@zuplo/cli 6.72.3 → 6.72.8

package/node_modules/@zuplo/runtime/out/types/mcp-gateway/index.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod/v4";
 
 /**
- * Optional per-caller access control. Defaults to mode 'allPublic' (no access control). Set mode to 'rolesAndGroups' to match the caller's role/group claims against each capability's markup (every capability must then set roles/groups or public: true), or 'function' to delegate to a custom resolver.
+ * Optional per-caller access control. Defaults to mode 'allPublic' (no access control). Set mode to 'rolesAndGroups' to match the caller's role/group claims against each capability's markup (a capability with no roles/groups/public markup is available to no one), or 'function' to delegate to a custom resolver.
  * @public
  */
 declare interface AccessControl {
@@ -128,9 +128,9 @@ declare interface BuildRouteConfiguration {
  * `roles`/`groups`, each allowing a dot-path such as `realm_access.roles`).
  * `request.user.data` is populated by whichever auth policy ran (JWT claims,
  * API-key metadata, etc.). A capability marked `public: true` is allowed for
- * everyone; otherwise the caller must match any listed role or group. In this
- * mode every capability must be classified (see {@link assertClassified}), so
- * nothing is public by omission.
+ * everyone; otherwise the caller must match any listed role or group. A
+ * capability with no roles/groups/public markup is available to no one until
+ * it is classified, so nothing is ever exposed by omission.
  *
  * @public
  */
@@ -3501,10 +3501,6 @@ export declare interface McpTokenExchangeInboundPolicyOptions {
    * Optional human-readable summary of the upstream, shown on the consent page.
    */
   summary?: string;
-  /**
-   * Optional override for the upstream's OAuth protected-resource metadata URL. Defaults from the route handler's rewritePattern.
-   */
-  protectedResourceMetadataUrl?: string;
   /**
    * Authentication mode. `user-oauth` performs per-user OAuth federation; `shared-oauth` uses a gateway-wide OAuth grant; `id-jag` exchanges the caller's identity assertion at the configured IdP for an ID-JAG (Identity Assertion JWT Authorization Grant, also known as Cross-App Access / XAA), then redeems it at the upstream Resource Authorization Server for an upstream access token.
    */
@@ -3513,6 +3509,10 @@ export declare interface McpTokenExchangeInboundPolicyOptions {
    * OAuth scopes to request from the upstream (for OAuth modes).
    */
   scopes?: string[];
+  /**
+   * Optional override for the upstream's OAuth protected-resource metadata URL. Defaults from the route handler's rewritePattern.
+   */
+  protectedResourceMetadataUrl?: string;
   /**
    * Delimiter used to join scopes in the OAuth authorization request. Defaults to a single space.
    */
@@ -4541,7 +4541,7 @@ declare interface PromptProjection {
 }
 
 /**
- * Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' every capability must set roles/groups OR public: true (not both) — an unclassified capability is a configuration error, so nothing is ever exposed by omission.
+ * Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' a capability with no roles/groups/public markup is available to no one until it is classified, so nothing is ever exposed by omission. Combining public: true with roles/groups is a configuration error.
  * @public
  */
 declare type Public = boolean;

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.72.3",
+  "version": "6.72.8",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/hono/dist/adapter/aws-lambda/handler.js

@@ -348,10 +348,7 @@ var defaultIsContentTypeBinary = (contentType) => {
   );
 };
 var isContentEncodingBinary = (contentEncoding) => {
-  if (contentEncoding === null) {
-    return false;
-  }
-  return /^(gzip|deflate|compress|br)/.test(contentEncoding);
+  return !!contentEncoding && !/^identity$/i.test(contentEncoding);
 };
 export {
   ALBProcessor,

