@zuplo/cli 6.72.17 → 6.73.0

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -615,6 +615,13 @@ export declare interface AIGatewaySemanticCacheOutboundPolicyOptions {}
  * route's chain is what enables it. `namespace` defaults to the AI Gateway
  * configuration id when omitted so caching stays scoped per tenant.
  *
+ * Cache outcomes are reported on the response via the RFC 9211 `Cache-Status`
+ * header under the cache name `zp-aigw-sem-cache` (hit:
+ * `zp-aigw-sem-cache; hit; detail="similarity=0.93"`; miss:
+ * `zp-aigw-sem-cache; fwd=miss; stored`) alongside the legacy
+ * `x-ai-gateway-cache: HIT|MISS` and `x-ai-gateway-cache-similarity` headers,
+ * kept for compatibility.
+ *
  * @title AI Gateway Semantic Cache (v2)
  * @product ai-gateway
  * @hidden
@@ -2673,7 +2680,7 @@ declare interface CacheOptions {
 }
 
 /**
- * How long a cached response lives, in seconds. Defaults to 3600 (1 hour).
+ * How long a cached response lives, in whole seconds. Defaults to 3600 (1 hour); maximum 2592000 (30 days).
  * @public
  */
 declare type CacheTTLSeconds = number;

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.72.17",
+  "version": "6.73.0",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/fast-uri/index.js

@@ -202,6 +202,10 @@ function serialize (cmpts, opts) {
 
 const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u
 
+// Captures the authority component (between "//" and the next "/", "?" or "#"),
+// with or without a scheme prefix, for the literal-backslash rejection below.
+const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/
+
 /**
  * @param {import('./types/index').URIComponent} parsed
  * @param {RegExpMatchArray} matches
@@ -248,6 +252,19 @@ function parseWithStatus (uri, opts) {
     }
   }
 
+  // A literal backslash (U+005C) is not a valid RFC 3986 URI character and is
+  // not an authority delimiter. Reject it in the authority rather than
+  // rewriting it: normalizing "\" -> "/" (WHATWG error recovery) could silently
+  // change the resource identified by an otherwise-invalid input, and lets "\"
+  // act as a host delimiter here while Node's native URL parses a different
+  // host (SSRF / redirect / origin-allowlist bypass). Percent-encoded %5C is
+  // untouched and remains valid encoded data.
+  const authorityMatch = uri.match(AUTHORITY_PREFIX)
+  if (authorityMatch !== null && authorityMatch[1].indexOf('\\') !== -1) {
+    parsed.error = 'URI authority must not contain a literal backslash.'
+    malformedAuthorityOrPort = true
+  }
+
   const matches = uri.match(URI_PARSE)
 
   if (matches) {

package/node_modules/fast-uri/package.json

@@ -1,7 +1,7 @@
 {
   "name": "fast-uri",
   "description": "Dependency-free RFC 3986 URI toolbox",
-  "version": "3.1.3",
+  "version": "3.1.4",
   "main": "index.js",
   "type": "commonjs",
   "types": "types/index.d.ts",

