"use strict";exports.id=317,exports.ids=[317],exports.modules={2445:e=>{e.exports={rE:"3.993.0"}},2840:(e,t,n)=>{n.d(t,{k:()=>S});var r=n(50469),i=n(69700);const s="(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)(?:[ne|u?r]?s?day)?",o="(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)",a="(\\d?\\d):(\\d{2}):(\\d{2})(?:\\.(\\d+))?",c="(\\d?\\d)",l="(\\d{4})",d=new RegExp(/^(\d{4})-(\d\d)-(\d\d)[tT](\d\d):(\d\d):(\d\d)(\.(\d+))?(([-+]\d\d:\d\d)|[zZ])$/),p=new RegExp(`^${s}, ${c} ${o} ${l} ${a} GMT$`),h=new RegExp(`^${s}, ${c}-${o}-(\\d\\d) ${a} GMT$`),u=new RegExp(`^${s} ${o} ( [1-9]|\\d\\d) ${a} ${l}$`),g=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"];function m(e,t,n){const r=Number(e);if(r<t||r>n)throw new Error(`Value ${r} out of range [${t}, ${n}]`)}var f=n(84651),x=n(70764),y=n(12544),b=n(2914),E=n(63282),w=n(26144);class S extends E.f{settings;constructor(e){super(),this.settings=e}read(e,t){const n=r.l.of(e);if(n.isListSchema())return(0,i.G)(t).map(e=>this.read(n.getValueSchema(),e));if(n.isBlobSchema())return(this.serdeContext?.base64Decoder??y.E)(t);if(n.isTimestampSchema())switch((0,w.V)(n,this.settings)){case 5:return(e=>{if(null==e)return;if("string"!=typeof e)throw new TypeError("RFC3339 timestamps must be strings");const t=d.exec(e);if(!t)throw new TypeError(`Invalid RFC3339 timestamp format ${e}`);const[,n,r,i,s,o,a,,c,l]=t;m(r,1,12),m(i,1,31),m(s,0,23),m(o,0,59),m(a,0,60);const p=new Date(Date.UTC(Number(n),Number(r)-1,Number(i),Number(s),Number(o),Number(a),Number(c)?Math.round(1e3*parseFloat(`0.${c}`)):0));if(p.setUTCFullYear(Number(n)),"Z"!=l.toUpperCase()){const[,e,t,n]=/([+-])(\d\d):(\d\d)/.exec(l)||[void 0,"+",0,0],r="-"===e?1:-1;p.setTime(p.getTime()+r*(60*Number(t)*60*1e3+60*Number(n)*1e3))}return p})(t);case 6:return(e=>{if(null==e)return;if("string"!=typeof e)throw new TypeError("RFC7231 timestamps must be strings.");let t,n,r,i,s,o,a,c;if((c=p.exec(e))?[,t,n,r,i,s,o,a]=c:(c=h.exec(e))?([,t,n,r,i,s,o,a]=c,r=(Number(r)+1900).toString()):(c=u.exec(e))&&([,n,t,i,s,o,a,r]=c),r&&o){const e=Date.UTC(Number(r),g.indexOf(n),Number(t),Number(i),Number(s),Number(o),a?Math.round(1e3*parseFloat(`0.${a}`)):0);m(t,1,31),m(i,0,23),m(s,0,59),m(o,0,60);const c=new Date(e);return c.setUTCFullYear(Number(r)),c}throw new TypeError(`Invalid RFC7231 date-time value ${e}.`)})(t);case 7:return(e=>{if(null==e)return;let t=NaN;if("number"==typeof e)t=e;else if("string"==typeof e){if(!/^-?\d*\.?\d+$/.test(e))throw new TypeError("parseEpochTimestamp - numeric string invalid.");t=Number.parseFloat(e)}else"object"==typeof e&&1===e.tag&&(t=e.value);if(isNaN(t)||Math.abs(t)===1/0)throw new TypeError("Epoch timestamps must be valid finite numbers.");return new Date(Math.round(1e3*t))})(t);default:return console.warn("Missing timestamp format, parsing value with Date constructor:",t),new Date(t)}if(n.isStringSchema()){const e=n.getMergedTraits().mediaType;let r=t;if(e)return n.getMergedTraits().httpHeader&&(r=this.base64ToUtf8(r)),("application/json"===e||e.endsWith("+json"))&&(r=f.A.from(r)),r}return n.isNumericSchema()?Number(t):n.isBigIntegerSchema()?BigInt(t):n.isBigDecimalSchema()?new x.D(t,"bigDecimal"):n.isBooleanSchema()?"true"===String(t).toLowerCase():t}base64ToUtf8(e){return(this.serdeContext?.utf8Encoder??b.P)((this.serdeContext?.base64Decoder??y.E)(e))}}},14433:(e,t,n)=>{n.d(t,{m:()=>r});class r{async sign(e,t,n){return e}}},30259:(e,t,n)=>{function r(e){return encodeURIComponent(e).replace(/[!'()*]/g,function(e){return"%"+e.charCodeAt(0).toString(16).toUpperCase()})}n.d(t,{$:()=>r})},69700:(e,t,n)=>{n.d(t,{G:()=>r});const r=e=>{const t=e.length,n=[];let r,i=!1,s=0;for(let o=0;o<t;++o){const t=e[o];switch(t){case'"':"\\"!==r&&(i=!i);break;case",":i||(n.push(e.slice(s,o)),s=o+1)}r=t}return n.push(e.slice(s)),n.map(e=>{const t=(e=e.trim()).length;return t<2?e:('"'===e[0]&&'"'===e[t-1]&&(e=e.slice(1,t-1)),e.replace(/\\"/g,'"'))})}},79317:(e,t,n)=>{n.d(t,{getDefaultRoleAssumer:()=>ai,getDefaultRoleAssumerWithWebIdentity:()=>ci});var r=n(53347),i=n(96901),s=n(7387);const o=!1;var a=n(66686),c=n(22869);const l={UseGlobalEndpoint:{type:"builtInParams",name:"useGlobalEndpoint"},UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}};var d=n(51453),p=n(6723);class h extends p.T{constructor(e){super(e),Object.setPrototypeOf(this,h.prototype)}}class u extends h{name="ExpiredTokenException";$fault="client";constructor(e){super({name:"ExpiredTokenException",$fault:"client",...e}),Object.setPrototypeOf(this,u.prototype)}}class g extends h{name="MalformedPolicyDocumentException";$fault="client";constructor(e){super({name:"MalformedPolicyDocumentException",$fault:"client",...e}),Object.setPrototypeOf(this,g.prototype)}}class m extends h{name="PackedPolicyTooLargeException";$fault="client";constructor(e){super({name:"PackedPolicyTooLargeException",$fault:"client",...e}),Object.setPrototypeOf(this,m.prototype)}}class f extends h{name="RegionDisabledException";$fault="client";constructor(e){super({name:"RegionDisabledException",$fault:"client",...e}),Object.setPrototypeOf(this,f.prototype)}}class x extends h{name="IDPRejectedClaimException";$fault="client";constructor(e){super({name:"IDPRejectedClaimException",$fault:"client",...e}),Object.setPrototypeOf(this,x.prototype)}}class y extends h{name="InvalidIdentityTokenException";$fault="client";constructor(e){super({name:"InvalidIdentityTokenException",$fault:"client",...e}),Object.setPrototypeOf(this,y.prototype)}}class b extends h{name="IDPCommunicationErrorException";$fault="client";constructor(e){super({name:"IDPCommunicationErrorException",$fault:"client",...e}),Object.setPrototypeOf(this,b.prototype)}}const E="AssumedRoleUser",w="Credentials",S="DurationSeconds",v="Policy",N="PolicyArns",T="PackedPolicySize",A="RoleArn",C="RoleSessionName",I="SourceIdentity",$="awsQueryError",_="client",P="error",k="httpError",D="message",R="smithy.ts.sdk.synthetic.com.amazonaws.sts",O="com.amazonaws.sts",j=d.O.for(R);var M=[-3,R,"STSServiceException",0,[],[]];j.registerError(M,h);const L=d.O.for(O);var V=[-3,O,"ExpiredTokenException",{[$]:["ExpiredTokenException",400],[P]:_,[k]:400},[D],[0]];L.registerError(V,u);var U=[-3,O,"IDPCommunicationErrorException",{[$]:["IDPCommunicationError",400],[P]:_,[k]:400},[D],[0]];L.registerError(U,b);var q=[-3,O,"IDPRejectedClaimException",{[$]:["IDPRejectedClaim",403],[P]:_,[k]:403},[D],[0]];L.registerError(q,x);var F=[-3,O,"InvalidIdentityTokenException",{[$]:["InvalidIdentityToken",400],[P]:_,[k]:400},[D],[0]];L.registerError(F,y);var W=[-3,O,"MalformedPolicyDocumentException",{[$]:["MalformedPolicyDocument",400],[P]:_,[k]:400},[D],[0]];L.registerError(W,g);var z=[-3,O,"PackedPolicyTooLargeException",{[$]:["PackedPolicyTooLarge",400],[P]:_,[k]:400},[D],[0]];L.registerError(z,m);var B=[-3,O,"RegionDisabledException",{[$]:["RegionDisabledException",403],[P]:_,[k]:403},[D],[0]];L.registerError(B,f);const K=[j,L];var G=[0,O,"accessKeySecretType",8,0],H=[0,O,"clientTokenType",8,0],X=[3,O,E,0,["AssumedRoleId","Arn"],[0,0],2],Q=[3,O,"AssumeRoleRequest",0,[A,C,N,v,S,"Tags","TransitiveTagKeys","ExternalId","SerialNumber","TokenCode",I,"ProvidedContexts"],[0,0,()=>ie,0,1,()=>oe,64,0,0,0,0,()=>se],2],Y=[3,O,"AssumeRoleResponse",0,[w,E,T,I],[[()=>ee,0],()=>X,1,0]],Z=[3,O,"AssumeRoleWithWebIdentityRequest",0,[A,C,"WebIdentityToken","ProviderId",N,v,S],[0,0,[()=>H,0],0,()=>ie,0,1],3],J=[3,O,"AssumeRoleWithWebIdentityResponse",0,[w,"SubjectFromWebIdentityToken",E,T,"Provider","Audience",I],[[()=>ee,0],0,()=>X,1,0,0,0]],ee=[3,O,w,0,["AccessKeyId","SecretAccessKey","SessionToken","Expiration"],[0,[()=>G,0],0,4],4],te=[3,O,"PolicyDescriptorType",0,["arn"],[0]],ne=[3,O,"ProvidedContext",0,["ProviderArn","ContextAssertion"],[0,0]],re=[3,O,"Tag",0,["Key","Value"],[0,0],2],ie=[1,O,"policyDescriptorListType",0,()=>te],se=[1,O,"ProvidedContextsListType",0,()=>ne],oe=[1,O,"tagListType",0,()=>re],ae=[9,O,"AssumeRole",0,()=>Q,()=>Y],ce=[9,O,"AssumeRoleWithWebIdentity",0,()=>Z,()=>J];class le extends(c.u.classBuilder().ep(l).m(function(e,t,n,r){return[(0,a.r)(n,e.getEndpointParameterInstructions())]}).s("AWSSecurityTokenServiceV20110615","AssumeRole",{}).n("STSClient","AssumeRoleCommand").sc(ae).build()){}class de extends(c.u.classBuilder().ep(l).m(function(e,t,n,r){return[(0,a.r)(n,e.getEndpointParameterInstructions())]}).s("AWSSecurityTokenServiceV20110615","AssumeRoleWithWebIdentity",{}).n("STSClient","AssumeRoleWithWebIdentityCommand").sc(ce).build()){}const pe=e=>{if("string"==typeof e?.Arn){const t=e.Arn.split(":");if(t.length>4&&""!==t[4])return t[4]}},he=async(e,t,n,r={})=>{const a="function"==typeof e?await e():e,c="function"==typeof t?await t():t;let l="";const d=a??c??(l=await function(e={}){return(0,s.Z)({...i.GG,default:async()=>(o||console.warn("@aws-sdk - WARN - default STS region of us-east-1 used. See @aws-sdk/credential-providers README and set a region explicitly."),"us-east-1")},{...i.zH,...e})}(r)());return n?.debug?.("@aws-sdk/client-sts::resolveRegion","accepting first of:",`${a} (credential provider clientConfig)`,`${c} (contextual client)`,`${l} (STS default: AWS_REGION, profile region, or us-east-1)`),d},ue=e=>"h2"===e?.metadata?.handlerProtocol;var ge=n(97040),me=n(74534),fe=n(70775),xe=n(5572),ye=n(61019),be=n(94615),Ee=n(45326),we=n(9575),Se=n(68249),ve=n(75279),Ne=n(10860),Te=n(39412),Ae=n(72084),Ce=n(10773),Ie=n(9942),$e=n(23870),_e=n(45547),Pe=n(81974);const ke=async(e,t,n)=>({operation:(0,_e.u)(t).operation,region:await(0,Pe.t)(e.region)()||(()=>{throw new Error("expected `region` to be configured for `aws.auth#sigv4`")})()}),De=e=>{const t=[];return"AssumeRoleWithWebIdentity"===e.operation?t.push({schemeId:"smithy.api#noAuth"}):t.push(function(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"sts",region:e.region},propertiesExtractor:(e,t)=>({signingProperties:{config:e,context:t}})}}(e)),t};var Re=n(2445),Oe=n(17479),je=n(96965),Me=n(17357),Le=n(17914),Ve=n(5882),Ue=n(24661),qe=n(46109),Fe=n(14433),We=n(5012),ze=n(24176),Be=n(64327),Ke=n(34338),Ge=n(57815),He=n(55425),Xe=n(99816),Qe=n(48828),Ye=n(63139),Ze=n(78607),Je=n(59772),et=n(50469),tt=n(28075);const nt=":A-Za-z_\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD",rt=new RegExp("^["+nt+"]["+nt+"\\-.\\d\\u00B7\\u0300-\\u036F\\u203F-\\u2040]*$");function it(e,t){const n=[];let r=t.exec(e);for(;r;){const i=[];i.startIndex=t.lastIndex-r[0].length;const s=r.length;for(let e=0;e<s;e++)i.push(r[e]);n.push(i),r=t.exec(e)}return n}const st=function(e){return!(null==rt.exec(e))},ot=["hasOwnProperty","toString","valueOf","__defineGetter__","__defineSetter__","__lookupGetter__","__lookupSetter__"],at=["__proto__","constructor","prototype"],ct=e=>ot.includes(e)?"