zuplo 6.72.8 → 6.72.10

package/docs/articles/api-key-administration.mdx

@@ -3,40 +3,30 @@ title: Manage Keys in the Portal
 sidebar_label: Manage in the Portal
 ---
 
-API Key Consumers can be managed from your project's
-[**Services**](https://portal.zuplo.com/+/account/project/services) page in the
-Zuplo Portal. Each project is created with three API Key Buckets - one for
-production, one shared by preview environments, and one for development (working
-copy) environments.
+Manage API Key Consumers from the
+[**Services**](https://portal.zuplo.com/+/account/project/services) tab in the
+Zuplo Portal. Opening **Services** lands you on **API Keys → Consumers** in the
+section sidebar. Each project has three API Key Buckets — one for production,
+one shared by preview environments, and one for development (working copy)
+environments.
 
-![Services](../../public/media/api-key-administration/services-page.png)
+![The API Keys → Consumers page in the Services section, with the sidebar showing API Keys, Monetization, and Audit Logs, and the environment switcher set to Dev](../../public/media/api-key-administration/services-page.png)
 
-You can view the buckets for each environment or for all environments using the
-drop down.
+To view the bucket for a different environment, use the **Dev / Preview / Prod**
+switcher at the top of the sidebar. The active bucket's name appears as a
+copyable pill under the **API Key Service** heading.
 
-![Environment Selection](../../public/media/api-key-administration/image-1.png)
-
-To open the API Key Bucket for an environment, click the **Configure** button.
-
-![Configure](../../public/media/api-key-administration/image-2.png)
-
-When you first open the API Key Bucket, you won't have any API Keys created.
-
-![Empty API Key Bucket](../../public/media/api-key-administration/image-3.png)
-
-To add a new API Key Consumer click the **Create Consumer** button and complete
-the form.
+To add a new API Key Consumer, click **Create Consumer** and complete the form.
 
 <ModalScreenshot>
 
-![New API Key Consumer](../../public/media/api-key-administration/image-4.png)
+![The Create Consumer dialog with fields for the consumer name and description](../../public/media/api-key-administration/image-4.png)
 
 </ModalScreenshot>
 
-Once a consumer is created, you can view or copy the API Key by clicking the
-icons shown.
+Once a consumer is created, view or copy its API Key using the icons shown.
 
-![Copy or View](../../public/media/api-key-administration/image-5.png)
+![A consumer row with icons to view and copy its API key](../../public/media/api-key-administration/image-5.png)
 
 If you're using the Zuplo [Developer Portal](../dev-portal/introduction.mdx),
 we've an integration with the API Key API that allows developers to access their

package/docs/articles/api-key-consumer-bucket-portal-ui.mdx

@@ -7,9 +7,11 @@ description:
   troubleshooting.
 ---
 
-Every API key consumer in Zuplo lives inside a **bucket**, and each bucket is
-scoped to a specific environment. This guide shows how to pick a target bucket
-from the **Services** screen and create a consumer inside it.
+Every API key consumer in Zuplo lives inside a **bucket**. Each project's
+default buckets are scoped to a specific environment, though custom buckets
+created through the Developer API can be account-scoped instead. This guide
+shows how to select the target environment's bucket on the **API Keys →
+Consumers** page and create a consumer inside it.
 
 :::note
 
@@ -57,33 +59,32 @@ For deeper detail, see [Buckets and Environments](./api-key-buckets.mdx).
 1. Open your project in the [Zuplo Portal](https://portal.zuplo.com).
 
 1. Navigate to the
-   [**Services**](https://portal.zuplo.com/+/account/project/services) page.
+   [**Services**](https://portal.zuplo.com/+/account/project/services) tab. It
+   opens on **API Keys → Consumers** in the section sidebar.
 
-1. Locate the **API Key Service** card. Use the **environment dropdown** at the
-   top right to filter the visible buckets. Pick **All Environments** to see
-   every bucket, or pick a single environment to narrow the list.
+1. Use the **Dev / Preview / Prod** switcher at the top of the sidebar to select
+   the environment whose bucket you want. The active bucket's name appears as a
+   copyable pill under the **API Key Service** heading.
 
