@zuplo/cli 6.71.23 → 6.71.25

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -1350,6 +1350,150 @@ declare interface AuditLogEntry {
   };
 }
 
+/**
+ * A CloudEvent 1.0 audit log entry. Most fields are auto-populated by the
+ * runtime; user code only supplies the type/subject/resources/data fields when
+ * calling `AuditLogInboundPolicy.log()`.
+ *
+ * @public
+ */
+export declare interface AuditLogEvent {
+  specversion: "1.0";
+  id: string;
+  source: string;
+  type: string;
+  time: string;
+  datacontenttype?: "application/json";
+  subject?: string;
+  bucketid: string;
+  actorsub?: string;
+  actortype?: "user" | "service" | "apikey" | "anonymous";
+  actoremail?: string;
+  actorconnection?: string;
+  resources?: AuditLogResource[];
+  requestid?: string;
+  success?: boolean;
+  httpmethod?: string;
+  httpurl?: string;
+  httpstatus?: number;
+  ipaddress?: string;
+  useragent?: string;
+  country?: string;
+  region?: string;
+  city?: string;
+  mcpserver?: string;
+  mcpvirtualserver?: string;
+  mcptool?: string;
+  data?: Record<string, unknown>;
+  extensions?: Record<string, unknown>;
+}
+
+/**
+ * Fields a caller may supply when emitting a custom audit event via
+ * `AuditLogInboundPolicy.log()`. Everything else is filled in by the runtime
+ * from the request context.
+ *
+ * @public
+ */
+export declare interface AuditLogEventInput {
+  type: string;
+  subject?: string;
+  resources?: AuditLogResource[];
+  success?: boolean;
+  data?: Record<string, unknown>;
+  /**
+   * Geolocation of the caller. When omitted, these default to the current
+   * request's geo data (from the request context), so custom events carry the
+   * same location information as the auto-emitted per-request event.
+   */
+  country?: string;
+  region?: string;
+  city?: string;
+  /** Override the auto-derived actor (rare). */
+  actor?: {
+    sub?: string;
+    type?: "user" | "service" | "apikey" | "anonymous";
+    email?: string;
+    connection?: string;
+  };
+  /** MCP-specific helpers. */
+  mcp?: {
+    server?: string;
+    virtualServer?: string;
+    tool?: string;
+  };
+}
+
+/**
+ * Capture detailed logs of requests for auditing purposes. The policy emits
+ * one structured CloudEvent per request, and user code can emit additional
+ * events via the static `log()` method.
+ *
+ * @title Audit Logs
+ * @product api-gateway
+ * @public
+ * @enterprise
+ */
+export declare class AuditLogInboundPolicy extends InboundPolicy<AuditLogInboundPolicyOptions> {
+  #private;
+  static readonly policyType = "audit-logs";
+  /**
+   * Emit an audit event for the current request.
+   *
+   * Fields not provided are filled in from the request context (bucket id,
+   * request id, time, actor, IP, user agent, etc).
+   *
+   * @param context - The current ZuploContext.
+   * @param event - The event details to record.
+   */
+  static log(context: ZuploContext, event: AuditLogEventInput): void;
+  constructor(options: AuditLogInboundPolicyOptions, policyName: string);
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * The options for the Audit Log Inbound policy.
+ * @public
+ */
+export declare interface AuditLogInboundPolicyOptions {
+  /**
+   * Reverse-DNS prefix used for the auto-emitted request event type. Defaults to 'com.zuplo.api'.
+   */
+  eventTypeBase?: string;
+  /**
+   * Override the bucket id this policy emits events for. Defaults to the bucket id from the runtime environment.
+   */
+  bucketId?: string;
+  /**
+   * Fraction of requests to capture, between 0 (none) and 1 (all). Defaults to 1.
+   */
+  samplingRate?: number;
+  /**
+   * Controls which potentially-sensitive parts of each request are captured in the auto-emitted audit event. Disable fields to satisfy your own data-handling and PII policies. All are enabled by default.
+   */
+  include?: {
+    /**
+     * Include the request's query-string parameters in the logged URL. Disable if query strings may contain sensitive data.
+     */
+    queryParams?: boolean;
+    /**
+     * Include the authenticated user / actor identity (subject, email, connection).
+     */
+    user?: boolean;
+    /**
+     * Include the caller's IP address.
+     */
+    ipAddress?: boolean;
+    /**
+     * Include the caller's geolocation (country, region, city).
+     */
+    geolocation?: boolean;
+  };
+}
+
 /**
  * Configuration options for audit logging
  * @public
@@ -1394,6 +1538,16 @@ declare interface AuditLogRequestFilter {
   (request: ZuploRequest, context: ZuploContext): Promise<boolean>;
 }
 