__"+e:e,lt={preserveOrder:!1,attributeNamePrefix:"@_",attributesGroupName:!1,textNodeName:"#text",ignoreAttributes:!0,removeNSPrefix:!1,allowBooleanAttributes:!1,parseTagValue:!0,parseAttributeValue:!1,trimValues:!0,cdataPropName:!1,numberParseOptions:{hex:!0,leadingZeros:!0,eNotation:!0,unicode:!1},tagValueProcessor:function(e,t){return t},attributeValueProcessor:function(e,t){return t},stopNodes:[],alwaysCreateTextNode:!1,isArray:()=>!1,commentPropName:!1,unpairedTags:[],processEntities:!0,htmlEntities:!1,entityDecoder:null,ignoreDeclaration:!1,ignorePiTags:!1,transformTagName:!1,transformAttributeName:!1,updateTag:function(e,t,n){return e},captureMetaData:!1,maxNestedTags:100,strictReservedNames:!0,jPath:!0,onDangerousProperty:ct};function dt(e,t){if("string"!=typeof e)return;const n=e.toLowerCase();if(ot.some(e=>n===e.toLowerCase()))throw new Error(`[SECURITY] Invalid ${t}: "${e}" is a reserved JavaScript keyword that could cause prototype pollution`);if(at.some(e=>n===e.toLowerCase()))throw new Error(`[SECURITY] Invalid ${t}: "${e}" is a reserved JavaScript keyword that could cause prototype pollution`)}function pt(e,t){return"boolean"==typeof e?{enabled:e,maxEntitySize:1e4,maxExpansionDepth:1e4,maxTotalExpansions:1/0,maxExpandedLength:1e5,maxEntityCount:1e3,allowedTags:null,tagFilter:null,appliesTo:"all"}:"object"==typeof e&&null!==e?{enabled:!1!==e.enabled,maxEntitySize:Math.max(1,e.maxEntitySize??1e4),maxExpansionDepth:Math.max(1,e.maxExpansionDepth??1e4),maxTotalExpansions:Math.max(1,e.maxTotalExpansions??1/0),maxExpandedLength:Math.max(1,e.maxExpandedLength??1e5),maxEntityCount:Math.max(1,e.maxEntityCount??1e3),allowedTags:e.allowedTags??null,tagFilter:e.tagFilter??null,appliesTo:e.appliesTo??"all"}:pt(!0)}const ht=function(e){const t=Object.assign({},lt,e),n=[{value:t.attributeNamePrefix,name:"attributeNamePrefix"},{value:t.attributesGroupName,name:"attributesGroupName"},{value:t.textNodeName,name:"textNodeName"},{value:t.cdataPropName,name:"cdataPropName"},{value:t.commentPropName,name:"commentPropName"}];for(const{value:e,name:t}of n)e&&dt(e,t);return null===t.onDangerousProperty&&(t.onDangerousProperty=ct),t.processEntities=pt(t.processEntities,t.htmlEntities),t.unpairedTagsSet=new Set(t.unpairedTags),t.stopNodes&&Array.isArray(t.stopNodes)&&(t.stopNodes=t.stopNodes.map(e=>"string"==typeof e&&e.startsWith("*.")?".."+e.substring(2):e)),t};let ut;ut="function"!=typeof Symbol?"@@xmlMetadata":Symbol("XML Node Metadata");class gt{constructor(e){this.tagname=e,this.child=[],this[":@"]=Object.create(null)}add(e,t){"__proto__"===e&&(e="#__proto__"),this.child.push({[e]:t})}addChild(e,t){"__proto__"===e.tagname&&(e.tagname="#__proto__"),e[":@"]&&Object.keys(e[":@"]).length>0?this.child.push({[e.tagname]:e.child,":@":e[":@"]}):this.child.push({[e.tagname]:e.child}),void 0!==t&&(this.child[this.child.length-1][ut]={startIndex:t})}static getMetaDataSymbol(){return ut}}const mt=":A-Za-z_À-ÖØ-öø-˿Ͱ-ͽͿ-҆҈-῿‌-‍⁰-↏Ⰰ-⿯、-퟿豈-﷏ﷰ-�",ft=":A-Za-z_À-˿Ͱ-ͽͿ-҆҈-῿‌-‍⁰-↏Ⰰ-⿯、-퟿豈-﷏ﷰ-�𐀀-󯿿",xt=ft+"\\-\\.\\d·̀-ͯ҇‿-⁀",yt=(e,t,n="")=>{const r=`[${e.replace(":","")}][${t.replace(":","")}]*`;return{name:new RegExp(`^[${e}][${t}]*$`,n),ncName:new RegExp(`^${r}$`,n),qName:new RegExp(`^${r}(?::${r})?$`,n),nmToken:new RegExp(`^[${t}]+$`,n),nmTokens:new RegExp(`^[${t}]+(?:\\s+[${t}]+)*$`,n)}},bt=yt(mt,mt+"\\-\\.\\d·̀-ͯ‿-⁀"),Et=yt(ft,xt,"u"),wt=(e,{xmlVersion:t="1.0"}={})=>((e="1.0")=>"1.1"===e?Et:bt)(t).qName.test(e);class St{constructor(e,t){this.suppressValidationErr=!e,this.options=e,this.xmlVersion=t||1}setXmlVersion(e=1){this.xmlVersion=e}readDocType(e,t){const n=Object.create(null);let r=0;if("O"!==e[t+3]||"C"!==e[t+4]||"T"!==e[t+5]||"Y"!==e[t+6]||"P"!==e[t+7]||"E"!==e[t+8])throw new Error("Invalid Tag instead of DOCTYPE");{t+=9;let i=1,s=!1,o=!1,a="";for(;t<e.length;t++)if("<"!==e[t]||o)if(">"===e[t]){if(o?"-"===e[t-1]&&"-"===e[t-2]&&(o=!1,i--):i--,0===i)break}else"["===e[t]?s=!0:a+=e[t];else{if(s&&Nt(e,"!ENTITY",t)){let i,s;if(t+=7,[i,s,t]=this.readEntityExp(e,t+1,this.suppressValidationErr),-1===s.indexOf("&")){if(!1!==this.options.enabled&&null!=this.options.maxEntityCount&&r>=this.options.maxEntityCount)throw new Error(`Entity count (${r+1}) exceeds maximum allowed (${this.options.maxEntityCount})`);n[i]=s,r++}}else if(s&&Nt(e,"!ELEMENT",t)){t+=8;const{index:n}=this.readElementExp(e,t+1);t=n}else if(s&&Nt(e,"!ATTLIST",t))t+=8;else if(s&&Nt(e,"!NOTATION",t)){t+=9;const{index:n}=this.readNotationExp(e,t+1,this.suppressValidationErr);t=n}else{if(!Nt(e,"!--",t))throw new Error("Invalid DOCTYPE");o=!0}i++,a=""}if(0!==i)throw new Error("Unclosed DOCTYPE")}return{entities:n,i:t}}readEntityExp(e,t){const n=t=vt(e,t);for(;t<e.length&&!/\s/.test(e[t])&&'"'!==e[t]&&"'"!==e[t];)t++;let r=e.substring(n,t);if(Tt(r,{xmlVersion:this.xmlVersion}),t=vt(e,t),!this.suppressValidationErr){if("SYSTEM"===e.substring(t,t+6).toUpperCase())throw new Error("External entities are not supported");if("%"===e[t])throw new Error("Parameter entities are not supported")}let i="";if([t,i]=this.readIdentifierVal(e,t,"entity"),!1!==this.options.enabled&&null!=this.options.maxEntitySize&&i.length>this.options.maxEntitySize)throw new Error(`Entity "${r}" size (${i.length}) exceeds maximum allowed size (${this.options.maxEntitySize})`);return[r,i,--t]}readNotationExp(e,t){const n=t=vt(e,t);for(;t<e.length&&!/\s/.test(e[t]);)t++;let r=e.substring(n,t);!this.suppressValidationErr&&Tt(r,{xmlVersion:this.xmlVersion}),t=vt(e,t);const i=e.substring(t,t+6).toUpperCase();if(!this.suppressValidationErr&&"SYSTEM"!==i&&"PUBLIC"!==i)throw new Error(`Expected SYSTEM or PUBLIC, found "${i}"`);t+=i.length,t=vt(e,t);let s=null,o=null;if("PUBLIC"===i)[t,s]=this.readIdentifierVal(e,t,"publicIdentifier"),'"'!==e[t=vt(e,t)]&&"'"!==e[t]||([t,o]=this.readIdentifierVal(e,t,"systemIdentifier"));else if("SYSTEM"===i&&([t,o]=this.readIdentifierVal(e,t,"systemIdentifier"),!this.suppressValidationErr&&!o))throw new Error("Missing mandatory system identifier for SYSTEM notation");return{notationName:r,publicIdentifier:s,systemIdentifier:o,index:--t}}readIdentifierVal(e,t,n){let r="";const i=e[t];if('"'!==i&&"'"!==i)throw new Error(`Expected quoted string, found "${i}"`);const s=++t;for(;t<e.length&&e[t]!==i;)t++;if(r=e.substring(s,t),e[t]!==i)throw new Error(`Unterminated ${n} value`);return[++t,r]}readElementExp(e,t){const n=t=vt(e,t);for(;t<e.length&&!/\s/.test(e[t]);)t++;let r=e.substring(n,t);if(!this.suppressValidationErr&&!wt(r,{xmlVersion:this.xmlVersion}))throw new Error(`Invalid element name: "${r}"`);let i="";if("E"===e[t=vt(e,t)]&&Nt(e,"MPTY",t))t+=4;else if("A"===e[t]&&Nt(e,"NY",t))t+=2;else if("("===e[t]){const n=++t;for(;t<e.length&&")"!==e[t];)t++;if(i=e.substring(n,t),")"!==e[t])throw new Error("Unterminated content model")}else if(!this.suppressValidationErr)throw new Error(`Invalid Element Expression, found "${e[t]}"`);return{elementName:r,contentModel:i.trim(),index:t}}readAttlistExp(e,t){let n=t=vt(e,t);for(;t<e.length&&!/\s/.test(e[t]);)t++;let r=e.substring(n,t);for(Tt(r,{xmlVersion:this.xmlVersion}),n=t=vt(e,t);t<e.length&&!/\s/.test(e[t]);)t++;let i=e.substring(n,t);if(!Tt(i,{xmlVersion:this.xmlVersion}))throw new Error(`Invalid attribute name: "${i}"`);t=vt(e,t);let s="";if("NOTATION"===e.substring(t,t+8).toUpperCase()){if(s="NOTATION","("!==e[t=vt(e,t+=8)])throw new Error(`Expected '(', found "${e[t]}"`);t++;let n=[];for(;t<e.length&&")"!==e[t];){const r=t;for(;t<e.length&&"|"!==e[t]&&")"!==e[t];)t++;let i=e.substring(r,t);if(i=i.trim(),!Tt(i,{xmlVersion:this.xmlVersion}))throw new Error(`Invalid notation name: "${i}"`);n.push(i),"|"===e[t]&&(t++,t=vt(e,t))}if(")"!==e[t])throw new Error("Unterminated list of notations");t++,s+=" ("+n.join("|")+")"}else{const n=t;for(;t<e.length&&!/\s/.test(e[t]);)t++;s+=e.substring(n,t);const r=["CDATA","ID","IDREF","IDREFS","ENTITY","ENTITIES","NMTOKEN","NMTOKENS"];if(!this.suppressValidationErr&&!r.includes(s.toUpperCase()))throw new Error(`Invalid attribute type: "${s}"`)}t=vt(e,t);let o="";return"#REQUIRED"===e.substring(t,t+8).toUpperCase()?(o="#REQUIRED",t+=8):"#IMPLIED"===e.substring(t,t+7).toUpperCase()?(o="#IMPLIED",t+=7):[t,o]=this.readIdentifierVal(e,t,"ATTLIST"),{elementName:r,attributeName:i,attributeType:s,defaultValue:o,index:t}}}const vt=(e,t)=>{for(;t<e.length&&/\s/.test(e[t]);)t++;return t};function Nt(e,t,n){for(let r=0;r<t.length;r++)if(t[r]!==e[n+r+1])return!1;return!0}function Tt(e,t){if(wt(e,{xmlVersion:t}))return e;throw new Error(`Invalid entity name ${e}`)}const At=[48,1632,1776,2406,2534,2662,2790,2918,3046,3174,3302,3430,3558,3664,3792,3872,4160,4240,6112,6160,6470,6608,6784,6800,6992,7088,7232,7248,65296,120782,120792,120802,120812,120822,66720,68912,69734,69872,69942,70096,70384,70736,70864,71248,71360,71472,71904,72016,72688,72784,73040,73120,73552,92768,92864,93008,123200,123632,124144,125264,130032],Ct=new Map,It=1632,$t=new Uint8Array(63904).fill(255);for(const e of At)for(let t=0;t<10;t++){const n=e+t;n<=65535?$t[n-It]=t:Ct.set(n,t)}const _t=new Set([8722,65293,65123]),Pt=/^[-+]?0x[a-fA-F0-9]+$/,kt=/^0b[01]+$/,Dt=/^0o[0-7]+$/,Rt=/^([\-\+])?(0*)([0-9]*(\.[0-9]*)?)$/,Ot={hex:!0,binary:!1,octal:!1,leadingZeros:!0,decimalPoint:".",eNotation:!0,infinity:"original",unicode:!1};function jt(e,t={}){if(t=Object.assign({},Ot,t),!e||"string"!=typeof e)return e;let n=e.trim();if(0===n.length)return e;if(void 0!==t.skipLike&&t.skipLike.test(n))return e;if("0"===n)return 0;if(t.unicode&&(n=function(e){if("string"!=typeof e)return e;const t=e.length;if(0===t)return e;let n=-1;for(let r=0;r<t;r++){const i=e.charCodeAt(r);if(!(i>=48&&i<=57||45===i))if(i<It){if(_t.has(i)){n=r;break}}else if(i>=55296&&i<=56319){if(r+1<t){const t=e.charCodeAt(r+1);if(t>=56320&&t<=57343){const e=65536+(i-55296<<10)+(t-56320);if(Ct.has(e)){n=r;break}}}}else if(255!==$t[i-It]||_t.has(i)){n=r;break}}if(-1===n)return e;const r=[];n>0&&r.push(e.slice(0,n));for(let i=n;i<t;i++){const n=e.charCodeAt(i);if(n>=48&&n<=57||45===n){r.push(e[i]);continue}if(n<It){r.push(_t.has(n)?"-":e[i]);continue}if(n>=55296&&n<=56319){if(i+1<t){const t=e.charCodeAt(i+1);if(t>=56320&&t<=57343){const e=65536+(n-55296<<10)+(t-56320),s=Ct.get(e);if(void 0!==s){r.push(String.fromCharCode(s+48)),i++;continue}}}r.push(e[i]);continue}if(_t.has(n)){r.push("-");continue}const s=$t[n-It];r.push(255!==s?String.fromCharCode(s+48):e[i])}return r.join("")}(n),"0"===n))return 0;if(t.hex&&Pt.test(n))return Lt(n,16);if(t.binary&&kt.test(n))return Lt(n,2);if(t.octal&&Dt.test(n))return Lt(n,8);if(isFinite(n)){if(n.includes("e")||n.includes("E"))return function(e,t,n){if(!n.eNotation)return e;const r=t.match(Mt);if(r){let i=r[1]||"";const s=-1===r[3].indexOf("e")?"E":"e",o=r[2],a=i?e[o.length+1]===s:e[o.length]===s;return o.length>1&&a?e:(1!==o.length||!r[3].startsWith(`.${s}`)&&r[3][0]!==s)&&o.length>0?n.leadingZeros&&!a?(t=(r[1]||"")+r[3],Number(t)):e:Number(t)}return e}(e,n,t);{const i=Rt.exec(n);if(i){const s=i[1]||"",o=i[2];let a=(r=i[3])&&-1!==r.indexOf(".")?("."===(r=r.replace(/0+$/,""))?r="0":"."===r[0]?r="0"+r:"."===r[r.length-1]&&(r=r.substring(0,r.length-1)),r):r;const c=s?"."===e[o.length+1]:"."===e[o.length];if(!t.leadingZeros&&(o.length>1||1===o.length&&!c))return e;{const r=Number(n),i=String(r);if(0===r)return r;if(-1!==i.search(/[eE]/))return t.eNotation?r:e;if(-1!