package/node_modules/hono/dist/adapter/lambda-edge/handler.js

@@ -15,21 +15,31 @@ var convertHeaders = (headers) => {
 var handle = (app) => {
   return async (event, ...args) => {
     const [context, callback] = args;
+    let callbackError = null;
+    let callbackResult;
     const res = await app.fetch(createRequest(event), {
       event,
       context,
       callback: (err, result) => {
+        if (!callbackError && !callbackResult) {
+          callbackError = err;
+          callbackResult = result;
+        }
         callback?.(err, result);
       },
       config: event.Records[0].cf.config,
       request: event.Records[0].cf.request,
       response: event.Records[0].cf.response
     });
-    return createResult(res);
+    if (callbackError) {
+      throw callbackError;
+    }
+    return callbackResult ?? createResult(res);
   };
 };
 var createResult = async (res) => {
-  const isBase64Encoded = isContentTypeBinary(res.headers.get("content-type") || "");
+  const contentEncoding = res.headers.get("content-encoding");
+  const isBase64Encoded = isContentTypeBinary(res.headers.get("content-type") || "") || !!contentEncoding && !/^identity$/i.test(contentEncoding);
   const body = isBase64Encoded ? encodeBase64(await res.arrayBuffer()) : await res.text();
   return {
     status: res.status.toString(),

package/node_modules/hono/dist/cjs/adapter/aws-lambda/handler.js

@@ -378,10 +378,7 @@ const defaultIsContentTypeBinary = (contentType) => {
   );
 };
 const isContentEncodingBinary = (contentEncoding) => {
-  if (contentEncoding === null) {
-    return false;
-  }
-  return /^(gzip|deflate|compress|br)/.test(contentEncoding);
+  return !!contentEncoding && !/^identity$/i.test(contentEncoding);
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/node_modules/hono/dist/cjs/adapter/lambda-edge/handler.js

@@ -48,21 +48,31 @@ const convertHeaders = (headers) => {
 const handle = (app) => {
   return async (event, ...args) => {
     const [context, callback] = args;
+    let callbackError = null;
+    let callbackResult;
     const res = await app.fetch(createRequest(event), {
       event,
       context,
       callback: (err, result) => {
+        if (!callbackError && !callbackResult) {
+          callbackError = err;
+          callbackResult = result;
+        }
         callback?.(err, result);
       },
       config: event.Records[0].cf.config,
       request: event.Records[0].cf.request,
       response: event.Records[0].cf.response
     });
-    return createResult(res);
+    if (callbackError) {
+      throw callbackError;
+    }
+    return callbackResult ?? createResult(res);
   };
 };
 const createResult = async (res) => {
-  const isBase64Encoded = isContentTypeBinary(res.headers.get("content-type") || "");
+  const contentEncoding = res.headers.get("content-encoding");
+  const isBase64Encoded = isContentTypeBinary(res.headers.get("content-type") || "") || !!contentEncoding && !/^identity$/i.test(contentEncoding);
   const body = isBase64Encoded ? (0, import_encode.encodeBase64)(await res.arrayBuffer()) : await res.text();
   return {
     status: res.status.toString(),

package/node_modules/hono/dist/cjs/client/client.js

@@ -184,7 +184,16 @@ const hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
   });
   if (method) {
     options ??= {};
-    const args = (0, import_utils.deepMerge)(options, { ...opts.args[1] });
+    const reqOptions = { ...opts.args[1] };
+    const baseHeaders = options.headers;
+    const reqHeaders = reqOptions.headers;
+    if (baseHeaders && reqHeaders) {
+      reqOptions.headers = async () => ({
+        ...typeof baseHeaders === "function" ? await baseHeaders() : baseHeaders,
+        ...typeof reqHeaders === "function" ? await reqHeaders() : reqHeaders
+      });
+    }
+    const args = (0, import_utils.deepMerge)(options, reqOptions);
     return req.fetch(opts.args[0], args);
   }
   return req;

package/node_modules/hono/dist/cjs/client/utils.js

@@ -36,7 +36,7 @@ const mergePath = (base, path) => {
 };
 const replaceUrlParam = (urlString, params) => {
   for (const [k, v] of Object.entries(params)) {
-    const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??");
+    const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??(?=/|$)");
     urlString = urlString.replace(reg, v ? `/${v}` : "");
   }
   return urlString;

package/node_modules/hono/dist/cjs/middleware/cache/index.js

@@ -55,7 +55,7 @@ const cache = (options) => {
   );
   const addHeader = (c, responseVary) => {
     if (cacheControlDirectives) {
-      const existingDirectives = c.res.headers.get("Cache-Control")?.split(",").map((d) => d.trim().split("=", 1)[0]) ?? [];
+      const existingDirectives = c.res.headers.get("Cache-Control")?.split(",").map((d) => d.trim().split("=", 1)[0].toLowerCase()) ?? [];
       for (const directive of cacheControlDirectives) {
         let [name, value] = directive.trim().split("=", 2);
         name = name.toLowerCase();

