@zuplo/cli 7.1.9 → 7.2.0

package/node_modules/@zuplo/runtime/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{b as l}from"../chunk-RAZK5G27.js";import{_ as n}from"../chunk-4POCC75H.js";import{a as o}from"../chunk-TYV53J3B.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function t(r){e.push(Promise.resolve(r))}return o(t,"waitUntil"),{context:new s({event:{waitUntil:t},route:u.route}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(g,"createMockContext");var a={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},s=class extends EventTarget{static{o(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=a,parentContext:i}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=i,this.#e=e,this.analyticsContext=new l(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,i){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,t,i){let d=o(r=>{try{typeof t=="function"?t(r):t.handleEvent(r)}catch(p){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),p}},"wrapped");super.addEventListener(e,d,i)}};export{s as MockZuploContext,g as createMockContext};
+import{b as l}from"../chunk-4VE55TG3.js";import{_ as n}from"../chunk-4POCC75H.js";import{a as o}from"../chunk-TYV53J3B.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function t(r){e.push(Promise.resolve(r))}return o(t,"waitUntil"),{context:new s({event:{waitUntil:t},route:u.route}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(g,"createMockContext");var a={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},s=class extends EventTarget{static{o(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=a,parentContext:i}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=i,this.#e=e,this.analyticsContext=new l(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,i){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,t,i){let d=o(r=>{try{typeof t=="function"?t(r):t.handleEvent(r)}catch(p){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),p}},"wrapped");super.addEventListener(e,d,i)}};export{s as MockZuploContext,g as createMockContext};
 //# sourceMappingURL=index.js.map

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -332,6 +332,75 @@ export declare interface AIGatewayConfigurationLoaderV2InboundPolicyOptions {
   cacheTtlSeconds?: number;
 }
 