+/**
+ * A resource affected by an audit event.
+ * @public
+ */
+export declare interface AuditLogResource {
+  type: string;
+  id: string;
+  metadata?: Record<string, unknown>;
+}
+
 /**
  * Authenticate users using Auth0 issued JWT tokens.
  *

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.71.23",
+  "version": "6.71.25",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/hono/dist/adapter/aws-lambda/handler.js

@@ -334,7 +334,7 @@ var isProxyEventALB = (event) => {
   return false;
 };
 var isProxyEventV2 = (event) => {
-  return Object.hasOwn(event, "rawPath");
+  return Object.hasOwn(event, "rawPath") && Object.hasOwn(event.requestContext ?? {}, "http");
 };
 var isLatticeEventV2 = (event) => {
   if (event.requestContext) {

package/node_modules/hono/dist/adapter/bun/websocket.js

@@ -24,7 +24,9 @@ var upgradeWebSocket = defineWebSocketHelper((c, events) => {
     data: {
       events,
       url: new URL(c.req.url),
-      protocol: c.req.url
+      // The first requested subprotocol, exposed via WSContext.protocol to
+      // match the deno and cloudflare adapters.
+      protocol: c.req.header("sec-websocket-protocol")?.split(",")[0]?.trim() ?? ""
     }
   });
   if (upgradeResult) {

package/node_modules/hono/dist/cjs/adapter/aws-lambda/handler.js

@@ -364,7 +364,7 @@ const isProxyEventALB = (event) => {
   return false;
 };
 const isProxyEventV2 = (event) => {
-  return Object.hasOwn(event, "rawPath");
+  return Object.hasOwn(event, "rawPath") && Object.hasOwn(event.requestContext ?? {}, "http");
 };
 const isLatticeEventV2 = (event) => {
   if (event.requestContext) {

package/node_modules/hono/dist/cjs/adapter/bun/websocket.js

@@ -48,7 +48,9 @@ const upgradeWebSocket = (0, import_websocket.defineWebSocketHelper)((c, events)
     data: {
       events,
       url: new URL(c.req.url),
-      protocol: c.req.url
+      // The first requested subprotocol, exposed via WSContext.protocol to
+      // match the deno and cloudflare adapters.
+      protocol: c.req.header("sec-websocket-protocol")?.split(",")[0]?.trim() ?? ""
     }
   });
   if (upgradeResult) {

package/node_modules/hono/dist/cjs/middleware/serve-static/index.js

@@ -65,7 +65,7 @@ const serveStatic = (options) => {
     if (content instanceof Response) {
       return c.newResponse(content.body, content);
     }
-    if (content) {
+    if (content != null) {
       const mimeType = options.mimes && (0, import_mime.getMimeType)(path, options.mimes) || (0, import_mime.getMimeType)(path);
       c.header("Content-Type", mimeType || "application/octet-stream");
       if (options.precompressed && (!mimeType || import_compress.COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {

package/node_modules/hono/dist/cjs/utils/body.js

@@ -20,18 +20,26 @@ __export(body_exports, {
   parseBody: () => parseBody
 });
 module.exports = __toCommonJS(body_exports);
-var import_request = require("../request");
+var import_buffer = require("./buffer");
+const isRawRequest = (request) => "headers" in request;
 const parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
-  const headers = request instanceof import_request.HonoRequest ? request.raw.headers : request.headers;
+  const headers = isRawRequest(request) ? request.headers : request.raw.headers;
   const contentType = headers.get("Content-Type");
-  if (contentType?.startsWith("multipart/form-data") || contentType?.startsWith("application/x-www-form-urlencoded")) {
+  const mediaType = contentType?.split(";")[0].trim().toLowerCase();
+  if (mediaType === "multipart/form-data" || mediaType === "application/x-www-form-urlencoded") {
     return parseFormData(request, { all, dot });
   }
   return {};
 };
 async function parseFormData(request, options) {
-  const formData = await request.formData();
+  const headers = isRawRequest(request) ? request.headers : request.raw.headers;
+  const arrayBuffer = await request.arrayBuffer();
+  const formDataPromise = (0, import_buffer.bufferToFormData)(arrayBuffer, headers.get("Content-Type") || "");
+  if (!isRawRequest(request)) {
+    request.bodyCache.formData = formDataPromise;
+  }
+  const formData = await formDataPromise;
   if (formData) {
     return convertFormDataToBodyData(formData, options);
   }

