@kinosec/cli 0.10.0 → 0.10.2

package/dist/cli.js

@@ -5383,25 +5383,44 @@ var {
 // src/lib/errors.ts
 var import_picocolors2 = __toESM(require_picocolors(), 1);
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/errors/HTTPError.js
-var HTTPError = class extends Error {
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/KyError.js
+var KyError = class extends Error {
+  name = "KyError";
+  get isKyError() {
+    return true;
+  }
+};
+
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/HTTPError.js
+var HTTPError = class extends KyError {
+  name = "HTTPError";
   response;
   request;
   options;
+  data;
   constructor(response, request, options) {
     const code = response.status || response.status === 0 ? response.status : "";
     const title = response.statusText ?? "";
     const status = `${code} ${title}`.trim();
     const reason = status ? `status code ${status}` : "an unknown error";
     super(`Request failed with ${reason}: ${request.method} ${request.url}`);
-    this.name = "HTTPError";
     this.response = response;
     this.request = request;
     this.options = options;
   }
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/errors/NonError.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/NetworkError.js
+var NetworkError = class extends KyError {
+  name = "NetworkError";
+  request;
+  constructor(request, options) {
+    super(`Request failed due to a network error: ${request.method} ${request.url}`, options);
+    this.request = request;
+  }
+};
+
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/NonError.js
 var NonError = class extends Error {
   name = "NonError";
   value;
@@ -5420,8 +5439,8 @@ var NonError = class extends Error {
   }
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/errors/ForceRetryError.js
-var ForceRetryError = class extends Error {
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/ForceRetryError.js
+var ForceRetryError = class extends KyError {
   name = "ForceRetryError";
   customDelay;
   code;
@@ -5435,7 +5454,27 @@ var ForceRetryError = class extends Error {
   }
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/core/constants.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/SchemaValidationError.js
+var SchemaValidationError = class extends Error {
+  name = "SchemaValidationError";
+  issues;
+  constructor(issues) {
+    super("Response schema validation failed");
+    this.issues = issues;
+  }
+};
+
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/TimeoutError.js
+var TimeoutError = class extends KyError {
+  name = "TimeoutError";
+  request;
+  constructor(request) {
+    super(`Request timed out: ${request.method} ${request.url}`);
+    this.request = request;
+  }
+};
+
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/core/constants.js
 var supportsRequestStreams = (() => {
   let duplexAccessed = false;
   let hasContentType = false;
@@ -5479,7 +5518,7 @@ var responseTypes = {
   bytes: "*/*"
 };
 var maxSafeTimeout = 2147483647;
-var usualFormBoundarySize = new TextEncoder().encode("------WebKitFormBoundaryaxpyiPgbbPti10Rw").length;
+var usualFormBoundarySize = 40;
 var stop = /* @__PURE__ */ Symbol("stop");
 var RetryMarker = class {
   options;
@@ -5493,9 +5532,11 @@ var kyOptionKeys = {
   parseJson: true,
   stringifyJson: true,
   searchParams: true,
-  prefixUrl: true,
+  baseUrl: true,
+  prefix: true,
   retry: true,
   timeout: true,
+  totalTimeout: true,
   hooks: true,
   throwHttpErrors: true,
   onDownloadProgress: true,
@@ -5503,10 +5544,6 @@ var kyOptionKeys = {
   fetch: true,
   context: true
 };
-var vendorSpecificOptions = {
-  next: true
-  // Next.js cache revalidation (revalidate, tags)
-};
 var requestOptionsRegistry = {
   method: true,
   headers: true,
@@ -5524,7 +5561,8 @@ var requestOptionsRegistry = {
   duplex: true
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/body.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/body.js
+var encoder = new TextEncoder();
 var getBodySize = (body) => {
   if (!body) {
     return 0;
@@ -5533,33 +5571,22 @@ var getBodySize = (body) => {
     let size = 0;
     for (const [key, value] of body) {
       size += usualFormBoundarySize;
-      size += new TextEncoder().encode(`Content-Disposition: form-data; name="${key}"`).length;
-      size += typeof value === "string" ? new TextEncoder().encode(value).length : value.size;
+      size += encoder.encode(`Content-Disposition: form-data; name="${key}"`).byteLength;
+      size += typeof value === "string" ? encoder.encode(value).byteLength : value.size;
     }
     return size;
   }
   if (body instanceof Blob) {
     return body.size;
   }
-  if (body instanceof ArrayBuffer) {
+  if (body instanceof ArrayBuffer || ArrayBuffer.isView(body)) {
     return body.byteLength;
   }
   if (typeof body === "string") {
-    return new TextEncoder().encode(body).length;
+    return encoder.encode(body).byteLength;
   }
   if (body instanceof URLSearchParams) {
-    return new TextEncoder().encode(body.toString()).length;
-  }
-  if ("byteLength" in body) {
-    return body.byteLength;
-  }
-  if (typeof body === "object" && body !== null) {
-    try {
-      const jsonString = JSON.stringify(body);
-      return new TextEncoder().encode(jsonString).length;
-    } catch {
-      return 0;
-    }
+    return encoder.encode(body.toString()).byteLength;
   }
   return 0;
 };
@@ -5591,19 +5618,16 @@ var streamResponse = (response, onDownloadProgress) => {
   if (!response.body) {
     return response;
   }
-  if (response.status === 204) {
-    return new Response(null, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: response.headers
-    });
-  }
-  const totalBytes = Math.max(0, Number(response.headers.get("content-length")) || 0);
-  return new Response(withProgress(response.body, totalBytes, onDownloadProgress), {
+  const responseInit = {
     status: response.status,
     statusText: response.statusText,
     headers: response.headers
-  });
+  };
+  if (response.status === 204) {
+    return new Response(null, responseInit);
+  }
+  const totalBytes = Math.max(0, Number(response.headers.get("content-length")) || 0);
+  return new Response(withProgress(response.body, totalBytes, onDownloadProgress), responseInit);
 };
 var streamRequest = (request, onUploadProgress, originalBody) => {
   if (!request.body) {
@@ -5617,10 +5641,18 @@ var streamRequest = (request, onUploadProgress, originalBody) => {
   });
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/is.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/is.js
 var isObject = (value) => value !== null && typeof value === "object";
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/merge.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/merge.js
+var replaceSymbol = /* @__PURE__ */ Symbol("replaceOption");
+var getReplaceState = (value) => isObject(value) && value[replaceSymbol] === true ? {
+  isReplace: true,
+  value: value.value
+} : {
+  isReplace: false,
+  value
+};
 var validateAndMerge = (...sources) => {
   for (const source of sources) {
     if ((!isObject(source) || Array.isArray(source)) && source !== void 0) {
@@ -5642,17 +5674,55 @@ var mergeHeaders = (source1 = {}, source2 = {}) => {
   }
   return result;
 };
+var isPlainObject = (value) => {
+  if (!isObject(value) || Array.isArray(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+};
+var cloneShallow = (value) => {
+  if (value instanceof URLSearchParams) {
+    const copy = new URLSearchParams(value);
+    const deleted = value[deletedParametersSymbol];
+    if (deleted) {
+      copy[deletedParametersSymbol] = new Set(deleted);
+    }
+    return copy;
+  }
+  if (value instanceof globalThis.Headers) {
+    return new globalThis.Headers(value);
+  }
+  if (Array.isArray(value)) {
+    return [...value];
+  }
+  if (isPlainObject(value)) {
+    const copy = { ...value };
+    return copy;
+  }
+  return value;
+};
+var normalizeHeaderObject = (headers) => Object.fromEntries(Object.entries(headers).filter((entry) => entry[1] !== void 0));
+var mergeHeaderContainers = (source1, source2) => {
+  if (isPlainObject(source1) && isPlainObject(source2)) {
+    return normalizeHeaderObject({ ...source1, ...source2 });
+  }
+  return mergeHeaders(source1, source2);
+};
 function newHookValue(original, incoming, property) {
   return Object.hasOwn(incoming, property) && incoming[property] === void 0 ? [] : deepMerge(original[property] ?? [], incoming[property] ?? []);
 }
 var mergeHooks = (original = {}, incoming = {}) => ({
+  init: newHookValue(original, incoming, "init"),
   beforeRequest: newHookValue(original, incoming, "beforeRequest"),
   beforeRetry: newHookValue(original, incoming, "beforeRetry"),
-  afterResponse: newHookValue(original, incoming, "afterResponse"),
-  beforeError: newHookValue(original, incoming, "beforeError")
+  beforeError: newHookValue(original, incoming, "beforeError"),
+  afterResponse: newHookValue(original, incoming, "afterResponse")
 });
+var deletedParametersSymbol = /* @__PURE__ */ Symbol("deletedParameters");
 var appendSearchParameters = (target, source) => {
   const result = new URLSearchParams();
+  const deleted = /* @__PURE__ */ new Set();
   for (const input of [target, source]) {
     if (input === void 0) {
       continue;
@@ -5660,6 +5730,14 @@ var appendSearchParameters = (target, source) => {
