@kinosec/cli 0.9.0 → 0.10.1

package/dist/cli.js

@@ -5383,25 +5383,44 @@ var {
 // src/lib/errors.ts
 var import_picocolors2 = __toESM(require_picocolors(), 1);
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/errors/HTTPError.js
-var HTTPError = class extends Error {
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/KyError.js
+var KyError = class extends Error {
+  name = "KyError";
+  get isKyError() {
+    return true;
+  }
+};
+
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/HTTPError.js
+var HTTPError = class extends KyError {
+  name = "HTTPError";
   response;
   request;
   options;
+  data;
   constructor(response, request, options) {
     const code = response.status || response.status === 0 ? response.status : "";
     const title = response.statusText ?? "";
     const status = `${code} ${title}`.trim();
     const reason = status ? `status code ${status}` : "an unknown error";
     super(`Request failed with ${reason}: ${request.method} ${request.url}`);
-    this.name = "HTTPError";
     this.response = response;
     this.request = request;
     this.options = options;
   }
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/errors/NonError.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/NetworkError.js
+var NetworkError = class extends KyError {
+  name = "NetworkError";
+  request;
+  constructor(request, options) {
+    super(`Request failed due to a network error: ${request.method} ${request.url}`, options);
+    this.request = request;
+  }
+};
+
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/NonError.js
 var NonError = class extends Error {
   name = "NonError";
   value;
@@ -5420,8 +5439,8 @@ var NonError = class extends Error {
   }
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/errors/ForceRetryError.js
-var ForceRetryError = class extends Error {
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/ForceRetryError.js
+var ForceRetryError = class extends KyError {
   name = "ForceRetryError";
   customDelay;
   code;
@@ -5435,7 +5454,27 @@ var ForceRetryError = class extends Error {
   }
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/core/constants.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/SchemaValidationError.js
+var SchemaValidationError = class extends Error {
+  name = "SchemaValidationError";
+  issues;
+  constructor(issues) {
+    super("Response schema validation failed");
+    this.issues = issues;
+  }
+};
+
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/errors/TimeoutError.js
+var TimeoutError = class extends KyError {
+  name = "TimeoutError";
+  request;
+  constructor(request) {
+    super(`Request timed out: ${request.method} ${request.url}`);
+    this.request = request;
+  }
+};
+
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/core/constants.js
 var supportsRequestStreams = (() => {
   let duplexAccessed = false;
   let hasContentType = false;
@@ -5479,7 +5518,7 @@ var responseTypes = {
   bytes: "*/*"
 };
 var maxSafeTimeout = 2147483647;
-var usualFormBoundarySize = new TextEncoder().encode("------WebKitFormBoundaryaxpyiPgbbPti10Rw").length;
+var usualFormBoundarySize = 40;
 var stop = /* @__PURE__ */ Symbol("stop");
 var RetryMarker = class {
   options;
@@ -5493,9 +5532,11 @@ var kyOptionKeys = {
   parseJson: true,
   stringifyJson: true,
   searchParams: true,
-  prefixUrl: true,
+  baseUrl: true,
+  prefix: true,
   retry: true,
   timeout: true,
+  totalTimeout: true,
   hooks: true,
   throwHttpErrors: true,
   onDownloadProgress: true,
@@ -5503,10 +5544,6 @@ var kyOptionKeys = {
   fetch: true,
   context: true
 };
-var vendorSpecificOptions = {
-  next: true
-  // Next.js cache revalidation (revalidate, tags)
-};
 var requestOptionsRegistry = {
   method: true,
   headers: true,
@@ -5524,7 +5561,8 @@ var requestOptionsRegistry = {
   duplex: true
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/body.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/body.js
+var encoder = new TextEncoder();
 var getBodySize = (body) => {
   if (!body) {
     return 0;
@@ -5533,33 +5571,22 @@ var getBodySize = (body) => {
     let size = 0;
     for (const [key, value] of body) {
       size += usualFormBoundarySize;
-      size += new TextEncoder().encode(`Content-Disposition: form-data; name="${key}"`).length;
-      size += typeof value === "string" ? new TextEncoder().encode(value).length : value.size;
+      size += encoder.encode(`Content-Disposition: form-data; name="${key}"`).byteLength;
+      size += typeof value === "string" ? encoder.encode(value).byteLength : value.size;
     }
     return size;
   }
   if (body instanceof Blob) {
     return body.size;
   }
-  if (body instanceof ArrayBuffer) {
+  if (body instanceof ArrayBuffer || ArrayBuffer.isView(body)) {
     return body.byteLength;
   }
   if (typeof body === "string") {
-    return new TextEncoder().encode(body).length;
+    return encoder.encode(body).byteLength;
   }
   if (body instanceof URLSearchParams) {
-    return new TextEncoder().encode(body.toString()).length;
-  }
-  if ("byteLength" in body) {
-    return body.byteLength;
-  }
-  if (typeof body === "object" && body !== null) {
-    try {
-      const jsonString = JSON.stringify(body);
-      return new TextEncoder().encode(jsonString).length;
-    } catch {
-      return 0;
-    }
+    return encoder.encode(body.toString()).byteLength;
   }
   return 0;
 };
@@ -5591,19 +5618,16 @@ var streamResponse = (response, onDownloadProgress) => {
   if (!response.body) {
     return response;
   }
-  if (response.status === 204) {
-    return new Response(null, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: response.headers
-    });
-  }
-  const totalBytes = Math.max(0, Number(response.headers.get("content-length")) || 0);
-  return new Response(withProgress(response.body, totalBytes, onDownloadProgress), {
+  const responseInit = {
     status: response.status,
     statusText: response.statusText,
     headers: response.headers
-  });
+  };
+  if (response.status === 204) {
+    return new Response(null, responseInit);
+  }
+  const totalBytes = Math.max(0, Number(response.headers.get("content-length")) || 0);
+  return new Response(withProgress(response.body, totalBytes, onDownloadProgress), responseInit);
 };
 var streamRequest = (request, onUploadProgress, originalBody) => {
   if (!request.body) {
@@ -5617,10 +5641,18 @@ var streamRequest = (request, onUploadProgress, originalBody) => {
   });
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/is.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/is.js
 var isObject = (value) => value !== null && typeof value === "object";
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/merge.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/merge.js
+var replaceSymbol = /* @__PURE__ */ Symbol("replaceOption");
+var getReplaceState = (value) => isObject(value) && value[replaceSymbol] === true ? {
+  isReplace: true,
+  value: value.value
+} : {
+  isReplace: false,
+  value
+};
 var validateAndMerge = (...sources) => {
   for (const source of sources) {
     if ((!isObject(source) || Array.isArray(source)) && source !== void 0) {
@@ -5642,17 +5674,55 @@ var mergeHeaders = (source1 = {}, source2 = {}) => {
   }
   return result;
 };
+var isPlainObject = (value) => {
+  if (!isObject(value) || Array.isArray(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+};
+var cloneShallow = (value) => {
+  if (value instanceof URLSearchParams) {
+    const copy = new URLSearchParams(value);
+    const deleted = value[deletedParametersSymbol];
+    if (deleted) {
+      copy[deletedParametersSymbol] = new Set(deleted);
+    }
+    return copy;
+  }
+  if (value instanceof globalThis.Headers) {
+    return new globalThis.Headers(value);
+  }
+  if (Array.isArray(value)) {
+    return [...value];
+  }
+  if (isPlainObject(value)) {
+    const copy = { ...value };
+    return copy;
+  }
+  return value;
+};
+var normalizeHeaderObject = (headers) => Object.fromEntries(Object.entries(headers).filter((entry) => entry[1] !== void 0));
+var mergeHeaderContainers = (source1, source2) => {
+  if (isPlainObject(source1) && isPlainObject(source2)) {
+    return normalizeHeaderObject({ ...source1, ...source2 });
+  }
+  return mergeHeaders(source1, source2);
+};
 function newHookValue(original, incoming, property) {
   return Object.hasOwn(incoming, property) && incoming[property] === void 0 ? [] : deepMerge(original[property] ?? [], incoming[property] ?? []);
 }
 var mergeHooks = (original = {}, incoming = {}) => ({
+  init: newHookValue(original, incoming, "init"),
   beforeRequest: newHookValue(original, incoming, "beforeRequest"),
   beforeRetry: newHookValue(original, incoming, "beforeRetry"),
-  afterResponse: newHookValue(original, incoming, "afterResponse"),
-  beforeError: newHookValue(original, incoming, "beforeError")
+  beforeError: newHookValue(original, incoming, "beforeError"),
+  afterResponse: newHookValue(original, incoming, "afterResponse")
 });
+var deletedParametersSymbol = /* @__PURE__ */ Symbol("deletedParameters");
 var appendSearchParameters = (target, source) => {
   const result = new URLSearchParams();
+  const deleted = /* @__PURE__ */ new Set();
   for (const input of [target, source]) {
     if (input === void 0) {
       continue;
@@ -5660,6 +5730,14 @@ var appendSearchParameters = (target, source) => {
     if (input instanceof URLSearchParams) {
       for (const [key, value] of input.entries()) {
         result.append(key, value);
+        deleted.delete(key);
+      }
+      const inputDeleted = input[deletedParametersSymbol];
+      if (inputDeleted) {
+        for (const key of inputDeleted) {
+          result.delete(key);
+          deleted.add(key);
+        }
       }
     } else if (Array.isArray(input)) {
       for (const pair of input) {
@@ -5667,20 +5745,29 @@ var appendSearchParameters = (target, source) => {
           throw new TypeError("Array search parameters must be provided in [[key, value], ...] format");
         }
         result.append(String(pair[0]), String(pair[1]));
+        deleted.delete(String(pair[0]));
       }
     } else if (isObject(input)) {
       for (const [key, value] of Object.entries(input)) {
-        if (value !== void 0) {
+        if (value === void 0) {
+          result.delete(key);
+          deleted.add(key);
+        } else {
           result.append(key, String(value));
+          deleted.delete(key);
         }
       }
     } else {
       const parameters = new URLSearchParams(input);
       for (const [key, value] of parameters.entries()) {
         result.append(key, value);
+        deleted.delete(key);
       }
     }
   }
+  if (deleted.size > 0) {
+    result[deletedParametersSymbol] = deleted;
+  }
   return result;
 };
 var deepMerge = (...sources) => {
@@ -5701,35 +5788,42 @@ var deepMerge = (...sources) => {
           signals2.push(value);
           continue;
         }
+        const replaceState = getReplaceState(value);
+        const { isReplace } = replaceState;
+        value = replaceState.value;
         if (key === "context") {
           if (value !== void 0 && value !== null && (!isObject(value) || Array.isArray(value))) {
             throw new TypeError("The `context` option must be an object");
           }
           returnValue = {
             ...returnValue,
-            context: value === void 0 || value === null ? {} : { ...returnValue.context, ...value }
+            context: value === void 0 || value === null ? {} : isReplace ? { ...value } : { ...returnValue.context, ...value }
           };
           continue;
         }
         if (key === "searchParams") {
           if (value === void 0 || value === null) {
             searchParameters = void 0;
+          } else if (isReplace) {
+            searchParameters = value;
           } else {
             searchParameters = searchParameters === void 0 ? value : appendSearchParameters(searchParameters, value);
           }
           continue;
         }
-        if (isObject(value) && key in returnValue) {
+        if (isObject(value) && !isReplace && key in returnValue) {
           value = deepMerge(returnValue[key], value);
         }
         returnValue = { ...returnValue, [key]: value };
       }
       if (isObject(source.hooks)) {
-        hooks = mergeHooks(hooks, source.hooks);
+        const { value: hookValue, isReplace } = getReplaceState(source.hooks);
+        hooks = isReplace ? mergeHooks({}, hookValue) : mergeHooks(hooks, hookValue);
         returnValue.hooks = hooks;
       }
       if (isObject(source.headers)) {
-        headers = mergeHeaders(headers, source.headers);
+        const { value: headerValue, isReplace } = getReplaceState(source.headers);
+        headers = isReplace ? cloneShallow(headerValue) : mergeHeaderContainers(headers, headerValue);
         returnValue.headers = headers;
       }
     }
@@ -5749,7 +5843,7 @@ var deepMerge = (...sources) => {
   return returnValue;
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/normalize.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/normalize.js
 var normalizeRequestMethod = (input) => requestMethods.includes(input) ? input.toUpperCase() : input;
 var retryMethods = ["get", "put", "head", "delete", "options", "trace"];
 var retryStatusCodes = [408, 413, 429, 500, 502, 503, 504];
@@ -5775,28 +5869,20 @@ var normalizeRetryOptions = (retry2 = {}) => {
   if (retry2.methods && !Array.isArray(retry2.methods)) {
     throw new Error("retry.methods must be an array");
   }
-  retry2.methods &&= retry2.methods.map((method) => method.toLowerCase());
   if (retry2.statusCodes && !Array.isArray(retry2.statusCodes)) {
     throw new Error("retry.statusCodes must be an array");
   }
-  const normalizedRetry = Object.fromEntries(Object.entries(retry2).filter(([, value]) => value !== void 0));
+  const normalizedRetry = Object.fromEntries(Object.entries({
+    ...retry2,
+    methods: retry2.methods?.map((method) => method.toLowerCase())
+  }).filter(([, value]) => value !== void 0));
   return {
     ...defaultRetryOptions,
     ...normalizedRetry
   };
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/errors/TimeoutError.js
-var TimeoutError = class extends Error {
-  request;
-  constructor(request) {
-    super(`Request timed out: ${request.method} ${request.url}`);
-    this.name = "TimeoutError";
-    this.request = request;
-  }
-};
-
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/timeout.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/timeout.js
 async function timeout(request, init, abortController, options) {
   return new Promise((resolve, reject) => {
     const timeoutId = setTimeout(() => {
@@ -5811,7 +5897,7 @@ async function timeout(request, init, abortController, options) {
   });
 }
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/delay.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/delay.js
 async function delay(ms, { signal }) {
   return new Promise((resolve, reject) => {
     if (signal) {
@@ -5829,14 +5915,14 @@ async function delay(ms, { signal }) {
   });
 }
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/options.js
-var findUnknownOptions = (request, options) => {
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/options.js
+var findUnknownOptions = (options) => {
   const unknownOptions = {};
   for (const key in options) {
     if (!Object.hasOwn(options, key)) {
       continue;
     }
-    if (!(key in requestOptionsRegistry) && !(key in kyOptionKeys) && (!(key in request) || key in vendorSpecificOptions)) {
+    if (!(key in requestOptionsRegistry) && !(key in kyOptionKeys)) {
       unknownOptions[key] = options[key];
     }
   }
@@ -5850,7 +5936,7 @@ var hasSearchParameters = (search) => {
     return search.length > 0;
   }
   if (search instanceof URLSearchParams) {
-    return search.size > 0;
+    return search.size > 0 || Boolean(search[deletedParametersSymbol]?.size);
   }
   if (typeof search === "object") {
     return Object.keys(search).length > 0;
@@ -5861,56 +5947,181 @@ var hasSearchParameters = (search) => {
   return Boolean(search);
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/type-guards.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/is-network-error.js
+var objectToString = Object.prototype.toString;
+var isError = (value) => objectToString.call(value) === "[object Error]";
+var errorMessages = /* @__PURE__ */ new Set([
+  "network error",
+  // Chrome
+  "NetworkError when attempting to fetch resource.",
+  // Firefox
+  "The Internet connection appears to be offline.",
+  // Safari 16
+  "Network request failed",
+  // `cross-fetch`
