@zuplo/cli 7.3.2 → 7.4.3

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -345,8 +345,9 @@ export declare interface AIGatewayConfigurationLoaderV2InboundPolicyOptions {
  * identifiers, API keys and other credentials) using the in-gateway DLP
  * engine, and applies per-rule actions: mask, block, or log. Detection runs
  * entirely inside the gateway; nothing is sent to a third-party scanning
- * service. Streaming responses are scanned as they stream, chunk by chunk
- * with a sliding boundary window, rather than being buffered to the end.
+ * service. Streaming responses are scanned as they stream by default (chunk
+ * by chunk with a sliding boundary window); `streaming.mode: "buffer"`
+ * instead collects the whole response and scans it once as one document.
  *
  * Options are validated at request time and invalid options fail closed with
  * a ConfigurationError. Content that cannot be inspected is denied by
@@ -367,13 +368,13 @@ export declare function AIGatewayDlpInboundPolicy(
 ): Promise<ZuploRequest | Response>;
 
 /**
- * The options for the Data Loss Prevention (DLP) policy. Scans the content of AI requests and responses — system prompts, messages, and tool-call arguments — for sensitive data such as credit cards, national identifiers, and API keys, applying a per-rule action (mask, block, or log). Detection runs entirely inside the gateway and streaming responses are scanned as they stream.
+ * The options for the Data Loss Prevention (DLP) policy. Scans the content of AI requests and responses — system prompts, messages, and tool-call arguments — for sensitive data such as credit cards, national identifiers, and API keys, applying a per-rule action (mask, block, or log). Detection runs entirely inside the gateway; streaming responses are scanned as they stream (or collected and scanned whole with `streaming.mode: "buffer"`).
  * @public
  */
 export declare interface AIGatewayDlpInboundPolicyOptions {
   rules: DlpRules;
   /**
-   * Your own detection rules alongside the built-ins: the same rule object plus a `name`, a regex `pattern`, and optional `context` words.
+   * Your own detectors: a `name`, a regex `pattern`, and optional `context` words. A detector does nothing by itself — activate it by name inside `rules.inbound` or `rules.outbound`, exactly like a built-in type, with its own action, detection level, and mask per direction.
    */
   customRules?: DlpCustomRule[];
   /**
@@ -4861,7 +4862,7 @@ declare interface DlpCustomPattern_2 {
 
 declare interface DlpCustomRule {
   /**
-   * Identifier reported in findings and block details for this rule.
+   * The detector's name — the key you use to activate it inside `rules.inbound` or `rules.outbound`, exactly like a built-in type id. Must be distinct and must not reuse a built-in type id or group selector.
    */
   name: string;
   /**
@@ -4869,68 +4870,16 @@ declare interface DlpCustomRule {
    */
   pattern: string;
   /**
-   * Context words for this rule. With `detection: "corroborated"` the rule only fires when one of these words appears near the match.
+   * Context words for this detector. An activation with `detection: "corroborated"` then only fires when one of these words appears near the match.
    */
   context?: string[];
-  /**
-   * What happens when this rule matches, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the rule's name (never the values); `log` records a finding and lets the traffic pass unchanged; `off` disables the rule. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both.
-   */
-  action?: "mask" | "block" | "log" | "off";
-  /**
-   * What happens when this rule matches in what callers send the model. Use with `outboundAction` to give the rule different behavior per direction. Omitting it (or `off`) leaves the inbound direction unscanned for this rule. Cannot be combined with `action`.
-   */
-  inboundAction?: "mask" | "block" | "log" | "off";
-  /**
-   * What happens when this rule matches in what the model sends back. Omitting it (or `off`) leaves the outbound direction unscanned for this rule. Cannot be combined with `action`.
-   */
-  outboundAction?: "mask" | "block" | "log" | "off";
-  /**
-   * How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule.
-   */
-  detection?: "corroborated" | "standard" | "aggressive";
-  /**
-   * Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type.
-   */
-  mask?: string;
-  partialMask?: DlpPartialMask;
-}
-
-declare interface DlpPartialMask {
-  /**
-   * Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked.
-   */
-  keepLast: number;
-}
-
-declare interface DlpRule {
-  /**
-   * What happens when this type is found, in BOTH directions. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key. A rule states either `action` or the directional pair (`inboundAction`/`outboundAction`), never both.
-   */
-  action?: "mask" | "block" | "log" | "off";
-  /**
-   * What happens when this type is found in what callers send the model (system prompt, message text, and tool-call arguments). Use with `outboundAction` to give one type different behavior per direction — for example mask PII on the way in and block it on the way out. Omitting it (or `off`) leaves the inbound direction unscanned for this type. Cannot be combined with `action`.
-   */
-  inboundAction?: "mask" | "block" | "log" | "off";
-  /**
-   * What happens when this type is found in what the model sends back (buffered responses whole, streaming responses as they stream). Omitting it (or `off`) leaves the outbound direction unscanned for this type. Cannot be combined with `action`.
-   */
-  outboundAction?: "mask" | "block" | "log" | "off";
-  /**
-   * How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule.
-   */
-  detection?: "corroborated" | "standard" | "aggressive";
-  /**
-   * Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type.
-   */
-  mask?: string;
-  partialMask?: DlpPartialMask;
 }
 
