npm - @chain305/x-security - Versions diffs - 0.1.2 → 0.2.0 - Mend

@chain305/x-security 0.1.2 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/bin/xsecurity.mjs CHANGED Viewed

@@ -13,10 +13,10 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
-var __glob = (map3) => (path28) => {
-  var fn = map3[path28];
+var __glob = (map3) => (path30) => {
+  var fn = map3[path30];
   if (fn) return fn();
-  throw new Error("Module not found in bundle: " + path28);
+  throw new Error("Module not found in bundle: " + path30);
 };
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
@@ -1098,8 +1098,8 @@ function buildRuleBasedAuthzPlugins(authz, ctx = {}) {
 function luaHostSet(domains) {
   return "{" + domains.map((d5) => `[${luaStr(d5.toLowerCase())}]=true`).join(", ") + "}";
 }
-function buildSsrfPreFunctionPlugins(request7, ctx = {}) {
-  const schema = request7?.schema;
+function buildSsrfPreFunctionPlugins(request9, ctx = {}) {
+  const schema = request9?.schema;
   if (!schema) return [];
   const items = [];
   for (const [field, ps] of Object.entries(schema)) {
@@ -1160,11 +1160,11 @@ function buildSsrfPreFunctionPlugins(request7, ctx = {}) {
     tags: [SS_SSRF_TAG]
   }];
 }
-function buildMassAssignPreFunctionPlugins(request7, ctx = {}) {
-  if (!request7) return [];
-  const explicitAllow = Array.isArray(request7.allowedFields) ? request7.allowedFields : void 0;
-  const schemaKeys = request7.schema ? Object.keys(request7.schema) : [];
-  const denyUnknown = request7.denyUnknownFields === true;
+function buildMassAssignPreFunctionPlugins(request9, ctx = {}) {
+  if (!request9) return [];
+  const explicitAllow = Array.isArray(request9.allowedFields) ? request9.allowedFields : void 0;
+  const schemaKeys = request9.schema ? Object.keys(request9.schema) : [];
+  const denyUnknown = request9.denyUnknownFields === true;
   let allow;
   if (explicitAllow && explicitAllow.length > 0) {
     allow = explicitAllow;
@@ -1208,12 +1208,12 @@ function buildMassAssignPreFunctionPlugins(request7, ctx = {}) {
     tags: [SS_MASS_ASSIGN_TAG]
   }];
 }
-function buildSqliPreFunctionPlugins(request7, ctx = {}) {
-  if (!request7) return [];
-  const ct = request7.contentType ?? [];
+function buildSqliPreFunctionPlugins(request9, ctx = {}) {
+  if (!request9) return [];
+  const ct = request9.contentType ?? [];
   const acceptsJson = ct.some((t) => t.toLowerCase().includes("json"));
   if (!acceptsJson) return [];
-  if (!request7.schema || Object.keys(request7.schema).length === 0) return [];
+  if (!request9.schema || Object.keys(request9.schema).length === 0) return [];
   const checks = [];
   for (let i5 = 0; i5 < SQLI_LUA_PATTERNS.length; i5++) {
     checks.push(`      if vl:match(${luaStr(SQLI_LUA_PATTERNS[i5])}) then return k, ${i5 + 1} end`);
@@ -2844,9 +2844,9 @@ var init_v07_rules = __esm({
 });
 // src/generators/coraza/rules.ts
-function endpointHash3(method, path28) {
+function endpointHash3(method, path30) {
   let h5 = 2166136261 >>> 0;
-  const s = `${method} ${path28}`;
+  const s = `${method} ${path30}`;
   for (let i5 = 0; i5 < s.length; i5++) {
     h5 ^= s.charCodeAt(i5);
     h5 = Math.imul(h5, 16777619) >>> 0;
@@ -2880,8 +2880,8 @@ function parseDurationSec(v) {
   const unit = (m3[2] ?? "s").toLowerCase();
   return unit === "d" ? n2 * 86400 : unit === "h" ? n2 * 3600 : unit === "m" ? n2 * 60 : n2;
 }
-function pathRegex(path28) {
-  const escaped = path28.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+function pathRegex(path30) {
+  const escaped = path30.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
   const withParams = escaped.replace(/\\\{[^/]+?\\\}/g, "[^/]+");
   return `^${withParams}$`;
 }
@@ -3795,16 +3795,16 @@ function durationToHaproxy(window2) {
   if (!Number.isFinite(secs) || secs <= 0) return "1m";
   return window2.trim();
 }
-function slugify(method, path28) {
-  const raw = `${method}_${path28}`.toLowerCase();
+function slugify(method, path30) {
+  const raw = `${method}_${path30}`.toLowerCase();
   return raw.replace(/[{}]/g, "").replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 60);
 }
-function aclPathPredicate(aclName, path28) {
-  const firstBrace = path28.indexOf("{");
+function aclPathPredicate(aclName, path30) {
+  const firstBrace = path30.indexOf("{");
   if (firstBrace === -1) {
-    return `acl ${aclName} path ${path28}`;
+    return `acl ${aclName} path ${path30}`;
   }
-  const prefix = path28.slice(0, firstBrace);
+  const prefix = path30.slice(0, firstBrace);
   return `acl ${aclName} path_beg ${prefix}`;
 }
 function flattenIdentifier(id) {
@@ -4063,8 +4063,8 @@ var init_haproxy_stick_tables = __esm({
 });
 // src/generators/coraza/templates/modsec-nginx-server.ts
-function pathToNginxLocation(path28) {
-  const re = path28.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\\\{([^/]+?)\\\}/g, "(?<$1>[^/]+)");
+function pathToNginxLocation(path30) {
+  const re = path30.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\\\{([^/]+?)\\\}/g, "(?<$1>[^/]+)");
   return `^${re}$`;
 }
 function buildEndpointBlock(ep) {
@@ -4388,10 +4388,10 @@ function createCorazaGenerator(opts = {}) {
         if (profile.name !== "coraza-go") meta["engine"] = profile.name;
         meta["source"] = { title: spec.info.title, version: spec.info.version };
         meta["directives"] = directives;
-        const yaml17 = dump(meta, { lineWidth: -1, noRefs: true });
+        const yaml18 = dump(meta, { lineWidth: -1, noRefs: true });
         artifacts.push({
           path: "coraza.yml",
-          content: yaml17,
+          content: yaml18,
           format: "yaml"
         });
       }
@@ -4893,9 +4893,9 @@ function pathRegex2(p2) {
   }).join("/");
   return `^/${rebuilt}$`;
 }
-function slotIdFor(method, path28) {
+function slotIdFor(method, path30) {
   let h5 = 0;
-  const s = `${method} ${path28}`;
+  const s = `${method} ${path30}`;
   for (let i5 = 0; i5 < s.length; i5++) h5 = (h5 << 5) - h5 + s.charCodeAt(i5) | 0;
   return Math.abs(h5) % 100;
 }
@@ -4938,9 +4938,9 @@ function pathRegex3(p2) {
   }).join("/");
   return `^/${rebuilt}$`;
 }
-function slotIdFor2(method, path28) {
+function slotIdFor2(method, path30) {
   let h5 = 0;
-  const s = `${method} ${path28}`;
+  const s = `${method} ${path30}`;
   for (let i5 = 0; i5 < s.length; i5++) h5 = (h5 << 5) - h5 + s.charCodeAt(i5) | 0;
   return Math.abs(h5) % 50 * 2;
 }
@@ -5007,9 +5007,9 @@ function pathRegex4(p2) {
   }).join("/");
   return `^/${rebuilt}$`;
 }
-function stableHash(method, path28) {
+function stableHash(method, path30) {
   let h5 = 0;
-  const s = `${method} ${path28}`;
+  const s = `${method} ${path30}`;
   for (let i5 = 0; i5 < s.length; i5++) h5 = (h5 << 5) - h5 + s.charCodeAt(i5) | 0;
   return Math.abs(h5);
 }
@@ -7051,19 +7051,19 @@ var init_firewall = __esm({
 function yamlString(s) {
   return '"' + s.replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"';
 }
-function pathToSafeRegex(path28) {
+function pathToSafeRegex(path30) {
   const parts = [];
   let i5 = 0;
-  while (i5 < path28.length) {
-    const open = path28.indexOf("{", i5);
+  while (i5 < path30.length) {
+    const open = path30.indexOf("{", i5);
     if (open === -1) {
-      parts.push(escapeRegex(path28.slice(i5)));
+      parts.push(escapeRegex(path30.slice(i5)));
       break;
     }
-    if (open > i5) parts.push(escapeRegex(path28.slice(i5, open)));
-    const close = path28.indexOf("}", open + 1);
+    if (open > i5) parts.push(escapeRegex(path30.slice(i5, open)));
+    const close = path30.indexOf("}", open + 1);
     if (close === -1) {
-      parts.push(escapeRegex(path28.slice(open)));
+      parts.push(escapeRegex(path30.slice(open)));
       break;
     }
     parts.push("[^/]+");
@@ -7148,19 +7148,19 @@ var init_clusters = __esm({
 function regoString(s) {
   return '"' + s.replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"';
 }
-function pathToRegoRegex(path28) {
+function pathToRegoRegex(path30) {
   const parts = [];
   let i5 = 0;
-  while (i5 < path28.length) {
-    const open = path28.indexOf("{", i5);
+  while (i5 < path30.length) {
+    const open = path30.indexOf("{", i5);
     if (open === -1) {
-      parts.push(escapeRegex2(path28.slice(i5)));
+      parts.push(escapeRegex2(path30.slice(i5)));
       break;
     }
-    if (open > i5) parts.push(escapeRegex2(path28.slice(i5, open)));
-    const close = path28.indexOf("}", open + 1);
+    if (open > i5) parts.push(escapeRegex2(path30.slice(i5, open)));
+    const close = path30.indexOf("}", open + 1);
     if (close === -1) {
-      parts.push(escapeRegex2(path28.slice(open)));
+      parts.push(escapeRegex2(path30.slice(open)));
       break;
     }
     parts.push("[^/]+");
@@ -7171,8 +7171,8 @@ function pathToRegoRegex(path28) {
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
-function paramSplitIndex(path28, paramName) {
-  const parts = path28.split("/");
+function paramSplitIndex(path30, paramName) {
+  const parts = path30.split("/");
   for (let i5 = 0; i5 < parts.length; i5++) {
     if (parts[i5] === `{${paramName}}`) return i5;
   }
@@ -7911,11 +7911,11 @@ function emitSinkTypedConfig(lines, indent, r5) {
     lines.push(`${indent}      transport_api_version: V3`);
     return;
   }
-  const path28 = r5.sink === "file" ? "/var/log/envoy/access.log" : "/dev/stdout";
+  const path30 = r5.sink === "file" ? "/var/log/envoy/access.log" : "/dev/stdout";
   lines.push(`${indent}- name: envoy.access_loggers.file`);
   lines.push(`${indent}  typed_config:`);
   lines.push(`${indent}    "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog`);
-  lines.push(`${indent}    path: ${path28}`);
+  lines.push(`${indent}    path: ${path30}`);
   lines.push(`${indent}    log_format:`);
   lines.push(`${indent}      json_format:`);
   for (const [k5, v] of fields) {
@@ -8670,19 +8670,19 @@ function endpointNeedsLua(ep) {
     r5.contentType || r5.maxBodySize || r5.duplicateParamPolicy || r5.headerInjectionGuard || r5.signature
   );
 }
-function envoyPathPattern(path28) {
+function envoyPathPattern(path30) {
   const parts = [];
   let i5 = 0;
-  while (i5 < path28.length) {
-    const open = path28.indexOf("{", i5);
+  while (i5 < path30.length) {
+    const open = path30.indexOf("{", i5);
     if (open === -1) {
-      parts.push(escapeLuaPattern(path28.slice(i5)));
+      parts.push(escapeLuaPattern(path30.slice(i5)));
       break;
     }
-    if (open > i5) parts.push(escapeLuaPattern(path28.slice(i5, open)));
-    const close = path28.indexOf("}", open + 1);
+    if (open > i5) parts.push(escapeLuaPattern(path30.slice(i5, open)));
+    const close = path30.indexOf("}", open + 1);
     if (close === -1) {
-      parts.push(escapeLuaPattern(path28.slice(open)));
+      parts.push(escapeLuaPattern(path30.slice(open)));
       break;
     }
     parts.push("[^/]+");
@@ -8831,10 +8831,10 @@ function buildMethodAllowlist(endpoints) {
     byPath.set(ep.path, set);
   }
   const out = [];
-  for (const [path28, methods] of byPath.entries()) {
+  for (const [path30, methods] of byPath.entries()) {
     out.push({
-      path: path28,
-      pattern: envoyPathPattern(path28),
+      path: path30,
+      pattern: envoyPathPattern(path30),
       methods: [...methods]
     });
   }
@@ -9123,9 +9123,9 @@ var require_util = __commonJS({
     var parse = (u) => new URL(u);
     exports.swaggerParamRegExp = /\{([^/}]+)}/g;
     var operationsList = ["get", "post", "put", "delete", "patch", "options", "head", "trace"];
-    function fixServers(server, path28) {
+    function fixServers(server, path30) {
       if (server.url && server.url.startsWith("/")) {
-        const inUrl = parse(path28);
+        const inUrl = parse(path30);
         const finalUrl = inUrl.protocol + "//" + inUrl.hostname + server.url;
         server.url = finalUrl;
         return server;
@@ -9137,8 +9137,8 @@ var require_util = __commonJS({
           schema.servers.map((server) => fixServers(server, filePath));
         }
         ["paths", "webhooks"].forEach((component) => {
-          Object.keys(schema[component] || []).forEach((path28) => {
-            const pathItem = schema[component][path28];
+          Object.keys(schema[component] || []).forEach((path30) => {
+            const pathItem = schema[component][path30];
             Object.keys(pathItem).forEach((opItem) => {
               if (opItem === "servers") {
                 pathItem[opItem].map((server) => fixServers(server, filePath));
@@ -12708,8 +12708,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path28) {
-      let input = path28;
+    function removeDotSegments(path30) {
+      let input = path30;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -12961,8 +12961,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path28, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path28 && path28 !== "/" ? path28 : void 0;
+        const [path30, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path30 && path30 !== "/" ? path30 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -21753,10 +21753,10 @@ var require_spec = __commonJS({
       let paths = Object.keys(api.paths || {});
       let operationIds = [];
       for (let pathName of paths) {
-        let path28 = api.paths[pathName];
+        let path30 = api.paths[pathName];
         let pathId = "/paths" + pathName;
-        if (path28 && pathName.indexOf("/") === 0) {
-          validatePath(api, path28, pathId, operationIds);
+        if (path30 && pathName.indexOf("/") === 0) {
+          validatePath(api, path30, pathId, operationIds);
         }
       }
       let definitions = Object.keys(api.definitions || {});
@@ -21766,9 +21766,9 @@ var require_spec = __commonJS({
         validateRequiredPropertiesExist(definition, definitionId);
       }
     }
-    function validatePath(api, path28, pathId, operationIds) {
+    function validatePath(api, path30, pathId, operationIds) {
       for (let operationName of swaggerMethods) {
-        let operation2 = path28[operationName];
+        let operation2 = path30[operationName];
         let operationId = pathId + "/" + operationName;
         if (operation2) {
           let declaredOperationId = operation2.operationId;
@@ -21779,7 +21779,7 @@ var require_spec = __commonJS({
               throw ono.syntax(`Validation failed. Duplicate operation id '${declaredOperationId}'`);
             }
           }
-          validateParameters(api, path28, pathId, operation2, operationId);
+          validateParameters(api, path30, pathId, operation2, operationId);
           let responses = Object.keys(operation2.responses || {});
           for (let responseName of responses) {
             let response = operation2.responses[responseName];
@@ -21789,8 +21789,8 @@ var require_spec = __commonJS({
         }
       }
     }
-    function validateParameters(api, path28, pathId, operation2, operationId) {
-      let pathParams = path28.parameters || [];
+    function validateParameters(api, path30, pathId, operation2, operationId) {
+      let pathParams = path30.parameters || [];
       let operationParams = operation2.parameters || [];
       try {
         checkForDuplicates(pathParams);
@@ -22085,57 +22085,57 @@ var require_url = __commonJS({
       if (typeof window !== "undefined") {
         return location.href;
       }
-      const path28 = process.cwd();
-      const lastChar = path28.slice(-1);
+      const path30 = process.cwd();
+      const lastChar = path30.slice(-1);
       if (lastChar === "/" || lastChar === "\\") {
-        return path28;
+        return path30;
       } else {
-        return path28 + "/";
+        return path30 + "/";
       }
     }
-    function getProtocol(path28) {
-      const match = protocolPattern.exec(path28 || "");
+    function getProtocol(path30) {
+      const match = protocolPattern.exec(path30 || "");
       if (match) {
         return match[1].toLowerCase();
       }
       return void 0;
     }
-    function getExtension(path28) {
-      const lastDot = path28.lastIndexOf(".");
+    function getExtension(path30) {
+      const lastDot = path30.lastIndexOf(".");
       if (lastDot >= 0) {
-        return stripQuery(path28.substr(lastDot).toLowerCase());
+        return stripQuery(path30.substr(lastDot).toLowerCase());
       }
       return "";
     }
-    function stripQuery(path28) {
-      const queryIndex = path28.indexOf("?");
+    function stripQuery(path30) {
+      const queryIndex = path30.indexOf("?");
       if (queryIndex >= 0) {
-        path28 = path28.substr(0, queryIndex);
+        path30 = path30.substr(0, queryIndex);
       }
-      return path28;
+      return path30;
     }
-    function getHash(path28) {
-      if (!path28) {
+    function getHash(path30) {
+      if (!path30) {
         return "#";
       }
-      const hashIndex = path28.indexOf("#");
+      const hashIndex = path30.indexOf("#");
       if (hashIndex >= 0) {
-        return path28.substring(hashIndex);
+        return path30.substring(hashIndex);
       }
       return "#";
     }
-    function stripHash(path28) {
-      if (!path28) {
+    function stripHash(path30) {
+      if (!path30) {
         return "";
       }
-      const hashIndex = path28.indexOf("#");
+      const hashIndex = path30.indexOf("#");
       if (hashIndex >= 0) {
-        path28 = path28.substring(0, hashIndex);
+        path30 = path30.substring(0, hashIndex);
       }
-      return path28;
+      return path30;
     }
-    function isHttp(path28) {
-      const protocol = getProtocol(path28);
+    function isHttp(path30) {
+      const protocol = getProtocol(path30);
       if (protocol === "http" || protocol === "https") {
         return true;
       } else if (protocol === void 0) {
@@ -22144,58 +22144,58 @@ var require_url = __commonJS({
         return false;
       }
     }
-    function isFileSystemPath(path28) {
+    function isFileSystemPath(path30) {
       if (typeof window !== "undefined" || typeof process !== "undefined" && process.browser) {
         return false;
       }
-      const protocol = getProtocol(path28);
+      const protocol = getProtocol(path30);
       return protocol === void 0 || protocol === "file";
     }
-    function fromFileSystemPath(path28) {
+    function fromFileSystemPath(path30) {
       if ((0, is_windows_1.isWindows)()) {
         const projectDir = cwd();
-        const upperPath = path28.toUpperCase();
+        const upperPath = path30.toUpperCase();
         const projectDirPosixPath = (0, convert_path_to_posix_1.default)(projectDir);
         const posixUpper = projectDirPosixPath.toUpperCase();
         const hasProjectDir = upperPath.includes(posixUpper);
         const hasProjectUri = upperPath.includes(posixUpper);
-        const isAbsolutePath = path_1.win32?.isAbsolute(path28) || path28.startsWith("http://") || path28.startsWith("https://") || path28.startsWith("file://");
+        const isAbsolutePath = path_1.win32?.isAbsolute(path30) || path30.startsWith("http://") || path30.startsWith("https://") || path30.startsWith("file://");
         if (!(hasProjectDir || hasProjectUri || isAbsolutePath) && !projectDir.startsWith("http")) {
-          path28 = (0, path_2.join)(projectDir, path28);
+          path30 = (0, path_2.join)(projectDir, path30);
         }
-        path28 = (0, convert_path_to_posix_1.default)(path28);
+        path30 = (0, convert_path_to_posix_1.default)(path30);
       }
-      path28 = encodeURI(path28);
+      path30 = encodeURI(path30);
       for (const pattern of urlEncodePatterns) {
-        path28 = path28.replace(pattern[0], pattern[1]);
+        path30 = path30.replace(pattern[0], pattern[1]);
       }
-      return path28;
+      return path30;
     }
-    function toFileSystemPath(path28, keepFileProtocol) {
-      path28 = decodeURI(path28);
+    function toFileSystemPath(path30, keepFileProtocol) {
+      path30 = decodeURI(path30);
       for (let i5 = 0; i5 < urlDecodePatterns.length; i5 += 2) {
-        path28 = path28.replace(urlDecodePatterns[i5], urlDecodePatterns[i5 + 1]);
+        path30 = path30.replace(urlDecodePatterns[i5], urlDecodePatterns[i5 + 1]);
       }
-      let isFileUrl = path28.substr(0, 7).toLowerCase() === "file://";
+      let isFileUrl = path30.substr(0, 7).toLowerCase() === "file://";
       if (isFileUrl) {
-        path28 = path28[7] === "/" ? path28.substr(8) : path28.substr(7);
-        if ((0, is_windows_1.isWindows)() && path28[1] === "/") {
-          path28 = path28[0] + ":" + path28.substr(1);
+        path30 = path30[7] === "/" ? path30.substr(8) : path30.substr(7);
+        if ((0, is_windows_1.isWindows)() && path30[1] === "/") {
+          path30 = path30[0] + ":" + path30.substr(1);
         }
         if (keepFileProtocol) {
-          path28 = "file:///" + path28;
+          path30 = "file:///" + path30;
         } else {
           isFileUrl = false;
-          path28 = (0, is_windows_1.isWindows)() ? path28 : "/" + path28;
+          path30 = (0, is_windows_1.isWindows)() ? path30 : "/" + path30;
         }
       }
       if ((0, is_windows_1.isWindows)() && !isFileUrl) {
-        path28 = path28.replace(forwardSlashPattern, "\\");
-        if (path28.substr(1, 2) === ":\\") {
-          path28 = path28[0].toUpperCase() + path28.substr(1);
+        path30 = path30.replace(forwardSlashPattern, "\\");
+        if (path30.substr(1, 2) === ":\\") {
+          path30 = path30[0].toUpperCase() + path30.substr(1);
         }
       }
-      return path28;
+      return path30;
     }
     function safePointerToPath(pointer) {
       if (pointer.length <= 1 || pointer[0] !== "#" || pointer[1] !== "/") {
@@ -22300,8 +22300,8 @@ var require_errors2 = __commonJS({
     };
     exports.UnmatchedResolverError = UnmatchedResolverError;
     var MissingPointerError = class extends JSONParserError {
-      constructor(token, path28) {
-        super(`Token "${token}" does not exist.`, (0, url_js_1.stripHash)(path28));
+      constructor(token, path30) {
+        super(`Token "${token}" does not exist.`, (0, url_js_1.stripHash)(path30));
         this.code = "EUNMATCHEDRESOLVER";
         this.name = "MissingPointerError";
       }
@@ -22316,8 +22316,8 @@ var require_errors2 = __commonJS({
     };
     exports.TimeoutError = TimeoutError;
     var InvalidPointerError = class extends JSONParserError {
-      constructor(pointer, path28) {
-        super(`Invalid $ref pointer "${pointer}". Pointers must begin with "#/"`, (0, url_js_1.stripHash)(path28));
+      constructor(pointer, path30) {
+        super(`Invalid $ref pointer "${pointer}". Pointers must begin with "#/"`, (0, url_js_1.stripHash)(path30));
         this.code = "EUNMATCHEDRESOLVER";
         this.name = "InvalidPointerError";
       }
@@ -22385,10 +22385,10 @@ var require_pointer = __commonJS({
       }
     };
     var Pointer = class _Pointer {
-      constructor($ref, path28, friendlyPath) {
+      constructor($ref, path30, friendlyPath) {
         this.$ref = $ref;
-        this.path = path28;
-        this.originalPath = friendlyPath || path28;
+        this.path = path30;
+        this.originalPath = friendlyPath || path30;
         this.value = void 0;
         this.circular = false;
         this.indirections = 0;
@@ -22486,8 +22486,8 @@ var require_pointer = __commonJS({
        * @param [originalPath]
        * @returns
        */
-      static parse(path28, originalPath) {
-        const pointer = url.getHash(path28).substring(1);
+      static parse(path30, originalPath) {
+        const pointer = url.getHash(path30).substring(1);
         if (!pointer) {
           return [];
         }
@@ -22496,7 +22496,7 @@ var require_pointer = __commonJS({
           split2[i5] = safeDecodeURIComponent(split2[i5].replace(escapedSlash, "/").replace(escapedTilde, "~"));
         }
         if (split2[0] !== "") {
-          throw new errors_js_1.InvalidPointerError(split2, originalPath === void 0 ? path28 : originalPath);
+          throw new errors_js_1.InvalidPointerError(split2, originalPath === void 0 ? path30 : originalPath);
         }
         return split2.slice(1);
       }
@@ -22609,9 +22609,9 @@ var require_ref2 = __commonJS({
        * @param options
        * @returns
        */
-      exists(path28, options) {
+      exists(path30, options) {
         try {
-          this.resolve(path28, options);
+          this.resolve(path30, options);
           return true;
         } catch {
           return false;
@@ -22624,8 +22624,8 @@ var require_ref2 = __commonJS({
        * @param options
        * @returns - Returns the resolved value
        */
-      get(path28, options) {
-        return this.resolve(path28, options)?.value;
+      get(path30, options) {
+        return this.resolve(path30, options)?.value;
       }
       /**
        * Resolves the given JSON reference within this {@link $Ref#value}.