+/**
+ * AI Gateway DLP Inbound Policy
+ * @title AI Gateway DLP
+ * @product ai-gateway
+ * @hidden
+ * @requiresAI
+ *
+ * Scans the content of AI requests and responses — system prompts, message
+ * text, and tool-call arguments — for sensitive data (credit cards, national
+ * identifiers, API keys and other credentials) using the in-gateway DLP
+ * engine, and applies per-rule actions: mask, block, or log. Detection runs
+ * entirely inside the gateway; nothing is sent to a third-party scanning
+ * service. Streaming responses are scanned as they stream, chunk by chunk
+ * with a sliding boundary window, rather than being buffered to the end.
+ *
+ * Options are validated at request time and invalid options fail closed with
+ * a ConfigurationError. Content that cannot be inspected is denied by
+ * default (`onUnknownShape: "deny"`), and internal scan failures fail closed
+ * by default (`onError: "block"`).
+ *
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare function AIGatewayDlpInboundPolicy(
+  request: ZuploRequest,
+  context: ZuploContext,
+  unparsedOptions: unknown,
+  policyName: string
+): Promise<ZuploRequest | Response>;
+
+/**
+ * The options for the AI Gateway DLP policy. Scans the content of AI requests and responses — system prompts, messages, and tool-call arguments — for sensitive data such as credit cards, national identifiers, and API keys, applying a per-rule action (mask, block, or log). Detection runs entirely inside the gateway and streaming responses are scanned as they stream.
+ * @public
+ */
+export declare interface AIGatewayDlpInboundPolicyOptions {
+  rules: DlpRules;
+  /**
+   * Your own detection rules alongside the built-ins: the same rule object plus a `name`, a regex `pattern`, and optional `context` words.
+   */
+  customRules?: DlpCustomRule[];
+  /**
+   * Exact strings that are never flagged by any rule — documentation samples like Stripe's public test card `4242 4242 4242 4242`, or your own support email address. Matching is case-sensitive against the exact detected text, including when a value arrives split across streaming chunks.
+   */
+  allowValues?: string[];
+  /**
+   * The replacement text for masked matches. The `{type}` token inserts the detected type id in UPPER_SNAKE form (for example `[CONTACT_EMAIL]`), which keeps masked conversations legible to the model. Individual rules can override this.
+   */
+  mask?: string;
+  /**
+   * Default evidence level for rules that do not set their own. See the per-rule `detection` description for the level semantics. There are no numeric confidence thresholds to tune — levels are the whole dial.
+   */
+  detection?: "corroborated" | "standard" | "aggressive";
+  /**
+   * Also scan tool/function-call argument payloads — in requests, buffered responses, and streamed tool-call deltas. Tool arguments are user and model content; disabling this exempts them from every rule.
+   */
+  scanToolArguments?: boolean;
+  streaming?: DlpStreamingSettings;
+  endpoints?: ApplicableEndpoints;
+  onUnknownShape?: OnUnknownShape;
+  onError?: OnEngineError;
+  /**
+   * The detection engine. Only `builtin` (in-gateway regex + checksum detection with context-word scoring; no data egress) is available today. Declaring the discriminator now keeps future engines an additive, non-breaking change.
+   */
+  engine?: "builtin";
+}
+
 /**
  * Adds failure and quota fallbacks to an existing AI Gateway model selection.
  *
@@ -960,10 +1029,14 @@ export declare interface AIGatewaySemanticCacheOutboundPolicyOptions {}
  * response-sending hook to write the upstream response back into the cache —
  * matching the firewall's single-policy shape (no separate outbound policy).
  *
- * Caching parameters (semanticTolerance, expirationSecondsTtl, namespace) come
- * from the policy options, and presence in the route's chain is what enables
- * it. An id from the authenticated app configuration always provides the cache
- * namespace so application-supplied options cannot cross tenant partitions.
+ * Caching parameters (semanticTolerance, expirationSecondsTtl, namespace,
+ * recentMessageCount) come from the policy options, and presence in the
+ * route's chain is what enables it. An id from the authenticated app
+ * configuration always provides the cache namespace so application-supplied
+ * options cannot cross tenant partitions. The cache key covers the system
+ * prompt plus the last `recentMessageCount` messages (default 1) — applied
+ * when storing and when matching — so multi-turn conversations can hit
+ * entries cached from earlier, shorter ones.
  *
  * Cache outcomes are reported on the response via the RFC 9211 `Cache-Status`
  * header under the cache name `zp-aigw-sem-cache` (hit:
@@ -997,9 +1070,10 @@ export declare interface AIGatewaySemanticCacheV2InboundPolicyOptions {
   semanticTolerance?: SemanticTolerance;
   expirationSecondsTtl?: CacheTTLSeconds;
   namespace?: CacheNamespace;
+  recentMessageCount?: RecentMessageCount;
   maxConversationLength?: MaxConversationLength;
-  endpoints?: ApplicableEndpoints;
-  onUnknownShape?: OnUnknownShape;
+  endpoints?: ApplicableEndpoints_2;
+  onUnknownShape?: OnUnknownShape_2;
 }
 
 /**
@@ -1227,8 +1301,8 @@ export declare interface AkamaiAIFirewallV2PolicyOptions {
   "api-key": APIKey_2;
   applicationId?: ApplicationID_2;
   streamingAccumulation?: StreamingAccumulationSettings_2;
-  endpoints?: ApplicableEndpoints_2;
-  onUnknownShape?: OnUnknownShape_2;
+  endpoints?: ApplicableEndpoints_3;
+  onUnknownShape?: OnUnknownShape_3;
   onError?: OnFirewallError_2;
 }
 
@@ -1837,7 +1911,7 @@ declare interface APITokenCredentialConfig {
 }
 
 /**
- * The endpoint shapes to cache. Defaults to ['openai-chat', 'anthropic-messages']; OpenAI Responses remains unsupported.
+ * The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
  * @public
  */
 declare type ApplicableEndpoints = (
@@ -1847,7 +1921,7 @@ declare type ApplicableEndpoints = (
 )[];
 
 /**
- * The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
+ * The endpoint shapes to cache. Defaults to all shapes: ['openai-chat', 'anthropic-messages', 'openai-responses'].
  * @public
  */
 declare type ApplicableEndpoints_2 = (
@@ -1876,6 +1950,16 @@ declare type ApplicableEndpoints_4 = (
   | "anthropic-messages"
 )[];
 