==n.indexOf("."))return"0"===i||i===a||i===`${s}${a}`?r:e;let c=o?a:n;return o?c===i||s+c===i?r:e:c===i||c===s+i?r:e}}return e}}var r;return function(e,t,n){const r=t===1/0;switch(n.infinity.toLowerCase()){case"null":return null;case"infinity":return t;case"string":return r?"Infinity":"-Infinity";default:return e}}(e,Number(n),t)}const Mt=/^([-+])?(0*)(\d*(\.\d*)?[eE][-\+]?\d+)$/;function Lt(e,t){const n=e.trim();if(2!==t&&8!==t||(e=n.substring(2)),parseInt)return parseInt(e,t);if(Number.parseInt)return Number.parseInt(e,t);if(window&&window.parseInt)return window.parseInt(e,t);throw new Error("parseInt, Number.parseInt, window.parseInt are not supported")}class Vt{constructor(e){this._matcher=e}get separator(){return this._matcher.separator}getCurrentTag(){const e=this._matcher.path;return e.length>0?e[e.length-1].tag:void 0}getCurrentNamespace(){const e=this._matcher.path;return e.length>0?e[e.length-1].namespace:void 0}getAttrValue(e){const t=this._matcher.path;if(0!==t.length)return t[t.length-1].values?.[e]}hasAttr(e){const t=this._matcher.path;if(0===t.length)return!1;const n=t[t.length-1];return void 0!==n.values&&e in n.values}getPosition(){const e=this._matcher.path;return 0===e.length?-1:e[e.length-1].position??0}getCounter(){const e=this._matcher.path;return 0===e.length?-1:e[e.length-1].counter??0}getIndex(){return this.getPosition()}getDepth(){return this._matcher.path.length}toString(e,t=!0){return this._matcher.toString(e,t)}toArray(){return this._matcher.path.map(e=>e.tag)}matches(e){return this._matcher.matches(e)}matchesAny(e){return e.matchesAny(this._matcher)}}class Ut{constructor(e={}){this.separator=e.separator||".",this.path=[],this.siblingStacks=[],this._pathStringCache=null,this._view=new Vt(this)}push(e,t=null,n=null){this._pathStringCache=null,this.path.length>0&&(this.path[this.path.length-1].values=void 0);const r=this.path.length;this.siblingStacks[r]||(this.siblingStacks[r]=new Map);const i=this.siblingStacks[r],s=n?`${n}:${e}`:e,o=i.get(s)||0;let a=0;for(const e of i.values())a+=e;i.set(s,o+1);const c={tag:e,position:a,counter:o};null!=n&&(c.namespace=n),null!=t&&(c.values=t),this.path.push(c)}pop(){if(0===this.path.length)return;this._pathStringCache=null;const e=this.path.pop();return this.siblingStacks.length>this.path.length+1&&(this.siblingStacks.length=this.path.length+1),e}updateCurrent(e){if(this.path.length>0){const t=this.path[this.path.length-1];null!=e&&(t.values=e)}}getCurrentTag(){return this.path.length>0?this.path[this.path.length-1].tag:void 0}getCurrentNamespace(){return this.path.length>0?this.path[this.path.length-1].namespace:void 0}getAttrValue(e){if(0!==this.path.length)return this.path[this.path.length-1].values?.[e]}hasAttr(e){if(0===this.path.length)return!1;const t=this.path[this.path.length-1];return void 0!==t.values&&e in t.values}getPosition(){return 0===this.path.length?-1:this.path[this.path.length-1].position??0}getCounter(){return 0===this.path.length?-1:this.path[this.path.length-1].counter??0}getIndex(){return this.getPosition()}getDepth(){return this.path.length}toString(e,t=!0){const n=e||this.separator;if(n===this.separator&&!0===t){if(null!==this._pathStringCache)return this._pathStringCache;const e=this.path.map(e=>e.namespace?`${e.namespace}:${e.tag}`:e.tag).join(n);return this._pathStringCache=e,e}return this.path.map(e=>t&&e.namespace?`${e.namespace}:${e.tag}`:e.tag).join(n)}toArray(){return this.path.map(e=>e.tag)}reset(){this._pathStringCache=null,this.path=[],this.siblingStacks=[]}matches(e){const t=e.segments;return 0!==t.length&&(e.hasDeepWildcard()?this._matchWithDeepWildcard(t):this._matchSimple(t))}_matchSimple(e){if(this.path.length!==e.length)return!1;for(let t=0;t<e.length;t++)if(!this._matchSegment(e[t],this.path[t],t===this.path.length-1))return!1;return!0}_matchWithDeepWildcard(e){let t=this.path.length-1,n=e.length-1;for(;n>=0&&t>=0;){const r=e[n];if("deep-wildcard"===r.type){if(n--,n<0)return!0;const r=e[n];let i=!1;for(let e=t;e>=0;e--)if(this._matchSegment(r,this.path[e],e===this.path.length-1)){t=e-1,n--,i=!0;break}if(!i)return!1}else{if(!this._matchSegment(r,this.path[t],t===this.path.length-1))return!1;t--,n--}}return n<0}_matchSegment(e,t,n){if("*"!==e.tag&&e.tag!==t.tag)return!1;if(void 0!==e.namespace&&"*"!==e.namespace&&e.namespace!==t.namespace)return!1;if(void 0!==e.attrName){if(!n)return!1;if(!t.values||!(e.attrName in t.values))return!1;if(void 0!==e.attrValue&&String(t.values[e.attrName])!==String(e.attrValue))return!1}if(void 0!==e.position){if(!n)return!1;const r=t.counter??0;if("first"===e.position&&0!==r)return!1;if("odd"===e.position&&r%2!=1)return!1;if("even"===e.position&&r%2!=0)return!1;if("nth"===e.position&&r!==e.positionValue)return!1}return!0}matchesAny(e){return e.matchesAny(this)}snapshot(){return{path:this.path.map(e=>({...e})),siblingStacks:this.siblingStacks.map(e=>new Map(e))}}restore(e){this._pathStringCache=null,this.path=e.path.map(e=>({...e})),this.siblingStacks=e.siblingStacks.map(e=>new Map(e))}readOnly(){return this._view}}class qt{constructor(e,t={},n){this.pattern=e,this.separator=t.separator||".",this.segments=this._parse(e),this.data=n,this._hasDeepWildcard=this.segments.some(e=>"deep-wildcard"===e.type),this._hasAttributeCondition=this.segments.some(e=>void 0!==e.attrName),this._hasPositionSelector=this.segments.some(e=>void 0!==e.position)}_parse(e){const t=[];let n=0,r="";for(;n<e.length;)e[n]===this.separator?n+1<e.length&&e[n+1]===this.separator?(r.trim()&&(t.push(this._parseSegment(r.trim())),r=""),t.push({type:"deep-wildcard"}),n+=2):(r.trim()&&t.push(this._parseSegment(r.trim())),r="",n++):(r+=e[n],n++);return r.trim()&&t.push(this._parseSegment(r.trim())),t}_parseSegment(e){const t={type:"tag"};let n=null,r=e;const i=e.match(/^([^\[]+)(\[[^\]]*\])(.*)$/);if(i&&(r=i[1]+i[3],i[2])){const e=i[2].slice(1,-1);e&&(n=e)}let s,o,a=r;if(r.includes("::")){const t=r.indexOf("::");if(s=r.substring(0,t).trim(),a=r.substring(t+2).trim(),!s)throw new Error(`Invalid namespace in pattern: ${e}`)}let c=null;if(a.includes(":")){const e=a.lastIndexOf(":"),t=a.substring(0,e).trim(),n=a.substring(e+1).trim();["first","last","odd","even"].includes(n)||/^nth\(\d+\)$/.test(n)?(o=t,c=n):o=a}else o=a;if(!o)throw new Error(`Invalid segment pattern: ${e}`);if(t.tag=o,s&&(t.namespace=s),n)if(n.includes("=")){const e=n.indexOf("=");t.attrName=n.substring(0,e).trim(),t.attrValue=n.substring(e+1).trim()}else t.attrName=n.trim();if(c){const e=c.match(/^nth\((\d+)\)$/);e?(t.position="nth",t.positionValue=parseInt(e[1],10)):t.position=c}return t}get length(){return this.segments.length}hasDeepWildcard(){return this._hasDeepWildcard}hasAttributeCondition(){return this._hasAttributeCondition}hasPositionSelector(){return this._hasPositionSelector}toString(){return this.pattern}}class Ft{constructor(){this._byDepthAndTag=new Map,this._wildcardByDepth=new Map,this._deepWildcards=[],this._patterns=new Set,this._sealed=!1}add(e){if(this._sealed)throw new TypeError("ExpressionSet is sealed. Create a new ExpressionSet to add more expressions.");if(this._patterns.has(e.pattern))return this;if(this._patterns.add(e.pattern),e.hasDeepWildcard())return this._deepWildcards.push(e),this;const t=e.length,n=e.segments[e.segments.length-1],r=n?.tag;if(r&&"*"!==r){const n=`${t}:${r}`;this._byDepthAndTag.has(n)||this._byDepthAndTag.set(n,[]),this._byDepthAndTag.get(n).push(e)}else this._wildcardByDepth.has(t)||this._wildcardByDepth.set(t,[]),this._wildcardByDepth.get(t).push(e);return this}addAll(e){for(const t of e)this.add(t);return this}has(e){return this._patterns.has(e.pattern)}get size(){return this._patterns.size}seal(){return this._sealed=!0,this}get isSealed(){return this._sealed}matchesAny(e){return null!==this.findMatch(e)}findMatch(e){const t=e.getDepth(),n=`${t}:${e.getCurrentTag()}`,r=this._byDepthAndTag.get(n);if(r)for(let t=0;t<r.length;t++)if(e.matches(r[t]))return r[t];const i=this._wildcardByDepth.get(t);if(i)for(let t=0;t<i.length;t++)if(e.matches(i[t]))return i[t];for(let t=0;t<this._deepWildcards.length;t++)if(e.matches(this._deepWildcards[t]))return this._deepWildcards[t];return null}}const Wt={cent:"¢",pound:"£",curren:"¤",yen:"¥",euro:"€",dollar:"$",fnof:"ƒ",inr:"₹",af:"؋",birr:"ብር",peso:"₱",rub:"₽",won:"₩",yuan:"¥",cedil:"¸"},zt={amp:"&",apos:"'",gt:">",lt:"<",quot:'"'},Bt={nbsp:" ",copy:"©",reg:"®",trade:"™",mdash:"—",ndash:"–",hellip:"…",laquo:"«",raquo:"»",lsquo:"‘",rsquo:"’",ldquo:"“",rdquo:"”",bull:"•",para:"¶",sect:"§",deg:"°",frac12:"½",frac14:"¼",frac34:"¾"},Kt=Object.freeze({ALLOW:"allow",BLOCK:"block",THROW:"throw"}),Gt=new Set("!?\\\\/[]$%{}^&*()<>|+");function Ht(e){if("#"===e[0])throw new Error(`[EntityReplacer] Invalid character '#' in entity name: "${e}"`);for(const t of e)if(Gt.has(t))throw new Error(`[EntityReplacer] Invalid character '${t}' in entity name: "${e}"`);return e}function Xt(...e){const t=Object.create(null);for(const n of e)if(n)for(const e of Object.keys(n)){const r=n[e];if("string"==typeof r)t[e]=r;else if(r&&"object"==typeof r&&void 0!==r.val){const n=r.val;"string"==typeof n&&(t[e]=n)}}return t}const Qt="external",Yt="base",Zt="all",Jt=Object.freeze({allow:0,leave:1,remove:2,throw:3}),en=new Set([9,10,13]);class tn{constructor(e={}){var t;this._limit=e.limit||{},this._maxTotalExpansions=this._limit.maxTotalExpansions||0,this._maxExpandedLength=this._limit.maxExpandedLength||0,this._postCheck="function"==typeof e.postCheck?e.postCheck:e=>e,this._limitTiers=(t=this._limit.applyLimitsTo??Qt)&&t!==Qt?t===Zt?new Set([Zt]):t===Yt?new Set([Yt]):Array.isArray(t)?new Set(t):new Set([Qt]):new Set([Qt]),this._numericAllowed=e.numericAllowed??!0,this._baseMap=Xt(zt,e.namedEntities||null),this._externalMap=Object.create(null),this._inputMap=Object.create(null),this._totalExpansions=0,this._expandedLength=0,this._removeSet=new Set(e.remove&&Array.isArray(e.remove)?e.remove:[]),this._leaveSet=new Set(e.leave&&Array.isArray(e.leave)?e.leave:[]);const n=function(e){if(!e)return{xmlVersion:1,onLevel:Jt.allow,nullLevel:Jt.remove};const t=1.1===e.xmlVersion?1.1:1,n=Jt[e.onNCR]??Jt.allow,r=Jt[e.nullNCR]??Jt.remove;return{xmlVersion:t,onLevel:n,nullLevel:Math.max(r,Jt.remove)}}(e.ncr);this._ncrXmlVersion=n.xmlVersion,this._ncrOnLevel=n.onLevel,this._ncrNullLevel=n.nullLevel,this._onExternalEntity="function"==typeof e.onExternalEntity?e.onExternalEntity:null,this._onInputEntity="function"==typeof e.onInputEntity?e.onInputEntity:null}_applyRegistrationHook(e,t,n,r){if(!e)return!0;const i=e(t,n);if(i===Kt.BLOCK)return!1;if(i===Kt.THROW)throw new Error(`[EntityDecoder] Registration of ${r} entity "&${t};" was rejected by hook`);return!0}setExternalEntities(e){if(e)for(const t of Object.keys(e))Ht(t);if(!this._onExternalEntity)return void(this._externalMap=Xt(e));const t=Xt(e),n=Object.create(null);for(const[e,r]of Object.entries(t))this._applyRegistrationHook(this._onExternalEntity,e,r,"external")&&(n[e]=r);this._externalMap=n}addExternalEntity(e,t){Ht(e),"string"==typeof t&&-1===t.indexOf("&")&&this._applyRegistrationHook(this._onExternalEntity,e,t,"external")&&(this._externalMap[e]=t)}addInputEntities(e){if(this._totalExpansions=0,this._expandedLength=0,!this._onInputEntity)return void(this._inputMap=Xt(e));const t=Xt(e),n=Object.create(null);for(const[e,r]of Object.entries(t))this._applyRegistrationHook(this._onInputEntity,e,r,"input")&&(n[e]=r);this._inputMap=n}reset(){return this._inputMap=Object.create(null),this._totalExpansions=0,this._expandedLength=0,this}setXmlVersion(e){this._ncrXmlVersion=1.1===e?1.1:1}decode(e){if("string"!