package/node_modules/hono/dist/cjs/middleware/compress/index.js

@@ -57,7 +57,8 @@ const compress = (options) => {
   return async function compress2(ctx, next) {
     await next();
     const contentLength = ctx.res.headers.get("Content-Length");
-    if (ctx.res.headers.has("Content-Encoding") || // already encoded
+    if (ctx.res.status === 206 || // partial content, Content-Range refers to the uncompressed bytes
+    ctx.res.headers.has("Content-Encoding") || // already encoded
     ctx.res.headers.has("Transfer-Encoding") || // already encoded or chunked
     ctx.req.method === "HEAD" || // HEAD request
     contentLength && Number(contentLength) < threshold || // content-length below threshold

package/node_modules/hono/dist/cjs/middleware/etag/index.js

@@ -70,7 +70,8 @@ const etag = (options) => {
       }
       etag3 = weak ? `W/"${hash}"` : `"${hash}"`;
     }
-    if (etagMatches(etag3, ifNoneMatch)) {
+    const matched = ifNoneMatch === "*" ? (c.req.method === "GET" || c.req.method === "HEAD") && res.ok : etagMatches(etag3, ifNoneMatch);
+    if (matched) {
       c.res = new Response(null, {
         status: 304,
         statusText: "Not Modified",

package/node_modules/hono/dist/cjs/middleware/method-override/index.js

@@ -80,11 +80,13 @@ const methodOverride = (options) => async function methodOverride2(c, next) {
     if (method) {
       const url = new URL(c.req.url);
       url.searchParams.delete(queryName);
-      const request = new Request(url.toString(), {
+      const requestInit = {
         body: c.req.raw.body,
         headers: c.req.raw.headers,
-        method
-      });
+        method,
+        duplex: c.req.raw.body ? "half" : void 0
+      };
+      const request = new Request(url.toString(), requestInit);
       return app.fetch(request, c.env, getExecutionCtx(c));
     }
   }

package/node_modules/hono/dist/cjs/router/trie-router/node.js

@@ -155,6 +155,15 @@ class Node {
             if (m) {
               params[name] = m[0];
               this.#pushHandlerSets(handlerSets, child, method, node.#params, params);
+              if (m[0].length === restPathString.length && child.#children["*"]) {
+                this.#pushHandlerSets(
+                  handlerSets,
+                  child.#children["*"],
+                  method,
+                  node.#params,
+                  params
+                );
+              }
               if (hasChildren(child.#children)) {
                 child.#params = params;
                 const componentCount = m[0].match(/\//)?.length ?? 0;

package/node_modules/hono/dist/client/client.js

@@ -170,7 +170,16 @@ var hc = (baseUrl, options) => createProxy(function proxyCallback(opts) {
   });
   if (method) {
     options ??= {};
-    const args = deepMerge(options, { ...opts.args[1] });
+    const reqOptions = { ...opts.args[1] };
+    const baseHeaders = options.headers;
+    const reqHeaders = reqOptions.headers;
+    if (baseHeaders && reqHeaders) {
+      reqOptions.headers = async () => ({
+        ...typeof baseHeaders === "function" ? await baseHeaders() : baseHeaders,
+        ...typeof reqHeaders === "function" ? await reqHeaders() : reqHeaders
+      });
+    }
+    const args = deepMerge(options, reqOptions);
     return req.fetch(opts.args[0], args);
   }
   return req;

package/node_modules/hono/dist/client/utils.js

@@ -8,7 +8,7 @@ var mergePath = (base, path) => {
 };
 var replaceUrlParam = (urlString, params) => {
   for (const [k, v] of Object.entries(params)) {
-    const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??");
+    const reg = new RegExp("/:" + k + "(?:{[^/]+})?\\??(?=/|$)");
     urlString = urlString.replace(reg, v ? `/${v}` : "");
   }
   return urlString;

package/node_modules/hono/dist/middleware/cache/index.js

@@ -34,7 +34,7 @@ var cache = (options) => {
   );
   const addHeader = (c, responseVary) => {
     if (cacheControlDirectives) {
-      const existingDirectives = c.res.headers.get("Cache-Control")?.split(",").map((d) => d.trim().split("=", 1)[0]) ?? [];
+      const existingDirectives = c.res.headers.get("Cache-Control")?.split(",").map((d) => d.trim().split("=", 1)[0].toLowerCase()) ?? [];
       for (const directive of cacheControlDirectives) {
         let [name, value] = directive.trim().split("=", 2);
         name = name.toLowerCase();

