@apilift/cli 1.5.11 → 1.5.12

package/dist/apilift-collector.js

@@ -27953,7 +27953,16 @@ function parseUrl(value) {
 function loopback(host) {
   return host === "localhost" || host === "127.0.0.1" || host === "[::1]";
 }
-var import__, resourceKinds, resourceKindSchema, segmentSchema, appSlugSchema, actionNameSchema, generatedNameSchema, inputNameSchema, pointerSchema, categorySlugs, categorySchema, title, description, requiredDescription, originSchema, httpUrlSchema, requestUrlSchema, ajv, jsonSchema, valueSchema, requestSchema, responseSchema, proofPointer, proofComparison, proofKey, proofSelection, proofSchema, appDefinitionSchema, entityDefinitionSchema, generatedSchema, executableActionSchema, unavailableActionSchema, actionDefinitionSchema, locatorSchema, observeSchema, injectSchema, credentialSchema, probeSchema, transportDefinitionSchema, browserContextDefinitionSchema, definitionSchemas;
+function bodyIssues(v2, ctx) {
+  if (v2.form !== void 0 && v2.body !== void 0)
+    ctx.addIssue({ code: "custom", message: "form and JSON body are mutually exclusive" });
+  if ((v2.form !== void 0 || v2.body !== void 0) && ["GET", "HEAD"].includes(v2.method))
+    ctx.addIssue({ code: "custom", message: "GET/HEAD cannot have a request body" });
+  for (const [name, value] of Object.entries(v2.headers ?? {}))
+    if (name.toLowerCase() === "content-type" && (v2.form !== void 0 || v2.body !== void 0) && value !== (v2.form !== void 0 ? "application/x-www-form-urlencoded" : "application/json"))
+      ctx.addIssue({ code: "custom", message: "Content-Type conflicts with declared body encoding" });
+}
+var import__, resourceKinds, resourceKindSchema, segmentSchema, appSlugSchema, actionNameSchema, generatedNameSchema, inputNameSchema, pointerSchema, categorySlugs, categorySchema, title, description, requiredDescription, originSchema, httpUrlSchema, requestUrlSchema, ajv, jsonSchema, valueSchema, htmlFieldSchema, htmlExtractionSchema, continuationSchema, responseSchema, baseRequestSchema, readPreparationSchema, requestSchema, proofPointer, proofComparison, proofKey, proofSelection, proofSchema, appDefinitionSchema, entityDefinitionSchema, generatedSchema, executableActionSchema, unavailableActionSchema, actionDefinitionSchema, locatorSchema, observeSchema, injectSchema, credentialSchema, probeSchema, transportDefinitionSchema, browserContextDefinitionSchema, definitionSchemas;
 var init_schema = __esm({
   "../../packages/core/dist/definitions/schema.js"() {
     "use strict";
@@ -28000,17 +28009,37 @@ var init_schema = __esm({
       }
     }, "Expected a valid JSON Schema draft 2020-12 document");
     valueSchema = external_exports.lazy(() => external_exports.union([external_exports.null(), external_exports.boolean(), external_exports.number(), external_exports.string(), external_exports.array(valueSchema), external_exports.record(external_exports.string(), valueSchema)]));
-    requestSchema = external_exports.strictObject({
+    htmlFieldSchema = external_exports.lazy(() => external_exports.strictObject({ selector: external_exports.string().min(1).max(2e3).optional(), read: external_exports.enum(["text", "attribute", "value", "checked", "json"]).optional(), attribute: external_exports.string().min(1).optional(), type: external_exports.enum(["string", "number", "integer", "boolean"]).optional(), optional: external_exports.boolean().optional(), many: external_exports.boolean().optional(), fields: external_exports.record(external_exports.string(), htmlFieldSchema).optional() }).superRefine((v2, ctx) => {
+      if (v2.read === "attribute" && !v2.attribute)
+        ctx.addIssue({ code: "custom", message: "Attribute extraction requires attribute" });
+      if (v2.fields && (v2.read || v2.type || v2.attribute))
+        ctx.addIssue({ code: "custom", message: "Nested fields exclude scalar extraction" });
+    }));
+    htmlExtractionSchema = external_exports.strictObject({ marker: external_exports.string().min(1).max(2e3), fields: external_exports.record(external_exports.string(), htmlFieldSchema).refine((v2) => Object.keys(v2).length > 0), errors: external_exports.string().min(1).max(2e3).optional() });
+    continuationSchema = external_exports.strictObject({ statuses: external_exports.array(external_exports.number().int().min(200).max(599)).min(1).max(20), format: external_exports.enum(["json", "html"]), path: pointerSchema.optional(), selector: external_exports.string().min(1).optional(), attribute: external_exports.string().min(1).optional() }).superRefine((v2, ctx) => {
