@zuplo/cli 7.11.6 → 7.11.8

package/node_modules/@zuplo/runtime/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{E as p,J as c,M as u}from"../chunk-5SHD5VGF.js";import"../chunk-NUVXDVLJ.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import"../chunk-CDEAY3VY.js";import{aa as i}from"../chunk-LVSZ3WTO.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties"),setRequestProperties:o(()=>{},"setRequestProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
+import{E as p,J as c,M as u}from"../chunk-7WJVPTYD.js";import"../chunk-NUVXDVLJ.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import"../chunk-CDEAY3VY.js";import{aa as i}from"../chunk-LVSZ3WTO.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
 //# sourceMappingURL=index.js.map

package/node_modules/@zuplo/runtime/out/esm/mocks/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["@zuplo/runtime/mocks/context.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;0QAkCO,SAASA,EACdC,EAA6D,CAC3D,QAAS,IAAI,QAAQ,yBAAyB,CAChD,EACA,CACA,IAAMC,EAAwC,CAAC,EAG/C,SAASC,EAAUC,EAA6B,CAC9CF,EAAkB,KAAK,QAAQ,QAAQE,CAAO,CAAC,CACjD,CAFS,OAAAC,EAAAF,EAAA,aAcF,CAAE,QAVO,IAAIG,EAAiB,CACnC,MAAO,CAAE,UAAAH,CAAU,EACnB,MAAOF,EAAQ,MACf,gBAAiBA,EAAQ,OAC3B,CAAC,EAMiB,eAJKI,EAAA,SAAY,CACjC,MAAM,QAAQ,IAAIH,CAAiB,CACrC,EAFuB,iBAIU,CACnC,CAvBgBG,EAAAL,EAAA,qBAyBhB,IAAMO,EAA2C,CAC/C,KAAM,IACN,QAAS,CAAC,KAAK,EACf,QAAS,CACP,OAAQ,CAAC,EACT,OAAQ,SACV,EACA,IAAKF,EAAA,KAAU,CAAC,GAAX,MACP,EAMaC,EAAN,cAA+B,WAAoC,CAzE1E,MAyE0E,CAAAD,EAAA,yBAC/DG,GACAC,GACA,UACA,UACA,IACA,MAEA,OACA,0BACA,cACA,iBAET,YAAY,CACV,MAAAC,EACA,MAAAC,EAAQJ,EACR,cAAAK,EACA,gBAAAC,CACF,EAUG,CACD,MAAM,EACN,KAAK,UAAY,OAAO,WAAW,EACnC,KAAK,UAAY,OAAO,WAAW,EAEnC,KAAK,IAAM,CACT,KAAMC,EAAU,QAAQ,KACxB,IAAKA,EAAU,QAAQ,IACvB,MAAOA,EAAU,QAAQ,MACzB,KAAMA,EAAU,QAAQ,KACxB,MAAOA,EAAU,QAAQ,MACzB,iBAAkBT,EAAA,IAAM,CAAC,EAAP,oBAClB,qBAAsBA,EAAA,IAAM,CAAC,EAAP,uBACxB,EACA,KAAK,OAAS,CAAC,EACf,KAAK,MAAQM,EACb,KAAK,0BAA4B,CAC/B,GAAI,cACJ,IAAK,KACL,eAAgB,eAChB,KAAM,UACN,OAAQ,aACR,WAAY,KACZ,KAAM,MACN,UAAW,KACX,QAAS,KACT,WAAY,QACZ,UAAW,MACX,SAAU,OACV,UAAW,OACX,SAAU,OACV,aAAc,OACd,WAAY,OACZ,6BAA8B,OAC9B,6BAA8B,OAC9B,4BAA6B,OAC7B,oBAAqB,OACrB,mBAAoB,OACpB,mBAAoB,OACpB,oBAAqB,MACvB,EACA,KAAK,cAAgBC,EACrB,KAAKJ,GAASE,EACd,KAAKD,GAAmBI,EACxB,KAAK,iBAAmB,IAAIE,EAA6B,KAAK,SAAS,CACzE,CAGA,UAAUX,EAAuB,CAC/B,KAAKI,GAAO,UAAUJ,CAAO,CAC/B,CAEA,oBACEY,EACAC,EACkC,CAClC,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,qBACED,EACAE,EACAD,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,YACEE,EACAC,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,uBAAuBC,EAAmC,CACxD,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,4BAA4BA,EAAwC,CAClE,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAQA,qBACEC,EACArB,EACM,CAIN,IAAIsB,EACJ,GAAI,CACFA,EAAMC,EAAuB,qBAAqB,IAAI,CACxD,MAAQ,CACND,EAAMC,EAAuB,WAC3B,KACA,IAAIC,EACF,KAAKhB,IAAoB,IAAI,QAAQ,yBAAyB,CAChE,CACF,CACF,CAKAc,EAAI,kBAAoB,SACxBG,EAA0B,KAAMH,EAAKD,EAASrB,CAAO,CACvD,CAgBA,IAAI,oBAAyE,CAC3E,IAAIsB,EACJ,GAAI,CACFA,EAAMC,EAAuB,qBAAqB,IAAI,CACxD,MAAQ,CACN,MAAO,CAAC,CACV,CACA,OAAQD,EAAI,iBAAiB,SAAW,CAAC,GAAG,IAAKI,IAAW,CAC1D,WAAYA,EAAM,WAClB,KAAMA,EAAM,IACd,EAAE,CACJ,CAES,iBACPC,EACAN,EACArB,EACM,CACN,IAAM4B,EAA8CxB,EAACyB,GAAM,CACzD,GAAI,CACF,OAAOR,GAAY,WAAaA,EAAQQ,CAAC,EAAIR,EAAQ,YAAYQ,CAAC,CACpE,OAASC,EAAK,CACZ,WAAK,IAAI,MACP,wBAAwBH,CAAI,mCAC9B,EACMG,CACR,CACF,EAToD,WAUpD,MAAM,iBAAiBH,EAAMC,EAAS5B,CAAO,CAC/C,CACF","names":["createMockContext","options","waitUntilPromises","waitUntil","promise","__name","MockZuploContext","DEFAULT_ROUTE_CONFIG","#event","#originalRequest","event","route","parentContext","originalRequest","internals_default","ZuploGatewayAnalyticsContext","policyName","request","response","input","init","hook","handler","ext","ZuploContextExtensions","ZuploRequest","registerPreRequestHandler","entry","type","wrapped","e","err"]}