package/node_modules/hono/dist/middleware/compress/index.js

@@ -35,7 +35,8 @@ var compress = (options) => {
   return async function compress2(ctx, next) {
     await next();
     const contentLength = ctx.res.headers.get("Content-Length");
-    if (ctx.res.headers.has("Content-Encoding") || // already encoded
+    if (ctx.res.status === 206 || // partial content, Content-Range refers to the uncompressed bytes
+    ctx.res.headers.has("Content-Encoding") || // already encoded
     ctx.res.headers.has("Transfer-Encoding") || // already encoded or chunked
     ctx.req.method === "HEAD" || // HEAD request
     contentLength && Number(contentLength) < threshold || // content-length below threshold

package/node_modules/hono/dist/middleware/etag/index.js

@@ -48,7 +48,8 @@ var etag = (options) => {
       }
       etag3 = weak ? `W/"${hash}"` : `"${hash}"`;
     }
-    if (etagMatches(etag3, ifNoneMatch)) {
+    const matched = ifNoneMatch === "*" ? (c.req.method === "GET" || c.req.method === "HEAD") && res.ok : etagMatches(etag3, ifNoneMatch);
+    if (matched) {
       c.res = new Response(null, {
         status: 304,
         statusText: "Not Modified",

package/node_modules/hono/dist/middleware/method-override/index.js

@@ -59,11 +59,13 @@ var methodOverride = (options) => async function methodOverride2(c, next) {
     if (method) {
       const url = new URL(c.req.url);
       url.searchParams.delete(queryName);
-      const request = new Request(url.toString(), {
+      const requestInit = {
         body: c.req.raw.body,
         headers: c.req.raw.headers,
-        method
-      });
+        method,
+        duplex: c.req.raw.body ? "half" : void 0
+      };
+      const request = new Request(url.toString(), requestInit);
       return app.fetch(request, c.env, getExecutionCtx(c));
     }
   }

package/node_modules/hono/dist/router/trie-router/node.js

@@ -134,6 +134,15 @@ var Node = class _Node {
             if (m) {
               params[name] = m[0];
               this.#pushHandlerSets(handlerSets, child, method, node.#params, params);
+              if (m[0].length === restPathString.length && child.#children["*"]) {
+                this.#pushHandlerSets(
+                  handlerSets,
+                  child.#children["*"],
+                  method,
+                  node.#params,
+                  params
+                );
+              }
               if (hasChildren(child.#children)) {
                 child.#params = params;
                 const componentCount = m[0].match(/\//)?.length ?? 0;

package/node_modules/hono/dist/types/adapter/lambda-edge/handler.d.ts

@@ -81,7 +81,7 @@ interface CloudFrontResult {
     body?: string;
     bodyEncoding?: 'text' | 'base64';
 }
-export declare const handle: (app: Hono<any>) => ((event: CloudFrontEdgeEvent, context?: CloudFrontContext, callback?: Callback) => Promise<CloudFrontResult>);
+export declare const handle: (app: Hono<any>) => ((event: CloudFrontEdgeEvent, context?: CloudFrontContext, callback?: Callback) => Promise<CloudFrontResult | CloudFrontRequest>);
 export declare const createBody: (method: string, requestBody: CloudFrontRequest["body"]) => string | Uint8Array<ArrayBuffer> | undefined;
 export declare const isContentTypeBinary: (contentType: string) => boolean;
 export {};

package/node_modules/hono/dist/types/helper/websocket/index.d.ts

@@ -31,7 +31,7 @@ export type WSReadyState = 0 | 1 | 2 | 3;
  * An argument for WSContext class
  */
 export interface WSContextInit<T = unknown> {
-    send(data: string | ArrayBuffer | Uint8Array, options: SendOptions): void;
+    send(data: string | ArrayBuffer | Uint8Array<ArrayBuffer>, options: SendOptions): void;
     close(code?: number, reason?: string): void;
     raw?: T;
     readyState: WSReadyState;