+  "fetch failed",
+  // Undici (Node.js)
+  "terminated",
+  // Undici (Node.js)
+  " A network error occurred.",
+  // Bun (WebKit) - leading space is intentional
+  "Network connection lost"
+  // Cloudflare Workers (fetch)
+]);
+function isRawNetworkError(error2) {
+  const isValid = error2 && isError(error2) && error2.name === "TypeError" && typeof error2.message === "string";
+  if (!isValid) {
+    return false;
+  }
+  const { message, stack } = error2;
+  if (message === "Load failed") {
+    return stack === void 0 || "__sentry_captured__" in error2;
+  }
+  if (message.startsWith("error sending request for url")) {
+    return true;
+  }
+  if (message === "Failed to fetch" || message.startsWith("Failed to fetch (") && message.endsWith(")")) {
+    return true;
+  }
+  return errorMessages.has(message);
+}
+
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/utils/type-guards.js
+var isErrorType = (error2, cls) => error2 instanceof cls || error2?.name === cls.name;
 function isHTTPError(error2) {
-  return error2 instanceof HTTPError || error2?.name === HTTPError.name;
+  return isErrorType(error2, HTTPError);
+}
+function isNetworkError(error2) {
+  return isErrorType(error2, NetworkError);
 }
 function isTimeoutError(error2) {
-  return error2 instanceof TimeoutError || error2?.name === TimeoutError.name;
+  return isErrorType(error2, TimeoutError);
 }
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/core/Ky.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/core/Ky.js
+var maxErrorResponseBodySize = 10 * 1024 * 1024;
+var prefixUrlRenamedErrorMessage = "The `prefixUrl` option has been renamed `prefix` in v2 and enhanced to allow slashes in input. See also the new `baseUrl` option for improved flexibility with standard URL resolution: https://github.com/sindresorhus/ky#baseurl";
+var timedOutResponseData = /* @__PURE__ */ Symbol("timedOutResponseData");
+var createTextDecoder = (contentType) => {
+  const match = /;\s*charset\s*=\s*(?:"([^"]+)"|([^;,\s]+))/i.exec(contentType);
+  const charset = match?.[1] ?? match?.[2];
+  if (charset) {
+    try {
+      return new TextDecoder(charset);
+    } catch {
+    }
+  }
+  return new TextDecoder();
+};
+var invalidSchemaMessage = "The `schema` argument must follow the Standard Schema specification";
+var cloneRetryOptions = (retry2) => {
+  if (typeof retry2 !== "object") {
+    return retry2;
+  }
+  return {
+    ...retry2,
+    ...retry2.methods && { methods: [...retry2.methods] },
+    ...retry2.statusCodes && { statusCodes: [...retry2.statusCodes] },
+    ...retry2.afterStatusCodes && { afterStatusCodes: [...retry2.afterStatusCodes] }
+  };
+};
+var objectToString2 = Object.prototype.toString;
+var isRequestInstance = (value) => value instanceof globalThis.Request || objectToString2.call(value) === "[object Request]";
+var isResponseInstance = (value) => value instanceof globalThis.Response || objectToString2.call(value) === "[object Response]";
+var cloneSearchParametersForInitHook = (searchParameters) => {
+  if (Array.isArray(searchParameters)) {
+    return searchParameters.map((parameter) => [...parameter]);
+  }
+  return cloneShallow(searchParameters);
+};
+function cloneInitHookOptions(options) {
+  const clonedOptions = {
+    ...options,
+    json: cloneShallow(options.json),
+    context: cloneShallow(options.context),
+    headers: cloneShallow(options.headers),
+    searchParams: cloneSearchParametersForInitHook(options.searchParams)
+  };
+  if (options.retry !== void 0) {
+    clonedOptions.retry = cloneRetryOptions(options.retry);
+  }
+  return clonedOptions;
+}
+var validateJsonWithSchema = async (jsonValue, schema) => {
+  if (typeof schema !== "object" && typeof schema !== "function" || schema === null) {
+    throw new TypeError(invalidSchemaMessage);
+  }
+  const standardSchema = schema["~standard"];
+  if (typeof standardSchema !== "object" || standardSchema === null || typeof standardSchema.validate !== "function") {
+    throw new TypeError(invalidSchemaMessage);
+  }
+  const validationResult = await standardSchema.validate(jsonValue);
+  if (validationResult.issues) {
+    throw new SchemaValidationError(validationResult.issues);
+  }
+  return validationResult.value;
+};
 var Ky = class _Ky {
   static create(input, options) {
-    const ky2 = new _Ky(input, options);
+    const initHooks = options.hooks?.init ?? [];
+    const initHookOptions = initHooks.length > 0 ? cloneInitHookOptions(options) : options;
+    for (const hook of initHooks) {
+      hook(initHookOptions);
+    }
+    const ky2 = new _Ky(input, initHookOptions);
     const function_ = async () => {
       if (typeof ky2.#options.timeout === "number" && ky2.#options.timeout > maxSafeTimeout) {
         throw new RangeError(`The \`timeout\` option cannot be greater than ${maxSafeTimeout}`);
       }
+      if (typeof ky2.#options.totalTimeout === "number" && ky2.#options.totalTimeout > maxSafeTimeout) {
+        throw new RangeError(`The \`totalTimeout\` option cannot be greater than ${maxSafeTimeout}`);
+      }
       await Promise.resolve();
-      let response = await ky2.#fetch();
-      for (const hook of ky2.#options.hooks.afterResponse) {
-        const clonedResponse = ky2.#decorateResponse(response.clone());
-        let modifiedResponse;
-        try {
-          modifiedResponse = await hook(ky2.request, ky2.#getNormalizedOptions(), clonedResponse, { retryCount: ky2.#retryCount });
-        } catch (error2) {
-          ky2.#cancelResponseBody(clonedResponse);
-          ky2.#cancelResponseBody(response);
-          throw error2;
-        }
-        if (modifiedResponse instanceof RetryMarker) {
-          ky2.#cancelResponseBody(clonedResponse);
-          ky2.#cancelResponseBody(response);
-          throw new ForceRetryError(modifiedResponse.options);
-        }
-        const nextResponse = modifiedResponse instanceof globalThis.Response ? modifiedResponse : response;
-        if (clonedResponse !== nextResponse) {
-          ky2.#cancelResponseBody(clonedResponse);
+      const beforeRequestResponse = await ky2.#runBeforeRequestHooks();
+      let response = beforeRequestResponse ?? await ky2.#retry(async () => ky2.#fetch());
+      let responseFromHook = beforeRequestResponse !== void 0 || ky2.#consumeReturnedResponseFromBeforeRetryHook();
+      for (; ; ) {
+        if (response === void 0) {
+          return response;
+        }
+        if (isResponseInstance(response)) {
+          try {
+            response = await ky2.#runAfterResponseHooks(response);
+          } catch (error2) {
+            if (!(error2 instanceof ForceRetryError)) {
+              throw error2;
+            }
+            const retriedResponse = await ky2.#retryFromError(error2, async () => ky2.#fetch());
+            if (retriedResponse === void 0) {
+              return retriedResponse;
+            }
+            response = retriedResponse;
+            responseFromHook = ky2.#consumeReturnedResponseFromBeforeRetryHook();
+            continue;
+          }
         }
-        if (response !== nextResponse) {
-          ky2.#cancelResponseBody(response);
+        const currentResponse = response;
+        if (!currentResponse.ok && currentResponse.type !== "opaque" && (typeof ky2.#options.throwHttpErrors === "function" ? ky2.#options.throwHttpErrors(currentResponse.status) : ky2.#options.throwHttpErrors)) {
+          const httpError = new HTTPError(currentResponse, ky2.#getResponseRequest(currentResponse), ky2.#getNormalizedOptions());
+          const errorToThrow = httpError;
+          httpError.data = await ky2.#getResponseData(currentResponse);
+          if (responseFromHook) {
+            throw errorToThrow;
+          }
+          const retriedResponse = await ky2.#retryFromError(httpError, async () => ky2.#fetch());
+          if (retriedResponse === void 0) {
+            return retriedResponse;
+          }
+          response = retriedResponse;
+          responseFromHook = ky2.#consumeReturnedResponseFromBeforeRetryHook();
+          continue;
         }
-        response = nextResponse;
+        break;
       }
-      ky2.#decorateResponse(response);
-      if (!response.ok && (typeof ky2.#options.throwHttpErrors === "function" ? ky2.#options.throwHttpErrors(response.status) : ky2.#options.throwHttpErrors)) {
-        let error2 = new HTTPError(response, ky2.request, ky2.#getNormalizedOptions());
-        for (const hook of ky2.#options.hooks.beforeError) {
-          error2 = await hook(error2, { retryCount: ky2.#retryCount });
-        }
-        throw error2;
+      if (!isResponseInstance(response)) {
+        return response;
       }
+      ky2.#decorateResponse(response);
       if (ky2.#options.onDownloadProgress) {
         if (typeof ky2.#options.onDownloadProgress !== "function") {
           throw new TypeError("The `onDownloadProgress` option must be a function");
@@ -5924,32 +6135,56 @@ var Ky = class _Ky {
       }
       return response;
     };
-    const result = ky2.#retry(function_).finally(() => {
-      const originalRequest = ky2.#originalRequest;
-      ky2.#cancelBody(originalRequest?.body ?? void 0);
-      ky2.#cancelBody(ky2.request.body ?? void 0);
-    });
+    const result = (async () => {
+      try {
+        return await function_();
+      } catch (error2) {
+        if (!(error2 instanceof Error)) {
+          throw error2;
+        }
+        if (ky2.#beforeRetryHookErrors.has(error2)) {
+          throw error2;
+        }
+        let processedError = error2;
+        for (const hook of ky2.#options.hooks.beforeError) {
+          const hookResult = await hook({
+            request: ky2.request,
+            options: ky2.#getNormalizedOptions(),
+            error: processedError,
+            retryCount: ky2.#retryCount
+          });
+          if (hookResult instanceof Error) {
+            processedError = hookResult;
+          }
+        }
+        throw processedError;
+      } finally {
+        const originalRequest = ky2.#originalRequest;
+        ky2.#cancelBody(originalRequest?.body ?? void 0);
+        if (ky2.request !== originalRequest) {
+          ky2.#cancelBody(ky2.request.body ?? void 0);
+        }
+      }
+    })();
     for (const [type, mimeType] of Object.entries(responseTypes)) {
       if (type === "bytes" && typeof globalThis.Response?.prototype?.bytes !== "function") {
         continue;
       }
-      result[type] = async () => {
+      result[type] = async (schema) => {
         ky2.request.headers.set("accept", ky2.request.headers.get("accept") || mimeType);
         const response = await result;
-        if (type === "json") {
-          if (response.status === 204) {
-            return "";
-          }
-          const text = await response.text();
-          if (text === "") {
-            return "";
-          }
-          if (options.parseJson) {
-            return options.parseJson(text);
+        if (type !== "json") {
+          return response[type]();
+        }
+        const text = await response.text();
+        if (text === "") {
+          if (schema !== void 0) {
+            return validateJsonWithSchema(void 0, schema);
           }
           return JSON.parse(text);
         }
-        return response[type]();
+        const jsonValue = initHookOptions.parseJson ? await initHookOptions.parseJson(text, { request: ky2.#getResponseRequest(response), response }) : JSON.parse(text);
+        return schema === void 0 ? jsonValue : validateJsonWithSchema(jsonValue, schema);
       };
     }
     return result;
@@ -5969,44 +6204,55 @@ var Ky = class _Ky {
   #options;
   #originalRequest;
   #userProvidedAbortSignal;
+  #beforeRetryHookErrors = /* @__PURE__ */ new WeakSet();
   #cachedNormalizedOptions;
+  #startTime;
+  #returnedResponseFromBeforeRetryHook = false;
+  #responseRequests = /* @__PURE__ */ new WeakMap();
   // eslint-disable-next-line complexity
   constructor(input, options = {}) {
     this.#input = input;
+    if (Object.hasOwn(options, "prefixUrl")) {
+      throw new Error(prefixUrlRenamedErrorMessage);
+    }
     this.#options = {
       ...options,
       headers: mergeHeaders(this.#input.headers, options.headers),
-      hooks: mergeHooks({
-        beforeRequest: [],
-        beforeRetry: [],
-        beforeError: [],
-        afterResponse: []
-      }, options.hooks),
+      hooks: mergeHooks({}, options.hooks),
       method: normalizeRequestMethod(options.method ?? this.#input.method ?? "GET"),
       // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing
-      prefixUrl: String(options.prefixUrl || ""),
+      prefix: String(options.prefix || ""),
       retry: normalizeRetryOptions(options.retry),
       throwHttpErrors: options.throwHttpErrors ?? true,
       timeout: options.timeout ?? 1e4,
+      totalTimeout: options.totalTimeout ?? false,
       fetch: options.fetch ?? globalThis.fetch.bind(globalThis),
       context: options.context ?? {}
     };
     if (typeof this.#input !== "string" && !(this.#input instanceof URL || this.#input instanceof globalThis.Request)) {
       throw new TypeError("`input` must be a string, URL, or Request");
     }
-    if (this.#options.prefixUrl && typeof this.#input === "string") {
-      if (this.#input.startsWith("/")) {
-        throw new Error("`input` must not begin with a slash when using `prefixUrl`");
+    if (typeof this.#input === "string") {
+      if (this.#options.prefix) {
+        const normalizedPrefix = this.#options.prefix.replace(/\/+$/, "");
+        const normalizedInput = this.#input.replace(/^\/+/, "");
+        this.#input = `${normalizedPrefix}/${normalizedInput}`;
       }
-      if (!this.#options.prefixUrl.endsWith("/")) {
-        this.#options.prefixUrl += "/";
+      if (this.#options.baseUrl) {
+        let absoluteInput;
+        try {
+          absoluteInput = new URL(this.#input);
+        } catch {
+        }
+        if (!absoluteInput) {
+          this.#input = new URL(this.#input, new Request(this.#options.baseUrl).url);
+        }
       }
-      this.#input = this.#options.prefixUrl + this.#input;
     }
     if (supportsAbortController && supportsAbortSignal) {
       this.#userProvidedAbortSignal = this.#options.signal ?? this.#input.signal;
       this.#abortController = new globalThis.AbortController();
-      this.#options.signal = this.#userProvidedAbortSignal ? AbortSignal.any([this.#userProvidedAbortSignal, this.#abortController.signal]) : this.#abortController.signal;
+      this.#options.signal = this.#createManagedSignal();
     }
     if (supportsRequestStreams) {
       this.#options.duplex = "half";
@@ -6021,23 +6267,40 @@ var Ky = class _Ky {
     }
     this.request = new globalThis.Request(this.#input, this.#options);
     if (hasSearchParameters(this.#options.searchParams)) {
-      const textSearchParams = typeof this.#options.searchParams === "string" ? this.#options.searchParams.replace(/^\?/, "") : new URLSearchParams(_Ky.#normalizeSearchParams(this.#options.searchParams)).toString();
-      const searchParams = "?" + textSearchParams;
-      const url = this.request.url.replace(/(?:\?.*?)?(?=#|$)/, searchParams);
-      this.request = new globalThis.Request(url, this.#options);
-    }
-    if (this.#options.onUploadProgress) {
-      if (typeof this.#options.onUploadProgress !== "function") {
-        throw new TypeError("The `onUploadProgress` option must be a function");
+      const url = new URL(this.request.url);
+      const deleted = this.#options.searchParams?.[deletedParametersSymbol];
+      if (deleted) {
+        for (const key of deleted) {
+          url.searchParams.delete(key);
+        }
+      }
+      if (typeof this.#options.searchParams === "string") {
+        const stringSearchParameters = this.#options.searchParams.replace(/^\?/, "");
+        if (stringSearchParameters !== "") {
+          url.search = url.search ? `${url.search}&${stringSearchParameters}` : `?${stringSearchParameters}`;
+        }
+      } else {
+        const optionsSearchParameters = new URLSearchParams(_Ky.#normalizeSearchParams(this.#options.searchParams));
+        for (const [key, value] of optionsSearchParameters.entries()) {
+          url.searchParams.append(key, value);
+        }
       }
-      if (!supportsRequestStreams) {
-        throw new Error("Request streams are not supported in your environment. The `duplex` option for `Request` is not available.");
+      if (this.#options.searchParams && typeof this.#options.searchParams === "object" && !Array.isArray(this.#options.searchParams) && !(this.#options.searchParams instanceof URLSearchParams)) {