+{"version":3,"sources":["@zuplo/runtime/mocks/context.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;0QAkCO,SAASA,EACdC,EAA6D,CAC3D,QAAS,IAAI,QAAQ,yBAAyB,CAChD,EACA,CACA,IAAMC,EAAwC,CAAC,EAG/C,SAASC,EAAUC,EAA6B,CAC9CF,EAAkB,KAAK,QAAQ,QAAQE,CAAO,CAAC,CACjD,CAFS,OAAAC,EAAAF,EAAA,aAcF,CAAE,QAVO,IAAIG,EAAiB,CACnC,MAAO,CAAE,UAAAH,CAAU,EACnB,MAAOF,EAAQ,MACf,gBAAiBA,EAAQ,OAC3B,CAAC,EAMiB,eAJKI,EAAA,SAAY,CACjC,MAAM,QAAQ,IAAIH,CAAiB,CACrC,EAFuB,iBAIU,CACnC,CAvBgBG,EAAAL,EAAA,qBAyBhB,IAAMO,EAA2C,CAC/C,KAAM,IACN,QAAS,CAAC,KAAK,EACf,QAAS,CACP,OAAQ,CAAC,EACT,OAAQ,SACV,EACA,IAAKF,EAAA,KAAU,CAAC,GAAX,MACP,EAMaC,EAAN,cAA+B,WAAoC,CAzE1E,MAyE0E,CAAAD,EAAA,yBAC/DG,GACAC,GACA,UACA,UACA,IACA,MAEA,OACA,0BACA,cACA,iBAET,YAAY,CACV,MAAAC,EACA,MAAAC,EAAQJ,EACR,cAAAK,EACA,gBAAAC,CACF,EAUG,CACD,MAAM,EACN,KAAK,UAAY,OAAO,WAAW,EACnC,KAAK,UAAY,OAAO,WAAW,EAEnC,KAAK,IAAM,CACT,KAAMC,EAAU,QAAQ,KACxB,IAAKA,EAAU,QAAQ,IACvB,MAAOA,EAAU,QAAQ,MACzB,KAAMA,EAAU,QAAQ,KACxB,MAAOA,EAAU,QAAQ,MACzB,iBAAkBT,EAAA,IAAM,CAAC,EAAP,mBACpB,EACA,KAAK,OAAS,CAAC,EACf,KAAK,MAAQM,EACb,KAAK,0BAA4B,CAC/B,GAAI,cACJ,IAAK,KACL,eAAgB,eAChB,KAAM,UACN,OAAQ,aACR,WAAY,KACZ,KAAM,MACN,UAAW,KACX,QAAS,KACT,WAAY,QACZ,UAAW,MACX,SAAU,OACV,UAAW,OACX,SAAU,OACV,aAAc,OACd,WAAY,OACZ,6BAA8B,OAC9B,6BAA8B,OAC9B,4BAA6B,OAC7B,oBAAqB,OACrB,mBAAoB,OACpB,mBAAoB,OACpB,oBAAqB,MACvB,EACA,KAAK,cAAgBC,EACrB,KAAKJ,GAASE,EACd,KAAKD,GAAmBI,EACxB,KAAK,iBAAmB,IAAIE,EAA6B,KAAK,SAAS,CACzE,CAGA,UAAUX,EAAuB,CAC/B,KAAKI,GAAO,UAAUJ,CAAO,CAC/B,CAEA,oBACEY,EACAC,EACkC,CAClC,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,qBACED,EACAE,EACAD,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,YACEE,EACAC,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,uBAAuBC,EAAmC,CACxD,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,4BAA4BA,EAAwC,CAClE,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAQA,qBACEC,EACArB,EACM,CAIN,IAAIsB,EACJ,GAAI,CACFA,EAAMC,EAAuB,qBAAqB,IAAI,CACxD,MAAQ,CACND,EAAMC,EAAuB,WAC3B,KACA,IAAIC,EACF,KAAKhB,IAAoB,IAAI,QAAQ,yBAAyB,CAChE,CACF,CACF,CAKAc,EAAI,kBAAoB,SACxBG,EAA0B,KAAMH,EAAKD,EAASrB,CAAO,CACvD,CAgBA,IAAI,oBAAyE,CAC3E,IAAIsB,EACJ,GAAI,CACFA,EAAMC,EAAuB,qBAAqB,IAAI,CACxD,MAAQ,CACN,MAAO,CAAC,CACV,CACA,OAAQD,EAAI,iBAAiB,SAAW,CAAC,GAAG,IAAKI,IAAW,CAC1D,WAAYA,EAAM,WAClB,KAAMA,EAAM,IACd,EAAE,CACJ,CAES,iBACPC,EACAN,EACArB,EACM,CACN,IAAM4B,EAA8CxB,EAACyB,GAAM,CACzD,GAAI,CACF,OAAOR,GAAY,WAAaA,EAAQQ,CAAC,EAAIR,EAAQ,YAAYQ,CAAC,CACpE,OAASC,EAAK,CACZ,WAAK,IAAI,MACP,wBAAwBH,CAAI,mCAC9B,EACMG,CACR,CACF,EAToD,WAUpD,MAAM,iBAAiBH,EAAMC,EAAS5B,CAAO,CAC/C,CACF","names":["createMockContext","options","waitUntilPromises","waitUntil","promise","__name","MockZuploContext","DEFAULT_ROUTE_CONFIG","#event","#originalRequest","event","route","parentContext","originalRequest","internals_default","ZuploGatewayAnalyticsContext","policyName","request","response","input","init","hook","handler","ext","ZuploContextExtensions","ZuploRequest","registerPreRequestHandler","entry","type","wrapped","e","err"]}