 /**
- * What to find and what to do about it. Each key is a built-in data type id (like `id-us-ssn`) or a group selector (like `pii` or `secret`, plus any dash-aligned id prefix such as `secret-aws`); each value is a rule object stating either one `action` for both directions or a directional pair (`inboundAction`/`outboundAction`) — for example mask PII inbound and block it outbound. Types you do not mention are not scanned. The most specific key wins — an exact id beats a prefix beats a group — and the winning entry decides everything for its type. When one stretch of text matches multiple rules, the severest action wins (block > mask > log). At least one rule must scan something.
+ * What to find in this direction and what to do about it. Each key is a built-in data type id (like `id-us-ssn`), a group selector (like `pii` or `secret`, plus any dash-aligned id prefix such as `secret-aws`), or one of your custom detectors by name; each value is a rule object whose required `action` says what happens on a match. Types you do not mention are not scanned in this direction. The most specific key wins — an exact id beats a prefix beats a group — and the winning entry decides everything for its type in this direction. When one stretch of text matches multiple rules, the severest action wins (block > mask > log).
  * @public
  */
-declare interface DlpRules {
+declare interface DlpDirectionRules {
   contact?: DlpRule;
   finance?: DlpRule;
   "finance-us"?: DlpRule;
@@ -5014,23 +4963,56 @@ declare interface DlpRules {
   "secret-terraform"?: DlpRule;
   "secret-twilio"?: DlpRule;
   "secret-zuplo"?: DlpRule;
+  [k: string]: unknown;
+}
+
+declare interface DlpPartialMask {
+  /**
+   * Keep the last N characters of the matched value unmasked and replace the rest with `*`, preserving length (for example `**** **** **** 4242`). Values no longer than N characters are fully masked.
+   */
+  keepLast: number;
+}
+
+declare interface DlpRule {
+  /**
+   * What happens when this rule matches in this direction. `mask` replaces the matched text with a placeholder and the conversation continues; `block` rejects the request or terminates the response with an error naming only the detected types (never the values); `log` records a finding and lets the traffic pass unchanged — use it to trial a rule before enforcing it; `off` excludes this type from a group enabled by a broader key in the same section.
+   */
+  action: "mask" | "block" | "log" | "off";
+  /**
+   * How much evidence a match needs before this rule acts. `corroborated` additionally requires one of the type's context words near the match (types that define no context words behave as `standard`); `standard` uses the catalog as tuned — distinctive shapes act on their own while ambiguous shapes need nearby context; `aggressive` counts every pattern match and is false-positive-prone — pair it with the `log` action for audits. Overrides the policy-level `detection` for this rule.
+   */
+  detection?: "corroborated" | "standard" | "aggressive";
+  /**
+   * Replacement text for this rule's masked matches. The `{type}` token inserts the detected type id in UPPER_SNAKE form, so the default turns a matched email into `[CONTACT_EMAIL]` — typed placeholders keep masked conversations legible to the model. Set a literal like `[REDACTED]` to hide the type.
+   */
+  mask?: string;
+  partialMask?: DlpPartialMask;
 }
 