     if (input instanceof URLSearchParams) {
       for (const [key, value] of input.entries()) {
         result.append(key, value);
+        deleted.delete(key);
+      }
+      const inputDeleted = input[deletedParametersSymbol];
+      if (inputDeleted) {
+        for (const key of inputDeleted) {
+          result.delete(key);
+          deleted.add(key);
+        }
       }
     } else if (Array.isArray(input)) {
       for (const pair of input) {
@@ -5667,20 +5745,29 @@ var appendSearchParameters = (target, source) => {
           throw new TypeError("Array search parameters must be provided in [[key, value], ...] format");
         }
         result.append(String(pair[0]), String(pair[1]));
+        deleted.delete(String(pair[0]));
       }
     } else if (isObject(input)) {
       for (const [key, value] of Object.entries(input)) {
-        if (value !== void 0) {
+        if (value === void 0) {
+          result.delete(key);
+          deleted.add(key);
+        } else {
           result.append(key, String(value));
+          deleted.delete(key);
         }
       }
     } else {
       const parameters = new URLSearchParams(input);
       for (const [key, value] of parameters.entries()) {
         result.append(key, value);
+        deleted.delete(key);
       }
     }
   }
+  if (deleted.size > 0) {
+    result[deletedParametersSymbol] = deleted;
+  }
   return result;
 };
 var deepMerge = (...sources) => {
@@ -5701,35 +5788,42 @@ var deepMerge = (...sources) => {
           signals2.push(value);
           continue;
         }
+        const replaceState = getReplaceState(value);
+        const { isReplace } = replaceState;
+        value = replaceState.value;
         if (key === "context") {
           if (value !== void 0 && value !== null && (!isObject(value) || Array.isArray(value))) {
             throw new TypeError("The `context` option must be an object");
           }
           returnValue = {
             ...returnValue,
-            context: value === void 0 || value === null ? {} : { ...returnValue.context, ...value }
+            context: value === void 0 || value === null ? {} : isReplace ? { ...value } : { ...returnValue.context, ...value }
           };
           continue;
         }
         if (key === "searchParams") {
           if (value === void 0 || value === null) {
             searchParameters = void 0;
+          } else if (isReplace) {
+            searchParameters = value;
           } else {
             searchParameters = searchParameters === void 0 ? value : appendSearchParameters(searchParameters, value);
           }
           continue;
         }
-        if (isObject(value) && key in returnValue) {
+        if (isObject(value) && !isReplace && key in returnValue) {
           value = deepMerge(returnValue[key], value);
         }
         returnValue = { ...returnValue, [key]: value };
       }
       if (isObject(source.hooks)) {
-        hooks = mergeHooks(hooks, source.hooks);
+        const { value: hookValue, isReplace } = getReplaceState(source.hooks);
+        hooks = isReplace ? mergeHooks({}, hookValue) : mergeHooks(hooks, hookValue);
         returnValue.hooks = hooks;
       }
       if (isObject(source.headers)) {
-        headers = mergeHeaders(headers, source.headers);
+        const { value: headerValue, isReplace } = getReplaceState(source.headers);
+        headers = isReplace ? cloneShallow(headerValue) : mergeHeaderContainers(headers, headerValue);
         returnValue.headers = headers;
       }
     }
@@ -5749,7 +5843,7 @@ var deepMerge = (...sources) => {
   return returnValue;
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/normalize.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/normalize.js
 var normalizeRequestMethod = (input) => requestMethods.includes(input) ? input.toUpperCase() : input;
 var retryMethods = ["get", "put", "head", "delete", "options", "trace"];
 var retryStatusCodes = [408, 413, 429, 500, 502, 503, 504];
@@ -5775,28 +5869,20 @@ var normalizeRetryOptions = (retry2 = {}) => {
   if (retry2.methods && !Array.isArray(retry2.methods)) {
     throw new Error("retry.methods must be an array");
   }
-  retry2.methods &&= retry2.methods.map((method) => method.toLowerCase());
   if (retry2.statusCodes && !Array.isArray(retry2.statusCodes)) {
     throw new Error("retry.statusCodes must be an array");
   }
-  const normalizedRetry = Object.fromEntries(Object.entries(retry2).filter(([, value]) => value !== void 0));
+  const normalizedRetry = Object.fromEntries(Object.entries({
+    ...retry2,
+    methods: retry2.methods?.map((method) => method.toLowerCase())
+  }).filter(([, value]) => value !== void 0));
   return {
     ...defaultRetryOptions,
     ...normalizedRetry
   };
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/errors/TimeoutError.js
-var TimeoutError = class extends Error {
-  request;
-  constructor(request) {
-    super(`Request timed out: ${request.method} ${request.url}`);
-    this.name = "TimeoutError";
-    this.request = request;
-  }
-};
-
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/timeout.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/timeout.js
 async function timeout(request, init, abortController, options) {
   return new Promise((resolve, reject) => {
     const timeoutId = setTimeout(() => {
@@ -5811,7 +5897,7 @@ async function timeout(request, init, abortController, options) {
   });
 }
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/delay.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/delay.js
 async function delay(ms, { signal }) {
   return new Promise((resolve, reject) => {
     if (signal) {
@@ -5829,14 +5915,14 @@ async function delay(ms, { signal }) {
   });
 }
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/options.js
-var findUnknownOptions = (request, options) => {
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/options.js
+var findUnknownOptions = (options) => {
   const unknownOptions = {};
   for (const key in options) {
     if (!Object.hasOwn(options, key)) {
       continue;
     }
-    if (!(key in requestOptionsRegistry) && !(key in kyOptionKeys) && (!(key in request) || key in vendorSpecificOptions)) {
+    if (!(key in requestOptionsRegistry) && !(key in kyOptionKeys)) {
       unknownOptions[key] = options[key];
     }
   }
@@ -5850,7 +5936,7 @@ var hasSearchParameters = (search) => {
     return search.length > 0;
   }
   if (search instanceof URLSearchParams) {
-    return search.size > 0;
+    return search.size > 0 || Boolean(search[deletedParametersSymbol]?.size);
   }
   if (typeof search === "object") {
     return Object.keys(search).length > 0;
@@ -5861,56 +5947,181 @@ var hasSearchParameters = (search) => {
   return Boolean(search);
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/type-guards.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/is-network-error.js
+var objectToString = Object.prototype.toString;
+var isError = (value) => objectToString.call(value) === "[object Error]";
+var errorMessages = /* @__PURE__ */ new Set([
+  "network error",
+  // Chrome
+  "NetworkError when attempting to fetch resource.",
+  // Firefox
+  "The Internet connection appears to be offline.",
+  // Safari 16
+  "Network request failed",
+  // `cross-fetch`
+  "fetch failed",
+  // Undici (Node.js)
+  "terminated",
+  // Undici (Node.js)
+  " A network error occurred.",
+  // Bun (WebKit) - leading space is intentional
+  "Network connection lost"
+  // Cloudflare Workers (fetch)
+]);
+function isRawNetworkError(error2) {
+  const isValid = error2 && isError(error2) && error2.name === "TypeError" && typeof error2.message === "string";
+  if (!isValid) {
+    return false;
+  }
+  const { message, stack } = error2;
+  if (message === "Load failed") {
+    return stack === void 0 || "__sentry_captured__" in error2;
+  }
+  if (message.startsWith("error sending request for url")) {
+    return true;
+  }
+  if (message === "Failed to fetch" || message.startsWith("Failed to fetch (") && message.endsWith(")")) {
+    return true;
+  }
+  return errorMessages.has(message);
+}
+
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/type-guards.js
+var isErrorType = (error2, cls) => error2 instanceof cls || error2?.name === cls.name;
 function isHTTPError(error2) {
-  return error2 instanceof HTTPError || error2?.name === HTTPError.name;
+  return isErrorType(error2, HTTPError);
+}
+function isNetworkError(error2) {
+  return isErrorType(error2, NetworkError);
 }
 function isTimeoutError(error2) {
-  return error2 instanceof TimeoutError || error2?.name === TimeoutError.name;
+  return isErrorType(error2, TimeoutError);
 }
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/core/Ky.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/core/Ky.js
+var maxErrorResponseBodySize = 10 * 1024 * 1024;
+var prefixUrlRenamedErrorMessage = "The `prefixUrl` option has been renamed `prefix` in v2 and enhanced to allow slashes in input. See also the new `baseUrl` option for improved flexibility with standard URL resolution: https://github.com/sindresorhus/ky#baseurl";
+var timedOutResponseData = /* @__PURE__ */ Symbol("timedOutResponseData");
+var createTextDecoder = (contentType) => {
+  const match = /;\s*charset\s*=\s*(?:"([^"]+)"|([^;,\s]+))/i.exec(contentType);
