@zuplo/cli 7.1.10 → 7.2.0

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -332,6 +332,75 @@ export declare interface AIGatewayConfigurationLoaderV2InboundPolicyOptions {
   cacheTtlSeconds?: number;
 }
 
+/**
+ * AI Gateway DLP Inbound Policy
+ * @title AI Gateway DLP
+ * @product ai-gateway
+ * @hidden
+ * @requiresAI
+ *
+ * Scans the content of AI requests and responses — system prompts, message
+ * text, and tool-call arguments — for sensitive data (credit cards, national
+ * identifiers, API keys and other credentials) using the in-gateway DLP
+ * engine, and applies per-rule actions: mask, block, or log. Detection runs
+ * entirely inside the gateway; nothing is sent to a third-party scanning
+ * service. Streaming responses are scanned as they stream, chunk by chunk
+ * with a sliding boundary window, rather than being buffered to the end.
+ *
+ * Options are validated at request time and invalid options fail closed with
+ * a ConfigurationError. Content that cannot be inspected is denied by
+ * default (`onUnknownShape: "deny"`), and internal scan failures fail closed
+ * by default (`onError: "block"`).
+ *
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare function AIGatewayDlpInboundPolicy(
+  request: ZuploRequest,
+  context: ZuploContext,
+  unparsedOptions: unknown,
+  policyName: string
+): Promise<ZuploRequest | Response>;
+
+/**
+ * The options for the AI Gateway DLP policy. Scans the content of AI requests and responses — system prompts, messages, and tool-call arguments — for sensitive data such as credit cards, national identifiers, and API keys, applying a per-rule action (mask, block, or log). Detection runs entirely inside the gateway and streaming responses are scanned as they stream.
+ * @public
+ */
+export declare interface AIGatewayDlpInboundPolicyOptions {
+  rules: DlpRules;
+  /**
+   * Your own detection rules alongside the built-ins: the same rule object plus a `name`, a regex `pattern`, and optional `context` words.
+   */
+  customRules?: DlpCustomRule[];
+  /**
+   * Exact strings that are never flagged by any rule — documentation samples like Stripe's public test card `4242 4242 4242 4242`, or your own support email address. Matching is case-sensitive against the exact detected text, including when a value arrives split across streaming chunks.
+   */
+  allowValues?: string[];
+  /**
+   * The replacement text for masked matches. The `{type}` token inserts the detected type id in UPPER_SNAKE form (for example `[CONTACT_EMAIL]`), which keeps masked conversations legible to the model. Individual rules can override this.
+   */
+  mask?: string;
+  /**
+   * Default evidence level for rules that do not set their own. See the per-rule `detection` description for the level semantics. There are no numeric confidence thresholds to tune — levels are the whole dial.
+   */
+  detection?: "corroborated" | "standard" | "aggressive";
+  /**
+   * Also scan tool/function-call argument payloads — in requests, buffered responses, and streamed tool-call deltas. Tool arguments are user and model content; disabling this exempts them from every rule.
+   */
+  scanToolArguments?: boolean;
+  streaming?: DlpStreamingSettings;
+  endpoints?: ApplicableEndpoints;
+  onUnknownShape?: OnUnknownShape;
+  onError?: OnEngineError;
+  /**
+   * The detection engine. Only `builtin` (in-gateway regex + checksum detection with context-word scoring; no data egress) is available today. Declaring the discriminator now keeps future engines an additive, non-breaking change.
+   */
+  engine?: "builtin";
+}
+
 /**
  * Adds failure and quota fallbacks to an existing AI Gateway model selection.
  *
@@ -1003,8 +1072,8 @@ export declare interface AIGatewaySemanticCacheV2InboundPolicyOptions {
   namespace?: CacheNamespace;
   recentMessageCount?: RecentMessageCount;
   maxConversationLength?: MaxConversationLength;
-  endpoints?: ApplicableEndpoints;
-  onUnknownShape?: OnUnknownShape;
+  endpoints?: ApplicableEndpoints_2;
+  onUnknownShape?: OnUnknownShape_2;
 }
 
 /**
@@ -1232,8 +1301,8 @@ export declare interface AkamaiAIFirewallV2PolicyOptions {
   "api-key": APIKey_2;
   applicationId?: ApplicationID_2;
   streamingAccumulation?: StreamingAccumulationSettings_2;
-  endpoints?: ApplicableEndpoints_2;
-  onUnknownShape?: OnUnknownShape_2;
+  endpoints?: ApplicableEndpoints_3;
+  onUnknownShape?: OnUnknownShape_3;
   onError?: OnFirewallError_2;
 }
 