 /**
- * Tuning for streaming (SSE) response scanning. Each chunk is held until the boundary scan that includes its successor passes, then released — so values split across chunks are always fully maskable, at the cost of one chunk of latency.
+ * The scan configuration, split by direction: `inbound` covers what callers send the model (system prompt, message text, and tool-call arguments); `outbound` covers what the model sends back (buffered responses whole, streaming responses as they stream). Each direction you include is scanned; each you omit is left untouched — there is no "both" shorthand and no mirroring, so wanting the same behavior on both sides means stating it in both sections. At least one section must enable at least one rule.
+ * @public
+ */
+declare interface DlpRules {
+  inbound?: DlpDirectionRules;
+  outbound?: DlpDirectionRules;
+}
+
+/**
+ * How streaming (SSE) responses are inspected. `stream` (the default) scans deltas as they flow, holding each chunk until the boundary scan that includes its successor passes — values split across chunks stay maskable at the cost of one chunk of latency. `buffer` collects the entire response and scans it once as one document — exact detection for values of any length, and a blocked response is a clean 400 because nothing has been delivered yet — at the cost of the client waiting for the full generation. `off` passes streaming responses through unscanned.
  * @public
  */
 declare interface DlpStreamingSettings {
   /**
-   * Scan streaming responses. When false, streaming responses pass through unscanned even when rules cover the outbound direction.
+   * `stream` scans deltas in flight with the windowed scanner. `buffer` holds the entire response and scans it once, exactly like a non-streaming response: values of any length are caught (no carry window) and a block is a native 400 error instead of a mid-stream termination, but the client receives nothing until the model finishes. `off` skips scanning of streaming responses entirely, even when rules cover the outbound direction.
    */
-  enabled?: boolean;
+  mode?: "stream" | "buffer" | "off";
   /**
-   * Scan across chunk boundaries using a carried tail of already-scanned text. When false, each chunk is scanned alone and released immediately — lower cost, but values split across two chunks are missed.
+   * Scan across chunk boundaries using a carried tail of already-scanned text. When false, each chunk is scanned alone and released immediately — lower cost, but values split across two chunks are missed. Applies to `stream` mode only.
    */
   boundaryScan?: boolean;
   /**
-   * How many trailing characters are carried from one chunk into the next boundary scan. Bounds memory and re-scan cost; must be larger than the longest value you need to catch.
+   * How many trailing characters are carried from one chunk into the next boundary scan. Bounds memory and re-scan cost; must be larger than the longest value you need to catch. Applies to `stream` mode only — `buffer` mode always scans the complete text.
    */
   maxCarryChars?: number;
 }
@@ -15679,12 +15661,69 @@ export declare class ZuploMcpSdk {
    */
   getRawCallToolRequest(): CallToolRequest | null;
   /**
-   * Sets the MCP request/response context object.
-   * Use this to set `_meta` that should be included in the tool result.
+   * Overrides fields of the MCP tool result the gateway is about to send.
+   *
+   * Every field is independently optional; an absent field keeps the value
+   * the gateway derives from the downstream response. The most useful
+   * combination is `content` alone: the human-readable summary replaces the
+   * raw serialized body while `structuredContent` is still auto-derived from
+   * it — one call, compact model context, full data preserved.
+   *
+   * @example A compact summary for the model, full JSON in structuredContent
+   * ```ts
+   * const response = await context.invokeRoute("/todos");
+   * new ZuploMcpSdk(context).setRawCallToolResult({
+   *   content: [{ type: "text", text: "Fetched the todo list" }],
+   * });
+   * return response;
+   * ```
+   *
+   * Notes:
+   *
+   * - The stored value is *consumed* when the gateway builds the tool result
+   *   (asymmetric with {@link getRawCallToolRequest}, which can be read any
+   *   number of times).
+   * - The value is written to the context that carried the matching
+   *   `tools/call` request, which is looked up exactly one `invokeRoute`
+   *   generation up. Calling this from a grandchild invocation (a route that
+   *   itself invokes another route) silently stores the override where the
+   *   gateway never reads it.
+   * - `isError` is deliberately not overridable: it follows the status of the
+   *   response your handler returns, so upstream failures cannot be masked.
+   * - `structuredContent` must be a JSON object. The MCP 2025-11-25 wire
+   *   format rejects arrays and scalars here.
+   * - Declining the spec's backwards-compatibility SHOULD (mirroring
+   *   serialized JSON into a text block) has a concrete cost: clients that
+   *   predate `structuredContent` see only your summary in `content`.
+   * - MCP reserves `_meta` keys with the `modelcontextprotocol.io/` prefix
+   *   for the protocol itself; use your own prefix for application metadata.
    *
-   * @param req - The object containing metadata (e.g. `{ _meta: { ... } }`)
+   * @param result - The fields to override on the tool result
+   */
+  setRawCallToolResult(result: ZuploMcpToolResultOverride): void;
+}
+
+/**
+ * The subset of a `tools/call` result a module author may override via
+ * {@link ZuploMcpSdk.setRawCallToolResult}. Every field is independently
+ * optional; an absent field keeps the value the gateway derives from the
+ * downstream response.
+ */
+export declare interface ZuploMcpToolResultOverride {
+  /**
+   * Content blocks for the model to read. Replaces the gateway's default
+   * (the serialized downstream body in a single text block).
+   */
+  content?: CallToolResult["content"];
+  /**
+   * The structured form of the tool's output. MUST be a JSON object — the
+   * MCP 2025-11-25 wire format rejects arrays/strings/numbers here.
+   */
+  structuredContent?: Record<string, unknown>;
+  /**
+   * Per-call metadata. Replaces the gateway's default of `{}`.
    */
-  setRawCallToolResult(req: CallToolResult): void;
+  _meta?: Record<string, unknown>;
 }
 