+/**
+ * The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
+ * @public
+ */
+declare type ApplicableEndpoints_5 = (
+  | "openai-chat"
+  | "openai-responses"
+  | "anthropic-messages"
+)[];
+
 /**
  * The application ID to identify this usage of the AI Firewall (optional).
  * @public
@@ -3770,8 +3854,8 @@ export declare interface CometOpikTracingV2PolicyOptions {
    * The base URL for the Comet Opik API (optional, defaults to https://www.comet.com/opik/api).
    */
   baseUrl?: string;
-  endpoints?: ApplicableEndpoints_3;
-  onUnknownShape?: OnUnknownShape_3;
+  endpoints?: ApplicableEndpoints_4;
+  onUnknownShape?: OnUnknownShape_4;
 }
 
 /**
@@ -4550,7 +4634,11 @@ export declare interface DataLossPreventionInboundPolicyOptions {
    */
   customPatterns?: DlpCustomPattern[];
   /**
-   * Minimum confidence (0-1) a match must reach to count as a finding. Context-dependent recognizers (for example `finance-us-bank-account` or `finance-us-aba-routing`) sit below the default threshold of 0.5 until a context word near the match boosts them above it. Lower the threshold to surface them everywhere; raise it to keep only prefix- or checksum-validated matches.
+   * Values that are never reported as findings, compared against the exact matched text (case-sensitive, separators included). Use this to exempt well-known non-sensitive values that share a sensitive shape — for example the Stripe test card number `4242 4242 4242 4242` in a payments sandbox, or a public support email address. List every written form you want to allow (a spaced and an unspaced card number are different matches).
+   */
+  allowValues?: string[];
+  /**
+   * Minimum confidence (0-1) a match must reach to count as a finding. Every match starts at its recognizer's base confidence and gains a fixed boost of 0.45 when one of the recognizer's context words appears near it. Ambiguous shapes (for example `finance-us-bank-account` or `finance-cvv`) have a low base confidence and only cross the default threshold of 0.5 with that boost; lower the threshold to surface them without context. Raising the threshold is not a precision filter: any recognizer whose base confidence falls below it stops matching entirely except near its context words, and most checksum-validated recognizers run at 0.85, so values above 0.85 disable most of the catalog. To narrow detection, scope the `entities` list instead.
    */
   minConfidence?: number;
   /**
@@ -4693,7 +4781,11 @@ export declare interface DataLossPreventionOutboundPolicyOptions {
    */
   customPatterns?: DlpCustomPattern_2[];
   /**
-   * Minimum confidence (0-1) a match must reach to count as a finding. Context-dependent recognizers (for example `finance-us-bank-account` or `finance-us-aba-routing`) sit below the default threshold of 0.5 until a context word near the match boosts them above it. Lower the threshold to surface them everywhere; raise it to keep only prefix- or checksum-validated matches.
+   * Values that are never reported as findings, compared against the exact matched text (case-sensitive, separators included). Use this to exempt well-known non-sensitive values that share a sensitive shape — for example the Stripe test card number `4242 4242 4242 4242` in a payments sandbox, or a public support email address. List every written form you want to allow (a spaced and an unspaced card number are different matches).
+   */
+  allowValues?: string[];
+  /**
+   * Minimum confidence (0-1) a match must reach to count as a finding. Every match starts at its recognizer's base confidence and gains a fixed boost of 0.45 when one of the recognizer's context words appears near it. Ambiguous shapes (for example `finance-us-bank-account` or `finance-cvv`) have a low base confidence and only cross the default threshold of 0.5 with that boost; lower the threshold to surface them without context. Raising the threshold is not a precision filter: any recognizer whose base confidence falls below it stops matching entirely except near its context words, and most checksum-validated recognizers run at 0.85, so values above 0.85 disable most of the catalog. To narrow detection, scope the `entities` list instead.
    */
   minConfidence?: number;
   /**
@@ -4765,6 +4857,174 @@ declare interface DlpCustomPattern_2 {
   context?: string[];
 }
 
