@redocly/cli 2.41.2 → 2.43.0

package/lib/chunks/RRC5IDC3.js

@@ -1,2416 +0,0 @@
-import { createRequire as __createRequire } from 'node:module';
-const require = __createRequire(import.meta.url);
-import {
-  compileOpenApiPath,
-  getPathWithoutTrailingSlash,
-  isJsonMime,
-  isSyntheticHost,
-  listOpenApiFiles,
-  normalizeServerPrefix,
-  parseHeaderIgnoreList,
-  parseUrl,
-  pickSchemaByMime,
-  resolvePathForServer,
-  shouldIgnoreHeaderAsUndocumented,
-  splitSetCookieHeader
-} from "./3CX2Z7JI.js";
-import {
-  BaseResolver,
-  blue,
-  bold,
-  bundle,
-  cyan,
-  detectSpec,
-  dim,
-  getMajorSpecVersion,
-  getTypes,
-  gray,
-  green,
-  isPlainObject,
-  logger,
-  normalizeTypes,
-  normalizeVisitors,
-  red,
-  require__,
-  require_dist,
-  walkDocument,
-  yellow
-} from "./Z2664VV5.js";
-import {
-  __toESM
-} from "./5ILQMFXK.js";
-
-// src/commands/drift/engine/reporter.ts
-import path from "node:path";
-
-// src/commands/drift/utils/finding-groups.ts
-var KEY_SEPARATOR = "";
-function normalizePart(value) {
-  if (!value) {
-    return "";
-  }
-  return value.trim();
-}
-function createProblemKey(finding) {
-  const operationOrPath = normalizePart(finding.operationId) || normalizePart(finding.path);
-  return [
-    normalizePart(finding.ruleId),
-    normalizePart(finding.severity),
-    normalizePart(finding.message),
-    operationOrPath,
-    normalizePart(finding.target),
-    normalizePart(finding.schemaPath)
-  ].join(KEY_SEPARATOR);
-}
-
-// src/commands/drift/engine/reporter.ts
-var cyanBold = (text) => bold(cyan(text));
-function mapSeverityToSarifLevel(severity) {
-  if (severity === "error") return "error";
-  if (severity === "warning") return "warning";
-  return "note";
-}
-function escapeCsvCell(value) {
-  if (value === void 0 || value === null) {
-    return "";
-  }
-  const stringValue = String(value);
-  if (!stringValue.includes(",") && !stringValue.includes('"') && !stringValue.includes("\n")) {
-    return stringValue;
-  }
-  return `"${stringValue.replace(/"/g, '""')}"`;
-}
-function toRelativeSpecPath(specSource) {
-  if (!path.isAbsolute(specSource)) {
-    return specSource;
-  }
-  const relativePath = path.relative(process.cwd(), specSource);
-  return relativePath || ".";
-}
-function getOperationTemplatePath(details) {
-  if (!details) {
-    return null;
-  }
-  const maybePath = details.operationPathTemplate;
-  return typeof maybePath === "string" && maybePath.length > 0 ? maybePath : null;
-}
-function sortRuleCounts(findingsByRule) {
-  return Object.entries(findingsByRule).sort((a, b) => {
-    const countDiff = b[1] - a[1];
-    if (countDiff !== 0) {
-      return countDiff;
-    }
-    return a[0].localeCompare(b[0]);
-  });
-}
-function groupFindingsIntoProblems(findings) {
-  const problems = [];
-  const keyToIndex = /* @__PURE__ */ new Map();
-  for (const finding of findings) {
-    const key = createProblemKey({
-      ruleId: finding.ruleId,
-      severity: finding.severity,
-      message: finding.message,
-      operationId: finding.operationId,
-      path: finding.path,
-      target: finding.target,
-      schemaPath: finding.schemaPath
-    });
-    const existingIndex = keyToIndex.get(key);
-    if (existingIndex !== void 0) {
-      problems[existingIndex].occurrences += 1;
-      continue;
-    }
-    keyToIndex.set(key, problems.length);
-    problems.push({ finding, occurrences: 1 });
-  }
-  return problems;
-}
-function formatJson(result) {
-  const problems = groupFindingsIntoProblems(result.findings).map((problem) => ({
-    occurrences: problem.occurrences,
-    exchangeIndex: problem.finding.exchangeIndex,
-    ruleId: problem.finding.ruleId,
-    severity: problem.finding.severity,
-    category: problem.finding.category,
-    message: problem.finding.message,
-    operationId: problem.finding.operationId,
-    specSource: problem.finding.specSource,
-    target: problem.finding.target,
-    schemaPath: problem.finding.schemaPath,
-    dataPath: problem.finding.dataPath,
-    details: problem.finding.details,
-    method: problem.finding.method,
-    url: problem.finding.url,
-    path: problem.finding.path,
-    status: problem.finding.status
-  }));
-  const payload = {
-    run: {
-      id: result.runId,
-      specSource: result.meta.specSource,
-      trafficPath: result.meta.trafficPath,
-      format: result.meta.format,
-      matchMode: result.meta.matchMode,
-      server: result.meta.server,
-      totalExchanges: result.summary.totalExchanges,
-      documentedExchanges: result.summary.documentedExchanges,
-      undocumentedExchanges: result.summary.undocumentedExchanges,
-      skippedExchanges: result.summary.skippedExchanges,
-      findingsBySeverity: result.summary.findingsBySeverity,
-      findingsByRule: result.summary.findingsByRule,
-      totalProblems: result.summary.totalProblemGroups,
-      durationMs: result.summary.durationMs
-    },
-    problems
-  };
-  return `${JSON.stringify(payload, null, 2)}
-`;
-}
-function formatCsv(result) {
-  const header = [
-    "run_id",
-    "finding_id",
-    "exchange_index",
-    "severity",
-    "category",
-    "rule_id",
-    "message",
-    "method",
-    "path",
-    "url",
-    "status",
-    "operation_id",
-    "spec_source",
-    "target",
-    "schema_path",
-    "data_path"
-  ];
-  const rows = result.findings.map((finding) => [
-    result.runId,
-    finding.id,
-    finding.exchangeIndex,
-    finding.severity,
-    finding.category,
-    finding.ruleId,
-    finding.message,
-    finding.method,
-    finding.path,
-    finding.url,
-    finding.status,
-    finding.operationId,
-    finding.specSource,
-    finding.target,
-    finding.schemaPath,
-    finding.dataPath
-  ]);
-  const csvRows = [header, ...rows].map((row) => row.map(escapeCsvCell).join(","));
-  return `${csvRows.join("\n")}
-`;
-}
-function formatSarif(result) {
-  const ruleSet = /* @__PURE__ */ new Map();
-  for (const finding of result.findings) {
-    if (!ruleSet.has(finding.ruleId)) {
-      ruleSet.set(finding.ruleId, {
-        id: finding.ruleId,
-        name: finding.ruleId,
-        shortDescription: { text: `${finding.category} detection` }
-      });
-    }
-  }
-  const results = result.findings.map((finding) => {
-    const locationUri = finding.specSource ?? finding.url ?? void 0;
-    return {
-      ruleId: finding.ruleId,
-      level: mapSeverityToSarifLevel(finding.severity),
-      message: { text: finding.message },
-      locations: locationUri ? [{ physicalLocation: { artifactLocation: { uri: locationUri } } }] : void 0,
-      properties: {
-        runId: result.runId,
-        exchangeIndex: finding.exchangeIndex,
-        method: finding.method,
-        path: finding.path,
-        status: finding.status,
-        operationId: finding.operationId,
-        target: finding.target,
-        schemaPath: finding.schemaPath,
-        dataPath: finding.dataPath
-      }
-    };
-  });
-  const sarifPayload = {
-    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
-    version: "2.1.0",
-    runs: [{ tool: { driver: { name: "drift", rules: Array.from(ruleSet.values()) } }, results }]
-  };
-  return `${JSON.stringify(sarifPayload, null, 2)}
-`;
-}
-function totalFindings(summary) {
-  return summary.findingsBySeverity.error + summary.findingsBySeverity.warning + summary.findingsBySeverity.info;
-}
-function statusColor(status) {
-  if (status >= 500) return red;
-  if (status >= 400) return yellow;
-  if (status >= 300) return blue;
-  if (status >= 200) return green;
-  return gray;
-}
-function formatPretty(result, color, maxFindings) {
-  const colorize = (text, paint) => color ? paint(text) : text;
-  const severityIcon = (severity) => severity === "error" ? colorize("\u2716", red) : severity === "warning" ? colorize("\u25B2", yellow) : colorize("\u25CF", blue);
-  const severityLabel = (severity) => severity === "error" ? colorize("ERROR", red) : severity === "warning" ? colorize("WARN", yellow) : colorize("INFO", blue);
-  const { summary, meta } = result;
-  const findingsCount = totalFindings(summary);
-  const findingsToRender = summary.previewFindings.slice(0, maxFindings);
-  const lines = [];
-  lines.push(colorize("\u250F\u2501 Drift Report", cyanBold));
-  lines.push(`\u2503 Run: ${result.runId}`);
-  lines.push(`\u2503 Spec: ${meta.specSource}`);
-  lines.push(`\u2503 Traffic: ${meta.trafficPath}`);
-  lines.push(
-    meta.server ? `\u2503 Server: ${meta.server} (overrides description servers)` : `\u2503 Match mode: ${meta.matchMode}`
-  );
-  lines.push(`\u2503 Traffic format: ${meta.format}${meta.format === "auto" ? " (auto-detect)" : ""}`);
-  lines.push(
-    `\u2503 Exchanges: total=${summary.totalExchanges} documented=${summary.documentedExchanges} undocumented=${summary.undocumentedExchanges}${summary.skippedExchanges > 0 ? ` skipped=${summary.skippedExchanges}` : ""}`
-  );
-  lines.push(
-    `\u2503 Findings: total=${findingsCount} ${colorize(`error=${summary.findingsBySeverity.error}`, red)} ${colorize(
-      `warning=${summary.findingsBySeverity.warning}`,
-      yellow
-    )} ${colorize(`info=${summary.findingsBySeverity.info}`, blue)}`
-  );
-  lines.push(`\u2503 Problems: total=${summary.totalProblemGroups}`);
-  lines.push(`\u2517 Duration: ${summary.durationMs}ms`);
-  if (findingsCount === 0) {
-    lines.push("");
-    lines.push(colorize("\u2714 No findings.", cyan));
-    return `${lines.join("\n")}
-`;
-  }
-  lines.push("");
-  lines.push(colorize(`Types (${Object.keys(summary.problemGroupsByRule).length})`, cyanBold));
-  for (const [ruleId, problemsCount] of sortRuleCounts(summary.problemGroupsByRule)) {
-    const findingsForRule = summary.findingsByRule[ruleId] ?? problemsCount;
-    lines.push(
-      `  ${colorize("\u2022", gray)} ${ruleId}: ${problemsCount} problems / ${findingsForRule} findings`
-    );
-  }
-  const groupedFindings = /* @__PURE__ */ new Map();
-  for (const finding of findingsToRender) {
-    if (!groupedFindings.has(finding.ruleId)) {
-      groupedFindings.set(finding.ruleId, []);