 </Stepper>
 
 <ModalScreenshot size="md">
 
-![Services page with the environment dropdown open, showing All Environments, Production, Preview, and Development options](../../public/media/api-key-consumer-bucket-portal-ui/services-page-dropdown.png)
+![The API Keys → Consumers page with the environment switcher set to Dev and the active bucket name shown as a pill under the API Key Service heading](../../public/media/api-key-consumer-bucket-portal-ui/services-page-dropdown.png)
 
 </ModalScreenshot>
 
-The card's **Connected to** badge shows which environment's bucket is currently
-active.
+The pill under the **API Key Service** heading shows the name of the bucket
+that's currently active for the selected environment.
 
 ## Create a consumer in a specific bucket
 
 <Stepper>
 
-1. On the **Services** page, choose the target environment from the dropdown.
+1. On the **API Keys → Consumers** page, choose the target environment with the
+   **Dev / Preview / Prod** switcher.
 
-1. On the API Key Service card, click **Bucket Details**. The bucket's consumer
-   list opens.
-
-1. Click **Create new consumer** and fill in the form below.
+1. Click **Create Consumer** and fill in the form below.
 
 1. Click **Save consumer**, then confirm it appears in the list.
 
@@ -175,8 +176,8 @@ target bucket name, and `$ZAPI_KEY` with your
 Usually a bucket mismatch. The consumer is in one bucket, but the policy checks
 a different one.
 
-1. In the portal, navigate to **Services** and confirm which bucket holds the
-   consumer.
+1. In the portal, open **Services → API Keys → Consumers** and confirm which
+   bucket holds the consumer.
 2. Open the route's API Key Authentication policy. If `bucketName` or `bucketId`
    is set, verify it matches the consumer's bucket. If neither is set, the
    policy uses the current environment's default bucket.
@@ -188,13 +189,14 @@ a different one.
 <details>
 <summary>I don't see the bucket I'm looking for</summary>
 
-- **Environment filter.** Set the dropdown to **All Environments** to see every
-  bucket.
+- **Environment.** Switch the **Dev / Preview / Prod** toggle to the environment
+  whose bucket you're looking for.
 - **Custom buckets.** Buckets created via the Developer API are account-scoped,
-  not environment-scoped. They show under **All Environments**. If still
-  missing, confirm the account using the
-  [list buckets API endpoint](https://dev.zuplo.com/docs).
-- **Permissions.** Account-level roles control access to the Services page.
+  not environment-scoped, so the sidebar's environment switcher doesn't surface
+  them. Confirm they exist with the
+  [list buckets API endpoint](https://dev.zuplo.com/docs) and manage them
+  through the API.
+- **Permissions.** Account-level roles control access to the Services section.
   Confirm your role can view and manage API key consumers.
 
 </details>
@@ -204,8 +206,8 @@ a different one.
 
 Consumers belong to buckets, not environments directly. A consumer created while
 viewing the **Preview** environment sits in the preview bucket and only
-authenticates preview environments. Switch the dropdown to **All Environments**
-or the specific environment to locate it.
+authenticates preview environments. Switch the **Dev / Preview / Prod** toggle
+to the matching environment to locate it.
 
 </details>
 

package/docs/articles/api-key-end-users.mdx

@@ -44,11 +44,11 @@ hand in the admin portal does not scale to a production user base.
 
 For development or one-off needs, the easiest way to obtain an API key is in the
 [Zuplo Portal](https://portal.zuplo.com). Open your project's
-[**Services**](https://portal.zuplo.com/+/account/project/services) page, find
-the **API Key Service**, click **Configure**, and you can view existing keys or
-create new keys for your consumers manually.
+[**Services**](https://portal.zuplo.com/+/account/project/services) tab, then
+select **API Keys → Consumers** in the sidebar. From here you can view existing
+keys or create new keys for your consumers manually.
 