+      if (v2.format === "json" ? v2.path === void 0 || !!v2.selector || !!v2.attribute : !v2.selector || !v2.attribute || v2.path !== void 0)
+        ctx.addIssue({ code: "custom", message: "JSON continuation needs path; HTML continuation needs selector and attribute" });
+    });
+    responseSchema = external_exports.strictObject({ format: external_exports.enum(["json", "html"]).optional(), html: htmlExtractionSchema.optional(), continue: external_exports.array(continuationSchema).min(1).max(5).optional(), schema: jsonSchema.optional(), path: pointerSchema.optional(), fields: external_exports.record(external_exports.string(), pointerSchema).optional(), generated: generatedNameSchema.optional() }).superRefine((v2, ctx) => {
+      if (v2.generated && (v2.path !== void 0 || v2.fields !== void 0 || v2.html))
+        ctx.addIssue({ code: "custom", message: "generated excludes path and fields" });
+      if (v2.format === "html" !== !!v2.html)
+        ctx.addIssue({ code: "custom", message: "HTML responses require format: html and html extraction with a page marker" });
+    });
+    baseRequestSchema = external_exports.strictObject({
       method: external_exports.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]),
       url: requestUrlSchema,
       headers: external_exports.record(external_exports.string(), valueSchema).optional(),
       query: external_exports.record(external_exports.string(), external_exports.union([valueSchema, external_exports.array(valueSchema)])).optional(),
-      body: valueSchema.optional()
-    });
-    responseSchema = external_exports.strictObject({ schema: jsonSchema.optional(), path: pointerSchema.optional(), fields: external_exports.record(external_exports.string(), pointerSchema).optional(), generated: generatedNameSchema.optional() }).superRefine((v2, ctx) => {
-      if (v2.generated && (v2.path !== void 0 || v2.fields !== void 0))
-        ctx.addIssue({ code: "custom", message: "generated excludes path and fields" });
+      body: valueSchema.optional(),
+      form: external_exports.record(external_exports.string(), valueSchema).optional()
     });
+    readPreparationSchema = external_exports.strictObject({ request: baseRequestSchema.superRefine((v2, ctx) => {
+      bodyIssues(v2, ctx);
+      if (v2.method !== "GET")
+        ctx.addIssue({ code: "custom", message: "Preparation and identity checks must use GET" });
+    }), response: responseSchema });
+    requestSchema = baseRequestSchema.extend({ prepare: readPreparationSchema.optional() }).superRefine(bodyIssues);
     proofPointer = external_exports.string().refine((value) => {
       let valid = true;
       const resolved = value.replace(/\{(input|result|generated)\.([^{}]*)\}/gu, (token, kind, ref, offset) => {
@@ -28026,7 +28055,7 @@ var init_schema = __esm({
       if (!!v2.where === !!v2.key)
         ctx.addIssue({ code: "custom", message: "Select by exactly one of where or key" });
     });
-    proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: proofSelection.optional(), equals: external_exports.array(proofComparison).min(1).optional(), response: external_exports.strictObject({ path: proofPointer.optional(), schema: jsonSchema }).optional(), absent: external_exports.literal(true).optional() }).superRefine((v2, ctx) => {
+    proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: proofSelection.optional(), equals: external_exports.array(proofComparison).min(1).optional(), response: responseSchema.optional(), absent: external_exports.literal(true).optional() }).superRefine((v2, ctx) => {
       if (!!v2.equals === !!v2.absent)
         ctx.addIssue({ code: "custom", message: "Exactly one of equals and absent is required" });
       if (v2.select && v2.absent && !v2.select.complete)
@@ -28072,17 +28101,17 @@ var init_schema = __esm({
           ctx.addIssue({ code: "custom", path: [key], message: `${key} required for ${v2.in}` });
     });
     observeSchema = external_exports.strictObject({ kind: external_exports.literal("observe"), request: external_exports.strictObject({ method: external_exports.string(), urlPattern: external_exports.string() }), extract: external_exports.strictObject({ in: external_exports.enum(["request-header", "response-header", "response-body"]), name: external_exports.string().optional(), path: pointerSchema.optional() }), trigger: external_exports.union([external_exports.strictObject({ kind: external_exports.literal("navigate"), url: httpUrlSchema }), external_exports.strictObject({ kind: external_exports.literal("selector"), selector: external_exports.string() })]).optional(), cache: external_exports.literal("browser-session") });