@@ -22636,8 +22636,8 @@ var require_ref2 = __commonJS({
        * @param pathFromRoot - The path of `obj` from the schema root
        * @returns
        */
-      resolve(path28, options, friendlyPath, pathFromRoot) {
-        const pointer = new pointer_js_1.default(this, path28, friendlyPath);
+      resolve(path30, options, friendlyPath, pathFromRoot) {
+        const pointer = new pointer_js_1.default(this, path30, friendlyPath);
         try {
           return pointer.resolve(this.value, options, pathFromRoot);
         } catch (err2) {
@@ -22661,8 +22661,8 @@ var require_ref2 = __commonJS({
        * @param path - The full path of the property to set, optionally with a JSON pointer in the hash
        * @param value - The value to assign
        */
-      set(path28, value) {
-        const pointer = new pointer_js_1.default(this, path28);
+      set(path30, value) {
+        const pointer = new pointer_js_1.default(this, path30);
         this.value = pointer.set(this.value, value);
       }
       /**
@@ -22841,8 +22841,8 @@ var require_refs = __commonJS({
        */
       paths(...types) {
         const paths = getPaths(this._$refs, types.flat());
-        return paths.map((path28) => {
-          return (0, convert_path_to_posix_1.default)(path28.decoded);
+        return paths.map((path30) => {
+          return (0, convert_path_to_posix_1.default)(path30.decoded);
         });
       }
       /**
@@ -22855,8 +22855,8 @@ var require_refs = __commonJS({
       values(...types) {
         const $refs = this._$refs;
         const paths = getPaths($refs, types.flat());
-        return paths.reduce((obj, path28) => {
-          obj[(0, convert_path_to_posix_1.default)(path28.decoded)] = $refs[path28.encoded].value;
+        return paths.reduce((obj, path30) => {
+          obj[(0, convert_path_to_posix_1.default)(path30.decoded)] = $refs[path30.encoded].value;
           return obj;
         }, {});
       }
@@ -22874,9 +22874,9 @@ var require_refs = __commonJS({
        * @param [options]
        * @returns
        */
-      exists(path28, options) {
+      exists(path30, options) {
         try {
-          this._resolve(path28, "", options);
+          this._resolve(path30, "", options);
           return true;
         } catch {
           return false;
@@ -22889,8 +22889,8 @@ var require_refs = __commonJS({
        * @param [options]
        * @returns - Returns the resolved value
        */
-      get(path28, options) {
-        return this._resolve(path28, "", options).value;
+      get(path30, options) {
+        return this._resolve(path30, "", options).value;
       }
       /**
        * Sets the value at the given path in the schema. If the property, or any of its parents, don't exist, they will be created.
@@ -22898,12 +22898,12 @@ var require_refs = __commonJS({
        * @param path The JSON Reference path, optionally with a JSON Pointer in the hash
        * @param value The value to assign. Can be anything (object, string, number, etc.)
        */
-      set(path28, value) {
-        const absPath = url.resolve(this._root$Ref.path, path28);
+      set(path30, value) {
+        const absPath = url.resolve(this._root$Ref.path, path30);
         const withoutHash = url.stripHash(absPath);
         const $ref = this._$refs[withoutHash];
         if (!$ref) {
-          throw (0, ono_1.ono)(`Error resolving $ref pointer "${path28}".
+          throw (0, ono_1.ono)(`Error resolving $ref pointer "${path30}".
 "${withoutHash}" not found.`);
         }
         $ref.set(absPath, value);
@@ -22915,9 +22915,9 @@ var require_refs = __commonJS({
        * @returns
        * @protected
        */
-      _get$Ref(path28) {
-        path28 = url.resolve(this._root$Ref.path, path28);
-        const withoutHash = url.stripHash(path28);
+      _get$Ref(path30) {
+        path30 = url.resolve(this._root$Ref.path, path30);
+        const withoutHash = url.stripHash(path30);
         return this._$refs[withoutHash];
       }
       /**
@@ -22925,8 +22925,8 @@ var require_refs = __commonJS({
        *
        * @param path  - The file path or URL of the referenced file
        */
-      _add(path28) {
-        const withoutHash = url.stripHash(path28);
+      _add(path30) {
+        const withoutHash = url.stripHash(path30);
         const $ref = new ref_js_1.default(this);
         $ref.path = withoutHash;
         this._$refs[withoutHash] = $ref;
@@ -22942,15 +22942,15 @@ var require_refs = __commonJS({
        * @returns
        * @protected
        */
-      _resolve(path28, pathFromRoot, options) {
-        const absPath = url.resolve(this._root$Ref.path, path28);
+      _resolve(path30, pathFromRoot, options) {
+        const absPath = url.resolve(this._root$Ref.path, path30);
         const withoutHash = url.stripHash(absPath);
         const $ref = this._$refs[withoutHash];
         if (!$ref) {
-          throw (0, ono_1.ono)(`Error resolving $ref pointer "${path28}".
+          throw (0, ono_1.ono)(`Error resolving $ref pointer "${path30}".
 "${withoutHash}" not found.`);
         }
-        return $ref.resolve(absPath, options, path28, pathFromRoot);
+        return $ref.resolve(absPath, options, path30, pathFromRoot);
       }
       constructor() {
         this._$refs = {};
@@ -22969,10 +22969,10 @@ var require_refs = __commonJS({
           return types.includes($refs[key].pathType);
         });
       }
-      return paths.map((path28) => {
+      return paths.map((path30) => {
         return {
-          encoded: path28,
-          decoded: $refs[path28].pathType === "file" ? url.toFileSystemPath(path28, true) : path28
+          encoded: path30,
+          decoded: $refs[path30].pathType === "file" ? url.toFileSystemPath(path30, true) : path30
         };
       });
     }
@@ -23110,18 +23110,18 @@ var require_parse = __commonJS({
     var url = __importStar2(require_url());
     var plugins = __importStar2(require_plugins());
     var errors_js_1 = require_errors2();
-    async function parse(path28, $refs, options) {
-      const hashIndex = path28.indexOf("#");
+    async function parse(path30, $refs, options) {
+      const hashIndex = path30.indexOf("#");
       let hash = "";
       if (hashIndex >= 0) {
-        hash = path28.substring(hashIndex);
-        path28 = path28.substring(0, hashIndex);
+        hash = path30.substring(hashIndex);
+        path30 = path30.substring(0, hashIndex);
       }
-      const $ref = $refs._add(path28);
+      const $ref = $refs._add(path30);
       const file = {
-        url: path28,
+        url: path30,
         hash,
-        extension: url.getExtension(path28)
+        extension: url.getExtension(path30)
       };
       try {
         const resolver = await readFile17(file, options, $refs);
@@ -23446,16 +23446,16 @@ var require_file = __commonJS({
        * Reads the given file and returns its raw contents as a Buffer.
        */
       async read(file) {
-        let path28;
+        let path30;
         try {
-          path28 = url.toFileSystemPath(file.url);
+          path30 = url.toFileSystemPath(file.url);
         } catch (err2) {
           throw new errors_js_1.ResolverError(ono_1.ono.uri(err2, `Malformed URI: ${file.url}`), file.url);
         }
         try {
-          return await fs_1.default.promises.readFile(path28);
+          return await fs_1.default.promises.readFile(path30);
         } catch (err2) {
-          throw new errors_js_1.ResolverError((0, ono_1.ono)(err2, `Error opening file "${path28}"`), path28);
+          throw new errors_js_1.ResolverError((0, ono_1.ono)(err2, `Error opening file "${path30}"`), path30);
         }
       }
     };
@@ -23715,7 +23715,7 @@ var require_normalize_args = __commonJS({
     exports.normalizeArgs = normalizeArgs;
     var options_js_1 = require_options();
     function normalizeArgs(_args) {
-      let path28;
+      let path30;
       let schema;
       let options;
       let callback;
@@ -23724,7 +23724,7 @@ var require_normalize_args = __commonJS({
         callback = args.pop();
       }
       if (typeof args[0] === "string") {
-        path28 = args[0];
+        path30 = args[0];
         if (typeof args[2] === "object") {
           schema = args[1];
           options = args[2];
@@ -23733,7 +23733,7 @@ var require_normalize_args = __commonJS({
           options = args[1];
         }
       } else {
-        path28 = "";
+        path30 = "";
         schema = args[0];
         options = args[1];
       }
@@ -23746,7 +23746,7 @@ var require_normalize_args = __commonJS({
         schema = JSON.parse(JSON.stringify(schema));
       }
       return {
-        path: path28,
+        path: path30,
         schema,
         options,
         callback
@@ -23807,26 +23807,26 @@ var require_resolve_external = __commonJS({
         return Promise.reject(e5);
       }
     }
-    function crawl(obj, path28, $refs, options, seen, external) {
+    function crawl(obj, path30, $refs, options, seen, external) {
       seen || (seen = /* @__PURE__ */ new Set());
       let promises = [];
       if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !seen.has(obj)) {
         seen.add(obj);
         if (ref_js_1.default.isExternal$Ref(obj)) {
-          promises.push(resolve$Ref(obj, path28, $refs, options));
+          promises.push(resolve$Ref(obj, path30, $refs, options));
         }
         const keys = Object.keys(obj);
         for (const key of keys) {
-          const keyPath = pointer_js_1.default.join(path28, key);
+          const keyPath = pointer_js_1.default.join(path30, key);
           const value = obj[key];
           promises = promises.concat(crawl(value, keyPath, $refs, options, seen, external));
         }
       }
       return promises;
     }
-    async function resolve$Ref($ref, path28, $refs, options) {
+    async function resolve$Ref($ref, path30, $refs, options) {
       const shouldResolveOnCwd = options.dereference?.externalReferenceResolution === "root";
-      const resolvedPath2 = url.resolve(shouldResolveOnCwd ? url.cwd() : path28, $ref.$ref);
+      const resolvedPath2 = url.resolve(shouldResolveOnCwd ? url.cwd() : path30, $ref.$ref);
       const withoutHash = url.stripHash(resolvedPath2);
       const ref = $refs._$refs[withoutHash];
       if (ref) {
@@ -23841,8 +23841,8 @@ var require_resolve_external = __commonJS({
           throw err2;
         }
         if ($refs._$refs[withoutHash]) {
-          err2.source = decodeURI(url.stripHash(path28));
-          err2.path = url.safePointerToPath(url.getHash(path28));
+          err2.source = decodeURI(url.stripHash(path30));
+          err2.path = url.safePointerToPath(url.getHash(path30));
         }
         return [];
       }
@@ -23894,11 +23894,11 @@ var require_bundle = __commonJS({
       crawl(parser, "schema", parser.$refs._root$Ref.path + "#", "#", 0, inventory, parser.$refs, options);
       remap(inventory);
     }
-    function crawl(parent, key, path28, pathFromRoot, indirections, inventory, $refs, options) {
+    function crawl(parent, key, path30, pathFromRoot, indirections, inventory, $refs, options) {
       const obj = key === null ? parent : parent[key];
       if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj)) {
         if (ref_js_1.default.isAllowed$Ref(obj)) {
-          inventory$Ref(parent, key, path28, pathFromRoot, indirections, inventory, $refs, options);
+          inventory$Ref(parent, key, path30, pathFromRoot, indirections, inventory, $refs, options);
         } else {
           const keys = Object.keys(obj).sort((a5, b5) => {
             if (a5 === "definitions") {
@@ -23910,11 +23910,11 @@ var require_bundle = __commonJS({
             }
           });
           for (const key2 of keys) {
-            const keyPath = pointer_js_1.default.join(path28, key2);
+            const keyPath = pointer_js_1.default.join(path30, key2);
             const keyPathFromRoot = pointer_js_1.default.join(pathFromRoot, key2);
             const value = obj[key2];
             if (ref_js_1.default.isAllowed$Ref(value)) {
-              inventory$Ref(obj, key2, path28, keyPathFromRoot, indirections, inventory, $refs, options);
+              inventory$Ref(obj, key2, path30, keyPathFromRoot, indirections, inventory, $refs, options);
             } else {
               crawl(obj, key2, keyPath, keyPathFromRoot, indirections, inventory, $refs, options);
             }
@@ -23922,9 +23922,9 @@ var require_bundle = __commonJS({
         }
       }
     }
-    function inventory$Ref($refParent, $refKey, path28, pathFromRoot, indirections, inventory, $refs, options) {
+    function inventory$Ref($refParent, $refKey, path30, pathFromRoot, indirections, inventory, $refs, options) {
       const $ref = $refKey === null ? $refParent : $refParent[$refKey];
-      const $refPath = url.resolve(path28, $ref.$ref);
+      const $refPath = url.resolve(path30, $ref.$ref);
       const pointer = $refs._resolve($refPath, pathFromRoot, options);
       if (pointer === null) {
         return;
@@ -24080,7 +24080,7 @@ var require_dereference = __commonJS({
       parser.$refs.circular = dereferenced.circular;
       parser.schema = dereferenced.value;
     }
-    function crawl(obj, path28, pathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime) {
+    function crawl(obj, path30, pathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime) {
       let dereferenced;
       const result2 = {
         value: obj,
@@ -24098,12 +24098,12 @@ var require_dereference = __commonJS({
           parents.add(obj);
           processedObjects.add(obj);
           if (ref_js_1.default.isAllowed$Ref(obj, options)) {
-            dereferenced = dereference$Ref(obj, path28, pathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime);
+            dereferenced = dereference$Ref(obj, path30, pathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime);
             result2.circular = dereferenced.circular;
             result2.value = dereferenced.value;
           } else {
             for (const key of Object.keys(obj)) {
-              const keyPath = pointer_js_1.default.join(path28, key);
+              const keyPath = pointer_js_1.default.join(path30, key);
               const keyPathFromRoot = pointer_js_1.default.join(pathFromRoot, key);
               if (isExcludedPath(keyPathFromRoot)) {
                 continue;
@@ -24136,10 +24136,10 @@ var require_dereference = __commonJS({
       }
       return result2;
     }
-    function dereference$Ref($ref, path28, pathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime) {
+    function dereference$Ref($ref, path30, pathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime) {
       const isExternalRef = ref_js_1.default.isExternal$Ref($ref);
       const shouldResolveOnCwd = isExternalRef && options?.dereference?.externalReferenceResolution === "root";
-      const $refPath = url.resolve(shouldResolveOnCwd ? url.cwd() : path28, $ref.$ref);
+      const $refPath = url.resolve(shouldResolveOnCwd ? url.cwd() : path30, $ref.$ref);
       const cache6 = dereferencedCache.get($refPath);
       if (cache6 && !cache6.circular) {
         const refKeys = Object.keys($ref);
@@ -24157,7 +24157,7 @@ var require_dereference = __commonJS({
         }
         return cache6;
       }
-      const pointer = $refs._resolve($refPath, path28, options);
+      const pointer = $refs._resolve($refPath, path30, options);
       if (pointer === null) {
         return {
           circular: false,
@@ -24167,7 +24167,7 @@ var require_dereference = __commonJS({
       const directCircular = pointer.circular;
       let circular = directCircular || parents.has(pointer.value);
       if (circular) {
-        foundCircularReference(path28, $refs, options);
+        foundCircularReference(path30, $refs, options);
       }
       let dereferencedValue = ref_js_1.default.dereference($ref, pointer.value);
       if (!circular) {
@@ -24564,7 +24564,7 @@ var require_lib4 = __commonJS({
        * @param {Function} [callback] - An error-first callback. The second parameter is the parsed API object.
        * @returns {Promise} - The returned promise resolves with the parsed API object.
        */
-      async parse(path28, api, options, callback) {
+      async parse(path30, api, options, callback) {
         let args = normalizeArgs(arguments);
         args.options = new Options(args.options);
         try {
@@ -24616,7 +24616,7 @@ var require_lib4 = __commonJS({
        * @param {Function} [callback] - An error-first callback. The second parameter is the parsed API object.
        * @returns {Promise} - The returned promise resolves with the parsed API object.