=typeof e||0===e.length)return e;if(-1===e.indexOf("&"))return e;const t=e,n=[],r=e.length;let i=0,s=0;const o=this._maxTotalExpansions>0,a=this._maxExpandedLength>0,c=o||a;for(;s<r;){if(38!==e.charCodeAt(s)){s++;continue}let t=s+1;for(;t<r&&59!==e.charCodeAt(t)&&t-s<=32;)t++;if(t>=r||59!==e.charCodeAt(t)){s++;continue}const l=e.slice(s+1,t);if(0===l.length){s++;continue}let d,p;if(this._removeSet.has(l))d="",void 0===p&&(p=Qt);else{if(this._leaveSet.has(l)){s++;continue}if(35===l.charCodeAt(0)){const e=this._resolveNCR(l);if(void 0===e){s++;continue}d=e,p=Yt}else{const e=this._resolveName(l);d=e?.value,p=e?.tier}}if(void 0!==d){if(s>i&&n.push(e.slice(i,s)),n.push(d),i=t+1,s=i,c&&this._tierCounts(p)){if(o&&(this._totalExpansions++,this._totalExpansions>this._maxTotalExpansions))throw new Error(`[EntityReplacer] Entity expansion count limit exceeded: ${this._totalExpansions} > ${this._maxTotalExpansions}`);if(a){const e=d.length-(l.length+2);if(e>0&&(this._expandedLength+=e,this._expandedLength>this._maxExpandedLength))throw new Error(`[EntityReplacer] Expanded content length limit exceeded: ${this._expandedLength} > ${this._maxExpandedLength}`)}}}else s++}i<r&&n.push(e.slice(i));const l=0===n.length?e:n.join("");return this._postCheck(l,t)}_tierCounts(e){return!!this._limitTiers.has(Zt)||this._limitTiers.has(e)}_resolveName(e){return e in this._inputMap?{value:this._inputMap[e],tier:Qt}:e in this._externalMap?{value:this._externalMap[e],tier:Qt}:e in this._baseMap?{value:this._baseMap[e],tier:Yt}:void 0}_classifyNCR(e){return 0===e?this._ncrNullLevel:e>=55296&&e<=57343||1===this._ncrXmlVersion&&e>=1&&e<=31&&!en.has(e)?Jt.remove:-1}_applyNCRAction(e,t,n){switch(e){case Jt.allow:return String.fromCodePoint(n);case Jt.remove:return"";case Jt.leave:return;case Jt.throw:throw new Error(`[EntityDecoder] Prohibited numeric character reference &${t}; (U+${n.toString(16).toUpperCase().padStart(4,"0")})`);default:return String.fromCodePoint(n)}}_resolveNCR(e){const t=e.charCodeAt(1);let n;if(n=120===t||88===t?parseInt(e.slice(2),16):parseInt(e.slice(1),10),Number.isNaN(n)||n<0||n>1114111)return;const r=this._classifyNCR(n);if(!this._numericAllowed&&r<Jt.remove)return;const i=-1===r?this._ncrOnLevel:Math.max(this._ncrOnLevel,r);return this._applyNCRAction(i,e,n)}}const nn=[{id:"sql-block-comment-open",description:"SQL block comment open: /* ... */ — unusual in legitimate user text",pattern:/\/\*/},{id:"sql-union-select",description:"UNION SELECT — most common SQL injection aggregation attack",pattern:/\bUNION\s{1,20}(?:ALL\s{1,20})?SELECT\b/i},{id:"sql-drop-table",description:"DROP TABLE — destructive DDL injection",pattern:/\bDROP\s{1,20}TABLE\b/i},{id:"sql-drop-database",description:"DROP DATABASE — destructive DDL injection",pattern:/\bDROP\s{1,20}DATABASE\b/i},{id:"sql-insert-into",description:"INSERT INTO — data injection",pattern:/\bINSERT\s{1,20}INTO\b/i},{id:"sql-delete-from",description:"DELETE FROM — data deletion injection",pattern:/\bDELETE\s{1,20}FROM\b/i},{id:"sql-update-set",description:"UPDATE ... SET — data modification injection",pattern:/\bUPDATE\b[\s\S]{1,60}\bSET\b/i},{id:"sql-exec-xp",description:"EXEC xp_ — MSSQL extended stored procedure execution",pattern:/\bEXEC(?:UTE)?\s{1,20}xp_/i},{id:"sql-tautology-string",description:'Classic string tautology: \' OR \'1\'=\'1 or " OR "1"="1"',pattern:/'\s{0,10}OR\s{0,10}'[^']{0,20}'\s*=\s*'[^']{0,20}/i},{id:"sql-tautology-numeric",description:"Numeric tautology: OR 1=1",pattern:/\bOR\s{1,10}1\s*=\s*1\b/i},{id:"sql-always-true-zero",description:"Numeric tautology: OR 0=0",pattern:/\bOR\s{1,10}0\s*=\s*0\b/i},{id:"sql-sleep-benchmark",description:"Time-based blind injection: SLEEP() or BENCHMARK()",pattern:/\b(?:SLEEP|BENCHMARK)\s*\(/i},{id:"sql-waitfor-delay",description:"MSSQL time-based blind injection: WAITFOR DELAY",pattern:/\bWAITFOR\s{1,20}DELAY\b/i},{id:"sql-char-function",description:"CHAR() function — used to obfuscate injected strings",pattern:/\bCHAR\s*\(\s*\d{1,3}/i},{id:"sql-information-schema",description:"INFORMATION_SCHEMA — reconnaissance query for table/column enumeration",pattern:/\bINFORMATION_SCHEMA\b/i}],rn="[\"'\\s]*:",sn={HTML:[{id:"html-script-open",description:"<script opening tag",pattern:/<script[\s>/]/i},{id:"html-script-close",description:"<\/script closing tag",pattern:/<\/script[\s>]/i},{id:"html-javascript-protocol",description:"javascript: URI scheme (with optional whitespace/encoding)",pattern:/j[\t\n\r ]*a[\t\n\r ]*v[\t\n\r ]*a[\t\n\r ]*s[\t\n\r ]*c[\t\n\r ]*r[\t\n\r ]*i[\t\n\r ]*p[\t\n\r ]*t[\t\n\r ]*:/i},{id:"html-vbscript-protocol",description:"vbscript: URI scheme",pattern:/vbscript[\t\n\r ]*:/i},{id:"html-data-html",description:"data:text/html URI — can execute scripts in browsers",pattern:/data[\t\n\r ]*:[\t\n\r ]*text\/html/i},{id:"html-data-xhtml",description:"data:application/xhtml+xml URI",pattern:/data[\t\n\r ]*:[\t\n\r ]*application\/xhtml/i},{id:"html-data-svg",description:"data:image/svg+xml URI — can execute scripts",pattern:/data[\t\n\r ]*:[\t\n\r ]*image\/svg\+xml/i},{id:"html-inline-event-handler",description:"Inline event handler attributes: onclick=, onerror=, onload=, etc.",pattern:/\bon\w{1,30}\s*=/i},{id:"html-entity-obfuscated-script",description:"HTML-entity-encoded <script (e.g. &#x3C;script or &lt;script)",pattern:/(?:&#x0*3[Cc];?|&#0*60;?|&lt;)\s*script/i},{id:"html-entity-obfuscated-javascript",description:'HTML-entity-encoded javascript: (partial — catches common &#106; or &#x6a; for "j")',pattern:/(?:&#x0*6[Aa];?|&#0*106;?)\s*(?:&#x0*61;?|a)[\s\S]{0,80}script\s*:/i},{id:"html-style-expression",description:"CSS expression() — IE-era code execution in style attributes",pattern:/style[\s\S]{0,20}expression\s*\(/i},{id:"html-object-embed",description:"<object or <embed tags that can load active content",pattern:/<(?:object|embed)[\s>/]/i},{id:"html-base-tag",description:"<base href= — can hijack all relative URLs on a page",pattern:/<base[\s>]/i},{id:"html-meta-refresh",description:'<meta http-equiv="refresh" — can redirect users',pattern:/<meta[\s\S]{0,40}http-equiv[\s\S]{0,20}refresh/i},{id:"html-srcdoc",description:"srcdoc= attribute on iframes — embeds HTML that can run scripts",pattern:/srcdoc\s*=/i},{id:"html-iframe",description:"<iframe tag",pattern:/<iframe[\s>/]/i},{id:"html-form",description:"<form tag — can be used for phishing / credential harvesting injection",pattern:/<form[\s>/]/i}],XML:[{id:"xml-cdata-injection",description:"CDATA section injection: <![CDATA[ breaks out of text node context",pattern:/<!\[CDATA\[/i},{id:"xml-cdata-close",description:"CDATA close sequence: ]]> can terminate an enclosing CDATA section",pattern:/\]\]>/},{id:"xml-processing-instruction",description:"XML processing instruction: <?xml-stylesheet or <?php etc.",pattern:/<\?(?:xml[\- ]|php|asp)/i},{id:"xml-doctype-injection",description:"DOCTYPE declaration embedded in content — can define entities",pattern:/<!DOCTYPE(?:[\s[]|$)/i},{id:"xml-entity-system",description:"SYSTEM keyword — used in external entity declarations (XXE)",pattern:/\bSYSTEM\s+["']/i},{id:"xml-entity-public",description:"PUBLIC keyword — used in external entity declarations (XXE)",pattern:/\bPUBLIC\s+["']/i},{id:"xml-entity-declaration",description:"<!ENTITY declaration — defines entities, potential XXE or entity expansion",pattern:/<!ENTITY[\s%]/i},{id:"xml-billion-laughs",description:"Entity reference chaining / billion laughs: repeated &eX; style references",pattern:/(?:&\w{1,20};){3,}/},{id:"xml-namespace-confusion",description:"xmlns: attribute injection — can redefine namespaces to confuse parsers",pattern:/\bxmlns\s*(?::\w{1,40})?\s*=/i},{id:"xml-comment-injection",description:"\x3c!-- comment injection — can hide content from some parsers",pattern:/<!--/},{id:"xml-comment-close",description:"--\x3e closes an enclosing XML comment",pattern:/-->/},{id:"xml-pi-close",description:"?> closes an enclosing processing instruction",pattern:/\?>/}],SVG:[{id:"svg-script-element",description:"<script element inside SVG executes JavaScript",pattern:/<script[\s>/]/i},{id:"svg-xlink-href-javascript",description:"xlink:href with javascript: — classic SVG XSS via <a> or <use>",pattern:/xlink\s*:\s*href\s*=\s*["']?\s*javascript\s*:/i},{id:"svg-href-javascript",description:"href= with javascript: in SVG context (<a>, <animate>, etc.)",pattern:/href\s*=\s*["']?\s*javascript\s*:/i},{id:"svg-foreignobject",description:"<foreignObject embeds HTML inside SVG — can execute scripts",pattern:/<foreignObject[\s>/]/i},{id:"svg-use-external",description:"<use xlink:href or href pointing to external resource (non-fragment URL)",pattern:/<use[\s\S]{0,60}(?:xlink\s*:\s*)?href\s*=\s*(?:["'][^#]|[^"'#\s>])/i},{id:"svg-animate-href",description:'<animate attributeName="href" — can dynamically change href to javascript:',pattern:/<animate[\s\S]{0,80}attributeName\s*=\s*["'][\s]*href["']/i},{id:"svg-animate-xlinkhref",description:'<animate attributeName="xlink:href"',pattern:/<animate[\s\S]{0,80}attributeName\s*=\s*["'][\s]*xlink\s*:\s*href["']/i},{id:"svg-set-javascript",description:'<set to="javascript:..." — sets an attribute to a javascript: URI',pattern:/<set[\s\S]{0,80}to\s*=\s*["']?\s*javascript\s*:/i},{id:"svg-event-handler",description:"SVG-specific event handler attributes: onload=, onerror=, onactivate=, etc.",pattern:/\bon(?:load|error|activate|begin|end|repeat|focus|blur|click|mouse\w{1,20}|key\w{1,20})\s*=/i},{id:"svg-handler-generic",description:"Generic on* handler catch-all for SVG attributes",pattern:/\bon\w{1,30}\s*=/i},{id:"svg-filter-feimage",description:"<feImage href= — filter primitive that can load external resources",pattern:/<feImage[\s\S]{0,80}(?:xlink\s*:\s*)?href\s*=/i},{id:"svg-image-external",description:"<image xlink:href with http/https or javascript protocol",pattern:/<image[\s\S]{0,80}(?:xlink\s*:\s*)?href\s*=\s*["']?\s*(?:https?|javascript)\s*:/i},{id:"svg-style-javascript",description:"style= attribute containing javascript: (e.g. background:url(javascript:...))",pattern:/style\s*=[\s\S]{0,60}javascript\s*:/i}],SQL:nn,"SQL-STRICT":[...nn,{id:"sql-line-comment",description:"SQL line comment: -- followed by whitespace or end of string",pattern:/--(?:\s|$)/},{id:"sql-stacked-query",description:"Stacked queries: semicolon immediately followed by a SQL keyword",pattern:/;\s{0,10}(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|EXEC)\b/i},{id:"sql-hex-encoding",description:"Hex-encoded string injection: 0x41414141 style (MySQL)",pattern:/\b0x[0-9a-f]{4,}/i}],SHELL:[{id:"shell-path-traversal-unix",description:"Unix path traversal: ../  — climbing the directory tree",pattern:/\.