 /**

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.3.2",
+  "version": "7.4.3",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/negotiator/lib/accept.js

@@ -0,0 +1,54 @@
+/*!
+ * negotiator
+ * Copyright(c) 2026 Blake Embrey
+ * MIT Licensed
+ */
+
+'use strict';
+
+var contentType = require('content-type');
+
+/**
+ * Module exports.
+ * @private
+ */
+
+module.exports = parseAccept;
+
+/**
+ * Parse an Accept-style header.
+ * @private
+ */
+
+function parseAccept(header) {
+  var values = [];
+  var index = 0;
+
+  while (index < header.length) {
+    var start = skipOptionalWhitespace(header, index);
+    var parsed = contentType.parse(header, { comma: true, start: start });
+
+    // `content-type` normalizes the type, but accept methods return original casing.
+    parsed.type = header.slice(start, start + parsed.type.length);
+    values.push(parsed);
+
+    index = parsed.index + 1;
+  }
+
+  return values;
+}
+
+/**
+ * Skip optional whitespace.
+ * @private
+ */
+
+function skipOptionalWhitespace(header, index) {
+  var cursor = index;
+
+  while (header.charCodeAt(cursor) === 0x20 || header.charCodeAt(cursor) === 0x09) {
+    cursor++;
+  }
+
+  return cursor;
+}

package/node_modules/negotiator/lib/charset.js

@@ -8,6 +8,8 @@
 
 'use strict';
 
+var parseAccept = require('./accept');
+
 /**
  * Module exports.
  * @public
@@ -21,55 +23,29 @@ module.exports.preferredCharsets = preferredCharsets;
  * @private
  */
 
-var simpleCharsetRegExp = /^\s*([^\s;]+)\s*(?:;(.*))?$/;
-
-/**
- * Parse the Accept-Charset header.
- * @private
- */
-
 function parseAcceptCharset(accept) {
-  var accepts = accept.split(',');
+  var accepts = parseAccept(accept);
 
   for (var i = 0, j = 0; i < accepts.length; i++) {
-    var charset = parseCharset(accepts[i].trim(), i);
-
-    if (charset) {
-      accepts[j++] = charset;
-    }
+    var charset = formatCharset(accepts[i], i);
+    if (charset) accepts[j++] = charset;
   }
 
-  // trim accepts
   accepts.length = j;
-
   return accepts;
 }
 
 /**
- * Parse a charset from the Accept-Charset header.
+ * Format a parsed charset for negotiation.
  * @private
  */
 
-function parseCharset(str, i) {
-  var match = simpleCharsetRegExp.exec(str);
-  if (!match) return null;
-
-  var charset = match[1];
-  var q = 1;
-  if (match[2]) {
-    var params = match[2].split(';')
-    for (var j = 0; j < params.length; j++) {
-      var p = params[j].trim().split('=');
-      if (p[0] === 'q') {
-        q = parseFloat(p[1]);
-        break;
-      }
-    }
-  }
+function formatCharset(parsed, i) {
+  if (!parsed.type) return null;
 
   return {
-    charset: charset,
-    q: q,
+    charset: parsed.type,
+    q: parsed.parameters.q ? parseFloat(parsed.parameters.q) : 1,
     i: i
   };
 }

package/node_modules/negotiator/lib/encoding.js

@@ -8,6 +8,8 @@
 
 'use strict';
 
+var parseAccept = require('./accept');
+
 /**
  * Module exports.
  * @public
@@ -21,20 +23,13 @@ module.exports.preferredEncodings = preferredEncodings;
  * @private
  */
 
-var simpleEncodingRegExp = /^\s*([^\s;]+)\s*(?:;(.*))?$/;
-
-/**
- * Parse the Accept-Encoding header.
- * @private
- */
-
 function parseAcceptEncoding(accept) {
-  var accepts = accept.split(',');
+  var accepts = parseAccept(accept);
   var hasIdentity = false;
   var minQuality = 1;
 
   for (var i = 0, j = 0; i < accepts.length; i++) {
-    var encoding = parseEncoding(accepts[i].trim(), i);
+    var encoding = formatEncoding(accepts[i], i);
 
     if (encoding) {
       accepts[j++] = encoding;
@@ -55,37 +50,21 @@ function parseAcceptEncoding(accept) {
     };
   }
 
-  // trim accepts
   accepts.length = j;
-
   return accepts;
 }
 
 /**
- * Parse an encoding from the Accept-Encoding header.
+ * Format a parsed encoding for negotiation.
  * @private
  */
 
-function parseEncoding(str, i) {
-  var match = simpleEncodingRegExp.exec(str);
-  if (!match) return null;
-
-  var encoding = match[1];
-  var q = 1;
-  if (match[2]) {
-    var params = match[2].split(';');
-    for (var j = 0; j < params.length; j++) {
-      var p = params[j].trim().split('=');
-      if (p[0] === 'q') {
-        q = parseFloat(p[1]);
-        break;
-      }
-    }
-  }
+function formatEncoding(parsed, i) {
+  if (!parsed.type) return null;
 
   return {
-    encoding: encoding,
-    q: q,
+    encoding: parsed.type,
+    q: parsed.parameters.q ? parseFloat(parsed.parameters.q) : 1,
     i: i
   };
 }

package/node_modules/negotiator/lib/language.js

@@ -8,6 +8,9 @@
 
 'use strict';
 
+var contentType = require('content-type');
+var parseAccept = require('./accept');
+
 /**
  * Module exports.
  * @public
@@ -21,60 +24,36 @@ module.exports.preferredLanguages = preferredLanguages;
  * @private
  */
 
-var simpleLanguageRegExp = /^\s*([^\s\-;]+)(?:-([^\s;]+))?\s*(?:;(.*))?$/;
-
-/**
- * Parse the Accept-Language header.
- * @private
- */
-
 function parseAcceptLanguage(accept) {
-  var accepts = accept.split(',');
+  var accepts = parseAccept(accept);
 
   for (var i = 0, j = 0; i < accepts.length; i++) {
-    var language = parseLanguage(accepts[i].trim(), i);
-
-    if (language) {
-      accepts[j++] = language;
-    }
+    var language = formatLanguage(accepts[i], i);
+    if (language) accepts[j++] = language;
   }
 
-  // trim accepts
   accepts.length = j;
-
   return accepts;
 }
 
 /**
- * Parse a language from the Accept-Language header.
+ * Format a parsed language for negotiation.
  * @private
  */
 
-function parseLanguage(str, i) {
-  var match = simpleLanguageRegExp.exec(str);
-  if (!match) return null;
-
-  var prefix = match[1]
-  var suffix = match[2]
-  var full = prefix
+function formatLanguage(parsed, i) {
+  if (!parsed.type) return null;
 
-  if (suffix) full += "-" + suffix;
-
-  var q = 1;
-  if (match[3]) {
-    var params = match[3].split(';')
-    for (var j = 0; j < params.length; j++) {
-      var p = params[j].split('=');
-      if (p[0] === 'q') q = parseFloat(p[1]);
-    }
-  }
+  var hyphen = parsed.type.indexOf('-');
+  var prefix = hyphen === -1 ? parsed.type : parsed.type.slice(0, hyphen);
+  var suffix = hyphen === -1 ? undefined : parsed.type.slice(hyphen + 1);
 
   return {
     prefix: prefix,
     suffix: suffix,
-    q: q,
+    q: parsed.parameters.q ? parseFloat(parsed.parameters.q) : 1,
     i: i,
-    full: full
+    full: parsed.type
   };
 }
 
@@ -103,7 +82,7 @@ function getLanguagePriority(language, accepted, index) {
  */
 
 function specify(language, spec, index) {
-  var p = parseLanguage(language)
+  var p = formatLanguage(contentType.parse(language), 0)
   if (!p) return null;
   var s = 0;
   if(spec.full.toLowerCase() === p.full.toLowerCase()){