+declare interface DlpCustomRule {
+  /**
+   * Identifier reported in findings and block details for this rule.
+   */
+  name: string;
+  /**
+   * A JavaScript regular expression source string. Remember to escape backslashes for JSON (for example `\\d` for a digit). An invalid pattern fails the configuration at request time — a broken guardrail never degrades into a silent pass-through.
+   */
+  pattern: string;
+  /**
+   * Context words for this rule. With `detection: "corroborated"` the rule only fires when one of these words appears near the match.
+   */
+  context?: string[];
+  /**
+   * What happens when this type is found. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key.
+   */
+  action: "mask" | "block" | "log" | "off";
+  /**
+   * Where the rule applies. `inbound` scans what callers send the model (system prompt, message text, and tool-call arguments); `outbound` scans what the model sends back (buffered responses whole, streaming responses chunk by chunk). Defaults to `both`.
+   */
+  direction?: "both" | "inbound" | "outbound";
+  /**
+   * How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule.
+   */
+  detection?: "corroborated" | "standard" | "aggressive";
+  /**
+   * Replacement text for this rule when `action` is `mask`, overriding the policy-level `mask`. The `{type}` token inserts the detected type id in UPPER_SNAKE form (for example `[CONTACT_EMAIL]`).
+   */
+  mask?: string;
+  partialMask?: DlpPartialMask;
+}
+
+declare interface DlpPartialMask {
+  /**
+   * Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked.
+   */
+  keepLast: number;
+}
+
+declare interface DlpRule {
+  /**
+   * What happens when this type is found. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key.
+   */
+  action: "mask" | "block" | "log" | "off";
+  /**
+   * Where the rule applies. `inbound` scans what callers send the model (system prompt, message text, and tool-call arguments); `outbound` scans what the model sends back (buffered responses whole, streaming responses chunk by chunk). Defaults to `both`.
+   */
+  direction?: "both" | "inbound" | "outbound";
+  /**
+   * How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule.
+   */
+  detection?: "corroborated" | "standard" | "aggressive";
+  /**
+   * Replacement text for this rule when `action` is `mask`, overriding the policy-level `mask`. The `{type}` token inserts the detected type id in UPPER_SNAKE form (for example `[CONTACT_EMAIL]`).
+   */
+  mask?: string;
+  partialMask?: DlpPartialMask;
+}
+
+/**
+ * What to find and what to do about it. Each key is a built-in data type id (like `id-us-ssn`) or a group selector (like `pii` or `secret`, plus any dash-aligned id prefix such as `secret-aws`); each value is a rule object whose required `action` says what happens when that type is found. Types you do not mention are not scanned. The most specific key wins — an exact id beats a prefix beats a group — and the winning entry decides everything for its type, direction included. When one stretch of text matches multiple rules, the severest action wins (block > mask > log). At least one rule must scan something.
+ * @public
+ */
+declare interface DlpRules {
+  contact?: DlpRule;
+  finance?: DlpRule;
+  "finance-us"?: DlpRule;
+  id?: DlpRule;
+  "id-au"?: DlpRule;
+  "id-br"?: DlpRule;
+  "id-ca"?: DlpRule;
+  "id-es"?: DlpRule;
+  "id-fr"?: DlpRule;
+  "id-in"?: DlpRule;
+  "id-it"?: DlpRule;
+  "id-nl"?: DlpRule;
+  "id-pl"?: DlpRule;
+  "id-sg"?: DlpRule;
+  "id-uk"?: DlpRule;
+  "id-us"?: DlpRule;
+  network?: DlpRule;
+  pii?: DlpRule;
+  "region-eu"?: DlpRule;
+  secret?: DlpRule;
+  "secret-aws"?: DlpRule;
+  "contact-email"?: DlpRule;
+  "contact-phone"?: DlpRule;
+  "finance-credit-card"?: DlpRule;
+  "finance-crypto-wallet"?: DlpRule;
+  "finance-cvv"?: DlpRule;
+  "finance-iban"?: DlpRule;
+  "finance-swift-bic"?: DlpRule;
+  "finance-us-aba-routing"?: DlpRule;
+  "finance-us-bank-account"?: DlpRule;
+  "id-au-abn"?: DlpRule;
+  "id-au-acn"?: DlpRule;
+  "id-au-medicare"?: DlpRule;
+  "id-au-tfn"?: DlpRule;
+  "id-br-cpf"?: DlpRule;
+  "id-ca-sin"?: DlpRule;
+  "id-es-nif"?: DlpRule;
+  "id-fr-nir"?: DlpRule;
+  "id-in-aadhaar"?: DlpRule;
+  "id-in-pan"?: DlpRule;
+  "id-it-fiscal-code"?: DlpRule;
+  "id-nl-bsn"?: DlpRule;
+  "id-pl-pesel"?: DlpRule;
+  "id-sg-nric"?: DlpRule;
+  "id-uk-nhs"?: DlpRule;
+  "id-uk-nino"?: DlpRule;
+  "id-us-itin"?: DlpRule;
+  "id-us-passport"?: DlpRule;
+  "id-us-ssn"?: DlpRule;
+  "network-ipv4"?: DlpRule;
+  "network-ipv6"?: DlpRule;
+  "network-mac"?: DlpRule;
+  "secret-anthropic"?: DlpRule;
+  "secret-aws-access-key"?: DlpRule;
+  "secret-aws-bedrock"?: DlpRule;
+  "secret-azure-client"?: DlpRule;
+  "secret-databricks"?: DlpRule;
+  "secret-digitalocean"?: DlpRule;
+  "secret-discord-webhook"?: DlpRule;
+  "secret-github"?: DlpRule;
+  "secret-gitlab"?: DlpRule;
+  "secret-google-api-key"?: DlpRule;
+  "secret-heroku"?: DlpRule;
+  "secret-hugging-face"?: DlpRule;
+  "secret-jwt"?: DlpRule;
+  "secret-mailchimp"?: DlpRule;
+  "secret-mailgun"?: DlpRule;
+  "secret-npm"?: DlpRule;
+  "secret-openai"?: DlpRule;
+  "secret-perplexity"?: DlpRule;
+  "secret-postman"?: DlpRule;
+  "secret-private-key"?: DlpRule;
+  "secret-pypi"?: DlpRule;
+  "secret-sendgrid"?: DlpRule;
+  "secret-sentry"?: DlpRule;
+  "secret-shopify"?: DlpRule;
+  "secret-slack"?: DlpRule;
+  "secret-square"?: DlpRule;
+  "secret-stripe"?: DlpRule;
+  "secret-telegram-bot"?: DlpRule;
+  "secret-terraform"?: DlpRule;
+  "secret-twilio"?: DlpRule;
+  "secret-zuplo"?: DlpRule;
+}
+
+/**
+ * Tuning for streaming (SSE) response scanning. Each chunk is held until the boundary scan that includes its successor passes, then released — so values split across chunks are always fully maskable, at the cost of one chunk of latency.
+ * @public
+ */
+declare interface DlpStreamingSettings {
+  /**
+   * Scan streaming responses. When false, streaming responses pass through unscanned even when rules cover the outbound direction.
+   */
+  enabled?: boolean;
+  /**
+   * Scan across chunk boundaries using a carried tail of already-scanned text. When false, each chunk is scanned alone and released immediately — lower cost, but values split across two chunks are missed.
+   */
+  boundaryScan?: boolean;
+  /**
+   * How many trailing characters are carried from one chunk into the next boundary scan. Bounds memory and re-scan cost; must be larger than the longest value you need to catch.
+   */
+  maxCarryChars?: number;
+}
+
 declare interface DynaTraceLoggingOptions {
   url: string;
   apiToken: string;
@@ -4917,6 +5177,7 @@ declare const EventType: {
   readonly MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_auth_upstream_reconsent_required";
   readonly GRAPHQL_OPERATION: "graphql_operation";
   readonly CACHE_OPERATION: "cache_operation";
+  readonly HANDLER_EXECUTION: "handler_execution";
 };
 