\.\//},{id:"shell-path-traversal-windows",description:"Windows path traversal: ..\\ — climbing the directory tree",pattern:/\.\.\\/},{id:"shell-path-traversal-encoded",description:"URL-encoded path traversal: %2e%2e or %2f variants",pattern:/%2e%2e|%2f\.\.|\.\.%2f/i},{id:"shell-null-byte",description:"Null byte injection: \\x00 or %00 — truncates strings in C-backed functions",pattern:/\x00|%00/},{id:"shell-semicolon",description:"Semicolon command separator: cmd1; cmd2",pattern:/;/},{id:"shell-pipe",description:"Pipe operator: cmd1 | cmd2",pattern:/\|/},{id:"shell-and-operator",description:"AND operator: cmd1 && cmd2",pattern:/&&/},{id:"shell-or-operator",description:"OR operator: cmd1 || cmd2",pattern:/\|\|/},{id:"shell-backtick",description:"Backtick command substitution: `cmd`",pattern:/`/},{id:"shell-dollar-paren",description:"Dollar-paren command substitution: $(cmd)",pattern:/\$\(/},{id:"shell-dollar-brace",description:"Dollar-brace variable expansion: ${var} — can be abused for injection",pattern:/\$\{/},{id:"shell-redirect-out",description:"Output redirection: cmd > file or cmd >> file",pattern:/>{1,2}/},{id:"shell-redirect-in",description:"Input redirection: cmd < file",pattern:/</},{id:"shell-newline-injection",description:"Newline injection: \\n or \\r — can inject new shell commands",pattern:/[\n\r]/},{id:"shell-glob-star",description:"Glob expansion: * or ? — can expand to unintended files",pattern:/[/\\][*?]/},{id:"shell-absolute-root",description:"Absolute root path injection: string starting with / or \\ (Windows UNC)",pattern:/^(?:\/|\\\\)/},{id:"shell-windows-drive",description:"Windows drive letter path injection: C:\\ or D:/",pattern:/^[a-zA-Z]:[/\\]/},{id:"shell-curl-wget",description:"curl/wget with URL or flags — can exfiltrate data or download payloads",pattern:/\b(?:curl|wget)\s+(?:https?:\/\/|ftp:\/\/|-)/i}],REDOS:[{id:"redos-nested-quantifier-plus",description:"Nested + quantifier inside a group with outer quantifier: (a+)+, (.+b)*, etc.",pattern:/\([^)]*\+[^)]*\)[+*]/},{id:"redos-nested-quantifier-star",description:"Nested * quantifier: (a*)* or (a*)+ — catastrophic backtracking",pattern:/\([^)]*\*[^)]*\)[*+]/},{id:"redos-nested-groups",description:"Doubly nested quantified groups: ((a+)+) — guaranteed catastrophic",pattern:/\(\([^)]{0,40}\)[+*]\)[+*]/},{id:"redos-alternation-overlap",description:"Overlapping alternation under quantifier: (a|a)+ — ambiguous NFA paths",pattern:/\(([^|()]{1,20})\|(?:\1)(?:\|[^|()]{1,20}){0,5}\)[+*?]{1,2}/},{id:"redos-star-plus-concat",description:"(x*x)+ pattern — triggers super-linear backtracking",pattern:/\([^)]{0,10}\*[^)]{0,10}\)[+*]/},{id:"redos-dot-star-greedy",description:"(.*){n,} or (.+){n,} — repeated greedy dot quantifiers",pattern:/\(\.[*+]\)\{?\d/},{id:"redos-large-repetition",description:"Very large fixed or range repetition count {1000,} or {1000,n} — denial of service via backtracking",pattern:/\{\d{4,}(?:,\d*)?\}/},{id:"redos-catastrophic-alternation",description:"Long alternation with many similar branches — polynomial backtracking risk",pattern:/\([^)]{0,200}(?:\|[^|)]{0,50}){9,}\)/}],NOSQL:[{id:"nosql-where-operator",description:"$where — executes arbitrary JavaScript server-side in MongoDB",pattern:new RegExp(`\\$where${rn}`,"i")},{id:"nosql-ne-operator",description:'$ne — "not equal" operator used to bypass equality checks',pattern:new RegExp(`\\$ne${rn}`,"i")},{id:"nosql-gt-operator",description:'$gt — "greater than" used to bypass password/value checks',pattern:new RegExp(`\\$gte?${rn}`,"i")},{id:"nosql-lt-operator",description:'$lt / $lte — "less than" bypass variants',pattern:new RegExp(`\\$lte?${rn}`,"i")},{id:"nosql-regex-operator",description:"$regex — can be used to extract data character by character (blind injection)",pattern:new RegExp(`\\$regex${rn}`,"i")},{id:"nosql-or-operator",description:"$or — logical OR; used to create always-true conditions",pattern:new RegExp(`\\$or${rn}\\s*\\[`,"i")},{id:"nosql-and-operator",description:"$and — logical AND operator injection",pattern:new RegExp(`\\$and${rn}\\s*\\[`,"i")},{id:"nosql-nor-operator",description:"$nor — logical NOR operator injection",pattern:new RegExp(`\\$nor${rn}\\s*\\[`,"i")},{id:"nosql-exists-operator",description:"$exists — can enumerate fields to determine schema",pattern:new RegExp(`\\$exists${rn}`,"i")},{id:"nosql-in-operator",description:"$in — matches any value in a list; can enumerate values",pattern:new RegExp(`\\$in${rn}\\s*\\[`,"i")},{id:"nosql-expr-operator",description:"$expr — allows aggregation expressions in queries (MongoDB 3.6+)",pattern:new RegExp(`\\$expr${rn}`,"i")},{id:"nosql-function-operator",description:"$function — executes arbitrary JavaScript in MongoDB 4.4+",pattern:new RegExp(`\\$function${rn}`,"i")},{id:"nosql-accumulator-operator",description:"$accumulator — custom aggregation with arbitrary JS execution",pattern:new RegExp(`\\$accumulator${rn}`,"i")},{id:"nosql-proto-pollution",description:"__proto__ — prototype pollution via object key injection",pattern:/__proto__/},{id:"nosql-constructor-prototype",description:"constructor.prototype — alternative prototype pollution vector (dot notation or JSON key)",pattern:/constructor[\s"':.,{\[]*prototype/i},{id:"nosql-proto-bracket",description:'["__proto__"] — bracket-notation prototype pollution',pattern:/\[["']__proto__["']\]/}],LOG:[{id:"log-crlf-injection",description:"CRLF injection: literal \\r or \\n embeds fake log lines",pattern:/[\r\n]/},{id:"log-url-encoded-crlf",description:"URL-encoded CRLF: %0d, %0a, %0D, %0A — decoded by some log parsers",pattern:/%0[dDaA]/},{id:"log-unicode-newline",description:"Unicode newline variants: U+2028 (line separator), U+2029 (paragraph separator)",pattern:/[\u2028\u2029]/},{id:"log-log4shell-jndi",description:"Log4Shell: ${jndi:...} triggers remote code execution in Apache Log4j",pattern:/\$\{jndi\s*:/i},{id:"log-log4shell-obfuscated",description:"Obfuscated Log4Shell: ${::-j}... lookup-bypass prefix used to evade WAF detection",pattern:/\$\{::-/},{id:"log-log4j-lookup",description:"Log4j lookup syntax: ${env:...}, ${sys:...}, ${ctx:...} — data exfiltration",pattern:/\$\{(?:env|sys|ctx|main|map|sd|web|docker|k8s|spring)\s*:/i},{id:"log-ssti-double-brace",description:"SSTI double-brace: {{expression}} — Jinja2, Twig, Handlebars, etc.",pattern:/\{\{[\s\S]{0,80}\}\}/},{id:"log-ssti-hash-brace",description:"SSTI hash-brace: #{expression} — Thymeleaf, Velocity, Ruby ERB",pattern:/#\{[\s\S]{0,80}\}/},{id:"log-ssti-dollar-brace",description:"SSTI/EL injection: ${expression with operators or method calls} — JSP EL, Freemarker, SpEL",pattern:/\$\{[^}]*(?:\.|\(|\*|\+|\bclass\b|\bruntime\b|\bprocess\b|\bexec\b)[^}]{0,80}\}/i},{id:"log-ssti-percent-tag",description:"SSTI ERB/ASP tag: <%= expression %> — Ruby ERB, ASP",pattern:/<%=[\s\S]{0,80}%>/},{id:"log-null-byte",description:"Null byte: \\x00 or %00 — can truncate log entries in C-backed loggers",pattern:/\x00|%00/},{id:"log-ansi-escape",description:"ANSI escape sequence: ESC[ — can manipulate terminal output when logs are tailed",pattern:/\x1b\[/}]},on=sn,an=Object.freeze(Object.fromEntries(Object.keys(sn).map(e=>[e,e])));function cn(e,t){const n=on[t];for(const r of n)if(r.pattern.test(e))return{context:t,id:r.id,description:r.description,pattern:r.pattern};return null}function ln(e,t){if(function(e){if("string"!=typeof e)throw new TypeError("is-unsafe: first argument must be a string, got "+typeof e)}(e),function(e){if(!(e instanceof RegExp))if("string"!=typeof e){if(!Array.isArray(e))throw new TypeError("is-unsafe: second argument must be a context string, array of context strings, or RegExp. Got: "+typeof e);if(0===e.length)throw new TypeError("is-unsafe: context array must not be empty");for(const t of e)if("string"!=typeof t||!on[t])throw new TypeError(`is-unsafe: unknown context "${t}" in array. Valid contexts: ${Object.keys(an).join(", ")}`)}else if(!on[e])throw new TypeError(`is-unsafe: unknown context "${e}". Valid contexts: ${Object.keys(an).join(", ")}`)}(t),t instanceof RegExp)return t.test(e);if("string"==typeof t)return null!==cn(e,t);for(const n of t)if(null!==cn(e,n))return!0;return!1}function dn(e,t){if(!e)return{};const n=t.attributesGroupName?e[t.attributesGroupName]:e;if(!n)return{};const r={};for(const e in n)e.startsWith(t.attributeNamePrefix)?r[e.substring(t.attributeNamePrefix.length)]=n[e]:r[e]=n[e];return r}function pn(e){if(!e||"string"!=typeof e)return;const t=e.indexOf(":");if(-1!==t&&t>0){const n=e.substring(0,t);if("xmlns"!==n)return n}}class hn{constructor(e,t){var n;this.options=e,this.currentNode=null,this.tagsNodeStack=[],this.parseXml=xn,this.parseTextData=un,this.resolveNameSpace=gn,this.buildAttributesMap=fn,this.isItStopNode=wn,this.replaceEntitiesValue=bn,this.readStopNodeData=Tn,this.saveTextToParentTag=En,this.addChild=yn,this.ignoreAttributesFn="function"==typeof(n=this.options.ignoreAttributes)?n:Array.isArray(n)?e=>{for(const t of n){if("string"==typeof t&&e===t)return!0;if(t instanceof RegExp&&t.test(e))return!0}}:()=>!1,this.entityExpansionCount=0,this.currentExpandedLength=0;let r={...zt};this.options.entityDecoder?this.entityDecoder=this.options.entityDecoder:("object"==typeof this.options.htmlEntities?r=this.options.htmlEntities:!0===this.options.htmlEntities&&(r={...Bt,...Wt}),this.entityDecoder=new tn({namedEntities:{...r,...t},numericAllowed:this.options.htmlEntities,limit:{maxTotalExpansions:this.options.processEntities.maxTotalExpansions,maxExpandedLength:this.options.processEntities.maxExpandedLength,applyLimitsTo:this.options.processEntities.appliesTo},onInputEntity:(e,t)=>ln(t,[an.HTML,an.XML])?Kt.BLOCK:Kt.ALLOW})),this.matcher=new Ut,this.readonlyMatcher=this.matcher.readOnly(),this.isCurrentNodeStopNode=!1,this.stopNodeExpressionsSet=new Ft;const i=this.options.stopNodes;if(i&&i.length>0){for(let e=0;e<i.length;e++){const t=i[e];"string"==typeof t?this.stopNodeExpressionsSet.add(new qt(t)):t instanceof qt&&this.stopNodeExpressionsSet.add(t)}this.stopNodeExpressionsSet.seal()}}}function un(e,t,n,r,i,s,o){const a=this.options;if(void 0!==e&&(a.trimValues&&!r&&(e=e.trim()),e.length>0)){o||(e=this.replaceEntitiesValue(e,t,n));const r=a.jPath?n.toString():n,c=a.tagValueProcessor(t,e,r,i,s);return null==c?e:typeof c!=typeof e||c!==e?c:a.trimValues||e.trim()===e?An(e,a.parseTagValue,a.numberParseOptions):e}}function gn(e){if(this.options.removeNSPrefix){const t=e.split(":"),n="/"===e.charAt(0)?"/":"";if("xmlns"===t[0])return"";2===t.length&&(e=n+t[1])}return e}const mn=new RegExp("([^\\s=]+)\\s*(=\\s*(['\"])([\\s\\S]*?)\\3)?","gm");function fn(e,t,n,r=!1){const i=this.options;if(!0===r||!0!==i.ignoreAttributes&&"string"==typeof e){const r=it(e,mn),s=r.length,o={},a=new Array(s);let c=!1;const l={};for(let e=0;e<s;e++){const t=this.resolveNameSpace(r[e][1]),s=r[e][4];if(t.length&&void 0!