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -8637,11 +8637,24 @@ declare type LogFormat = "pretty" | "json" | "gcp" | "cloudflare";
  */
 export declare interface Logger extends SystemLogger {
   /**
-   * Set properties that will be included in all subsequent log entries for this request.
-   * Properties are merged with existing properties and any static fields configured in the logging plugin.
-   * Per-request properties take precedence over static fields with the same name.
+   * Set properties for this request. They are added to every later log entry
+   * for this request that a log plugin ships (Datadog, Splunk, Loki and the
+   * others), and to the request's row in Zuplo's request log, which the log
+   * viewer in the Zuplo Portal shows in the request's details.
    *
-   * @param properties - Key-value pairs to include in log entries. Values must be string, number, or boolean.
+   * Properties apply only to the current request. Each call merges into the
+   * properties already set, and a later value for the same key overwrites an
+   * earlier one. In log entries, a per-request property takes precedence over
+   * a static field with the same name configured in the logging plugin. A
+   * request made with `context.invokeRoute` has its own properties and its
+   * own row.
+   *
+   * To keep request rows small, a row holds at most 64 properties, a key can
+   * be at most 128 characters, and a value at most 2048 characters. A longer
+   * value is truncated on the row, and a property over the other limits is
+   * left off the row. Log entries are not limited this way.
+   *
+   * @param properties - Key-value pairs for this request. Values must be string, number, or boolean.
    *
    * @example
    * ```ts
@@ -8658,44 +8671,6 @@ export declare interface Logger extends SystemLogger {
   setLogProperties?(
     properties: Record<string, string | number | boolean>
   ): void;
-  /**
-   * Attach properties to this request's row in Zuplo's request log, the one
-   * row per request that analytics and the request details view read.
-   *
-   * This differs from `setLogProperties`, which adds fields to every log
-   * entry (each `context.log.info(...)` line) that log plugins ship. Use
-   * `setRequestProperties` to label the request itself, for example with a
-   * tenant ID, a feature flag or an experiment variant.
-   *
-   * Each call merges into the properties already set for this request, and a
-   * later value for the same key overwrites an earlier one. Numbers and
-   * booleans are stored as strings, and `null` or `undefined` values are
-   * skipped. A request made with `context.invokeRoute` has a row of its own,
-   * so properties set while it runs land on that row, not on the caller's.
-   *
-   * To keep rows small, a request holds at most 64 properties, a key can be
-   * at most 128 characters, and a value at most 2048 characters. A longer
-   * value is truncated, and a property over the other limits is dropped. The
-   * method never throws.
-   *
-   * @param properties - Key-value pairs to attach to the request's log row.
-   *
-   * @example
-   * ```ts
-   * export default async function (request: ZuploRequest, context: ZuploContext) {
-   *   context.log.setRequestProperties({
-   *     tenantId: request.user?.data.tenantId,
-   *     pricingExperiment: "variant-b",
-   *     cached: false,
-   *   });
-   *
-   *   return new Response("ok");
-   * }
-   * ```
-   */
-  setRequestProperties(
-    properties: Record<string, string | number | boolean | undefined | null>
-  ): void;
 }
 