package/node_modules/hono/dist/cjs/utils/buffer.js

@@ -88,7 +88,8 @@ const bufferToString = (buffer) => {
 const bufferToFormData = (arrayBuffer, contentType) => {
   const response = new Response(arrayBuffer, {
     headers: {
-      "Content-Type": contentType
+      // Normalize the media type (case-insensitive) while keeping parameters like the boundary
+      "Content-Type": contentType.replace(/^[^;]+/, (mediaType) => mediaType.toLowerCase())
     }
   });
   return response.formData();

package/node_modules/hono/dist/cjs/validator/validator.js

@@ -23,9 +23,9 @@ module.exports = __toCommonJS(validator_exports);
 var import_cookie = require("../helper/cookie");
 var import_http_exception = require("../http-exception");
 var import_buffer = require("../utils/buffer");
-const jsonRegex = /^application\/([a-z-\.]+\+)?json(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/;
-const multipartRegex = /^multipart\/form-data(;\s?boundary=[a-zA-Z0-9'"()+_,\-./:=?]+)?$/;
-const urlencodedRegex = /^application\/x-www-form-urlencoded(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/;
+const jsonRegex = /^application\/([a-z-\.]+\+)?json(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i;
+const multipartRegex = /^multipart\/form-data(;\s?boundary=[a-zA-Z0-9'"()+_,\-./:=?]+)?$/i;
+const urlencodedRegex = /^application\/x-www-form-urlencoded(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i;
 const validator = (target, validationFunc) => {
   return async (c, next) => {
     let value = {};

package/node_modules/hono/dist/middleware/serve-static/index.js

@@ -44,7 +44,7 @@ var serveStatic = (options) => {
     if (content instanceof Response) {
       return c.newResponse(content.body, content);
     }
-    if (content) {
+    if (content != null) {
       const mimeType = options.mimes && getMimeType(path, options.mimes) || getMimeType(path);
       c.header("Content-Type", mimeType || "application/octet-stream");
       if (options.precompressed && (!mimeType || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {

package/node_modules/hono/dist/types/middleware/context-storage/index.d.ts

@@ -24,11 +24,11 @@ import type { Env, MiddlewareHandler } from '../../types';
  * app.use(contextStorage())
  *
  * app.use(async (c, next) => {
- *   c.set('message', 'Hono is hot!!)
+ *   c.set('message', 'Hono is hot!!')
  *   await next()
  * })
  *
- * app.get('/', async (c) => { c.text(getMessage()) })
+ * app.get('/', async (c) => c.text(getMessage()))
  *
  * const getMessage = () => {
  *   return getContext<Env>().var.message

package/node_modules/hono/dist/types/utils/body.d.ts

@@ -2,7 +2,7 @@
  * @module
  * Body utility.
  */
-import { HonoRequest } from '../request';
+import type { HonoRequest } from '../request';
 type BodyDataValueDot = {
     [x: string]: string | File | BodyDataValueDot;
 };

package/node_modules/hono/dist/utils/body.js

@@ -1,16 +1,24 @@
 // src/utils/body.ts
-import { HonoRequest } from "../request.js";
+import { bufferToFormData } from "./buffer.js";
+var isRawRequest = (request) => "headers" in request;
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
-  const headers = request instanceof HonoRequest ? request.raw.headers : request.headers;
+  const headers = isRawRequest(request) ? request.headers : request.raw.headers;
   const contentType = headers.get("Content-Type");
-  if (contentType?.startsWith("multipart/form-data") || contentType?.startsWith("application/x-www-form-urlencoded")) {
+  const mediaType = contentType?.split(";")[0].trim().toLowerCase();
+  if (mediaType === "multipart/form-data" || mediaType === "application/x-www-form-urlencoded") {
     return parseFormData(request, { all, dot });
   }
   return {};
 };
 async function parseFormData(request, options) {
-  const formData = await request.formData();
+  const headers = isRawRequest(request) ? request.headers : request.raw.headers;
+  const arrayBuffer = await request.arrayBuffer();
+  const formDataPromise = bufferToFormData(arrayBuffer, headers.get("Content-Type") || "");
+  if (!isRawRequest(request)) {
+    request.bodyCache.formData = formDataPromise;
+  }
+  const formData = await formDataPromise;
   if (formData) {
     return convertFormDataToBodyData(formData, options);
   }