@@ -1842,7 +1911,7 @@ declare interface APITokenCredentialConfig {
 }
 
 /**
- * The endpoint shapes to cache. Defaults to all shapes: ['openai-chat', 'anthropic-messages', 'openai-responses'].
+ * The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
  * @public
  */
 declare type ApplicableEndpoints = (
@@ -1852,7 +1921,7 @@ declare type ApplicableEndpoints = (
 )[];
 
 /**
- * The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
+ * The endpoint shapes to cache. Defaults to all shapes: ['openai-chat', 'anthropic-messages', 'openai-responses'].
  * @public
  */
 declare type ApplicableEndpoints_2 = (
@@ -1881,6 +1950,16 @@ declare type ApplicableEndpoints_4 = (
   | "anthropic-messages"
 )[];
 
+/**
+ * The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
+ * @public
+ */
+declare type ApplicableEndpoints_5 = (
+  | "openai-chat"
+  | "openai-responses"
+  | "anthropic-messages"
+)[];
+
 /**
  * The application ID to identify this usage of the AI Firewall (optional).
  * @public
@@ -3775,8 +3854,8 @@ export declare interface CometOpikTracingV2PolicyOptions {
    * The base URL for the Comet Opik API (optional, defaults to https://www.comet.com/opik/api).
    */
   baseUrl?: string;
-  endpoints?: ApplicableEndpoints_3;
-  onUnknownShape?: OnUnknownShape_3;
+  endpoints?: ApplicableEndpoints_4;
+  onUnknownShape?: OnUnknownShape_4;
 }
 
 /**
@@ -4555,7 +4634,11 @@ export declare interface DataLossPreventionInboundPolicyOptions {
    */
   customPatterns?: DlpCustomPattern[];
   /**
-   * Minimum confidence (0-1) a match must reach to count as a finding. Context-dependent recognizers (for example `finance-us-bank-account` or `finance-us-aba-routing`) sit below the default threshold of 0.5 until a context word near the match boosts them above it. Lower the threshold to surface them everywhere; raise it to keep only prefix- or checksum-validated matches.
+   * Values that are never reported as findings, compared against the exact matched text (case-sensitive, separators included). Use this to exempt well-known non-sensitive values that share a sensitive shape — for example the Stripe test card number `4242 4242 4242 4242` in a payments sandbox, or a public support email address. List every written form you want to allow (a spaced and an unspaced card number are different matches).
+   */
+  allowValues?: string[];
+  /**
+   * Minimum confidence (0-1) a match must reach to count as a finding. Every match starts at its recognizer's base confidence and gains a fixed boost of 0.45 when one of the recognizer's context words appears near it. Ambiguous shapes (for example `finance-us-bank-account` or `finance-cvv`) have a low base confidence and only cross the default threshold of 0.5 with that boost; lower the threshold to surface them without context. Raising the threshold is not a precision filter: any recognizer whose base confidence falls below it stops matching entirely except near its context words, and most checksum-validated recognizers run at 0.85, so values above 0.85 disable most of the catalog. To narrow detection, scope the `entities` list instead.
    */
   minConfidence?: number;
   /**
@@ -4698,7 +4781,11 @@ export declare interface DataLossPreventionOutboundPolicyOptions {
    */
   customPatterns?: DlpCustomPattern_2[];
   /**
-   * Minimum confidence (0-1) a match must reach to count as a finding. Context-dependent recognizers (for example `finance-us-bank-account` or `finance-us-aba-routing`) sit below the default threshold of 0.5 until a context word near the match boosts them above it. Lower the threshold to surface them everywhere; raise it to keep only prefix- or checksum-validated matches.
+   * Values that are never reported as findings, compared against the exact matched text (case-sensitive, separators included). Use this to exempt well-known non-sensitive values that share a sensitive shape — for example the Stripe test card number `4242 4242 4242 4242` in a payments sandbox, or a public support email address. List every written form you want to allow (a spaced and an unspaced card number are different matches).
+   */
+  allowValues?: string[];
+  /**
+   * Minimum confidence (0-1) a match must reach to count as a finding. Every match starts at its recognizer's base confidence and gains a fixed boost of 0.45 when one of the recognizer's context words appears near it. Ambiguous shapes (for example `finance-us-bank-account` or `finance-cvv`) have a low base confidence and only cross the default threshold of 0.5 with that boost; lower the threshold to surface them without context. Raising the threshold is not a precision filter: any recognizer whose base confidence falls below it stops matching entirely except near its context words, and most checksum-validated recognizers run at 0.85, so values above 0.85 disable most of the catalog. To narrow detection, scope the `entities` list instead.
    */
   minConfidence?: number;
   /**
@@ -4770,6 +4857,174 @@ declare interface DlpCustomPattern_2 {
   context?: string[];
 }
 