        */
-      async validate(path28, api, options, callback) {
+      async validate(path30, api, options, callback) {
         let me = this;
         let args = normalizeArgs(arguments);
         args.options = new Options(args.options);
@@ -25231,12 +25231,12 @@ var require_dist2 = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f5;
     };
-    function addFormats2(ajv, list2, fs22, exportName) {
+    function addFormats2(ajv, list2, fs23, exportName) {
       var _a2;
       var _b;
       (_a2 = (_b = ajv.opts.code).formats) !== null && _a2 !== void 0 ? _a2 : _b.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f5 of list2)
-        ajv.addFormat(f5, fs22[f5]);
+        ajv.addFormat(f5, fs23[f5]);
     }
     module.exports = exports = formatsPlugin;
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -26757,8 +26757,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data: data2, path: path28, errorMaps, issueData } = params;
-      const fullPath = [...path28, ...issueData.path || []];
+      const { data: data2, path: path30, errorMaps, issueData } = params;
+      const fullPath = [...path30, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -27066,11 +27066,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path28, key) {
+      constructor(parent, value, path30, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path28;
+        this._path = path30;
         this._key = key;
       }
       get path() {
@@ -30987,10 +30987,10 @@ function detectDialect(version) {
     return "3.0";
   throw new UnsupportedDialectError(version);
 }
-function deriveOperationId(method, path28, explicit) {
+function deriveOperationId(method, path30, explicit) {
   if (explicit)
     return explicit;
-  return `${method.toLowerCase()}_${path28.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_|_$/g, "")}`;
+  return `${method.toLowerCase()}_${path30.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_|_$/g, "")}`;
 }
 function collectParameters(op2, pathItem) {
   const all = [...pathItem.parameters ?? [], ...op2.parameters ?? []];
@@ -31023,7 +31023,7 @@ async function loadSpec(specPath, opts = {}) {
   const endpoints = [];
   const unprotected = [];
   const unresolvedAgg = /* @__PURE__ */ new Map();
-  for (const [path28, pathItem] of Object.entries(doc.paths ?? {})) {
+  for (const [path30, pathItem] of Object.entries(doc.paths ?? {})) {
     if (!pathItem)
       continue;
     for (const method of METHODS) {
@@ -31032,13 +31032,13 @@ async function loadSpec(specPath, opts = {}) {
         continue;
       const rawXSecurity = op2["x-security"];
       if (!rawXSecurity) {
-        unprotected.push({ method: method.toUpperCase(), path: path28 });
+        unprotected.push({ method: method.toUpperCase(), path: path30 });
         continue;
       }
       if (validate) {
         const result2 = validateXSecurity(rawXSecurity, dialect === "3.1" ? "2020-12" : "draft-04");
         if (!result2.valid) {
-          throw new SchemaValidationError(`Invalid x-security at ${method.toUpperCase()} ${path28}: ${result2.errors.map((e5) => `${e5.instancePath} ${e5.message}`).join("; ")}`, result2.errors);
+          throw new SchemaValidationError(`Invalid x-security at ${method.toUpperCase()} ${path30}: ${result2.errors.map((e5) => `${e5.instancePath} ${e5.message}`).join("; ")}`, result2.errors);
         }
       }
       const { value: policy, resolved, unresolved } = await resolveVariables(rawXSecurity, {
@@ -31046,7 +31046,7 @@ async function loadSpec(specPath, opts = {}) {
         strict: false
       });
       if (unresolved.length > 0) {
-        const opRef = `${method.toUpperCase()} ${path28}`;
+        const opRef = `${method.toUpperCase()} ${path30}`;
         for (const v of unresolved) {
           const list2 = unresolvedAgg.get(v) ?? [];
           list2.push(opRef);
@@ -31055,8 +31055,8 @@ async function loadSpec(specPath, opts = {}) {
       }
       endpoints.push({
         method: method.toUpperCase(),
-        path: path28,
-        operationId: deriveOperationId(method, path28, op2.operationId),
+        path: path30,
+        operationId: deriveOperationId(method, path30, op2.operationId),
         policy,
         parameters: collectParameters(op2, pathItem),
         raw: op2,
@@ -31136,8 +31136,8 @@ function assertNoPlaceholders(spec) {
   lines.push("Hint: set real values for these variables, or re-run with --no-strict to allow placeholders.");
   throw new StrictnessViolation("S1", lines.join("\n"), { hits });
 }
-function normalizePathForMatch(path28) {
-  return path28.replace(/\{[^}]+\}/g, "").replace(/\/+$/, "/");
+function normalizePathForMatch(path30) {
+  return path30.replace(/\{[^}]+\}/g, "").replace(/\/+$/, "/");
 }
 function detectEmissionGaps(spec, artifacts) {
   if (artifacts.length === 0) {
@@ -32867,14 +32867,14 @@ var init_readFile = __esm({
   "../../node_modules/.pnpm/@smithy+core@3.24.2/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/readFile.js"() {
     filePromises = {};
     fileIntercept = {};
-    readFile2 = (path28, options) => {
-      if (fileIntercept[path28] !== void 0) {
-        return fileIntercept[path28];
+    readFile2 = (path30, options) => {
+      if (fileIntercept[path30] !== void 0) {
+        return fileIntercept[path30];
       }
-      if (!filePromises[path28] || options?.ignoreCache) {
-        filePromises[path28] = fsReadFile(path28, "utf8");
+      if (!filePromises[path30] || options?.ignoreCache) {
+        filePromises[path30] = fsReadFile(path30, "utf8");
       }
-      return filePromises[path28];
+      return filePromises[path30];
     };
   }
 });
@@ -32986,8 +32986,8 @@ var init_externalDataInterceptor = __esm({
       getFileRecord() {
         return fileIntercept;
       },
-      interceptFile(path28, contents) {
-        fileIntercept[path28] = Promise.resolve(contents);
+      interceptFile(path30, contents) {
+        fileIntercept[path30] = Promise.resolve(contents);
       },
       getTokenRecord() {
         return tokenIntercept;
@@ -33839,14 +33839,14 @@ var init_schemaSerializationMiddleware = __esm({
       const { operationSchema } = getSmithyContext(context);
       const [, ns, n2, t, i5, o2] = operationSchema ?? [];
       const endpoint = context.endpointV2 ? async () => toEndpointV1(context.endpointV2) : config.endpoint;
-      const request7 = await config.protocol.serializeRequest(operation(ns, n2, t, i5, o2), args.input, {
+      const request9 = await config.protocol.serializeRequest(operation(ns, n2, t, i5, o2), args.input, {
         ...config,
         ...context,
         endpoint
       });
       return next({
         ...args,
-        request: request7
+        request: request9
       });
     };
   }
@@ -34629,7 +34629,7 @@ var init_command = __esm({
             ...requestOptions
           };
         }
-        return stack.resolve((request7) => requestHandler.handle(request7.request, requestOptions), handlerExecutionContext);
+        return stack.resolve((request9) => requestHandler.handle(request9.request, requestOptions), handlerExecutionContext);
       }
     };
     ClassBuilder = class {
@@ -35595,13 +35595,13 @@ var init_resolveDefaultsModeConfig = __esm({
       }
       return { hostname: "169.254.169.254", path: "/" };
     };
-    imdsHttpGet = async ({ hostname, path: path28 }) => {
-      const { request: request7 } = await import("node:http");
+    imdsHttpGet = async ({ hostname, path: path30 }) => {
+      const { request: request9 } = await import("node:http");
       return new Promise((resolve2, reject) => {
-        const req = request7({
+        const req = request9({
           method: "GET",
           hostname: hostname.replace(/^\[(.+)]$/, "$1"),
-          path: path28,
+          path: path30,
           timeout: 1e3,
           signal: AbortSignal.timeout(1e3)
         });
@@ -35850,8 +35850,8 @@ var init_createConfigValueProvider = __esm({
               return endpoint.url.href;
             }
             if ("hostname" in endpoint) {
-              const { protocol, hostname, port, path: path28 } = endpoint;
-              return `${protocol}//${hostname}${port ? ":" + port : ""}${path28}`;
+              const { protocol, hostname, port, path: path30 } = endpoint;
+              return `${protocol}//${hostname}${port ? ":" + port : ""}${path30}`;
             }
           }
           return endpoint;
@@ -36290,18 +36290,18 @@ var getAttrPathList;
 var init_getAttrPathList = __esm({
   "../../node_modules/.pnpm/@smithy+core@3.24.2/node_modules/@smithy/core/dist-es/submodules/endpoints/util-endpoints/lib/getAttrPathList.js"() {
     init_types3();
-    getAttrPathList = (path28) => {
-      const parts = path28.split(".");
+    getAttrPathList = (path30) => {
+      const parts = path30.split(".");
       const pathList = [];
       for (const part of parts) {
         const squareBracketIndex = part.indexOf("[");
         if (squareBracketIndex !== -1) {
           if (part.indexOf("]") !== part.length - 1) {
-            throw new EndpointError(`Path: '${path28}' does not end with ']'`);
+            throw new EndpointError(`Path: '${path30}' does not end with ']'`);
           }
           const arrayIndex = part.slice(squareBracketIndex + 1, -1);
           if (Number.isNaN(parseInt(arrayIndex))) {
-            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path28}'`);
+            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path30}'`);
           }
           if (squareBracketIndex !== 0) {
             pathList.push(part.slice(0, squareBracketIndex));
@@ -36322,9 +36322,9 @@ var init_getAttr = __esm({
   "../../node_modules/.pnpm/@smithy+core@3.24.2/node_modules/@smithy/core/dist-es/submodules/endpoints/util-endpoints/lib/getAttr.js"() {
     init_types3();
     init_getAttrPathList();
-    getAttr = (value, path28) => getAttrPathList(path28).reduce((acc, index) => {
+    getAttr = (value, path30) => getAttrPathList(path30).reduce((acc, index) => {
       if (typeof acc !== "object") {
-        throw new EndpointError(`Index '${index}' in '${path28}' not found in '${JSON.stringify(value)}'`);
+        throw new EndpointError(`Index '${index}' in '${path30}' not found in '${JSON.stringify(value)}'`);
       } else if (Array.isArray(acc)) {
         const i5 = parseInt(index);
         return acc[i5 < 0 ? acc.length + i5 : i5];
@@ -36405,8 +36405,8 @@ var init_parseURL = __esm({
             return value;
           }
           if (typeof value === "object" && "hostname" in value) {
-            const { hostname: hostname2, port, protocol: protocol2 = "", path: path28 = "", query = {} } = value;
-            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path28}`);
+            const { hostname: hostname2, port, protocol: protocol2 = "", path: path30 = "", query = {} } = value;
+            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path30}`);
             url.search = Object.entries(query).map(([k5, v]) => `${k5}=${v}`).join("&");
             return url;
           }
@@ -37031,10 +37031,10 @@ var init_serializerMiddleware = __esm({
       if (!endpoint) {
         throw new Error("No valid endpoint provider available.");
       }
-      const request7 = await serializer(args.input, { ...options, endpoint });
+      const request9 = await serializer(args.input, { ...options, endpoint });
       return next({
         ...args,
-        request: request7
+        request: request9
       });
     };
   }
@@ -38194,21 +38194,21 @@ var init_httpRequest = __esm({
         this.password = options.password;
         this.fragment = options.fragment;
       }
-      static clone(request7) {
+      static clone(request9) {
         const cloned = new _HttpRequest({
-          ...request7,
-          headers: { ...request7.headers }
+          ...request9,
+          headers: { ...request9.headers }
         });
         if (cloned.query) {
           cloned.query = cloneQuery(cloned.query);
         }
         return cloned;
       }
-      static isInstance(request7) {
-        if (!request7) {
+      static isInstance(request9) {
+        if (!request9) {
           return false;
         }
-        const req = request7;
+        const req = request9;
         return "method" in req && "protocol" in req && "hostname" in req && "path" in req && typeof req["query"] === "object" && typeof req["headers"] === "object";
       }
       clone() {
@@ -38672,13 +38672,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path28, preserveJsx) {
-  if (typeof path28 === "string" && /^\.\.?\//.test(path28)) {
-    return path28.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m3, tsx, d5, ext, cm) {
+function __rewriteRelativeImportExtension(path30, preserveJsx) {
+  if (typeof path30 === "string" && /^\.\.?\//.test(path30)) {
+    return path30.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m3, tsx, d5, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d5 && (!ext || !cm) ? m3 : d5 + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path28;
+  return path30;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -40368,44 +40368,44 @@ var init_HttpProtocol = __esm({
           this.getPayloadCodec().setSerdeContext(serdeContext);
         }
       }
-      updateServiceEndpoint(request7, endpoint) {
+      updateServiceEndpoint(request9, endpoint) {
         if ("url" in endpoint) {
-          request7.protocol = endpoint.url.protocol;
-          request7.hostname = endpoint.url.hostname;
-          request7.port = endpoint.url.port ? Number(endpoint.url.port) : void 0;
-          request7.path = endpoint.url.pathname;
-          request7.fragment = endpoint.url.hash || void 0;
-          request7.username = endpoint.url.username || void 0;
-          request7.password = endpoint.url.password || void 0;
-          if (!request7.query) {
-            request7.query = {};
+          request9.protocol = endpoint.url.protocol;
+          request9.hostname = endpoint.url.hostname;
+          request9.port = endpoint.url.port ? Number(endpoint.url.port) : void 0;
+          request9.path = endpoint.url.pathname;
+          request9.fragment = endpoint.url.hash || void 0;
+          request9.username = endpoint.url.username || void 0;
+          request9.password = endpoint.url.password || void 0;
+          if (!request9.query) {
+            request9.query = {};
           }
           for (const [k5, v] of endpoint.url.searchParams.entries()) {
-            request7.query[k5] = v;
+            request9.query[k5] = v;
           }
           if (endpoint.headers) {
             for (const name in endpoint.headers) {
-              request7.headers[name] = endpoint.headers[name].join(", ");
+              request9.headers[name] = endpoint.headers[name].join(", ");
             }
           }
-          return request7;
+          return request9;
         } else {
-          request7.protocol = endpoint.protocol;
-          request7.hostname = endpoint.hostname;
-          request7.port = endpoint.port ? Number(endpoint.port) : void 0;
-          request7.path = endpoint.path;
-          request7.query = {
+          request9.protocol = endpoint.protocol;
+          request9.hostname = endpoint.hostname;
+          request9.port = endpoint.port ? Number(endpoint.port) : void 0;
+          request9.path = endpoint.path;
+          request9.query = {
             ...endpoint.query
           };
           if (endpoint.headers) {
             for (const name in endpoint.headers) {
-              request7.headers[name] = endpoint.headers[name];
+              request9.headers[name] = endpoint.headers[name];
             }
           }
-          return request7;
+          return request9;
         }
       }
-      setHostPrefix(request7, operationSchema, input) {
+      setHostPrefix(request9, operationSchema, input) {
         if (this.serdeContext?.disableHostPrefix) {
           return;
         }
@@ -40424,7 +40424,7 @@ var init_HttpProtocol = __esm({
               }
               hostPrefix = hostPrefix.replace(`{${name}}`, replacement);
             }
-            request7.hostname = hostPrefix + request7.hostname;
+            request9.hostname = hostPrefix + request9.hostname;
           }
         }
       }
@@ -40501,7 +40501,7 @@ var init_HttpBindingProtocol = __esm({
         const payloadMemberSchemas = [];
         let hasNonHttpBindingMember = false;
         let payload2;
-        const request7 = new HttpRequest({
+        const request9 = new HttpRequest({
           protocol: "",
           hostname: "",
           port: void 0,
@@ -40512,16 +40512,16 @@ var init_HttpBindingProtocol = __esm({
           body: void 0
         });
         if (endpoint) {
-          this.updateServiceEndpoint(request7, endpoint);
-          this.setHostPrefix(request7, operationSchema, input);
+          this.updateServiceEndpoint(request9, endpoint);
+          this.setHostPrefix(request9, operationSchema, input);
           const opTraits = translateTraits(operationSchema.traits);
           if (opTraits.http) {
-            request7.method = opTraits.http[0];
-            const [path28, search] = opTraits.http[1].split("?");
-            if (request7.path == "/") {
-              request7.path = path28;
+            request9.method = opTraits.http[0];
+            const [path30, search] = opTraits.http[1].split("?");
+            if (request9.path == "/") {
+              request9.path = path30;
             } else {
-              request7.path += path28;
+              request9.path += path30;
             }
             const traitSearchParams = new URLSearchParams(search ?? "");
             for (const [key, value] of traitSearchParams) {
@@ -40534,7 +40534,7 @@ var init_HttpBindingProtocol = __esm({
           const inputMemberValue = input[memberName];
           if (inputMemberValue == null && !memberNs.isIdempotencyToken()) {
             if (memberTraits.httpLabel) {
-              if (request7.path.includes(`{${memberName}+}`) || request7.path.includes(`{${memberName}}`)) {
+              if (request9.path.includes(`{${memberName}+}`) || request9.path.includes(`{${memberName}}`)) {
                 throw new Error(`No value provided for input HTTP label: ${memberName}.`);
               }
             }
@@ -40561,10 +40561,10 @@ var init_HttpBindingProtocol = __esm({
           } else if (memberTraits.httpLabel) {
             serializer.write(memberNs, inputMemberValue);
             const replacement = serializer.flush();
-            if (request7.path.includes(`{${memberName}+}`)) {
-              request7.path = request7.path.replace(`{${memberName}+}`, replacement.split("/").map(extendedEncodeURIComponent).join("/"));
-            } else if (request7.path.includes(`{${memberName}}`)) {
-              request7.path = request7.path.replace(`{${memberName}}`, extendedEncodeURIComponent(replacement));
+            if (request9.path.includes(`{${memberName}+}`)) {
+              request9.path = request9.path.replace(`{${memberName}+}`, replacement.split("/").map(extendedEncodeURIComponent).join("/"));
+            } else if (request9.path.includes(`{${memberName}}`)) {
+              request9.path = request9.path.replace(`{${memberName}}`, extendedEncodeURIComponent(replacement));
             }
           } else if (memberTraits.httpHeader) {
             serializer.write(memberNs, inputMemberValue);
@@ -40604,10 +40604,10 @@ var init_HttpBindingProtocol = __esm({
           serializer.write(payloadSchema, input);
           payload2 = serializer.flush();
         }
-        request7.headers = headers;
-        request7.query = query;
-        request7.body = payload2;
-        return request7;
+        request9.headers = headers;
+        request9.query = query;
+        request9.body = payload2;
+        return request9;
       }
       serializeQuery(ns, data2, query) {
         const serializer = this.serializer;
@@ -40772,7 +40772,7 @@ var init_RpcProtocol = __esm({
         const schema = ns.getSchema();
         let payload2;
         const input = _input && typeof _input === "object" ? _input : {};
-        const request7 = new HttpRequest({
+        const request9 = new HttpRequest({
           protocol: "",
           hostname: "",
           port: void 0,
@@ -40783,8 +40783,8 @@ var init_RpcProtocol = __esm({
           body: void 0
         });
         if (endpoint) {
-          this.updateServiceEndpoint(request7, endpoint);
-          this.setHostPrefix(request7, operationSchema, input);
+          this.updateServiceEndpoint(request9, endpoint);
+          this.setHostPrefix(request9, operationSchema, input);
         }
         if (input) {
           const eventStreamMember = ns.getEventStreamMember();
@@ -40808,11 +40808,11 @@ var init_RpcProtocol = __esm({
             payload2 = serializer.flush();
           }
         }
-        request7.headers = Object.assign(request7.headers, headers);
-        request7.query = query;
-        request7.body = payload2;
-        request7.method = "POST";
-        return request7;
+        request9.headers = Object.assign(request9.headers, headers);
+        request9.query = query;
+        request9.body = payload2;
+        request9.method = "POST";
+        return request9;
       }
       async deserializeResponse(operationSchema, context, response) {
         const deserializer = this.deserializer;
@@ -40922,8 +40922,8 @@ var init_requestBuilder = __esm({
         return this;
       }
       p(memberName, labelValueProvider, uriLabel, isGreedyLabel) {
-        this.resolvePathStack.push((path28) => {
-          this.path = resolvedPath(path28, this.input, memberName, labelValueProvider, uriLabel, isGreedyLabel);
+        this.resolvePathStack.push((path30) => {
+          this.path = resolvedPath(path30, this.input, memberName, labelValueProvider, uriLabel, isGreedyLabel);
         });
         return this;
       }
@@ -41319,14 +41319,14 @@ var init_httpExtensionConfiguration = __esm({
 // ../../node_modules/.pnpm/@smithy+core@3.24.2/node_modules/@smithy/core/dist-es/submodules/protocols/middleware-content-length/contentLengthMiddleware.js
 function contentLengthMiddleware(bodyLengthChecker) {
   return (next) => async (args) => {
-    const request7 = args.request;
-    if (HttpRequest.isInstance(request7)) {
-      const { body, headers } = request7;
+    const request9 = args.request;
+    if (HttpRequest.isInstance(request9)) {
+      const { body, headers } = request9;
       if (body && Object.keys(headers).map((str) => str.toLowerCase()).indexOf(CONTENT_LENGTH_HEADER) === -1) {
         try {
           const length = bodyLengthChecker(body);
-          request7.headers = {
-            ...request7.headers,
+          request9.headers = {
+            ...request9.headers,
             [CONTENT_LENGTH_HEADER]: String(length)
           };
         } catch (error2) {
@@ -41335,7 +41335,7 @@ function contentLengthMiddleware(bodyLengthChecker) {
     }
     return next({
       ...args,
-      request: request7
+      request: request9
     });
   };
 }
@@ -41528,16 +41528,16 @@ var require_dist_cjs5 = __commonJS({
     var hostHeaderMiddleware = (options) => (next) => async (args) => {
       if (!protocols.HttpRequest.isInstance(args.request))
         return next(args);
-      const { request: request7 } = args;
+      const { request: request9 } = args;
       const { handlerProtocol = "" } = options.requestHandler.metadata || {};
-      if (handlerProtocol.indexOf("h2") >= 0 && !request7.headers[":authority"]) {
-        delete request7.headers["host"];
-        request7.headers[":authority"] = request7.hostname + (request7.port ? ":" + request7.port : "");
-      } else if (!request7.headers["host"]) {
-        let host = request7.hostname;
-        if (request7.port != null)
-          host += `:${request7.port}`;
-        request7.headers["host"] = host;
+      if (handlerProtocol.indexOf("h2") >= 0 && !request9.headers[":authority"]) {
+        delete request9.headers["host"];
+        request9.headers[":authority"] = request9.hostname + (request9.port ? ":" + request9.port : "");
+      } else if (!request9.headers["host"]) {
+        let host = request9.hostname;
+        if (request9.port != null)
+          host += `:${request9.port}`;
+        request9.headers["host"] = host;
       }
       return next(args);
     };
@@ -41743,12 +41743,12 @@ var require_recursionDetectionMiddleware = __commonJS({
     var ENV_LAMBDA_FUNCTION_NAME = "AWS_LAMBDA_FUNCTION_NAME";
     var ENV_TRACE_ID = "_X_AMZN_TRACE_ID";
     var recursionDetectionMiddleware = () => (next) => async (args) => {
-      const { request: request7 } = args;
-      if (!protocols_1.HttpRequest.isInstance(request7)) {
+      const { request: request9 } = args;
+      if (!protocols_1.HttpRequest.isInstance(request9)) {
         return next(args);
       }
-      const traceIdHeader = Object.keys(request7.headers ?? {}).find((h5) => h5.toLowerCase() === TRACE_ID_HEADER_NAME.toLowerCase()) ?? TRACE_ID_HEADER_NAME;
-      if (request7.headers.hasOwnProperty(traceIdHeader)) {
+      const traceIdHeader = Object.keys(request9.headers ?? {}).find((h5) => h5.toLowerCase() === TRACE_ID_HEADER_NAME.toLowerCase()) ?? TRACE_ID_HEADER_NAME;
+      if (request9.headers.hasOwnProperty(traceIdHeader)) {
         return next(args);
       }
       const functionName = process.env[ENV_LAMBDA_FUNCTION_NAME];
@@ -41758,11 +41758,11 @@ var require_recursionDetectionMiddleware = __commonJS({
       const traceId = traceIdFromInvokeStore ?? traceIdFromEnv;
       const nonEmptyString = (str) => typeof str === "string" && str.length > 0;
       if (nonEmptyString(functionName) && nonEmptyString(traceId)) {
-        request7.headers[TRACE_ID_HEADER_NAME] = traceId;
+        request9.headers[TRACE_ID_HEADER_NAME] = traceId;
       }
       return next({
         ...args,
-        request: request7
+        request: request9
       });
     };
     exports.recursionDetectionMiddleware = recursionDetectionMiddleware;
@@ -42046,9 +42046,9 @@ var init_createPaginator = __esm({
       command = withCommand(command) ?? command;
       return await client.send(command, ...args);
     };
-    get = (fromObject, path28) => {
+    get = (fromObject, path30) => {
       let cursor2 = fromObject;
-      const pathComponents = path28.split(".");
+      const pathComponents = path30.split(".");
       for (const step of pathComponents) {
         if (!cursor2 || typeof cursor2 !== "object") {
           return void 0;
@@ -42758,7 +42758,7 @@ import { Readable as Readable5 } from "node:stream";
 var isStreamingPayload;
 var init_isStreamingPayload = __esm({
   "../../node_modules/.pnpm/@smithy+core@3.24.2/node_modules/@smithy/core/dist-es/submodules/retry/middleware-retry/isStreamingPayload/isStreamingPayload.js"() {
-    isStreamingPayload = (request7) => request7?.body instanceof Readable5 || typeof ReadableStream !== "undefined" && request7?.body instanceof ReadableStream;
+    isStreamingPayload = (request9) => request9?.body instanceof Readable5 || typeof ReadableStream !== "undefined" && request9?.body instanceof ReadableStream;
   }
 });
@@ -42930,15 +42930,15 @@ function bindRetryMiddleware(isStreamingPayload2) {
       let lastError = new Error();
       let attempts = 0;
       let totalRetryDelay = 0;
-      const { request: request7 } = args;
-      const isRequest = HttpRequest.isInstance(request7);
+      const { request: request9 } = args;
+      const isRequest = HttpRequest.isInstance(request9);
       if (isRequest) {
-        request7.headers[INVOCATION_ID_HEADER] = v4();
+        request9.headers[INVOCATION_ID_HEADER] = v4();
       }
       while (true) {
         try {
           if (isRequest) {
-            request7.headers[REQUEST_HEADER] = `attempt=${attempts + 1}; max=${maxAttempts}`;
+            request9.headers[REQUEST_HEADER] = `attempt=${attempts + 1}; max=${maxAttempts}`;
           }
           const { response, output } = await next(args);
           retryStrategy.recordSuccess(retryToken);
@@ -42948,7 +42948,7 @@ function bindRetryMiddleware(isStreamingPayload2) {
         } catch (e5) {
           const retryErrorInfo = getRetryErrorInfo(e5, options.logger);
           lastError = asSdkError(e5);
-          if (isRequest && isStreamingPayload2(request7)) {
+          if (isRequest && isStreamingPayload2(request9)) {
             (context.logger instanceof NoOpLogger ? console : context.logger)?.warn("An error was encountered in a non-retryable streaming request.");
             throw lastError;
           }
@@ -43499,14 +43499,14 @@ var init_StandardRetryStrategy2 = __esm({
         let attempts = 0;
         let totalDelay = 0;
         const maxAttempts = await this.getMaxAttempts();
-        const { request: request7 } = args;
-        if (HttpRequest.isInstance(request7)) {
-          request7.headers[INVOCATION_ID_HEADER] = v4();
+        const { request: request9 } = args;
+        if (HttpRequest.isInstance(request9)) {
+          request9.headers[INVOCATION_ID_HEADER] = v4();
         }
         while (true) {
           try {
-            if (HttpRequest.isInstance(request7)) {
-              request7.headers[REQUEST_HEADER] = `attempt=${attempts + 1}; max=${maxAttempts}`;
+            if (HttpRequest.isInstance(request9)) {
+              request9.headers[REQUEST_HEADER] = `attempt=${attempts + 1}; max=${maxAttempts}`;
             }
             if (options?.beforeRequest) {
               await options.beforeRequest();
@@ -43646,10 +43646,10 @@ var init_omitRetryHeadersMiddleware = __esm({
     init_protocols();
     init_constants5();
     omitRetryHeadersMiddleware = () => (next) => async (args) => {
-      const { request: request7 } = args;
-      if (HttpRequest.isInstance(request7)) {
-        delete request7.headers[INVOCATION_ID_HEADER];
-        delete request7.headers[REQUEST_HEADER];
+      const { request: request9 } = args;
+      if (HttpRequest.isInstance(request9)) {
+        delete request9.headers[INVOCATION_ID_HEADER];
+        delete request9.headers[REQUEST_HEADER];
       }
       return next(args);
     };
@@ -43829,8 +43829,8 @@ var require_dist_cjs9 = __commonJS({
     }
     var ACCOUNT_ID_ENDPOINT_REGEX = /\d{12}\.ddb/;
     async function checkFeatures(context, config, args) {
-      const request7 = args.request;
-      if (request7?.headers?.["smithy-protocol"] === "rpc-v2-cbor") {
+      const request9 = args.request;
+      if (request9?.headers?.["smithy-protocol"] === "rpc-v2-cbor") {
         client.setFeature(context, "PROTOCOL_RPC_V2_CBOR", "M");
       }
       if (typeof config.retryStrategy === "function") {
@@ -43899,11 +43899,11 @@ var require_dist_cjs9 = __commonJS({
       return buffer;
     }
     var userAgentMiddleware = (options) => (next, context) => async (args) => {
-      const { request: request7 } = args;
-      if (!protocols.HttpRequest.isInstance(request7)) {
+      const { request: request9 } = args;
+      if (!protocols.HttpRequest.isInstance(request9)) {
         return next(args);
       }
-      const { headers } = request7;
+      const { headers } = request9;
       const userAgent = context?.userAgent?.map(escapeUserAgent) || [];
       const defaultUserAgent = (await options.defaultUserAgentProvider()).map(escapeUserAgent);
       await checkFeatures(context, options, args);
@@ -43930,7 +43930,7 @@ var require_dist_cjs9 = __commonJS({
       }
       return next({
         ...args,
-        request: request7
+        request: request9
       });
     };
     var escapeUserAgent = (userAgentPair) => {
@@ -44425,11 +44425,11 @@ var require_dist_cjs10 = __commonJS({
         this.regionProvider = client.normalizeProvider(region);
         this.credentialProvider = client.normalizeProvider(credentials);
       }
-      createCanonicalRequest(request7, canonicalHeaders, payloadHash) {
+      createCanonicalRequest(request9, canonicalHeaders, payloadHash) {
         const sortedHeaders = Object.keys(canonicalHeaders).sort();
-        return `${request7.method}
-${this.getCanonicalPath(request7)}
-${getCanonicalQuery(request7)}
+        return `${request9.method}
+${this.getCanonicalPath(request9)}
+${getCanonicalQuery(request9)}
 ${sortedHeaders.map((name) => `${name}:${canonicalHeaders[name]}`).join("\n")}
 ${sortedHeaders.join(";")}
@@ -44444,10 +44444,10 @@ ${longDate}
 ${credentialScope}
 ${serde.toHex(hashedRequest)}`;
       }
-      getCanonicalPath({ path: path28 }) {
+      getCanonicalPath({ path: path30 }) {
         if (this.uriEscapePath) {
           const normalizedPathSegments = [];
-          for (const pathSegment of path28.split("/")) {
+          for (const pathSegment of path30.split("/")) {
             if (pathSegment?.length === 0)
               continue;
             if (pathSegment === ".")