 /* Excluded from this release type: LoggingContext */
@@ -10791,7 +10766,7 @@ declare interface MetricsData {
    */
   url?: string;
   /**
-   * Free-form properties attached with `context.log.setRequestProperties`.
+   * Free-form properties attached with `context.log.setLogProperties`.
    * Omitted when none were set.
    */
   properties?: Record<string, string>;

package/node_modules/@zuplo/runtime/out/types/internal/index.d.ts

@@ -1037,11 +1037,24 @@ declare type JsonValue = JsonPrimitive | JsonObject | JsonArray;
  */
 declare interface Logger extends BaseLogger {
   /**
-   * Set properties that will be included in all subsequent log entries for this request.
-   * Properties are merged with existing properties and any static fields configured in the logging plugin.
-   * Per-request properties take precedence over static fields with the same name.
+   * Set properties for this request. They are added to every later log entry
+   * for this request that a log plugin ships (Datadog, Splunk, Loki and the
+   * others), and to the request's row in Zuplo's request log, which the log
+   * viewer in the Zuplo Portal shows in the request's details.
    *
-   * @param properties - Key-value pairs to include in log entries. Values must be string, number, or boolean.
+   * Properties apply only to the current request. Each call merges into the
+   * properties already set, and a later value for the same key overwrites an
+   * earlier one. In log entries, a per-request property takes precedence over
+   * a static field with the same name configured in the logging plugin. A
+   * request made with `context.invokeRoute` has its own properties and its
+   * own row.
+   *
+   * To keep request rows small, a row holds at most 64 properties, a key can
+   * be at most 128 characters, and a value at most 2048 characters. A longer
+   * value is truncated on the row, and a property over the other limits is
+   * left off the row. Log entries are not limited this way.
+   *
+   * @param properties - Key-value pairs for this request. Values must be string, number, or boolean.
    *
    * @example
    * ```ts
@@ -1058,44 +1071,6 @@ declare interface Logger extends BaseLogger {
   setLogProperties?(
     properties: Record<string, string | number | boolean>
   ): void;
-  /**
-   * Attach properties to this request's row in Zuplo's request log, the one
-   * row per request that analytics and the request details view read.
-   *
-   * This differs from `setLogProperties`, which adds fields to every log
-   * entry (each `context.log.info(...)` line) that log plugins ship. Use
-   * `setRequestProperties` to label the request itself, for example with a
-   * tenant ID, a feature flag or an experiment variant.
-   *
-   * Each call merges into the properties already set for this request, and a
-   * later value for the same key overwrites an earlier one. Numbers and
-   * booleans are stored as strings, and `null` or `undefined` values are
-   * skipped. A request made with `context.invokeRoute` has a row of its own,
-   * so properties set while it runs land on that row, not on the caller's.
-   *
-   * To keep rows small, a request holds at most 64 properties, a key can be
-   * at most 128 characters, and a value at most 2048 characters. A longer
-   * value is truncated, and a property over the other limits is dropped. The
-   * method never throws.
-   *
-   * @param properties - Key-value pairs to attach to the request's log row.
-   *
-   * @example
-   * ```ts
-   * export default async function (request: ZuploRequest, context: ZuploContext) {
-   *   context.log.setRequestProperties({
-   *     tenantId: request.user?.data.tenantId,
-   *     pricingExperiment: "variant-b",
-   *     cached: false,
-   *   });
-   *
-   *   return new Response("ok");
-   * }
-   * ```
-   */
-  setRequestProperties(
-    properties: Record<string, string | number | boolean | undefined | null>
-  ): void;
 }
 
 declare type Modify<T, R> = Omit<T, keyof R> & R;

package/node_modules/@zuplo/runtime/out/types/mcp/messages/index.d.ts

@@ -965,11 +965,24 @@ declare type JsonValue = JsonPrimitive | JsonObject | JsonArray;
  */
 declare interface Logger extends BaseLogger {
   /**
-   * Set properties that will be included in all subsequent log entries for this request.
-   * Properties are merged with existing properties and any static fields configured in the logging plugin.
-   * Per-request properties take precedence over static fields with the same name.
+   * Set properties for this request. They are added to every later log entry
+   * for this request that a log plugin ships (Datadog, Splunk, Loki and the
+   * others), and to the request's row in Zuplo's request log, which the log
+   * viewer in the Zuplo Portal shows in the request's details.
    *
-   * @param properties - Key-value pairs to include in log entries. Values must be string, number, or boolean.
+   * Properties apply only to the current request. Each call merges into the
+   * properties already set, and a later value for the same key overwrites an
+   * earlier one. In log entries, a per-request property takes precedence over
+   * a static field with the same name configured in the logging plugin. A
+   * request made with `context.invokeRoute` has its own properties and its
+   * own row.
+   *
+   * To keep request rows small, a row holds at most 64 properties, a key can
+   * be at most 128 characters, and a value at most 2048 characters. A longer
+   * value is truncated on the row, and a property over the other limits is
+   * left off the row. Log entries are not limited this way.
+   *
+   * @param properties - Key-value pairs for this request. Values must be string, number, or boolean.
    *
    * @example
    * ```ts
@@ -986,44 +999,6 @@ declare interface Logger extends BaseLogger {
   setLogProperties?(
     properties: Record<string, string | number | boolean>
   ): void;
-  /**
-   * Attach properties to this request's row in Zuplo's request log, the one
-   * row per request that analytics and the request details view read.
-   *
-   * This differs from `setLogProperties`, which adds fields to every log
-   * entry (each `context.log.info(...)` line) that log plugins ship. Use
-   * `setRequestProperties` to label the request itself, for example with a
-   * tenant ID, a feature flag or an experiment variant.
-   *
-   * Each call merges into the properties already set for this request, and a
-   * later value for the same key overwrites an earlier one. Numbers and
-   * booleans are stored as strings, and `null` or `undefined` values are
-   * skipped. A request made with `context.invokeRoute` has a row of its own,
-   * so properties set while it runs land on that row, not on the caller's.
-   *
-   * To keep rows small, a request holds at most 64 properties, a key can be
-   * at most 128 characters, and a value at most 2048 characters. A longer
-   * value is truncated, and a property over the other limits is dropped. The
-   * method never throws.
-   *
-   * @param properties - Key-value pairs to attach to the request's log row.
-   *
-   * @example
-   * ```ts
-   * export default async function (request: ZuploRequest, context: ZuploContext) {
-   *   context.log.setRequestProperties({
-   *     tenantId: request.user?.data.tenantId,
-   *     pricingExperiment: "variant-b",
-   *     cached: false,
-   *   });
-   *
-   *   return new Response("ok");
-   * }
-   * ```
-   */
-  setRequestProperties(
-    properties: Record<string, string | number | boolean | undefined | null>
-  ): void;
 }
 
 /**

package/node_modules/@zuplo/runtime/out/types/mcp-gateway/index.d.ts

@@ -1093,11 +1093,24 @@ declare type JsonValue = JsonPrimitive | JsonObject | JsonArray;
  */
 declare interface Logger extends BaseLogger {
   /**
-   * Set properties that will be included in all subsequent log entries for this request.
-   * Properties are merged with existing properties and any static fields configured in the logging plugin.
-   * Per-request properties take precedence over static fields with the same name.
+   * Set properties for this request. They are added to every later log entry
+   * for this request that a log plugin ships (Datadog, Splunk, Loki and the
+   * others), and to the request's row in Zuplo's request log, which the log
+   * viewer in the Zuplo Portal shows in the request's details.
    *
-   * @param properties - Key-value pairs to include in log entries. Values must be string, number, or boolean.
+   * Properties apply only to the current request. Each call merges into the
+   * properties already set, and a later value for the same key overwrites an
+   * earlier one. In log entries, a per-request property takes precedence over
+   * a static field with the same name configured in the logging plugin. A
+   * request made with `context.invokeRoute` has its own properties and its
+   * own row.
+   *
+   * To keep request rows small, a row holds at most 64 properties, a key can
+   * be at most 128 characters, and a value at most 2048 characters. A longer
+   * value is truncated on the row, and a property over the other limits is
+   * left off the row. Log entries are not limited this way.
+   *
+   * @param properties - Key-value pairs for this request. Values must be string, number, or boolean.
    *
    * @example
    * ```ts
@@ -1114,44 +1127,6 @@ declare interface Logger extends BaseLogger {
   setLogProperties?(
     properties: Record<string, string | number | boolean>
   ): void;
-  /**
-   * Attach properties to this request's row in Zuplo's request log, the one
-   * row per request that analytics and the request details view read.
-   *
-   * This differs from `setLogProperties`, which adds fields to every log
-   * entry (each `context.log.info(...)` line) that log plugins ship. Use
-   * `setRequestProperties` to label the request itself, for example with a
-   * tenant ID, a feature flag or an experiment variant.
-   *
-   * Each call merges into the properties already set for this request, and a
-   * later value for the same key overwrites an earlier one. Numbers and
-   * booleans are stored as strings, and `null` or `undefined` values are
-   * skipped. A request made with `context.invokeRoute` has a row of its own,
-   * so properties set while it runs land on that row, not on the caller's.
-   *
-   * To keep rows small, a request holds at most 64 properties, a key can be
-   * at most 128 characters, and a value at most 2048 characters. A longer
-   * value is truncated, and a property over the other limits is dropped. The
-   * method never throws.
-   *
-   * @param properties - Key-value pairs to attach to the request's log row.
-   *
-   * @example
-   * ```ts
-   * export default async function (request: ZuploRequest, context: ZuploContext) {
-   *   context.log.setRequestProperties({
-   *     tenantId: request.user?.data.tenantId,
-   *     pricingExperiment: "variant-b",
-   *     cached: false,
-   *   });
-   *
-   *   return new Response("ok");
-   * }
-   * ```
-   */
-  setRequestProperties(
-    properties: Record<string, string | number | boolean | undefined | null>
-  ): void;
 }
 