==s){let r=s;i.trimValues&&(r=r.trim()),r=this.replaceEntitiesValue(r,n,this.readonlyMatcher),a[e]=r,l[t]=r,c=!0}}c&&"object"==typeof t&&t.updateCurrent&&t.updateCurrent(l);const d=i.jPath?t.toString():this.readonlyMatcher;let p=!1;for(let e=0;e<s;e++){const t=this.resolveNameSpace(r[e][1]);if(this.ignoreAttributesFn(t,d))continue;let n=i.attributeNamePrefix+t;if(t.length)if(i.transformAttributeName&&(n=i.transformAttributeName(n)),n=In(n,i),void 0!==r[e][4]){const r=a[e],s=i.attributeValueProcessor(t,r,d);o[n]=null==s?r:typeof s!=typeof r||s!==r?s:An(r,i.parseAttributeValue,i.numberParseOptions),p=!0}else i.allowBooleanAttributes&&(o[n]=!0,p=!0)}if(!p)return;if(i.attributesGroupName&&!i.preserveOrder){const e={};return e[i.attributesGroupName]=o,e}return o}}const xn=function(e){e=e.replace(/\r\n?/g,"\n");const t=new gt("!xml");let n=t,r="";this.matcher.reset(),this.entityDecoder.reset(),this.entityExpansionCount=0,this.currentExpandedLength=0;const i=this.options,s=new St(i.processEntities),o=e.length;for(let a=0;a<o;a++)if("<"===e[a]){const c=e.charCodeAt(a+1);if(47===c){const t=Sn(e,">",a,"Closing Tag is not closed.");let s=e.substring(a+2,t).trim();if(i.removeNSPrefix){const e=s.indexOf(":");-1!==e&&(s=s.substr(e+1))}s=Cn(i.transformTagName,s,"",i).tagName,n&&(r=this.saveTextToParentTag(r,n,this.readonlyMatcher));const o=this.matcher.getCurrentTag();if(s&&i.unpairedTagsSet.has(s))throw new Error(`Unpaired tag can not be used as closing tag: </${s}>`);o&&i.unpairedTagsSet.has(o)&&(this.matcher.pop(),this.tagsNodeStack.pop()),this.matcher.pop(),this.isCurrentNodeStopNode=!1,n=this.tagsNodeStack.pop(),r="",a=t}else if(63===c){let t=Nn(e,a,!1,"?>");if(!t)throw new Error("Pi Tag is not closed.");r=this.saveTextToParentTag(r,n,this.readonlyMatcher);const o=this.buildAttributesMap(t.tagExp,this.matcher,t.tagName,!0);if(o){const e=o[this.options.attributeNamePrefix+"version"];this.entityDecoder.setXmlVersion(Number(e)||1),s.setXmlVersion(Number(e)||1)}if(i.ignoreDeclaration&&"?xml"===t.tagName||i.ignorePiTags);else{const e=new gt(t.tagName);e.add(i.textNodeName,""),t.tagName!==t.tagExp&&t.attrExpPresent&&!0!==i.ignoreAttributes&&(e[":@"]=o),this.addChild(n,e,this.readonlyMatcher,a)}a=t.closeIndex+1}else if(33===c&&45===e.charCodeAt(a+2)&&45===e.charCodeAt(a+3)){const t=Sn(e,"--\x3e",a+4,"Comment is not closed.");if(i.commentPropName){const s=e.substring(a+4,t-2);r=this.saveTextToParentTag(r,n,this.readonlyMatcher),n.add(i.commentPropName,[{[i.textNodeName]:s}])}a=t}else if(33===c&&68===e.charCodeAt(a+2)){const t=s.readDocType(e,a);this.entityDecoder.addInputEntities(t.entities),a=t.i}else if(33===c&&91===e.charCodeAt(a+2)){const t=Sn(e,"]]>",a,"CDATA is not closed.")-2,s=e.substring(a+9,t);r=this.saveTextToParentTag(r,n,this.readonlyMatcher);let o=this.parseTextData(s,n.tagname,this.readonlyMatcher,!0,!1,!0,!0);null==o&&(o=""),i.cdataPropName?n.add(i.cdataPropName,[{[i.textNodeName]:s}]):n.add(i.textNodeName,o),a=t+2}else{let s=Nn(e,a,i.removeNSPrefix);if(!s){const t=e.substring(Math.max(0,a-50),Math.min(o,a+50));throw new Error(`readTagExp returned undefined at position ${a}. Context: "${t}"`)}let c=s.tagName;const l=s.rawTagName;let d=s.tagExp,p=s.attrExpPresent,h=s.closeIndex;if(({tagName:c,tagExp:d}=Cn(i.transformTagName,c,d,i)),i.strictReservedNames&&(c===i.commentPropName||c===i.cdataPropName||c===i.textNodeName||c===i.attributesGroupName))throw new Error(`Invalid tag name: ${c}`);n&&r&&"!xml"!==n.tagname&&(r=this.saveTextToParentTag(r,n,this.readonlyMatcher,!1));const u=n;u&&i.unpairedTagsSet.has(u.tagname)&&(n=this.tagsNodeStack.pop(),this.matcher.pop());let g=!1;d.length>0&&d.lastIndexOf("/")===d.length-1&&(g=!0,"/"===c[c.length-1]?(c=c.substr(0,c.length-1),d=c):d=d.substr(0,d.length-1),p=c!==d);let m,f=null,x={};m=pn(l),c!==t.tagname&&this.matcher.push(c,{},m),c!==d&&p&&(f=this.buildAttributesMap(d,this.matcher,c),f&&(x=dn(f,i))),c!==t.tagname&&(this.isCurrentNodeStopNode=this.isItStopNode());const y=a;if(this.isCurrentNodeStopNode){let t="";if(g)a=s.closeIndex;else if(i.unpairedTagsSet.has(c))a=s.closeIndex;else{const n=this.readStopNodeData(e,l,h+1);if(!n)throw new Error(`Unexpected end of ${l}`);a=n.i,t=n.tagContent}const r=new gt(c);f&&(r[":@"]=f),r.add(i.textNodeName,t),this.matcher.pop(),this.isCurrentNodeStopNode=!1,this.addChild(n,r,this.readonlyMatcher,y)}else{if(g){({tagName:c,tagExp:d}=Cn(i.transformTagName,c,d,i));const e=new gt(c);f&&(e[":@"]=f),this.addChild(n,e,this.readonlyMatcher,y),this.matcher.pop(),this.isCurrentNodeStopNode=!1}else{if(i.unpairedTagsSet.has(c)){const e=new gt(c);f&&(e[":@"]=f),this.addChild(n,e,this.readonlyMatcher,y),this.matcher.pop(),this.isCurrentNodeStopNode=!1,a=s.closeIndex;continue}{const e=new gt(c);if(this.tagsNodeStack.length>i.maxNestedTags)throw new Error("Maximum nested tags exceeded");this.tagsNodeStack.push(n),f&&(e[":@"]=f),this.addChild(n,e,this.readonlyMatcher,y),n=e}}r="",a=h}}}else r+=e[a];return t.child};function yn(e,t,n,r){this.options.captureMetaData||(r=void 0);const i=this.options.jPath?n.toString():n,s=this.options.updateTag(t.tagname,i,t[":@"]);!1===s||("string"==typeof s?(t.tagname=s,e.addChild(t,r)):e.addChild(t,r))}function bn(e,t,n){const r=this.options.processEntities;if(!r||!r.enabled)return e;if(r.allowedTags){const i=this.options.jPath?n.toString():n;if(!(Array.isArray(r.allowedTags)?r.allowedTags.includes(t):r.allowedTags(t,i)))return e}if(r.tagFilter){const i=this.options.jPath?n.toString():n;if(!r.tagFilter(t,i))return e}return this.entityDecoder.decode(e)}function En(e,t,n,r){return e&&(void 0===r&&(r=0===t.child.length),void 0!==(e=this.parseTextData(e,t.tagname,n,!1,!!t[":@"]&&0!==Object.keys(t[":@"]).length,r))&&""!==e&&t.add(this.options.textNodeName,e),e=""),e}function wn(){return 0!==this.stopNodeExpressionsSet.size&&this.matcher.matchesAny(this.stopNodeExpressionsSet)}function Sn(e,t,n,r){const i=e.indexOf(t,n);if(-1===i)throw new Error(r);return i+t.length-1}function vn(e,t,n,r){const i=e.indexOf(t,n);if(-1===i)throw new Error(r);return i}function Nn(e,t,n,r=">"){const i=function(e,t,n=">"){let r=0;const i=e.length,s=n.charCodeAt(0),o=n.length>1?n.charCodeAt(1):-1;let a="",c=t;for(let n=t;n<i;n++){const t=e.charCodeAt(n);if(r)t===r&&(r=0);else if(34===t||39===t)r=t;else if(t===s){if(-1===o)return a+=e.substring(c,n),{data:a,index:n};if(e.charCodeAt(n+1)===o)return a+=e.substring(c,n),{data:a,index:n}}else 9!==t||r||(a+=e.substring(c,n)+" ",c=n+1)}}(e,t+1,r);if(!i)return;let s=i.data;const o=i.index,a=s.search(/\s/);let c=s,l=!0;-1!==a&&(c=s.substring(0,a),s=s.substring(a+1).trimStart());const d=c;if(n){const e=c.indexOf(":");-1!==e&&(c=c.substr(e+1),l=c!==i.data.substr(e+1))}return{tagName:c,tagExp:s,closeIndex:o,attrExpPresent:l,rawTagName:d}}function Tn(e,t,n){const r=n;let i=1;const s=e.length;for(;n<s;n++)if("<"===e[n]){const s=e.charCodeAt(n+1);if(47===s){const s=vn(e,">",n,`${t} is not closed`);if(e.substring(n+2,s).trim()===t&&(i--,0===i))return{tagContent:e.substring(r,n),i:s};n=s}else if(63===s)n=Sn(e,"?>",n+1,"StopNode is not closed.");else if(33===s&&45===e.charCodeAt(n+2)&&45===e.charCodeAt(n+3))n=Sn(e,"--\x3e",n+3,"StopNode is not closed.");else if(33===s&&91===e.charCodeAt(n+2))n=Sn(e,"]]>",n,"StopNode is not closed.")-2;else{const r=Nn(e,n,!1);r&&((r&&r.tagName)===t&&"/"!==r.tagExp[r.tagExp.length-1]&&i++,n=r.closeIndex)}}}function An(e,t,n){if(t&&"string"==typeof e){const t=e.trim();return"true"===t||"false"!==t&&jt(e,n)}return function(e){return void 0!==e}(e)?e:""}function Cn(e,t,n,r){if(e){const r=e(t);n===t&&(n=r),t=r}return{tagName:t=In(t,r),tagExp:n}}function In(e,t){if(at.includes(e))throw new Error(`[SECURITY] Invalid name: "${e}" is a reserved JavaScript keyword that could cause prototype pollution`);return ot.includes(e)?t.onDangerousProperty(e):e}const $n=gt.getMetaDataSymbol();function _n(e,t){if(!e||"object"!=typeof e)return{};if(!t)return e;const n={};for(const r in e)r.startsWith(t)?n[r.substring(t.length)]=e[r]:n[r]=e[r];return n}function Pn(e,t,n,r){return kn(e,t,n,r)}function kn(e,t,n,r){let i;const s={};for(let o=0;o<e.length;o++){const a=e[o],c=Dn(a);if(void 0!==c&&c!==t.textNodeName){const e=_n(a[":@"]||{},t.attributeNamePrefix);n.push(c,e)}if(c===t.textNodeName)void 0===i?i=a[c]:i+=""+a[c];else{if(void 0===c)continue;if(a[c]){let e=kn(a[c],t,n,r);const i=On(e,t);if(0===Object.keys(e).length&&t.alwaysCreateTextNode&&(e[t.textNodeName]=""),a[":@"]?Rn(e,a[":@"],r,t):1!==Object.keys(e).length||void 0===e[t.textNodeName]||t.alwaysCreateTextNode?0===Object.keys(e).length&&(t.alwaysCreateTextNode?e[t.textNodeName]="":e=""):e=e[t.textNodeName],void 0!==a[$n]&&"object"==typeof e&&null!==e&&(e[$n]=a[$n]),void 0!==s[c]&&Object.prototype.hasOwnProperty.call(s,c))Array.isArray(s[c])||(s[c]=[s[c]]),s[c].push(e);else{const n=t.jPath?r.toString():r;t.isArray(c,n,i)?s[c]=[e]:s[c]=e}void 0!==c&&c!==t.textNodeName&&n.pop()}}}return"string"==typeof i?i.length>0&&(s[t.textNodeName]=i):void 0!==i&&(s[t.textNodeName]=i),s}function Dn(e){const t=Object.keys(e);for(let e=0;e<t.length;e++){const n=t[e];if(":@"!==n)return n}}function Rn(e,t,n,r){if(t){const i=Object.keys(t),s=i.length;for(let o=0;o<s;o++){const s=i[o],a=s.startsWith(r.attributeNamePrefix)?s.substring(r.attributeNamePrefix.length):s,c=r.jPath?n.toString()+"."+a:n;r.isArray(s,c,!0,!0)?e[s]=[t[s]]:e[s]=t[s]}}}function On(e,t){const{textNodeName:n}=t,r=Object.keys(e).length;return 0===r||!(1!==r||!e[n]&&"boolean"!=typeof e[n]&&0!==e[n])}const jn={allowBooleanAttributes:!1,unpairedTags:[]};function Mn(e){return" "===e||"\t"===e||"\n"===e||"\r"===e}function Ln(e,t){const n=t;for(;t<e.length;t++)if("?"==e[t]||" "==e[t]){const r=e.substr(n,t-n);if(t>5&&"xml"===r)return zn("InvalidXml","XML declaration allowed only at the start of the document.",Gn(e,t));if("?"==e[t]&&">"==e[t+1]){t++;break}continue}return t}function Vn(e,t){if(e.length>t+5&&"-"===e[t+1]&&"-"===e[t+2]){for(t+=3;t<e.length;t++)if("-"===e[t]&&"-"===e[t+1]&&">"===e[t+2]){t+=2;break}}else if(e.length>t+8&&"D"===e[t+1]&&"O"===e[t+2]&&"C"===e[t+3]&&"T"===e[t+4]&&"Y"===e[t+5]&&"P"===e[t+6]&&"E"===e[t+7]){let n=1;for(t+=8;t<e.length;t++)if("<"===e[t])n++;else if(">"===e[t]&&(n--,0===n))break}else if(e.length>t+9&&"["===e[t+1]&&"C"===e[t+2]&&"D"===e[t+3]&&"A"===e[t+4]&&"T"===e[t+5]&&"A"===e[t+6]&&"["===e[t+7])for(t+=8;t<e.length;t++)if("]"===e[t]&&"]"===e[t+1]&&">"===e[t+2]){t+=2;break}return t}function Un(e,t){let n="",r="",i=!1;for(;t<e.length;t++){if('"'===e[t]||"'"===e[t])""===r?r=e[t]:r!==e[t]||(r="");else if(">"===e[t]&&""===r){i=!0;break}n+=e[t]}return""===r&&{value:n,index:t,tagClosed:i}}const qn=new RegExp("(\\s*)([^\\s=]+)(\\s*=)?(\\s*(['\"])(([\\s\\S])*?)\\5)?","g");function Fn(e,t){const n=it(e,qn),r={};for(let e=0;e<n.length;e++){if(0===n[e][1].length)return zn("InvalidAttr","Attribute '"+n[e][2]+"' has no space in starting.",Hn(n[e]));if(void 0!