@@ -44458,11 +44458,11 @@ ${serde.toHex(hashedRequest)}`;
               normalizedPathSegments.push(pathSegment);
             }
           }
-          const normalizedPath = `${path28?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path28?.endsWith("/") ? "/" : ""}`;
+          const normalizedPath = `${path30?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path30?.endsWith("/") ? "/" : ""}`;
           const doubleEncoded = protocols.escapeUri(normalizedPath);
           return doubleEncoded.replace(/%2F/g, "/");
         }
-        return path28;
+        return path30;
       }
       validateResolvedCredentials(credentials) {
         if (typeof credentials !== "object" || typeof credentials.accessKeyId !== "string" || typeof credentials.secretAccessKey !== "string") {
@@ -44550,8 +44550,8 @@ ${serde.toHex(hashedRequest)}`;
       }
       return false;
     };
-    var moveHeadersToQuery = (request7, options = {}) => {
-      const { headers, query = {} } = protocols.HttpRequest.clone(request7);
+    var moveHeadersToQuery = (request9, options = {}) => {
+      const { headers, query = {} } = protocols.HttpRequest.clone(request9);
       for (const name of Object.keys(headers)) {
         const lname = name.toLowerCase();
         if (lname.slice(0, 6) === "x-amz-" && !options.unhoistableHeaders?.has(lname) || options.hoistableHeaders?.has(lname)) {
@@ -44560,19 +44560,19 @@ ${serde.toHex(hashedRequest)}`;
         }
       }
       return {
-        ...request7,
+        ...request9,
         headers,
         query
       };
     };
-    var prepareRequest = (request7) => {
-      request7 = protocols.HttpRequest.clone(request7);
-      for (const headerName of Object.keys(request7.headers)) {
+    var prepareRequest = (request9) => {
+      request9 = protocols.HttpRequest.clone(request9);
+      for (const headerName of Object.keys(request9.headers)) {
         if (GENERATED_HEADERS.indexOf(headerName.toLowerCase()) > -1) {
-          delete request7.headers[headerName];
+          delete request9.headers[headerName];
         }
       }
-      return request7;
+      return request9;
     };
     var SignatureV42 = class extends SignatureV4Base {
       headerFormatter = new HeaderFormatter();
@@ -44596,18 +44596,18 @@ ${serde.toHex(hashedRequest)}`;
           return Promise.reject("Signature version 4 presigned URLs must have an expiration date less than one week in the future");
         }
         const scope = createScope(shortDate, region, signingService ?? this.service);
-        const request7 = moveHeadersToQuery(prepareRequest(originalRequest), { unhoistableHeaders, hoistableHeaders });
+        const request9 = moveHeadersToQuery(prepareRequest(originalRequest), { unhoistableHeaders, hoistableHeaders });
         if (credentials.sessionToken) {
-          request7.query[TOKEN_QUERY_PARAM] = credentials.sessionToken;
+          request9.query[TOKEN_QUERY_PARAM] = credentials.sessionToken;
         }
-        request7.query[ALGORITHM_QUERY_PARAM] = ALGORITHM_IDENTIFIER;
-        request7.query[CREDENTIAL_QUERY_PARAM] = `${credentials.accessKeyId}/${scope}`;
-        request7.query[AMZ_DATE_QUERY_PARAM] = longDate;
-        request7.query[EXPIRES_QUERY_PARAM] = expiresIn.toString(10);
-        const canonicalHeaders = getCanonicalHeaders(request7, unsignableHeaders, signableHeaders);
-        request7.query[SIGNED_HEADERS_QUERY_PARAM] = this.getCanonicalHeaderList(canonicalHeaders);
-        request7.query[SIGNATURE_QUERY_PARAM] = await this.getSignature(longDate, scope, this.getSigningKey(credentials, region, shortDate, signingService), this.createCanonicalRequest(request7, canonicalHeaders, await getPayloadHash(originalRequest, this.sha256)));
-        return request7;
+        request9.query[ALGORITHM_QUERY_PARAM] = ALGORITHM_IDENTIFIER;
+        request9.query[CREDENTIAL_QUERY_PARAM] = `${credentials.accessKeyId}/${scope}`;
+        request9.query[AMZ_DATE_QUERY_PARAM] = longDate;
+        request9.query[EXPIRES_QUERY_PARAM] = expiresIn.toString(10);
+        const canonicalHeaders = getCanonicalHeaders(request9, unsignableHeaders, signableHeaders);
+        request9.query[SIGNED_HEADERS_QUERY_PARAM] = this.getCanonicalHeaderList(canonicalHeaders);
+        request9.query[SIGNATURE_QUERY_PARAM] = await this.getSignature(longDate, scope, this.getSigningKey(credentials, region, shortDate, signingService), this.createCanonicalRequest(request9, canonicalHeaders, await getPayloadHash(originalRequest, this.sha256)));
+        return request9;
       }
       async sign(toSign, options) {
         if (typeof toSign === "string") {
@@ -44671,21 +44671,21 @@ ${serde.toHex(hashedRequest)}`;
         const credentials = await this.credentialProvider();
         this.validateResolvedCredentials(credentials);
         const region = signingRegion ?? await this.regionProvider();
-        const request7 = prepareRequest(requestToSign);
+        const request9 = prepareRequest(requestToSign);
         const { longDate, shortDate } = this.formatDate(signingDate);
         const scope = createScope(shortDate, region, signingService ?? this.service);
-        request7.headers[AMZ_DATE_HEADER] = longDate;
+        request9.headers[AMZ_DATE_HEADER] = longDate;
         if (credentials.sessionToken) {
-          request7.headers[TOKEN_HEADER] = credentials.sessionToken;
+          request9.headers[TOKEN_HEADER] = credentials.sessionToken;
         }
-        const payloadHash = await getPayloadHash(request7, this.sha256);
-        if (!hasHeader2(SHA256_HEADER, request7.headers) && this.applyChecksum) {
-          request7.headers[SHA256_HEADER] = payloadHash;
+        const payloadHash = await getPayloadHash(request9, this.sha256);
+        if (!hasHeader2(SHA256_HEADER, request9.headers) && this.applyChecksum) {
+          request9.headers[SHA256_HEADER] = payloadHash;
         }
-        const canonicalHeaders = getCanonicalHeaders(request7, unsignableHeaders, signableHeaders);
-        const signature = await this.getSignature(longDate, scope, this.getSigningKey(credentials, region, shortDate, signingService), this.createCanonicalRequest(request7, canonicalHeaders, payloadHash));
-        request7.headers[AUTH_HEADER] = `${ALGORITHM_IDENTIFIER} Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${this.getCanonicalHeaderList(canonicalHeaders)}, Signature=${signature}`;
-        return request7;
+        const canonicalHeaders = getCanonicalHeaders(request9, unsignableHeaders, signableHeaders);
+        const signature = await this.getSignature(longDate, scope, this.getSigningKey(credentials, region, shortDate, signingService), this.createCanonicalRequest(request9, canonicalHeaders, payloadHash));
+        request9.headers[AUTH_HEADER] = `${ALGORITHM_IDENTIFIER} Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${this.getCanonicalHeaderList(canonicalHeaders)}, Signature=${signature}`;
+        return request9;
       }
       async getSignature(longDate, credentialScope, keyPromise, canonicalRequest) {
         const stringToSign = await this.createStringToSign(longDate, credentialScope, canonicalRequest, ALGORITHM_IDENTIFIER);
@@ -45482,13 +45482,13 @@ var require_dist_cjs13 = __commonJS({
       clearTimeout: (timeoutId) => clearTimeout(timeoutId)
     };
     var DEFER_EVENT_LISTENER_TIME$2 = 1e3;
-    var setConnectionTimeout = (request7, reject, timeoutInMs = 0) => {
+    var setConnectionTimeout = (request9, reject, timeoutInMs = 0) => {
       if (!timeoutInMs) {
         return -1;
       }
       const registerTimeout = (offset) => {
         const timeoutId = timing.setTimeout(() => {
-          request7.destroy();
+          request9.destroy();
           reject(Object.assign(new Error(`@smithy/node-http-handler - the request socket did not establish a connection with the server within the configured timeout of ${timeoutInMs} ms.`), {
             name: "TimeoutError"
           }));
@@ -45502,10 +45502,10 @@ var require_dist_cjs13 = __commonJS({
             timing.clearTimeout(timeoutId);
           }
         };
-        if (request7.socket) {
-          doWithSocket(request7.socket);
+        if (request9.socket) {
+          doWithSocket(request9.socket);
         } else {
-          request7.on("socket", doWithSocket);
+          request9.on("socket", doWithSocket);
         }
       };
       if (timeoutInMs < 2e3) {
@@ -45534,15 +45534,15 @@ var require_dist_cjs13 = __commonJS({
       return -1;
     };
     var DEFER_EVENT_LISTENER_TIME$1 = 3e3;
-    var setSocketKeepAlive = (request7, { keepAlive, keepAliveMsecs }, deferTimeMs = DEFER_EVENT_LISTENER_TIME$1) => {
+    var setSocketKeepAlive = (request9, { keepAlive, keepAliveMsecs }, deferTimeMs = DEFER_EVENT_LISTENER_TIME$1) => {
       if (keepAlive !== true) {
         return -1;
       }
       const registerListener = () => {
-        if (request7.socket) {
-          request7.socket.setKeepAlive(keepAlive, keepAliveMsecs || 0);
+        if (request9.socket) {
+          request9.socket.setKeepAlive(keepAlive, keepAliveMsecs || 0);
         } else {
-          request7.on("socket", (socket) => {
+          request9.on("socket", (socket) => {
             socket.setKeepAlive(keepAlive, keepAliveMsecs || 0);
           });
         }
@@ -45554,18 +45554,18 @@ var require_dist_cjs13 = __commonJS({
       return timing.setTimeout(registerListener, deferTimeMs);
     };
     var DEFER_EVENT_LISTENER_TIME = 3e3;
-    var setSocketTimeout = (request7, reject, timeoutInMs = 0) => {
+    var setSocketTimeout = (request9, reject, timeoutInMs = 0) => {
       const registerTimeout = (offset) => {
         const timeout = timeoutInMs - offset;
         const onTimeout = () => {
-          request7.destroy();
+          request9.destroy();
           reject(Object.assign(new Error(`@smithy/node-http-handler - the request socket timed out after ${timeoutInMs} ms of inactivity (configured by client requestHandler).`), { name: "TimeoutError" }));
         };
-        if (request7.socket) {
-          request7.socket.setTimeout(timeout, onTimeout);
-          request7.on("close", () => request7.socket?.removeListener("timeout", onTimeout));
+        if (request9.socket) {
+          request9.socket.setTimeout(timeout, onTimeout);
+          request9.on("close", () => request9.socket?.removeListener("timeout", onTimeout));
         } else {
-          request7.setTimeout(timeout, onTimeout);
+          request9.setTimeout(timeout, onTimeout);
         }
       };
       if (0 < timeoutInMs && timeoutInMs < 6e3) {
@@ -45575,8 +45575,8 @@ var require_dist_cjs13 = __commonJS({
       return timing.setTimeout(registerTimeout.bind(null, timeoutInMs === 0 ? 0 : DEFER_EVENT_LISTENER_TIME), DEFER_EVENT_LISTENER_TIME);
     };
     var MIN_WAIT_TIME = 6e3;
-    async function writeRequestBody(httpRequest, request7, maxContinueTimeoutMs = MIN_WAIT_TIME, externalAgent = false) {
-      const headers = request7.headers;
+    async function writeRequestBody(httpRequest, request9, maxContinueTimeoutMs = MIN_WAIT_TIME, externalAgent = false) {
+      const headers = request9.headers;
       const expect = headers ? headers.Expect || headers.expect : void 0;
       let timeoutId = -1;
       let sendBody = true;
@@ -45602,7 +45602,7 @@ var require_dist_cjs13 = __commonJS({
         ]);
       }
       if (sendBody) {
-        writeBody(httpRequest, request7.body);
+        writeBody(httpRequest, request9.body);
       }
     }
     function writeBody(httpRequest, body) {
@@ -45684,12 +45684,12 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
         this.config?.httpAgent?.destroy();
         this.config?.httpsAgent?.destroy();
       }
-      async handle(request7, { abortSignal, requestTimeout } = {}) {
+      async handle(request9, { abortSignal, requestTimeout } = {}) {
         if (!this.config) {
           this.config = await this.configProvider;
         }
         const config = this.config;
-        const isSSL = request7.protocol === "https:";
+        const isSSL = request9.protocol === "https:";
         if (!isSSL && !this.config.httpAgent) {
           this.config.httpAgent = await this.config.httpAgentProvider();
         }
@@ -45722,7 +45722,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             reject(abortError);
             return;
           }
-          const headers = request7.headers;
+          const headers = request9.headers;
           const expectContinue = headers ? (headers.Expect ?? headers.expect) === "100-continue" : false;
           let agent = isSSL ? config.httpsAgent : config.httpAgent;
           if (expectContinue && !this.externalAgent) {
@@ -45734,32 +45734,32 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
           socketWarningTimeoutId = timing.setTimeout(() => {
             this.socketWarningTimestamp = _NodeHttpHandler.checkSocketUsage(agent, this.socketWarningTimestamp, config.logger);
           }, config.socketAcquisitionWarningTimeout ?? (config.requestTimeout ?? 2e3) + (config.connectionTimeout ?? 1e3));
-          const queryString = request7.query ? protocols.buildQueryString(request7.query) : "";
+          const queryString = request9.query ? protocols.buildQueryString(request9.query) : "";
           let auth = void 0;
-          if (request7.username != null || request7.password != null) {
-            const username = request7.username ?? "";
-            const password = request7.password ?? "";
+          if (request9.username != null || request9.password != null) {
+            const username = request9.username ?? "";
+            const password = request9.password ?? "";
             auth = `${username}:${password}`;
           }
-          let path28 = request7.path;
+          let path30 = request9.path;
           if (queryString) {
-            path28 += `?${queryString}`;
+            path30 += `?${queryString}`;
           }
-          if (request7.fragment) {
-            path28 += `#${request7.fragment}`;
+          if (request9.fragment) {
+            path30 += `#${request9.fragment}`;
           }
-          let hostname = request7.hostname ?? "";
+          let hostname = request9.hostname ?? "";
           if (hostname[0] === "[" && hostname.endsWith("]")) {
-            hostname = request7.hostname.slice(1, -1);
+            hostname = request9.hostname.slice(1, -1);
           } else {
-            hostname = request7.hostname;
+            hostname = request9.hostname;
           }
           const nodeHttpsOptions = {
-            headers: request7.headers,
+            headers: request9.headers,
             host: hostname,
-            method: request7.method,
-            path: path28,
-            port: request7.port,
+            method: request9.method,
+            path: path30,
+            port: request9.port,
             agent,
             auth
           };
@@ -45805,7 +45805,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
               keepAliveMsecs: httpAgent.keepAliveMsecs
             });
           }
-          writeRequestBodyPromise = writeRequestBody(req, request7, effectiveRequestTimeout, this.externalAgent).catch((e5) => {
+          writeRequestBodyPromise = writeRequestBody(req, request9, effectiveRequestTimeout, this.externalAgent).catch((e5) => {
             clearTimeouts();
             return _reject(e5);
           });
@@ -45834,8 +45834,8 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
           socketAcquisitionWarningTimeout,
           throwOnRequestTimeout,
           httpAgentProvider: async () => {
-            const { Agent, request: request7 } = await import("node:http");
-            hRequest = request7;
+            const { Agent, request: request9 } = await import("node:http");
+            hRequest = request9;
             hAgent = Agent;
             if (httpAgent instanceof hAgent || typeof httpAgent?.destroy === "function") {
               this.externalAgent = true;
@@ -46072,8 +46072,8 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
         }
         return this.connectionPools.get(url);
       }
-      getUrlString(request7) {
-        return request7.destination.toString();
+      getUrlString(request9) {
+        return request9.destination.toString();
       }
       connect(url) {
         return this.connectOptions === void 0 ? http2.connect(url) : http2.connect(url, this.connectOptions);
@@ -46104,7 +46104,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
       destroy() {
         this.connectionManager.destroy();
       }
-      async handle(request7, { abortSignal, requestTimeout, isEventStream } = {}) {
+      async handle(request9, { abortSignal, requestTimeout, isEventStream } = {}) {
         if (!this.config) {
           this.config = await this.configProvider;
           const { disableConcurrentStreams: disableConcurrentStreams2, maxConcurrentStreams, nodeHttp2ConnectOptions } = this.config;
@@ -46136,11 +46136,11 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             reject(abortError);
             return;
           }
-          const { hostname, method, port, protocol, query } = request7;
+          const { hostname, method, port, protocol, query } = request9;
           let auth = "";
-          if (request7.username != null || request7.password != null) {
-            const username = request7.username ?? "";
-            const password = request7.password ?? "";
+          if (request9.username != null || request9.password != null) {
+            const username = request9.username ?? "";
+            const password = request9.password ?? "";
             auth = `${username}:${password}@`;
           }
           const authority = `${protocol}//${auth}${hostname}${port ? `:${port}` : ""}`;
@@ -46159,16 +46159,16 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             reject(err2);
           };
           const queryString = query ? protocols.buildQueryString(query) : "";
-          let path28 = request7.path;
+          let path30 = request9.path;
           if (queryString) {
-            path28 += `?${queryString}`;
+            path30 += `?${queryString}`;
           }
-          if (request7.fragment) {
-            path28 += `#${request7.fragment}`;
+          if (request9.fragment) {
+            path30 += `#${request9.fragment}`;
           }
           const clientHttp2Stream = session.request({
-            ...request7.headers,
-            [http2.constants.HTTP2_HEADER_PATH]: path28,
+            ...request9.headers,
+            [http2.constants.HTTP2_HEADER_PATH]: path30,
             [http2.constants.HTTP2_HEADER_METHOD]: method
           });
           if (effectiveRequestTimeout) {
@@ -46222,7 +46222,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
               rejectWithDestroy(new Error("Unexpected error: http2 request did not get a response"));
             }
           });
-          writeRequestBodyPromise = writeRequestBody(clientHttp2Stream, request7, effectiveRequestTimeout);
+          writeRequestBodyPromise = writeRequestBody(clientHttp2Stream, request9, effectiveRequestTimeout);
         });
       }
       updateHttpClientConfig(key, value) {
@@ -46462,14 +46462,14 @@ Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
         connectionTimeout: options.timeout ?? 1e3
       });
       return (0, retry_wrapper_1.retryWrapper)(async () => {
-        const request7 = (0, requestHelpers_1.createGetRequest)(url);
+        const request9 = (0, requestHelpers_1.createGetRequest)(url);
         if (token) {
-          request7.headers.Authorization = token;
+          request9.headers.Authorization = token;
         } else if (tokenFile) {
-          request7.headers.Authorization = (await promises_1.default.readFile(tokenFile)).toString();
+          request9.headers.Authorization = (await promises_1.default.readFile(tokenFile)).toString();
         }
         try {
-          const result2 = await requestHandler.handle(request7);
+          const result2 = await requestHandler.handle(request9);
           return (0, requestHelpers_1.getCredentials)(result2.response).then((creds) => (0, client_1.setCredentialFeature)(creds, "CREDENTIALS_HTTP", "z"));
         } catch (e5) {
           throw new config_1.CredentialsProviderError(String(e5), { logger: options.logger });
@@ -46718,12 +46718,12 @@ var require_dist_cjs15 = __commonJS({
       }
       return ["md/nodejs", node_process.versions.node];
     };
-    var getNodeModulesParentDirs = (dirname5) => {
+    var getNodeModulesParentDirs = (dirname6) => {
       const cwd = process.cwd();
-      if (!dirname5) {
+      if (!dirname6) {
         return [cwd];
       }
-      const normalizedPath = node_path.normalize(dirname5);
+      const normalizedPath = node_path.normalize(dirname6);
       const parts = normalizedPath.split(node_path.sep);
       const nodeModulesIndex = parts.indexOf("node_modules");
       const parentDir = nodeModulesIndex !== -1 ? parts.slice(0, nodeModulesIndex).join(node_path.sep) : normalizedPath;
@@ -46771,8 +46771,8 @@ var require_dist_cjs15 = __commonJS({
         tscVersion = null;
         return void 0;
       }
-      const dirname5 = typeof __dirname !== "undefined" ? __dirname : void 0;
-      const nodeModulesParentDirs = getNodeModulesParentDirs(dirname5);
+      const dirname6 = typeof __dirname !== "undefined" ? __dirname : void 0;
+      const nodeModulesParentDirs = getNodeModulesParentDirs(dirname6);
       let versionFromApp;
       for (const nodeModulesParentDir of nodeModulesParentDirs) {
         try {
@@ -47822,33 +47822,33 @@ var init_SmithyRpcV2CborProtocol = __esm({
         return this.codec;
       }
       async serializeRequest(operationSchema, input, context) {
-        const request7 = await super.serializeRequest(operationSchema, input, context);
-        Object.assign(request7.headers, {
+        const request9 = await super.serializeRequest(operationSchema, input, context);
+        Object.assign(request9.headers, {
           "content-type": this.getDefaultContentType(),
           "smithy-protocol": "rpc-v2-cbor",
           accept: this.getDefaultContentType()
         });
         if (deref(operationSchema.input) === "unit") {
-          delete request7.body;
-          delete request7.headers["content-type"];
+          delete request9.body;
+          delete request9.headers["content-type"];
         } else {
-          if (!request7.body) {
+          if (!request9.body) {
             this.serializer.write(15, {});
-            request7.body = this.serializer.flush();
+            request9.body = this.serializer.flush();
           }
           try {
-            request7.headers["content-length"] = String(request7.body.byteLength);
+            request9.headers["content-length"] = String(request9.body.byteLength);
           } catch (e5) {
           }
         }
         const { service, operation: operation2 } = getSmithyContext(context);
-        const path28 = `/service/${service}/operation/${operation2}`;
-        if (request7.path.endsWith("/")) {
-          request7.path += path28.slice(1);
+        const path30 = `/service/${service}/operation/${operation2}`;
+        if (request9.path.endsWith("/")) {
+          request9.path += path30.slice(1);
         } else {
-          request7.path += path28;
+          request9.path += path30;
         }
-        return request7;
+        return request9;
       }
       async deserializeResponse(operationSchema, context, response) {
         return super.deserializeResponse(operationSchema, context, response);
@@ -48068,11 +48068,11 @@ var init_AwsSmithyRpcV2CborProtocol = __esm({
         this.mixin = new ProtocolLib(this.awsQueryCompatible);
       }
       async serializeRequest(operationSchema, input, context) {
-        const request7 = await super.serializeRequest(operationSchema, input, context);
+        const request9 = await super.serializeRequest(operationSchema, input, context);
         if (this.awsQueryCompatible) {
-          request7.headers["x-amzn-query-mode"] = "true";
+          request9.headers["x-amzn-query-mode"] = "true";
         }
-        return request7;
+        return request9;
       }
       async handleError(operationSchema, context, response, dataObject, metadata) {
         if (this.awsQueryCompatible) {
@@ -48777,19 +48777,19 @@ var init_AwsJsonRpcProtocol = __esm({
         this.mixin = new ProtocolLib(this.awsQueryCompatible);
       }
       async serializeRequest(operationSchema, input, context) {
-        const request7 = await super.serializeRequest(operationSchema, input, context);
-        if (!request7.path.endsWith("/")) {
-          request7.path += "/";
+        const request9 = await super.serializeRequest(operationSchema, input, context);
+        if (!request9.path.endsWith("/")) {
+          request9.path += "/";
         }
-        request7.headers["content-type"] = `application/x-amz-json-${this.getJsonRpcVersion()}`;
-        request7.headers["x-amz-target"] = `${this.serviceTarget}.${operationSchema.name}`;
+        request9.headers["content-type"] = `application/x-amz-json-${this.getJsonRpcVersion()}`;
+        request9.headers["x-amz-target"] = `${this.serviceTarget}.${operationSchema.name}`;
         if (this.awsQueryCompatible) {
-          request7.headers["x-amzn-query-mode"] = "true";
+          request9.headers["x-amzn-query-mode"] = "true";
         }
-        if (deref(operationSchema.input) === "unit" || !request7.body) {
-          request7.body = "{}";
+        if (deref(operationSchema.input) === "unit" || !request9.body) {
+          request9.body = "{}";
         }
-        return request7;
+        return request9;
       }
       getPayloadCodec() {
         return this.codec;
@@ -48923,18 +48923,18 @@ var init_AwsRestJsonProtocol = __esm({
         super.setSerdeContext(serdeContext);
       }
       async serializeRequest(operationSchema, input, context) {
-        const request7 = await super.serializeRequest(operationSchema, input, context);
+        const request9 = await super.serializeRequest(operationSchema, input, context);
         const inputSchema4 = NormalizedSchema.of(operationSchema.input);
-        if (!request7.headers["content-type"]) {
+        if (!request9.headers["content-type"]) {
           const contentType = this.mixin.resolveRestContentType(this.getDefaultContentType(), inputSchema4);
           if (contentType) {
-            request7.headers["content-type"] = contentType;
+            request9.headers["content-type"] = contentType;
           }
         }
-        if (request7.body == null && request7.headers["content-type"] === this.getDefaultContentType()) {
-          request7.body = "{}";
+        if (request9.body == null && request9.headers["content-type"] === this.getDefaultContentType()) {
+          request9.body = "{}";
         }
-        return request7;
+        return request9;
       }
       async deserializeResponse(operationSchema, context, response) {
         const output = await super.deserializeResponse(operationSchema, context, response);
@@ -51401,20 +51401,20 @@ var init_AwsQueryProtocol = __esm({
         throw new Error("AWSQuery protocol has no payload codec.");
       }
       async serializeRequest(operationSchema, input, context) {
-        const request7 = await super.serializeRequest(operationSchema, input, context);
-        if (!request7.path.endsWith("/")) {
-          request7.path += "/";
+        const request9 = await super.serializeRequest(operationSchema, input, context);
+        if (!request9.path.endsWith("/")) {
+          request9.path += "/";
         }
-        request7.headers["content-type"] = "application/x-www-form-urlencoded";
-        if (deref(operationSchema.input) === "unit" || !request7.body) {
-          request7.body = "";
+        request9.headers["content-type"] = "application/x-www-form-urlencoded";
+        if (deref(operationSchema.input) === "unit" || !request9.body) {
+          request9.body = "";
         }
         const action = operationSchema.name.split("#")[1] ?? operationSchema.name;
-        request7.body = `Action=${action}&Version=${this.options.version}` + request7.body;
-        if (request7.body.endsWith("&")) {
-          request7.body = request7.body.slice(-1);
+        request9.body = `Action=${action}&Version=${this.options.version}` + request9.body;
+        if (request9.body.endsWith("&")) {
+          request9.body = request9.body.slice(-1);
         }
-        return request7;
+        return request9;
       }
       async deserializeResponse(operationSchema, context, response) {
         const deserializer = this.deserializer;
@@ -51924,18 +51924,18 @@ var init_AwsRestXmlProtocol = __esm({
         return "aws.protocols#restXml";
       }
       async serializeRequest(operationSchema, input, context) {
-        const request7 = await super.serializeRequest(operationSchema, input, context);
+        const request9 = await super.serializeRequest(operationSchema, input, context);
         const inputSchema4 = NormalizedSchema.of(operationSchema.input);
-        if (!request7.headers["content-type"]) {
+        if (!request9.headers["content-type"]) {
           const contentType = this.mixin.resolveRestContentType(this.getDefaultContentType(), inputSchema4);
           if (contentType) {
-            request7.headers["content-type"] = contentType;
+            request9.headers["content-type"] = contentType;
           }
         }
-        if (typeof request7.body === "string" && request7.headers["content-type"] === this.getDefaultContentType() && !request7.body.startsWith("<?xml ") && !this.hasUnstructuredPayloadBinding(inputSchema4)) {
-          request7.body = '<?xml version="1.0" encoding="UTF-8"?>' + request7.body;
+        if (typeof request9.body === "string" && request9.headers["content-type"] === this.getDefaultContentType() && !request9.body.startsWith("<?xml ") && !this.hasUnstructuredPayloadBinding(inputSchema4)) {
+          request9.body = '<?xml version="1.0" encoding="UTF-8"?>' + request9.body;
         }
-        return request7;
+        return request9;
       }
       async deserializeResponse(operationSchema, context, response) {
         return super.deserializeResponse(operationSchema, context, response);
@@ -54797,11 +54797,11 @@ var require_dist_cjs20 = __commonJS({
       createDPoPInterceptor(middlewareStack) {
         middlewareStack.add((next) => async (args) => {
           if (protocols.HttpRequest.isInstance(args.request)) {
-            const request7 = args.request;
-            const actualEndpoint = `${request7.protocol}//${request7.hostname}${request7.port ? `:${request7.port}` : ""}${request7.path}`;
-            const dpop = await this.generateDpop(request7.method, actualEndpoint);
-            request7.headers = {
-              ...request7.headers,
+            const request9 = args.request;
+            const actualEndpoint = `${request9.protocol}//${request9.hostname}${request9.port ? `:${request9.port}` : ""}${request9.path}`;
+            const dpop = await this.generateDpop(request9.method, actualEndpoint);
+            request9.headers = {
+              ...request9.headers,
               DPoP: dpop
             };
           }
@@ -58840,11 +58840,22 @@ var init_kong_shared = __esm({
 // src/drift/kong-admin.ts
 import { request as request2 } from "undici";
-async function fetchAll(baseUrl, resource) {
+async function fetchAll(baseUrl, resource, timeoutMs) {
   const out = [];
   let url = `${baseUrl.replace(/\/$/, "")}/${resource}`;
   while (url) {
-    const res = await request2(url, { method: "GET" });
+    let res;
+    try {
+      res = await request2(url, {
+        method: "GET",
+        ...timeoutMs !== void 0 ? { signal: AbortSignal.timeout(timeoutMs) } : {}
+      });
+    } catch (e5) {
+      if (e5.name === "TimeoutError" || e5.name === "AbortError") {
+        throw new Error(`Kong admin GET ${url} timed out after ${timeoutMs}ms`);
+      }
+      throw e5;
+    }
     if (res.statusCode >= 400) {
       throw new Error(`Kong admin GET ${url} \u2192 ${res.statusCode}`);
     }
@@ -58854,10 +58865,10 @@ async function fetchAll(baseUrl, resource) {
   }
   return out;
 }
-function createHttpClient(baseUrl) {
+function createHttpClient(baseUrl, timeoutMs) {
   return {
-    routes: () => fetchAll(baseUrl, "routes"),
-    plugins: () => fetchAll(baseUrl, "plugins")
+    routes: () => fetchAll(baseUrl, "routes", timeoutMs),
+    plugins: () => fetchAll(baseUrl, "plugins", timeoutMs)
   };
 }
 function indexActualFromAdmin(routes, plugins, spec) {
@@ -58884,7 +58895,7 @@ function indexActualFromAdmin(routes, plugins, spec) {
   return out;
 }
 async function detectAdminDrift(spec, opts) {
-  const client = opts.client ?? createHttpClient(opts.gatewayUrl);
+  const client = opts.client ?? createHttpClient(opts.gatewayUrl, opts.timeoutMs);
   const [routes, plugins] = await Promise.all([client.routes(), client.plugins()]);
   const actual = indexActualFromAdmin(routes, plugins, spec);
   const expected = buildExpected(spec);
@@ -60366,7 +60377,7 @@ async function runValidate(specPath, opts) {
   let report;
   switch (opts.target) {
     case "kong":
-      report = isHttp ? await detectAdminDrift(spec, { gatewayUrl: opts.gateway }) : await detectFileDrift(spec, { filePath: opts.gateway });
+      report = isHttp ? await detectAdminDrift(spec, { gatewayUrl: opts.gateway, ...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {} }) : await detectFileDrift(spec, { filePath: opts.gateway });
       break;
     case "coraza":
       if (isHttp) throw new Error("coraza drift is file-mode only \u2014 pass a path to the deployed YAML.");
@@ -60571,8 +60582,8 @@ async function bringUp(plan, opts = {}) {
     );
   }
   const DockerMod = await import("dockerode");
-  const Docker = DockerMod.default;
-  const docker = new Docker();
+  const Docker2 = DockerMod.default;
+  const docker = new Docker2();
   await docker.ping().catch(() => {
     throw new Error("Docker daemon not reachable (set DOCKER_HOST or start Docker Desktop).");
   });
@@ -60693,7 +60704,7 @@ var init_docker_compose = __esm({
 // src/test-harness/traffic.ts
 import { request as undiciRequest2 } from "undici";
-async function sendOnce(baseUrl, req) {
+async function sendOnce(baseUrl, req, timeoutMs) {
   const start = Date.now();
   const url = baseUrl.replace(/\/$/, "") + req.path;
   const opts = {
@@ -60702,19 +60713,28 @@ async function sendOnce(baseUrl, req) {
   };
   if (req.body !== void 0) opts.body = req.body;
   if (req.timeout) opts.headersTimeout = req.timeout;
-  const res = await undiciRequest2(url, opts);
-  const buf = await res.body.arrayBuffer();
-  return {
-    status: res.statusCode,
-    headers: res.headers,
-    body: Buffer.from(buf).toString("utf8"),
-    durationMs: Date.now() - start
-  };
+  if (timeoutMs !== void 0) opts.signal = AbortSignal.timeout(timeoutMs);
+  try {
+    const res = await undiciRequest2(url, opts);
+    const buf = await res.body.arrayBuffer();
+    return {
+      status: res.statusCode,
+      headers: res.headers,
+      body: Buffer.from(buf).toString("utf8"),
+      durationMs: Date.now() - start
+    };
+  } catch (e5) {
+    const name = e5.name;
+    if (name === "TimeoutError" || name === "AbortError") {
+      throw new Error(`${req.method} ${url} timed out after ${timeoutMs}ms`);
+    }
+    throw e5;
+  }
 }
-async function sendN(baseUrl, req, count) {
+async function sendN(baseUrl, req, count, timeoutMs) {
   const out = [];
   for (let i5 = 0; i5 < count; i5++) {
-    out.push(await sendOnce(baseUrl, req));
+    out.push(await sendOnce(baseUrl, req, timeoutMs));
   }
   return out;
 }
@@ -60749,7 +60769,7 @@ function result(endpoint, rule, verdict, message, startMs) {
     durationMs: Date.now() - startMs
   };
 }
-async function assertRateLimit(baseUrl, endpoint) {
+async function assertRateLimit(baseUrl, endpoint, timeoutMs) {
   const rls = endpoint.policy.rateLimit;
   if (!rls) return [];
   const list2 = Array.isArray(rls) ? rls : [rls];
@@ -60758,7 +60778,7 @@ async function assertRateLimit(baseUrl, endpoint) {
     const start = Date.now();
     const total = rl.requests + 1;
     try {
-      const responses = await sendN(baseUrl, baseRequest(endpoint), total);
+      const responses = await sendN(baseUrl, baseRequest(endpoint), total, timeoutMs);
       const last = responses[responses.length - 1];
       if (last.status === 429) {
         out.push(result(endpoint, "rateLimit", "PASS", `429 after ${rl.requests} requests`, start));
@@ -60779,12 +60799,12 @@ async function assertRateLimit(baseUrl, endpoint) {
   }
   return out;
 }
-async function assertAuth(baseUrl, endpoint) {
+async function assertAuth(baseUrl, endpoint, timeoutMs) {
   const auth = endpoint.policy.authentication;
   if (!auth || auth.type === "none") return null;
   const start = Date.now();
   try {
-    const res = await sendOnce(baseUrl, baseRequest(endpoint));
+    const res = await sendOnce(baseUrl, baseRequest(endpoint), timeoutMs);
     if (res.status === 401 || res.status === 403) {
       return result(endpoint, "authentication", "PASS", `Unauth \u2192 ${res.status}`, start);
     }
@@ -60799,7 +60819,7 @@ async function assertAuth(baseUrl, endpoint) {
     return result(endpoint, "authentication", "SKIP", `traffic error: ${e5.message}`, start);
   }
 }
-async function assertCors(baseUrl, endpoint) {
+async function assertCors(baseUrl, endpoint, timeoutMs) {
   const cors = endpoint.policy.cors;
   if (!cors || !cors.allowedOrigins?.length) return null;
   const start = Date.now();
@@ -60812,7 +60832,7 @@ async function assertCors(baseUrl, endpoint) {
         Origin: origin,
         "Access-Control-Request-Method": endpoint.method
       }
-    });
+    }, timeoutMs);
     const allowed = res.headers["access-control-allow-origin"];
     if (allowed && (allowed === origin || allowed === "*")) {
       return result(endpoint, "cors", "PASS", `CORS preflight echoed ${allowed}`, start);
@@ -60822,7 +60842,7 @@ async function assertCors(baseUrl, endpoint) {
     return result(endpoint, "cors", "SKIP", `traffic error: ${e5.message}`, start);
   }
 }
-async function assertMaxBodySize(baseUrl, endpoint) {
+async function assertMaxBodySize(baseUrl, endpoint, timeoutMs) {
   const maxBody = endpoint.policy.request?.maxBodySize;
   if (!maxBody) return null;
   const start = Date.now();
@@ -60835,7 +60855,7 @@ async function assertMaxBodySize(baseUrl, endpoint) {
     const res = await sendOnce(baseUrl, {
       ...baseRequest(endpoint, { "Content-Type": "application/octet-stream" }),
       body: big
-    });
+    }, timeoutMs);
     if (res.status === 413) {
       return result(endpoint, "maxBodySize", "PASS", `413 on ${bytes}B payload`, start);
     }
@@ -60844,7 +60864,7 @@ async function assertMaxBodySize(baseUrl, endpoint) {
     return result(endpoint, "maxBodySize", "SKIP", `traffic error: ${e5.message}`, start);
   }
 }
-async function assertContentType(baseUrl, endpoint) {
+async function assertContentType(baseUrl, endpoint, timeoutMs) {
   const allowed = endpoint.policy.request?.contentType;
   if (!allowed?.length) return null;
   if (endpoint.method === "GET" || endpoint.method === "HEAD") return null;
@@ -60853,7 +60873,7 @@ async function assertContentType(baseUrl, endpoint) {
     const res = await sendOnce(baseUrl, {
       ...baseRequest(endpoint, { "Content-Type": "application/x-disallowed-type" }),
       body: "x"
-    });
+    }, timeoutMs);
     if (res.status === 415 || res.status === 400) {
       return result(endpoint, "contentType", "PASS", `${res.status} on bad content-type`, start);
     }
@@ -60862,7 +60882,7 @@ async function assertContentType(baseUrl, endpoint) {
     return result(endpoint, "contentType", "SKIP", `traffic error: ${e5.message}`, start);
   }
 }
-async function assertSchema(baseUrl, endpoint) {
+async function assertSchema(baseUrl, endpoint, timeoutMs) {
   const schema = endpoint.policy.request?.schema;
   if (!schema || Object.keys(schema).length === 0) return null;
   const start = Date.now();
@@ -60870,7 +60890,7 @@ async function assertSchema(baseUrl, endpoint) {
     const res = await sendOnce(baseUrl, {
       ...baseRequest(endpoint, { "Content-Type": "application/json" }),
       body: "{}"
-    });
+    }, timeoutMs);
     if (res.status === 400 || res.status === 422) {
       return result(endpoint, "requestSchema", "PASS", `${res.status} on empty body`, start);
     }
@@ -60879,19 +60899,19 @@ async function assertSchema(baseUrl, endpoint) {
     return result(endpoint, "requestSchema", "SKIP", `traffic error: ${e5.message}`, start);
   }
 }
-async function runAllAssertions(baseUrl, endpoint) {
+async function runAllAssertions(baseUrl, endpoint, timeoutMs) {
   const cases = [];
-  const auth = await assertAuth(baseUrl, endpoint);