-    injectSchema = external_exports.strictObject({ from: external_exports.union([locatorSchema, observeSchema]), to: external_exports.union([external_exports.strictObject({ in: external_exports.literal("header"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("query"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("body"), path: pointerSchema })]) });
+    injectSchema = external_exports.strictObject({ from: external_exports.union([locatorSchema, observeSchema]), to: external_exports.union([external_exports.strictObject({ in: external_exports.literal("header"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("query"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("body"), path: pointerSchema }), external_exports.strictObject({ in: external_exports.literal("form"), name: external_exports.string().min(1) })]) });
     credentialSchema = external_exports.strictObject({ name: generatedNameSchema, header: external_exports.string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/), prefix: external_exports.string().max(80).refine((v2) => !/[\r\n]/.test(v2)).optional() });
-    probeSchema = external_exports.strictObject({ effect: external_exports.literal("read").optional(), request: requestSchema, response: external_exports.strictObject({ schema: jsonSchema.optional(), path: pointerSchema.optional() }), inputs: jsonSchema.optional() });
-    transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.optional(), allowedOrigins: external_exports.array(originSchema).min(1).max(100), browserContext: segmentSchema.optional(), credentials: external_exports.array(credentialSchema).max(16).optional(), inject: external_exports.array(injectSchema).optional(), probes: external_exports.record(external_exports.string(), probeSchema) }).superRefine((v2, ctx) => {
+    probeSchema = external_exports.strictObject({ effect: external_exports.literal("read").optional(), request: requestSchema, response: responseSchema, inputs: jsonSchema.optional() });
+    transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.optional(), allowedOrigins: external_exports.array(originSchema).min(1).max(100), browserContext: segmentSchema.optional(), credentials: external_exports.array(credentialSchema).max(16).optional(), inject: external_exports.array(injectSchema).optional(), identity: readPreparationSchema.extend({ paths: external_exports.array(pointerSchema).min(1).max(8) }).optional(), probes: external_exports.record(external_exports.string(), probeSchema) }).superRefine((v2, ctx) => {
       if (new Set(v2.allowedOrigins).size !== v2.allowedOrigins.length)
         ctx.addIssue({ code: "custom", path: ["allowedOrigins"], message: "Origins must be distinct" });
       if (v2.mode === "direct" && !v2.baseUrl)
         ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Direct transport requires baseUrl" });
       if (v2.mode === "browser" && !v2.browserContext)
         ctx.addIssue({ code: "custom", path: ["browserContext"], message: "Browser transport requires browserContext" });
-      if (v2.mode === "direct" && (v2.browserContext || v2.inject))
+      if (v2.mode === "direct" && (v2.browserContext || v2.inject || v2.identity))
         ctx.addIssue({ code: "custom", message: "browserContext and inject require browser mode" });
       if (v2.baseUrl && !v2.allowedOrigins.includes(parseUrl(v2.baseUrl)?.origin ?? ""))
         ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Base URL origin must be allowed" });
@@ -28371,7 +28400,7 @@ function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
   const transport = async (input2, init) => {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers);
-    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3");
+    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3,web-responses-v1");
     headers.set("Apilift-Client", `cli/${cliVersion}`);
     if (token) headers.set("Authorization", `Bearer ${token}`);
     if (sessionId) headers.set("Apilift-Session", sessionId);

package/dist/apilift-native-host.js

@@ -29446,17 +29446,46 @@ var jsonSchema = external_exports.custom((value) => {
   }
 }, "Expected a valid JSON Schema draft 2020-12 document");