+        for (const [key, value] of Object.entries(this.#options.searchParams)) {
+          if (value === void 0) {
+            url.searchParams.delete(key);
+          }
+        }
       }
-      this.request = this.#wrapRequestWithUploadProgress(this.request, this.#options.body ?? void 0);
+      this.request = new globalThis.Request(url, this.#options);
+    }
+    if (this.#options.onUploadProgress && typeof this.#options.onUploadProgress !== "function") {
+      throw new TypeError("The `onUploadProgress` option must be a function");
     }
+    this.#startTime = typeof this.#options.totalTimeout === "number" ? this.#getCurrentTime() : void 0;
   }
   #calculateDelay() {
-    const retryDelay = this.#options.retry.delay(this.#retryCount);
+    const retryDelay = this.#options.retry.delay(this.#retryCount + 1);
     let jitteredDelay = retryDelay;
     if (this.#options.retry.jitter === true) {
       jitteredDelay = Math.random() * retryDelay;
@@ -6047,12 +6310,10 @@ var Ky = class _Ky {
         jitteredDelay = retryDelay;
       }
     }
-    const backoffLimit = this.#options.retry.backoffLimit ?? Number.POSITIVE_INFINITY;
-    return Math.min(backoffLimit, jitteredDelay);
+    return Math.min(this.#options.retry.backoffLimit, jitteredDelay);
   }
   async #calculateRetryDelay(error2) {
-    this.#retryCount++;
-    if (this.#retryCount > this.#options.retry.limit) {
+    if (this.#retryCount >= this.#options.retry.limit) {
       throw error2;
     }
     const errorObject = error2 instanceof Error ? error2 : new NonError(error2);
@@ -6063,7 +6324,7 @@ var Ky = class _Ky {
       throw error2;
     }
     if (this.#options.retry.shouldRetry !== void 0) {
-      const result = await this.#options.retry.shouldRetry({ error: errorObject, retryCount: this.#retryCount });
+      const result = await this.#options.retry.shouldRetry({ error: errorObject, retryCount: this.#retryCount + 1 });
       if (result === false) {
         throw error2;
       }
@@ -6071,8 +6332,11 @@ var Ky = class _Ky {
         return this.#calculateDelay();
       }
     }
-    if (isTimeoutError(error2) && !this.#options.retry.retryOnTimeout) {
-      throw error2;
+    if (isTimeoutError(error2)) {
+      if (!this.#options.retry.retryOnTimeout) {
+        throw error2;
+      }
+      return this.#calculateDelay();
     }
     if (isHTTPError(error2)) {
       if (!this.#options.retry.statusCodes.includes(error2.response.status)) {
@@ -6086,21 +6350,138 @@ var Ky = class _Ky {
         } else if (after >= Date.parse("2024-01-01")) {
           after -= Date.now();
         }
-        const max = this.#options.retry.maxRetryAfter ?? after;
-        return after < max ? after : max;
+        if (!Number.isFinite(after)) {
+          return Math.min(this.#options.retry.maxRetryAfter, this.#calculateDelay());
+        }
+        after = Math.max(0, after);
+        return Math.min(this.#options.retry.maxRetryAfter, after);
       }
       if (error2.response.status === 413) {
         throw error2;
       }
+      return this.#calculateDelay();
+    }
+    if (!isNetworkError(error2)) {
+      throw error2;
     }
     return this.#calculateDelay();
   }
   #decorateResponse(response) {
+    const request = this.#getResponseRequest(response);
     if (this.#options.parseJson) {
-      response.json = async () => this.#options.parseJson(await response.text());
+      response.json = async () => {
+        const text = await response.text();
+        if (text === "") {
+          return JSON.parse(text);
+        }
+        return this.#options.parseJson(text, { request, response });
+      };
     }
     return response;
   }
+  async #getResponseData(response) {
+    const text = await this.#readResponseText(response, this.#getErrorDataTimeout());
+    if (text === timedOutResponseData) {
+      this.#throwIfTotalTimeoutExhausted();
+      return void 0;
+    }
+    if (!text) {
+      return void 0;
+    }
+    if (!this.#isJsonContentType(response.headers.get("content-type") ?? "")) {
+      return text;
+    }
+    const data = await this.#parseJson(text, response, this.#getErrorDataTimeout(), this.#getResponseRequest(response));
+    if (data === timedOutResponseData) {
+      this.#throwIfTotalTimeoutExhausted();
+      return void 0;
+    }
+    return data;
+  }
+  #getErrorDataTimeout() {
+    const errorDataTimeout = this.#options.timeout === false ? 1e4 : this.#options.timeout;
+    const remainingTotal = this.#getRemainingTotalTimeout();
+    if (remainingTotal === void 0) {
+      return errorDataTimeout;
+    }
+    if (remainingTotal <= 0) {
+      throw new TimeoutError(this.request);
+    }
+    return Math.min(errorDataTimeout, remainingTotal);
+  }
+  #isJsonContentType(contentType) {
+    const mimeType = (contentType.split(";", 1)[0] ?? "").trim().toLowerCase();
+    return /\/(?:.*[.+-])?json$/.test(mimeType);
+  }
+  async #readResponseText(response, timeoutMs) {
+    const { body } = response;
+    if (!body) {
+      try {
+        return await response.text();
+      } catch {
+        return void 0;
+      }
+    }
+    let reader;
+    try {
+      reader = body.getReader();
+    } catch {
+      return void 0;
+    }
+    const decoder = createTextDecoder(response.headers.get("content-type") ?? "");
+    const chunks = [];
+    let totalBytes = 0;
+    const readAll = (async () => {
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) {
+            break;
+          }
+          totalBytes += value.byteLength;
+          if (totalBytes > maxErrorResponseBodySize) {
+            void reader.cancel().catch(() => void 0);
+            return void 0;
+          }
+          chunks.push(decoder.decode(value, { stream: true }));
+        }
+      } catch {
+        return void 0;
+      }
+      chunks.push(decoder.decode());
+      return chunks.join("");
+    })();
+    const timeoutPromise = new Promise((resolve) => {
+      const timeoutId = setTimeout(() => {
+        resolve(timedOutResponseData);
+      }, timeoutMs);
+      void readAll.finally(() => {
+        clearTimeout(timeoutId);
+      });
+    });
+    const result = await Promise.race([readAll, timeoutPromise]);
+    if (result === timedOutResponseData) {
+      void reader.cancel().catch(() => void 0);
+    }
+    return result;
+  }
+  async #parseJson(text, response, timeoutMs, request) {
+    let timeoutId;
+    try {
+      return await Promise.race([
+        Promise.resolve().then(() => this.#options.parseJson ? this.#options.parseJson(text, { request, response }) : JSON.parse(text)),
+        new Promise((resolve) => {
+          timeoutId = setTimeout(() => {
+            resolve(timedOutResponseData);
+          }, timeoutMs);
+        })
+      ]);
+    } catch {
+      return void 0;
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  }
   #cancelBody(body) {
     if (!body) {
       return;
@@ -6110,84 +6491,200 @@ var Ky = class _Ky {
   #cancelResponseBody(response) {
     this.#cancelBody(response.body ?? void 0);
   }
+  #createManagedSignal() {
+    return this.#userProvidedAbortSignal ? AbortSignal.any([this.#userProvidedAbortSignal, this.#abortController.signal]) : this.#abortController.signal;
+  }
+  #throwIfTotalTimeoutExhausted() {
+    const remaining = this.#getRemainingTotalTimeout();
+    if (remaining !== void 0 && remaining <= 0) {
+      throw new TimeoutError(this.request);
+    }
+  }
+  async #runBeforeRequestHooks() {
+    for (const hook of this.#options.hooks.beforeRequest) {
+      const result = await hook({
+        request: this.request,
+        options: this.#getNormalizedOptions(),
+        retryCount: 0
+      });
+      if (isRequestInstance(result)) {
+        this.#assignRequest(result);
+      } else if (isResponseInstance(result)) {
+        return result;
+      }
+    }
+    return void 0;
+  }
+  async #runAfterResponseHooks(response) {
+    const responseRequest = this.#getResponseRequest(response);
+    for (const hook of this.#options.hooks.afterResponse) {
+      const hookResponse = this.#setResponseRequest(response.clone(), responseRequest);
+      this.#decorateResponse(hookResponse);
+      let modifiedResponse;
+      try {
+        modifiedResponse = await hook({
+          request: this.request,
+          options: this.#getNormalizedOptions(),
+          response: hookResponse,
+          retryCount: this.#retryCount
+        });
+      } catch (error2) {
+        if (hookResponse !== response) {
+          this.#cancelResponseBody(hookResponse);
+        }
+        this.#cancelResponseBody(response);
+        throw error2;
+      }
+      if (modifiedResponse instanceof RetryMarker) {
+        if (hookResponse !== response) {
+          this.#cancelResponseBody(hookResponse);
+        }
+        this.#cancelResponseBody(response);
+        throw new ForceRetryError(modifiedResponse.options);
+      }
+      const nextResponse = isResponseInstance(modifiedResponse) ? this.#setResponseRequest(modifiedResponse, responseRequest) : response;
+      if (hookResponse !== response && hookResponse !== nextResponse && hookResponse.body !== nextResponse.body) {
+        this.#cancelResponseBody(hookResponse);
+      }
+      if (response !== nextResponse && response.body !== nextResponse.body) {
+        this.#cancelResponseBody(response);
+      }
+      response = nextResponse;
+    }
+    return response;
+  }
   async #retry(function_) {
     try {
       return await function_();
     } catch (error2) {
-      const ms = Math.min(await this.#calculateRetryDelay(error2), maxSafeTimeout);
-      if (this.#retryCount < 1) {
-        throw error2;
+      return this.#retryFromError(error2, function_);
+    }
+  }
+  async #retryFromError(error2, function_) {
+    this.#returnedResponseFromBeforeRetryHook = false;
+    const retryDelay = Math.min(await this.#calculateRetryDelay(error2), maxSafeTimeout);
+    const delayOptions = { signal: this.#userProvidedAbortSignal };
+    const remainingTimeout = this.#getRemainingTotalTimeout();
+    if (remainingTimeout !== void 0) {
+      if (remainingTimeout <= 0) {
+        throw new TimeoutError(this.request);
       }
-      await delay(ms, this.#userProvidedAbortSignal ? { signal: this.#userProvidedAbortSignal } : {});
-      if (error2 instanceof ForceRetryError && error2.customRequest) {
-        const managedRequest = this.#options.signal ? new globalThis.Request(error2.customRequest, { signal: this.#options.signal }) : new globalThis.Request(error2.customRequest);
-        this.#assignRequest(managedRequest);
+      if (retryDelay >= remainingTimeout) {
+        await delay(remainingTimeout, delayOptions);
+        throw new TimeoutError(this.request);
       }
-      for (const hook of this.#options.hooks.beforeRetry) {
-        const hookResult = await hook({
+    }
+    await delay(retryDelay, delayOptions);
+    this.#throwIfTotalTimeoutExhausted();
+    if (error2 instanceof ForceRetryError && error2.customRequest) {
+      const customRequest = new globalThis.Request(error2.customRequest, this.#options.signal ? { signal: this.#options.signal } : void 0);
+      this.#assignRequest(customRequest);
+    }
+    for (const hook of this.#options.hooks.beforeRetry) {
+      let hookResult;
+      try {
+        hookResult = await hook({
           request: this.request,
           options: this.#getNormalizedOptions(),
           error: error2,
-          retryCount: this.#retryCount
+          retryCount: this.#retryCount + 1
         });
-        if (hookResult instanceof globalThis.Request) {
-          this.#assignRequest(hookResult);
-          break;
-        }
-        if (hookResult instanceof globalThis.Response) {
-          return hookResult;
-        }
-        if (hookResult === stop) {
-          return;
+      } catch (hookError) {
+        if (hookError instanceof Error && hookError !== error2) {
+          this.#beforeRetryHookErrors.add(hookError);
         }
+        throw hookError;
+      }
+      if (isRequestInstance(hookResult)) {
+        this.#assignRequest(hookResult);
+        break;
+      }
+      if (isResponseInstance(hookResult)) {
+        this.#returnedResponseFromBeforeRetryHook = true;
+        this.#retryCount++;
+        return hookResult;
+      }
+      if (hookResult === stop) {
+        return;
       }
-      return this.#retry(function_);
     }
+    this.#throwIfTotalTimeoutExhausted();
+    this.#retryCount++;
+    return this.#retry(function_);
+  }
+  #consumeReturnedResponseFromBeforeRetryHook() {
+    const value = this.#returnedResponseFromBeforeRetryHook;
+    this.#returnedResponseFromBeforeRetryHook = false;
+    return value;
   }
   async #fetch() {
     if (this.#abortController?.signal.aborted) {
       this.#abortController = new globalThis.AbortController();
-      this.#options.signal = this.#userProvidedAbortSignal ? AbortSignal.any([this.#userProvidedAbortSignal, this.#abortController.signal]) : this.#abortController.signal;
+      this.#options.signal = this.#createManagedSignal();
       this.request = new globalThis.Request(this.request, { signal: this.#options.signal });
     }
-    for (const hook of this.#options.hooks.beforeRequest) {
-      const result = await hook(this.request, this.#getNormalizedOptions(), { retryCount: this.#retryCount });
-      if (result instanceof Response) {
-        return result;
-      }
-      if (result instanceof globalThis.Request) {
-        this.#assignRequest(result);
-        break;
+    const nonRequestOptions = findUnknownOptions(this.#options);
+    const retryRequest = this.#options.retry.limit > 0 ? this.request.clone() : void 0;
+    const request = this.#wrapRequestWithUploadProgress(this.request, this.#options.body ?? void 0);
+    this.#originalRequest = request;
+    if (retryRequest) {
+      this.request = retryRequest;
+    }
+    try {
+      const remainingTotal = this.#getRemainingTotalTimeout();
+      if (remainingTotal !== void 0 && remainingTotal <= 0) {
+        throw new TimeoutError(this.request);
+      }
+      const effectiveTimeout = this.#options.timeout === false ? remainingTotal : remainingTotal === void 0 ? this.#options.timeout : Math.min(this.#options.timeout, remainingTotal);
+      const response = effectiveTimeout === void 0 ? await this.#options.fetch(request, nonRequestOptions) : await timeout(request, nonRequestOptions, this.#abortController, {
+        timeout: effectiveTimeout,
+        fetch: this.#options.fetch
+      });
+      return this.#setResponseRequest(response, request);
+    } catch (error2) {
+      if (isRawNetworkError(error2)) {
+        throw new NetworkError(this.request, { cause: error2 });
       }
+      throw error2;
     }
-    const nonRequestOptions = findUnknownOptions(this.request, this.#options);
-    this.#originalRequest = this.request;
-    this.request = this.#originalRequest.clone();
-    if (this.#options.timeout === false) {
-      return this.#options.fetch(this.#originalRequest, nonRequestOptions);
+  }
+  #getRemainingTotalTimeout() {
+    if (this.#startTime === void 0) {
+      return void 0;
     }
-    return timeout(this.#originalRequest, nonRequestOptions, this.#abortController, this.#options);
+    const elapsed = this.#getCurrentTime() - this.#startTime;
+    return Math.max(0, this.#options.totalTimeout - elapsed);
+  }
+  #getCurrentTime() {
+    return globalThis.performance?.now() ?? Date.now();
   }
   #getNormalizedOptions() {
     if (!this.#cachedNormalizedOptions) {
-      const { hooks, ...normalizedOptions } = this.#options;
+      const { hooks, json, parseJson, stringifyJson, searchParams, timeout: timeout2, totalTimeout, throwHttpErrors, fetch: fetch2, ...normalizedOptions } = this.#options;
       this.#cachedNormalizedOptions = Object.freeze(normalizedOptions);
     }
     return this.#cachedNormalizedOptions;
   }
   #assignRequest(request) {
     this.#cachedNormalizedOptions = void 0;
-    this.request = this.#wrapRequestWithUploadProgress(request);
+    this.request = request;
+  }
+  #getResponseRequest(response) {
+    return this.#responseRequests.get(response) ?? this.request;
+  }
+  #setResponseRequest(response, request) {
+    this.#responseRequests.set(response, request);
+    return response;
   }
   #wrapRequestWithUploadProgress(request, originalBody) {
-    if (!this.#options.onUploadProgress || !request.body) {
+    if (!this.#options.onUploadProgress || !request.body || !supportsRequestStreams) {
       return request;
     }
     return streamRequest(request, this.#options.onUploadProgress, originalBody ?? this.#options.body ?? void 0);
   }
 };
 