-![API key section](../../public/media/api-key-end-users/api-key-service.png)
+![The API Keys → Consumers page in the Services section](../../public/media/api-key-end-users/api-key-service.png)
 
 ## Zuplo Developer Portal
 

package/docs/articles/api-key-self-serve-integration.mdx

@@ -54,8 +54,9 @@ Before you start, you need:
 - Your **account name** and **bucket name**. A bucket groups consumers for an
   environment - each project has buckets for production, preview, and
   development. Find the bucket name on your project's
-  [**Services**](https://portal.zuplo.com/+/account/project/services) page, and
-  the account name in
+  [**Services → API Keys → Consumers**](https://portal.zuplo.com/+/account/project/services)
+  page (the copyable pill under the **API Key Service** heading), and the
+  account name in
   [**Project Settings → General**](https://portal.zuplo.com/+/account/project/settings/general).
 - An application with server-side code and existing user authentication.
 
@@ -64,7 +65,7 @@ All examples in this guide use these environment variables:
 ```bash
 # Your Zuplo Account Name
 export ZUPLO_ACCOUNT=my-account
-# Your bucket name (found on your project's Services page)
+# Your bucket name (found on the Services → API Keys → Consumers page)
 export ZUPLO_BUCKET=my-bucket
 # Your Zuplo API Key (found in Account Settings > Zuplo API Keys)
 export ZUPLO_API_KEY=zpka_YOUR_API_KEY

package/docs/articles/audit-logs.mdx

@@ -105,9 +105,10 @@ fails the request, even if an event can't be recorded.
 ## Viewing audit logs in the portal
 
 To browse and search your audit logs, open your project's
-[**Services**](https://portal.zuplo.com/+/account/project/services) page in the
-Zuplo Portal and select the **Audit Logs** tile for the environment you want to
-inspect.
+[**Services**](https://portal.zuplo.com/+/account/project/services) tab in the
+Zuplo Portal, pick the environment you want to inspect with the
+**Dev / Preview / Prod** switcher at the top of the sidebar, then select **Audit
+Logs → Events** in the sidebar.
 
 The events view lets you:
 
@@ -120,8 +121,9 @@ The events view lets you:
 Everything in the portal is backed by the Zuplo API, so you can query audit logs
 programmatically — for scripting, custom dashboards, or exporting to other
 systems. Authenticate with a [Zuplo API key](./accounts/zuplo-api-keys.mdx) and
-query events by bucket name. Your bucket name is shown on the **Services** page
-in the portal (it's the same bucket used by the API Key Service).
+query events by bucket name. Your bucket name is shown on the **API Keys →
+Consumers** page in the portal, as the copyable pill under the **API Key
+Service** heading (it's the same bucket used by the API Key Service).
 
 ```bash
 curl "https://dev.zuplo.com/v1/audit-logs/$BUCKET_NAME/events?type=com.zuplo.api.request&startDate=2026-07-01T00:00:00Z&endDate=2026-07-07T00:00:00Z" \