 declare type EventType = (typeof EventType)[keyof typeof EventType];
@@ -5190,8 +5451,8 @@ export declare interface GalileoTracingV2PolicyOptions {
    * The base URL for the Galileo API (optional, defaults to https://api.galileo.ai).
    */
   baseUrl?: string;
-  endpoints?: ApplicableEndpoints_4;
-  onUnknownShape?: OnUnknownShape_4;
+  endpoints?: ApplicableEndpoints_5;
+  onUnknownShape?: OnUnknownShape_5;
 }
 
 /**
@@ -8046,7 +8307,7 @@ declare type LokiTransportVersion = 1 | 2;
 /* Excluded from this release type: LookupResult */
 
 /**
- * Skip caching requests whose message count exceeds this value. Longer conversations rarely repeat and dilute cache quality. Defaults to 3.
+ * Skip caching entirely when the conversation has more than this many messages. Unset by default (no limit). Set a bound to guard against topic drift: the cache key covers only the last recentMessageCount messages, so the deeper a conversation goes, the more likely a match on recent messages alone ignores earlier context that should change the answer.
  * @public
  */
 declare type MaxConversationLength = number;
@@ -10572,6 +10833,12 @@ export declare interface OktaJwtInboundPolicyOptions {
   oAuthResourceMetadataEnabled?: boolean;
 }
 