+  const charset = match?.[1] ?? match?.[2];
+  if (charset) {
+    try {
+      return new TextDecoder(charset);
+    } catch {
+    }
+  }
+  return new TextDecoder();
+};
+var invalidSchemaMessage = "The `schema` argument must follow the Standard Schema specification";
+var cloneRetryOptions = (retry2) => {
+  if (typeof retry2 !== "object") {
+    return retry2;
+  }
+  return {
+    ...retry2,
+    ...retry2.methods && { methods: [...retry2.methods] },
+    ...retry2.statusCodes && { statusCodes: [...retry2.statusCodes] },
+    ...retry2.afterStatusCodes && { afterStatusCodes: [...retry2.afterStatusCodes] }
+  };
+};
+var objectToString2 = Object.prototype.toString;
+var isRequestInstance = (value) => value instanceof globalThis.Request || objectToString2.call(value) === "[object Request]";
+var isResponseInstance = (value) => value instanceof globalThis.Response || objectToString2.call(value) === "[object Response]";
+var cloneSearchParametersForInitHook = (searchParameters) => {
+  if (Array.isArray(searchParameters)) {
+    return searchParameters.map((parameter) => [...parameter]);
+  }
+  return cloneShallow(searchParameters);
+};
+function cloneInitHookOptions(options) {
+  const clonedOptions = {
+    ...options,
+    json: cloneShallow(options.json),
+    context: cloneShallow(options.context),
+    headers: cloneShallow(options.headers),
+    searchParams: cloneSearchParametersForInitHook(options.searchParams)
+  };
+  if (options.retry !== void 0) {
+    clonedOptions.retry = cloneRetryOptions(options.retry);
+  }
+  return clonedOptions;
+}
+var validateJsonWithSchema = async (jsonValue, schema) => {
+  if (typeof schema !== "object" && typeof schema !== "function" || schema === null) {
+    throw new TypeError(invalidSchemaMessage);
+  }
+  const standardSchema = schema["~standard"];
+  if (typeof standardSchema !== "object" || standardSchema === null || typeof standardSchema.validate !== "function") {
+    throw new TypeError(invalidSchemaMessage);
+  }
+  const validationResult = await standardSchema.validate(jsonValue);
+  if (validationResult.issues) {
+    throw new SchemaValidationError(validationResult.issues);
+  }
+  return validationResult.value;
+};
 var Ky = class _Ky {
   static create(input, options) {
-    const ky2 = new _Ky(input, options);
+    const initHooks = options.hooks?.init ?? [];
+    const initHookOptions = initHooks.length > 0 ? cloneInitHookOptions(options) : options;
+    for (const hook of initHooks) {
+      hook(initHookOptions);
+    }
+    const ky2 = new _Ky(input, initHookOptions);
     const function_ = async () => {
       if (typeof ky2.#options.timeout === "number" && ky2.#options.timeout > maxSafeTimeout) {
         throw new RangeError(`The \`timeout\` option cannot be greater than ${maxSafeTimeout}`);
       }
+      if (typeof ky2.#options.totalTimeout === "number" && ky2.#options.totalTimeout > maxSafeTimeout) {
+        throw new RangeError(`The \`totalTimeout\` option cannot be greater than ${maxSafeTimeout}`);
+      }
       await Promise.resolve();
-      let response = await ky2.#fetch();
-      for (const hook of ky2.#options.hooks.afterResponse) {
-        const clonedResponse = ky2.#decorateResponse(response.clone());
-        let modifiedResponse;
-        try {
-          modifiedResponse = await hook(ky2.request, ky2.#getNormalizedOptions(), clonedResponse, { retryCount: ky2.#retryCount });
-        } catch (error2) {
-          ky2.#cancelResponseBody(clonedResponse);
-          ky2.#cancelResponseBody(response);
-          throw error2;
-        }
-        if (modifiedResponse instanceof RetryMarker) {
-          ky2.#cancelResponseBody(clonedResponse);
-          ky2.#cancelResponseBody(response);
-          throw new ForceRetryError(modifiedResponse.options);
-        }
-        const nextResponse = modifiedResponse instanceof globalThis.Response ? modifiedResponse : response;
-        if (clonedResponse !== nextResponse) {
-          ky2.#cancelResponseBody(clonedResponse);
+      const beforeRequestResponse = await ky2.#runBeforeRequestHooks();
+      let response = beforeRequestResponse ?? await ky2.#retry(async () => ky2.#fetch());
+      let responseFromHook = beforeRequestResponse !== void 0 || ky2.#consumeReturnedResponseFromBeforeRetryHook();
+      for (; ; ) {
+        if (response === void 0) {
+          return response;
+        }
+        if (isResponseInstance(response)) {
+          try {
+            response = await ky2.#runAfterResponseHooks(response);
+          } catch (error2) {
+            if (!(error2 instanceof ForceRetryError)) {
+              throw error2;
+            }
+            const retriedResponse = await ky2.#retryFromError(error2, async () => ky2.#fetch());
+            if (retriedResponse === void 0) {
+              return retriedResponse;
+            }
+            response = retriedResponse;
+            responseFromHook = ky2.#consumeReturnedResponseFromBeforeRetryHook();
+            continue;
+          }
         }
-        if (response !== nextResponse) {
-          ky2.#cancelResponseBody(response);
+        const currentResponse = response;
+        if (!currentResponse.ok && currentResponse.type !== "opaque" && (typeof ky2.#options.throwHttpErrors === "function" ? ky2.#options.throwHttpErrors(currentResponse.status) : ky2.#options.throwHttpErrors)) {
+          const httpError = new HTTPError(currentResponse, ky2.#getResponseRequest(currentResponse), ky2.#getNormalizedOptions());
+          const errorToThrow = httpError;
+          httpError.data = await ky2.#getResponseData(currentResponse);
+          if (responseFromHook) {
+            throw errorToThrow;
+          }
+          const retriedResponse = await ky2.#retryFromError(httpError, async () => ky2.#fetch());
+          if (retriedResponse === void 0) {
+            return retriedResponse;
+          }
+          response = retriedResponse;
+          responseFromHook = ky2.#consumeReturnedResponseFromBeforeRetryHook();
+          continue;
         }
-        response = nextResponse;
+        break;
       }
-      ky2.#decorateResponse(response);
-      if (!response.ok && (typeof ky2.#options.throwHttpErrors === "function" ? ky2.#options.throwHttpErrors(response.status) : ky2.#options.throwHttpErrors)) {
-        let error2 = new HTTPError(response, ky2.request, ky2.#getNormalizedOptions());
-        for (const hook of ky2.#options.hooks.beforeError) {
-          error2 = await hook(error2, { retryCount: ky2.#retryCount });
-        }
-        throw error2;
+      if (!isResponseInstance(response)) {
+        return response;
       }
+      ky2.#decorateResponse(response);
       if (ky2.#options.onDownloadProgress) {
         if (typeof ky2.#options.onDownloadProgress !== "function") {
           throw new TypeError("The `onDownloadProgress` option must be a function");
@@ -5924,32 +6135,56 @@ var Ky = class _Ky {
       }
       return response;
     };
-    const result = ky2.#retry(function_).finally(() => {
-      const originalRequest = ky2.#originalRequest;
-      ky2.#cancelBody(originalRequest?.body ?? void 0);
-      ky2.#cancelBody(ky2.request.body ?? void 0);
-    });
+    const result = (async () => {
+      try {
+        return await function_();
+      } catch (error2) {
+        if (!(error2 instanceof Error)) {
+          throw error2;
+        }
+        if (ky2.#beforeRetryHookErrors.has(error2)) {
+          throw error2;
+        }
+        let processedError = error2;
+        for (const hook of ky2.#options.hooks.beforeError) {
+          const hookResult = await hook({
+            request: ky2.request,
+            options: ky2.#getNormalizedOptions(),
+            error: processedError,
+            retryCount: ky2.#retryCount
+          });
+          if (hookResult instanceof Error) {
+            processedError = hookResult;
+          }
+        }
+        throw processedError;
+      } finally {
+        const originalRequest = ky2.#originalRequest;
+        ky2.#cancelBody(originalRequest?.body ?? void 0);
+        if (ky2.request !== originalRequest) {
+          ky2.#cancelBody(ky2.request.body ?? void 0);
+        }
+      }
+    })();
     for (const [type, mimeType] of Object.entries(responseTypes)) {
       if (type === "bytes" && typeof globalThis.Response?.prototype?.bytes !== "function") {
         continue;
       }
-      result[type] = async () => {
+      result[type] = async (schema) => {
         ky2.request.headers.set("accept", ky2.request.headers.get("accept") || mimeType);
         const response = await result;
-        if (type === "json") {
-          if (response.status === 204) {
-            return "";
-          }
-          const text = await response.text();
-          if (text === "") {
-            return "";
-          }
-          if (options.parseJson) {
-            return options.parseJson(text);
+        if (type !== "json") {
+          return response[type]();
+        }
+        const text = await response.text();
+        if (text === "") {
+          if (schema !== void 0) {
+            return validateJsonWithSchema(void 0, schema);
           }
           return JSON.parse(text);
         }
-        return response[type]();