-// ../../node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/index.js
+// ../../node_modules/.pnpm/ky@2.0.2/node_modules/ky/distribution/index.js
 var createInstance = (defaults) => {
   const ky2 = (input, options) => Ky.create(input, validateAndMerge(defaults, options));
   for (const method of requestMethods) {
@@ -6294,13 +6791,13 @@ var KinoSecClient = class {
   constructor(config) {
     const prefixPathname = new URL(config.apiUrl).pathname.replace(/\/?$/, "/");
     this.api = distribution_default.create({
-      prefixUrl: config.apiUrl,
+      prefix: config.apiUrl,
       headers: {
         "user-agent": config.userAgent ?? `kinosec/0.1.0 (${process.platform})`
       },
       hooks: {
         beforeRequest: [
-          (request) => {
+          ({ request }) => {
             request.headers.set("authorization", `Bearer ${config.token}`);
             const url = new URL(request.url);
             const path = url.pathname.slice(prefixPathname.length - 1);
@@ -6313,15 +6810,9 @@ var KinoSecClient = class {
           }
         ],
         beforeError: [
-          async (error2) => {
-            const { response } = error2;
-            let body;
-            try {
-              body = await response.json();
-            } catch {
-              body = null;
-            }
-            throw parseApiError(body, response.status);
+          ({ error: error2 }) => {
+            if (!isHTTPError(error2)) return error2;
+            return parseApiError(error2.data, error2.response.status);
           }
         ]
       },
@@ -6495,6 +6986,117 @@ var AuditResource = class {
     return this.api.get("v1/audit", { searchParams: buildSearchParams(params) }).json();
   }
 };
+var MULTI_LEVEL_TLDS = /* @__PURE__ */ new Set([
+  "co.uk",
+  "org.uk",
+  "ac.uk",
+  "me.uk",
+  "com.au",
+  "net.au",
+  "org.au",
+  "co.nz",
+  "net.nz",
+  "org.nz",
+  "co.jp",
+  "or.jp",
+  "ne.jp",
+  "co.kr",
+  "or.kr",
+  "co.za",
+  "org.za",
+  "web.za",
+  "co.in",
+  "net.in",
+  "org.in",
+  "co.id",
+  "or.id",
+  "com.br",
+  "net.br",
+  "org.br",
+  "com.mx",
+  "org.mx",
+  "com.ar",
+  "org.ar",
+  "com.cn",
+  "net.cn",
+  "org.cn",
+  "com.tw",
+  "org.tw",
+  "com.sg",
+  "org.sg",
+  "com.ph",
+  "org.ph",
+  "com.tr",
+  "org.tr",
+  "com.ng",
+  "org.ng"
+]);
+var PUBLIC_HOSTING_SUFFIXES = /* @__PURE__ */ new Set([
+  "github.io",
+  "gitlab.io",
+  "bitbucket.io",
+  "vercel.app",
+  "netlify.app",
+  "netlify.com",
+  "lovable.app",
+  "lovableproject.com",
+  "herokuapp.com",
+  "appspot.com",
+  "firebaseapp.com",
+  "web.app",
+  "azurewebsites.net",
+  "cloudfront.net",
+  "amazonaws.com",
+  "replit.app",
+  "repl.co",
+  "readme.io",
+  "readthedocs.io",
+  "readthedocs.org",
+  "statuspage.io",
+  "uptimerobot.com",
+  "myshopify.com",
+  "webflow.io",
+  "wixsite.com",
+  "squarespace.com",
+  "blogspot.com",
+  "tumblr.com",
+  "substack.com",
+  "medium.com",
+  "slack.com",
+  "notion.site",
+  "codesandbox.io",
+  "stackblitz.io",
+  "glitch.me",
+  "ngrok.app",
+  "ngrok.io",
+  "ngrok-free.app"
+]);
+var IPV4_RE = /^\d{1,3}(\.\d{1,3}){3}$/;
+function normalize(value) {
+  return value.replace(/:\d+$/, "").replace(/\.+$/, "").toLowerCase();
+}
+function detectAssetType(value) {
+  const host = normalize(value);
+  if (IPV4_RE.test(host) || host.includes(":")) {
+    return "ip";
+  }
+  const labels = host.split(".");
+  if (labels.length <= 1) return "domain";
+  const tld2 = labels.slice(-2).join(".");
+  const registrableLabels = MULTI_LEVEL_TLDS.has(tld2) ? 3 : 2;
+  return labels.length > registrableLabels ? "subdomain" : "domain";
+}
+function deriveParentDomain(value) {
+  const host = normalize(value);
+  if (detectAssetType(host) !== "subdomain") return null;
+  const labels = host.split(".");
+  const tld2 = labels.slice(-2).join(".");
+  const registrableLabels = MULTI_LEVEL_TLDS.has(tld2) ? 3 : 2;
+  return labels.slice(-registrableLabels).join(".");
+}
+function isPublicSuffix(value) {
+  return PUBLIC_HOSTING_SUFFIXES.has(normalize(value));
+}
 
 // src/lib/output.ts
 var import_cli_table3 = __toESM(require_cli_table3(), 1);
@@ -7775,7 +8377,7 @@ Examples:
 }
 
 // src/commands/pentest.ts
-var import_picocolors7 = __toESM(require_picocolors(), 1);
+var import_picocolors8 = __toESM(require_picocolors(), 1);
 
 // src/lib/confirm.ts
 var import_picocolors3 = __toESM(require_picocolors(), 1);
@@ -7835,8 +8437,21 @@ ${import_picocolors3.default.dim("use of its services.")}
 
 // src/commands/schedule.ts
 var import_picocolors4 = __toESM(require_picocolors(), 1);
+
+// src/lib/validate-mode.ts
+function validateScanMode(mode) {
+  if (mode === "quick") {
+    console.error("Quick mode is temporarily unavailable. Please use --mode full (the default).");
+    process.exit(2);
+  }
+  if (mode !== "full") {
+    console.error(`Invalid mode "${mode}". Must be: full`);
+    process.exit(2);
+  }
+}
+
+// src/commands/schedule.ts
 var VALID_PATTERNS = ["once", "daily", "weekly", "biweekly", "monthly"];
-var VALID_MODES = ["quick", "full"];
 var DAY_NAMES = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
 function extractTime(scheduledAt) {
   if (!scheduledAt) return "\u2014";
@@ -7934,19 +8549,16 @@ Examples:
       handleError(error2);
     }
   });
-  schedule.command("create").description("Create a scheduled pentest").requiredOption("--asset <id>", "Asset ID to scan").requiredOption("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode: quick or full", "full").option("--time <HH:MM>", "Time of day (24h format)", "09:00").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat) for weekly/biweekly").option("--day-of-month <1-31>", "Day of month for monthly").option("--timezone <tz>", "Timezone (e.g. America/New_York)", Intl.DateTimeFormat().resolvedOptions().timeZone).addHelpText("after", `
+  schedule.command("create").description("Create a scheduled pentest").requiredOption("--asset <id>", "Asset ID to scan").requiredOption("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode (default: full)", "full").option("--time <HH:MM>", "Time of day (24h format)", "09:00").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat) for weekly/biweekly").option("--day-of-month <1-31>", "Day of month for monthly").option("--timezone <tz>", "Timezone (e.g. America/New_York)", Intl.DateTimeFormat().resolvedOptions().timeZone).addHelpText("after", `
 Examples:
   $ kinosec pentest schedule create --asset abc123 --pattern weekly --day-of-week 1 --time 09:00
-  $ kinosec pentest schedule create --asset abc123 --pattern daily --mode quick --time 14:00
+  $ kinosec pentest schedule create --asset abc123 --pattern daily --time 14:00
   $ kinosec pentest schedule create --asset abc123 --pattern monthly --day-of-month 15 --time 03:00 --timezone UTC`).action(async (options) => {
     if (!VALID_PATTERNS.includes(options.pattern)) {
       console.error(`Invalid pattern "${options.pattern}". Must be: ${VALID_PATTERNS.join(", ")}`);
       process.exit(2);
     }
-    if (!VALID_MODES.includes(options.mode)) {
-      console.error(`Invalid mode "${options.mode}". Must be: ${VALID_MODES.join(", ")}`);
-      process.exit(2);
-    }
+    validateScanMode(options.mode);
     if ((options.pattern === "weekly" || options.pattern === "biweekly") && options.dayOfWeek === void 0) {
       console.error(`--day-of-week is required for ${options.pattern} schedules.`);
       process.exit(2);
@@ -7984,14 +8596,17 @@ Manage: kinosec pentest schedule get ${s.id}`);
       handleError(error2);
     }
   });
-  schedule.command("update").description("Update a schedule").argument("<id>", "Schedule ID").option("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode: quick or full").option("--time <HH:MM>", "Time of day (24h format)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat)").option("--day-of-month <1-31>", "Day of month").option("--timezone <tz>", "Timezone").addHelpText("after", `
+  schedule.command("update").description("Update a schedule").argument("<id>", "Schedule ID").option("--pattern <pattern>", "Recurrence: once, daily, weekly, biweekly, monthly").option("--name <name>", "Schedule name").option("--mode <mode>", "Scan mode").option("--time <HH:MM>", "Time of day (24h format)").option("--day-of-week <0-6>", "Day of week (0=Sun..6=Sat)").option("--day-of-month <1-31>", "Day of month").option("--timezone <tz>", "Timezone").addHelpText("after", `
 Examples:
   $ kinosec pentest schedule update abc123 --pattern daily --time 14:00
-  $ kinosec pentest schedule update abc123 --mode quick`).action(async (id, options) => {
+  $ kinosec pentest schedule update abc123 --time 14:00`).action(async (id, options) => {
     const params = {};
     if (options.pattern) params.recurrence_pattern = options.pattern;
     if (options.name) params.name = options.name;
-    if (options.mode) params.scan_mode = options.mode;
+    if (options.mode) {
+      validateScanMode(options.mode);
+      params.scan_mode = options.mode;
+    }
     if (options.time) params.time_of_day = options.time;
     if (options.dayOfWeek !== void 0) params.day_of_week = parseInt(options.dayOfWeek, 10);
     if (options.dayOfMonth !== void 0) params.day_of_month = parseInt(options.dayOfMonth, 10);
@@ -8088,7 +8703,7 @@ function isUnicodeSupported() {
   return Boolean(env2.WT_SESSION) || Boolean(env2.TERMINUS_SUBLIME) || env2.ConEmuTask === "{cmd::Cmder}" || TERM_PROGRAM === "Terminus-Sublime" || TERM_PROGRAM === "vscode" || TERM === "xterm-256color" || TERM === "alacritty" || TERM === "rxvt-unicode" || TERM === "rxvt-unicode-256color" || env2.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
 
-// ../../node_modules/.pnpm/ora@9.4.0/node_modules/ora/index.js
+// ../../node_modules/.pnpm/ora@9.4.1/node_modules/ora/index.js
 import process8 from "process";
 import { stripVTControlCharacters } from "util";
 