-    }
-    groupedFindings.get(finding.ruleId).push(finding);
-  }
-  const orderedRuleIds = Array.from(groupedFindings.keys()).sort((a, b) => {
-    const countDiff = (summary.problemGroupsByRule[b] ?? 0) - (summary.problemGroupsByRule[a] ?? 0);
-    if (countDiff !== 0) {
-      return countDiff;
-    }
-    return a.localeCompare(b);
-  });
-  lines.push("");
-  lines.push(
-    colorize(
-      `Problems by type (showing first ${findingsToRender.length} of ${summary.totalProblemGroups})`,
-      cyanBold
-    )
-  );
-  let renderedIndex = 0;
-  for (const ruleId of orderedRuleIds) {
-    const group = groupedFindings.get(ruleId);
-    if (!group || group.length === 0) {
-      continue;
-    }
-    const ruleProblemTotal = summary.problemGroupsByRule[ruleId] ?? group.length;
-    const ruleFindingTotal = summary.findingsByRule[ruleId] ?? ruleProblemTotal;
-    lines.push("");
-    lines.push(
-      `${colorize("\u25C9", cyan)} ${colorize(ruleId, cyanBold)} ${colorize(
-        `(${group.length} problems shown / ${ruleProblemTotal} total, ${ruleFindingTotal} findings)`,
-        gray
-      )}`
-    );
-    for (const finding of group) {
-      renderedIndex += 1;
-      const occurrences = finding.occurrences;
-      const statusText = finding.status !== void 0 ? colorize(String(finding.status), statusColor(finding.status)) : colorize("-", gray);
-      const displayPath = getOperationTemplatePath(finding.details) ?? finding.path;
-      const operationLabel = finding.operationId ? ` ${colorize(finding.operationId, dim)}` : "";
-      lines.push(
-        `${severityIcon(finding.severity)} ${severityLabel(finding.severity)} #${renderedIndex}${occurrences > 1 ? ` ${colorize(`\xD7${occurrences}`, gray)}` : ""} ${colorize("\u2192", gray)} ${finding.message}`
-      );
-      lines.push(
-        `  \u21B3 sample exchange=${finding.exchangeIndex} ${colorize(finding.method, cyan)} ${displayPath} (${statusText})${operationLabel}`
-      );
-      lines.push("");
-      lines.push(`    ${colorize(finding.url, gray)}`);
-      if (finding.specSource || finding.schemaPath || finding.dataPath) {
-        lines.push("");
-        if (finding.specSource) {
-          lines.push(
-            `    ${colorize("spec:", dim)} ${colorize(toRelativeSpecPath(finding.specSource), cyan)}`
-          );
-        }
-        if (finding.schemaPath) {
-          lines.push(`    ${colorize("schemaPath=", dim)} ${colorize(finding.schemaPath, dim)}`);
-        }
-        if (finding.dataPath) {
-          lines.push(`    ${colorize("dataPath=", dim)} ${colorize(finding.dataPath, cyan)}`);
-        }
-      }
-      if (finding.details) {
-        lines.push("");
-        if (finding.ruleId === "security-baseline" && typeof finding.details.summary === "string") {
-          lines.push(`    ${colorize("security:", dim)} ${finding.details.summary}`);
-        } else if (finding.ruleId === "owasp-api-top10" && typeof finding.details.summary === "string") {
-          const issueId = typeof finding.details.issueId === "string" ? finding.details.issueId : null;
-          const issueTitle = typeof finding.details.issueTitle === "string" ? finding.details.issueTitle : null;
-          lines.push(`    ${colorize("owasp:", dim)} ${finding.details.summary}`);
-          if (issueId || issueTitle) {
-            lines.push(
-              `    ${colorize("issue:", dim)} ${[issueId, issueTitle].filter(Boolean).join(" - ")}`
-            );
-          }
-        } else if (finding.ruleId === "schema-consistency" && typeof finding.details.summary === "string") {
-          const detailPath = typeof finding.details.path === "string" ? finding.details.path : null;
-          const expected = typeof finding.details.expected === "string" ? finding.details.expected : null;
-          const actual = typeof finding.details.actual === "string" ? finding.details.actual : null;
-          const suggestion = typeof finding.details.suggestion === "string" ? finding.details.suggestion : null;
-          lines.push(`    ${colorize("schema:", dim)} ${finding.details.summary}`);
-          if (detailPath) {
-            lines.push(`    ${colorize("path:", dim)} ${colorize(detailPath, cyan)}`);
-          }
-          if (expected) {
-            lines.push(`    ${colorize("expected:", dim)} ${expected}`);
-          }
-          if (actual) {
-            lines.push(`    ${colorize("actual:", dim)} ${actual}`);
-          }
-          if (suggestion) {
-            lines.push(`    ${colorize("hint:", dim)}`);
-            for (const suggestionLine of suggestion.split("\n")) {
-              lines.push(`      ${suggestionLine}`);
-            }
-          }
-        } else {
-          lines.push(`    ${colorize("details:", dim)} ${JSON.stringify(finding.details)}`);
-        }
-      }
-      lines.push("");
-    }
-  }
-  const omittedProblemsCount = summary.totalProblemGroups - findingsToRender.length;
-  if (omittedProblemsCount > 0) {
-    if (lines[lines.length - 1] !== "") {
-      lines.push("");
-    }
-    lines.push(
-      colorize(
-        `\u2026 ${omittedProblemsCount} problems omitted from terminal output. Use --format json/csv/sarif for the complete export.`,
-        gray
-      )
-    );
-  } else if (lines[lines.length - 1] === "") {
-    lines.pop();
-  }
-  return `${lines.join("\n")}
-`;
-}
-function renderReport(result, options) {
-  const maxFindings = options.maxFindings ?? 10;
-  switch (options.format) {
-    case "json":
-      return formatJson(result);
-    case "csv":
-      return formatCsv(result);
-    case "sarif":
-      return formatSarif(result);
-    case "pretty":
-      return formatPretty(result, options.color ?? false, maxFindings);
-    default:
-      throw new Error(`Unsupported report format: ${options.format}`);
-  }
-}
-
-// src/commands/drift/engine/validation-session.ts
-import { randomUUID } from "node:crypto";
-
-// src/commands/drift/openapi/matcher.ts
-function toRelativePath(requestPath, server) {
-  const normalizedRequestPath = getPathWithoutTrailingSlash(requestPath || "/") || "/";
-  const normalizedBasePath = getPathWithoutTrailingSlash(server.basePath || "/") || "/";
-  if (normalizedBasePath === "/") {
-    return normalizedRequestPath;
-  }
-  if (normalizedRequestPath === normalizedBasePath) {
-    return "/";
-  }
-  if (!normalizedRequestPath.startsWith(`${normalizedBasePath}/`)) {
-    return null;
-  }
-  return normalizedRequestPath.slice(normalizedBasePath.length) || "/";
-}
-function hostMatches(operationServer, requestHost) {
-  if (!operationServer.host || !requestHost) {
-    return true;
-  }
-  return operationServer.host === requestHost.toLowerCase();
-}
-function decodePathParam(value) {
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    return value;
-  }
-}
-function scoreCandidate(operation, server, mode) {
-  const hostScore = mode === "strict-host" ? server.host ? 20 : 5 : 0;
-  return operation.pathScore * 10 + hostScore;
-}
-function extractPathParams(operation, pathMatch) {
-  const params = {};
-  for (let index = 0; index < operation.pathParams.length; index += 1) {
-    const paramName = operation.pathParams[index];
-    const paramValue = pathMatch[index + 1];
-    if (paramName && paramValue !== void 0) {
-      params[paramName] = decodePathParam(paramValue);
-    }
-  }
-  return params;
-}
-function matchOperationByRelativePath(operationCandidates, relativePath) {
-  const normalizedPath = getPathWithoutTrailingSlash(relativePath) || "/";
-  for (const operation of operationCandidates) {
-    const pathMatch = operation.pathRegex.exec(normalizedPath);
-    if (pathMatch) {
-      return { operation, pathParams: extractPathParams(operation, pathMatch) };
-    }
-  }
-  return null;
-}
-function matchOperation(index, exchange, mode, relativePathOverride) {
-  const method = exchange.request.method.toLowerCase();
-  const operationCandidates = index.operationsByMethod.get(method);
-  if (!operationCandidates || operationCandidates.length === 0) {
-    return null;
-  }
-  if (relativePathOverride !== void 0) {
-    return matchOperationByRelativePath(operationCandidates, relativePathOverride);
-  }
-  let bestCandidate = null;
-  for (const operation of operationCandidates) {
-    for (const server of operation.servers) {
-      if (mode === "strict-host" && !hostMatches(server, exchange.request.host)) {
-        continue;
-      }
-      const relativePath = toRelativePath(exchange.request.path, server);
-      if (!relativePath) {
-        continue;
-      }
-      const pathMatch = operation.pathRegex.exec(relativePath);
-      if (!pathMatch) {
-        continue;
-      }
-      const candidate = {
-        score: scoreCandidate(operation, server, mode),
-        matched: {
-          operation,
-          pathParams: extractPathParams(operation, pathMatch)
-        }
-      };
-      if (!bestCandidate || candidate.score > bestCandidate.score) {
-        bestCandidate = candidate;
-      }
-    }
-  }
-  return bestCandidate?.matched ?? null;
-}
-
-// src/commands/drift/rules/builtins/owasp.ts
-var MAX_EXPOSED_PATHS = 6;
-var MAX_SCAN_NODES = 2e3;
-var MAX_SCAN_ARRAY_ITEMS = 50;
-var MAX_SENSITIVE_QUERY_PARAMS = 5;
-var LARGE_RESPONSE_THRESHOLD_BYTES = 1e6;
-var SENSITIVE_QUERY_KEY_PATTERN = /(?:token|api[_-]?key|apikey|password|passwd|secret|authorization|jwt)/i;
-var SENSITIVE_RESPONSE_KEY_PATTERN = /(?:password|passwd|secret|api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key|ssn|credit[_-]?card|card[_-]?number|cvv)/i;
-var PAGINATION_QUERY_KEYS = /* @__PURE__ */ new Set([
-  "page",
-  "limit",
-  "offset",
-  "cursor",
-  "per_page",
-  "perpage",
-  "size",
-  "start",
-  "after",
-  "before"
-]);
-var MASK_REVEALED_PREFIX_LENGTH = 4;
-var MASK_FULL_THRESHOLD = MASK_REVEALED_PREFIX_LENGTH * 2;
-function maskValue(value) {
-  if (value.length <= MASK_FULL_THRESHOLD) {
-    return "***";
-  }
-  return `${value.slice(0, MASK_REVEALED_PREFIX_LENGTH)}\u2026`;
-}
-function normalizeJsonPointerSegment(segment) {
-  return segment.replace(/~/g, "~0").replace(/\//g, "~1");
-}
-function looksLikePrimitive(value) {
-  return typeof value === "string" || typeof value === "number";
-}
-function isFlagLikeSensitiveField(key) {
-  const lower = key.toLowerCase();
-  if (!(lower.includes("secret") || lower.includes("token") || lower.includes("key"))) {
-    return false;
-  }
-  return lower.startsWith("is") || lower.startsWith("has") || lower.startsWith("can") || lower.startsWith("should") || lower.startsWith("enable") || lower.startsWith("allow");
-}
-function isBooleanLikeValue(value) {
-  if (typeof value === "number") {
-    return value === 0 || value === 1;
-  }
-  const normalized = value.trim().toLowerCase();
-  return normalized === "true" || normalized === "false" || normalized === "0" || normalized === "1";
-}
-function findSensitiveResponsePaths(payload) {
-  if (!isPlainObject(payload) && !Array.isArray(payload)) {
-    return [];
-  }
-  const exposedPaths = [];
-  const queue = [{ value: payload, path: "" }];
-  let visitedNodes = 0;
-  while (queue.length > 0 && visitedNodes < MAX_SCAN_NODES && exposedPaths.length < MAX_EXPOSED_PATHS) {
-    const current = queue.pop();
-    if (!current) {
-      break;
-    }
-    visitedNodes += 1;
-    if (Array.isArray(current.value)) {
-      const limit = Math.min(current.value.length, MAX_SCAN_ARRAY_ITEMS);
-      for (let index = 0; index < limit; index += 1) {
-        const item = current.value[index];
-        if (isPlainObject(item) || Array.isArray(item)) {
-          queue.push({ value: item, path: `${current.path}/${index}` });
-        }
-      }
-      continue;
-    }
-    if (!isPlainObject(current.value)) {
-      continue;
-    }
-    for (const [key, value] of Object.entries(current.value)) {
-      const pointerPath = `${current.path}/${normalizeJsonPointerSegment(key)}`;
-      if (SENSITIVE_RESPONSE_KEY_PATTERN.test(key) && looksLikePrimitive(value)) {
-        const stringified = String(value);
-        if (isFlagLikeSensitiveField(key) && isBooleanLikeValue(value)) {
-          continue;
-        }
-        if (stringified.length > 0) {
-          exposedPaths.push(pointerPath || "/");
-          if (exposedPaths.length >= MAX_EXPOSED_PATHS) {
-            break;
-          }
-        }
-      }
-      if (isPlainObject(value) || Array.isArray(value)) {
-        queue.push({ value, path: pointerPath });
-      }
-    }
-  }
-  return exposedPaths;
-}
-function hasPaginationHint(query) {
-  for (const key of query.keys()) {
-    if (PAGINATION_QUERY_KEYS.has(key.toLowerCase())) {
-      return true;
-    }
-  }
-  return false;
-}
-function buildSecurityFinding(context, message, target, severity, details) {
-  return {
-    ruleId: "owasp-api-top10",
-    severity,
-    category: "security",
-    message,
-    exchangeIndex: context.exchange.index,
-    operationId: context.matchedOperation?.operation.operationId,
-    specSource: context.matchedOperation?.operation.specSource,
-    target,
-    details
-  };
-}
-function detectSensitiveQueryParams(context) {
-  const matches = [];
-  for (const [key, value] of context.exchange.request.query.entries()) {
-    if (!SENSITIVE_QUERY_KEY_PATTERN.test(key)) {
-      continue;
-    }
-    matches.push({
-      key,
-      valuePreview: maskValue(value)
-    });
-    if (matches.length >= MAX_SENSITIVE_QUERY_PARAMS) {
-      break;
-    }
-  }
-  if (matches.length === 0) {
-    return [];
-  }
-  return [
-    buildSecurityFinding(
-      context,
-      "Sensitive credential-like query parameters detected",
-      "request",
-      "warning",
-      {
-        issueId: "API2:2023",
-        issueTitle: "Broken Authentication",
-        summary: "Authentication data should not be passed via query parameters because it can leak via logs, browser history, and referrers.",
-        sensitiveQueryParams: matches
-      }
-    )
-  ];
-}
-function detectInsecureCors(context) {
-  const response = context.exchange.response;
-  if (!response) {
-    return [];
-  }
-  const allowOrigin = response.headers["access-control-allow-origin"]?.trim();
-  const allowCredentials = response.headers["access-control-allow-credentials"]?.trim().toLowerCase();
-  if (allowOrigin !== "*" || allowCredentials !== "true") {
-    return [];
-  }
-  return [
-    buildSecurityFinding(
-      context,
-      "Insecure CORS policy: wildcard origin with credentials enabled",
-      "response",
-      "error",
-      {
-        issueId: "API8:2023",
-        issueTitle: "Security Misconfiguration",
-        summary: 'Access-Control-Allow-Origin is "*" while Access-Control-Allow-Credentials is true. Browsers may expose authenticated API responses to untrusted origins.',
-        headers: {
-          accessControlAllowOrigin: allowOrigin,
-          accessControlAllowCredentials: allowCredentials
-        }
-      }
-    )
-  ];
-}
-function detectWeakCookieAttributes(context) {
-  const response = context.exchange.response;
-  if (!response) {
-    return [];
-  }
-  const setCookie = response.headers["set-cookie"];
-  if (!setCookie) {
-    return [];
-  }
-  const findings = [];
-  for (const cookie of splitSetCookieHeader(setCookie)) {
-    const attributeNames = new Set(
-      cookie.split(";").slice(1).map((attribute) => attribute.split("=")[0].trim().toLowerCase())
-    );
-    if (context.exchange.request.protocol === "https:" && !attributeNames.has("secure")) {
-      findings.push(
-        buildSecurityFinding(
-          context,
-          'Set-Cookie header is missing "Secure" attribute',
-          "response",
-          "warning",
-          {
-            issueId: "API2:2023",
-            issueTitle: "Broken Authentication",
-            summary: 'Session cookies over HTTPS should include "Secure" to prevent transmission over plain HTTP.',
-            setCookiePreview: cookie.slice(0, 200)
-          }
-        )
-      );
-    }
-    if (!attributeNames.has("httponly")) {
-      findings.push(
-        buildSecurityFinding(
-          context,
-          'Set-Cookie header is missing "HttpOnly" attribute',
-          "response",
-          "warning",
-          {
-            issueId: "API2:2023",
-            issueTitle: "Broken Authentication",
-            summary: 'Session cookies should include "HttpOnly" to reduce risk of token theft via client-side script access.',
-            setCookiePreview: cookie.slice(0, 200)
-          }
-        )
-      );
-    }
-    if (!attributeNames.has("samesite")) {
-      findings.push(
-        buildSecurityFinding(
-          context,
-          'Set-Cookie header is missing "SameSite" attribute',
-          "response",
-          "info",
-          {
-            issueId: "API8:2023",
-            issueTitle: "Security Misconfiguration",
-            summary: 'Set "SameSite" on session cookies to reduce CSRF risk for state-changing requests.',
-            setCookiePreview: cookie.slice(0, 200)
-          }
-        )
-      );
-    }
-  }
-  return findings;
-}
-function detectSensitiveResponseData(context) {
-  const response = context.exchange.response;
-  if (!response || response.bodyJson === void 0) {
-    return [];
-  }
-  const exposedPaths = findSensitiveResponsePaths(response.bodyJson);
-  if (exposedPaths.length === 0) {
-    return [];
-  }
-  return [
-    buildSecurityFinding(
-      context,
-      "Potential sensitive data exposure in response payload",
-      "response",
-      "warning",
-      {
-        issueId: "API3:2019",
-        issueTitle: "Excessive Data Exposure",
-        summary: `Sensitive-looking fields detected in response payload: ${exposedPaths.join(", ")}`,
-        exposedPaths
-      }
-    )
-  ];
-}
-function detectLargeUnpaginatedResponses(context) {
-  const response = context.exchange.response;
-  if (!response || response.status >= 400 || context.exchange.request.method !== "GET") {
-    return [];
-  }
-  if (!response.bodyText || response.bodyText.length < LARGE_RESPONSE_THRESHOLD_BYTES) {
-    return [];
-  }
-  if (hasPaginationHint(context.exchange.request.query)) {
-    return [];
-  }
-  return [
-    buildSecurityFinding(
-      context,
-      "Large response without pagination parameters (possible resource-consumption risk)",
-      "response",
-      "info",
-      {
-        issueId: "API4:2023",
-        issueTitle: "Unrestricted Resource Consumption",
-        summary: "A large response was returned without common pagination query parameters. Consider explicit page/limit controls for large collections.",
-        responseBytes: response.bodyText.length
-      }
-    )
-  ];
-}
-var OwaspApiTop10Rule = class {
-  id = "owasp-api-top10";
-  analyze(context) {
-    if (!context.matchedOperation) {
-      return [];
-    }
-    return [
-      ...detectSensitiveQueryParams(context),
-      ...detectInsecureCors(context),
-      ...detectWeakCookieAttributes(context),
-      ...detectSensitiveResponseData(context),
-      ...detectLargeUnpaginatedResponses(context)
-    ];
-  }
-};
-
-// src/commands/drift/rules/builtins/schema.ts
-var MAX_ACTUAL_VALUE_LENGTH = 200;
-function hasBodyContent(bodyText) {
-  return bodyText !== void 0 && bodyText !== "";
-}
-function parseCookies(headerValue) {
-  if (!headerValue) {
-    return {};
-  }
-  const cookies = {};
-  for (const pair of headerValue.split(";")) {
-    const [rawName, ...rawValueParts] = pair.trim().split("=");
-    if (!rawName) {
-      continue;
-    }
-    const value = rawValueParts.join("=").trim();
-    cookies[rawName] = value;
-  }
-  return cookies;
-}
-function decodeJsonPointerSegment(segment) {
-  return segment.replace(/~1/g, "/").replace(/~0/g, "~");
-}
-function encodeJsonPointerSegment(segment) {
-  return segment.replace(/~/g, "~0").replace(/\//g, "~1");
-}
-function normalizeJsonPointer(pointer) {
-  if (!pointer || pointer === "#") {
-    return "";
-  }
-  if (pointer.startsWith("#")) {
-    return pointer.slice(1);
-  }
-  return pointer;
-}
-function jsonPointerSegments(pointer) {
-  const normalized = normalizeJsonPointer(pointer);
-  if (!normalized || normalized === "/") {
-    return [];
-  }