+/**
+ * What to do if the scanner itself throws. The engine is a local in-gateway scanner, so this is effectively unreachable outside of a runtime defect — but a guardrail must declare its failure posture. `block` (the default) fails closed with a 500 in the route's native error format; `allow` fails open and serves the content uninspected.
+ * @public
+ */
+declare type OnEngineError = "block" | "allow";
+
 /**
  * What to do when the Akamai detect call itself fails (invalid API key, rate limit, outage). 'block' (the default) fails closed and returns a 502 so unverified content is never served; 'allow' fails open and lets the request through without inspection. An onError value in the AI Gateway app configuration takes precedence over this option.
  * @public
@@ -10630,19 +10897,19 @@ declare interface OnSendingAwsLambdaEventHook {
 }
 
 /**
- * Unused by the cache (a cache miss is never unsafe, so it always fails open). Present for interface consistency.
+ * What to do when the request shape cannot be inspected. As a guardrail this policy defaults to `deny` (fail closed) so uninspectable content is never served.
  * @public
  */
 declare type OnUnknownShape = "deny" | "skip";
 
 /**
- * What to do when the request shape cannot be inspected. As a guardrail, this policy defaults to 'deny' (fail closed) so uninspectable content is never served.
+ * Unused by the cache (a cache miss is never unsafe, so it always fails open). Present for interface consistency.
  * @public
  */
 declare type OnUnknownShape_2 = "deny" | "skip";
 
 /**
- * What to do on a shape the policy cannot read. As an observer this defaults to 'skip' (fail open — pass through untraced).
+ * What to do when the request shape cannot be inspected. As a guardrail, this policy defaults to 'deny' (fail closed) so uninspectable content is never served.
  * @public
  */
 declare type OnUnknownShape_3 = "deny" | "skip";
@@ -10653,6 +10920,12 @@ declare type OnUnknownShape_3 = "deny" | "skip";
  */
 declare type OnUnknownShape_4 = "deny" | "skip";
 
+/**
+ * What to do on a shape the policy cannot read. As an observer this defaults to 'skip' (fail open — pass through untraced).
+ * @public
+ */
+declare type OnUnknownShape_5 = "deny" | "skip";
+
 /**
  * Handler that serves OpenAPI specification files.
  * Use this to expose your API documentation in a standard format that can be
@@ -12339,6 +12612,12 @@ export declare function ReadmeMetricsInboundPolicy(
   policyName: string
 ): Promise<ZuploRequest<RequestGeneric>>;
 
+/**
+ * How many of the conversation's most recent messages (input items on the Responses endpoint) form the cache key, both when storing a response and when matching later requests. Earlier messages are ignored, so a multi-turn conversation can hit an entry cached from a shorter one; system messages are always included. Requests whose keyed window contains no user message (for example a conversation ending in an assistant prefill) are not cached. Defaults to 1 (match on the newest message only).
+ * @public
+ */
+declare type RecentMessageCount = number;
+
 /**
  * Record the GraphQL response-cache outcome for the in-flight operation so
  * the analytics middleware can emit it as the `cacheState` dimension on the

package/node_modules/@zuplo/runtime/out/types/internal/index.d.ts

@@ -208,6 +208,7 @@ declare const EventType: {
   readonly MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_auth_upstream_reconsent_required";
   readonly GRAPHQL_OPERATION: "graphql_operation";
   readonly CACHE_OPERATION: "cache_operation";
+  readonly HANDLER_EXECUTION: "handler_execution";
 };
 
 declare type EventType = (typeof EventType)[keyof typeof EventType];

package/node_modules/@zuplo/runtime/out/types/mcp/messages/index.d.ts

@@ -138,6 +138,7 @@ declare const EventType: {
   readonly MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_auth_upstream_reconsent_required";
   readonly GRAPHQL_OPERATION: "graphql_operation";
   readonly CACHE_OPERATION: "cache_operation";
+  readonly HANDLER_EXECUTION: "handler_execution";
 };
 
 declare type EventType = (typeof EventType)[keyof typeof EventType];