+        const jsonValue = initHookOptions.parseJson ? await initHookOptions.parseJson(text, { request: ky2.#getResponseRequest(response), response }) : JSON.parse(text);
+        return schema === void 0 ? jsonValue : validateJsonWithSchema(jsonValue, schema);
       };
     }
     return result;
@@ -5969,44 +6204,55 @@ var Ky = class _Ky {
   #options;
   #originalRequest;
   #userProvidedAbortSignal;
+  #beforeRetryHookErrors = /* @__PURE__ */ new WeakSet();
   #cachedNormalizedOptions;
+  #startTime;
+  #returnedResponseFromBeforeRetryHook = false;
+  #responseRequests = /* @__PURE__ */ new WeakMap();
   // eslint-disable-next-line complexity
   constructor(input, options = {}) {
     this.#input = input;
+    if (Object.hasOwn(options, "prefixUrl")) {
+      throw new Error(prefixUrlRenamedErrorMessage);
+    }
     this.#options = {
       ...options,
       headers: mergeHeaders(this.#input.headers, options.headers),
-      hooks: mergeHooks({
-        beforeRequest: [],
-        beforeRetry: [],
-        beforeError: [],
-        afterResponse: []
-      }, options.hooks),
+      hooks: mergeHooks({}, options.hooks),
       method: normalizeRequestMethod(options.method ?? this.#input.method ?? "GET"),
       // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
-      prefixUrl: String(options.prefixUrl || ""),
+      prefix: String(options.prefix || ""),
       retry: normalizeRetryOptions(options.retry),
       throwHttpErrors: options.throwHttpErrors ?? true,
       timeout: options.timeout ?? 1e4,
+      totalTimeout: options.totalTimeout ?? false,
       fetch: options.fetch ?? globalThis.fetch.bind(globalThis),
       context: options.context ?? {}
     };
     if (typeof this.#input !== "string" && !(this.#input instanceof URL || this.#input instanceof globalThis.Request)) {
       throw new TypeError("`input` must be a string, URL, or Request");
     }
-    if (this.#options.prefixUrl && typeof this.#input === "string") {
-      if (this.#input.startsWith("/")) {
-        throw new Error("`input` must not begin with a slash when using `prefixUrl`");
+    if (typeof this.#input === "string") {
+      if (this.#options.prefix) {
+        const normalizedPrefix = this.#options.prefix.replace(/\/+$/, "");
+        const normalizedInput = this.#input.replace(/^\/+/, "");
+        this.#input = `${normalizedPrefix}/${normalizedInput}`;
       }
-      if (!this.#options.prefixUrl.endsWith("/")) {
-        this.#options.prefixUrl += "/";
+      if (this.#options.baseUrl) {
+        let absoluteInput;
+        try {
+          absoluteInput = new URL(this.#input);
+        } catch {
+        }
+        if (!absoluteInput) {
+          this.#input = new URL(this.#input, new Request(this.#options.baseUrl).url);
+        }
       }
-      this.#input = this.#options.prefixUrl + this.#input;
     }
     if (supportsAbortController && supportsAbortSignal) {
       this.#userProvidedAbortSignal = this.#options.signal ?? this.#input.signal;
       this.#abortController = new globalThis.AbortController();
-      this.#options.signal = this.#userProvidedAbortSignal ? AbortSignal.any([this.#userProvidedAbortSignal, this.#abortController.signal]) : this.#abortController.signal;
+      this.#options.signal = this.#createManagedSignal();
     }
     if (supportsRequestStreams) {
       this.#options.duplex = "half";
@@ -6021,23 +6267,40 @@ var Ky = class _Ky {
     }
     this.request = new globalThis.Request(this.#input, this.#options);
     if (hasSearchParameters(this.#options.searchParams)) {
-      const textSearchParams = typeof this.#options.searchParams === "string" ? this.#options.searchParams.replace(/^\?/, "") : new URLSearchParams(_Ky.#normalizeSearchParams(this.#options.searchParams)).toString();
-      const searchParams = "?" + textSearchParams;
-      const url = this.request.url.replace(/(?:\?.*?)?(?=#|$)/, searchParams);
-      this.request = new globalThis.Request(url, this.#options);
-    }
-    if (this.#options.onUploadProgress) {
-      if (typeof this.#options.onUploadProgress !== "function") {
-        throw new TypeError("The `onUploadProgress` option must be a function");
+      const url = new URL(this.request.url);
+      const deleted = this.#options.searchParams?.[deletedParametersSymbol];
+      if (deleted) {
+        for (const key of deleted) {
+          url.searchParams.delete(key);
+        }
       }
-      if (!supportsRequestStreams) {
-        throw new Error("Request streams are not supported in your environment. The `duplex` option for `Request` is not available.");
+      if (typeof this.#options.searchParams === "string") {
+        const stringSearchParameters = this.#options.searchParams.replace(/^\?/, "");
+        if (stringSearchParameters !== "") {
+          url.search = url.search ? `${url.search}&${stringSearchParameters}` : `?${stringSearchParameters}`;
+        }
+      } else {
+        const optionsSearchParameters = new URLSearchParams(_Ky.#normalizeSearchParams(this.#options.searchParams));
+        for (const [key, value] of optionsSearchParameters.entries()) {
+          url.searchParams.append(key, value);
+        }
       }
-      this.request = this.#wrapRequestWithUploadProgress(this.request, this.#options.body ?? void 0);
+      if (this.#options.searchParams && typeof this.#options.searchParams === "object" && !Array.isArray(this.#options.searchParams) && !(this.#options.searchParams instanceof URLSearchParams)) {
+        for (const [key, value] of Object.entries(this.#options.searchParams)) {
+          if (value === void 0) {
+            url.searchParams.delete(key);
+          }
+        }
+      }
+      this.request = new globalThis.Request(url, this.#options);
+    }
+    if (this.#options.onUploadProgress && typeof this.#options.onUploadProgress !== "function") {
+      throw new TypeError("The `onUploadProgress` option must be a function");
     }
+    this.#startTime = typeof this.#options.totalTimeout === "number" ? this.#getCurrentTime() : void 0;
   }
   #calculateDelay() {
-    const retryDelay = this.#options.retry.delay(this.#retryCount);
+    const retryDelay = this.#options.retry.delay(this.#retryCount + 1);
     let jitteredDelay = retryDelay;
     if (this.#options.retry.jitter === true) {
       jitteredDelay = Math.random() * retryDelay;
@@ -6047,12 +6310,10 @@ var Ky = class _Ky {
         jitteredDelay = retryDelay;
       }
     }
-    const backoffLimit = this.#options.retry.backoffLimit ?? Number.POSITIVE_INFINITY;
-    return Math.min(backoffLimit, jitteredDelay);
+    return Math.min(this.#options.retry.backoffLimit, jitteredDelay);
   }
   async #calculateRetryDelay(error2) {
-    this.#retryCount++;
-    if (this.#retryCount > this.#options.retry.limit) {
+    if (this.#retryCount >= this.#options.retry.limit) {
       throw error2;
     }
     const errorObject = error2 instanceof Error ? error2 : new NonError(error2);
@@ -6063,7 +6324,7 @@ var Ky = class _Ky {
       throw error2;
     }
     if (this.#options.retry.shouldRetry !== void 0) {
-      const result = await this.#options.retry.shouldRetry({ error: errorObject, retryCount: this.#retryCount });
+      const result = await this.#options.retry.shouldRetry({ error: errorObject, retryCount: this.#retryCount + 1 });
       if (result === false) {
         throw error2;
       }
@@ -6071,8 +6332,11 @@ var Ky = class _Ky {
         return this.#calculateDelay();
       }
     }
-    if (isTimeoutError(error2) && !this.#options.retry.retryOnTimeout) {
-      throw error2;
+    if (isTimeoutError(error2)) {
+      if (!this.#options.retry.retryOnTimeout) {
+        throw error2;
+      }
+      return this.#calculateDelay();
     }
     if (isHTTPError(error2)) {
       if (!this.#options.retry.statusCodes.includes(error2.response.status)) {
@@ -6086,21 +6350,138 @@ var Ky = class _Ky {
         } else if (after >= Date.parse("2024-01-01")) {
           after -= Date.now();
         }
-        const max = this.#options.retry.maxRetryAfter ?? after;
-        return after < max ? after : max;
+        if (!Number.isFinite(after)) {
+          return Math.min(this.#options.retry.maxRetryAfter, this.#calculateDelay());
+        }
+        after = Math.max(0, after);
+        return Math.min(this.#options.retry.maxRetryAfter, after);
       }
       if (error2.response.status === 413) {
         throw error2;
       }
+      return this.#calculateDelay();
+    }
+    if (!isNetworkError(error2)) {
+      throw error2;
     }
     return this.#calculateDelay();
   }
   #decorateResponse(response) {
+    const request = this.#getResponseRequest(response);
     if (this.#options.parseJson) {
-      response.json = async () => this.#options.parseJson(await response.text());
+      response.json = async () => {
+        const text = await response.text();
+        if (text === "") {
+          return JSON.parse(text);
+        }
+        return this.#options.parseJson(text, { request, response });
+      };
     }
     return response;
   }
+  async #getResponseData(response) {
+    const text = await this.#readResponseText(response, this.#getErrorDataTimeout());
+    if (text === timedOutResponseData) {
+      this.#throwIfTotalTimeoutExhausted();
+      return void 0;
+    }
+    if (!text) {
+      return void 0;
+    }
+    if (!this.#isJsonContentType(response.headers.get("content-type") ?? "")) {
+      return text;