==n[e][3]&&void 0===n[e][4])return zn("InvalidAttr","Attribute '"+n[e][2]+"' is without value.",Hn(n[e]));if(void 0===n[e][3]&&!t.allowBooleanAttributes)return zn("InvalidAttr","boolean attribute '"+n[e][2]+"' is not allowed.",Hn(n[e]));const i=n[e][2];if(!Bn(i))return zn("InvalidAttr","Attribute '"+i+"' is an invalid name.",Hn(n[e]));if(Object.prototype.hasOwnProperty.call(r,i))return zn("InvalidAttr","Attribute '"+i+"' is repeated.",Hn(n[e]));r[i]=1}return!0}function Wn(e,t){if(";"===e[++t])return-1;if("#"===e[t])return function(e,t){let n=/\d/;for("x"===e[t]&&(t++,n=/[\da-fA-F]/);t<e.length;t++){if(";"===e[t])return t;if(!e[t].match(n))break}return-1}(e,++t);let n=0;for(;t<e.length;t++,n++)if(!(e[t].match(/\w/)&&n<20)){if(";"===e[t])break;return-1}return t}function zn(e,t,n){return{err:{code:e,msg:t,line:n.line||n,col:n.col}}}function Bn(e){return st(e)}function Kn(e){return st(e)}function Gn(e,t){const n=e.substring(0,t).split(/\r?\n/);return{line:n.length,col:n[n.length-1].length+1}}function Hn(e){return e.startIndex+e[1].length}const Xn=new class{constructor(e){this.externalEntities={},this.options=ht(e)}parse(e,t){if("string"!=typeof e&&e.toString)e=e.toString();else if("string"!=typeof e)throw new Error("XML data is accepted in String or Bytes[] form.");if(t){!0===t&&(t={});const n=function(e,t){t=Object.assign({},jn,t);const n=[];let r=!1,i=!1;"\ufeff"===e[0]&&(e=e.substr(1));for(let s=0;s<e.length;s++)if("<"===e[s]&&"?"===e[s+1]){if(s+=2,s=Ln(e,s),s.err)return s}else{if("<"!==e[s]){if(Mn(e[s]))continue;return zn("InvalidChar","char '"+e[s]+"' is not expected.",Gn(e,s))}{let o=s;if(s++,"!"===e[s]){s=Vn(e,s);continue}{let a=!1;"/"===e[s]&&(a=!0,s++);let c="";for(;s<e.length&&">"!==e[s]&&" "!==e[s]&&"\t"!==e[s]&&"\n"!==e[s]&&"\r"!==e[s];s++)c+=e[s];if(c=c.trim(),"/"===c[c.length-1]&&(c=c.substring(0,c.length-1),s--),!Kn(c)){let t;return t=0===c.trim().length?"Invalid space after '<'.":"Tag '"+c+"' is an invalid name.",zn("InvalidTag",t,Gn(e,s))}const l=Un(e,s);if(!1===l)return zn("InvalidAttr","Attributes for '"+c+"' have open quote.",Gn(e,s));let d=l.value;if(s=l.index,"/"===d[d.length-1]){const n=s-d.length;d=d.substring(0,d.length-1);const i=Fn(d,t);if(!0!==i)return zn(i.err.code,i.err.msg,Gn(e,n+i.err.line));r=!0}else if(a){if(!l.tagClosed)return zn("InvalidTag","Closing tag '"+c+"' doesn't have proper closing.",Gn(e,s));if(d.trim().length>0)return zn("InvalidTag","Closing tag '"+c+"' can't have attributes or invalid starting.",Gn(e,o));if(0===n.length)return zn("InvalidTag","Closing tag '"+c+"' has not been opened.",Gn(e,o));{const t=n.pop();if(c!==t.tagName){let n=Gn(e,t.tagStartPos);return zn("InvalidTag","Expected closing tag '"+t.tagName+"' (opened in line "+n.line+", col "+n.col+") instead of closing tag '"+c+"'.",Gn(e,o))}0==n.length&&(i=!0)}}else{const a=Fn(d,t);if(!0!==a)return zn(a.err.code,a.err.msg,Gn(e,s-d.length+a.err.line));if(!0===i)return zn("InvalidXml","Multiple possible root nodes found.",Gn(e,s));-1!==t.unpairedTags.indexOf(c)||n.push({tagName:c,tagStartPos:o}),r=!0}for(s++;s<e.length;s++)if("<"===e[s]){if("!"===e[s+1]){s++,s=Vn(e,s);continue}if("?"!==e[s+1])break;if(s=Ln(e,++s),s.err)return s}else if("&"===e[s]){const t=Wn(e,s);if(-1==t)return zn("InvalidChar","char '&' is not expected.",Gn(e,s));s=t}else if(!0===i&&!Mn(e[s]))return zn("InvalidXml","Extra text at the end",Gn(e,s));"<"===e[s]&&s--}}}return r?1==n.length?zn("InvalidTag","Unclosed tag '"+n[0].tagName+"'.",Gn(e,n[0].tagStartPos)):!(n.length>0)||zn("InvalidXml","Invalid '"+JSON.stringify(n.map(e=>e.tagName),null,4).replace(/\r?\n/g,"")+"' found.",{line:1,col:1}):zn("InvalidXml","Start tag expected.",1)}(e,t);if(!0!==n)throw Error(`${n.err.msg}:${n.err.line}:${n.err.col}`)}const n=new hn(this.options,this.externalEntities),r=n.parseXml(e);return this.options.preserveOrder||void 0===r?r:Pn(r,this.options,n.matcher,n.readonlyMatcher)}addEntity(e,t){if(-1!==t.indexOf("&"))throw new Error("Entity value can't have '&'");if(-1!==e.indexOf("&")||-1!==e.indexOf(";"))throw new Error("An entity must be set without '&' and ';'. Eg. use '#xD' for '&#xD;'");if("&"===t)throw new Error("An entity with value '&' is not permitted");this.externalEntities[e]=t}static getMetaDataSymbol(){return gt.getMetaDataSymbol()}}({attributeNamePrefix:"",htmlEntities:!0,ignoreAttributes:!1,ignoreDeclaration:!0,parseTagValue:!1,trimValues:!1,tagValueProcessor:(e,t)=>""===t.trim()&&t.includes("\n")?"":void 0});Xn.addEntity("#xD","\r"),Xn.addEntity("#10","\n");var Qn=n(2840);const Yn=e=>{const t="#text";for(const n in e)e.hasOwnProperty(n)&&void 0!==e[n][t]?e[n]=e[n][t]:"object"==typeof e[n]&&null!==e[n]&&(e[n]=Yn(e[n]));return e};var Zn=n(2914),Jn=n(88791),er=n(89946);class tr extends Jn.B{settings;stringDeserializer;constructor(e){super(),this.settings=e,this.stringDeserializer=new Qn.k(e)}setSerdeContext(e){this.serdeContext=e,this.stringDeserializer.setSerdeContext(e)}read(e,t,n){const r=et.l.of(e),i=r.getMemberSchemas();if(r.isStructSchema()&&r.isMemberSchema()&&Object.values(i).find(e=>!!e.getMemberTraits().eventPayload)){const e={},n=Object.keys(i)[0];return i[n].isBlobSchema()?e[n]=t:e[n]=this.read(i[n],t),e}const s=(this.serdeContext?.utf8Encoder??Zn.P)(t),o=this.parseXml(s);return this.readSchema(e,n?o[n]:o)}readSchema(e,t){const n=et.l.of(e);if(n.isUnitSchema())return;const r=n.getMergedTraits();if(n.isListSchema()&&!Array.isArray(t))return this.readSchema(n,[t]);if(null==t)return t;if("object"==typeof t){const e=!!r.sparse,i=!!r.xmlFlattened;if(n.isListSchema()){const r=n.getValueSchema(),s=[],o=r.getMergedTraits().xmlName??"member",a=i?t:(t[0]??t)[o],c=Array.isArray(a)?a:[a];for(const t of c)(null!=t||e)&&s.push(this.readSchema(r,t));return s}const s={};if(n.isMapSchema()){const r=n.getKeySchema(),o=n.getValueSchema();let a;a=i?Array.isArray(t)?t:[t]:Array.isArray(t.entry)?t.entry:[t.entry];const c=r.getMergedTraits().xmlName??"key",l=o.getMergedTraits().xmlName??"value";for(const t of a){const n=t[c],r=t[l];(null!=r||e)&&(s[n]=this.readSchema(o,r))}return s}if(n.isStructSchema()){const e=n.isUnionSchema();let r;e&&(r=new er.F(t,s));for(const[i,o]of n.structIterator()){const n=o.getMergedTraits(),a=n.httpPayload?n.xmlName??o.getName():o.getMemberTraits().xmlName??i;e&&r.mark(a),null!=t[a]&&(s[i]=this.readSchema(o,t[a]))}return e&&r.writeUnknown(),s}if(n.isDocumentSchema())return t;throw new Error(`@aws-sdk/core/protocols - xml deserializer unhandled schema type for ${n.getName(!0)}`)}return n.isListSchema()?[]:n.isMapSchema()||n.isStructSchema()?{}:this.stringDeserializer.read(n,t)}parseXml(e){if(e.length){let n;try{t=e,n=Xn.parse(t,!0)}catch(t){throw t&&"object"==typeof t&&Object.defineProperty(t,"$responseBodyText",{value:e}),t}const r="#text",i=Object.keys(n)[0],s=n[i];return s[r]&&(s[i]=s[r],delete s[r]),Yn(s)}var t;return{}}}var nr=n(26144),rr=n(30259),ir=n(34708),sr=n(70764),or=n(10015),ar=n(39181);class cr extends Jn.B{settings;buffer;constructor(e){super(),this.settings=e}write(e,t,n=""){void 0===this.buffer&&(this.buffer="");const r=et.l.of(e);if(n&&!n.endsWith(".")&&(n+="."),r.isBlobSchema())("string"==typeof t||t instanceof Uint8Array)&&(this.writeKey(n),this.writeValue((this.serdeContext?.base64Encoder??ar.n)(t)));else if(r.isBooleanSchema()||r.isNumericSchema()||r.isStringSchema())null!=t?(this.writeKey(n),this.writeValue(String(t))):r.isIdempotencyToken()&&(this.writeKey(n),this.writeValue((0,ir.v4)()));else if(r.isBigIntegerSchema())null!=t&&(this.writeKey(n),this.writeValue(String(t)));else if(r.isBigDecimalSchema())null!=t&&(this.writeKey(n),this.writeValue(t instanceof sr.D?t.string:String(t)));else if(r.isTimestampSchema()){if(t instanceof Date)switch(this.writeKey(n),(0,nr.V)(r,this.settings)){case 5:this.writeValue(t.toISOString().replace(".000Z","Z"));break;case 6:this.writeValue((0,or.JV)(t));break;case 7:this.writeValue(String(t.getTime()/1e3))}}else if(r.isDocumentSchema())Array.isArray(t)?this.write(79,t,n):t instanceof Date?this.write(4,t,n):t instanceof Uint8Array?this.write(21,t,n):t&&"object"==typeof t?this.write(143,t,n):(this.writeKey(n),this.writeValue(String(t)));else if(r.isListSchema()){if(Array.isArray(t))if(0===t.length)this.settings.serializeEmptyLists&&(this.writeKey(n),this.writeValue(""));else{const e=r.getValueSchema(),i=this.settings.flattenLists||r.getMergedTraits().xmlFlattened;let s=1;for(const r of t){if(null==r)continue;const t=e.getMergedTraits(),o=this.getKey("member",t.xmlName,t.ec2QueryName),a=i?`${n}${s}`:`${n}${o}.${s}`;this.write(e,r,a),++s}}}else if(r.isMapSchema()){if(t&&"object"==typeof t){const e=r.getKeySchema(),i=r.getValueSchema(),s=r.getMergedTraits().xmlFlattened;let o=1;for(const[r,a]of Object.entries(t)){if(null==a)continue;const t=e.getMergedTraits(),c=this.getKey("key",t.xmlName,t.ec2QueryName),l=s?`${n}${o}.${c}`:`${n}entry.${o}.${c}`,d=i.getMergedTraits(),p=this.getKey("value",d.xmlName,d.ec2QueryName),h=s?`${n}${o}.${p}`:`${n}entry.${o}.${p}`;this.write(e,r,l),this.write(i,a,h),++o}}}else if(r.isStructSchema()){if(t&&"object"==typeof t){let e=!1;for(const[i,s]of r.structIterator()){if(null==t[i]&&!s.isIdempotencyToken())continue;const r=s.getMergedTraits(),o=`${n}${this.getKey(i,r.xmlName,r.ec2QueryName,"struct")}`;this.write(s,t[i],o),e=!0}if(!e&&r.isUnionSchema()){const{$unknown:e}=t;if(Array.isArray(e)){const[t,r]=e,i=`${n}${t}`;this.write(15,r,i)}}}}else if(!r.isUnitSchema())throw new Error(`@aws-sdk/core/protocols - QuerySerializer unrecognized schema type ${r.getName(!0)}`)}flush(){if(void 0===this.buffer)throw new Error("@aws-sdk/core/protocols - QuerySerializer cannot flush with nothing written to buffer.");const e=this.buffer;return delete this.buffer,e}getKey(e,t,n,r){const{ec2:i,capitalizeKeys:s}=this.settings;if(i&&n)return n;const o=t??e;return s&&"struct"===r?o[0].toUpperCase()+o.slice(1):o}writeKey(e){e.endsWith(".")&&(e=e.slice(0,e.length-1)),this.buffer+=`&${(0,rr.$)(e)}=`}writeValue(e){this.buffer+=(0,rr.$)(e)}}class lr extends Ye.M{options;serializer;deserializer;mixin=new tt.U;constructor(e){super({defaultNamespace:e.defaultNamespace}),this.options=e;const t={timestampFormat:{useTrait:!0,default:5},httpBindings:!1,xmlNamespace:e.xmlNamespace,serviceNamespace:e.defaultNamespace,serializeEmptyLists:!0};this.serializer=new cr(t),this.deserializer=new tr(t)}getShapeId(){return"aws.protocols#awsQuery"}setSerdeContext(e){this.serializer.setSerdeContext(e),this.deserializer.setSerdeContext(e)}getPayloadCodec(){throw new Error("AWSQuery protocol has no payload codec.")}async serializeRequest(e,t,n){const r=await super.serializeRequest(e,t,n);r.path.endsWith("/")||(r.path+="/"),Object.assign(r.headers,{"content-type":"application/x-www-form-urlencoded"}),"unit"!