-  return normalized.split("/").slice(1).map((segment) => decodeJsonPointerSegment(segment));
-}
-function joinJsonPointer(basePath, segment) {
-  const baseSegments = jsonPointerSegments(basePath);
-  return `/${[...baseSegments, encodeJsonPointerSegment(segment)].join("/")}`;
-}
-function getValueAtJsonPointer(root, pointer) {
-  const segments = jsonPointerSegments(pointer);
-  let current = root;
-  for (const segment of segments) {
-    if (Array.isArray(current)) {
-      const index = Number.parseInt(segment, 10);
-      if (!Number.isInteger(index) || index < 0 || index >= current.length) {
-        return void 0;
-      }
-      current = current[index];
-      continue;
-    }
-    if (!isPlainObject(current)) {
-      return void 0;
-    }
-    current = current[segment];
-  }
-  return current;
-}
-function normalizeDataPathForError(error) {
-  const basePath = error.instancePath ?? "";
-  const params = error.params ?? {};
-  if (error.keyword === "required" && typeof params.missingProperty === "string") {
-    return joinJsonPointer(basePath, params.missingProperty);
-  }
-  if (error.keyword === "additionalProperties" && typeof params.additionalProperty === "string") {
-    return joinJsonPointer(basePath, params.additionalProperty);
-  }
-  return basePath;
-}
-function renderReadablePath(pointer) {
-  const segments = jsonPointerSegments(pointer);
-  if (segments.length === 0) {
-    return "root";
-  }
-  const pathParts = [];
-  for (const segment of segments) {
-    if (/^\d+$/.test(segment)) {
-      pathParts.push(`[${segment}]`);
-    } else if (pathParts.length === 0) {
-      pathParts.push(segment);
-    } else {
-      pathParts.push(`.${segment}`);
-    }
-  }
-  return pathParts.join("");
-}
-function compactActualValue(value) {
-  if (value === void 0) {
-    return "[missing]";
-  }
-  const serialized = JSON.stringify(value);
-  if (!serialized) {
-    return String(value);
-  }
-  return serialized.length > MAX_ACTUAL_VALUE_LENGTH ? `${serialized.slice(0, MAX_ACTUAL_VALUE_LENGTH)}\u2026` : serialized;
-}
-function createExpectedHint(error) {
-  const params = error.params ?? {};
-  if (error.keyword === "required" && typeof params.missingProperty === "string") {
-    return `required field "${params.missingProperty}"`;
-  }
-  if (error.keyword === "type" && typeof params.type === "string") {
-    return `type "${params.type}"`;
-  }
-  if (error.keyword === "additionalProperties") {
-    return "no additional undocumented properties";
-  }
-  if (error.keyword === "format" && typeof params.format === "string") {
-    return `format "${params.format}"`;
-  }
-  return void 0;
-}
-function createFallbackSchemaErrorSummary(target, error, highlightedDataPath) {
-  const targetLabel = target === "request" ? "Request" : "Response";
-  const params = error.params ?? {};
-  const location = renderReadablePath(highlightedDataPath);
-  if (error.keyword === "required" && typeof params.missingProperty === "string") {
-    return `${targetLabel} is missing required field "${location}".`;
-  }
-  if (error.keyword === "additionalProperties" && typeof params.additionalProperty === "string") {
-    return `${targetLabel} has undocumented field "${location}".`;
-  }
-  if (error.keyword === "type" && typeof params.type === "string") {
-    return `${targetLabel} field "${location}" must be ${params.type}.`;
-  }
-  if (error.keyword === "enum") {
-    return `${targetLabel} field "${location}" has a value outside allowed enum values.`;
-  }
-  if (error.keyword === "format" && typeof params.format === "string") {
-    return `${targetLabel} field "${location}" does not match format "${params.format}".`;
-  }
-  return `${targetLabel} schema mismatch at "${location}": ${error.message ?? "validation error"}`;
-}
-function createSchemaErrorDetails(value, error, target) {
-  const highlightedDataPath = normalizeDataPathForError(error);
-  const actualValue = getValueAtJsonPointer(value, highlightedDataPath);
-  const summary = createFallbackSchemaErrorSummary(target, error, highlightedDataPath);
-  return {
-    summary,
-    keyword: error.keyword ?? null,
-    path: highlightedDataPath || "/",
-    expected: createExpectedHint(error) ?? null,
-    actual: compactActualValue(actualValue),
-    suggestion: null,
-    params: error.params ?? {},
-    ajvMessage: error.message ?? "validation error"
-  };
-}
-function validateParameter(parameter, actualValue, context, findings) {
-  if (actualValue === void 0 || actualValue === null || !parameter.schema) {
-    return;
-  }
-  const result = context.validateSchema(parameter.schema, actualValue, { coerce: true });
-  if (result.valid) {
-    return;
-  }
-  for (const error of result.errors) {
-    const details = createSchemaErrorDetails(actualValue, error, "request");
-    findings.push({
-      ruleId: "schema-consistency",
-      severity: "error",
-      category: "schema",
-      message: `Invalid ${parameter.in} parameter "${parameter.name}": ${typeof details.summary === "string" ? details.summary : error.message ?? "schema mismatch"}`,
-      exchangeIndex: context.exchange.index,
-      operationId: context.matchedOperation?.operation.operationId,
-      specSource: context.matchedOperation?.operation.specSource,
-      target: "request",
-      schemaPath: error.schemaPath,
-      dataPath: normalizeDataPathForError(error),
-      details: {
-        ...details,
-        parameter: {
-          name: parameter.name,
-          in: parameter.in
-        }
-      }
-    });
-  }
-}
-var DEEP_OBJECT_QUERY_KEY_REGEX = /^([^[\]]+)\[([^[\]]+)\]$/;
-function parseDeepObjectQueryKey(key) {
-  const keyMatch = key.match(DEEP_OBJECT_QUERY_KEY_REGEX);
-  return keyMatch ? { parameterName: keyMatch[1], property: keyMatch[2] } : void 0;
-}
-function getDeepObjectParameterValue(parameterName, query) {
-  let objectValue;
-  for (const [key, value] of query) {
-    const deepObjectKey = parseDeepObjectQueryKey(key);
-    if (deepObjectKey?.parameterName === parameterName) {
-      objectValue ??= {};
-      objectValue[deepObjectKey.property] = value;
-    }
-  }
-  return objectValue;
-}
-function getActualParameterValue(parameter, context, cookies) {
-  switch (parameter.in) {
-    case "path":
-      return context.matchedOperation?.pathParams[parameter.name];
-    case "query": {
-      if (parameter.style === "deepObject") {
-        return getDeepObjectParameterValue(parameter.name, context.exchange.request.query);
-      }
-      const values = context.exchange.request.query.getAll(parameter.name);
-      if (values.length === 0) {
-        return void 0;
-      }
-      const schemaType = isPlainObject(parameter.schema) ? parameter.schema.type : void 0;
-      if (schemaType === "array" || values.length > 1) {
-        return values;
-      }
-      return values[0];
-    }
-    case "header":
-      return context.exchange.request.headers[parameter.name.toLowerCase()];
-    case "cookie":
-      return cookies[parameter.name];
-    default:
-      return void 0;
-  }
-}
-function createUndocumentedParameterFindings(context, matchedOperation) {
-  const findings = [];
-  const paramsByLocation = {
-    query: /* @__PURE__ */ new Set(),
-    header: /* @__PURE__ */ new Set(),
-    cookie: /* @__PURE__ */ new Set()
-  };
-  const deepObjectQueryParams = /* @__PURE__ */ new Set();
-  for (const parameter of matchedOperation.operation.requestParameters) {
-    if (parameter.in === "header") {
-      paramsByLocation.header.add(parameter.name.toLowerCase());
-    } else if (parameter.in === "query" || parameter.in === "cookie") {
-      paramsByLocation[parameter.in].add(parameter.name);
-      if (parameter.in === "query" && parameter.style === "deepObject") {
-        deepObjectQueryParams.add(parameter.name);
-      }
-    }
-  }
-  for (const name of new Set(context.exchange.request.query.keys())) {
-    if (paramsByLocation.query.has(name)) {
-      continue;
-    }
-    const deepObjectKey = parseDeepObjectQueryKey(name);
-    if (deepObjectKey && deepObjectQueryParams.has(deepObjectKey.parameterName)) {
-      continue;
-    }
-    findings.push({
-      ruleId: "schema-consistency",
-      severity: "warning",
-      category: "documentation",
-      message: `Undocumented query parameter in traffic: "${name}"`,
-      exchangeIndex: context.exchange.index,
-      operationId: matchedOperation.operation.operationId,
-      specSource: matchedOperation.operation.specSource,
-      target: "request"
-    });
-  }
-  for (const headerName of Object.keys(context.exchange.request.headers)) {
-    if (shouldIgnoreHeaderAsUndocumented(headerName, context.ignoreHeaders)) {
-      continue;
-    }
-    if (!paramsByLocation.header.has(headerName.toLowerCase())) {
-      findings.push({
-        ruleId: "schema-consistency",
-        severity: "info",
-        category: "documentation",
-        message: `Undocumented header in traffic: "${headerName}"`,
-        exchangeIndex: context.exchange.index,
-        operationId: matchedOperation.operation.operationId,
-        specSource: matchedOperation.operation.specSource,
-        target: "request"
-      });
-    }
-  }
-  return findings;
-}
-function isRequestRejectedByServer(context) {
-  const response = context.exchange.response;
-  return response !== void 0 && response.status >= 400 && response.status < 500;
-}
-function pickResponseSchema(context, matchedOperation) {
-  const response = context.exchange.response;
-  if (!response) {
-    return void 0;
-  }
-  const statusCode = String(response.status);
-  const statusClass = `${Math.floor(response.status / 100)}XX`;
-  const responseContentMap = matchedOperation.operation.responseBodyContent[statusCode] ?? matchedOperation.operation.responseBodyContent[statusClass] ?? matchedOperation.operation.responseBodyContent[statusClass.toLowerCase()] ?? matchedOperation.operation.responseBodyContent.default;
-  if (!responseContentMap) {
-    return void 0;
-  }
-  return pickSchemaByMime(responseContentMap, response.contentType);
-}
-function validateSchemaResult(schema, value, context, target) {
-  const result = context.validateSchema(schema, value, { target });
-  if (result.valid) {
-    return [];
-  }
-  return result.errors.map((error) => {
-    const details = createSchemaErrorDetails(value, error, target);
-    return {
-      ruleId: "schema-consistency",
-      severity: "error",
-      category: "schema",
-      message: typeof details.summary === "string" ? details.summary : `Schema mismatch (${target}): ${error.message ?? "validation error"}`,
-      exchangeIndex: context.exchange.index,
-      operationId: context.matchedOperation?.operation.operationId,
-      specSource: context.matchedOperation?.operation.specSource,
-      target,
-      schemaPath: error.schemaPath,
-      dataPath: normalizeDataPathForError(error),
-      details
-    };
-  });
-}
-var SchemaConsistencyRule = class {
-  id = "schema-consistency";
-  analyze(context) {
-    const matchedOperation = context.matchedOperation;
-    if (!matchedOperation) {
-      return [];
-    }
-    const findings = [];
-    const cookies = parseCookies(context.exchange.request.headers.cookie);
-    findings.push(...createUndocumentedParameterFindings(context, matchedOperation));
-    if (!isRequestRejectedByServer(context)) {
-      for (const parameter of matchedOperation.operation.requestParameters) {
-        if (context.ignoreCookies && parameter.in === "cookie") {
-          continue;
-        }
-        const actualValue = getActualParameterValue(parameter, context, cookies);
-        if (parameter.required && (actualValue === void 0 || actualValue === null)) {
-          findings.push({
-            ruleId: this.id,
-            severity: "error",
-            category: "documentation",
-            message: `Missing required ${parameter.in} parameter: "${parameter.name}"`,
-            exchangeIndex: context.exchange.index,
-            operationId: matchedOperation.operation.operationId,
-            specSource: matchedOperation.operation.specSource,
-            target: "request"
-          });
-          continue;
-        }
-        validateParameter(parameter, actualValue, context, findings);
-      }
-      const requestContentType = context.exchange.request.contentType;
-      const requestSchema = pickSchemaByMime(
-        matchedOperation.operation.requestBodyContent,
-        requestContentType
-      );
-      const hasRequestBody = hasBodyContent(context.exchange.request.bodyText);
-      if (matchedOperation.operation.requestBodyRequired && !hasRequestBody) {
-        findings.push({
-          ruleId: this.id,
-          severity: "error",
-          category: "documentation",
-          message: "Missing required request body",
-          exchangeIndex: context.exchange.index,
-          operationId: matchedOperation.operation.operationId,
-          specSource: matchedOperation.operation.specSource,
-          target: "request"
-        });
-      }
-      if (requestSchema && hasRequestBody && isJsonMime(requestContentType)) {
-        if (context.exchange.request.bodyJson === void 0) {
-          findings.push({
-            ruleId: this.id,
-            severity: "error",
-            category: "schema",
-            message: "Request body is not valid JSON for JSON content-type",
-            exchangeIndex: context.exchange.index,
-            operationId: matchedOperation.operation.operationId,
-            specSource: matchedOperation.operation.specSource,
-            target: "request"
-          });
-        } else {
-          findings.push(
-            ...validateSchemaResult(
-              requestSchema,
-              context.exchange.request.bodyJson,
-              context,
-              "request"
-            )
-          );
-        }
-      }
-    }
-    const responseSchema = pickResponseSchema(context, matchedOperation);
-    if (responseSchema && context.exchange.response && hasBodyContent(context.exchange.response.bodyText)) {
-      const responseContentType = context.exchange.response.contentType;
-      if (isJsonMime(responseContentType)) {
-        if (context.exchange.response.bodyJson === void 0) {
-          findings.push({
-            ruleId: this.id,
-            severity: "error",
-            category: "schema",
-            message: "Response body is not valid JSON for JSON content-type",
-            exchangeIndex: context.exchange.index,
-            operationId: matchedOperation.operation.operationId,
-            specSource: matchedOperation.operation.specSource,
-            target: "response"
-          });
-        } else {
-          findings.push(
-            ...validateSchemaResult(
-              responseSchema,
-              context.exchange.response.bodyJson,
-              context,
-              "response"
-            )
-          );
-        }
-      }
-    }
-    return findings;
-  }
-};
-
-// src/commands/drift/rules/builtins/security.ts
-function extractAuthorizationScheme(authorizationHeader) {
-  if (!authorizationHeader) {
-    return null;
-  }
-  const [scheme] = authorizationHeader.trim().split(/\s+/, 1);
-  return scheme ? scheme.toLowerCase() : null;
-}
-function hasAuthorizationHeader(context) {
-  return Boolean(context.exchange.request.headers.authorization);
-}
-function hasCookieValue(cookieHeader, cookieName) {
-  if (!cookieHeader) {
-    return false;
-  }
-  return cookieHeader.split(";").map((part) => part.trim()).some((part) => part.startsWith(`${cookieName}=`));
-}
-function evaluateScheme(context, schemeName) {
-  const operation = context.matchedOperation?.operation;
-  if (!operation) {
-    return {
-      schemeName,
-      schemeType: "unknown",
-      satisfied: true,
-      reason: "No matched OpenAPI operation."
-    };
-  }
-  const scheme = operation.securitySchemes[schemeName];
-  if (!scheme) {
-    return {
-      schemeName,
-      schemeType: "missing",
-      satisfied: false,
-      reason: "Security scheme is referenced but not defined in components.securitySchemes."
-    };
-  }
-  const schemeType = String(scheme.type ?? "unknown");
-  if (scheme.type === "apiKey") {
-    const parameterName = String(scheme.name ?? "");
-    const parameterLocation = String(scheme.in ?? "header");
-    if (!parameterName) {
-      return {
-        schemeName,
-        schemeType,
-        satisfied: false,
-        reason: 'apiKey scheme is missing the "name" field in the OpenAPI spec.'
-      };
-    }
-    if (parameterLocation === "header") {
-      const present = Boolean(context.exchange.request.headers[parameterName.toLowerCase()]);
-      return {
-        schemeName,
-        schemeType,
-        satisfied: present,
-        reason: present ? `Found required apiKey header "${parameterName}".` : `Missing required apiKey header "${parameterName}".`
-      };
-    }
-    if (parameterLocation === "query") {
-      const present = context.exchange.request.query.has(parameterName);
-      return {
-        schemeName,
-        schemeType,
-        satisfied: present,
-        reason: present ? `Found required apiKey query parameter "${parameterName}".` : `Missing required apiKey query parameter "${parameterName}".`
-      };
-    }
-    if (parameterLocation === "cookie") {
-      if (context.ignoreCookies) {
-        return {
-          schemeName,
-          schemeType,
-          satisfied: true,
-          skipped: true,
-          reason: `Skipped apiKey cookie "${parameterName}" validation because --ignore-cookies is enabled.`
-        };
-      }
-      const present = hasCookieValue(context.exchange.request.headers.cookie, parameterName);
-      return {
-        schemeName,
-        schemeType,
-        satisfied: present,
-        reason: present ? `Found required apiKey cookie "${parameterName}".` : `Missing required apiKey cookie "${parameterName}".`
-      };
-    }
-    return {
-      schemeName,
-      schemeType,
-      satisfied: false,
-      reason: `Unsupported apiKey location "${parameterLocation}" in OpenAPI security scheme.`
-    };
-  }
-  if (scheme.type === "http") {
-    const auth = context.exchange.request.headers.authorization;
-    if (!auth) {
-      return {
-        schemeName,
-        schemeType,
-        satisfied: false,
-        reason: "Missing Authorization header."
-      };
-    }
-    const httpScheme = String(scheme.scheme ?? "").toLowerCase();
-    const actualAuthScheme = extractAuthorizationScheme(auth);
-    if (!httpScheme) {
-      return {
-        schemeName,
-        schemeType,
-        satisfied: true,
-        reason: "Authorization header is present and no specific HTTP auth scheme is documented."
-      };
-    }
-    if (!actualAuthScheme) {
-      return {
-        schemeName,
-        schemeType,
-        satisfied: false,
-        reason: "Authorization header is malformed and does not include an auth scheme."
-      };
-    }
-    const satisfied = actualAuthScheme === httpScheme;
-    return {
-      schemeName,
-      schemeType,
-      satisfied,
-      reason: satisfied ? `Authorization uses expected "${httpScheme}" scheme.` : `Authorization uses "${actualAuthScheme}" but "${httpScheme}" is required.`
-    };
-  }
-  if (scheme.type === "oauth2" || scheme.type === "openIdConnect") {
-    const auth = context.exchange.request.headers.authorization;
-    if (!auth) {
-      return {
-        schemeName,
-        schemeType,
-        satisfied: false,
-        reason: "Missing Authorization header for OAuth2/OpenID Connect scheme."
-      };
-    }
-    const actualAuthScheme = extractAuthorizationScheme(auth);
-    const satisfied = actualAuthScheme === "bearer";
-    return {
-      schemeName,
-      schemeType,
-      satisfied,
-      reason: satisfied ? "Authorization uses bearer token as expected for OAuth2/OpenID Connect." : `Authorization scheme "${actualAuthScheme ?? "unknown"}" does not satisfy OAuth2/OpenID Connect (expected bearer).`
-    };
-  }
-  if (scheme.type === "mutualTLS") {
-    return {
-      schemeName,
-      schemeType,
-      satisfied: true,
-      reason: "mutualTLS cannot be validated from HTTP traffic logs alone."
-    };
-  }
-  return {
-    schemeName,
-    schemeType,
-    satisfied: false,
-    reason: `Unsupported security scheme type "${schemeType}".`
-  };
-}
-function evaluateSecurityRequirements(context) {
-  const security = context.matchedOperation?.operation.security;
-  if (!security) {
-    return {
-      satisfied: true,
-      requirements: []
-    };
-  }
-  if (security.length === 0) {
-    return {
-      satisfied: true,
-      requirements: []
-    };
-  }
-  const requirements = security.map((requirement, requirementIndex) => {
-    const schemeNames = Object.keys(requirement);
-    if (schemeNames.length === 0) {
-      return {
-        requirementIndex,
-        satisfied: true,
-        schemeResults: []
-      };
-    }
-    const schemeResults = schemeNames.map((schemeName) => evaluateScheme(context, schemeName));
-    return {
-      requirementIndex,
-      satisfied: schemeResults.every((result) => result.satisfied),
-      schemeResults
-    };
-  });
-  return {
-    satisfied: requirements.some((requirement) => requirement.satisfied),
-    requirements
-  };
-}
-function collectSecurityIssues(evaluation) {
-  const issues = [];
-  for (const requirement of evaluation.requirements) {
-    for (const schemeResult of requirement.schemeResults) {
-      if (!schemeResult.satisfied) {
-        issues.push({
-          requirement: requirement.requirementIndex + 1,
-          schemeName: schemeResult.schemeName,
-          reason: schemeResult.reason
-        });
-      }
-    }
-  }
-  return issues;
-}
-function collectSkippedSecurityChecks(evaluation) {
-  const skippedChecks = [];
-  for (const requirement of evaluation.requirements) {
-    for (const schemeResult of requirement.schemeResults) {
-      if (schemeResult.skipped) {
-        skippedChecks.push({
-          requirement: requirement.requirementIndex + 1,
-          schemeName: schemeResult.schemeName,
-          reason: schemeResult.reason
-        });
-      }
-    }
-  }
-  return skippedChecks;
-}
-function createSecuritySummary(issues) {
-  if (issues.length === 0) {
-    return "All documented security requirements are satisfied.";
-  }
-  const groupedByRequirement = /* @__PURE__ */ new Map();
-  for (const issue of issues) {
-    const grouped = groupedByRequirement.get(issue.requirement);
-    if (grouped) {
-      grouped.push(issue);
-    } else {
-      groupedByRequirement.set(issue.requirement, [issue]);
-    }
-  }
-  const optionSummaries = Array.from(groupedByRequirement.entries()).sort((a, b) => a[0] - b[0]).map(([requirement, optionIssues]) => {
-    const schemeNames = optionIssues.map((issue) => issue.schemeName).join(" + ");
-    const reasons = optionIssues.map((issue) => issue.reason).join(" ");
-    return `Option ${requirement} (${schemeNames}): ${reasons}`;
-  });
-  if (optionSummaries.length === 1) {
-    return `Authentication check failed. ${optionSummaries[0]}`;
-  }
-  return `None of the documented authentication options matched. Any one of these options would satisfy the OpenAPI security requirements: ${optionSummaries.join(
-    " | "
-  )}`;
-}
-function getSensitiveQueryKeys(context) {
-  return Array.from(context.exchange.request.query.keys()).filter((key) => {
-    const normalizedKey = key.toLowerCase();
-    return normalizedKey.includes("token") || normalizedKey.includes("apikey") || normalizedKey.includes("api_key") || normalizedKey.includes("access_key");
-  });
-}
-var LOOPBACK_HOSTNAME_PATTERN = /^(?:(?:.+\.)?localhost|127(?:\.\d{1,3}){3}|::1)$/i;
-function isLoopbackRequest(request) {
-  let hostname;
-  try {
-    hostname = new URL(request.url).hostname;
-  } catch {
-    hostname = request.host?.replace(/:\d+$/, "");
-  }
-  if (!hostname) {
-    return false;
-  }
-  return LOOPBACK_HOSTNAME_PATTERN.test(hostname.replace(/^\[|\]$/g, ""));
-}
-function shouldFlagInsecureTransport(context) {
-  if (context.exchange.request.protocol !== "http:" || !context.exchange.request.protocolKnown || isLoopbackRequest(context.exchange.request)) {
-    return {
-      flag: false,
-      hasAuthHeader: false,
-      sensitiveQueryKeys: []
-    };
-  }
-  const hasAuthHeader = hasAuthorizationHeader(context);
-  const sensitiveQueryKeys = getSensitiveQueryKeys(context);
-  return {
-    flag: hasAuthHeader || sensitiveQueryKeys.length > 0,
-    hasAuthHeader,
-    sensitiveQueryKeys
-  };
-}
-var SecurityRule = class {
-  id = "security-baseline";
-  analyze(context) {
-    if (!context.matchedOperation) {
-      return [];
-    }
-    const findings = [];
-    const securityEvaluation = evaluateSecurityRequirements(context);
-    if (!securityEvaluation.satisfied) {
-      const issues = collectSecurityIssues(securityEvaluation);
-      findings.push({
-        ruleId: this.id,
-        severity: "error",
-        category: "security",
-        message: "Request does not satisfy documented OpenAPI security requirements",
-        exchangeIndex: context.exchange.index,
-        operationId: context.matchedOperation.operation.operationId,
-        specSource: context.matchedOperation.operation.specSource,
-        target: "request",
-        details: {
-          summary: createSecuritySummary(issues),
-          failedChecks: issues,
-          skippedChecks: collectSkippedSecurityChecks(securityEvaluation),
-          authorizationScheme: extractAuthorizationScheme(
-            context.exchange.request.headers.authorization
-          ),
-          hasAuthorizationHeader: hasAuthorizationHeader(context)
-        }
-      });
-    } else {
-      const skippedChecks = collectSkippedSecurityChecks(securityEvaluation);
-      if (skippedChecks.length > 0) {
-        findings.push({
-          ruleId: this.id,
-          severity: "info",
-          category: "security",
-          message: "Some documented cookie-based security checks were skipped",
-          exchangeIndex: context.exchange.index,
-          operationId: context.matchedOperation.operation.operationId,
-          specSource: context.matchedOperation.operation.specSource,
-          target: "request",
-          details: {
-            summary: skippedChecks.map(
-              (check) => `Skipped option ${check.requirement} (${check.schemeName}): ${check.reason}`
-            ).join(" "),
-            skippedChecks
-          }
-        });
-      }
-    }
-    const insecureTransport = shouldFlagInsecureTransport(context);
-    if (insecureTransport.flag) {
-      findings.push({
-        ruleId: this.id,
-        severity: "warning",
-        category: "security",
-        message: "Potential credential exposure over insecure HTTP transport",
-        exchangeIndex: context.exchange.index,
-        operationId: context.matchedOperation.operation.operationId,
-        specSource: context.matchedOperation.operation.specSource,
-        target: "request",
-        details: {
-          protocol: context.exchange.request.protocol,
-          hasAuthorizationHeader: insecureTransport.hasAuthHeader,
-          sensitiveQueryKeys: insecureTransport.sensitiveQueryKeys
-        }
-      });
-    }
-    return findings;
-  }
-};
-
-// src/commands/drift/rules/builtins/undocumented-endpoint.ts
-var UndocumentedEndpointRule = class {
-  id = "undocumented-endpoint";
-  analyze(context) {
-    if (context.matchedOperation) {
-      return [];
-    }
-    const { method, path: path2, host } = context.exchange.request;
-    const isHostMismatch = context.matchMode === "strict-host" && !context.hostCompatibleWithSpecServers;
-    const message = isHostMismatch ? `Undocumented server: ${method} ${path2} was sent to "${host}", which does not match any server in the description` : `Undocumented endpoint: ${method} ${path2}`;
-    return [
-      {
-        ruleId: this.id,
-        severity: "error",
-        category: "documentation",
-        message,
-        exchangeIndex: context.exchange.index,
-        target: "request"
-      }
-    ];
-  }
-};
-
-// src/commands/drift/rules/registry.ts
-var BUILTIN_RULE_FACTORIES = {
-  "undocumented-endpoint": () => new UndocumentedEndpointRule(),
-  "schema-consistency": () => new SchemaConsistencyRule(),
-  "security-baseline": () => new SecurityRule(),
-  "owasp-api-top10": () => new OwaspApiTop10Rule()
-};
-var BUILTIN_RULE_IDS = Object.keys(BUILTIN_RULE_FACTORIES);
-var DEFAULT_BUILTIN_RULE_IDS = [
-  "undocumented-endpoint",
-  "schema-consistency",
-  "security-baseline"
-];
-function loadRules(activeRuleIds) {
-  if (!activeRuleIds || activeRuleIds.length === 0) {
-    return DEFAULT_BUILTIN_RULE_IDS.map((ruleId) => BUILTIN_RULE_FACTORIES[ruleId]());
-  }
-  return [...new Set(activeRuleIds)].map((ruleId) => {
-    const factory = BUILTIN_RULE_FACTORIES[ruleId];
-    if (!factory) {
-      throw new Error(
-        `Unknown rule id: "${ruleId}". Available rules: ${BUILTIN_RULE_IDS.join(", ")}`
-      );
-    }
-    return factory();
-  });
-}
-
-// src/commands/drift/engine/schema-validator.ts
-var import__ = __toESM(require__(), 1);
-var import_ajv_formats = __toESM(require_dist(), 1);
-var AjvConstructor = import__.default;
-var applyFormats = import_ajv_formats.default;
-function isPropertyExcludedFromTarget(propertySchema, target) {
-  if (!isPlainObject(propertySchema)) {
-    return false;
-  }
-  return target === "request" ? propertySchema.readOnly === true : propertySchema.writeOnly === true;
-}
-function isRequiredNameExcludedFromTarget(schema, name, target, seen = /* @__PURE__ */ new WeakSet()) {
-  if (!isPlainObject(schema) || seen.has(schema)) {
-    return false;
-  }
-  seen.add(schema);
-  const properties = schema.properties;
-  if (isPlainObject(properties) && isPropertyExcludedFromTarget(properties[name], target)) {
-    return true;
-  }
-  return [schema.allOf, schema.oneOf, schema.anyOf].some(
-    (branches) => Array.isArray(branches) && branches.some((branch) => isRequiredNameExcludedFromTarget(branch, name, target, seen))
-  );
-}
-var SINGLE_SCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
-  "items",
-  "additionalItems",
-  "additionalProperties",
-  "unevaluatedItems",
-  "unevaluatedProperties",
-  "contains",
-  "propertyNames",
-  "not",
-  "if",
-  "then",
-  "else"
-]);
-var SCHEMA_LIST_KEYWORDS = /* @__PURE__ */ new Set(["allOf", "anyOf", "oneOf", "prefixItems"]);
-var SCHEMA_MAP_KEYWORDS = /* @__PURE__ */ new Set([
-  "properties",
-  "patternProperties",
-  "dependentSchemas",
-  "$defs",
-  "definitions"
-]);
-function relaxRequiredForTarget(schema, target, ancestors = /* @__PURE__ */ new WeakSet()) {
-  if (!isPlainObject(schema)) {
-    return schema;
-  }
-  if (ancestors.has(schema)) {
-    return true;
-  }
-  ancestors.add(schema);
-  const relaxValue = (value) => relaxRequiredForTarget(value, target, ancestors);
-  const output = {};
-  for (const [key, value] of Object.entries(schema)) {
-    if (SINGLE_SCHEMA_KEYWORDS.has(key)) {
-      output[key] = Array.isArray(value) ? value.map(relaxValue) : relaxValue(value);
-    } else if (SCHEMA_LIST_KEYWORDS.has(key) && Array.isArray(value)) {
-      output[key] = value.map(relaxValue);
-    } else if (SCHEMA_MAP_KEYWORDS.has(key) && isPlainObject(value)) {
-      output[key] = Object.fromEntries(
-        Object.entries(value).map(([mapKey, mapValue]) => [mapKey, relaxValue(mapValue)])
-      );
-    } else {
-      output[key] = value;
-    }
-  }
-  if (Array.isArray(schema.required)) {
-    output.required = schema.required.filter(
-      (name) => typeof name !== "string" || !isRequiredNameExcludedFromTarget(schema, name, target)
-    );
-  }
-  ancestors.delete(schema);
-  return output;
-}
-var SchemaValidator = class {
-  ajv;
-  fallbackAjv;
-  objectSchemaCaches = {
-    none: /* @__PURE__ */ new WeakMap(),
-    request: /* @__PURE__ */ new WeakMap(),
-    response: /* @__PURE__ */ new WeakMap()
-  };
-  scalarSchemaCache = /* @__PURE__ */ new Map();
-  constructor(options) {
-    const ajvOptions = {
-      strict: false,
-      allErrors: true,
-      allowUnionTypes: true,
-      discriminator: true,
-      coerceTypes: options?.coerceTypes ? "array" : false,
-      validateFormats: true,
-      verbose: true,
-      formats: {
-        // Some specs misuse `format: "enum"` instead of the `enum` keyword.
-        // Treat it as a no-op format to avoid noisy unknown-format warnings.