+declare interface DlpCustomRule {
+  /**
+   * Identifier reported in findings and block details for this rule.
+   */
+  name: string;
+  /**
+   * A JavaScript regular expression source string. Remember to escape backslashes for JSON (for example `\\d` for a digit). An invalid pattern fails the configuration at request time — a broken guardrail never degrades into a silent pass-through.
+   */
+  pattern: string;
+  /**
+   * Context words for this rule. With `detection: "corroborated"` the rule only fires when one of these words appears near the match.
+   */
+  context?: string[];
+  /**
+   * What happens when this type is found. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key.
+   */
+  action: "mask" | "block" | "log" | "off";
+  /**
+   * Where the rule applies. `inbound` scans what callers send the model (system prompt, message text, and tool-call arguments); `outbound` scans what the model sends back (buffered responses whole, streaming responses chunk by chunk). Defaults to `both`.
+   */
+  direction?: "both" | "inbound" | "outbound";
+  /**
+   * How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule.
+   */
+  detection?: "corroborated" | "standard" | "aggressive";
+  /**
+   * Replacement text for this rule when `action` is `mask`, overriding the policy-level `mask`. The `{type}` token inserts the detected type id in UPPER_SNAKE form (for example `[CONTACT_EMAIL]`).
+   */
+  mask?: string;
+  partialMask?: DlpPartialMask;
+}
+
+declare interface DlpPartialMask {
+  /**
+   * Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked.
+   */
+  keepLast: number;
+}
+
+declare interface DlpRule {
+  /**
+   * What happens when this type is found. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key.
+   */
+  action: "mask" | "block" | "log" | "off";
+  /**
+   * Where the rule applies. `inbound` scans what callers send the model (system prompt, message text, and tool-call arguments); `outbound` scans what the model sends back (buffered responses whole, streaming responses chunk by chunk). Defaults to `both`.
+   */
+  direction?: "both" | "inbound" | "outbound";
+  /**
+   * How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule.
+   */
+  detection?: "corroborated" | "standard" | "aggressive";
+  /**
+   * Replacement text for this rule when `action` is `mask`, overriding the policy-level `mask`. The `{type}` token inserts the detected type id in UPPER_SNAKE form (for example `[CONTACT_EMAIL]`).
+   */
+  mask?: string;
+  partialMask?: DlpPartialMask;
+}
+
+/**
+ * What to find and what to do about it. Each key is a built-in data type id (like `id-us-ssn`) or a group selector (like `pii` or `secret`, plus any dash-aligned id prefix such as `secret-aws`); each value is a rule object whose required `action` says what happens when that type is found. Types you do not mention are not scanned. The most specific key wins — an exact id beats a prefix beats a group — and the winning entry decides everything for its type, direction included. When one stretch of text matches multiple rules, the severest action wins (block > mask > log). At least one rule must scan something.
+ * @public
+ */
+declare interface DlpRules {
+  contact?: DlpRule;
+  finance?: DlpRule;
+  "finance-us"?: DlpRule;
+  id?: DlpRule;
+  "id-au"?: DlpRule;
+  "id-br"?: DlpRule;
+  "id-ca"?: DlpRule;
+  "id-es"?: DlpRule;
+  "id-fr"?: DlpRule;
+  "id-in"?: DlpRule;
+  "id-it"?: DlpRule;
+  "id-nl"?: DlpRule;
+  "id-pl"?: DlpRule;