package/docs/articles/monetization/api-access.mdx

@@ -37,7 +37,7 @@ are set in your terminal:
 
 ```bash
 # Your Bucket ID (could be working-copy, preview, or production)
-# (Found in Project Services > Bucket Details — https://portal.zuplo.com/+/account/project/services)
+# (Copy the bucket pill on Services > API Keys > Consumers — https://portal.zuplo.com/+/account/project/services)
 export BUCKET_ID=your-bucket-id
 # Your Zuplo API Key (Found in Account Settings > Zuplo API Keys —
 # https://portal.zuplo.com/+/account/settings/api-keys)

package/docs/articles/monetization/developer-portal.md

@@ -67,10 +67,9 @@ Save and deploy. Once the plugin is enabled, ensure:
 
 ### Plan display order
 
-Control plan display order from your project's
-[**Services**](https://portal.zuplo.com/+/account/project/services) page in the
-Zuplo Portal — open the Monetization Service. Plans can be reordered using
-drag-and-drop.
+Control plan display order from
+[**Services → Monetization**](https://portal.zuplo.com/+/account/project/services)
+in the Zuplo Portal. Reorder plans using drag-and-drop.
 
 ### Feature comparison matrix
 

package/docs/articles/monetization/going-to-production.mdx

@@ -346,13 +346,12 @@ live mode.
 
 <Stepper>
 
-1. Open your project's
-   [**Services**](https://portal.zuplo.com/+/account/project/services) page in
-   the Zuplo Portal.
+1. Open the [**Services**](https://portal.zuplo.com/+/account/project/services)
+   tab in the Zuplo Portal.
 
-1. Select the **Production** environment.
+1. Select **Prod** on the environment switcher in the sidebar.
 
-1. Open the Monetization Service, then go to **Payment Provider**.
+1. Go to **Monetization → Payment Provider**.
 
 1. Paste your live restricted key (`rk_live_...`) and click **Save**.
 
@@ -460,7 +459,7 @@ To help the team resolve your issue quickly, include:
 | ------------------ | ------------------------------------------------------ |
 | Account slug       | Your Zuplo account identifier                          |
 | Project slug       | The project with monetization enabled                  |
-| Bucket ID          | Project Services → Bucket Details                      |
+| Bucket ID          | The bucket pill on Services → API Keys → Consumers     |
 | Stripe account ID  | Stripe Dashboard → Settings, starts with `acct_`       |
 | Plan keys          | The plan keys involved in the issue                    |
 | Subscription ID    | If the issue is subscription-specific                  |

package/docs/articles/monetization/quickstart.md

@@ -71,9 +71,9 @@ Add the monetization plugin to your Developer Portal configuration.
 
 1. Open the [**Services**](https://portal.zuplo.com/+/account/project/services)
    tab in your project.
-2. Select the environment you want to configure. We will use **Working Copy**
-   for this quickstart.
-3. Click **Configure** on the **Monetization Service** card.
+2. Select the environment with the **Dev / Preview / Prod** switcher in the
+   sidebar. This quickstart uses **Dev**.
+3. Select **Monetization** in the sidebar.
 
 ## Step 4: Create a meter
 
@@ -231,9 +231,8 @@ charges.
    you're in **sandbox mode** (toggle in the top-right corner).
 2. Go to **Developers > API keys** and copy your **Secret key** (starts with
    `sk_test_`).
-3. In the Monetization Service, click **Payment Provider** in the left sidebar.
-4. Click **Configure** on the Stripe card.
-5. Enter a **Name** and paste your **Stripe API Key**, then click **Save**.
+3. Open **Services → Monetization → Payment Provider**.
+4. Paste your **Stripe API Key** into the field, then click **Save**.
 
 :::tip
 

package/docs/articles/monetization/stripe-integration.md

@@ -33,12 +33,11 @@ in Stripe at the moment a charge is needed (as invoice line items).
 
 ### Via the Zuplo Portal
 
-1. Open your project's
-   [**Services**](https://portal.zuplo.com/+/account/project/services) page,
-   select the Monetization Service, then go to **Payment Provider**
-2. Click **Configure** on the Stripe card
-3. Paste your **Stripe API Key**
-4. Click **Save**
+1. Open
+   [**Services → Monetization → Payment Provider**](https://portal.zuplo.com/+/account/project/services)
+   in your project.
+2. Paste your **Stripe API Key**
+3. Click **Save**
 
 The connection authorizes Zuplo to manage Stripe objects on your behalf —
 specifically Customers, Checkout Sessions, Customer Portal Sessions, Invoices,
@@ -104,10 +103,9 @@ Intents, Refunds, or Stripe Billing Meters — leave all of those at **None**.
    or `Zuplo Monetization (production)`.
 3. For each of the eight permissions above, set the level shown in the table.
 4. Click **Create key**, copy the value (`rk_test_...` or `rk_live_...`), and
-   paste it into the Monetization Service's **Payment Provider** screen (open
-   your project's