+  const auth = await assertAuth(baseUrl, endpoint, timeoutMs);
   if (auth) cases.push(auth);
-  const cors = await assertCors(baseUrl, endpoint);
+  const cors = await assertCors(baseUrl, endpoint, timeoutMs);
   if (cors) cases.push(cors);
-  const ct = await assertContentType(baseUrl, endpoint);
+  const ct = await assertContentType(baseUrl, endpoint, timeoutMs);
   if (ct) cases.push(ct);
-  const sz = await assertMaxBodySize(baseUrl, endpoint);
+  const sz = await assertMaxBodySize(baseUrl, endpoint, timeoutMs);
   if (sz) cases.push(sz);
-  const sch = await assertSchema(baseUrl, endpoint);
+  const sch = await assertSchema(baseUrl, endpoint, timeoutMs);
   if (sch) cases.push(sch);
-  cases.push(...await assertRateLimit(baseUrl, endpoint));
+  cases.push(...await assertRateLimit(baseUrl, endpoint, timeoutMs));
   return cases;
 }
 var init_assertions = __esm({
@@ -60903,16 +60923,23 @@ var init_assertions = __esm({
 // src/verify/readers/kong.ts
 import { request as request3 } from "undici";
-async function getJson(base, p2) {
+async function getJson(base, p2, timeoutMs) {
   const url = base.replace(/\/$/, "") + p2;
   try {
-    const res = await request3(url, { method: "GET" });
+    const res = await request3(url, {
+      method: "GET",
+      ...timeoutMs !== void 0 ? { signal: AbortSignal.timeout(timeoutMs) } : {}
+    });
     if (res.statusCode >= 400) {
       throw new Error(`${url} \u2192 HTTP ${res.statusCode}`);
     }
     const body = await res.body.json();
     return body;
   } catch (e5) {
+    const name = e5.name;
+    if (name === "TimeoutError" || name === "AbortError") {
+      throw new Error(`${url} timed out after ${timeoutMs}ms`);
+    }
     const msg = e5.message;
     if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN/.test(msg)) {
       throw new Error(`gateway-unreachable: ${msg}`);
@@ -60920,11 +60947,11 @@ async function getJson(base, p2) {
     throw e5;
   }
 }
-async function listAll(base, p2) {
+async function listAll(base, p2, timeoutMs) {
   let url = p2;
   const out = [];
   while (url) {
-    const page = await getJson(base, url);
+    const page = await getJson(base, url, timeoutMs);
     out.push(...page.data);
     if (page.next) {
       const u = new URL(page.next, base + "/");
@@ -60978,11 +61005,11 @@ var init_kong = __esm({
         const decl = load7(kongYml.content);
         return scanEmittedFromDeclarative(decl);
       },
-      async readLoadedArtifacts(gateway) {
+      async readLoadedArtifacts(gateway, timeoutMs) {
         const [services, routes, plugins] = await Promise.all([
-          listAll(gateway, "/services"),
-          listAll(gateway, "/routes"),
-          listAll(gateway, "/plugins")
+          listAll(gateway, "/services", timeoutMs),
+          listAll(gateway, "/routes", timeoutMs),
+          listAll(gateway, "/plugins", timeoutMs)
         ]);
         const routeIdToName = /* @__PURE__ */ new Map();
         for (const r5 of routes) if (r5.id && r5.name) routeIdToName.set(r5.id, r5.name);
@@ -61050,13 +61077,13 @@ async function readNginxConfigDump(gateway) {
     if (m3 && m3[1]) modsecFiles.add(m3[1]);
   }
   const extra = [];
-  for (const path28 of modsecFiles) {
-    const cat = spawnSync("docker", ["exec", name, "cat", path28], {
+  for (const path30 of modsecFiles) {
+    const cat = spawnSync("docker", ["exec", name, "cat", path30], {
       encoding: "utf8",
       maxBuffer: 4 * 1024 * 1024
     });
     if (cat.error || cat.status !== 0) continue;
-    extra.push(`# configuration file ${path28}:`);
+    extra.push(`# configuration file ${path30}:`);
     extra.push(cat.stdout || "");
   }
   return dump4 + "\n" + extra.join("\n");
@@ -61069,8 +61096,8 @@ function listGlobInContainer(container, glob) {
   if (r5.error || r5.status !== 0) return [];
   return (r5.stdout || "").split("\n").map((s) => s.trim()).filter(Boolean);
 }
-function fileHasWritHeader(container, path28) {
-  const r5 = spawnSync("docker", ["exec", container, "sh", "-c", `head -5 ${JSON.stringify(path28)} 2>/dev/null`], {
+function fileHasWritHeader(container, path30) {
+  const r5 = spawnSync("docker", ["exec", container, "sh", "-c", `head -5 ${JSON.stringify(path30)} 2>/dev/null`], {
     encoding: "utf8",
     maxBuffer: 64 * 1024
   });
@@ -61122,8 +61149,8 @@ async function readGatewaySource(gateway) {
     throw new Error(msg);
   }
 }
-function extractDirectives(yaml17) {
-  const m3 = yaml17.match(/^directives:\s*\|\s*\n([\s\S]*)$/m);
+function extractDirectives(yaml18) {
+  const m3 = yaml18.match(/^directives:\s*\|\s*\n([\s\S]*)$/m);
   const body = m3?.[1];
   if (!body) return "";
   return body.split("\n").map((l3) => l3.replace(/^ {2}/, "")).join("\n");
@@ -61184,7 +61211,7 @@ var init_modsec_nginx = __esm({
         const directives = extractDirectives(yml.content);
         return scanEmittedRules(directives);
       },
-      async readLoadedArtifacts(gateway) {
+      async readLoadedArtifacts(gateway, _timeoutMs) {
         const raw = await readGatewaySource(gateway);
         const out = [];
         const nginxDump = await readNginxConfigDump(gateway);
@@ -61284,8 +61311,8 @@ var init_modsec_nginx = __esm({
 import { readFile as readFile10 } from "node:fs/promises";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { request as request4 } from "undici";
-function extractDirectives2(yaml17) {
-  const m3 = yaml17.match(/^directives:\s*\|\s*\n([\s\S]*)$/m);
+function extractDirectives2(yaml18) {
+  const m3 = yaml18.match(/^directives:\s*\|\s*\n([\s\S]*)$/m);
   const body = m3?.[1];
   if (!body) return "";
   return body.split("\n").map((l3) => l3.replace(/^ {2}/, "")).join("\n");
@@ -61351,11 +61378,14 @@ var init_coraza_go = __esm({
         if (!yml) throw new Error("coraza generator did not emit a YAML artifact");
         return scanEmittedRules2(extractDirectives2(yml.content));
       },
-      async readLoadedArtifacts(gateway) {
+      async readLoadedArtifacts(gateway, timeoutMs) {
         if (gateway.startsWith("http://") || gateway.startsWith("https://")) {
           const url = gateway.replace(/\/$/, "") + "/debug/rules";
           try {
-            const res = await request4(url, { method: "GET" });
+            const res = await request4(url, {
+              method: "GET",
+              ...timeoutMs !== void 0 ? { signal: AbortSignal.timeout(timeoutMs) } : {}
+            });
             if (res.statusCode >= 400) {
               throw new Error(`debug-rules endpoint returned HTTP ${res.statusCode}`);
             }
@@ -61363,6 +61393,10 @@ var init_coraza_go = __esm({
             const ids = body.rules ?? [];
             return ids.map((r5) => ({ id: String(r5.id), kind: "coraza-rule" }));
           } catch (e5) {
+            const name = e5.name;
+            if (name === "TimeoutError" || name === "AbortError") {
+              throw new Error(`${url} timed out after ${timeoutMs}ms`);
+            }
             const msg = e5.message;
             if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN/.test(msg)) throw new Error(`gateway-unreachable: ${msg}`);
             throw e5;
@@ -61667,7 +61701,7 @@ var init_coraza_spoa = __esm({
         if (!yml) throw new Error("coraza generator did not emit a YAML artifact");
         return scanEmittedRules3(extractDirectives3(yml.content));
       },
-      async readLoadedArtifacts(gateway) {
+      async readLoadedArtifacts(gateway, _timeoutMs) {
         const split2 = parseSpoaGateway(gateway);
         const haproxyLog = split2.haproxy ? dockerLogs(split2.haproxy) : "";
         const spoaLog = split2.spoa ? dockerLogs(split2.spoa) : "";
@@ -61823,15 +61857,22 @@ var init_coraza_spoa = __esm({
 // src/verify/readers/envoy.ts
 import { request as request5 } from "undici";
 import * as yaml7 from "js-yaml";
-async function getJson2(base, p2) {
+async function getJson2(base, p2, timeoutMs) {
   const url = base.replace(/\/$/, "") + p2;
   try {
-    const res = await request5(url, { method: "GET" });
+    const res = await request5(url, {
+      method: "GET",
+      ...timeoutMs !== void 0 ? { signal: AbortSignal.timeout(timeoutMs) } : {}
+    });
     if (res.statusCode >= 400) {
       throw new Error(`${url} \u2192 HTTP ${res.statusCode}`);
     }
     return await res.body.json();
   } catch (e5) {
+    const name = e5.name;
+    if (name === "TimeoutError" || name === "AbortError") {
+      throw new Error(`${url} timed out after ${timeoutMs}ms`);
+    }
     const msg = e5.message;
     if (/ECONNREFUSED|ENOTFOUND|EAI_AGAIN/.test(msg)) {
       throw new Error(`gateway-unreachable: ${msg}`);
@@ -61999,7 +62040,7 @@ function routeLabel(route) {
   const match = route.match;
   if (!match) return null;
   const sr = match.safe_regex;
-  const path28 = sr?.regex ?? match.prefix ?? null;
+  const path30 = sr?.regex ?? match.prefix ?? null;
   const headers = match.headers;
   let method = "";
   if (headers) {
@@ -62011,7 +62052,7 @@ function routeLabel(route) {
       }
     }
   }
-  return path28 ? `${method} ${path28}`.trim() : null;
+  return path30 ? `${method} ${path30}`.trim() : null;
 }
 function emittedToArtifacts(parsed) {
   const out = [];
@@ -62063,8 +62104,8 @@ function emittedToArtifacts(parsed) {
     });
   }
   for (const key of parsed.endpointPolicies) {
-    const [method, path28] = key.split(":", 2);
-    const endpoint = method && path28 ? `${method} ${path28}` : key;
+    const [method, path30] = key.split(":", 2);
+    const endpoint = method && path30 ? `${method} ${path30}` : key;
     push({
       id: key,
       kind: "envoy-endpoint-policy",
@@ -62107,11 +62148,11 @@ var init_envoy3 = __esm({
         const parsed = parseEmittedSnippet(envoyYaml.content);
         return emittedToArtifacts(parsed);
       },
-      async readLoadedArtifacts(gateway) {
+      async readLoadedArtifacts(gateway, timeoutMs) {
         const [listeners, clusters, configDump] = await Promise.all([
-          getJson2(gateway, "/listeners?format=json").catch(() => ({})),
-          getJson2(gateway, "/clusters?format=json").catch(() => ({})),
-          getJson2(gateway, "/config_dump?include_eds=false")
+          getJson2(gateway, "/listeners?format=json", timeoutMs).catch(() => ({})),
+          getJson2(gateway, "/clusters?format=json", timeoutMs).catch(() => ({})),
+          getJson2(gateway, "/config_dump?include_eds=false", timeoutMs)
         ]);
         const out = [];
         const filterNames = /* @__PURE__ */ new Set();
@@ -62287,7 +62328,7 @@ var init_bunkerweb3 = __esm({
           line: r5.line
         }));
       },
-      async readLoadedArtifacts(gateway) {
+      async readLoadedArtifacts(gateway, _timeoutMs) {
         const split2 = parseBunkerwebGateway(gateway);
         const dump4 = dumpNginxConfig(split2.bunkerweb);
         const ids = /* @__PURE__ */ new Set();
@@ -62419,8 +62460,8 @@ function parseOpenappsecPolicy(policyYaml) {
       const name = typeof obj.name === "string" ? obj.name : void 0;
       const binding = obj.binding;
       const method = binding && typeof binding.method === "string" ? binding.method : "";
-      const path28 = binding && typeof binding.path === "string" ? binding.path : "";
-      if (name && method && path28) schemaEntries.push({ name, endpoint: `${method} ${path28}` });
+      const path30 = binding && typeof binding.path === "string" ? binding.path : "";
+      if (name && method && path30) schemaEntries.push({ name, endpoint: `${method} ${path30}` });
     }
   }
   return { practices, assets, triggers, customResponses, schemaEntries };
@@ -62496,7 +62537,7 @@ var init_openappsec3 = __esm({
         if (!policy) throw new Error("openappsec generator did not emit policy.yaml");
         return policyToArtifacts(parseOpenappsecPolicy(policy.content));
       },
-      async readLoadedArtifacts(gateway) {
+      async readLoadedArtifacts(gateway, _timeoutMs) {
         if (!gateway.startsWith("docker:")) {
           throw new Error(`openappsec gateway must be docker:<container> (got "${gateway}")`);
         }
@@ -62694,7 +62735,7 @@ async function runVerify(specPath, opts) {
   }
   let unreachable = false;
   try {
-    loaded = await reader.readLoadedArtifacts(opts.gateway);
+    loaded = await reader.readLoadedArtifacts(opts.gateway, opts.timeoutMs);
   } catch (e5) {
     const msg = e5.message;
     diagnostics.push(`gateway read error: ${msg}`);
@@ -62856,7 +62897,7 @@ ${plan.yaml}`,
   const cases = [];
   try {
     await handle.ready();
-    const coverageOk = await verifyCoverageOrSkip(specPath, target, handle);
+    const coverageOk = await verifyCoverageOrSkip(specPath, target, handle, opts.timeoutMs);
     if (coverageOk === false) {
       cases.push({
         endpoint: "(gateway)",
@@ -62867,7 +62908,7 @@ ${plan.yaml}`,
       });
     } else {
       for (const e5 of spec.endpoints) {
-        cases.push(...await runAllAssertions(handle.gatewayUrl, e5));
+        cases.push(...await runAllAssertions(handle.gatewayUrl, e5, opts.timeoutMs));
       }
     }
   } finally {
@@ -62893,32 +62934,36 @@ ${plan.yaml}`,
   const failures = cases.filter((c5) => c5.verdict === "FAIL").length;
   return { report, rendered, composeYaml: plan.yaml, exitCode: failures > 0 ? 1 : 0 };
 }
-async function verifyCoverageOrSkip(specPath, target, handle) {
+async function verifyCoverageOrSkip(specPath, target, handle, timeoutMs) {
+  const timeoutOpt = timeoutMs !== void 0 ? { timeoutMs } : {};
   try {
     if (target === "kong") {
       const adminUrl = handle.gatewayUrl.replace(/:(\d+)$/, (_, p2) => `:${Number(p2) + 1}`);
-      const r5 = await runVerify(specPath, { target: "kong", gateway: adminUrl });
+      const r5 = await runVerify(specPath, { target: "kong", gateway: adminUrl, ...timeoutOpt });
       return r5.exitCode === 0;
     }
     if (target === "coraza") {
       const r5 = await runVerify(specPath, {
         target: "coraza",
         engine: "modsec-nginx",
-        gateway: `docker:${handle.gatewayContainerName}`
+        gateway: `docker:${handle.gatewayContainerName}`,
+        ...timeoutOpt
       });
       return r5.exitCode === 0;
     }
     if (target === "bunkerweb") {
       const r5 = await runVerify(specPath, {
         target: "bunkerweb",
-        gateway: `docker:${handle.gatewayContainerName}`
+        gateway: `docker:${handle.gatewayContainerName}`,
+        ...timeoutOpt
       });
       return r5.exitCode === 0;
     }
     if (target === "openappsec") {
       const r5 = await runVerify(specPath, {
         target: "openappsec",
-        gateway: `docker:${handle.gatewayContainerName}`
+        gateway: `docker:${handle.gatewayContainerName}`,
+        ...timeoutOpt
       });
       return r5.exitCode === 0;
     }
@@ -63768,9 +63813,9 @@ var init_init = __esm({
 // ../cursor-mcp/dist/tools/propose-annotation.js
 function propose(input) {
   const method = (input.method ?? "GET").toUpperCase();
-  const path28 = input.path ?? "/";
+  const path30 = input.path ?? "/";
   const desc = (input.description ?? "").toLowerCase();
-  const lower = path28.toLowerCase();
+  const lower = path30.toLowerCase();
   const rationale = [];
   const isAuthEndpoint = /\/(login|signin|signup|register|auth|token|password[-_/]?reset|forgot[-_/]?password)\b/.test(lower) || desc.includes("login") || desc.includes("sign in") || desc.includes("signup");
   const isAdmin = /\/admin(\/|$)/.test(lower) || desc.includes("admin");
@@ -63808,7 +63853,7 @@ function propose(input) {
   const maxBody = isUpload ? "10MB" : "32KB";
   if (isUpload)
     rationale.push("upload endpoint \u2014 10MB body cap");
-  const hasIdParam = /\{[^}]+\}/.test(path28) || /:[A-Za-z_][\w]*/.test(path28);
+  const hasIdParam = /\{[^}]+\}/.test(path30) || /:[A-Za-z_][\w]*/.test(path30);
   if (hasIdParam) {
     rationale.push("path has a resource identifier \u2014 add authorization rules to prevent IDOR (API1:2023)");
   }
@@ -63865,12 +63910,12 @@ var init_propose_annotation = __esm({
         if (!input.method || !input.path) {
           throw new Error("method and path are required");
         }
-        const { yaml: yaml17, rationale } = propose(input);
+        const { yaml: yaml18, rationale } = propose(input);
         return `# Proposed x-security for ${input.method.toUpperCase()} ${input.path}
 # Rationale:
 ` + rationale.map((r5) => `#   - ${r5}`).join("\n") + `
-${yaml17}`;
+${yaml18}`;
       }
     };
   }
@@ -64288,11 +64333,11 @@ async function runVerifyBundle(tarballPath, opts = {}) {
   } else {
     pubKeyPem = BUNDLE_VERIFY_PUBLIC_KEY;
   }
-  const tmpdir4 = fs.mkdtempSync(path6.join(os2.tmpdir(), "writ-verify-"));
+  const tmpdir5 = fs.mkdtempSync(path6.join(os2.tmpdir(), "writ-verify-"));
   try {
-    await extractTarball(tarballPath, tmpdir4);
-    const manifestPath = path6.join(tmpdir4, MANIFEST);
-    const sigPath = path6.join(tmpdir4, SIG);
+    await extractTarball(tarballPath, tmpdir5);
+    const manifestPath = path6.join(tmpdir5, MANIFEST);
+    const sigPath = path6.join(tmpdir5, SIG);
     if (!fs.existsSync(manifestPath)) {
       return { exitCode: 1, message: `verify-bundle: ${MANIFEST} missing from bundle` };
     }
@@ -64321,7 +64366,7 @@ async function runVerifyBundle(tarballPath, opts = {}) {
         };
       }
       const expectedHex = expected.slice("sha256:".length).toLowerCase();
-      const filePath = path6.join(tmpdir4, relPath);
+      const filePath = path6.join(tmpdir5, relPath);
       if (!fs.existsSync(filePath)) {
         process.stderr.write(`hash mismatch: ${relPath} (missing from bundle)
 `);
@@ -64360,7 +64405,7 @@ pubkey fingerprint: ${fingerprint}`,
     };
   } finally {
     try {
-      fs.rmSync(tmpdir4, { recursive: true, force: true });
+      fs.rmSync(tmpdir5, { recursive: true, force: true });
     } catch {
     }
   }
@@ -64424,6 +64469,7 @@ async function runVerifyCli(specPath, opts) {
   };
   if (engine) runOpts.engine = engine;
   if (opts.threshold !== void 0) runOpts.thresholdPct = opts.threshold;
+  if (opts.timeoutMs !== void 0) runOpts.timeoutMs = opts.timeoutMs;
   const r5 = await runVerify(specPath, runOpts);
   return { rendered: r5.rendered, exitCode: r5.exitCode, passed: r5.report.passed };
 }
@@ -67102,8 +67148,8 @@ function isSelfMutationBodyOwnership(route, policy) {
   const hasBodyOwnership = fields.some((f5) => f5.loc === "body");
   if (!hasBodyOwnership)
     return false;
-  const path28 = route.path.toLowerCase();
-  if (SELF_MUTATION_PATH_TOKENS.some((t) => path28.includes(t)))
+  const path30 = route.path.toLowerCase();
+  if (SELF_MUTATION_PATH_TOKENS.some((t) => path30.includes(t)))
     return true;
   const pinsRequestVisibleId = fields.some((f5) => f5.loc === "path" || f5.loc === "params" || f5.loc === "query");
   return !pinsRequestVisibleId;
@@ -67406,8 +67452,8 @@ function normPath(p2) {
   }
   return out;
 }
-function routeKey(method, path28) {
-  return `${method}\0${normPath(path28)}`;
+function routeKey(method, path30) {
+  return `${method}\0${normPath(path30)}`;
 }
 function dedupeRoutes(routes) {
   const seen = /* @__PURE__ */ new Map();
@@ -67437,8 +67483,8 @@ function dedupeRoutes(routes) {
   }
   return out;
 }
-function underMount(prefix, path28) {
-  const p2 = "/" + path28.replace(/^\/+/, "");
+function underMount(prefix, path30) {
+  const p2 = "/" + path30.replace(/^\/+/, "");
   const full = prefix ? prefix.replace(/\/+$/, "") + p2 : p2;
   return full.replace(/\/\/+/g, "/");
 }
@@ -70057,8 +70103,8 @@ function compileAssumptionsToPolicy(emission) {
     return { emission, applied: [] };
   const applied = [];
   const policy = emission.policy ? structuredClone(emission.policy) : {};
-  const request7 = policy["request"] ??= {};
-  const schema = request7["schema"] ??= {};
+  const request9 = policy["request"] ??= {};
+  const schema = request9["schema"] ??= {};
   for (const a5 of emission.assumptions) {
     if (a5.confidence !== "high" && a5.confidence !== "medium")
       continue;
@@ -70121,8 +70167,8 @@ function compileAssumptionsToPolicy(emission) {
       continue;
     }
     if (hint.kind === "denyUnknownFields") {
-      if (request7["denyUnknownFields"] !== true) {
-        request7["denyUnknownFields"] = true;
+      if (request9["denyUnknownFields"] !== true) {
+        request9["denyUnknownFields"] = true;
         applied.push("request.denyUnknownFields:true");
       }
       continue;
@@ -70155,10 +70201,10 @@ function compileAssumptionsToPolicy(emission) {