+    }
+    const data = await this.#parseJson(text, response, this.#getErrorDataTimeout(), this.#getResponseRequest(response));
+    if (data === timedOutResponseData) {
+      this.#throwIfTotalTimeoutExhausted();
+      return void 0;
+    }
+    return data;
+  }
+  #getErrorDataTimeout() {
+    const errorDataTimeout = this.#options.timeout === false ? 1e4 : this.#options.timeout;
+    const remainingTotal = this.#getRemainingTotalTimeout();
+    if (remainingTotal === void 0) {
+      return errorDataTimeout;
+    }
+    if (remainingTotal <= 0) {
+      throw new TimeoutError(this.request);
+    }
+    return Math.min(errorDataTimeout, remainingTotal);
+  }
+  #isJsonContentType(contentType) {
+    const mimeType = (contentType.split(";", 1)[0] ?? "").trim().toLowerCase();
+    return /\/(?:.*[.+-])?json$/.test(mimeType);
+  }
+  async #readResponseText(response, timeoutMs) {
+    const { body } = response;
+    if (!body) {
+      try {
+        return await response.text();
+      } catch {
+        return void 0;
+      }
+    }
+    let reader;
+    try {
+      reader = body.getReader();
+    } catch {
+      return void 0;
+    }
+    const decoder = createTextDecoder(response.headers.get("content-type") ?? "");
+    const chunks = [];
+    let totalBytes = 0;
+    const readAll = (async () => {
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) {
+            break;
+          }
+          totalBytes += value.byteLength;
+          if (totalBytes > maxErrorResponseBodySize) {
+            void reader.cancel().catch(() => void 0);
+            return void 0;
+          }
+          chunks.push(decoder.decode(value, { stream: true }));
+        }
+      } catch {
+        return void 0;
+      }
+      chunks.push(decoder.decode());
+      return chunks.join("");
+    })();
+    const timeoutPromise = new Promise((resolve) => {
+      const timeoutId = setTimeout(() => {
+        resolve(timedOutResponseData);
+      }, timeoutMs);
+      void readAll.finally(() => {
+        clearTimeout(timeoutId);
+      });
+    });
+    const result = await Promise.race([readAll, timeoutPromise]);
+    if (result === timedOutResponseData) {
+      void reader.cancel().catch(() => void 0);
+    }
+    return result;
+  }
+  async #parseJson(text, response, timeoutMs, request) {
+    let timeoutId;
+    try {
+      return await Promise.race([
+        Promise.resolve().then(() => this.#options.parseJson ? this.#options.parseJson(text, { request, response }) : JSON.parse(text)),
+        new Promise((resolve) => {
+          timeoutId = setTimeout(() => {
+            resolve(timedOutResponseData);
+          }, timeoutMs);
+        })
+      ]);
+    } catch {
+      return void 0;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
   #cancelBody(body) {
     if (!body) {
       return;
@@ -6110,84 +6491,200 @@ var Ky = class _Ky {
   #cancelResponseBody(response) {
     this.#cancelBody(response.body ?? void 0);
   }
+  #createManagedSignal() {
+    return this.#userProvidedAbortSignal ? AbortSignal.any([this.#userProvidedAbortSignal, this.#abortController.signal]) : this.#abortController.signal;
+  }
+  #throwIfTotalTimeoutExhausted() {
+    const remaining = this.#getRemainingTotalTimeout();
+    if (remaining !== void 0 && remaining <= 0) {
+      throw new TimeoutError(this.request);
+    }
+  }
+  async #runBeforeRequestHooks() {
+    for (const hook of this.#options.hooks.beforeRequest) {
+      const result = await hook({
+        request: this.request,
+        options: this.#getNormalizedOptions(),
+        retryCount: 0
+      });
+      if (isRequestInstance(result)) {
+        this.#assignRequest(result);
+      } else if (isResponseInstance(result)) {
+        return result;
+      }
+    }
+    return void 0;
+  }
+  async #runAfterResponseHooks(response) {
+    const responseRequest = this.#getResponseRequest(response);
+    for (const hook of this.#options.hooks.afterResponse) {
+      const hookResponse = this.#setResponseRequest(response.clone(), responseRequest);
+      this.#decorateResponse(hookResponse);
+      let modifiedResponse;
+      try {
+        modifiedResponse = await hook({
+          request: this.request,
+          options: this.#getNormalizedOptions(),
+          response: hookResponse,
+          retryCount: this.#retryCount
+        });
+      } catch (error2) {
+        if (hookResponse !== response) {
+          this.#cancelResponseBody(hookResponse);
+        }
+        this.#cancelResponseBody(response);
+        throw error2;
+      }
+      if (modifiedResponse instanceof RetryMarker) {
+        if (hookResponse !== response) {
+          this.#cancelResponseBody(hookResponse);
+        }
+        this.#cancelResponseBody(response);
+        throw new ForceRetryError(modifiedResponse.options);
+      }
+      const nextResponse = isResponseInstance(modifiedResponse) ? this.#setResponseRequest(modifiedResponse, responseRequest) : response;
+      if (hookResponse !== response && hookResponse !== nextResponse && hookResponse.body !== nextResponse.body) {
+        this.#cancelResponseBody(hookResponse);
+      }
+      if (response !== nextResponse && response.body !== nextResponse.body) {
+        this.#cancelResponseBody(response);
+      }
+      response = nextResponse;
+    }
+    return response;
+  }
   async #retry(function_) {
     try {
       return await function_();
     } catch (error2) {
-      const ms = Math.min(await this.#calculateRetryDelay(error2), maxSafeTimeout);
-      if (this.#retryCount < 1) {
-        throw error2;
+      return this.#retryFromError(error2, function_);
+    }
+  }
+  async #retryFromError(error2, function_) {
+    this.#returnedResponseFromBeforeRetryHook = false;
+    const retryDelay = Math.min(await this.#calculateRetryDelay(error2), maxSafeTimeout);
+    const delayOptions = { signal: this.#userProvidedAbortSignal };
+    const remainingTimeout = this.#getRemainingTotalTimeout();
+    if (remainingTimeout !== void 0) {
+      if (remainingTimeout <= 0) {
+        throw new TimeoutError(this.request);
       }
-      await delay(ms, this.#userProvidedAbortSignal ? { signal: this.#userProvidedAbortSignal } : {});
-      if (error2 instanceof ForceRetryError && error2.customRequest) {
-        const managedRequest = this.#options.signal ? new globalThis.Request(error2.customRequest, { signal: this.#options.signal }) : new globalThis.Request(error2.customRequest);
-        this.#assignRequest(managedRequest);
+      if (retryDelay >= remainingTimeout) {
+        await delay(remainingTimeout, delayOptions);
+        throw new TimeoutError(this.request);
       }
-      for (const hook of this.#options.hooks.beforeRetry) {
-        const hookResult = await hook({
+    }
+    await delay(retryDelay, delayOptions);
+    this.#throwIfTotalTimeoutExhausted();
+    if (error2 instanceof ForceRetryError && error2.customRequest) {
+      const customRequest = new globalThis.Request(error2.customRequest, this.#options.signal ? { signal: this.#options.signal } : void 0);
+      this.#assignRequest(customRequest);
+    }
+    for (const hook of this.#options.hooks.beforeRetry) {
+      let hookResult;
+      try {
+        hookResult = await hook({
           request: this.request,
           options: this.#getNormalizedOptions(),
           error: error2,
-          retryCount: this.#retryCount
+          retryCount: this.#retryCount + 1
         });
-        if (hookResult instanceof globalThis.Request) {
-          this.#assignRequest(hookResult);
-          break;
-        }
-        if (hookResult instanceof globalThis.Response) {
-          return hookResult;
-        }
-        if (hookResult === stop) {
-          return;
+      } catch (hookError) {
+        if (hookError instanceof Error && hookError !== error2) {
+          this.#beforeRetryHookErrors.add(hookError);
         }
+        throw hookError;
+      }
+      if (isRequestInstance(hookResult)) {
+        this.#assignRequest(hookResult);
+        break;
+      }
+      if (isResponseInstance(hookResult)) {
+        this.#returnedResponseFromBeforeRetryHook = true;
+        this.#retryCount++;
+        return hookResult;
+      }
+      if (hookResult === stop) {
+        return;
       }
-      return this.#retry(function_);
     }
+    this.#throwIfTotalTimeoutExhausted();
+    this.#retryCount++;
+    return this.#retry(function_);
+  }
+  #consumeReturnedResponseFromBeforeRetryHook() {
+    const value = this.#returnedResponseFromBeforeRetryHook;
+    this.#returnedResponseFromBeforeRetryHook = false;
+    return value;
   }
   async #fetch() {
     if (this.#abortController?.signal.aborted) {
       this.#abortController = new globalThis.AbortController();
-      this.#options.signal = this.#userProvidedAbortSignal ? AbortSignal.any([this.#userProvidedAbortSignal, this.#abortController.signal]) : this.#abortController.signal;
+      this.#options.signal = this.#createManagedSignal();
       this.request = new globalThis.Request(this.request, { signal: this.#options.signal });
     }
-    for (const hook of this.#options.hooks.beforeRequest) {
-      const result = await hook(this.request, this.#getNormalizedOptions(), { retryCount: this.#retryCount });
-      if (result instanceof Response) {
-        return result;