==(0,Je.L)(e.input)&&r.body||(r.body="");const i=e.name.split("#")[1]??e.name;return r.body=`Action=${i}&Version=${this.options.version}`+r.body,r.body.endsWith("&")&&(r.body=r.body.slice(-1)),r}async deserializeResponse(e,t,n){const r=this.deserializer,i=et.l.of(e.output),s={};if(n.statusCode>=300){const i=await(0,Ze.P)(n.body,t);i.byteLength>0&&Object.assign(s,await r.read(15,i)),await this.handleError(e,t,n,s,this.deserializeMetadata(n))}for(const e in n.headers){const t=n.headers[e];delete n.headers[e],n.headers[e.toLowerCase()]=t}const o=e.name.split("#")[1]??e.name,a=i.isStructSchema()&&this.useNestedResult()?o+"Result":void 0,c=await(0,Ze.P)(n.body,t);return c.byteLength>0&&Object.assign(s,await r.read(i,c,a)),{$metadata:this.deserializeMetadata(n),...s}}useNestedResult(){return!0}async handleError(e,t,n,r,i){const s=this.loadQueryErrorCode(n,r)??"Unknown",o=this.loadQueryError(r),a=this.loadQueryErrorMessage(r);o.message=a,o.Error={Type:o.Type,Code:o.Code,Message:a};const{errorSchema:c,errorMetadata:l}=await this.mixin.getErrorSchemaOrThrowBaseException(s,this.options.defaultNamespace,n,o,i,this.mixin.findQueryCompatibleError),p=et.l.of(c),h=new(d.O.for(c[1]).getErrorCtor(c)??Error)(a),u={Type:o.Error.Type,Code:o.Error.Code,Error:o.Error};for(const[e,t]of p.structIterator()){const n=t.getMergedTraits().xmlName??e,i=o[n]??r[n];u[e]=this.deserializer.readSchema(t,i)}throw this.mixin.decorateServiceException(Object.assign(h,l,{$fault:p.getMergedTraits().error,message:a},u),r)}loadQueryErrorCode(e,t){const n=(t.Errors?.[0]?.Error??t.Errors?.Error??t.Error)?.Code;return void 0!==n?n:404==e.statusCode?"NotFound":void 0}loadQueryError(e){return e.Errors?.[0]?.Error??e.Errors?.Error??e.Error}loadQueryErrorMessage(e){const t=this.loadQueryError(e);return t?.message??t?.Message??e.message??e.Message??"Unknown"}getDefaultContentType(){return"application/x-www-form-urlencoded"}}var dr=n(3761),pr=n(67933),hr=n(12544),ur=n(40935),gr=n(2456),mr=n(48105),fr=n(1034),xr=n(7856);const yr="required",br="type",Er="fn",wr="argv",Sr="ref",vr=!1,Nr=!0,Tr="booleanEquals",Ar="stringEquals",Cr="sigv4",Ir="us-east-1",$r="endpoint",_r="https://sts.{Region}.{PartitionResult#dnsSuffix}",Pr="tree",kr="error",Dr="getAttr",Rr={[yr]:!1,[br]:"string"},Or={[yr]:!0,default:!1,[br]:"boolean"},jr={[Sr]:"Endpoint"},Mr={[Er]:"isSet",[wr]:[{[Sr]:"Region"}]},Lr={[Sr]:"Region"},Vr={[Er]:"aws.partition",[wr]:[Lr],assign:"PartitionResult"},Ur={[Sr]:"UseFIPS"},qr={[Sr]:"UseDualStack"},Fr={url:"https://sts.amazonaws.com",properties:{authSchemes:[{name:Cr,signingName:"sts",signingRegion:Ir}]},headers:{}},Wr={},zr={conditions:[{[Er]:Ar,[wr]:[Lr,"aws-global"]}],[$r]:Fr,[br]:$r},Br={[Er]:Tr,[wr]:[Ur,!0]},Kr={[Er]:Tr,[wr]:[qr,!0]},Gr={[Er]:Dr,[wr]:[{[Sr]:"PartitionResult"},"supportsFIPS"]},Hr={[Sr]:"PartitionResult"},Xr={[Er]:Tr,[wr]:[!0,{[Er]:Dr,[wr]:[Hr,"supportsDualStack"]}]},Qr=[{[Er]:"isSet",[wr]:[jr]}],Yr=[Br],Zr=[Kr],Jr={version:"1.0",parameters:{Region:Rr,UseDualStack:Or,UseFIPS:Or,Endpoint:Rr,UseGlobalEndpoint:Or},rules:[{conditions:[{[Er]:Tr,[wr]:[{[Sr]:"UseGlobalEndpoint"},Nr]},{[Er]:"not",[wr]:Qr},Mr,Vr,{[Er]:Tr,[wr]:[Ur,vr]},{[Er]:Tr,[wr]:[qr,vr]}],rules:[{conditions:[{[Er]:Ar,[wr]:[Lr,"ap-northeast-1"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"ap-south-1"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"ap-southeast-1"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"ap-southeast-2"]}],endpoint:Fr,[br]:$r},zr,{conditions:[{[Er]:Ar,[wr]:[Lr,"ca-central-1"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"eu-central-1"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"eu-north-1"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"eu-west-1"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"eu-west-2"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"eu-west-3"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"sa-east-1"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,Ir]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"us-east-2"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"us-west-1"]}],endpoint:Fr,[br]:$r},{conditions:[{[Er]:Ar,[wr]:[Lr,"us-west-2"]}],endpoint:Fr,[br]:$r},{endpoint:{url:_r,properties:{authSchemes:[{name:Cr,signingName:"sts",signingRegion:"{Region}"}]},headers:Wr},[br]:$r}],[br]:Pr},{conditions:Qr,rules:[{conditions:Yr,error:"Invalid Configuration: FIPS and custom endpoint are not supported",[br]:kr},{conditions:Zr,error:"Invalid Configuration: Dualstack and custom endpoint are not supported",[br]:kr},{endpoint:{url:jr,properties:Wr,headers:Wr},[br]:$r}],[br]:Pr},{conditions:[Mr],rules:[{conditions:[Vr],rules:[{conditions:[Br,Kr],rules:[{conditions:[{[Er]:Tr,[wr]:[Nr,Gr]},Xr],rules:[{endpoint:{url:"https://sts-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:Wr,headers:Wr},[br]:$r}],[br]:Pr},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",[br]:kr}],[br]:Pr},{conditions:Yr,rules:[{conditions:[{[Er]:Tr,[wr]:[Gr,Nr]}],rules:[{conditions:[{[Er]:Ar,[wr]:[{[Er]:Dr,[wr]:[Hr,"name"]},"aws-us-gov"]}],endpoint:{url:"https://sts.{Region}.amazonaws.com",properties:Wr,headers:Wr},[br]:$r},{endpoint:{url:"https://sts-fips.{Region}.{PartitionResult#dnsSuffix}",properties:Wr,headers:Wr},[br]:$r}],[br]:Pr},{error:"FIPS is enabled but this partition does not support FIPS",[br]:kr}],[br]:Pr},{conditions:Zr,rules:[{conditions:[Xr],rules:[{endpoint:{url:"https://sts.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:Wr,headers:Wr},[br]:$r}],[br]:Pr},{error:"DualStack is enabled but this partition does not support DualStack",[br]:kr}],[br]:Pr},zr,{endpoint:{url:_r,properties:Wr,headers:Wr},[br]:$r}],[br]:Pr}],[br]:Pr},{error:"Invalid Configuration: Missing Region",[br]:kr}]},ei=new mr.k({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS","UseGlobalEndpoint"]}),ti=(e,t={})=>ei.get(e,()=>(0,fr.s)(Jr,{endpointParams:e,logger:t.logger}));xr.m.aws=gr.UF;var ni=n(93673),ri=n(78646),ii=n(18081);class si extends Ie.K{config;constructor(...[e]){const t=(e=>{(0,Ke.I)(process.version);const t=(0,Xe.I)(e),n=()=>t().then(Ge.l),r=(e=>({apiVersion:"2011-06-15",base64Decoder:e?.base64Decoder??hr.E,base64Encoder:e?.base64Encoder??ar.n,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??ti,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??De,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:e=>e.getIdentityProvider("aws.auth#sigv4"),signer:new Me.f2},{schemeId:"smithy.api#noAuth",identityProvider:e=>e.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new Fe.m}],logger:e?.logger??new dr.N,protocol:e?.protocol??lr,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.sts",errorTypeRegistries:K,xmlNamespace:"https://sts.amazonaws.com/doc/2011-06-15/",version:"2011-06-15",serviceTarget:"AWSSecurityTokenServiceV20110615"},serviceId:e?.serviceId??"STS",urlParser:e?.urlParser??pr.D,utf8Decoder:e?.utf8Decoder??ur.a,utf8Encoder:e?.utf8Encoder??Zn.P}))(e);(0,Oe.I)(process.version);const o={profile:e?.profile,logger:r.logger};return{...r,...e,runtime:"node",defaultsMode:t,authSchemePreference:e?.authSchemePreference??(0,s.Z)(je.$,o),bodyLengthChecker:e?.bodyLengthChecker??He.n,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,Le.pf)({serviceId:r.serviceId,clientVersion:Re.rE}),httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:t=>t.getIdentityProvider("aws.auth#sigv4")||(async t=>await e.credentialDefaultProvider(t?.__config||{})()),signer:new Me.f2},{schemeId:"smithy.api#noAuth",identityProvider:e=>e.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new Fe.m}],maxAttempts:e?.maxAttempts??(0,s.Z)(Ae.qs,e),region:e?.region??(0,s.Z)(i.GG,{...i.zH,...o}),requestHandler:ze.$.create(e?.requestHandler??n),retryMode:e?.retryMode??(0,s.Z)({...Ae.kN,default:async()=>(await n()).retryMode||Qe.L0},e),sha256:e?.sha256??We.V.bind(null,"sha256"),streamCollector:e?.streamCollector??Be.k,useDualstackEndpoint:e?.useDualstackEndpoint??(0,s.Z)(Ue.e$,o),useFipsEndpoint:e?.useFipsEndpoint??(0,s.Z)(qe.Ko,o),userAgentAppId:e?.userAgentAppId??(0,s.Z)(Ve.hV,o)}})(e||{});super(t),this.initConfig=t;const n=(r=t,Object.assign(r,{useDualstackEndpoint:r.useDualstackEndpoint??!1,useFipsEndpoint:r.useFipsEndpoint??!1,useGlobalEndpoint:r.useGlobalEndpoint??!1,defaultSigningName:"sts"}));var r;const o=(0,xe.D)(n),a=(0,Ae.$z)(o),c=(0,be.T)(a),l=(0,ge.OV)(c),d=((e,t)=>{const n=Object.assign((0,ni.R)(e),(0,ii.xA)(e),(0,ri.e)(e),(e=>{const t=e.httpAuthSchemes;let n=e.httpAuthSchemeProvider,r=e.credentials;return{setHttpAuthScheme(e){const n=t.findIndex(t=>t.schemeId===e.schemeId);-1===n?t.push(e):t.splice(n,1,e)},httpAuthSchemes:()=>t,setHttpAuthSchemeProvider(e){n=e},httpAuthSchemeProvider:()=>n,setCredentials(e){r=e},credentials:()=>r}})(e));return t.forEach(e=>e.configure(n)),Object.assign(e,(0,ni.$)(n),(0,ii.uv)(n),(0,ri.j)(n),{httpAuthSchemes:(r=n).httpAuthSchemes(),httpAuthSchemeProvider:r.httpAuthSchemeProvider(),credentials:r.credentials()});var r})((e=>{const t=(n=e,Object.assign(n,{stsClientCtor:si}));var n;const r=(0,$e.h)(t);return Object.assign(r,{authSchemePreference:(0,Pe.t)(e.authSchemePreference??[])})})((0,Te.C)(l)),e?.extensions||[]);this.config=d,this.middlewareStack.use((0,ve.wq)(this.config)),this.middlewareStack.use((0,ye.sM)(this.config)),this.middlewareStack.use((0,Ce.ey)(this.config)),this.middlewareStack.use((0,Ne.vK)(this.config)),this.middlewareStack.use((0,ge.TC)(this.config)),this.middlewareStack.use((0,me.Y7)(this.config)),this.middlewareStack.use((0,fe.n)(this.config)),this.middlewareStack.use((0,Ee.w)(this.config,{httpAuthSchemeParametersProvider:ke,identityProviderConfigProvider:async e=>new we.h({"aws.auth#sigv4":e.credentials})})),this.middlewareStack.use((0,Se.l)(this.config))}destroy(){super.destroy()}}const oi=(e,t)=>t?class extends e{constructor(e){super(e);for(const e of t)this.middlewareStack.use(e)}}:e,ai=(e={},t)=>((e,t)=>{let n,i;return async(s,o)=>{if(i=s,!n){const{logger:r=e?.parentClientConfig?.logger,profile:s=e?.parentClientConfig?.profile,region:o,requestHandler:a=e?.parentClientConfig?.requestHandler,credentialProviderLogger:c,userAgentAppId:l=e?.parentClientConfig?.userAgentAppId}=e,d=await he(o,e?.parentClientConfig?.region,c,{logger:r,profile:s}),p=!ue(a);n=new t({...e,userAgentAppId:l,profile:s,credentialDefaultProvider:()=>async()=>i,region:d,requestHandler:p?a:void 0,logger:r})}const{Credentials:a,AssumedRoleUser:c}=await n.send(new le(o));if(!a||!a.AccessKeyId||!a.SecretAccessKey)throw new Error(`Invalid response from STS.assumeRole call with role ${o.RoleArn}`);const l=pe(c),d={accessKeyId:a.AccessKeyId,secretAccessKey:a.SecretAccessKey,sessionToken:a.SessionToken,expiration:a.Expiration,...a.CredentialScope&&{credentialScope:a.CredentialScope},...l&&{accountId:l}};return(0,r.g)(d,"CREDENTIALS_STS_ASSUME_ROLE","i"),d}})(e,oi(si,t)),ci=(e={},t)=>((e,t)=>{let n;return async i=>{if(!n){const{logger:r=e?.parentClientConfig?.logger,profile:i=e?.parentClientConfig?.profile,region:s,requestHandler:o=e?.parentClientConfig?.requestHandler,credentialProviderLogger:a,userAgentAppId:c=e?.parentClientConfig?.userAgentAppId}=e,l=await he(s,e?.parentClientConfig?.region,a,{logger:r,profile:i}),d=!ue(o);n=new t({...e,userAgentAppId:c,profile:i,region:l,requestHandler:d?o:void 0,logger:r})}const{Credentials:s,AssumedRoleUser:o}=await n.send(new de(i));if(!s||!s.AccessKeyId||!s.SecretAccessKey)throw new Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${i.RoleArn}`);const a=pe(o),c={accessKeyId:s.AccessKeyId,secretAccessKey:s.SecretAccessKey,sessionToken:s.SessionToken,expiration:s.Expiration,...s.CredentialScope&&{credentialScope:s.CredentialScope},...a&&{accountId:a}};return a&&(0,r.g)(c,"RESOLVED_ACCOUNT_ID","T"),(0,r.g)(c,"CREDENTIALS_STS_ASSUME_ROLE_WEB_ID","k"),c}})(e,oi(si,t))}};