package/node_modules/fast-uri/test/security.test.js

@@ -159,3 +159,65 @@ test('parse canonicalises IDN / Unicode hosts to their ASCII form', (t) => {
     t.equal(parsed.host, expectedHost, `host canonicalised to ASCII: ${description}`)
   })
 })
+
+test('parse rejects a literal backslash in the authority as malformed (RFC 3986)', (t) => {
+  // Regression for the host-confusion bypass: a literal "\" is invalid RFC 3986
+  // syntax and must be flagged malformed, not silently rewritten. Otherwise "\"
+  // acts as a host delimiter here while Node's native URL parses a different
+  // host, defeating a host-based SSRF/redirect/origin allowlist.
+  const cases = [
+    'http://evil.com\\@allowed.com',
+    'https://169.254.169.254\\@trusted.example.com',
+    'http://127.0.0.1\\@public.example.com',
+    'https://attacker.com\\@api.internal',
+    'http://a\\@b',
+    'ws://evil.com\\@allowed.com/chat',
+    'wss://evil.com\\@allowed.com/chat',
+    'http://evil.com\\%40allowed.com',
+    '//evil.com\\@allowed.com'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(
+      fastURI.parse(input).error,
+      'URI authority must not contain a literal backslash.',
+      input
+    )
+  })
+})
+
+test('normalize does not canonicalize a literal-backslash URI into a different valid URL', (t) => {
+  const cases = [
+    'http://evil.com\\@allowed.com',
+    'https://attacker.com\\@api.internal'
+  ]
+
+  t.plan(cases.length)
+
+  cases.forEach((input) => {
+    t.equal(fastURI.normalize(input), input, input)
+  })
+})
+
+test('parse leaves percent-encoded %5C untouched as encoded data (not rejected)', (t) => {
+  // Only the literal "\" byte is rejected; %5C stays valid encoded data and
+  // does not diverge from the native URL parser, so it must not be flagged.
+  const input = 'http://evil.com%5C@allowed.com'
+  const parsed = fastURI.parse(input)
+
+  t.plan(2)
+  t.notOk(parsed.error, '%5C is valid encoded data, not malformed')
+  t.equal(parsed.host, new URL(input).hostname, '%5C host matches native URL (no divergence)')
+})
+
+test('parse does not reject a literal backslash in the query or fragment', (t) => {
+  // The rejection is scoped to the authority/path (the host-confusion surface);
+  // a backslash after "?"/"#" is normalized as encoded data as before.
+  const parsed = fastURI.parse('http://host.example.com/?x=\\y#z\\w')
+
+  t.plan(2)
+  t.notOk(parsed.error, 'backslash in query/fragment does not mark the URI malformed')
+  t.equal(parsed.host, 'host.example.com', 'host parsed normally')
+})

package/node_modules/hono/dist/cjs/helper/streaming/sse.js

@@ -33,8 +33,9 @@ class SSEStreamingApi extends import_stream.StreamingApi {
     const dataLines = data.split(/\r\n|\r|\n/).map((line) => {
       return `data: ${line}`;
     }).join("\n");
-    for (const key of ["event", "id", "retry"]) {
-      if (message[key] && /[\r\n]/.test(message[key])) {
+    for (const key of ["event", "id"]) {
+      const value = message[key];
+      if (value && /[\r\n]/.test(value)) {
         throw new Error(`${key} must not contain "\\r" or "\\n"`);
       }
     }
@@ -42,7 +43,7 @@ class SSEStreamingApi extends import_stream.StreamingApi {
       message.event && `event: ${message.event}`,
       dataLines,
       message.id && `id: ${message.id}`,
-      message.retry && `retry: ${message.retry}`
+      message.retry !== void 0 && `retry: ${message.retry}`
     ].filter(Boolean).join("\n") + "\n\n";
     await this.write(sseData);
   }

package/node_modules/hono/dist/cjs/request.js

@@ -316,11 +316,16 @@ const cloneRawRequest = async (req) => {
       message: "Cannot clone request: body was already consumed and not cached. Please use HonoRequest methods (e.g., req.json(), req.text()) instead of consuming req.raw directly."
     });
   }
+  const body = await req[cacheKey]();
+  const headers = req.header();
+  if (body instanceof FormData) {
+    delete headers["content-type"];
+  }
   const requestInit = {
-    body: await req[cacheKey](),
+    body,
     cache: req.raw.cache,
     credentials: req.raw.credentials,
-    headers: req.header(),
+    headers,
     integrity: req.raw.integrity,
     keepalive: req.raw.keepalive,
     method: req.method,

package/node_modules/hono/dist/cjs/utils/body.js

@@ -33,6 +33,12 @@ const parseBody = async (request, options = /* @__PURE__ */ Object.create(null))
   return {};
 };
 async function parseFormData(request, options) {
+  if (!isRawRequest(request) && request.bodyCache.formData) {
+    return convertFormDataToBodyData(
+      await request.bodyCache.formData,
+      options
+    );
+  }
   const headers = isRawRequest(request) ? request.headers : request.raw.headers;
   const arrayBuffer = await request.arrayBuffer();
   const formDataPromise = (0, import_buffer.bufferToFormData)(arrayBuffer, headers.get("Content-Type") || "");