-      }
-      if (result instanceof globalThis.Request) {
-        this.#assignRequest(result);
-        break;
+    const nonRequestOptions = findUnknownOptions(this.#options);
+    const retryRequest = this.#options.retry.limit > 0 ? this.request.clone() : void 0;
+    const request = this.#wrapRequestWithUploadProgress(this.request, this.#options.body ?? void 0);
+    this.#originalRequest = request;
+    if (retryRequest) {
+      this.request = retryRequest;
+    }
+    try {
+      const remainingTotal = this.#getRemainingTotalTimeout();
+      if (remainingTotal !== void 0 && remainingTotal <= 0) {
+        throw new TimeoutError(this.request);
+      }
+      const effectiveTimeout = this.#options.timeout === false ? remainingTotal : remainingTotal === void 0 ? this.#options.timeout : Math.min(this.#options.timeout, remainingTotal);
+      const response = effectiveTimeout === void 0 ? await this.#options.fetch(request, nonRequestOptions) : await timeout(request, nonRequestOptions, this.#abortController, {
+        timeout: effectiveTimeout,
+        fetch: this.#options.fetch
+      });
+      return this.#setResponseRequest(response, request);
+    } catch (error2) {
+      if (isRawNetworkError(error2)) {
+        throw new NetworkError(this.request, { cause: error2 });
       }
+      throw error2;
     }
-    const nonRequestOptions = findUnknownOptions(this.request, this.#options);
-    this.#originalRequest = this.request;
-    this.request = this.#originalRequest.clone();
-    if (this.#options.timeout === false) {
-      return this.#options.fetch(this.#originalRequest, nonRequestOptions);
+  }
+  #getRemainingTotalTimeout() {
+    if (this.#startTime === void 0) {
+      return void 0;
     }
-    return timeout(this.#originalRequest, nonRequestOptions, this.#abortController, this.#options);
+    const elapsed = this.#getCurrentTime() - this.#startTime;
+    return Math.max(0, this.#options.totalTimeout - elapsed);
+  }
+  #getCurrentTime() {
+    return globalThis.performance?.now() ?? Date.now();
   }
   #getNormalizedOptions() {
     if (!this.#cachedNormalizedOptions) {
-      const { hooks, ...normalizedOptions } = this.#options;
+      const { hooks, json, parseJson, stringifyJson, searchParams, timeout: timeout2, totalTimeout, throwHttpErrors, fetch: fetch2, ...normalizedOptions } = this.#options;
       this.#cachedNormalizedOptions = Object.freeze(normalizedOptions);
     }
     return this.#cachedNormalizedOptions;
   }
   #assignRequest(request) {
     this.#cachedNormalizedOptions = void 0;
-    this.request = this.#wrapRequestWithUploadProgress(request);
+    this.request = request;
+  }
+  #getResponseRequest(response) {
+    return this.#responseRequests.get(response) ?? this.request;
+  }
+  #setResponseRequest(response, request) {
+    this.#responseRequests.set(response, request);
+    return response;
   }
   #wrapRequestWithUploadProgress(request, originalBody) {
-    if (!this.#options.onUploadProgress || !request.body) {
+    if (!this.#options.onUploadProgress || !request.body || !supportsRequestStreams) {
       return request;
     }
     return streamRequest(request, this.#options.onUploadProgress, originalBody ?? this.#options.body ?? void 0);
   }
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/index.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/index.js
 var createInstance = (defaults) => {
   const ky2 = (input, options) => Ky.create(input, validateAndMerge(defaults, options));
   for (const method of requestMethods) {
@@ -6294,13 +6791,13 @@ var KinoSecClient = class {
   constructor(config) {
     const prefixPathname = new URL(config.apiUrl).pathname.replace(/\/?$/, "/");
     this.api = distribution_default.create({
-      prefixUrl: config.apiUrl,
+      prefix: config.apiUrl,
       headers: {
         "user-agent": config.userAgent ?? `kinosec/0.1.0 (${process.platform})`
       },
       hooks: {
         beforeRequest: [
-          (request) => {
+          ({ request }) => {
             request.headers.set("authorization", `Bearer ${config.token}`);
             const url = new URL(request.url);
             const path = url.pathname.slice(prefixPathname.length - 1);
@@ -6313,15 +6810,9 @@ var KinoSecClient = class {
           }
         ],
         beforeError: [
-          async (error2) => {
-            const { response } = error2;
-            let body;
-            try {
-              body = await response.json();
-            } catch {
-              body = null;
-            }
-            throw parseApiError(body, response.status);
+          ({ error: error2 }) => {
+            if (!isHTTPError(error2)) return error2;
+            return parseApiError(error2.data, error2.response.status);
           }
         ]
       },
@@ -6495,6 +6986,117 @@ var AuditResource = class {
     return this.api.get("v1/audit", { searchParams: buildSearchParams(params) }).json();
   }
 };
+var MULTI_LEVEL_TLDS = /* @__PURE__ */ new Set([
+  "co.uk",
+  "org.uk",
+  "ac.uk",
+  "me.uk",
+  "com.au",
+  "net.au",
+  "org.au",
+  "co.nz",
+  "net.nz",
+  "org.nz",
+  "co.jp",
+  "or.jp",
+  "ne.jp",
+  "co.kr",
+  "or.kr",
+  "co.za",
+  "org.za",
+  "web.za",
+  "co.in",
+  "net.in",
+  "org.in",
+  "co.id",
+  "or.id",
+  "com.br",
+  "net.br",
+  "org.br",
+  "com.mx",
+  "org.mx",
+  "com.ar",
+  "org.ar",
+  "com.cn",
+  "net.cn",
+  "org.cn",
+  "com.tw",
+  "org.tw",
+  "com.sg",
+  "org.sg",
+  "com.ph",
+  "org.ph",
+  "com.tr",
+  "org.tr",
+  "com.ng",
+  "org.ng"
+]);
+var PUBLIC_HOSTING_SUFFIXES = /* @__PURE__ */ new Set([
+  "github.io",
+  "gitlab.io",
+  "bitbucket.io",
+  "vercel.app",
+  "netlify.app",
+  "netlify.com",
+  "lovable.app",
+  "lovableproject.com",
+  "herokuapp.com",
+  "appspot.com",
+  "firebaseapp.com",
+  "web.app",
+  "azurewebsites.net",
+  "cloudfront.net",
+  "amazonaws.com",
+  "replit.app",
+  "repl.co",
+  "readme.io",
+  "readthedocs.io",
+  "readthedocs.org",
+  "statuspage.io",
+  "uptimerobot.com",
+  "myshopify.com",
+  "webflow.io",
+  "wixsite.com",
+  "squarespace.com",
+  "blogspot.com",
+  "tumblr.com",
+  "substack.com",
+  "medium.com",
+  "slack.com",
+  "notion.site",
+  "codesandbox.io",
+  "stackblitz.io",
+  "glitch.me",
+  "ngrok.app",
+  "ngrok.io",
+  "ngrok-free.app"
+]);
+var IPV4_RE = /^\d{1,3}(\.\d{1,3}){3}$/;
+function normalize(value) {
+  return value.replace(/:\d+$/, "").replace(/\.+$/, "").toLowerCase();
+}
+function detectAssetType(value) {
+  const host = normalize(value);
+  if (IPV4_RE.test(host) || host.includes(":")) {
+    return "ip";
+  }
+  const labels = host.split(".");
+  if (labels.length <= 1) return "domain";
+  const tld2 = labels.slice(-2).join(".");
+  const registrableLabels = MULTI_LEVEL_TLDS.has(tld2) ? 3 : 2;
+  return labels.length > registrableLabels ? "subdomain" : "domain";
+}
+function deriveParentDomain(value) {
+  const host = normalize(value);
+  if (detectAssetType(host) !== "subdomain") return null;
+  const labels = host.split(".");
+  const tld2 = labels.slice(-2).join(".");
+  const registrableLabels = MULTI_LEVEL_TLDS.has(tld2) ? 3 : 2;
+  return labels.slice(-registrableLabels).join(".");
+}
+function isPublicSuffix(value) {
+  return PUBLIC_HOSTING_SUFFIXES.has(normalize(value));
+}
 
 // src/lib/output.ts
 var import_cli_table3 = __toESM(require_cli_table3(), 1);
@@ -7446,12 +8048,8 @@ import { join as join2, dirname as dirname2 } from "path";
 // src/lib/config.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync, openSync, writeSync, closeSync, unlinkSync, constants } from "fs";
 import { join, dirname } from "path";
-import { homedir, platform } from "os";
+import { homedir } from "os";
 function getConfigDir() {
-  const p = platform();
-  if (p === "win32") {
-    return join(process.env.APPDATA ?? join(homedir(), "AppData", "Roaming"), "kinosec");
-  }
   const xdg = process.env.XDG_CONFIG_HOME;
   if (xdg) return join(xdg, "kinosec");
   return join(homedir(), ".config", "kinosec");
@@ -7472,7 +8070,7 @@ function readJsonFile(path) {
 function writeJsonFile(path, data, restrictPermissions = false) {
   ensureDir(dirname(path));
   const content = JSON.stringify(data, null, 2) + "\n";
-  if (restrictPermissions && platform() !== "win32") {
+  if (restrictPermissions) {
     const fd = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC, 384);
     writeSync(fd, content);
     closeSync(fd);
@@ -8101,7 +8699,7 @@ function isUnicodeSupported() {
   return Boolean(env2.WT_SESSION) || Boolean(env2.TERMINUS_SUBLIME) || env2.ConEmuTask === "{cmd::Cmder}" || TERM_PROGRAM === "Terminus-Sublime" || TERM_PROGRAM === "vscode" || TERM === "xterm-256color" || TERM === "alacritty" || TERM === "rxvt-unicode" || TERM === "rxvt-unicode-256color" || env2.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 
-// ../../node_modules/.pnpm/ora@9.4.0/node_modules/ora/index.js
+// ../../node_modules/.pnpm/ora@9.4.1/node_modules/ora/index.js
 import process8 from "process";
 import { stripVTControlCharacters } from "util";
 
@@ -10836,7 +11434,7 @@ var StdinDiscarder = class {
 var stdinDiscarder = new StdinDiscarder();
 var stdin_discarder_default = Object.freeze(stdinDiscarder);
 
-// ../../node_modules/.pnpm/ora@9.4.0/node_modules/ora/index.js
+// ../../node_modules/.pnpm/ora@9.4.1/node_modules/ora/index.js