-        enum: true
-      }
-    };
-    this.ajv = new AjvConstructor(ajvOptions);
-    this.fallbackAjv = new AjvConstructor({ ...ajvOptions, discriminator: false });
-    applyFormats(this.ajv);
-    applyFormats(this.fallbackAjv);
-  }
-  validate(schema, value, target) {
-    if (schema === void 0) {
-      return { valid: true, errors: [] };
-    }
-    let validate;
-    try {
-      validate = this.getOrCompileValidator(schema, target);
-    } catch (error) {
-      return {
-        valid: false,
-        errors: [
-          {
-            message: `Schema compilation failed: ${error.message}`
-          }
-        ]
-      };
-    }
-    const valid = Boolean(validate(value));
-    const errors = validate.errors ?? [];
-    return { valid, errors };
-  }
-  getOrCompileValidator(schema, target) {
-    if (isPlainObject(schema)) {
-      const cache = this.objectSchemaCaches[target ?? "none"];
-      const cached2 = cache.get(schema);
-      if (cached2) {
-        return cached2;
-      }
-      const effectiveSchema = target ? relaxRequiredForTarget(schema, target) : schema;
-      const compiled2 = this.compileSchema(effectiveSchema);
-      cache.set(schema, compiled2);
-      return compiled2;
-    }
-    const cacheKey = `${target ?? "none"}:${JSON.stringify(schema)}`;
-    const cached = this.scalarSchemaCache.get(cacheKey);
-    if (cached) {
-      return cached;
-    }
-    const compiled = this.compileSchema(schema);
-    this.scalarSchemaCache.set(cacheKey, compiled);
-    return compiled;
-  }
-  compileSchema(schema) {
-    try {
-      return this.ajv.compile(schema);
-    } catch {
-      return this.fallbackAjv.compile(schema);
-    }
-  }
-};
-
-// src/commands/drift/engine/validation-session.ts
-var DEFAULT_FINDINGS_PREVIEW_LIMIT = 10;
-var SEVERITY_RANK = {
-  info: 0,
-  warning: 1,
-  error: 2
-};
-function createInitialCounters() {
-  return {
-    totalExchanges: 0,
-    documentedExchanges: 0,
-    undocumentedExchanges: 0,
-    skippedExchanges: 0,
-    hostCompatibleExchanges: 0,
-    findingsBySeverity: {
-      info: 0,
-      warning: 0,
-      error: 0
-    },
-    findingsByRule: {}
-  };
-}
-function accumulateFinding(counters, finding) {
-  counters.findingsBySeverity[finding.severity] += 1;
-  counters.findingsByRule[finding.ruleId] = (counters.findingsByRule[finding.ruleId] ?? 0) + 1;
-}
-function toFindingRecord(finding, exchange) {
-  return {
-    ...finding,
-    id: randomUUID(),
-    method: exchange.request.method,
-    url: exchange.request.url,
-    path: exchange.request.path,
-    status: exchange.response?.status
-  };
-}
-function mapFindingToPreview(finding, exchange) {
-  return {
-    exchangeIndex: finding.exchangeIndex,
-    ruleId: finding.ruleId,
-    severity: finding.severity,
-    category: finding.category,
-    message: finding.message,
-    occurrences: 1,
-    operationId: finding.operationId,
-    specSource: finding.specSource,
-    target: finding.target,
-    schemaPath: finding.schemaPath,
-    dataPath: finding.dataPath,
-    details: finding.details,
-    method: exchange.request.method,
-    url: exchange.request.url,
-    path: exchange.request.path,
-    status: exchange.response?.status
-  };
-}
-function ensureOperationContextInFinding(finding, matchedOperation) {
-  if (!matchedOperation) {
-    return;
-  }
-  if (!finding.operationId) {
-    finding.operationId = matchedOperation.operation.operationId;
-  }
-  if (!finding.specSource) {
-    finding.specSource = matchedOperation.operation.specSource;
-  }
-  const existingDetails = finding.details ?? {};
-  if (!isPlainObject(existingDetails)) {
-    finding.details = {
-      operationPathTemplate: matchedOperation.operation.pathTemplate
-    };
-    return;
-  }
-  if (typeof existingDetails.operationPathTemplate !== "string") {
-    existingDetails.operationPathTemplate = matchedOperation.operation.pathTemplate;
-  }
-  finding.details = existingDetails;
-}
-function collectSpecServerHosts(openApiIndex) {
-  const specServerHosts = /* @__PURE__ */ new Set();
-  let hasHostlessSpecServer = false;
-  for (const operations of openApiIndex.operationsByMethod.values()) {
-    for (const operation of operations) {
-      for (const server of operation.servers) {
-        if (server.host) {
-          specServerHosts.add(server.host);
-        } else {
-          hasHostlessSpecServer = true;
-        }
-      }
-    }
-  }
-  return { specServerHosts, hasHostlessSpecServer };
-}
-async function executeRules(rules, context) {
-  const findings = [];
-  for (const rule of rules) {
-    try {
-      const ruleFindings = await rule.analyze(context);
-      if (ruleFindings.length > 0) {
-        findings.push(...ruleFindings);
-      }
-    } catch (error) {
-      logger.warn(`Rule "${rule.id}" failed to execute: ${error.message}
-`);
-    }
-  }
-  return findings;
-}
-var ValidationSession = class _ValidationSession {
-  startedAt = Date.now();
-  runId = randomUUID();
-  previewLimit;
-  rules;
-  schemaValidator = new SchemaValidator();
-  coercingSchemaValidator = new SchemaValidator({ coerceTypes: true });
-  options;
-  counters = createInitialCounters();
-  findings = [];
-  previewFindings = [];
-  problemGroupsByRule = {};
-  problemKeyStats = /* @__PURE__ */ new Map();
-  totalProblemGroups = 0;
-  server;
-  ignoreHeaders;
-  minSeverityRank;
-  specServerHosts;
-  hasHostlessSpecServer;
-  constructor(options, rules) {
-    this.options = options;
-    this.rules = rules;
-    this.server = normalizeServerPrefix(options.server);
-    this.ignoreHeaders = options.ignoreHeaders ? parseHeaderIgnoreList(options.ignoreHeaders) : void 0;
-    const { specServerHosts, hasHostlessSpecServer } = collectSpecServerHosts(options.openApiIndex);
-    this.specServerHosts = specServerHosts;
-    this.hasHostlessSpecServer = hasHostlessSpecServer;
-    this.minSeverityRank = SEVERITY_RANK[options.minSeverity ?? "info"];
-    this.previewLimit = options.previewFindingsLimit && options.previewFindingsLimit > 0 ? options.previewFindingsLimit : DEFAULT_FINDINGS_PREVIEW_LIMIT;
-  }
-  static create(options) {
-    if (options.openApiIndex.loadedOperations === 0) {
-      throw new Error("No OpenAPI operations available to validate traffic against.");
-    }
-    return new _ValidationSession(options, loadRules(options.activeRules));
-  }
-  /**
-   * Validate a single exchange and return the finding records produced for it,
-   * so callers (e.g. the proxy) can surface findings live as they arrive.
-   */
-  async process(exchange) {
-    this.counters.totalExchanges += 1;
-    let relativePathOverride;
-    if (this.server !== void 0) {
-      relativePathOverride = resolvePathForServer(exchange.request, this.server);
-      if (relativePathOverride === void 0) {
-        this.counters.skippedExchanges += 1;
-        return [];
-      }
-    }
-    const hostCompatible = this.isHostCompatible(exchange.request.host);
-    if (hostCompatible) {
-      this.counters.hostCompatibleExchanges += 1;
-    }
-    const matchedOperation = matchOperation(
-      this.options.openApiIndex,
-      exchange,
-      this.options.matchMode,
-      relativePathOverride
-    );
-    if (matchedOperation) {
-      this.counters.documentedExchanges += 1;
-    } else {
-      this.counters.undocumentedExchanges += 1;
-    }
-    const exchangeFindings = await executeRules(this.rules, {
-      exchange,
-      matchedOperation,
-      matchMode: this.options.matchMode,
-      hostCompatibleWithSpecServers: relativePathOverride !== void 0 || hostCompatible,
-      ignoreCookies: this.options.ignoreCookies ?? false,
-      ignoreHeaders: this.ignoreHeaders,
-      validateSchema: (schema, value, options) => options?.coerce ? this.coercingSchemaValidator.validate(schema, value, options?.target) : this.schemaValidator.validate(schema, value, options?.target)
-    });
-    const records = [];
-    for (const finding of exchangeFindings) {
-      if (SEVERITY_RANK[finding.severity] < this.minSeverityRank) {
-        continue;
-      }
-      ensureOperationContextInFinding(finding, matchedOperation);
-      const record = toFindingRecord(finding, exchange);
-      this.findings.push(record);
-      records.push(record);
-      accumulateFinding(this.counters, finding);
-      const problemKey = createProblemKey({
-        ruleId: finding.ruleId,
-        severity: finding.severity,
-        message: finding.message,
-        operationId: finding.operationId,
-        path: exchange.request.path,
-        target: finding.target,
-        schemaPath: finding.schemaPath
-      });
-      const existingProblem = this.problemKeyStats.get(problemKey);
-      if (existingProblem) {
-        existingProblem.occurrences += 1;
-        if (existingProblem.previewIndex !== null) {
-          this.previewFindings[existingProblem.previewIndex].occurrences = existingProblem.occurrences;
-        }
-        continue;
-      }
-      this.totalProblemGroups += 1;
-      this.problemGroupsByRule[finding.ruleId] = (this.problemGroupsByRule[finding.ruleId] ?? 0) + 1;
-      if (this.previewFindings.length < this.previewLimit) {
-        const previewIndex = this.previewFindings.length;
-        this.previewFindings.push(mapFindingToPreview(finding, exchange));
-        this.problemKeyStats.set(problemKey, { occurrences: 1, previewIndex });
-        continue;
-      }
-      this.problemKeyStats.set(problemKey, { occurrences: 1, previewIndex: null });
-    }
-    return records;
-  }
-  isHostCompatible(requestHost) {
-    return !requestHost || this.hasHostlessSpecServer || this.specServerHosts.has(requestHost.toLowerCase());
-  }
-  finalize() {
-    const summary = {
-      runId: this.runId,
-      totalExchanges: this.counters.totalExchanges,
-      documentedExchanges: this.counters.documentedExchanges,
-      undocumentedExchanges: this.counters.undocumentedExchanges,
-      skippedExchanges: this.counters.skippedExchanges,
-      hostCompatibleExchanges: this.counters.hostCompatibleExchanges,
-      findingsBySeverity: this.counters.findingsBySeverity,
-      findingsByRule: this.counters.findingsByRule,
-      problemGroupsByRule: this.problemGroupsByRule,
-      totalProblemGroups: this.totalProblemGroups,
-      durationMs: Date.now() - this.startedAt,
-      previewFindings: this.previewFindings,
-      previewLimit: this.previewLimit,
-      previewTruncated: this.totalProblemGroups > this.previewFindings.length
-    };
-    return { runId: this.runId, summary, findings: this.findings };
-  }
-};
-
-// src/commands/drift/openapi/loader.ts
-import { stat } from "node:fs/promises";
-
-// src/commands/drift/utils/openapi.ts
-function resolveServerUrl(rawUrl, variables) {
-  const resolvedUrl = rawUrl.replace(/\{([^}]+)\}/g, (_, variableName) => {
-    const variable = variables?.[variableName];
-    if (variable?.default !== void 0) {
-      return String(variable.default);
-    }
-    if (Array.isArray(variable?.enum) && variable.enum.length > 0) {
-      return String(variable.enum[0]);
-    }
-    return "";
-  });
-  const parsedUrl = parseUrl(resolvedUrl);