package/node_modules/hono/dist/helper/streaming/sse.js

@@ -11,8 +11,9 @@ var SSEStreamingApi = class extends StreamingApi {
     const dataLines = data.split(/\r\n|\r|\n/).map((line) => {
       return `data: ${line}`;
     }).join("\n");
-    for (const key of ["event", "id", "retry"]) {
-      if (message[key] && /[\r\n]/.test(message[key])) {
+    for (const key of ["event", "id"]) {
+      const value = message[key];
+      if (value && /[\r\n]/.test(value)) {
         throw new Error(`${key} must not contain "\\r" or "\\n"`);
       }
     }
@@ -20,7 +21,7 @@ var SSEStreamingApi = class extends StreamingApi {
       message.event && `event: ${message.event}`,
       dataLines,
       message.id && `id: ${message.id}`,
-      message.retry && `retry: ${message.retry}`
+      message.retry !== void 0 && `retry: ${message.retry}`
     ].filter(Boolean).join("\n") + "\n\n";
     await this.write(sseData);
   }

package/node_modules/hono/dist/request.js

@@ -294,11 +294,16 @@ var cloneRawRequest = async (req) => {
       message: "Cannot clone request: body was already consumed and not cached. Please use HonoRequest methods (e.g., req.json(), req.text()) instead of consuming req.raw directly."
     });
   }
+  const body = await req[cacheKey]();
+  const headers = req.header();
+  if (body instanceof FormData) {
+    delete headers["content-type"];
+  }
   const requestInit = {
-    body: await req[cacheKey](),
+    body,
     cache: req.raw.cache,
     credentials: req.raw.credentials,
-    headers: req.header(),
+    headers,
     integrity: req.raw.integrity,
     keepalive: req.raw.keepalive,
     method: req.method,

package/node_modules/hono/dist/types/middleware/combine/index.d.ts

@@ -71,7 +71,7 @@ export declare const every: (...middleware: (MiddlewareHandler | Condition)[]) =
  * @example
  * ```ts
  * import { except } from 'hono/combine'
- * import { bearerAuth } from 'hono/bearer-auth
+ * import { bearerAuth } from 'hono/bearer-auth'
  *
  * // If client is accessing public API, then skip authentication.
  * // Otherwise, require a valid token.

package/node_modules/hono/dist/utils/body.js

@@ -12,6 +12,12 @@ var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) =
   return {};
 };
 async function parseFormData(request, options) {
+  if (!isRawRequest(request) && request.bodyCache.formData) {
+    return convertFormDataToBodyData(
+      await request.bodyCache.formData,
+      options
+    );
+  }
   const headers = isRawRequest(request) ? request.headers : request.raw.headers;
   const arrayBuffer = await request.arrayBuffer();
   const formDataPromise = bufferToFormData(arrayBuffer, headers.get("Content-Type") || "");

package/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.12.30",
+  "version": "4.12.31",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "6.72.17",
+  "version": "6.73.0",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -27,10 +27,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.201.1",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "6.72.17",
+    "@zuplo/core": "6.73.0",
     "@zuplo/editor": "1.0.20821740935",
-    "@zuplo/openapi-tools": "6.72.17",
-    "@zuplo/runtime": "6.72.17",
+    "@zuplo/openapi-tools": "6.73.0",
+    "@zuplo/runtime": "6.73.0",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -61,8 +61,8 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "3.25.76",
-    "@zuplo/graphql": "6.72.17",
-    "@zuplo/otel": "6.72.17"
+    "@zuplo/graphql": "6.73.0",
+    "@zuplo/otel": "6.73.0"
   },
   "bundleDependencies": [
     "@inquirer/prompts",