 var RENDER_DEFERRAL_TIMEOUT = 200;
 var SYNCHRONIZED_OUTPUT_ENABLE = "\x1B[?2026h";
 var SYNCHRONIZED_OUTPUT_DISABLE = "\x1B[?2026l";
@@ -11215,7 +11813,7 @@ var Ora = class {
     return this;
   }
   start(text) {
-    if (text) {
+    if (text !== void 0) {
       this.text = text;
     }
     if (this.isSilent) {
@@ -11417,10 +12015,9 @@ function extractPhase(entries) {
   return null;
 }
 function printActivityLines(entries, tty3) {
-  for (let i = 0; i < entries.length; i++) {
-    const isLastEntry = i === entries.length - 1;
-    const prompt = tty3 ? import_picocolors5.default.green(">") : ">";
-    const text = tty3 ? isLastEntry ? import_picocolors5.default.green(entries[i]) : import_picocolors5.default.dim(import_picocolors5.default.green(entries[i])) : entries[i];
+  for (const entry of entries) {
+    const prompt = tty3 ? import_picocolors5.default.dim(import_picocolors5.default.green(">")) : ">";
+    const text = tty3 ? import_picocolors5.default.dim(import_picocolors5.default.green(entry)) : entry;
     console.log(`${prompt} ${text}`);
   }
 }
@@ -11447,7 +12044,7 @@ async function watchPentest(client, profileId, options) {
     spinner.text = import_picocolors5.default.green(currentPhase ? `[${currentPhase}] ${buzz}...` : `${buzz}...`);
   }
   if (!useJson && tty3) {
-    spinner = ora({ text: "Fetching pentest status...", color: "green", isEnabled: true }).start();
+    spinner = ora({ text: "Fetching pentest status...", color: "green", isEnabled: true, discardStdin: false }).start();
     cycler = createBuzzwordCycler(SCAN_EXECUTION_PHRASES, 2500, () => {
       updateSpinnerText();
     });
@@ -11462,71 +12059,134 @@ async function watchPentest(client, profileId, options) {
     process.exit(0);
   });
   const showFullDetails = await resolveShowFullDetails(client);
-  while (true) {
-    const scanDetail = await client.scans.get(profileId);
-    const totalMs = Date.now() - loopStart;
-    if (useJson) {
-      const elapsed = Math.round(totalMs / 1e3);
-      process.stdout.write(
-        JSON.stringify({ ...scanDetail, elapsed_seconds: elapsed }) + "\n"
-      );
-    } else {
-      const normalized = normalizeActivityHistory(scanDetail.activity_history);
-      const filtered = filterActivityForTier(normalized, showFullDetails);
-      if (printedCount > filtered.length) printedCount = 0;
-      const newEntries = filtered.slice(printedCount);
-      if (newEntries.length > 0) {
-        if (spinner) spinner.stop();
-        printActivityLines(newEntries, tty3);
-        printedCount += newEntries.length;
-        if (spinner) spinner = ora({ color: "green", isEnabled: true }).start();
-      }
-      currentPhase = extractPhase(filtered);
-      updateSpinnerText();
-    }
-    const terminalStatuses = ["Completed", "Failed", "Stopped"];
-    if (terminalStatuses.some((s) => scanDetail.scan_status.includes(s))) {
-      cleanup();
+  let consecutiveErrors = 0;
+  const MAX_CONSECUTIVE_ERRORS = 2;
+  let deferredExitCode = null;
+  try {
+    while (true) {
+      let scanDetail;
+      try {
+        scanDetail = await client.scans.get(profileId);
+        consecutiveErrors = 0;
+      } catch (error2) {
+        if (error2 instanceof ApiError) {
+          if (error2.status === 401 || error2.status === 403) {
+            throw error2;
+          }
+          if (error2.status === 404) {
+            if (!useJson) {
+              const icon2 = tty3 ? import_picocolors5.default.yellow(sym.warn) : sym.warn;
+              console.log(`
+${icon2} Pentest is no longer available.`);
+              console.log(`  Check status: kinosec pentest get ${profileId}`);
+            }
+            break;
+          }
+        }
+        consecutiveErrors++;
+        if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+          if (!useJson) {
+            const icon2 = tty3 ? import_picocolors5.default.red(sym.fail) : sym.fail;
+            console.log(`
+${icon2} Lost connection to pentest.`);
+            console.log(`  Check status: kinosec pentest get ${profileId}`);
+          }
+          break;
+        }
+        if (spinner) {
+          spinner.text = import_picocolors5.default.yellow("Connection lost, retrying...");
+        }
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        continue;
+      }
+      const totalMs = Date.now() - loopStart;
+      if (useJson) {
+        const elapsed = Math.round(totalMs / 1e3);
+        process.stdout.write(
+          JSON.stringify({ ...scanDetail, elapsed_seconds: elapsed }) + "\n"
+        );
+      } else {
+        const normalized = normalizeActivityHistory(scanDetail.activity_history);
+        const filtered = filterActivityForTier(normalized, showFullDetails);
+        if (printedCount > filtered.length) printedCount = 0;
+        const newEntries = filtered.slice(printedCount);
+        if (newEntries.length > 0) {
+          if (spinner) spinner.stop();
+          printActivityLines(newEntries, tty3);
+          printedCount += newEntries.length;
+          if (spinner) spinner = ora({ color: "green", isEnabled: true, discardStdin: false }).start();
+        }
+        currentPhase = extractPhase(filtered);
+        updateSpinnerText();
+      }
+      const status = scanDetail.scan_status;
+      if (status === "Running...") {
+        if (Date.now() - loopStart > timeoutMs) {
+          const secs = Math.round(timeoutMs / 1e3);
+          console.error(`
+Timeout: pentest still running after ${secs}s.`);
+          console.error(`Check status: kinosec pentest get ${profileId}`);
+          deferredExitCode = 3;
+          break;
+        }
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+        continue;
+      }
       if (useJson) break;
-      if (scanDetail.scan_status.includes("Failed")) {
+      if (status === "Completed") {
+        const totalDur = formatDuration(Date.now() - loopStart);
+        const domain = tty3 ? import_picocolors5.default.bold(scanDetail.domain_or_ip) : scanDetail.domain_or_ip;
+        const icon2 = tty3 ? import_picocolors5.default.green(sym.success) : sym.success;
+        const dur = tty3 ? import_picocolors5.default.dim(totalDur) : totalDur;
+        console.log(`
+${icon2} Pentest completed: ${domain}    ${dur}`);
+        if (showFindingsSummary) {
+          await printFindingsSummary(client, profileId, tty3);
+        }
+        const cmd = `kinosec finding list ${profileId}`;
+        const viewLabel = tty3 ? import_picocolors5.default.dim("View details:") : "View details:";
+        const viewCmd = tty3 ? import_picocolors5.default.cyan(cmd) : cmd;
+        console.log(`
+  ${viewLabel}  ${viewCmd}`);
+        console.log();
+        break;
+      }
+      if (status === "Failed") {
         const icon2 = tty3 ? import_picocolors5.default.red(sym.fail) : sym.fail;
         const reason = scanDetail.failure_reason || "unknown reason";
         console.log(`
 ${icon2} Pentest failed: ${reason}`);
-        process.exit(1);
+        deferredExitCode = 1;
+        break;
       }
-      if (scanDetail.scan_status.includes("Stopped")) {
+      if (status === "Stopping...") {
         const icon2 = tty3 ? import_picocolors5.default.yellow(sym.warn) : sym.warn;
         console.log(`
-${icon2} Pentest was cancelled.`);
+${icon2} Pentest is being stopped.`);
         break;
       }
-      const totalDur = formatDuration(Date.now() - loopStart);
-      const domain = tty3 ? import_picocolors5.default.bold(scanDetail.domain_or_ip) : scanDetail.domain_or_ip;
-      const icon = tty3 ? import_picocolors5.default.green(sym.success) : sym.success;
-      const dur = tty3 ? import_picocolors5.default.dim(totalDur) : totalDur;
-      console.log(`
-${icon} Pentest completed: ${domain}    ${dur}`);
-      if (showFindingsSummary) {
-        await printFindingsSummary(client, profileId, tty3);
+      if (status === "Not Yet Started") {
+        const icon2 = tty3 ? import_picocolors5.default.yellow(sym.warn) : sym.warn;
+        console.log(`
+${icon2} Pentest was stopped.`);
+        break;
       }
-      const cmd = `kinosec finding list ${profileId}`;
-      const viewLabel = tty3 ? import_picocolors5.default.dim("View details:") : "View details:";
-      const viewCmd = tty3 ? import_picocolors5.default.cyan(cmd) : cmd;
+      if (status === "Scheduled") {
+        const icon2 = tty3 ? import_picocolors5.default.yellow(sym.warn) : sym.warn;
+        console.log(`
+${icon2} Pentest is scheduled, not currently running.`);
+        break;
+      }
+      const icon = tty3 ? import_picocolors5.default.yellow(sym.warn) : sym.warn;
       console.log(`
-  ${viewLabel}  ${viewCmd}`);
-      console.log();
+${icon} Unexpected status: ${status}`);
       break;
     }
-    if (Date.now() - loopStart > timeoutMs) {
-      cleanup();
-      const secs = Math.round(timeoutMs / 1e3);
-      console.error(`
-Timeout: pentest still running after ${secs}s.`);
-      console.error(`Check status: kinosec pentest get ${profileId}`);
-      process.exit(3);
-    }
-    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  } finally {
+    cleanup();
+  }
+  if (deferredExitCode !== null) {
+    process.exit(deferredExitCode);
   }
 }
 async function printFindingsSummary(client, profileId, tty3) {
@@ -11763,6 +12423,15 @@ function validateScopeHosts(hosts) {
     seen.add(lower);