package/node_modules/hono/dist/utils/buffer.js

@@ -64,7 +64,8 @@ var bufferToString = (buffer) => {
 var bufferToFormData = (arrayBuffer, contentType) => {
   const response = new Response(arrayBuffer, {
     headers: {
-      "Content-Type": contentType
+      // Normalize the media type (case-insensitive) while keeping parameters like the boundary
+      "Content-Type": contentType.replace(/^[^;]+/, (mediaType) => mediaType.toLowerCase())
     }
   });
   return response.formData();

package/node_modules/hono/dist/validator/validator.js

@@ -2,9 +2,9 @@
 import { getCookie } from "../helper/cookie/index.js";
 import { HTTPException } from "../http-exception.js";
 import { bufferToFormData } from "../utils/buffer.js";
-var jsonRegex = /^application\/([a-z-\.]+\+)?json(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/;
-var multipartRegex = /^multipart\/form-data(;\s?boundary=[a-zA-Z0-9'"()+_,\-./:=?]+)?$/;
-var urlencodedRegex = /^application\/x-www-form-urlencoded(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/;
+var jsonRegex = /^application\/([a-z-\.]+\+)?json(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i;
+var multipartRegex = /^multipart\/form-data(;\s?boundary=[a-zA-Z0-9'"()+_,\-./:=?]+)?$/i;
+var urlencodedRegex = /^application\/x-www-form-urlencoded(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i;
 var validator = (target, validationFunc) => {
   return async (c, next) => {
     let value = {};

package/node_modules/hono/package.json

@@ -1,13 +1,14 @@
 {
   "name": "hono",
-  "version": "4.12.27",
+  "version": "4.12.28",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",
   "module": "dist/index.js",
   "types": "dist/types/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "!dist/**/*.tsbuildinfo"
   ],
   "scripts": {
     "test": "tsc --noEmit && vitest --run",
@@ -678,17 +679,17 @@
     "eslint": "^9.39.3",
     "jsdom": "22.1.0",
     "msw": "^2.6.0",
-    "np": "10.2.0",
+    "np": "11.2.1",
     "oxc-parser": "^0.96.0",
     "pkg-pr-new": "^0.0.53",
     "prettier": "3.7.4",
     "publint": "0.3.15",
     "typescript": "^5.9.2",
-    "undici": "^6.21.3",
+    "undici": "^6.27.0",
     "vite-plugin-fastly-js-compute": "^0.4.2",
-    "vitest": "^4.1.7",
-    "wrangler": "4.12.0",
-    "ws": "^8.18.0",
+    "vitest": "^4.1.9",
+    "wrangler": "4.107.0",
+    "ws": "^8.21.0",
     "zod": "^3.23.8"
   },
   "packageManager": "bun@1.2.20",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "6.71.23",
+  "version": "6.71.25",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -27,10 +27,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.201.1",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "6.71.23",
+    "@zuplo/core": "6.71.25",
     "@zuplo/editor": "1.0.20821740935",
-    "@zuplo/openapi-tools": "6.71.23",
-    "@zuplo/runtime": "6.71.23",
+    "@zuplo/openapi-tools": "6.71.25",
+    "@zuplo/runtime": "6.71.25",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -61,8 +61,8 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "3.25.76",
-    "@zuplo/graphql": "6.71.23",
-    "@zuplo/otel": "6.71.23"
+    "@zuplo/graphql": "6.71.25",
+    "@zuplo/otel": "6.71.25"
   },
   "bundleDependencies": [
     "@inquirer/prompts",

package/node_modules/@fastify/fast-json-stringify-compiler/.eslintrc

@@ -1 +0,0 @@
-{"extends": "standard"}