-   [**Services**](https://portal.zuplo.com/+/account/project/services) page,
-   then the Monetization Service) in your Zuplo project.
+   paste it into the **Payment Provider** screen at
+   [**Services → Monetization → Payment Provider**](https://portal.zuplo.com/+/account/project/services)
+   in your Zuplo project.
 
 :::caution
 

package/docs/articles/step-3-add-api-key-auth-local.mdx

@@ -75,18 +75,19 @@ Let's get started.
    In order to call your API, you need to configure an API consumer. In the
    Zuplo Portal, open the
    [**Services**](https://portal.zuplo.com/+/account/project/services) tab for
-   your project, then click **Configure** on the "API Key Service".
+   your project, then select **API Keys → Consumers** in the sidebar.
 
    :::warning
 
-   Be sure to select the appropriate environment in the dropdown on the top
-   right of the services page. You must select the environment type your local
-   project is linked to. If you only have a single environment, you should
-   select "Production". Later we will create new environments for preview.
+   Be sure to select the appropriate environment with the
+   **Dev / Preview / Prod** switcher at the top of the sidebar. You must select
+   the environment type your local project is linked to. If you only have a
+   single environment, select **Prod**. Later we will create new environments
+   for preview.
 
    :::
 
-   ![API Key Service](../../public/media/step-3-add-api-key-auth/image-2.png)
+   ![The API Keys → Consumers page in the Services section](../../public/media/step-3-add-api-key-auth/image-2.png)
 
    Then click **Create Consumer**.
 

package/docs/articles/step-3-add-api-key-auth.mdx

@@ -66,9 +66,9 @@ Let's get started.
 
    In order to call your API, you need to configure an API consumer. Open the
    [**Services**](https://portal.zuplo.com/+/account/project/services) tab in
-   your project, then click **Configure** on the "API Key Service".
+   your project, then select **API Keys → Consumers** in the sidebar.
 
-   ![API Key Service](../../public/media/step-3-add-api-key-auth/image-2.png)
+   ![The API Keys → Consumers page in the Services section](../../public/media/step-3-add-api-key-auth/image-2.png)
 
    Then click **Create Consumer**.
 

package/docs/articles/step-5-dynamic-rate-limiting-local.mdx

@@ -140,8 +140,8 @@ Let's get started.
 1. Test your Policy
 
    With your gateway running (`npm run dev`), try your dynamic rate limiting.
-   Grab the key for each consumer back in the Services tab where you created
-   them, then make calls with each key until you hit its limit.
+   Grab the key for each consumer from **Services → API Keys → Consumers** where
+   you created them, then make calls with each key until you hit its limit.
 
    ```bash
    # free consumer — limited to 5 requests per minute

package/docs/articles/step-5-dynamic-rate-limiting.mdx

@@ -137,10 +137,11 @@ Let's get started.
 1. Test your Policy
 
    Using the Test modal, you can try your dynamic rate limiting. You can grab
-   the key for each consumer back in the Services tab where you created them.
-   Like [Step 3](./step-3-add-api-key-auth.mdx), you can fill in the keys into
-   the `Authorization` header and start making calls until you hit your rate
-   limit. Try out the other key and observe the difference in rate limits.
+   the key for each consumer from **Services → API Keys → Consumers** where you
+   created them. Like [Step 3](./step-3-add-api-key-auth.mdx), you can fill in
+   the keys into the `Authorization` header and start making calls until you hit
+   your rate limit. Try out the other key and observe the difference in rate
+   limits.
 
 </Stepper>
 

package/docs/concepts/api-keys.md

@@ -23,7 +23,8 @@ The API key system has three core objects:
 See [API Key Management](../articles/api-key-management.mdx) for a full
 overview, and
 [Manage Keys in the Portal](../articles/api-key-administration.mdx) for managing
-consumers under [Services](https://portal.zuplo.com/+/account/project/services)
+consumers under
+[**Services → API Keys → Consumers**](https://portal.zuplo.com/+/account/project/services)
 in your project.
 
 ## How validation works

package/docs/policies/mcp-capability-filter-inbound/doc.md

@@ -64,9 +64,11 @@ the strategy:
 
 ### Mode `rolesAndGroups`
 
-Mark each capability with `roles` and/or `groups`, or `public: true`. **Every
-capability must be classified** — one that sets neither (or both) is rejected at
-load, so nothing is ever exposed by omission:
+Mark each capability with `roles` and/or `groups`, or `public: true`. **Nothing
+is ever exposed by omission** — a capability with no markup stays in the catalog
+but is available to no one until you classify it (so you can list it now and
+assign roles later). Combining `public: true` with `roles`/`groups` is
+contradictory and rejected at load:
 