   }
 }
+function validateScopeHostOwnership(hosts, assetValue) {
+  const suffix = `.${assetValue.toLowerCase()}`;
+  for (const host of hosts) {
+    if (!host.toLowerCase().endsWith(suffix)) {
+      console.error(`Error: ${host} is not a subdomain of ${assetValue}.`);
+      process.exit(2);
+    }
+  }
+}
 function validateScopeFlags(options) {
   if (options.include && options.exclude) {
     console.error("Error: --include and --exclude cannot be used together. Use one or the other.");
@@ -11857,15 +12526,45 @@ Existing ${existingMode} scope:`);
   return { scope_filter: mode, scope_hosts: newHosts };
 }
 
-// src/commands/pentest.ts
-function stripProtocol(input) {
-  const match = input.match(/^https?:\/\/(.+)/i);
-  if (match) return { domain: match[1].replace(/\/+$/, ""), warned: true };
-  return { domain: input, warned: false };
-}
-function isValidDomain(value) {
-  return value.includes(".") && !/\s/.test(value);
+// src/lib/parse-target.ts
+function parseTarget(input) {
+  const warnings = [];
+  let value = input.trim();
+  const protocolMatch = value.match(/^https?:\/\/(.+)/i);
+  if (protocolMatch) {
+    value = protocolMatch[1];
+  }
+  const slashIndex = value.indexOf("/");
+  if (slashIndex !== -1) {
+    value = value.slice(0, slashIndex);
+  }
+  value = value.replace(/\.+$/, "").toLowerCase();
+  if (protocolMatch) {
+    warnings.push(`Protocol stripped from input. Using "${value}".`);
+  }
+  if (/\s/.test(value) || !value.includes(".")) {
+    throw new Error(
+      `Invalid target: "${input}". Provide a domain like example.com or an IP like 192.168.1.1.`
+    );
+  }
+  const assetType = detectAssetType(value);
+  const parentDomain = deriveParentDomain(value);
+  const isPubSuffix = isPublicSuffix(value);
+  if (isPubSuffix) {
+    warnings.push(
+      `${value} is a public hosting suffix. You probably want your specific subdomain (e.g. myapp.${value}).`
+    );
+  }
+  return {
+    hostname: value,
+    assetType,
+    parentDomain,
+    isPublicSuffix: isPubSuffix,
+    warnings
+  };
 }
+
+// src/commands/pentest.ts
 function registerPentestCommand(program3) {
   const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode", "full").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").addHelpText("after", `
 Examples:
@@ -11912,31 +12611,33 @@ Examples:
         targetDisplay = detail.domain_or_ip;
         params = { scan_profile_id: options.profile };
       } else {
-        const { domain, warned } = stripProtocol(options.target);
-        if (warned) {
-          console.error(`Warning: protocol stripped. Using "${domain}".`);
-        }
-        if (!isValidDomain(domain)) {
-          console.error(`Invalid domain format: "${domain}"`);
-          console.error("Provide a domain like delikado.org or juice.delikado.org.");
-          process.exit(2);
+        const parsed = parseTarget(options.target);
+        for (const warning2 of parsed.warnings) {
+          console.error(`Warning: ${warning2}`);
+        }
+        if (parsed.isPublicSuffix) {
+          console.error(
+            `
+  ${parsed.hostname} is a shared hosting domain. The server will likely reject this.`
+          );
         }
         let asset;
         try {
-          asset = await client.assets.lookup(domain);
+          asset = await client.assets.lookup(parsed.hostname);
         } catch (err) {
           if (err instanceof ApiError && err.status === 404) {
             asset = await client.assets.create({
-              asset_type: "domain",
-              asset_value: domain,
+              asset_type: parsed.assetType,
+              asset_value: parsed.hostname,
+              parent_domain: parsed.parentDomain,
               verification_method: "dns"
             });
-            console.error(`Asset created for ${domain}.`);
+            console.error(`Asset created for ${parsed.hostname}.`);
           } else {
             throw err;
           }
         }
-        targetDisplay = domain;
+        targetDisplay = parsed.hostname;
         const assetParams = {
           asset_id: asset.id,
           scan_mode: options.mode
@@ -11945,11 +12646,18 @@ Examples:
           assetParams.deployment_type = options.deployment;
         }
         params = assetParams;
-        if (scopeClear) {
+        if (scopeClear || options.include || options.exclude) {
           if (asset.asset_type !== "domain") {
-            console.error("Error: Scope filtering is only available for domain assets.");
+            const hint = parsed.parentDomain ? `
+  Target the parent domain instead:
+  kinosec pentest -t ${parsed.parentDomain} --${options.include ? "include" : "exclude"} ${parsed.hostname}` : "";
+            console.error(
+              `Error: Scope filtering is only available for domain assets. ${parsed.hostname} is a ${asset.asset_type}.${hint}`
+            );
             process.exit(2);
           }
+        }
+        if (scopeClear) {
           await client.assets.update(asset.id, {
             scope_filter: null,
             scope_hosts: null
@@ -11957,13 +12665,10 @@ Examples:
           console.error("Scope settings cleared. Scans will now cover all subdomains by default.");
           asset = await client.assets.get(asset.id);
         } else if (options.include || options.exclude) {
-          if (asset.asset_type !== "domain") {
-            console.error("Error: Scope filtering is only available for domain assets.");
-            process.exit(2);
-          }
           const mode = options.include ? "include" : "exclude";
           const rawHosts = parseScopeHosts(options.include ?? options.exclude);
           validateScopeHosts(rawHosts);
+          validateScopeHostOwnership(rawHosts, asset.asset_value);
           const scopeResult = await resolveScopeUpdate(asset, mode, rawHosts);
           if (!scopeResult) {
             process.exit(0);
@@ -12027,6 +12732,9 @@ ${divider}
         showFindingsSummary: true
       });
     } catch (error2) {
+      if (error2 instanceof Error && error2.message.startsWith("process.exit(")) {
+        throw error2;
+      }
       handleError(error2);
     }
   });
@@ -12531,18 +13239,24 @@ Examples:
         printJson(detail);
         return;
       }
-      printTable(
-        ["Field", "Value"],
-        [
-          ["ID", detail.id],
-          ["Value", detail.asset_value],
-          ["Type", detail.asset_type],
-          ["Status", detail.verification_status],
-          ["Parent", detail.parent_domain ?? "(none)"],
-          ["Created", detail.created_at],
-          ["Updated", detail.updated_at]
-        ]
+      const rows = [
+        ["ID", detail.id],
+        ["Value", detail.asset_value],
+        ["Type", detail.asset_type],
+        ["Status", detail.verification_status],
+        ["Parent", detail.parent_domain ?? "(none)"]
+      ];
+      if (detail.asset_type === "domain") {
+        rows.push(["Scope", detail.scope_filter ?? "all subdomains"]);
+        if (detail.scope_hosts?.length) {
+          rows.push(["Hosts", detail.scope_hosts.join(", ")]);
+        }
+      }
+      rows.push(
+        ["Created", detail.created_at],
+        ["Updated", detail.updated_at]
       );
+      printTable(["Field", "Value"], rows);
     } catch (error2) {
       handleError(error2);
     }
@@ -12555,11 +13269,18 @@ Examples:
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
+      const detected = detectAssetType(options.value);
+      if (detected !== options.type) {
+        console.error(
+          `Warning: ${options.value} looks like a ${detected}, not a ${options.type}. Continuing with your specified type.`
+        );
+      }
+      const parentDomain = options.parent ?? (options.type === "subdomain" ? deriveParentDomain(options.value) : null);
       const result = await client.assets.create({
         asset_type: options.type,
         asset_value: options.value,
         verification_method: options.verifyMethod,
-        parent_domain: options.parent ?? null
+        parent_domain: parentDomain
       });
       if (opts.json || opts.output === "json") {
         printJson(result);
@@ -12673,6 +13394,7 @@ Examples:
       const mode = options.include ? "include" : "exclude";
       const rawHosts = parseScopeHosts(options.include ?? options.exclude);
       validateScopeHosts(rawHosts);
+      validateScopeHostOwnership(rawHosts, asset2.asset_value);
       const result = await resolveScopeUpdate(asset2, mode, rawHosts);
       if (!result) return;
       await client.assets.update(asset2.id, {
@@ -13068,7 +13790,7 @@ Examples:
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.10.0", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
+program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.10.2", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
 registerAuthCommand(program2);
 registerMeCommand(program2);
 registerCreditsCommand(program2);
@@ -13077,7 +13799,7 @@ registerAssetCommand(program2);
 registerFindingCommand(program2);
 registerReportCommand(program2);
 registerTokenCommand(program2);
-program2.parseAsync(process.argv).then(() => checkForUpdate("0.10.0")).catch(handleError);
+program2.parseAsync(process.argv).then(() => checkForUpdate("0.10.2")).catch(handleError);
 /*! Bundled license information:
 
 ky/distribution/index.js: