@zuplo/cli 6.70.40 → 6.70.42

package/node_modules/@zuplo/runtime/out/types/mcp-gateway/index.d.ts

@@ -1,5 +1,13 @@
 import { z } from "zod/v4";
 
+/**
+ * MCP tool annotations to expose downstream.
+ * @public
+ */
+declare interface Annotations {
+  [k: string]: unknown;
+}
+
 declare interface ApiRuntimeConfig {
   urls: UrlConfig | undefined;
 }
@@ -1038,29 +1046,100 @@ export declare class McpCapabilityFilterInboundPolicy extends InboundPolicy<Vali
  */
 export declare interface McpCapabilityFilterInboundPolicyOptions {
   /**
-   * Tool names to expose. Omit to pass through all upstream tools; use an empty array to expose no tools.
+   * Tools to expose. Use a string for name-only filtering, or an object to expose and project tool description, annotations, and _meta. Omit to pass through all upstream tools; use an empty array to expose no tools.
    */
-  tools?: string[];
+  tools?: (string | ToolProjection)[];
   /**
-   * Prompt names to expose. Omit to pass through all upstream prompts; use an empty array to expose no prompts.
+   * Prompts to expose. Use a string for name-only filtering, or an object to expose and project prompt description and _meta. Omit to pass through all upstream prompts; use an empty array to expose no prompts.
    */
-  prompts?: string[];
+  prompts?: (string | PromptProjection)[];
   /**
-   * Resource URIs to expose. Omit to pass through all upstream resources; use an empty array to expose no resources.
+   * Resources to expose. Use a string for URI-only filtering, or an object to expose and project resource name, description, MIME type, and _meta. Omit to pass through all upstream resources; use an empty array to expose no resources.
    */
-  resources?: string[];
+  resources?: (string | ResourceProjection)[];
   /**
-   * Resource template URI templates to expose. Omit to pass through all upstream resource templates; use an empty array to expose no resource templates.
+   * Resource templates to expose. Use a string for URI-template-only filtering, or an object to expose and project template name, description, MIME type, and _meta. Omit to pass through all upstream resource templates; use an empty array to expose no resource templates.
    */
-  resourceTemplates?: string[];
+  resourceTemplates?: (string | ResourceTemplateProjection)[];
 }
 
 declare const mcpCapabilityFilterOptionsSchema: z.ZodObject<
   {
-    tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    prompts: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    resourceTemplates: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    tools: z.ZodOptional<
+      z.ZodArray<
+        z.ZodUnion<
+          readonly [
+            z.ZodString,
+            z.ZodObject<
+              {
+                name: z.ZodString;
+                description: z.ZodOptional<z.ZodString>;
+                annotations: z.ZodOptional<
+                  z.ZodRecord<z.ZodString, z.ZodUnknown>
+                >;
+                _meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+              },
+              z.core.$strict
+            >,
+          ]
+        >
+      >
+    >;
+    prompts: z.ZodOptional<
+      z.ZodArray<
+        z.ZodUnion<
+          readonly [
+            z.ZodString,
+            z.ZodObject<
+              {
+                name: z.ZodString;
+                description: z.ZodOptional<z.ZodString>;
+                _meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+              },
+              z.core.$strict
+            >,
+          ]
+        >
+      >
+    >;
+    resources: z.ZodOptional<
+      z.ZodArray<
+        z.ZodUnion<
+          readonly [
+            z.ZodString,
+            z.ZodObject<
+              {
+                uri: z.ZodString;
+                name: z.ZodOptional<z.ZodString>;
+                description: z.ZodOptional<z.ZodString>;
+                mimeType: z.ZodOptional<z.ZodString>;
+                _meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+              },
+              z.core.$strict
+            >,
+          ]
+        >
+      >
+    >;
+    resourceTemplates: z.ZodOptional<
+      z.ZodArray<
+        z.ZodUnion<
+          readonly [
+            z.ZodString,
+            z.ZodObject<
+              {
+                uriTemplate: z.ZodString;
+                name: z.ZodOptional<z.ZodString>;
+                description: z.ZodOptional<z.ZodString>;
+                mimeType: z.ZodOptional<z.ZodString>;
+                _meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+              },
+              z.core.$strict
+            >,
+          ]
+        >
+      >
+    >;
   },
   z.core.$strict
 >;
@@ -1339,6 +1418,14 @@ export declare interface McpTokenExchangeInboundPolicyOptions {
       };
 }
 
+/**
+ * Arbitrary MCP _meta fields to expose downstream.
+ * @public
+ */
+declare interface Metadata {
+  [k: string]: unknown;
+}
+
 declare type Modify<T, R> = Omit<T, keyof R> & R;
 
 declare interface NotFoundOptions {
@@ -2092,6 +2179,18 @@ declare interface ProblemResponseFormat {
   ): Promise<Response> | Response;
 }
 
+declare interface PromptProjection {
+  /**
+   * Prompt name to expose.
+   */
+  name: string;
+  /**
+   * Optional downstream-facing prompt description override.
+   */
+  description?: string;
+  _meta?: Metadata;
+}
+
 /**
  * Generic type parameters for a request.
  * Extends RequestInitGeneric and adds query parameter typing.
@@ -2153,6 +2252,46 @@ declare type ResolveRequestQuery<
 declare type ResolveUserData<TUserData extends UserDataDefault | undefined> =
   TUserData extends UserDataDefault ? TUserData : UserDataDefault;
 
+declare interface ResourceProjection {
+  /**
+   * Resource URI to expose.
+   */
+  uri: string;
+  /**
+   * Optional downstream-facing resource name override.
+   */
+  name?: string;
+  /**
+   * Optional downstream-facing resource description override.
+   */
+  description?: string;
+  /**
+   * Optional downstream-facing resource MIME type override.
+   */
+  mimeType?: string;
+  _meta?: Metadata;
+}
+
+declare interface ResourceTemplateProjection {
+  /**
+   * Resource template URI template to expose.
+   */
+  uriTemplate: string;
+  /**
+   * Optional downstream-facing resource template name override.
+   */
+  name?: string;
+  /**
+   * Optional downstream-facing resource template description override.
+   */
+  description?: string;
+  /**
+   * Optional downstream-facing resource template MIME type override.
+   */
+  mimeType?: string;
+  _meta?: Metadata;
+}
+
 /**
  * Definition of responses for a route
  * @public
@@ -2271,6 +2410,19 @@ declare abstract class SystemRuntimePlugin extends RuntimePlugin {
   /* Excluded from this release type: registerRoutes */
 }
 
+declare interface ToolProjection {
+  /**
+   * Tool name to expose.
+   */
+  name: string;
+  /**
+   * Optional downstream-facing tool description override.
+   */
+  description?: string;
+  annotations?: Annotations;
+  _meta?: Metadata;
+}
+
 declare type UpstreamTokenExchangePolicyOptions = z.infer<
   typeof upstreamTokenExchangePolicyOptionsSchema
 >;

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.70.40",
+  "version": "6.70.42",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/hono/dist/adapter/deno/websocket.js

@@ -4,7 +4,11 @@ var upgradeWebSocket = defineWebSocketHelper(async (c, events, options) => {
   if (c.req.header("upgrade") !== "websocket") {
     return;
   }
-  const { response, socket } = Deno.upgradeWebSocket(c.req.raw, options ?? {});
+  const subprotocol = c.req.header("sec-websocket-protocol")?.split(",")[0]?.trim();
+  const { response, socket } = Deno.upgradeWebSocket(c.req.raw, {
+    ...subprotocol ? { protocol: subprotocol } : {},
+    ...options
+  });
   const wsContext = new WSContext({
     close: (code, reason) => socket.close(code, reason),
     get protocol() {

package/node_modules/hono/dist/cjs/adapter/deno/websocket.js

@@ -25,7 +25,11 @@ const upgradeWebSocket = (0, import_websocket.defineWebSocketHelper)(async (c, e
   if (c.req.header("upgrade") !== "websocket") {
     return;
   }
-  const { response, socket } = Deno.upgradeWebSocket(c.req.raw, options ?? {});
+  const subprotocol = c.req.header("sec-websocket-protocol")?.split(",")[0]?.trim();
+  const { response, socket } = Deno.upgradeWebSocket(c.req.raw, {
+    ...subprotocol ? { protocol: subprotocol } : {},
+    ...options
+  });
   const wsContext = new import_websocket.WSContext({
     close: (code, reason) => socket.close(code, reason),
     get protocol() {

package/node_modules/hono/dist/cjs/middleware/compress/index.js

@@ -20,11 +20,31 @@ __export(compress_exports, {
   compress: () => compress
 });
 module.exports = __toCommonJS(compress_exports);
+var import_accept = require("../../utils/accept");
 var import_compress = require("../../utils/compress");
 const ENCODING_TYPES = ["gzip", "deflate"];
 const cacheControlNoTransformRegExp = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i;
+const selectEncoding = (header, candidates) => {
+  if (header === void 0) {
+    return void 0;
+  }
+  const accepts = (0, import_accept.parseAccept)(header);
+  const wildcardQ = accepts.find((a) => a.type === "*")?.q;
+  let best;
+  for (const enc of candidates) {
+    const explicit = accepts.find((a) => a.type.toLowerCase() === enc);
+    const q = explicit ? explicit.q : wildcardQ ?? 0;
+    if (q === 1) {
+      return enc;
+    } else if (q > 0 && (!best || q > best.q)) {
+      best = { encoding: enc, q };
+    }
+  }
+  return best?.encoding;
+};
 const compress = (options) => {
   const threshold = options?.threshold ?? 1024;
+  const candidates = options?.encoding ? [options.encoding] : ENCODING_TYPES;
   return async function compress2(ctx, next) {
     await next();
     const contentLength = ctx.res.headers.get("Content-Length");
@@ -37,7 +57,7 @@ const compress = (options) => {
       return;
     }
     const accepted = ctx.req.header("Accept-Encoding");
-    const encoding = options?.encoding ?? ENCODING_TYPES.find((encoding2) => accepted?.includes(encoding2));
+    const encoding = selectEncoding(accepted, candidates);
     if (!encoding || !ctx.res.body) {
       return;
     }

package/node_modules/hono/dist/cjs/utils/compress.js

@@ -20,7 +20,7 @@ __export(compress_exports, {
   COMPRESSIBLE_CONTENT_TYPE_REGEX: () => COMPRESSIBLE_CONTENT_TYPE_REGEX
 });
 module.exports = __toCommonJS(compress_exports);
-const COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/(?!event-stream(?:[;\s]|$))[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
+const COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/(?!event-stream(?:[;\s]|$))[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|msgpack|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|vnd\.msgpack|wasm|x-httpd-php|x-javascript|x-msgpack|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml|msgpack))(?:[;\s]|$)/i;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   COMPRESSIBLE_CONTENT_TYPE_REGEX

package/node_modules/hono/dist/cjs/utils/mime.js

@@ -28,15 +28,13 @@ const getMimeType = (filename, mimes = baseMimes) => {
   if (!match) {
     return;
   }
-  let mimeType = mimes[match[1].toLowerCase()];
-  if (mimeType && mimeType.startsWith("text")) {
-    mimeType += "; charset=utf-8";
-  }
-  return mimeType;
+  return mimes[match[1].toLowerCase()];
 };
 const getExtension = (mimeType) => {
+  const baseType = mimeType.split(";", 1)[0].trim();
   for (const ext in baseMimes) {
-    if (baseMimes[ext] === mimeType) {
+    const stored = baseMimes[ext];
+    if (stored === mimeType || stored.split(";", 1)[0].trim() === baseType) {
       return ext;
     }
   }
@@ -48,25 +46,25 @@ const _baseMimes = {
   av1: "video/av1",
   bin: "application/octet-stream",
   bmp: "image/bmp",
-  css: "text/css",
-  csv: "text/csv",
+  css: "text/css; charset=utf-8",
+  csv: "text/csv; charset=utf-8",
   eot: "application/vnd.ms-fontobject",
   epub: "application/epub+zip",
   gif: "image/gif",
   gz: "application/gzip",
-  htm: "text/html",
-  html: "text/html",
+  htm: "text/html; charset=utf-8",
+  html: "text/html; charset=utf-8",
   ico: "image/x-icon",
-  ics: "text/calendar",
+  ics: "text/calendar; charset=utf-8",
   jpeg: "image/jpeg",
   jpg: "image/jpeg",
-  js: "text/javascript",
+  js: "text/javascript; charset=utf-8",
   json: "application/json",
   jsonld: "application/ld+json",
   map: "application/json",
   mid: "audio/x-midi",
   midi: "audio/x-midi",
-  mjs: "text/javascript",
+  mjs: "text/javascript; charset=utf-8",
   mp3: "audio/mpeg",
   mp4: "video/mp4",
   mpeg: "video/mpeg",
@@ -78,12 +76,12 @@ const _baseMimes = {
   pdf: "application/pdf",
   png: "image/png",
   rtf: "application/rtf",
-  svg: "image/svg+xml",
+  svg: "image/svg+xml; charset=utf-8",
   tif: "image/tiff",
   tiff: "image/tiff",
   ts: "video/mp2t",
   ttf: "font/ttf",
-  txt: "text/plain",
+  txt: "text/plain; charset=utf-8",
   wasm: "application/wasm",
   webm: "video/webm",
   weba: "audio/webm",
@@ -91,8 +89,8 @@ const _baseMimes = {
   webp: "image/webp",
   woff: "font/woff",
   woff2: "font/woff2",
-  xhtml: "application/xhtml+xml",
-  xml: "application/xml",
+  xhtml: "application/xhtml+xml; charset=utf-8",
+  xml: "application/xml; charset=utf-8",
   zip: "application/zip",
   "3gp": "video/3gpp",
   "3g2": "video/3gpp2",

package/node_modules/hono/dist/middleware/compress/index.js

@@ -1,9 +1,29 @@
 // src/middleware/compress/index.ts
+import { parseAccept } from "../../utils/accept.js";
 import { COMPRESSIBLE_CONTENT_TYPE_REGEX } from "../../utils/compress.js";
 var ENCODING_TYPES = ["gzip", "deflate"];
 var cacheControlNoTransformRegExp = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i;
+var selectEncoding = (header, candidates) => {
+  if (header === void 0) {
+    return void 0;
+  }
+  const accepts = parseAccept(header);
+  const wildcardQ = accepts.find((a) => a.type === "*")?.q;
+  let best;
+  for (const enc of candidates) {
+    const explicit = accepts.find((a) => a.type.toLowerCase() === enc);
+    const q = explicit ? explicit.q : wildcardQ ?? 0;
+    if (q === 1) {
+      return enc;
+    } else if (q > 0 && (!best || q > best.q)) {
+      best = { encoding: enc, q };
+    }
+  }
+  return best?.encoding;
+};
 var compress = (options) => {
   const threshold = options?.threshold ?? 1024;
+  const candidates = options?.encoding ? [options.encoding] : ENCODING_TYPES;
   return async function compress2(ctx, next) {
     await next();
     const contentLength = ctx.res.headers.get("Content-Length");
@@ -16,7 +36,7 @@ var compress = (options) => {
       return;
     }
     const accepted = ctx.req.header("Accept-Encoding");
-    const encoding = options?.encoding ?? ENCODING_TYPES.find((encoding2) => accepted?.includes(encoding2));
+    const encoding = selectEncoding(accepted, candidates);
     if (!encoding || !ctx.res.body) {
       return;
     }