 var valueSchema = external_exports.lazy(() => external_exports.union([external_exports.null(), external_exports.boolean(), external_exports.number(), external_exports.string(), external_exports.array(valueSchema), external_exports.record(external_exports.string(), valueSchema)]));
-var requestSchema = external_exports.strictObject({
+var htmlFieldSchema = external_exports.lazy(() => external_exports.strictObject({ selector: external_exports.string().min(1).max(2e3).optional(), read: external_exports.enum(["text", "attribute", "value", "checked", "json"]).optional(), attribute: external_exports.string().min(1).optional(), type: external_exports.enum(["string", "number", "integer", "boolean"]).optional(), optional: external_exports.boolean().optional(), many: external_exports.boolean().optional(), fields: external_exports.record(external_exports.string(), htmlFieldSchema).optional() }).superRefine((v, ctx) => {
+  if (v.read === "attribute" && !v.attribute)
+    ctx.addIssue({ code: "custom", message: "Attribute extraction requires attribute" });
+  if (v.fields && (v.read || v.type || v.attribute))
+    ctx.addIssue({ code: "custom", message: "Nested fields exclude scalar extraction" });
+}));
+var htmlExtractionSchema = external_exports.strictObject({ marker: external_exports.string().min(1).max(2e3), fields: external_exports.record(external_exports.string(), htmlFieldSchema).refine((v) => Object.keys(v).length > 0), errors: external_exports.string().min(1).max(2e3).optional() });
+var continuationSchema = external_exports.strictObject({ statuses: external_exports.array(external_exports.number().int().min(200).max(599)).min(1).max(20), format: external_exports.enum(["json", "html"]), path: pointerSchema.optional(), selector: external_exports.string().min(1).optional(), attribute: external_exports.string().min(1).optional() }).superRefine((v, ctx) => {
+  if (v.format === "json" ? v.path === void 0 || !!v.selector || !!v.attribute : !v.selector || !v.attribute || v.path !== void 0)
+    ctx.addIssue({ code: "custom", message: "JSON continuation needs path; HTML continuation needs selector and attribute" });
+});
+var responseSchema = external_exports.strictObject({ format: external_exports.enum(["json", "html"]).optional(), html: htmlExtractionSchema.optional(), continue: external_exports.array(continuationSchema).min(1).max(5).optional(), schema: jsonSchema.optional(), path: pointerSchema.optional(), fields: external_exports.record(external_exports.string(), pointerSchema).optional(), generated: generatedNameSchema.optional() }).superRefine((v, ctx) => {
+  if (v.generated && (v.path !== void 0 || v.fields !== void 0 || v.html))
+    ctx.addIssue({ code: "custom", message: "generated excludes path and fields" });
+  if (v.format === "html" !== !!v.html)
+    ctx.addIssue({ code: "custom", message: "HTML responses require format: html and html extraction with a page marker" });
+});
+var baseRequestSchema = external_exports.strictObject({
   method: external_exports.enum(["GET", "HEAD", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"]),
   url: requestUrlSchema,
   headers: external_exports.record(external_exports.string(), valueSchema).optional(),
   query: external_exports.record(external_exports.string(), external_exports.union([valueSchema, external_exports.array(valueSchema)])).optional(),
-  body: valueSchema.optional()
-});
-var responseSchema = external_exports.strictObject({ schema: jsonSchema.optional(), path: pointerSchema.optional(), fields: external_exports.record(external_exports.string(), pointerSchema).optional(), generated: generatedNameSchema.optional() }).superRefine((v, ctx) => {
-  if (v.generated && (v.path !== void 0 || v.fields !== void 0))
-    ctx.addIssue({ code: "custom", message: "generated excludes path and fields" });
-});
+  body: valueSchema.optional(),
+  form: external_exports.record(external_exports.string(), valueSchema).optional()
+});
+function bodyIssues(v, ctx) {
+  if (v.form !== void 0 && v.body !== void 0)
+    ctx.addIssue({ code: "custom", message: "form and JSON body are mutually exclusive" });
+  if ((v.form !== void 0 || v.body !== void 0) && ["GET", "HEAD"].includes(v.method))
+    ctx.addIssue({ code: "custom", message: "GET/HEAD cannot have a request body" });
+  for (const [name, value] of Object.entries(v.headers ?? {}))