@@ -10823,7 +11438,7 @@ var StdinDiscarder = class {
 var stdinDiscarder = new StdinDiscarder();
 var stdin_discarder_default = Object.freeze(stdinDiscarder);
 
-// ../../node_modules/.pnpm/ora@9.4.0/node_modules/ora/index.js
+// ../../node_modules/.pnpm/ora@9.4.1/node_modules/ora/index.js
 var RENDER_DEFERRAL_TIMEOUT = 200;
 var SYNCHRONIZED_OUTPUT_ENABLE = "\x1B[?2026h";
 var SYNCHRONIZED_OUTPUT_DISABLE = "\x1B[?2026l";
@@ -11202,7 +11817,7 @@ var Ora = class {
     return this;
   }
   start(text) {
-    if (text) {
+    if (text !== void 0) {
       this.text = text;
     }
     if (this.isSilent) {
@@ -11563,105 +12178,344 @@ function printOnPremInstructions(result) {
     console.log(`  ${sym2.warn}  Token expires in 15 minutes.`);
   }
 }
-async function waitForScoutConnection(client, profileId, options) {
-  const { timeoutMs, intervalMs, useJson } = options;
-  const tty3 = isTTY();
-  const loopStart = Date.now();
-  let spinner = null;
-  if (!useJson && tty3) {
-    spinner = ora({
-      text: "Waiting for Scout connection...",
-      color: "green",
-      isEnabled: true
-    }).start();
+async function waitForScoutConnection(client, profileId, options) {
+  const { timeoutMs, intervalMs, useJson } = options;
+  const tty3 = isTTY();
+  const loopStart = Date.now();
+  let spinner = null;
+  if (!useJson && tty3) {
+    spinner = ora({
+      text: "Waiting for Scout connection...",
+      color: "green",
+      isEnabled: true
+    }).start();
+  }
+  const cleanup = () => {
+    if (spinner) spinner.stop();
+  };
+  const onSigint = () => {
+    cleanup();
+    console.log("\nWatch cancelled. Pentest is waiting for Scout connection.");
+    process.exit(0);
+  };
+  process.once("SIGINT", onSigint);
+  while (true) {
+    const status = await client.scans.scoutStatus(profileId);
+    if (useJson) {
+      const elapsed = Math.round((Date.now() - loopStart) / 1e3);
+      process.stdout.write(
+        JSON.stringify({ ...status, elapsed_seconds: elapsed }) + "\n"
+      );
+    }
+    switch (status.status) {
+      case "pending":
+        if (spinner) spinner.text = import_picocolors6.default.green("Waiting for Scout bootstrap...");
+        break;
+      case "bootstrapped":
+        if (spinner) spinner.text = import_picocolors6.default.green("Scout bootstrapped, establishing connection...");
+        break;
+      case "connected": {
+        cleanup();
+        process.removeListener("SIGINT", onSigint);
+        if (!useJson) {
+          const icon = tty3 ? import_picocolors6.default.green(sym2.success) : sym2.success;
+          console.log(`${icon} Scout connected`);
+          if (status.hostname) {
+            console.log(`  Hostname: ${status.hostname}`);
+          }
+          if (status.tools.length > 0) {
+            console.log(`  Tools: ${status.tools.join(", ")}`);
+          }
+        }
+        return;
+      }
+      case "expired": {
+        cleanup();
+        process.removeListener("SIGINT", onSigint);
+        const icon = tty3 ? import_picocolors6.default.red(sym2.fail) : sym2.fail;
+        console.error(`
+${icon} Scout bootstrap token expired.`);
+        console.error("Start a new pentest to get a fresh token.");
+        process.exit(1);
+      }
+      case "disconnected": {
+        cleanup();
+        process.removeListener("SIGINT", onSigint);
+        const icon = tty3 ? import_picocolors6.default.red(sym2.fail) : sym2.fail;
+        console.error(`
+${icon} Scout disconnected unexpectedly.`);
+        console.error(`Check status: kinosec pentest get ${profileId}`);
+        process.exit(1);
+      }
+    }
+    if (Date.now() - loopStart > timeoutMs) {
+      cleanup();
+      process.removeListener("SIGINT", onSigint);
+      const secs = Math.round(timeoutMs / 1e3);
+      console.error(`
+Timeout: Scout did not connect within ${secs}s.`);
+      console.error("The bootstrap token may have expired. Start a new pentest.");
+      process.exit(3);
+    }
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+  }
+}
+
+// src/lib/scope.ts
+var import_picocolors7 = __toESM(require_picocolors(), 1);
+
+// src/lib/prompt.ts
+import { createInterface as createInterface2 } from "readline";
+async function promptMasked(label) {
+  if (!isTTY() || !process.stdin.isTTY) {
+    console.error(`Cannot prompt for ${label} in non-interactive mode. Use flags instead.`);
+    process.exit(2);
+  }
+  process.stderr.write(`${label}: `);
+  return new Promise((resolve, reject) => {
+    const chars = [];
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf-8");
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        if (ch === "\r" || ch === "\n") {
+          process.stdin.setRawMode(false);
+          process.stdin.pause();
+          process.stdin.removeListener("data", onData);
+          process.stderr.write("\n");
+          resolve(chars.join(""));
+          return;
+        } else if (ch === "") {
+          process.stdin.setRawMode(false);
+          process.stdin.pause();
+          process.stdin.removeListener("data", onData);
+          process.stderr.write("\n");
+          reject(new Error("Cancelled"));
+          return;
+        } else if (ch === "\x7F" || ch === "\b") {
+          if (chars.length > 0) {
+            chars.pop();
+            process.stderr.write("\b \b");
+          }
+        } else if (ch >= " ") {
+          chars.push(ch);
+          process.stderr.write("*");
+        }
+      }
+    };
+    process.stdin.on("data", onData);
+  });
+}
+async function promptText(label) {
+  if (!isTTY() || !process.stdin.isTTY) {
+    console.error(`Cannot prompt for ${label} in non-interactive mode. Use flags instead.`);
+    process.exit(2);
+  }
+  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise((resolve) => {
+    rl.question(`${label}: `, resolve);
+  });
+  rl.close();
+  return answer;
+}
+async function promptSelect(message, options) {
+  if (!isTTY() || !process.stdin.isTTY) {
+    console.error("Cannot show interactive menu in non-interactive mode. Use flags instead.");
+    process.exit(2);
+  }
+  console.error(`
+${message}`);
+  for (let i = 0; i < options.length; i++) {
+    console.error(`  ${i + 1}. ${options[i].label} \u2014 ${options[i].description}`);
+  }
+  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const answer = await new Promise((resolve) => {
+    rl.question("> ", resolve);
+  });
+  rl.close();
+  const index = parseInt(answer, 10) - 1;
+  if (isNaN(index) || index < 0 || index >= options.length) {
+    console.error("Invalid selection.");
+    process.exit(2);
+  }
+  return options[index].value;
+}
+
+// src/lib/scope.ts
+var HOSTNAME_RE = /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/i;
+var MAX_SCOPE_HOSTS = 50;
+function parseScopeHosts(input) {
+  return input.split(",").map((h) => h.trim()).filter(Boolean);
+}
+function validateScopeHosts(hosts) {
+  for (const host of hosts) {
+    if (!HOSTNAME_RE.test(host)) {
+      console.error(`Error: Invalid hostname "${host}". Must be a valid domain (e.g., api.example.com).`);
+      process.exit(2);
+    }
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const host of hosts) {
+    const lower = host.toLowerCase();
+    if (seen.has(lower)) {
+      console.error(`Error: Duplicate hostname "${host}" in list.`);
+      process.exit(2);
+    }
+    seen.add(lower);
+  }
+}
+function validateScopeHostOwnership(hosts, assetValue) {
+  const suffix = `.${assetValue.toLowerCase()}`;
+  for (const host of hosts) {
+    if (!host.toLowerCase().endsWith(suffix)) {
+      console.error(`Error: ${host} is not a subdomain of ${assetValue}.`);
+      process.exit(2);
+    }
+  }
+}
+function validateScopeFlags(options) {
+  if (options.include && options.exclude) {
+    console.error("Error: --include and --exclude cannot be used together. Use one or the other.");
+    process.exit(2);
+  }
+  if (options.scopeClear && (options.include || options.exclude)) {
+    console.error("Error: --clear cannot be combined with --include or --exclude.");
+    process.exit(2);
+  }
+}
+function validateTotalHostCount(existingCount, newCount) {
+  const total = existingCount + newCount;
+  if (total > MAX_SCOPE_HOSTS) {
+    console.error(`Error: Maximum ${MAX_SCOPE_HOSTS} hosts allowed. You provided ${total}.`);
+    process.exit(2);
   }
-  const cleanup = () => {
-    if (spinner) spinner.stop();
-  };
-  const onSigint = () => {
-    cleanup();
-    console.log("\nWatch cancelled. Pentest is waiting for Scout connection.");
-    process.exit(0);
-  };
-  process.once("SIGINT", onSigint);
-  while (true) {
-    const status = await client.scans.scoutStatus(profileId);
-    if (useJson) {
-      const elapsed = Math.round((Date.now() - loopStart) / 1e3);
-      process.stdout.write(
-        JSON.stringify({ ...status, elapsed_seconds: elapsed }) + "\n"
-      );
+}
+function displayScope(asset) {
+  if (!asset.scope_filter || !asset.scope_hosts?.length) {
+    console.error(`Scope: ${isTTY() ? import_picocolors7.default.dim("all subdomains") : "all subdomains"}`);
+    return;
+  }
+  const label = asset.scope_filter === "include" ? "include only" : "exclude";
+  const hosts = asset.scope_hosts.join(", ");
+  console.error(`Scope: ${label} \u2014 ${hosts}`);
+}
+async function resolveScopeUpdate(asset, mode, newHosts) {
+  const existingMode = asset.scope_filter;
+  const existingHosts = asset.scope_hosts ?? [];
+  if (!existingMode || existingHosts.length === 0) {
+    validateScopeHosts(newHosts);
+    if (newHosts.length > MAX_SCOPE_HOSTS) {
+      console.error(`Error: Maximum ${MAX_SCOPE_HOSTS} hosts allowed. You provided ${newHosts.length}.`);
+      process.exit(2);
     }
-    switch (status.status) {
-      case "pending":
-        if (spinner) spinner.text = import_picocolors6.default.green("Waiting for Scout bootstrap...");
-        break;
-      case "bootstrapped":
-        if (spinner) spinner.text = import_picocolors6.default.green("Scout bootstrapped, establishing connection...");
-        break;
-      case "connected": {
-        cleanup();
-        process.removeListener("SIGINT", onSigint);
-        if (!useJson) {
-          const icon = tty3 ? import_picocolors6.default.green(sym2.success) : sym2.success;
-          console.log(`${icon} Scout connected`);
-          if (status.hostname) {
-            console.log(`  Hostname: ${status.hostname}`);
-          }
-          if (status.tools.length > 0) {
-            console.log(`  Tools: ${status.tools.join(", ")}`);
-          }
-        }
-        return;
-      }
-      case "expired": {
-        cleanup();
-        process.removeListener("SIGINT", onSigint);
-        const icon = tty3 ? import_picocolors6.default.red(sym2.fail) : sym2.fail;
-        console.error(`
-${icon} Scout bootstrap token expired.`);
-        console.error("Start a new pentest to get a fresh token.");
-        process.exit(1);
-      }
-      case "disconnected": {
-        cleanup();
-        process.removeListener("SIGINT", onSigint);
-        const icon = tty3 ? import_picocolors6.default.red(sym2.fail) : sym2.fail;
-        console.error(`
-${icon} Scout disconnected unexpectedly.`);
-        console.error(`Check status: kinosec pentest get ${profileId}`);
-        process.exit(1);
-      }
+    return { scope_filter: mode, scope_hosts: newHosts };
+  }
+  if (existingMode !== mode) {
+    console.error(`
+Existing ${existingMode} scope:`);
+    for (const host of existingHosts) {
+      console.error(`  - ${host}`);
     }
-    if (Date.now() - loopStart > timeoutMs) {
-      cleanup();
-      process.removeListener("SIGINT", onSigint);
-      const secs = Math.round(timeoutMs / 1e3);
-      console.error(`
-Timeout: Scout did not connect within ${secs}s.`);
-      console.error("The bootstrap token may have expired. Start a new pentest.");
-      process.exit(3);
+    const answer2 = await promptSelect(
+      `You have an existing ${existingMode} scope. Using --${mode} will replace it. Continue?`,
+      [
+        { value: "switch", label: `Yes, switch to ${mode}`, description: `Replace ${existingMode} list with new ${mode} list` },
+        { value: "cancel", label: "Cancel", description: "Keep existing scope" }
+      ]
+    );
+    if (answer2 === "cancel") {
+      console.error("Cancelled.");
+      return null;
     }
-    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    validateScopeHosts(newHosts);
+    if (newHosts.length > MAX_SCOPE_HOSTS) {
+      console.error(`Error: Maximum ${MAX_SCOPE_HOSTS} hosts allowed. You provided ${newHosts.length}.`);
+      process.exit(2);
+    }
+    return { scope_filter: mode, scope_hosts: newHosts };
+  }
+  console.error(`
+Existing ${existingMode} scope:`);
+  for (const host of existingHosts) {
+    console.error(`  - ${host}`);
+  }
+  const answer = await promptSelect(
+    `You have existing subdomains in your ${mode} list. What would you like to do?`,
+    [
+      { value: "add", label: "Add to existing list", description: "Append new hosts to the current list" },
+      { value: "replace", label: "Replace with new list", description: "Remove existing hosts and use only the new ones" }
+    ]
+  );
+  if (answer === "add") {
+    validateScopeHosts(newHosts);
+    const existingLower = new Set(existingHosts.map((h) => h.toLowerCase()));
+    const deduped = newHosts.filter((h) => !existingLower.has(h.toLowerCase()));
+    if (deduped.length === 0) {
+      console.error("All provided hosts are already in the list.");
+      return { scope_filter: mode, scope_hosts: existingHosts };
+    }
+    validateScopeHosts(deduped);
+    validateTotalHostCount(existingHosts.length, deduped.length);
+    const merged = [...existingHosts, ...deduped];
+    return { scope_filter: mode, scope_hosts: merged };
+  }
+  validateScopeHosts(newHosts);
+  if (newHosts.length > MAX_SCOPE_HOSTS) {
+    console.error(`Error: Maximum ${MAX_SCOPE_HOSTS} hosts allowed. You provided ${newHosts.length}.`);
+    process.exit(2);
   }
+  return { scope_filter: mode, scope_hosts: newHosts };
 }
 