 ```json
 {

package/docs/policies/mcp-capability-filter-inbound/schema.json

@@ -88,7 +88,7 @@
                       },
                       "public": {
                         "type": "boolean",
-                        "description": "Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' every capability must set roles/groups OR public: true (not both) — an unclassified capability is a configuration error, so nothing is ever exposed by omission."
+                        "description": "Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' a capability with no roles/groups/public markup is available to no one until it is classified, so nothing is ever exposed by omission. Combining public: true with roles/groups is a configuration error."
                       }
                     }
                   }
@@ -143,7 +143,7 @@
                       },
                       "public": {
                         "type": "boolean",
-                        "description": "Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' every capability must set roles/groups OR public: true (not both) — an unclassified capability is a configuration error, so nothing is ever exposed by omission."
+                        "description": "Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' a capability with no roles/groups/public markup is available to no one until it is classified, so nothing is ever exposed by omission. Combining public: true with roles/groups is a configuration error."
                       }
                     }
                   }
@@ -208,7 +208,7 @@
                       },
                       "public": {
                         "type": "boolean",
-                        "description": "Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' every capability must set roles/groups OR public: true (not both) — an unclassified capability is a configuration error, so nothing is ever exposed by omission."
+                        "description": "Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' a capability with no roles/groups/public markup is available to no one until it is classified, so nothing is ever exposed by omission. Combining public: true with roles/groups is a configuration error."
                       }
                     }
                   }
@@ -273,7 +273,7 @@
                       },
                       "public": {
                         "type": "boolean",
-                        "description": "Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' every capability must set roles/groups OR public: true (not both) — an unclassified capability is a configuration error, so nothing is ever exposed by omission."
+                        "description": "Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' a capability with no roles/groups/public markup is available to no one until it is classified, so nothing is ever exposed by omission. Combining public: true with roles/groups is a configuration error."
                       }
                     }
                   }
@@ -283,7 +283,7 @@
             "accessControl": {
               "type": "object",
               "additionalProperties": false,
-              "description": "Optional per-caller access control. Defaults to mode 'allPublic' (no access control). Set mode to 'rolesAndGroups' to match the caller's role/group claims against each capability's markup (every capability must then set roles/groups or public: true), or 'function' to delegate to a custom resolver.",
+              "description": "Optional per-caller access control. Defaults to mode 'allPublic' (no access control). Set mode to 'rolesAndGroups' to match the caller's role/group claims against each capability's markup (a capability with no roles/groups/public markup is available to no one), or 'function' to delegate to a custom resolver.",
               "properties": {
                 "mode": {
                   "type": "string",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zuplo",
-  "version": "6.72.8",
+  "version": "6.72.10",
   "type": "module",
   "description": "The programmable API Gateway",
   "author": "Zuplo, Inc.",
@@ -19,9 +19,9 @@
     "zuplo": "zuplo.js"
   },
   "dependencies": {
-    "@zuplo/cli": "6.72.8",
-    "@zuplo/core": "6.72.8",
-    "@zuplo/runtime": "6.72.8",
+    "@zuplo/cli": "6.72.10",
+    "@zuplo/core": "6.72.10",
+    "@zuplo/runtime": "6.72.10",
     "@zuplo/test": "1.4.0"
   }
 }