 /* Excluded from this release type: LookupResult */

package/node_modules/@zuplo/runtime/out/types/mocks/index.d.ts

@@ -872,11 +872,24 @@ declare type JsonValue = JsonPrimitive | JsonObject | JsonArray;
  */
 declare interface Logger extends BaseLogger {
   /**
-   * Set properties that will be included in all subsequent log entries for this request.
-   * Properties are merged with existing properties and any static fields configured in the logging plugin.
-   * Per-request properties take precedence over static fields with the same name.
+   * Set properties for this request. They are added to every later log entry
+   * for this request that a log plugin ships (Datadog, Splunk, Loki and the
+   * others), and to the request's row in Zuplo's request log, which the log
+   * viewer in the Zuplo Portal shows in the request's details.
    *
-   * @param properties - Key-value pairs to include in log entries. Values must be string, number, or boolean.
+   * Properties apply only to the current request. Each call merges into the
+   * properties already set, and a later value for the same key overwrites an
+   * earlier one. In log entries, a per-request property takes precedence over
+   * a static field with the same name configured in the logging plugin. A
+   * request made with `context.invokeRoute` has its own properties and its
+   * own row.
+   *
+   * To keep request rows small, a row holds at most 64 properties, a key can
+   * be at most 128 characters, and a value at most 2048 characters. A longer
+   * value is truncated on the row, and a property over the other limits is
+   * left off the row. Log entries are not limited this way.
+   *
+   * @param properties - Key-value pairs for this request. Values must be string, number, or boolean.
    *
    * @example
    * ```ts
@@ -893,44 +906,6 @@ declare interface Logger extends BaseLogger {
   setLogProperties?(
     properties: Record<string, string | number | boolean>
   ): void;
-  /**
-   * Attach properties to this request's row in Zuplo's request log, the one
-   * row per request that analytics and the request details view read.
-   *
-   * This differs from `setLogProperties`, which adds fields to every log
-   * entry (each `context.log.info(...)` line) that log plugins ship. Use
-   * `setRequestProperties` to label the request itself, for example with a
-   * tenant ID, a feature flag or an experiment variant.
-   *
-   * Each call merges into the properties already set for this request, and a
-   * later value for the same key overwrites an earlier one. Numbers and
-   * booleans are stored as strings, and `null` or `undefined` values are
-   * skipped. A request made with `context.invokeRoute` has a row of its own,
-   * so properties set while it runs land on that row, not on the caller's.
-   *
-   * To keep rows small, a request holds at most 64 properties, a key can be
-   * at most 128 characters, and a value at most 2048 characters. A longer
-   * value is truncated, and a property over the other limits is dropped. The
-   * method never throws.
-   *
-   * @param properties - Key-value pairs to attach to the request's log row.
-   *
-   * @example
-   * ```ts
-   * export default async function (request: ZuploRequest, context: ZuploContext) {
-   *   context.log.setRequestProperties({
-   *     tenantId: request.user?.data.tenantId,
-   *     pricingExperiment: "variant-b",
-   *     cached: false,
-   *   });
-   *
-   *   return new Response("ok");
-   * }
-   * ```
-   */
-  setRequestProperties(
-    properties: Record<string, string | number | boolean | undefined | null>
-  ): void;
 }
 