package/node_modules/@zuplo/runtime/out/types/mcp-gateway/index.d.ts

@@ -198,6 +198,7 @@ declare const EventType: {
   readonly MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_auth_upstream_reconsent_required";
   readonly GRAPHQL_OPERATION: "graphql_operation";
   readonly CACHE_OPERATION: "cache_operation";
+  readonly HANDLER_EXECUTION: "handler_execution";
 };
 
 declare type EventType = (typeof EventType)[keyof typeof EventType];

package/node_modules/@zuplo/runtime/out/types/mocks/index.d.ts

@@ -113,6 +113,7 @@ declare const EventType: {
   readonly MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_auth_upstream_reconsent_required";
   readonly GRAPHQL_OPERATION: "graphql_operation";
   readonly CACHE_OPERATION: "cache_operation";
+  readonly HANDLER_EXECUTION: "handler_execution";
 };
 
 declare type EventType = (typeof EventType)[keyof typeof EventType];

package/node_modules/@zuplo/runtime/out/types/sdks/aws/index.d.ts

@@ -357,6 +357,7 @@ declare const EventType: {
   readonly MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_auth_upstream_reconsent_required";
   readonly GRAPHQL_OPERATION: "graphql_operation";
   readonly CACHE_OPERATION: "cache_operation";
+  readonly HANDLER_EXECUTION: "handler_execution";
 };
 
 declare type EventType = (typeof EventType)[keyof typeof EventType];

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.1.9",
+  "version": "7.2.0",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/ansi-regex/index.js

@@ -2,8 +2,9 @@ export default function ansiRegex({onlyFirst = false} = {}) {
 	// Valid string terminator sequences are BEL, ESC\, and 0x9c
 	const ST = '(?:\\u0007|\\u001B\\u005C|\\u009C)';
 
-	// OSC sequences only: ESC ] ... ST (non-greedy until the first ST)
-	const osc = `(?:\\u001B\\][\\s\\S]*?${ST})`;
+	// OSC sequences only: ESC ] ... ST
+	// The payload stops at the first terminator character rather than scanning ahead for one, so an unterminated `ESC ]` cannot rescan the rest of the input. Terminals likewise abort a control string on an unexpected ESC.
+	const osc = `(?:\\u001B\\][^\\u0007\\u001B\\u009C]*${ST})`;
 
 	// CSI and related: ESC/C1, optional intermediates, optional params (supports ; and :) then final byte
 	const csi = '[\\u001B\\u009B][[\\]()#;?]*(?:\\d{1,4}(?:[;:]\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]';

package/node_modules/ansi-regex/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "ansi-regex",
-	"version": "6.2.2",
+	"version": "6.3.0",
 	"description": "Regular expression for matching ANSI escape codes",
 	"license": "MIT",
 	"repository": "chalk/ansi-regex",

package/node_modules/body-parser/node_modules/content-type/README.md

@@ -36,6 +36,8 @@ The parser is lenient and does not error. You should validate `type` and `parame
 #### Options
 
 - `parameters` (default: `true`): Set to `false` to skip parameters.
+- `comma` (default: `false`): Set to `true` to stop on a comma. This can be used to parse the media range in an `Accept` header.
+- `start` (default: `0`): Set index to start parsing from.
 
 ### contentType.format(obj)
 

package/node_modules/body-parser/node_modules/content-type/dist/index.d.ts

@@ -8,6 +8,7 @@
  */
 export interface ContentType {
     type: string;
+    index: number;
     parameters: Record<string, string>;
 }
 /**
@@ -18,7 +19,26 @@ export declare function format(obj: Partial<ContentType>): string;
  * Options for parsing a `Content-Type` header.
  */
 export interface ParseOptions {
+    /**
+     * Exit early on the first semicolon, returning only the type.
+     * This is useful for parsing the MIME from `Content-Type` headers.
+     *
+     * @default false
+     */
     parameters?: boolean;
+    /**
+     * Exits early on a comma, returning the first value and parameters.
+     * This is useful for parsing `Accept` headers.
+     *
+     * @default false
+     */
+    comma?: boolean;
+    /**
+     * The index to start parsing from.
+     *
+     * @default 0
+     */
+    start?: number;
 }
 /**
  * Parse a `Content-Type` header.