+    if (name.toLowerCase() === "content-type" && (v.form !== void 0 || v.body !== void 0) && value !== (v.form !== void 0 ? "application/x-www-form-urlencoded" : "application/json"))
+      ctx.addIssue({ code: "custom", message: "Content-Type conflicts with declared body encoding" });
+}
+var readPreparationSchema = external_exports.strictObject({ request: baseRequestSchema.superRefine((v, ctx) => {
+  bodyIssues(v, ctx);
+  if (v.method !== "GET")
+    ctx.addIssue({ code: "custom", message: "Preparation and identity checks must use GET" });
+}), response: responseSchema });
+var requestSchema = baseRequestSchema.extend({ prepare: readPreparationSchema.optional() }).superRefine(bodyIssues);
 var proofPointer = external_exports.string().refine((value) => {
   let valid2 = true;
   const resolved = value.replace(/\{(input|result|generated)\.([^{}]*)\}/gu, (token, kind, ref, offset) => {
@@ -29472,7 +29501,7 @@ var proofSelection = external_exports.strictObject({ path: proofPointer, where:
   if (!!v.where === !!v.key)
     ctx.addIssue({ code: "custom", message: "Select by exactly one of where or key" });
 });
-var proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: proofSelection.optional(), equals: external_exports.array(proofComparison).min(1).optional(), response: external_exports.strictObject({ path: proofPointer.optional(), schema: jsonSchema }).optional(), absent: external_exports.literal(true).optional() }).superRefine((v, ctx) => {
+var proofSchema = external_exports.strictObject({ request: requestSchema, effect: external_exports.literal("read").optional(), select: proofSelection.optional(), equals: external_exports.array(proofComparison).min(1).optional(), response: responseSchema.optional(), absent: external_exports.literal(true).optional() }).superRefine((v, ctx) => {
   if (!!v.equals === !!v.absent)
     ctx.addIssue({ code: "custom", message: "Exactly one of equals and absent is required" });
   if (v.select && v.absent && !v.select.complete)
@@ -29518,17 +29547,17 @@ var locatorSchema = external_exports.strictObject({ kind: external_exports.liter
       ctx.addIssue({ code: "custom", path: [key], message: `${key} required for ${v.in}` });
 });
 var observeSchema = external_exports.strictObject({ kind: external_exports.literal("observe"), request: external_exports.strictObject({ method: external_exports.string(), urlPattern: external_exports.string() }), extract: external_exports.strictObject({ in: external_exports.enum(["request-header", "response-header", "response-body"]), name: external_exports.string().optional(), path: pointerSchema.optional() }), trigger: external_exports.union([external_exports.strictObject({ kind: external_exports.literal("navigate"), url: httpUrlSchema }), external_exports.strictObject({ kind: external_exports.literal("selector"), selector: external_exports.string() })]).optional(), cache: external_exports.literal("browser-session") });
-var injectSchema = external_exports.strictObject({ from: external_exports.union([locatorSchema, observeSchema]), to: external_exports.union([external_exports.strictObject({ in: external_exports.literal("header"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("query"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("body"), path: pointerSchema })]) });
+var injectSchema = external_exports.strictObject({ from: external_exports.union([locatorSchema, observeSchema]), to: external_exports.union([external_exports.strictObject({ in: external_exports.literal("header"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("query"), name: external_exports.string() }), external_exports.strictObject({ in: external_exports.literal("body"), path: pointerSchema }), external_exports.strictObject({ in: external_exports.literal("form"), name: external_exports.string().min(1) })]) });
 var credentialSchema = external_exports.strictObject({ name: generatedNameSchema, header: external_exports.string().regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/), prefix: external_exports.string().max(80).refine((v) => !/[\r\n]/.test(v)).optional() });
-var probeSchema = external_exports.strictObject({ effect: external_exports.literal("read").optional(), request: requestSchema, response: external_exports.strictObject({ schema: jsonSchema.optional(), path: pointerSchema.optional() }), inputs: jsonSchema.optional() });