 /**

package/node_modules/@zuplo/runtime/out/types/sdks/aws/index.d.ts

@@ -1249,11 +1249,24 @@ declare type JsonValue = JsonPrimitive | JsonObject | JsonArray;
  */
 declare interface Logger extends BaseLogger {
   /**
-   * Set properties that will be included in all subsequent log entries for this request.
-   * Properties are merged with existing properties and any static fields configured in the logging plugin.
-   * Per-request properties take precedence over static fields with the same name.
+   * Set properties for this request. They are added to every later log entry
+   * for this request that a log plugin ships (Datadog, Splunk, Loki and the
+   * others), and to the request's row in Zuplo's request log, which the log
+   * viewer in the Zuplo Portal shows in the request's details.
    *
-   * @param properties - Key-value pairs to include in log entries. Values must be string, number, or boolean.
+   * Properties apply only to the current request. Each call merges into the
+   * properties already set, and a later value for the same key overwrites an
+   * earlier one. In log entries, a per-request property takes precedence over
+   * a static field with the same name configured in the logging plugin. A
+   * request made with `context.invokeRoute` has its own properties and its
+   * own row.
+   *
+   * To keep request rows small, a row holds at most 64 properties, a key can
+   * be at most 128 characters, and a value at most 2048 characters. A longer
+   * value is truncated on the row, and a property over the other limits is
+   * left off the row. Log entries are not limited this way.
+   *
+   * @param properties - Key-value pairs for this request. Values must be string, number, or boolean.
    *
    * @example
    * ```ts
@@ -1270,44 +1283,6 @@ declare interface Logger extends BaseLogger {
   setLogProperties?(
     properties: Record<string, string | number | boolean>
   ): void;
-  /**
-   * Attach properties to this request's row in Zuplo's request log, the one
-   * row per request that analytics and the request details view read.
-   *
-   * This differs from `setLogProperties`, which adds fields to every log
-   * entry (each `context.log.info(...)` line) that log plugins ship. Use
-   * `setRequestProperties` to label the request itself, for example with a
-   * tenant ID, a feature flag or an experiment variant.
-   *
-   * Each call merges into the properties already set for this request, and a
-   * later value for the same key overwrites an earlier one. Numbers and
-   * booleans are stored as strings, and `null` or `undefined` values are
-   * skipped. A request made with `context.invokeRoute` has a row of its own,
-   * so properties set while it runs land on that row, not on the caller's.
-   *
-   * To keep rows small, a request holds at most 64 properties, a key can be
-   * at most 128 characters, and a value at most 2048 characters. A longer
-   * value is truncated, and a property over the other limits is dropped. The
-   * method never throws.
-   *
-   * @param properties - Key-value pairs to attach to the request's log row.
-   *
-   * @example
-   * ```ts
-   * export default async function (request: ZuploRequest, context: ZuploContext) {
-   *   context.log.setRequestProperties({
-   *     tenantId: request.user?.data.tenantId,
-   *     pricingExperiment: "variant-b",
-   *     cached: false,
-   *   });
-   *
-   *   return new Response("ok");
-   * }
-   * ```
-   */
-  setRequestProperties(
-    properties: Record<string, string | number | boolean | undefined | null>
-  ): void;
 }
 
 declare type Modify<T, R> = Omit<T, keyof R> & R;

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.11.6",
+  "version": "7.11.8",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/qs/.github/THREAT_MODEL.md

@@ -24,7 +24,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 ```
 
 **Trust Boundaries:**
-- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests)
+- **Input string (parse):** May come from untrusted sources (e.g., user input, network requests). `qs` defines its own key grammar, where bracket groups denote nesting, so the parameter names it derives are deliberately not the flat names produced by `URLSearchParams`, `node:querystring`, or a WHATWG-conformant parser. The parsed object, not the raw string, is the only thing a caller should make trust decisions about; see "Interpretation conflict" below.
 - **Input object (stringify):** The calling application's own data, not a direct untrusted channel. May contain cycles (handled by the cycle detector). Deeply-nested non-cyclic input surfaces as a catchable synchronous `RangeError` (stack overflow), not unbounded resource consumption; callers that serialize externally-influenced objects should bound their depth/size beforehand.
 - **Options:** Provided by the caller
 - **Cycle Tracking:** Used only during stringification to detect and handle circular references
@@ -51,6 +51,7 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 - **Information Disclosure:** Error messages may expose internal details or sensitive data.
 - **Denial of Service:** Large or malformed input can exhaust memory or CPU.
 - **Elevation of Privilege:** Prototype pollution can lead to unintended privilege escalation in the host application[3][4][8].
+- **Interpretation conflict (out of scope):** An application that parses the same query string with two different parsers, and makes a trust decision on one result while consuming the other, can be attacked by any input the two parsers read differently. `qs`'s bracket grammar guarantees such inputs exist, so this is a property of the deployment, not a defect `qs` can remove. It is the calling application's responsibility to parse once and validate the parsed object.
 
 ### 6. Mitigation/Countermeasures
 
@@ -58,8 +59,9 @@ Caller Application → qs.stringify(obj, options) → Stringifying Engine → Ou
 |---------------------------------------------------|---------------------|
 | Tampering (malicious input, prototype pollution)  | Strict input validation; keep `allowPrototypes: false` by default; use `plainObjects` for output; ensure builtins/globals are never modified by parse[4][8]. |
 | Information Disclosure (error messages)           | Generic error messages without stack traces or internal paths. |
-| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For a hard cap that rejects oversized untrusted input, opt in to `throwOnLimitExceeded: true` (default `false`), and always bound input size at the transport layer[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
+| Denial of Service (memory/CPU exhaustion)         | `arrayLimit`, `parameterLimit`, and depth limiting apply with safe defaults. Note that `arrayLimit` is a representation threshold (array vs. object), and `parameterLimit` bounds only the number of `&`-delimited parameters - neither caps the elements produced by `comma: true` splitting. For hard caps on the number of parameters and on each array's length, opt in to `throwOnLimitExceeded: true` (default `false`), which rejects a query string with more than `parameterLimit` parameters, or one that would produce any array longer than `arrayLimit`. `arrayLimit` applies to each array separately, including each parameter's comma-split value, so the total number of values can still reach `parameterLimit` times `arrayLimit`; always bound input size at the transport layer as well[7]. On the `stringify` side, the input is the caller's own object rather than an untrusted string, so unbounded nesting manifests as a catchable `RangeError` (stack overflow) rather than exhaustion; callers serializing externally-influenced objects should bound depth/size beforehand, and may opt into `stringify`'s `depth` option (default `Infinity`) for a deterministic, catchable error. |
 | Elevation of Privilege (prototype pollution)      | Keep `allowPrototypes: false`; validate options against allowlist; use `plainObjects` to avoid prototype pollution[4][8]. |
+| Interpretation conflict (validate-then-use across two parsers) | None available inside `qs`, by construction: `qs` and a flat parser disagree about parameter names for well-formed input, so no hardening can make the two views equal. Parse untrusted input once, with `qs`, and apply deny lists, authorization, and signature checks to the parsed object rather than to raw key text. Text that `qs` cannot place in its grammar is currently dropped, so distinct raw names can share one parsed path ([#619](https://github.com/ljharb/qs/issues/619)). |
 