-  const hasExplicitHost = Boolean(parsedUrl.host && !isSyntheticHost(parsedUrl.host));
-  return {
-    rawUrl,
-    protocol: hasExplicitHost ? parsedUrl.protocol : void 0,
-    host: hasExplicitHost ? parsedUrl.host.toLowerCase() : void 0,
-    basePath: getPathWithoutTrailingSlash(parsedUrl.pathname || "/")
-  };
-}
-function ensureLeadingSlash(value) {
-  if (!value) {
-    return "/";
-  }
-  return value.startsWith("/") ? value : `/${value}`;
-}
-
-// src/commands/drift/openapi/loader.ts
-var HTTP_METHODS = ["get", "put", "post", "delete", "patch", "head", "options", "trace"];
-var PARAMETER_LOCATIONS = /* @__PURE__ */ new Set(["query", "header", "path", "cookie"]);
-function isHttpMethod(value) {
-  return HTTP_METHODS.includes(value);
-}
-function isParameterLocation(value) {
-  return PARAMETER_LOCATIONS.has(value);
-}
-function normalizeParameters(parameters) {
-  if (!Array.isArray(parameters)) {
-    return [];
-  }
-  const normalized = [];
-  for (const entry of parameters) {
-    if (!isPlainObject(entry)) {
-      continue;
-    }
-    const location = entry.in;
-    if (typeof location !== "string" || !isParameterLocation(location)) {
-      continue;
-    }
-    normalized.push({
-      name: String(entry.name ?? ""),
-      in: location,
-      required: Boolean(entry.required) || location === "path",
-      style: typeof entry.style === "string" ? entry.style : void 0,
-      schema: entry.schema
-    });
-  }
-  return normalized;
-}
-function parameterKey(parameter) {
-  const caseInsensitive = parameter.in === "header";
-  return `${parameter.in}:${caseInsensitive ? parameter.name.toLowerCase() : parameter.name}`;
-}
-function mergeParameters(baseParameters, operationParameters) {
-  const map = /* @__PURE__ */ new Map();
-  for (const parameter of baseParameters) {
-    map.set(parameterKey(parameter), parameter);
-  }
-  for (const parameter of operationParameters) {
-    map.set(parameterKey(parameter), parameter);
-  }
-  return Array.from(map.values());
-}
-function extractMediaSchemas(content) {
-  const output = {};
-  if (!isPlainObject(content)) {
-    return output;
-  }
-  for (const [mime, mediaTypeObject] of Object.entries(content)) {
-    if (isPlainObject(mediaTypeObject) && "schema" in mediaTypeObject) {
-      output[mime.toLowerCase()] = mediaTypeObject.schema;
-    }
-  }
-  return output;
-}
-function extractRequestBodyContent(requestBody) {
-  if (!isPlainObject(requestBody)) {
-    return {};
-  }
-  return extractMediaSchemas(requestBody.content);
-}
-function extractResponseBodyContent(responses) {
-  if (!isPlainObject(responses)) {
-    return {};
-  }
-  const output = {};
-  for (const [statusCode, responseObject] of Object.entries(responses)) {
-    if (!isPlainObject(responseObject) || !("content" in responseObject)) {
-      continue;
-    }
-    output[statusCode] = extractMediaSchemas(responseObject.content);
-  }
-  return output;
-}
-function resolveOperationServers(operationServers, pathServers, rootServers) {
-  const sourceServers = operationServers ?? pathServers ?? rootServers;
-  if (!Array.isArray(sourceServers) || sourceServers.length === 0) {
-    return [resolveServerUrl("/")];
-  }
-  return sourceServers.map((server) => {
-    if (!isPlainObject(server)) {
-      return resolveServerUrl("/");
-    }
-    const url = typeof server.url === "string" ? server.url : "/";
-    const variables = isPlainObject(server.variables) ? server.variables : void 0;
-    return resolveServerUrl(url, variables);
-  });
-}
-function toOperationId(method, pathTemplate, declaredOperationId) {
-  if (declaredOperationId) {
-    return declaredOperationId;
-  }
-  return `${method.toUpperCase()} ${pathTemplate}`;
-}
-function detectOpenApi3Spec(document) {
-  try {
-    const specVersion = detectSpec(document.parsed);
-    return getMajorSpecVersion(specVersion) === "oas3" ? specVersion : null;
-  } catch {
-    return null;
-  }
-}
-function normalizeSecurity(value) {
-  return Array.isArray(value) ? value : void 0;
-}
-function createIndexVisitor(specSource, operationsByMethod) {
-  let rootServers;
-  let rootSecurity;
-  let securitySchemes = {};
-  let currentPathTemplate = "/";
-  let currentPathParameters = [];
-  let currentPathServers;
-  return {
-    Root: {
-      enter(root) {
-        rootServers = root.servers;
-        rootSecurity = root.security;
-        const componentsSecuritySchemes = isPlainObject(root.components) ? root.components.securitySchemes : void 0;
-        securitySchemes = isPlainObject(componentsSecuritySchemes) ? componentsSecuritySchemes : {};
-      }
-    },
-    Paths: {
-      PathItem: {
-        enter(pathItem, ctx) {
-          currentPathTemplate = ensureLeadingSlash(String(ctx.key));
-          currentPathParameters = normalizeParameters(pathItem.parameters);
-          currentPathServers = pathItem.servers;
-        },
-        Operation: {
-          enter(operation, ctx) {
-            const method = String(ctx.key);
-            if (!isHttpMethod(method)) {
-              return;
-            }
-            const mergedParameters = mergeParameters(
-              currentPathParameters,
-              normalizeParameters(operation.parameters)
-            );
-            const compiledPath = compileOpenApiPath(currentPathTemplate);
-            const servers = resolveOperationServers(
-              operation.servers,
-              currentPathServers,
-              rootServers
-            );
-            const requestBody = operation.requestBody;
-            const item = {
-              operationId: toOperationId(
-                method,
-                currentPathTemplate,
-                typeof operation.operationId === "string" ? operation.operationId : void 0
-              ),
-              method,
-              pathTemplate: currentPathTemplate,
-              pathRegex: compiledPath.regex,
-              pathParams: compiledPath.params,
-              pathScore: compiledPath.score,
-              servers,
-              requestParameters: mergedParameters,
-              requestBodyContent: extractRequestBodyContent(requestBody),
-              requestBodyRequired: isPlainObject(requestBody) && Boolean(requestBody.required),
-              responseBodyContent: extractResponseBodyContent(operation.responses),
-              security: normalizeSecurity(operation.security) ?? normalizeSecurity(rootSecurity),
-              securitySchemes,
-              specSource
-            };
-            const methodOperations = operationsByMethod.get(method) ?? [];
-            methodOperations.push(item);
-            operationsByMethod.set(method, methodOperations);
-          }
-        }
-      }
-    }
-  };
-}
-function indexDocument(document, specVersion, config, specSource, operationsByMethod) {
-  const types = normalizeTypes(config.extendTypes(getTypes(specVersion), specVersion), config);
-  const resolvedRefMap = /* @__PURE__ */ new Map();
-  const ctx = { problems: [], specVersion, config, visitorsData: {} };
-  const normalizedVisitors = normalizeVisitors(
-    [
-      {
-        severity: "warn",
-        ruleId: "drift-index",
-        visitor: createIndexVisitor(specSource, operationsByMethod)
-      }
-    ],
-    types
-  );
-  walkDocument({
-    document,
-    rootType: types.Root,
-    normalizedVisitors,
-    resolvedRefMap,
-    ctx
-  });
-}
-function serverIdentity(server) {
-  return `${server.host ?? ""}|${server.basePath}`;
-}
-function warnAboutCollidingOperations(operationsByMethod) {
-  for (const operations of operationsByMethod.values()) {
-    const byPathPattern = /* @__PURE__ */ new Map();
-    for (const operation of operations) {
-      const group = byPathPattern.get(operation.pathRegex.source) ?? [];
-      group.push(operation);
-      byPathPattern.set(operation.pathRegex.source, group);
-    }
-    for (const group of byPathPattern.values()) {
-      const sourcesByServer = /* @__PURE__ */ new Map();
-      for (const operation of group) {
-        for (const server of operation.servers) {
-          const key = serverIdentity(server);
-          const sources = sourcesByServer.get(key) ?? /* @__PURE__ */ new Set();
-          sources.add(operation.specSource);
-          sourcesByServer.set(key, sources);
-        }
-      }
-      for (const sources of sourcesByServer.values()) {
-        if (sources.size > 1) {
-          const [first] = group;
-          logger.warn(
-            `"${first.method.toUpperCase()} ${first.pathTemplate}" is documented for the same server in multiple descriptions (${Array.from(
-              sources
-            ).join(", ")}). Matching traffic is validated against only one of them.
-`
-          );
-          break;
-        }
-      }
-    }
-  }
-}
-function finalizeIndex(operationsByMethod, loadedSpecs) {
-  for (const operations of operationsByMethod.values()) {
-    operations.sort((left, right) => right.pathScore - left.pathScore);
-  }
-  const loadedOperations = Array.from(operationsByMethod.values()).reduce(
-    (acc, current) => acc + current.length,
-    0
-  );
-  return { operationsByMethod, loadedSpecs, loadedOperations };
-}
-async function resolveSpecFiles(specPath) {
-  const stats = await stat(specPath);
-  if (stats.isDirectory()) {
-    return { specFiles: await listOpenApiFiles(specPath), fromDirectory: true };
-  }
-  return { specFiles: [specPath], fromDirectory: false };
-}
-async function loadOpenApiIndex(specPath, config) {
-  const { specFiles, fromDirectory } = await resolveSpecFiles(specPath);
-  const operationsByMethod = /* @__PURE__ */ new Map();
-  const externalRefResolver = new BaseResolver(config.resolve);
-  let loadedSpecs = 0;
-  for (const specFile of specFiles) {
-    const resolvedDocument = await externalRefResolver.resolveDocument(null, specFile, true);
-    if (resolvedDocument instanceof Error) {
-      logger.warn(`Failed to load OpenAPI description ${specFile}: ${resolvedDocument.message}
-`);
-      continue;
-    }
-    const specVersion = detectOpenApi3Spec(resolvedDocument);
-    if (!specVersion) {
-      if (!fromDirectory) {
-        logger.warn(`Skipping ${specFile}: not an OpenAPI 3.x description.
-`);
-      }
-      continue;
-    }
-    let document;
-    try {
-      const { bundle: bundled } = await bundle({
-        config,
-        doc: resolvedDocument,
-        externalRefResolver,
-        dereference: true
-      });
-      document = bundled;
-    } catch (error) {
-      logger.warn(
-        `Failed to bundle OpenAPI description ${specFile}: ${error.message}
-`
-      );
-      continue;
-    }
-    loadedSpecs += 1;
-    indexDocument(document, specVersion, config, specFile, operationsByMethod);
-  }
-  if (loadedSpecs > 1) {
-    warnAboutCollidingOperations(operationsByMethod);
-  }
-  return finalizeIndex(operationsByMethod, loadedSpecs);
-}
-
-// src/commands/drift/utils/args.ts
-function parseCsv(input) {
-  return input.split(",").map((value) => value.trim()).filter(Boolean);
-}
-
-export {
-  renderReport,
-  ValidationSession,
-  loadOpenApiIndex,
-  parseCsv
-};