package/node_modules/hono/dist/types/middleware/language/language.d.ts

@@ -98,5 +98,23 @@ export declare function validateOptions(options: DetectorOptions): void;
  * Language detector middleware factory
  * @param userOptions Configuration options for the language detector
  * @returns Hono middleware function
+ *
+ * @example
+ * ```ts
+ * type Variables = LanguageVariables
+ * const app = new Hono<{ Variables: Variables }>()
+ *
+ * app.use(
+ *   languageDetector({
+ *     supportedLanguages: ['en', 'ja'], // Must include fallback
+ *     fallbackLanguage: 'en', // Required
+ *   })
+ * )
+ *
+ * app.get('/', (c) => {
+ *   const lang = c.get('language')
+ *   return c.text(`Current language: ${lang}`)
+ * })
+ * ```
  */
 export declare const languageDetector: (userOptions: Partial<DetectorOptions>) => MiddlewareHandler;

package/node_modules/hono/dist/types/utils/types.d.ts

@@ -42,7 +42,7 @@ export type JSONParsed<T, TError = bigint | ReadonlyArray<bigint>> = T extends {
     toJSON(): unknown;
 } ? {} : JSONParsed<J, TError> : T extends JSONPrimitive ? T : T extends InvalidJSONValue ? never : T extends ReadonlyArray<unknown> ? {
     [K in keyof T]: JSONParsed<InvalidToNull<T[K]>, TError>;
-} : T extends Set<unknown> | Map<unknown, unknown> | Record<string, never> ? {} : T extends object ? T[keyof T] extends TError ? never : {
+} extends infer A ? A extends ReadonlyArray<unknown> ? A : JSONParsed<InvalidToNull<T[number]>, TError>[] : never : T extends Set<unknown> | Map<unknown, unknown> | Record<string, never> ? {} : T extends object ? T[keyof T] extends TError ? never : {
     [K in keyof OmitSymbolKeys<T> as IsInvalid<T[K]> extends true ? never : K]: boolean extends IsInvalid<T[K]> ? JSONParsed<T[K], TError> | undefined : JSONParsed<T[K], TError>;
 } : T extends unknown ? T extends TError ? never : JSONValue : never;
 /**

package/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.12.28",
+  "version": "4.12.30",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",
@@ -11,7 +11,7 @@
     "!dist/**/*.tsbuildinfo"
   ],
   "scripts": {
-    "test": "tsc --noEmit && vitest --run",
+    "test": "tsc -p tsconfig.spec.json && vitest --run",
     "test:watch": "vitest --watch",
     "test:deno": "deno test --allow-read --allow-env --allow-write --allow-net -c runtime-tests/deno/deno.json runtime-tests/deno && deno test --no-lock -c runtime-tests/deno-jsx/deno.precompile.json runtime-tests/deno-jsx && deno test --no-lock -c runtime-tests/deno-jsx/deno.react-jsx.json runtime-tests/deno-jsx",
     "test:bun": "bun test --jsx-import-source ../../src/jsx runtime-tests/bun/*",
@@ -666,7 +666,7 @@
     "nodejs"
   ],
   "devDependencies": {
-    "@hono/eslint-config": "^2.1.0",
+    "@hono/eslint-config": "^2.1.1",
     "@hono/node-server": "^2.0.2",
     "@types/jsdom": "^21.1.7",
     "@types/node": "^24.3.0",
@@ -684,7 +684,7 @@
     "pkg-pr-new": "^0.0.53",
     "prettier": "3.7.4",
     "publint": "0.3.15",
-    "typescript": "^5.9.2",
+    "typescript": "^6.0.3",
     "undici": "^6.27.0",
     "vite-plugin-fastly-js-compute": "^0.4.2",
     "vitest": "^4.1.9",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "6.72.3",
+  "version": "6.72.8",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -27,10 +27,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.201.1",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "6.72.3",
+    "@zuplo/core": "6.72.8",
     "@zuplo/editor": "1.0.20821740935",
-    "@zuplo/openapi-tools": "6.72.3",
-    "@zuplo/runtime": "6.72.3",
+    "@zuplo/openapi-tools": "6.72.8",
+    "@zuplo/runtime": "6.72.8",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -61,8 +61,8 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "3.25.76",
-    "@zuplo/graphql": "6.72.3",
-    "@zuplo/otel": "6.72.3"
+    "@zuplo/graphql": "6.72.8",
+    "@zuplo/otel": "6.72.8"
   },
   "bundleDependencies": [
     "@inquirer/prompts",