+  "id-sg"?: DlpRule;
+  "id-uk"?: DlpRule;
+  "id-us"?: DlpRule;
+  network?: DlpRule;
+  pii?: DlpRule;
+  "region-eu"?: DlpRule;
+  secret?: DlpRule;
+  "secret-aws"?: DlpRule;
+  "contact-email"?: DlpRule;
+  "contact-phone"?: DlpRule;
+  "finance-credit-card"?: DlpRule;
+  "finance-crypto-wallet"?: DlpRule;
+  "finance-cvv"?: DlpRule;
+  "finance-iban"?: DlpRule;
+  "finance-swift-bic"?: DlpRule;
+  "finance-us-aba-routing"?: DlpRule;
+  "finance-us-bank-account"?: DlpRule;
+  "id-au-abn"?: DlpRule;
+  "id-au-acn"?: DlpRule;
+  "id-au-medicare"?: DlpRule;
+  "id-au-tfn"?: DlpRule;
+  "id-br-cpf"?: DlpRule;
+  "id-ca-sin"?: DlpRule;
+  "id-es-nif"?: DlpRule;
+  "id-fr-nir"?: DlpRule;
+  "id-in-aadhaar"?: DlpRule;
+  "id-in-pan"?: DlpRule;
+  "id-it-fiscal-code"?: DlpRule;
+  "id-nl-bsn"?: DlpRule;
+  "id-pl-pesel"?: DlpRule;
+  "id-sg-nric"?: DlpRule;
+  "id-uk-nhs"?: DlpRule;
+  "id-uk-nino"?: DlpRule;
+  "id-us-itin"?: DlpRule;
+  "id-us-passport"?: DlpRule;
+  "id-us-ssn"?: DlpRule;
+  "network-ipv4"?: DlpRule;
+  "network-ipv6"?: DlpRule;
+  "network-mac"?: DlpRule;
+  "secret-anthropic"?: DlpRule;
+  "secret-aws-access-key"?: DlpRule;
+  "secret-aws-bedrock"?: DlpRule;
+  "secret-azure-client"?: DlpRule;
+  "secret-databricks"?: DlpRule;
+  "secret-digitalocean"?: DlpRule;
+  "secret-discord-webhook"?: DlpRule;
+  "secret-github"?: DlpRule;
+  "secret-gitlab"?: DlpRule;
+  "secret-google-api-key"?: DlpRule;
+  "secret-heroku"?: DlpRule;
+  "secret-hugging-face"?: DlpRule;
+  "secret-jwt"?: DlpRule;
+  "secret-mailchimp"?: DlpRule;
+  "secret-mailgun"?: DlpRule;
+  "secret-npm"?: DlpRule;
+  "secret-openai"?: DlpRule;
+  "secret-perplexity"?: DlpRule;
+  "secret-postman"?: DlpRule;
+  "secret-private-key"?: DlpRule;
+  "secret-pypi"?: DlpRule;
+  "secret-sendgrid"?: DlpRule;
+  "secret-sentry"?: DlpRule;
+  "secret-shopify"?: DlpRule;
+  "secret-slack"?: DlpRule;
+  "secret-square"?: DlpRule;
+  "secret-stripe"?: DlpRule;
+  "secret-telegram-bot"?: DlpRule;
+  "secret-terraform"?: DlpRule;
+  "secret-twilio"?: DlpRule;
+  "secret-zuplo"?: DlpRule;
+}
+
+/**
+ * Tuning for streaming (SSE) response scanning. Each chunk is held until the boundary scan that includes its successor passes, then released — so values split across chunks are always fully maskable, at the cost of one chunk of latency.
+ * @public
+ */
+declare interface DlpStreamingSettings {
+  /**
+   * Scan streaming responses. When false, streaming responses pass through unscanned even when rules cover the outbound direction.
+   */
+  enabled?: boolean;
+  /**
+   * Scan across chunk boundaries using a carried tail of already-scanned text. When false, each chunk is scanned alone and released immediately — lower cost, but values split across two chunks are missed.
+   */
+  boundaryScan?: boolean;
+  /**
+   * How many trailing characters are carried from one chunk into the next boundary scan. Bounds memory and re-scan cost; must be larger than the longest value you need to catch.
+   */
+  maxCarryChars?: number;
+}
+
 declare interface DynaTraceLoggingOptions {
   url: string;
   apiToken: string;
@@ -5196,8 +5451,8 @@ export declare interface GalileoTracingV2PolicyOptions {
    * The base URL for the Galileo API (optional, defaults to https://api.galileo.ai).
    */
   baseUrl?: string;
-  endpoints?: ApplicableEndpoints_4;
-  onUnknownShape?: OnUnknownShape_4;
+  endpoints?: ApplicableEndpoints_5;
+  onUnknownShape?: OnUnknownShape_5;
 }
 