 ### 7. Risk Ranking
 

package/node_modules/qs/CHANGELOG.md

@@ -1,17 +1,41 @@
+## **6.16.1**
+ - [Fix] `parse`: do not mutate an object input
+ - [Fix] `stringify`: stop re-encoding structural separator dots when `encodeDotInKeys` is set (#564)
+ - [Fix] `stringify`: `arrayFormat: 'comma'`: pass the full encoder arguments with `encodeValuesOnly`
+ - [Fix] `utils`: encode `+` as `%2B` in iso-8859-1 mode so values round-trip (#565)
+ - [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
+ - [Fix] `stringify`: ignore inherited array format names (#622)
+ - [Fix] `stringify`: `arrayFormat: 'comma'`: do not throw on elements with no callable `toString`
+ - [Fix] `utils`: `merge`: seed an overflow container's index from its own keys, not just the source
+ - [Fix] `utils`: `merge`: keep a `strictMerge` conflict container's index and `arrayLimit` correct
+ - [Fix] `parse`: only treat `[]` as array syntax when it ends the key
+ - [Perf] `decode`: skip decoders when there is no percent sign (#583)
+ - [Robustness] `utils`: `merge`: apply `arrayLimit` to the two-element array built for colliding values
+ - [Robustness] `parse`: bound the nesting added by repeated `strictMerge` conflicts
+ - [Docs] document that `qs` and flat parsers disagree about parameter names
+ - [Docs] clarify that `throwOnLimitExceeded` limits each array, not the total number of values
+ - [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
+ - [meta] fix changelog indents
+ - [actions] set least-privilege `cache-mode`
+ - [Tests] `utils`: `decode`: add missing cases
+ - [Tests] `parse`: characterize the `]=` split when an `=` precedes any bracket group (#620)
+ - [Tests] `parse`: `allowDots`: cover stray close brackets before a dot
+ - [Dev Deps] update `@ljharb/eslint-config`, `eslint`, `tape`
+
 ## **6.16.0**
- - [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
- - [Fix] stringify: serialize Date values when a filter is provided
- - [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
- - [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
- - [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
- - [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
- - [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
- - [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
- - [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
- - [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
- - [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
- - [Dev Deps] update `@ljharb/eslint-config`, `eslint`
- - [Dev Deps] update `eslint`, `evalmd`
+- [New] `stringify`: add a `depth` option to bound recursion depth (default `Infinity`)
+- [Fix] stringify: serialize Date values when a filter is provided
+- [Fix] `parse`: enforce `arrayLimit` on comma groups under `[]=` when `throwOnLimitExceeded` is set
+- [Fix] `parse`: flatten a collection appended to an overflowed array (#571)
+- [Fix] `utils`: `isBuffer`: do not invoke a non-callable `constructor.isBuffer`
+- [Fix] `stringify`: do not let `allowEmptyArrays` skip cycle detection (or drop own keys) on an empty array with own properties
+- [Fix] `stringify`: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (#562)
+- [Docs] threat model: clarify `stringify` deep-nesting DoS is caller-bounded
+- [Docs] clarify `arrayLimit` is a representation threshold, not an element-count cap
+- [Tests] `parse`: remove a test that pinned `[]=` comma groups escaping `arrayLimit`
+- [Tests] `stringify`: pin current `encodeDotInKeys` separator-dot behavior
+- [Dev Deps] update `@ljharb/eslint-config`, `eslint`
+- [Dev Deps] update `eslint`, `evalmd`
 
 ## **6.15.3**
 - [Fix] `parse`: enforce `throwOnLimitExceeded` for cumulative array growth via `combine`/`merge`
@@ -29,7 +53,7 @@
 - [Fix] `stringify`: use configured `delimiter` after `charsetSentinel` (#555)
 - [Fix] `stringify`: apply `formatter` to encoded key under `strictNullHandling` (#554)
 - [Fix] `stringify`: skip null/undefined filter-array entries instead of crashing in `encoder` (#551)
-- [Fix] `parse`: handle nested bracket groups and add regression tests (#530)
+- [Fix] `parse`: handle nested bracket groups and add regression tests (#530); changes output for some unbalanced bracket keys (see #558)
 - [readme] fix grammar (#550)
 - [Dev Deps] update `@ljharb/eslint-config`
 - [Tests] add regression tests for keys containing percent-encoded bracket text