-// src/commands/pentest.ts
-function stripProtocol(input) {
-  const match = input.match(/^https?:\/\/(.+)/i);
-  if (match) return { domain: match[1].replace(/\/+$/, ""), warned: true };
-  return { domain: input, warned: false };
-}
-function isValidDomain(value) {
-  return value.includes(".") && !/\s/.test(value);
+// src/lib/parse-target.ts
+function parseTarget(input) {
+  const warnings = [];
+  let value = input.trim();
+  const protocolMatch = value.match(/^https?:\/\/(.+)/i);
+  if (protocolMatch) {
+    value = protocolMatch[1];
+  }
+  const slashIndex = value.indexOf("/");
+  if (slashIndex !== -1) {
+    value = value.slice(0, slashIndex);
+  }
+  value = value.replace(/\.+$/, "").toLowerCase();
+  if (protocolMatch) {
+    warnings.push(`Protocol stripped from input. Using "${value}".`);
+  }
+  if (/\s/.test(value) || !value.includes(".")) {
+    throw new Error(
+      `Invalid target: "${input}". Provide a domain like example.com or an IP like 192.168.1.1.`
+    );
+  }
+  const assetType = detectAssetType(value);
+  const parentDomain = deriveParentDomain(value);
+  const isPubSuffix = isPublicSuffix(value);
+  if (isPubSuffix) {
+    warnings.push(
+      `${value} is a public hosting suffix. You probably want your specific subdomain (e.g. myapp.${value}).`
+    );
+  }
+  return {
+    hostname: value,
+    assetType,
+    parentDomain,
+    isPublicSuffix: isPubSuffix,
+    warnings
+  };
 }
+
+// src/commands/pentest.ts
 function registerPentestCommand(program3) {
-  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode: quick or full", "full").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").addHelpText("after", `
+  const pentest = program3.command("pentest").description("Run and manage pentests").option("-t, --target <domain>", "Target domain to pentest").option("--profile <id>", "Pentest profile ID (alternative to --target)").option("--mode <mode>", "Pentest mode", "full").option("-y, --yes", "Accept authorization terms without prompting").option("--no-watch", "Skip auto-watch after starting the pentest").option("--deployment <type>", "Deployment type: cloud or on-prem", "cloud").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--scope <action>", "Scope action: clear").addHelpText("after", `
 Examples:
   $ kinosec pentest -t delikado.org
-  $ kinosec pentest --target delikado.org --mode quick
   $ kinosec pentest --profile abc123
-  $ kinosec pentest -t internal.corp --deployment on-prem`).action(async (options) => {
+  $ kinosec pentest -t internal.corp --deployment on-prem
+  $ kinosec pentest -t example.com --include api.example.com,app.example.com
+  $ kinosec pentest -t example.com --exclude staging.example.com
+  $ kinosec pentest -t example.com --scope clear`).action(async (options) => {
     if (!options.target && !options.profile) {
       console.error("Provide --target <domain> or --profile <id>.");
       process.exit(2);
@@ -11673,6 +12527,21 @@ Examples:
       console.error("Invalid deployment type. Must be: cloud or on-prem.");
       process.exit(2);
     }
+    validateScanMode(options.mode);
+    const scopeClear = options.scope === "clear";
+    if (options.scope && options.scope !== "clear") {
+      console.error("Invalid --scope value. Must be: clear");
+      process.exit(2);
+    }
+    validateScopeFlags({
+      include: options.include,
+      exclude: options.exclude,
+      scopeClear
+    });
+    if (options.profile && (options.include || options.exclude || scopeClear)) {
+      console.error("Error: Scope flags are only supported with --target, not --profile.");
+      process.exit(2);
+    }
     try {
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
@@ -11684,31 +12553,33 @@ Examples:
         targetDisplay = detail.domain_or_ip;
         params = { scan_profile_id: options.profile };
       } else {
-        const { domain, warned } = stripProtocol(options.target);
-        if (warned) {
-          console.error(`Warning: protocol stripped. Using "${domain}".`);
-        }
-        if (!isValidDomain(domain)) {
-          console.error(`Invalid domain format: "${domain}"`);
-          console.error("Provide a domain like delikado.org or juice.delikado.org.");
-          process.exit(2);
+        const parsed = parseTarget(options.target);
+        for (const warning2 of parsed.warnings) {
+          console.error(`Warning: ${warning2}`);
+        }
+        if (parsed.isPublicSuffix) {
+          console.error(
+            `
+  ${parsed.hostname} is a shared hosting domain. The server will likely reject this.`
+          );
         }
         let asset;
         try {
-          asset = await client.assets.lookup(domain);
+          asset = await client.assets.lookup(parsed.hostname);
         } catch (err) {
           if (err instanceof ApiError && err.status === 404) {
             asset = await client.assets.create({
-              asset_type: "domain",
-              asset_value: domain,
+              asset_type: parsed.assetType,
+              asset_value: parsed.hostname,
+              parent_domain: parsed.parentDomain,
               verification_method: "dns"
             });
-            console.error(`Asset created for ${domain}.`);
+            console.error(`Asset created for ${parsed.hostname}.`);
           } else {
             throw err;
           }
         }
-        targetDisplay = domain;
+        targetDisplay = parsed.hostname;
         const assetParams = {
           asset_id: asset.id,
           scan_mode: options.mode
@@ -11717,6 +12588,40 @@ Examples:
           assetParams.deployment_type = options.deployment;
         }
         params = assetParams;
+        if (scopeClear || options.include || options.exclude) {
+          if (asset.asset_type !== "domain") {
+            const hint = parsed.parentDomain ? `
+  Target the parent domain instead:
+  kinosec pentest -t ${parsed.parentDomain} --${options.include ? "include" : "exclude"} ${parsed.hostname}` : "";
+            console.error(
+              `Error: Scope filtering is only available for domain assets. ${parsed.hostname} is a ${asset.asset_type}.${hint}`
+            );
+            process.exit(2);
+          }
+        }
+        if (scopeClear) {
+          await client.assets.update(asset.id, {
+            scope_filter: null,
+            scope_hosts: null
+          });
+          console.error("Scope settings cleared. Scans will now cover all subdomains by default.");
+          asset = await client.assets.get(asset.id);
+        } else if (options.include || options.exclude) {
+          const mode = options.include ? "include" : "exclude";
+          const rawHosts = parseScopeHosts(options.include ?? options.exclude);
+          validateScopeHosts(rawHosts);
+          validateScopeHostOwnership(rawHosts, asset.asset_value);
+          const scopeResult = await resolveScopeUpdate(asset, mode, rawHosts);
+          if (!scopeResult) {
+            process.exit(0);
+          }
+          await client.assets.update(asset.id, {
+            scope_filter: scopeResult.scope_filter,
+            scope_hosts: scopeResult.scope_hosts
+          });
+          asset = await client.assets.get(asset.id);
+        }
+        displayScope(asset);
       }
       await confirmAuthorization(targetDisplay, Boolean(options.yes));
       const result = await client.scans.create(params);
@@ -11731,7 +12636,7 @@ Examples:
       if (isOnPrem) {
         printOnPremInstructions(result);
         if (options.watch && isTTY()) {
-          const divider2 = import_picocolors7.default.dim("\u2500".repeat(37));
+          const divider2 = import_picocolors8.default.dim("\u2500".repeat(37));
           console.log(`
 ${divider2}
 `);
@@ -11758,7 +12663,7 @@ Watch connection: kinosec pentest watch ${result.scan_profile_id}`);
 Watch progress: kinosec pentest watch ${result.scan_profile_id}`);
         return;
       }
-      const divider = isTTY() ? import_picocolors7.default.dim("\u2500".repeat(37)) : "-".repeat(37);
+      const divider = isTTY() ? import_picocolors8.default.dim("\u2500".repeat(37)) : "-".repeat(37);
       console.log(`
 ${divider}
 `);
@@ -11769,6 +12674,9 @@ ${divider}
         showFindingsSummary: true
       });
     } catch (error2) {
+      if (error2 instanceof Error && error2.message.startsWith("process.exit(")) {
+        throw error2;
+      }
       handleError(error2);
     }
   });
@@ -11804,7 +12712,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors7.default.dim(`
+        console.log(import_picocolors8.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -11896,10 +12804,10 @@ Examples:
 }
 
 // src/commands/asset.ts
-var import_picocolors9 = __toESM(require_picocolors(), 1);
+var import_picocolors10 = __toESM(require_picocolors(), 1);
 
 // src/commands/asset-auth.ts
-var import_picocolors8 = __toESM(require_picocolors(), 1);
+var import_picocolors9 = __toESM(require_picocolors(), 1);
 
 // src/lib/resolve-asset.ts
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-/i;
@@ -11925,84 +12833,6 @@ or use pentest which auto-creates the asset:
   }
 }
 