       continue;
     }
     if (hint.kind === "contentType") {
-      if (request7["contentType"] !== void 0)
+      if (request9["contentType"] !== void 0)
         continue;
       const allowed = hint.allowed && hint.allowed.length > 0 ? hint.allowed : ["application/json"];
-      request7["contentType"] = allowed;
+      request9["contentType"] = allowed;
       applied.push(`request.contentType:[${allowed.join(",")}]`);
       continue;
     }
@@ -72039,12 +72085,12 @@ function dismissalProvesOwnership(cites, surface) {
     return PRINCIPAL_TOKEN_RE2.test(q2) && COMPARE_OR_BIND_RE.test(q2);
   });
 }
-function isSensitivePath(path28) {
-  const p2 = path28.toLowerCase();
+function isSensitivePath(path30) {
+  const p2 = path30.toLowerCase();
   return SENSITIVE_PATH_TOKENS.some((t) => p2.includes(t));
 }
-function isAuthEndpointPath(path28) {
-  const p2 = path28.toLowerCase();
+function isAuthEndpointPath(path30) {
+  const p2 = path30.toLowerCase();
   return AUTH_ENDPOINT_PATH_TOKENS.some((t) => p2.includes(t));
 }
 function findCredentialCheck(pack) {
@@ -72175,7 +72221,7 @@ function citedDismissalCovers(cites, surface) {
 function assessRouteDepth(args) {
   const { policy, pack } = args;
   const method = args.method.toUpperCase();
-  const path28 = args.path ?? "";
+  const path30 = args.path ?? "";
   const auth = args.auth;
   const dismissalCites = args.dismissalCites;
   const gaps = [];
@@ -72252,7 +72298,7 @@ function assessRouteDepth(args) {
     }
   }
   {
-    const sensitive = isSensitivePath(path28) || emitsPrincipalScopedOutput(pack);
+    const sensitive = isSensitivePath(path30) || emitsPrincipalScopedOutput(pack);
     const hasAuthBlock = Boolean(policy.authentication && policy.authentication.type && policy.authentication.type !== "none");
     const c1 = sensitive && authChainResolvedEmpty && !hasAuthBlock;
     const c22 = sensitive && !authChainResolvedEmpty && !hasAuthBlock;
@@ -72263,7 +72309,7 @@ function assessRouteDepth(args) {
         const why = c1 ? `the resolved auth chain is EMPTY (no middleware, no inline auth call)` : `app middleware exists but the emitted policy carries no authentication block (the gateway is the enforcement point, not app middleware)`;
         const gap = {
           kind: "sensitive-route-no-auth",
-          detail: `${method} ${path28 || "(route)"} is sensitive (path token or principal-scoped output) and ${why}. Emit an authentication block, or cite a public-routes allowlist line proving it is intentionally public.`,
+          detail: `${method} ${path30 || "(route)"} is sensitive (path token or principal-scoped output) and ${why}. Emit an authentication block, or cite a public-routes allowlist line proving it is intentionally public.`,
           surface: surfaceCite
         };
         gaps.push(gap);
@@ -72272,7 +72318,7 @@ function assessRouteDepth(args) {
   }
   {
     const credCheck = findCredentialCheck(pack);
-    const isAuthEndpoint = isAuthEndpointPath(path28) || credCheck !== null;
+    const isAuthEndpoint = isAuthEndpointPath(path30) || credCheck !== null;
     if (isAuthEndpoint && !rateLimitPresent(policy.rateLimit)) {
       const surfaceCite = credCheck ?? (pack.handlerSnippet ? {
         file: pack.handlerSnippet.file,
@@ -72282,7 +72328,7 @@ function assessRouteDepth(args) {
       if (surfaceCite && !citedDismissalCovers(dismissalCites, surfaceCite)) {
         gaps.push({
           kind: "auth-endpoint-no-rate-limit",
-          detail: `${method} ${path28 || "(route)"} is an authentication/credential endpoint with no rateLimit \u2014 a brute-force surface. Emit a rateLimit (e.g. { requests: 5, window: '1m', identifier: 'ip' }) or cite why it is intentionally unthrottled.`,
+          detail: `${method} ${path30 || "(route)"} is an authentication/credential endpoint with no rateLimit \u2014 a brute-force surface. Emit a rateLimit (e.g. { requests: 5, window: '1m', identifier: 'ip' }) or cite why it is intentionally unthrottled.`,
           surface: surfaceCite
         });
       }
@@ -73100,8 +73146,8 @@ var init_push = __esm({
     PushError = class extends Error {
     };
     defaultPoster = async (url, init) => {
-      const { request: request7 } = await import("undici");
-      const res = await request7(url, { method: "POST", headers: init.headers, body: init.body });
+      const { request: request9 } = await import("undici");
+      const res = await request9(url, { method: "POST", headers: init.headers, body: init.body });
       const text = await res.body.text();
       let body = text;
       try {
@@ -74419,17 +74465,511 @@ var init_byo_commands = __esm({
   }
 });
-// src/bin/lazy.ts
-var lazy_exports = {};
+// src/commands/doctor.ts
+import Docker from "dockerode";
+import { request as request7 } from "undici";
+async function runDoctor(opts = {}) {
+  const checks = [checkNode(), await checkDocker()];
+  if (opts.gateway) {
+    checks.push(await checkGateway(opts.gateway, opts.timeoutMs ?? DEFAULT_GATEWAY_TIMEOUT_MS));
+  }
+  const exitCode = checks.some((c5) => c5.status === "fail") ? 1 : 0;
+  const rendered = opts.format === "json" ? renderJson2(checks, exitCode) : renderTable3(checks);
+  return { exitCode, rendered, checks };
+}
+function checkNode() {
+  const version = process.versions.node;
+  const major = Number(version.split(".")[0]);
+  const ok2 = major >= MIN_NODE_MAJOR;
+  return {
+    name: "node",
+    status: ok2 ? "ok" : "fail",
+    detail: `v${version} (requires >=${MIN_NODE_MAJOR})`
+  };
+}
+async function checkDocker() {
+  try {
+    const docker = new Docker();
+    await withTimeout(docker.ping(), DOCKER_PING_TIMEOUT_MS);
+    return { name: "docker", status: "ok", detail: "daemon reachable" };
+  } catch (e5) {
+    return {
+      name: "docker",
+      status: "warn",
+      detail: `Docker not reachable \u2014 only needed for \`test\` (${e5.message})`
+    };
+  }
+}
+function withTimeout(p2, ms) {
+  return new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => reject(new Error(`timed out after ${ms}ms`)), ms);
+    p2.then(
+      (v) => {
+        clearTimeout(timer);
+        resolve2(v);
+      },
+      (e5) => {
+        clearTimeout(timer);
+        reject(e5);
+      }
+    );
+  });
+}
+function isHttpUrl(value) {
+  try {
+    const u = new URL(value);
+    return u.protocol === "http:" || u.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+async function checkGateway(gateway, timeoutMs) {
+  if (!isHttpUrl(gateway)) {
+    return {
+      name: "gateway",
+      status: "ok",
+      detail: `skipped: non-HTTP gateway (${gateway})`
+    };
+  }
+  try {
+    await request7(gateway, { signal: AbortSignal.timeout(timeoutMs) });
+    return { name: "gateway", status: "ok", detail: `reachable at ${gateway}` };
+  } catch (e5) {
+    return {
+      name: "gateway",
+      status: "fail",
+      detail: `unreachable: ${gateway} (${e5.message})`
+    };
+  }
+}
+function renderJson2(checks, exitCode) {
+  return JSON.stringify({ checks, ok: exitCode === 0 }, null, 2) + "\n";
+}
+function renderTable3(checks) {
+  const nameWidth = Math.max(...checks.map((c5) => c5.name.length));
+  const lines = checks.map(
+    (c5) => `[${c5.status}]${" ".repeat(Math.max(1, 6 - c5.status.length))}${c5.name.padEnd(nameWidth)}  ${c5.detail}`
+  );
+  return lines.join("\n") + "\n";
+}
+function registerDoctor(program2) {
+  program2.command("doctor").description("Preflight: check Node, Docker, and (optionally) a gateway URL are usable.").option("--format <fmt>", "table|json (default table)", "table").option("--gateway <url>", "Also check this gateway admin URL is reachable").option("--timeout <ms>", "Gateway reachability timeout (default 3000)", (v) => Number(v)).action(async (opts) => {
+    try {
+      const doctorOpts = { format: opts.format };
+      if (opts.gateway !== void 0) doctorOpts.gateway = opts.gateway;
+      if (opts.timeout !== void 0) doctorOpts.timeoutMs = opts.timeout;
+      const r5 = await runDoctor(doctorOpts);
+      process.stdout.write(r5.rendered);
+      process.exit(r5.exitCode);
+    } catch (e5) {
+      process.stderr.write(`doctor failed: ${e5.message}
+`);
+      process.exit(1);
+    }
+  });
+}
+var MIN_NODE_MAJOR, DEFAULT_GATEWAY_TIMEOUT_MS, DOCKER_PING_TIMEOUT_MS;
+var init_doctor = __esm({
+  "src/commands/doctor.ts"() {
+    "use strict";
+    MIN_NODE_MAJOR = 20;
+    DEFAULT_GATEWAY_TIMEOUT_MS = 3e3;
+    DOCKER_PING_TIMEOUT_MS = 2e3;
+  }
+});
+// src/bin/completion.ts
+function sanitizeIdentifier(binName) {
+  return binName.replace(/[^A-Za-z0-9_]/g, "_");
+}
+function generateBash(binName, subcommands) {
+  const fnName = `_${sanitizeIdentifier(binName)}_completions`;
+  const words = subcommands.join(" ");
+  return `# bash completion for ${binName}
+${fnName}() {
+  local cur
+  cur="\${COMP_WORDS[1]}"
+  COMPREPLY=( $(compgen -W "${words}" -- "$cur") )
+}
+complete -F ${fnName} ${binName}
+`;
+}
+function generateZsh(binName, subcommands) {
+  const words = subcommands.join(" ");
+  return `#compdef ${binName}
+# zsh completion for ${binName}
+_${sanitizeIdentifier(binName)}() {
+  local -a subcommands
+  subcommands=(${words})
+  _describe 'command' subcommands
+}
+compdef _${sanitizeIdentifier(binName)} ${binName}
+`;
+}
+function generateFish(binName, subcommands) {
+  const words = subcommands.join(" ");
+  return `# fish completion for ${binName}
+complete -c ${binName} -f -n '__fish_use_subcommand' -a '${words}'
+`;
+}
+function generateCompletion(shell, binName, subcommands) {
+  switch (shell) {
+    case "bash":
+      return generateBash(binName, subcommands);
+    case "zsh":
+      return generateZsh(binName, subcommands);
+    case "fish":
+      return generateFish(binName, subcommands);
+  }
+}
+function isSupportedShell(shell) {
+  return SUPPORTED_SHELLS.includes(shell);
+}
+function registerCompletion(program2) {
+  program2.command("completion [shell]").description(
+    'Print a shell completion script. Usage: eval "$(<bin> completion zsh)" or add to your rc file.'
+  ).addHelpText(
+    "after",
+    `
+Examples:
+  # bash: add to ~/.bashrc
+  eval "$(${program2.name()} completion bash)"
+  # zsh: add to ~/.zshrc
+  eval "$(${program2.name()} completion zsh)"
+  # fish: write to a completions file
+  ${program2.name()} completion fish > ~/.config/fish/completions/${program2.name()}.fish
+`
+  ).action((shell) => {
+    const binName = program2.name();
+    const subcommands = program2.commands.map((c5) => c5.name()).filter((name) => name !== "completion" && name !== "help");
+    const resolvedShell = shell ?? "bash";
+    if (!isSupportedShell(resolvedShell)) {
+      process.stderr.write(`unsupported shell "${resolvedShell}" (use bash|zsh|fish)
+`);
+      process.exit(1);
+      return;
+    }
+    process.stdout.write(generateCompletion(resolvedShell, binName, subcommands));
+  });
+}
+var SUPPORTED_SHELLS;
+var init_completion = __esm({
+  "src/bin/completion.ts"() {
+    "use strict";
+    SUPPORTED_SHELLS = ["bash", "zsh", "fish"];
+  }
+});
+// src/bin/update-check.ts
 import { readFileSync as readFileSync4 } from "node:fs";
-import { basename as basename2, dirname as dirname4, join as join12 } from "node:path";
+import { dirname as dirname4, join as join12 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { request as request8 } from "undici";
+function resolvePackageMeta() {
+  const here = dirname4(fileURLToPath2(import.meta.url));
+  for (const rel of ["../package.json", "../../package.json"]) {
+    try {
+      const pkg = JSON.parse(readFileSync4(join12(here, rel), "utf8"));
+      if (typeof pkg.name === "string" && typeof pkg.version === "string") {
+        return { name: pkg.name, version: pkg.version };
+      }
+    } catch {
+    }
+  }
+  return { name: "x-security", version: "0.0.0" };
+}
+async function fetchLatestVersion(name, timeoutMs = 2e3) {
+  try {
+    const { body } = await request8(`https://registry.npmjs.org/${encodeURIComponent(name)}/latest`, {
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    const json = await body.json();
+    return typeof json.version === "string" ? json.version : null;
+  } catch {
+    return null;
+  }
+}
+function toSegments(v) {
+  const [major, minor, patch] = v.split(".").map((n2) => parseInt(n2, 10));
+  return [major || 0, minor || 0, patch || 0];
+}
+function isNewer(latest, current) {
+  const [aMajor, aMinor, aPatch] = toSegments(latest);
+  const [bMajor, bMinor, bPatch] = toSegments(current);
+  if (aMajor !== bMajor) return aMajor > bMajor;
+  if (aMinor !== bMinor) return aMinor > bMinor;
+  return aPatch > bPatch;
+}
+function truthyEnv(v) {
+  return !!v && v !== "0" && v.toLowerCase() !== "false";
+}
+function registerUpdateCheck(program2) {
+  program2.command("update-check").description("Check npm for a newer release (explicit; makes one network call).").option("--timeout <ms>", "Registry request timeout in ms", (v) => Number(v)).action(async (opts) => {
+    const { name, version } = resolvePackageMeta();
+    const latest = await fetchLatestVersion(name, opts.timeout);
+    if (latest === null) {
+      process.stderr.write("update-check failed: could not reach npm registry\n");
+      process.exit(1);
+      return;
+    }
+    if (isNewer(latest, version)) {
+      process.stdout.write(`update available: ${version} \u2192 ${latest}  (npm i -g ${name}@latest)
+`);
+    } else {
+      process.stdout.write(`up to date (v${version})
+`);
+    }
+  });
+  program2.hook("postAction", async () => {
+    if (!truthyEnv(process.env.XSECURITY_UPDATE_CHECK)) return;
+    if (truthyEnv(process.env.NO_UPDATE_NOTIFIER) || truthyEnv(process.env.XSECURITY_NO_UPDATE_CHECK)) return;
+    try {
+      const { name, version } = resolvePackageMeta();
+      const latest = await fetchLatestVersion(name);
+      if (latest !== null && isNewer(latest, version)) {
+        process.stderr.write(`\u21E1 x-security ${latest} available (you have ${version}) \u2014 run: ${name} update-check
+`);
+      }
+    } catch {
+    }
+  });
+}
+var init_update_check = __esm({
+  "src/bin/update-check.ts"() {
+    "use strict";
+  }
+});
+// src/config/defaults.ts
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
+import os3 from "node:os";
+import path28 from "node:path";
+import yaml17 from "js-yaml";
+function readConfigFile(file) {
+  try {
+    if (!existsSync4(file)) return {};
+    const raw = readFileSync5(file, "utf8");
+    const doc = yaml17.load(raw);
+    return pickKnown(doc);
+  } catch {
+    return {};
+  }
+}
+function pickKnown(doc) {
+  if (doc === null || typeof doc !== "object") return {};
+  const src = doc;
+  const out = {};
+  if (typeof src.format === "string") out.format = src.format;
+  if (typeof src.out === "string") out.out = src.out;
+  if (src.timeout !== void 0) {
+    const n2 = Number(src.timeout);
+    if (!Number.isNaN(n2)) out.timeout = n2;
+  }
+  return out;
+}
+function firstExisting(candidates) {
+  return candidates.find((c5) => existsSync4(c5));
+}
+function loadConfig2(cwd = process.cwd(), home = os3.homedir()) {
+  const homeFile = firstExisting([
+    path28.join(home, ".config", "xsecurity", "config.yaml"),
+    path28.join(home, ".config", "xsecurity", "config.yml"),
+    path28.join(home, ".config", "xsecurity", "config.json")
+  ]);
+  const projectFile = firstExisting([
+    path28.join(cwd, ".xsecurityrc.yaml"),
+    path28.join(cwd, ".xsecurityrc.yml"),
+    path28.join(cwd, ".xsecurityrc.json"),
+    path28.join(cwd, ".xsecurityrc")
+  ]);
+  let merged = {};
+  if (homeFile) merged = { ...merged, ...readConfigFile(homeFile) };
+  if (projectFile) merged = { ...merged, ...readConfigFile(projectFile) };
+  const envPath = process.env.XSECURITY_CONFIG;
+  if (envPath) merged = { ...merged, ...readConfigFile(envPath) };
+  return merged;
+}
+function applyConfigDefaults(program2) {
+  const config = loadConfig2();
+  if (Object.keys(config).length === 0) return;
+  program2.hook("preAction", (_thisCommand, actionCommand) => {
+    for (const key of KNOWN_KEYS) {
+      const value = config[key];
+      if (value === void 0) continue;
+      const longFlag = LONG_FLAGS[key];
+      const hasOption = actionCommand.options.some((o2) => o2.long === longFlag);
+      if (!hasOption) continue;
+      const attr = OPTION_ATTRS[key];
+      const source = actionCommand.getOptionValueSource(attr);
+      if (source !== "default" && source !== void 0) continue;
+      actionCommand.setOptionValue(attr, value);
+      const withSource = actionCommand;
+      withSource.setOptionValueWithSource?.(attr, value, "config");
+    }
+  });
+}
+var KNOWN_KEYS, OPTION_ATTRS, LONG_FLAGS;
+var init_defaults = __esm({
+  "src/config/defaults.ts"() {
+    "use strict";
+    KNOWN_KEYS = ["format", "timeout", "out"];
+    OPTION_ATTRS = {
+      format: "format",
+      timeout: "timeout",
+      out: "out"
+    };
+    LONG_FLAGS = {
+      format: "--format",
+      timeout: "--timeout",
+      out: "--out"
+    };
+  }
+});
+// src/bin/register-extras.ts
+function registerExtras(program2) {
+  registerByoCommands(program2);
+  registerDoctor(program2);
+  registerCompletion(program2);
+  registerUpdateCheck(program2);
+  applyConfigDefaults(program2);
+}
+var init_register_extras = __esm({
+  "src/bin/register-extras.ts"() {
+    "use strict";
+    init_byo_commands();
+    init_doctor();
+    init_completion();
+    init_update_check();
+    init_defaults();
+  }
+});
+// src/bin/cli-io.ts
+import * as fs22 from "node:fs";
+import * as path29 from "node:path";
+import * as os4 from "node:os";
+function _cleanupTempSpecs() {
+  for (const dir of tempSpecDirs) {
+    try {
+      fs22.rmSync(dir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+}
+async function resolveSpecArg(arg, stdin = process.stdin) {
+  if (arg !== "-") return arg;
+  const chunks = [];
+  for await (const chunk of stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  const content = Buffer.concat(chunks).toString("utf8").trim();
+  if (!content) {
+    throw new Error("expected a spec document on stdin, got empty input");
+  }
+  const dir = fs22.mkdtempSync(path29.join(os4.tmpdir(), "writ-stdin-"));
+  tempSpecDirs.add(dir);
+  if (!exitHandlerRegistered) {
+    exitHandlerRegistered = true;
+    process.once("exit", _cleanupTempSpecs);
+  }
+  const specPath = path29.join(dir, "spec.yaml");
+  fs22.writeFileSync(specPath, content, "utf8");
+  return specPath;
+}
+function makeDiagnostics(v) {
+  return {
+    warn(line) {
+      if (v === "quiet") return;
+      process.stderr.write(`${line}
+`);
+    },
+    info(line) {
+      if (v !== "verbose") return;
+      process.stderr.write(`${line}
+`);
+    }
+  };
+}
+var tempSpecDirs, exitHandlerRegistered;
+var init_cli_io = __esm({
+  "src/bin/cli-io.ts"() {
+    "use strict";
+    tempSpecDirs = /* @__PURE__ */ new Set();
+    exitHandlerRegistered = false;
+  }
+});
+// src/bin/help-text.ts
+var generateExamples, validateExamples, verifyExamples, reportExamples, diffExamples;
+var init_help_text = __esm({
+  "src/bin/help-text.ts"() {
+    "use strict";
+    generateExamples = `
+Examples:
+  # Compile a spec on disk into Kong config
+  $ lazy generate --target kong spec.yaml
+  # Read the spec from stdin (- means stdin)
+  $ cat spec.yaml | lazy generate --target kong -
+`;
+    validateExamples = `
+Examples:
+  # Check a running Kong gateway against the spec
+  $ lazy validate --target kong --gateway http://localhost:8001 spec.yaml
+  # Pipe the spec in and diff against an exported kong.yml
+  $ cat spec.yaml | lazy validate --target kong --gateway ./kong.yml -
+`;
+    verifyExamples = `
+Examples:
+  # Confirm the gateway actually loaded what we emitted
+  $ lazy verify --target kong --gateway http://localhost:8001 spec.yaml
+  # Read the spec from stdin
+  $ cat spec.yaml | lazy verify --target kong --gateway http://localhost:8001 -
+`;
+    reportExamples = `
+Examples:
+  # OWASP API Top 10 coverage report
+  $ lazy report --owasp spec.yaml
+  # Read the spec from stdin
+  $ cat spec.yaml | lazy report --owasp -
+`;
+    diffExamples = `
+Examples:
+  # Diff generated Kong config across two spec versions
+  $ lazy diff --target kong old.yaml new.yaml
+  # Read the new spec from stdin (only one side may be -)
+  $ cat new.yaml | lazy diff --target kong old.yaml -
+Exit code: 0 when the two specs produce identical config, 1 when they differ
+(git diff --exit-code style).
+`;
+  }
+});
+// src/bin/lazy.ts
+var lazy_exports = {};
+import { readFileSync as readFileSync6 } from "node:fs";
+import { basename as basename2, dirname as dirname5, join as join14 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { Command as Command2 } from "commander";
+function verbosity() {
+  const opts = program.opts();
+  if (opts.quiet) return "quiet";
+  if (opts.verbose) return "verbose";
+  return "normal";
+}
 function resolveVersion() {
-  const here = dirname4(fileURLToPath2(import.meta.url));
+  const here = dirname5(fileURLToPath3(import.meta.url));
   for (const rel of ["../package.json", "../../package.json"]) {
     try {
-      const v = JSON.parse(readFileSync4(join12(here, rel), "utf8")).version;
+      const v = JSON.parse(readFileSync6(join14(here, rel), "utf8")).version;
       if (typeof v === "string") return v;
     } catch {
     }
@@ -74451,12 +74991,18 @@ var init_lazy = __esm({
     init_verify2();
     init_migrate();
     init_push();
-    init_byo_commands();
+    init_register_extras();
+    init_cli_io();
+    init_help_text();
     init_dist4();
     program = new Command2();
-    program.name(basename2(process.argv[1] ?? "lazy").replace(/\.(mjs|cjs|js)$/, "")).description("Compile, validate, test, and report on x-security policies in OpenAPI specs.").version(resolveVersion());
-    program.command("generate <spec>").description("Compile an annotated OpenAPI spec into target-specific gateway config.").requiredOption("--target <name>", "Target: kong|coraza|bunkerweb|openappsec|firewall").option("--out <dir>", "Output directory (default: ./writ-out/<target>)").option("--dry-run", "Print planned artifacts without writing to disk").option("--no-strict", "Allow unresolved variables (default: strict)").option("--vault", "Resolve $vault.* refs via HashiCorp Vault (uses VAULT_ADDR + VAULT_TOKEN or AppRole)").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager (uses default credential chain + AWS_REGION)").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).option("--no-with-consumers", "Kong only: emit spec-only output (omit consumers + per-plugin credentials). Consumers are emitted by default so OSS Kong gateways actually authenticate; pass this for the spec-only baseline.").option("--kong-deployment <mode>", "Kong only: standalone|behind-proxy|with-coraza|with-istio. with-coraza rewrites all service URLs to http://coraza:8080.", "standalone").option("--kong-edition <edition>", "Kong only: oss|enterprise. enterprise emits openid-connect (real JWKS+RS256) instead of HS256 jwt_secrets downgrade.", "oss").option("--kong-dbless", "Kong only: deployment runs in DB-less mode (KONG_DATABASE=off). Per-identity rate-limits fall back to policy=local with a structured warning instead of policy=cluster.", false).option("--kong-policy <mode>", "Kong only: rate-limit policy. local|cluster. Default local (safe for OSS DB-less). Pass cluster only when Kong is running in database mode (postgres/cassandra); cluster is a boot error in DB-less Kong.", "local").option("--coraza-engine <name>", "Coraza only: modsec-nginx|modsec-apache|coraza-go|coraza-spoa (default modsec-nginx).", "modsec-nginx").option("--coraza-peers <list>", 'Coraza only (coraza-spoa|coraza-go): HAProxy peer-replication for stick-tables. Format: "name1:host1:port1,name2:host2:port2". When set, emitted haproxy-stick-tables.cfg includes a `peers writ` section so counters replicate across instances.').option("--strict-fidelity", "Exit 4 (S3) if any spec field cannot be enforced by the chosen target+engine. Independent of --strict.").action(async (spec, opts) => {
+    program.name(basename2(process.argv[1] ?? "lazy").replace(/\.(mjs|cjs|js)$/, "")).description("Compile, validate, test, and report on x-security policies in OpenAPI specs.").option("--quiet", "Suppress warnings/advisories on stderr (results still print)").option("--verbose", "Print extra progress detail to stderr").version(resolveVersion()).showHelpAfterError("(add --help for usage)");
+    program.command("generate <spec>").description("Compile an annotated OpenAPI spec into target-specific gateway config. <spec> may be - to read from stdin.").requiredOption("--target <name>", "Target: kong|coraza|bunkerweb|openappsec|firewall").option("--out <dir>", "Output directory (default: ./writ-out/<target>)").option("--dry-run", "Print planned artifacts without writing to disk").option("--no-strict", "Allow unresolved variables (default: strict)").option("--vault", "Resolve $vault.* refs via HashiCorp Vault (uses VAULT_ADDR + VAULT_TOKEN or AppRole)").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager (uses default credential chain + AWS_REGION)").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).option("--no-with-consumers", "Kong only: emit spec-only output (omit consumers + per-plugin credentials). Consumers are emitted by default so OSS Kong gateways actually authenticate; pass this for the spec-only baseline.").option("--kong-deployment <mode>", "Kong only: standalone|behind-proxy|with-coraza|with-istio. with-coraza rewrites all service URLs to http://coraza:8080.", "standalone").option("--kong-edition <edition>", "Kong only: oss|enterprise. enterprise emits openid-connect (real JWKS+RS256) instead of HS256 jwt_secrets downgrade.", "oss").option("--kong-dbless", "Kong only: deployment runs in DB-less mode (KONG_DATABASE=off). Per-identity rate-limits fall back to policy=local with a structured warning instead of policy=cluster.", false).option("--kong-policy <mode>", "Kong only: rate-limit policy. local|cluster. Default local (safe for OSS DB-less). Pass cluster only when Kong is running in database mode (postgres/cassandra); cluster is a boot error in DB-less Kong.", "local").option("--coraza-engine <name>", "Coraza only: modsec-nginx|modsec-apache|coraza-go|coraza-spoa (default modsec-nginx).", "modsec-nginx").option("--coraza-peers <list>", 'Coraza only (coraza-spoa|coraza-go): HAProxy peer-replication for stick-tables. Format: "name1:host1:port1,name2:host2:port2". When set, emitted haproxy-stick-tables.cfg includes a `peers writ` section so counters replicate across instances.').option("--strict-fidelity", "Exit 4 (S3) if any spec field cannot be enforced by the chosen target+engine. Independent of --strict.").addHelpText("after", generateExamples).action(async (spec, opts) => {
       try {
+        const diag = makeDiagnostics(verbosity());
+        const fromStdin = spec === "-";
+        spec = await resolveSpecArg(spec);
+        if (fromStdin) diag.info("reading spec from stdin");
         if (opts.target === "kong") {
           const dep = opts.kongDeployment;
           if (dep && !["standalone", "behind-proxy", "with-coraza", "with-istio"].includes(dep)) {
@@ -74509,9 +75055,9 @@ var init_lazy = __esm({
         }
         if (opts.strictFidelity) generateOpts.strictFidelity = true;
         const r5 = await runGenerate(spec, generateOpts);
-        for (const w of r5.warnings) process.stderr.write(`warning: ${w}
-`);
+        for (const w of r5.warnings) diag.warn(`warning: ${w}`);
         if (opts.dryRun) {
+          diag.info(`generated ${r5.artifacts.length} artifact(s) for target ${opts.target} (dry-run)`);
           process.stdout.write(`# Dry-run \u2014 ${r5.artifacts.length} artifact(s) would be written:
 `);
           for (const a5 of r5.artifacts) {
@@ -74521,6 +75067,7 @@ ${a5.content}
 `);
           }
         } else {
+          diag.info(`generated ${r5.artifactPaths.length} artifact(s) for target ${opts.target}`);
           for (const p2 of r5.artifactPaths) process.stdout.write(`${p2}
 `);
         }
@@ -74535,16 +75082,22 @@ ${a5.content}
         process.exit(1);
       }
     });
-    program.command("validate <spec>").description("Detect drift between the spec and a running/exported gateway config.").requiredOption("--target <name>", "Currently: kong").requiredOption("--gateway <urlOrPath>", "Kong admin URL (http://...) or path to exported kong.yml").option("--format <fmt>", "table|json|sarif|csv (default: table)", "table").option("--vault", "Resolve $vault.* refs via HashiCorp Vault").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).action(async (spec, opts) => {
+    program.command("validate <spec>").description("Detect drift between the spec and a running/exported gateway config. <spec> may be - to read from stdin.").requiredOption("--target <name>", "Currently: kong").requiredOption("--gateway <urlOrPath>", "Kong admin URL (http://...) or path to exported kong.yml").option("--format <fmt>", "table|json|sarif|csv (default: table)", "table").option("--timeout <ms>", "Abort network calls after <ms> milliseconds (gateway admin URL / probes)", (v) => Number(v)).option("--vault", "Resolve $vault.* refs via HashiCorp Vault").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).addHelpText("after", validateExamples).action(async (spec, opts) => {
       try {
+        const diag = makeDiagnostics(verbosity());
+        const fromStdin = spec === "-";
+        spec = await resolveSpecArg(spec);
+        if (fromStdin) diag.info("reading spec from stdin");
         const validateOpts = {
           target: opts.target,
           gateway: opts.gateway,
           format: opts.format
         };
+        if (opts.timeout !== void 0) validateOpts.timeoutMs = opts.timeout;
         if (opts.vault) validateOpts.vault = true;
         if (opts.awsSecrets) validateOpts.awsSecrets = true;
         if (opts.vaultKvVersion) validateOpts.vaultKvVersion = opts.vaultKvVersion;
+        diag.info(`querying gateway ${opts.gateway}${opts.timeout ? ` (timeout ${opts.timeout}ms)` : ""}`);
         const r5 = await runValidate(spec, validateOpts);
         process.stdout.write(r5.rendered);
         process.exit(r5.exitCode);
@@ -74554,7 +75107,7 @@ ${a5.content}
         process.exit(1);
       }
     });
-    program.command("test <spec>").description("Closed-loop test: generate config, spin up Docker, send traffic, assert.").requiredOption("--target <name>", "kong|coraza|bunkerweb|openappsec").option("--upstream-port <port>", "Local port for mock upstream (ignored with --upstream-url)", (v) => Number(v)).option("--gateway-port <port>", "Local port for gateway", (v) => Number(v)).option("--upstream-url <url>", "Test against a real upstream (e.g. http://host.docker.internal:8000) instead of the mock-upstream container").option("--dry-run", "Print the docker-compose plan without running it").option("--keep", "Leave containers running on success (debug aid)").option("--format <fmt>", "table|junit|json (default: table)", "table").option("--vault", "Resolve $vault.* refs via HashiCorp Vault").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).addHelpText("after", `
+    program.command("test <spec>").description("Closed-loop test: generate config, spin up Docker, send traffic, assert. <spec> may be - to read from stdin.").requiredOption("--target <name>", "kong|coraza|bunkerweb|openappsec").option("--upstream-port <port>", "Local port for mock upstream (ignored with --upstream-url)", (v) => Number(v)).option("--gateway-port <port>", "Local port for gateway", (v) => Number(v)).option("--upstream-url <url>", "Test against a real upstream (e.g. http://host.docker.internal:8000) instead of the mock-upstream container").option("--dry-run", "Print the docker-compose plan without running it").option("--keep", "Leave containers running on success (debug aid)").option("--format <fmt>", "table|junit|json (default: table)", "table").option("--timeout <ms>", "Abort network calls after <ms> milliseconds (gateway admin URL / probes)", (v) => Number(v)).option("--vault", "Resolve $vault.* refs via HashiCorp Vault").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).addHelpText("after", `
 Examples:
   # Mock upstream (default): brings up mendhak/http-https-echo as the backend
   $ lazy test --target kong spec.yaml
@@ -74566,10 +75119,15 @@ Examples:
   $ lazy test --target kong --upstream-url https://staging.example.com spec.yaml
 `).action(async (spec, opts) => {
       try {
+        const diag = makeDiagnostics(verbosity());
+        const fromStdin = spec === "-";
+        spec = await resolveSpecArg(spec);
+        if (fromStdin) diag.info("reading spec from stdin");
         const testOpts = {
           target: opts.target,
           format: opts.format
         };
+        if (opts.timeout !== void 0) testOpts.timeoutMs = opts.timeout;
         if (opts.upstreamPort !== void 0) testOpts.upstreamPort = opts.upstreamPort;
         if (opts.gatewayPort !== void 0) testOpts.gatewayPort = opts.gatewayPort;
         if (opts.upstreamUrl !== void 0) testOpts.upstreamUrl = opts.upstreamUrl;
@@ -74578,6 +75136,7 @@ Examples:
         if (opts.vault) testOpts.vault = true;
         if (opts.awsSecrets) testOpts.awsSecrets = true;
         if (opts.vaultKvVersion) testOpts.vaultKvVersion = opts.vaultKvVersion;
+        diag.info(`bringing up ${opts.target} gateway (upstream: ${opts.upstreamUrl ?? "mock"})`);
         const r5 = await runTest(spec, testOpts);
         process.stdout.write(r5.rendered);
         process.exit(r5.exitCode);
@@ -74587,8 +75146,12 @@ Examples:
         process.exit(1);
       }
     });
-    program.command("report <spec>").description("OWASP coverage and annotation reports.").option("--owasp", "OWASP API Top 10 coverage report (default if neither flag given)").option("--coverage", "Annotation coverage report").option("--format <fmt>", "table|json|sarif|csv|html (default: table)", "table").option("--feasible <targets>", "Comma-separated targets (e.g. kong,coraza). Downgrade Y\u2192Y*/~ for declared mitigations no listed target can enforce.").option("--strict-fidelity", "Exit 4 if --feasible would downgrade any Y to Y*/~. Requires --owasp --feasible.").option("--vault", "Resolve $vault.* refs via HashiCorp Vault").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).action(async (spec, opts) => {
+    program.command("report <spec>").description("OWASP coverage and annotation reports. <spec> may be - to read from stdin.").option("--owasp", "OWASP API Top 10 coverage report (default if neither flag given)").option("--coverage", "Annotation coverage report").option("--format <fmt>", "table|json|sarif|csv|html (default: table)", "table").option("--feasible <targets>", "Comma-separated targets (e.g. kong,coraza). Downgrade Y\u2192Y*/~ for declared mitigations no listed target can enforce.").option("--strict-fidelity", "Exit 4 if --feasible would downgrade any Y to Y*/~. Requires --owasp --feasible.").option("--vault", "Resolve $vault.* refs via HashiCorp Vault").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).addHelpText("after", reportExamples).action(async (spec, opts) => {
       try {
+        const diag = makeDiagnostics(verbosity());
+        const fromStdin = spec === "-";
+        spec = await resolveSpecArg(spec);
+        if (fromStdin) diag.info("reading spec from stdin");
         const mode = opts.coverage ? "coverage" : "owasp";
         const reportOpts = {
           mode,
@@ -74612,8 +75175,12 @@ Examples:
         process.exit(1);
       }
     });
-    program.command("verify <spec>").description("Read-only post-deploy check: did the gateway actually load the artifacts we emitted?").requiredOption("--target <name>", "kong|coraza|envoy|bunkerweb|openappsec").requiredOption("--gateway <addr>", "Kong admin URL, Envoy admin URL, OR (for coraza) path to nginx error log / docker:<container> / coraza-go /debug/rules URL, OR (for bunkerweb) docker:<scheduler>+docker:<bunkerweb>, OR (for openappsec) docker:<agent>").option("--engine <name>", "Coraza engine: modsec-nginx|coraza-go|coraza-spoa (default modsec-nginx)").option("--format <fmt>", "table|json|sarif (default table)", "table").option("--threshold <pct>", "Minimum load-coverage % to consider PASS (default 90)", (v) => Number(v)).action(async (spec, opts) => {
+    program.command("verify <spec>").description("Read-only post-deploy check: did the gateway actually load the artifacts we emitted? <spec> may be - to read from stdin.").requiredOption("--target <name>", "kong|coraza|envoy|bunkerweb|openappsec").requiredOption("--gateway <addr>", "Kong admin URL, Envoy admin URL, OR (for coraza) path to nginx error log / docker:<container> / coraza-go /debug/rules URL, OR (for bunkerweb) docker:<scheduler>+docker:<bunkerweb>, OR (for openappsec) docker:<agent>").option("--engine <name>", "Coraza engine: modsec-nginx|coraza-go|coraza-spoa (default modsec-nginx)").option("--format <fmt>", "table|json|sarif (default table)", "table").option("--threshold <pct>", "Minimum load-coverage % to consider PASS (default 90)", (v) => Number(v)).option("--timeout <ms>", "Abort network calls after <ms> milliseconds (gateway admin URL / probes)", (v) => Number(v)).addHelpText("after", verifyExamples).action(async (spec, opts) => {
       try {
+        const diag = makeDiagnostics(verbosity());
+        const fromStdin = spec === "-";
+        spec = await resolveSpecArg(spec);
+        if (fromStdin) diag.info("reading spec from stdin");
         const verifyOpts = {
           target: opts.target,
           gateway: opts.gateway,
@@ -74621,6 +75188,8 @@ Examples:
         };
         if (opts.engine !== void 0) verifyOpts.engine = opts.engine;
         if (opts.threshold !== void 0) verifyOpts.threshold = opts.threshold;
+        if (opts.timeout !== void 0) verifyOpts.timeoutMs = opts.timeout;
+        diag.info(`querying gateway ${opts.gateway} (threshold ${opts.threshold ?? 90}%)`);
         const r5 = await runVerifyCli(spec, verifyOpts);
         process.stdout.write(r5.rendered);
         process.exit(r5.exitCode);
@@ -74630,8 +75199,16 @@ Examples:
         process.exit(1);
       }
     });
-    program.command("diff <old> <new>").description("Diff the generated target config for two spec versions.").requiredOption("--target <name>", "Target generator to use for both specs").option("--format <fmt>", "human|json (default: human)", "human").option("--vault", "Resolve $vault.* refs via HashiCorp Vault").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).action(async (oldSpec, newSpec, opts) => {
+    program.command("diff <old> <new>").description("Diff the generated target config for two spec versions. Either <old> or <new> may be - to read from stdin (not both). Exits 1 when configs differ, 0 when identical (git diff --exit-code style).").requiredOption("--target <name>", "Target generator to use for both specs").option("--format <fmt>", "human|json (default: human)", "human").option("--vault", "Resolve $vault.* refs via HashiCorp Vault").option("--aws-secrets", "Resolve $aws.* refs via AWS Secrets Manager").option("--vault-kv-version <v>", "Vault KV engine version: 1 or 2 (default 2)", (v) => v === "1" ? 1 : 2).addHelpText("after", diffExamples).action(async (oldSpec, newSpec, opts) => {
       try {
+        const diag = makeDiagnostics(verbosity());
+        if (oldSpec === "-" && newSpec === "-") {
+          process.stderr.write("diff failed: only one of <old>/<new> can be - (a single stdin stream)\n");
+          process.exit(1);
+        }
+        if (oldSpec === "-" || newSpec === "-") diag.info("reading spec from stdin");
+        oldSpec = await resolveSpecArg(oldSpec);
+        newSpec = await resolveSpecArg(newSpec);
         const diffOpts = {
           target: opts.target,
           format: opts.format
@@ -74641,7 +75218,7 @@ Examples:
         if (opts.vaultKvVersion) diffOpts.vaultKvVersion = opts.vaultKvVersion;
         const r5 = await runDiff(oldSpec, newSpec, diffOpts);
         process.stdout.write(r5.rendered);
-        process.exit(r5.modified.length + r5.added.length + r5.removed.length > 0 ? 0 : 0);
+        process.exit(r5.modified.length + r5.added.length + r5.removed.length > 0 ? 1 : 0);
       } catch (e5) {
         process.stderr.write(`diff failed: ${e5.message}
 `);
@@ -74735,7 +75312,7 @@ Examples:
         process.exit(1);
       }
     });
-    registerByoCommands(program);
+    registerExtras(program);
     program.command("push <repoDir>").description(
       "Upload the verified .writ/ policies to the Writ SaaS. Aborts if the local audit is not 100% cite-backed. Token from WRIT_API_TOKEN env only."
     ).option("--dry-run", "Assemble + validate the payload and print a summary WITHOUT sending.").action(async (repoDir, opts) => {
@@ -75392,8 +75969,8 @@ function buildForbidArrayRootPlugins(resp, ctx = {}) {
 var SS_IDEMPOTENCY_TAG = "writ-idempotency-replay-409";
 var SS_IDEMPOTENCY_CACHE_DICT = "writ_idempotency_cache";
 var SS_IDEMPOTENCY_CACHE_DICT_SIZE = "10m";
-function buildIdempotencyKeyPlugins(request7, ctx = {}) {
-  const idem = request7?.idempotencyKey;
+function buildIdempotencyKeyPlugins(request9, ctx = {}) {
+  const idem = request9?.idempotencyKey;
   if (!idem) return [];
   const ttl = durationSeconds(idem.ttl);
   if (ctx.warn) {