 /**
@@ -10578,6 +10833,12 @@ export declare interface OktaJwtInboundPolicyOptions {
   oAuthResourceMetadataEnabled?: boolean;
 }
 
+/**
+ * What to do if the scanner itself throws. The engine is a local in-gateway scanner, so this is effectively unreachable outside of a runtime defect — but a guardrail must declare its failure posture. `block` (the default) fails closed with a 500 in the route's native error format; `allow` fails open and serves the content uninspected.
+ * @public
+ */
+declare type OnEngineError = "block" | "allow";
+
 /**
  * What to do when the Akamai detect call itself fails (invalid API key, rate limit, outage). 'block' (the default) fails closed and returns a 502 so unverified content is never served; 'allow' fails open and lets the request through without inspection. An onError value in the AI Gateway app configuration takes precedence over this option.
  * @public
@@ -10636,19 +10897,19 @@ declare interface OnSendingAwsLambdaEventHook {
 }
 
 /**
- * Unused by the cache (a cache miss is never unsafe, so it always fails open). Present for interface consistency.
+ * What to do when the request shape cannot be inspected. As a guardrail this policy defaults to `deny` (fail closed) so uninspectable content is never served.
  * @public
  */
 declare type OnUnknownShape = "deny" | "skip";
 
 /**
- * What to do when the request shape cannot be inspected. As a guardrail, this policy defaults to 'deny' (fail closed) so uninspectable content is never served.
+ * Unused by the cache (a cache miss is never unsafe, so it always fails open). Present for interface consistency.
  * @public
  */
 declare type OnUnknownShape_2 = "deny" | "skip";
 
 /**
- * What to do on a shape the policy cannot read. As an observer this defaults to 'skip' (fail open — pass through untraced).
+ * What to do when the request shape cannot be inspected. As a guardrail, this policy defaults to 'deny' (fail closed) so uninspectable content is never served.
  * @public
  */
 declare type OnUnknownShape_3 = "deny" | "skip";
@@ -10659,6 +10920,12 @@ declare type OnUnknownShape_3 = "deny" | "skip";
  */
 declare type OnUnknownShape_4 = "deny" | "skip";
 
+/**
+ * What to do on a shape the policy cannot read. As an observer this defaults to 'skip' (fail open — pass through untraced).
+ * @public
+ */
+declare type OnUnknownShape_5 = "deny" | "skip";
+
 /**
  * Handler that serves OpenAPI specification files.
  * Use this to expose your API documentation in a standard format that can be

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.1.10",
+  "version": "7.2.0",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/default-browser/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "default-browser",
-	"version": "5.5.0",
+	"version": "5.5.1",
 	"description": "Get the default browser",
 	"license": "MIT",
 	"repository": "sindresorhus/default-browser",

package/node_modules/default-browser/windows.js

@@ -1,3 +1,4 @@
+import process from 'node:process';
 import {promisify} from 'node:util';
 import {execFile} from 'node:child_process';
 
@@ -31,7 +32,8 @@ export const _windowsBrowserProgIdMap = new Map(Object.entries(windowsBrowserPro
 export class UnknownBrowserError extends Error {}
 
 export default async function defaultBrowser(_execFileAsync = execFileAsync) {
-	const {stdout} = await _execFileAsync('reg', [
+	const regPath = `${process.env.SYSTEMROOT ?? process.env.windir ?? 'C:\\Windows'}\\System32\\reg.exe`;
+	const {stdout} = await _execFileAsync(regPath, [
 		'QUERY',
 		' HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice',
 		'/v',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "7.1.10",
+  "version": "7.2.0",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -28,10 +28,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.220.0",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "7.1.10",
+    "@zuplo/core": "7.2.0",
     "@zuplo/editor": "1.0.31094607111",
-    "@zuplo/openapi-tools": "7.1.10",
-    "@zuplo/runtime": "7.1.10",
+    "@zuplo/openapi-tools": "7.2.0",
+    "@zuplo/runtime": "7.2.0",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -62,8 +62,8 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "4.4.3",
-    "@zuplo/graphql": "7.1.10",
-    "@zuplo/otel": "7.1.10"
+    "@zuplo/graphql": "7.2.0",
+    "@zuplo/otel": "7.2.0"
   },
   "bundleDependencies": [
     "@inquirer/prompts",