-var transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.optional(), allowedOrigins: external_exports.array(originSchema).min(1).max(100), browserContext: segmentSchema.optional(), credentials: external_exports.array(credentialSchema).max(16).optional(), inject: external_exports.array(injectSchema).optional(), probes: external_exports.record(external_exports.string(), probeSchema) }).superRefine((v, ctx) => {
+var probeSchema = external_exports.strictObject({ effect: external_exports.literal("read").optional(), request: requestSchema, response: responseSchema, inputs: jsonSchema.optional() });
+var transportDefinitionSchema = external_exports.strictObject({ title, description: requiredDescription, mode: external_exports.enum(["direct", "browser"]), baseUrl: requestUrlSchema.optional(), allowedOrigins: external_exports.array(originSchema).min(1).max(100), browserContext: segmentSchema.optional(), credentials: external_exports.array(credentialSchema).max(16).optional(), inject: external_exports.array(injectSchema).optional(), identity: readPreparationSchema.extend({ paths: external_exports.array(pointerSchema).min(1).max(8) }).optional(), probes: external_exports.record(external_exports.string(), probeSchema) }).superRefine((v, ctx) => {
   if (new Set(v.allowedOrigins).size !== v.allowedOrigins.length)
     ctx.addIssue({ code: "custom", path: ["allowedOrigins"], message: "Origins must be distinct" });
   if (v.mode === "direct" && !v.baseUrl)
     ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Direct transport requires baseUrl" });
   if (v.mode === "browser" && !v.browserContext)
     ctx.addIssue({ code: "custom", path: ["browserContext"], message: "Browser transport requires browserContext" });
-  if (v.mode === "direct" && (v.browserContext || v.inject))
+  if (v.mode === "direct" && (v.browserContext || v.inject || v.identity))
     ctx.addIssue({ code: "custom", message: "browserContext and inject require browser mode" });
   if (v.baseUrl && !v.allowedOrigins.includes(parseUrl(v.baseUrl)?.origin ?? ""))
     ctx.addIssue({ code: "custom", path: ["baseUrl"], message: "Base URL origin must be allowed" });
@@ -29597,6 +29626,8 @@ function inspectRequest(request2, inputs, generated, proof, base2, issues) {
       const [key, ref] = entries[0] ?? [];
       if (key === "$input" && typeof ref === "string" && inputs.has(ref))
         return;
+      if (key === "$prepared" && typeof ref === "string" && request2.prepare && pointerSchema.safeParse(ref).success)
+        return;
       if (key === "$generated" && typeof ref === "string" && generated.has(ref))
         return;
       if (proof && key === "$result" && typeof ref === "string" && pointerSchema.safeParse(ref).success)
@@ -29620,6 +29651,9 @@ function inspectRequest(request2, inputs, generated, proof, base2, issues) {
   }
   walk(request2.query, `${base2}/query`);
   walk(request2.body, `${base2}/body`);
+  walk(request2.form, `${base2}/form`);
+  if (request2.prepare)
+    inspectRequest(request2.prepare.request, inputs, generated, proof, `${base2}/prepare/request`, issues);
 }
 function validateDefinition(kind, name, value) {
   const issues = [];
@@ -29674,6 +29708,8 @@ function validateDefinition(kind, name, value) {
       const props = probe.inputs && typeof probe.inputs === "object" && probe.inputs.properties && typeof probe.inputs.properties === "object" ? Object.keys(probe.inputs.properties) : [];
       inspectRequest(probe.request, new Set(props), /* @__PURE__ */ new Set(), false, `/probes/${origin}/request`, issues);
     }
+    if (definition2.identity)
+      inspectRequest(definition2.identity.request, /* @__PURE__ */ new Set(), /* @__PURE__ */ new Set(), false, "/identity/request", issues);
     for (const [i, rule] of (definition2.inject ?? []).entries())
       if (rule.to.in === "header" && rule.to.name.toLowerCase() === "cookie")
         issues.push({ path: `/inject/${i}/to/name`, message: "Cookie header cannot be injected" });
@@ -29850,7 +29886,7 @@ function createCliApi(baseUrl, fetcher = fetch, token, sessionId) {
   const transport = async (input2, init) => {
     const method = init?.method ?? "GET";
     const headers = new Headers(init?.headers);
-    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3");
+    headers.set("Apilift-Capabilities", "distributed-rollouts-v1,discovery-proof-v2,dynamic-bindings-v1,collection-proof-v3,web-responses-v1");
     headers.set("Apilift-Client", `cli/${cliVersion}`);
     if (token) headers.set("Authorization", `Bearer ${token}`);
     if (sessionId) headers.set("Apilift-Session", sessionId);