-// src/lib/prompt.ts
-import { createInterface as createInterface2 } from "readline";
-async function promptMasked(label) {
-  if (!isTTY() || !process.stdin.isTTY) {
-    console.error(`Cannot prompt for ${label} in non-interactive mode. Use flags instead.`);
-    process.exit(2);
-  }
-  process.stderr.write(`${label}: `);
-  return new Promise((resolve, reject) => {
-    const chars = [];
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stdin.setEncoding("utf-8");
-    const onData = (chunk) => {
-      for (const ch of chunk) {
-        if (ch === "\r" || ch === "\n") {
-          process.stdin.setRawMode(false);
-          process.stdin.pause();
-          process.stdin.removeListener("data", onData);
-          process.stderr.write("\n");
-          resolve(chars.join(""));
-          return;
-        } else if (ch === "") {
-          process.stdin.setRawMode(false);
-          process.stdin.pause();
-          process.stdin.removeListener("data", onData);
-          process.stderr.write("\n");
-          reject(new Error("Cancelled"));
-          return;
-        } else if (ch === "\x7F" || ch === "\b") {
-          if (chars.length > 0) {
-            chars.pop();
-            process.stderr.write("\b \b");
-          }
-        } else if (ch >= " ") {
-          chars.push(ch);
-          process.stderr.write("*");
-        }
-      }
-    };
-    process.stdin.on("data", onData);
-  });
-}
-async function promptText(label) {
-  if (!isTTY() || !process.stdin.isTTY) {
-    console.error(`Cannot prompt for ${label} in non-interactive mode. Use flags instead.`);
-    process.exit(2);
-  }
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve) => {
-    rl.question(`${label}: `, resolve);
-  });
-  rl.close();
-  return answer;
-}
-async function promptSelect(message, options) {
-  if (!isTTY() || !process.stdin.isTTY) {
-    console.error("Cannot show interactive menu in non-interactive mode. Use flags instead.");
-    process.exit(2);
-  }
-  console.error(`
-${message}`);
-  for (let i = 0; i < options.length; i++) {
-    console.error(`  ${i + 1}. ${options[i].label} \u2014 ${options[i].description}`);
-  }
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve) => {
-    rl.question("> ", resolve);
-  });
-  rl.close();
-  const index = parseInt(answer, 10) - 1;
-  if (isNaN(index) || index < 0 || index >= options.length) {
-    console.error("Invalid selection.");
-    process.exit(2);
-  }
-  return options[index].value;
-}
-
 // src/commands/asset-auth.ts
 var VALID_AUTH_TYPES = ["bearer", "basic", "apikey", "session", "cookie"];
 var AUTH_TYPE_OPTIONS = [
@@ -12156,7 +12986,7 @@ Examples:
       }
       if (!creds.has_credentials) {
         console.log(`Asset:           ${asset.asset_value}`);
-        console.log(`Auth Type:       ${import_picocolors8.default.dim("(none)")}`);
+        console.log(`Auth Type:       ${import_picocolors9.default.dim("(none)")}`);
         console.log(`Has Credentials: no`);
         return;
       }
@@ -12177,9 +13007,9 @@ Examples:
         const hasAny = ta.has_username || ta.has_cookie || ta.has_bearer_token || ta.has_apikey;
         if (hasAny) {
           const detail = ta.has_username ? "username" : ta.has_bearer_token ? "bearer token" : ta.has_cookie ? "cookie" : "API key";
-          console.log(`Target Account:  ${import_picocolors8.default.green("configured")} (${detail})`);
+          console.log(`Target Account:  ${import_picocolors9.default.green("configured")} (${detail})`);
         } else {
-          console.log(`Target Account:  ${import_picocolors8.default.dim("not configured")}`);
+          console.log(`Target Account:  ${import_picocolors9.default.dim("not configured")}`);
         }
       }
     } catch (error2) {
@@ -12320,17 +13150,18 @@ Examples:
         return;
       }
       printTable(
-        ["ID", "Value", "Type", "Status", "Created"],
+        ["ID", "Value", "Type", "Status", "Scope", "Created"],
         result.items.map((a) => [
           a.id,
           truncate(a.asset_value, 40),
           a.asset_type,
           a.verification_status,
+          a.scope_filter ?? "all",
           new Date(a.created_at).toLocaleDateString()
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors9.default.dim(`
+        console.log(import_picocolors10.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12350,18 +13181,24 @@ Examples:
         printJson(detail);
         return;
       }
-      printTable(
-        ["Field", "Value"],
-        [
-          ["ID", detail.id],
-          ["Value", detail.asset_value],
-          ["Type", detail.asset_type],
-          ["Status", detail.verification_status],
-          ["Parent", detail.parent_domain ?? "(none)"],
-          ["Created", detail.created_at],
-          ["Updated", detail.updated_at]
-        ]
+      const rows = [
+        ["ID", detail.id],
+        ["Value", detail.asset_value],
+        ["Type", detail.asset_type],
+        ["Status", detail.verification_status],
+        ["Parent", detail.parent_domain ?? "(none)"]
+      ];
+      if (detail.asset_type === "domain") {
+        rows.push(["Scope", detail.scope_filter ?? "all subdomains"]);
+        if (detail.scope_hosts?.length) {
+          rows.push(["Hosts", detail.scope_hosts.join(", ")]);
+        }
+      }
+      rows.push(
+        ["Created", detail.created_at],
+        ["Updated", detail.updated_at]
       );
+      printTable(["Field", "Value"], rows);
     } catch (error2) {
       handleError(error2);
     }
@@ -12374,11 +13211,18 @@ Examples:
       const opts = program3.opts();
       const { token, apiUrl } = resolveToken(opts);
       const client = new KinoSecClient({ apiUrl, token });
+      const detected = detectAssetType(options.value);
+      if (detected !== options.type) {
+        console.error(
+          `Warning: ${options.value} looks like a ${detected}, not a ${options.type}. Continuing with your specified type.`
+        );
+      }
+      const parentDomain = options.parent ?? (options.type === "subdomain" ? deriveParentDomain(options.value) : null);
       const result = await client.assets.create({
         asset_type: options.type,
         asset_value: options.value,
         verification_method: options.verifyMethod,
-        parent_domain: options.parent ?? null
+        parent_domain: parentDomain
       });
       if (opts.json || opts.output === "json") {
         printJson(result);
@@ -12438,11 +13282,85 @@ Examples:
       handleError(error2);
     }
   });
+  asset.command("scope").description("View or configure subdomain scope for an asset").argument("<id>", "Asset ID or domain").option("--include <hosts>", "Include only these subdomains (comma-separated)").option("--exclude <hosts>", "Exclude these subdomains (comma-separated)").option("--clear", "Clear scope settings").addHelpText("after", `
+Examples:
+  $ kinosec asset scope abc123
+  $ kinosec asset scope example.com --include api.example.com,app.example.com
+  $ kinosec asset scope abc123 --exclude staging.example.com
+  $ kinosec asset scope abc123 --clear`).action(async (id, options) => {
+    try {
+      validateScopeFlags({
+        include: options.include,
+        exclude: options.exclude,
+        scopeClear: options.clear
+      });
+      const opts = program3.opts();
+      const { token, apiUrl } = resolveToken(opts);
+      const client = new KinoSecClient({ apiUrl, token });
+      const asset2 = await resolveAsset(client, id);
+      if (asset2.asset_type !== "domain") {
+        console.error("Error: Scope filtering is only available for domain assets.");
+        process.exit(2);
+      }
+      if (!options.include && !options.exclude && !options.clear) {
+        if (opts.json || opts.output === "json") {
+          printJson({
+            scope_filter: asset2.scope_filter,
+            scope_hosts: asset2.scope_hosts
+          });
+          return;
+        }
+        if (!asset2.scope_filter || !asset2.scope_hosts?.length) {
+          console.log("Scope: all subdomains");
+        } else {
+          console.log(`Scope: ${asset2.scope_filter}`);
+          console.log("Hosts:");
+          for (const host of asset2.scope_hosts) {
+            console.log(`  - ${host}`);
+          }
+        }
+        return;
+      }
+      if (options.clear) {
+        await client.assets.update(asset2.id, {
+          scope_filter: null,
+          scope_hosts: null
+        });
+        if (opts.json || opts.output === "json") {
+          printJson({ scope_filter: null, scope_hosts: null });
+          return;
+        }
+        printSuccess("Scope settings cleared. Scans will now cover all subdomains by default.");
+        return;
+      }
+      const mode = options.include ? "include" : "exclude";
+      const rawHosts = parseScopeHosts(options.include ?? options.exclude);
+      validateScopeHosts(rawHosts);
+      validateScopeHostOwnership(rawHosts, asset2.asset_value);
+      const result = await resolveScopeUpdate(asset2, mode, rawHosts);
+      if (!result) return;
+      await client.assets.update(asset2.id, {
+        scope_filter: result.scope_filter,
+        scope_hosts: result.scope_hosts
+      });
+      if (opts.json || opts.output === "json") {
+        printJson(result);
+        return;
+      }
+      printSuccess(`Scope updated: ${result.scope_filter}`);
+      console.log("Hosts:");
+      for (const host of result.scope_hosts) {
+        console.log(`  - ${host}`);
+      }
+    } catch (error2) {
+      handleError(error2);
+    }
+  });
   registerAssetAuthCommand(asset);
 }
 
 // src/commands/finding.ts
-var import_picocolors10 = __toESM(require_picocolors(), 1);
+var import_picocolors11 = __toESM(require_picocolors(), 1);
 function formatPoc(poc) {
   if (poc == null) return null;
   if (typeof poc === "string") return poc.trim() || null;
@@ -12483,7 +13401,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors10.default.dim(`
+        console.log(import_picocolors11.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12571,7 +13489,7 @@ Examples:
 }
 
 // src/commands/report.ts
-var import_picocolors11 = __toESM(require_picocolors(), 1);
+var import_picocolors12 = __toESM(require_picocolors(), 1);
 function renderMarkdown(data) {
   const { scan, findings } = data;
   const lines = [];
@@ -12648,7 +13566,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors11.default.dim(`
+        console.log(import_picocolors12.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12719,7 +13637,7 @@ Examples:
 }
 
 // src/commands/token.ts
-var import_picocolors12 = __toESM(require_picocolors(), 1);
+var import_picocolors13 = __toESM(require_picocolors(), 1);
 function registerTokenCommand(program3) {
   const token = program3.command("token").description("Manage API tokens");
   token.command("list").description("List API tokens").option("--limit <n>", "Max results per page", "20").option("--cursor <cursor>", "Pagination cursor").addHelpText("after", `
@@ -12754,7 +13672,7 @@ Examples:
         ])
       );
       if (result.next_cursor) {
-        console.log(import_picocolors12.default.dim(`
+        console.log(import_picocolors13.default.dim(`
 More results available. Use --cursor ${result.next_cursor}`));
       }
     } catch (error2) {
@@ -12781,7 +13699,7 @@ Examples:
       }
       printSuccess(`Token created: ${result.name}`);
       console.log("");
-      console.log(import_picocolors12.default.bold("  Token: ") + result.token);
+      console.log(import_picocolors13.default.bold("  Token: ") + result.token);
       console.log("");
       printWarning("Save this token \u2014 it will not be shown again.");
       console.log(`  ID: ${result.id}`);
@@ -12814,7 +13732,7 @@ Examples:
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.9.0", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
+program2.name("kinosec").description("KinoSec CLI \u2014 run pentests from your terminal").version("0.10.1", "-v, --version").option("--token <pat>", "API token (overrides KINOSEC_TOKEN)").option("--output <format>", "Output format: text or json", "text").option("--json", "Shorthand for --output json").option("--no-color", "Disable colors");
 registerAuthCommand(program2);
 registerMeCommand(program2);
 registerCreditsCommand(program2);
@@ -12823,7 +13741,7 @@ registerAssetCommand(program2);
 registerFindingCommand(program2);
 registerReportCommand(program2);
 registerTokenCommand(program2);
-program2.parseAsync(process.argv).then(() => checkForUpdate("0.9.0")).catch(handleError);
+program2.parseAsync(process.argv).then(() => checkForUpdate("0.10.1")).catch(handleError);
 /*! Bundled license information:
 
 ky/distribution/index.js: