@zuplo/cli 6.71.22 → 6.71.23

package/node_modules/@zuplo/runtime/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{b as l}from"../chunk-54PA7VDV.js";import{a as o,da as n}from"../chunk-DSZS6PZJ.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function t(i){e.push(Promise.resolve(i))}return o(t,"waitUntil"),{context:new s({event:{waitUntil:t},route:u.route}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(g,"createMockContext");var p={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},s=class extends EventTarget{static{o(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=p,parentContext:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=r,this.#e=e,this.analyticsContext=new l(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,r){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,t,r){let d=o(i=>{try{typeof t=="function"?t(i):t.handleEvent(i)}catch(a){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),a}},"wrapped");super.addEventListener(e,d,r)}};export{s as MockZuploContext,g as createMockContext};
+import{b as l}from"../chunk-4QJJMELB.js";import{a as o,da as n}from"../chunk-DSZS6PZJ.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function t(i){e.push(Promise.resolve(i))}return o(t,"waitUntil"),{context:new s({event:{waitUntil:t},route:u.route}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(g,"createMockContext");var p={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},s=class extends EventTarget{static{o(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=p,parentContext:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=r,this.#e=e,this.analyticsContext=new l(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,r){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,t,r){let d=o(i=>{try{typeof t=="function"?t(i):t.handleEvent(i)}catch(a){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),a}},"wrapped");super.addEventListener(e,d,r)}};export{s as MockZuploContext,g as createMockContext};
 //# sourceMappingURL=index.js.map

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -1,6 +1,7 @@
 import { Attributes } from "@opentelemetry/api";
 import { CallToolRequest } from "@zuplo/mcp/types";
 import { CallToolResult } from "@zuplo/mcp/types";
+import { InboundPolicyHandler as InboundPolicyHandler_2 } from "../../policies.js";
 import { KeyLike } from "jose";
 import { RequestGeneric as RequestGeneric_2 } from "../../request.js";
 import type { ValidateFunction } from "ajv";
@@ -181,6 +182,7 @@ export declare function aiGatewayHandler(
  * @returns A Request or a Response
  */
 export declare class AIGatewayMeteringInboundPolicy extends InboundPolicy<AIGatewayMeteringInboundPolicyOptions> {
+  static readonly policyType = "ai-gateway-metering";
   /**
    * Set the meter increments for the current request.
    *
@@ -208,10 +210,6 @@ export declare class AIGatewayMeteringInboundPolicy extends InboundPolicy<AIGate
   static getQuotaFallback(
     context: ZuploContext
   ): QuotaFallbackModels | undefined;
-  constructor(
-    options: AIGatewayMeteringInboundPolicyOptions,
-    policyName: string
-  );
   handler(
     request: ZuploRequest,
     context: ZuploContext
@@ -897,6 +895,14 @@ declare interface AnthropicMessage {
       }>;
 }
 
+/**
+ * A request to the Anthropic Messages API (`/v1/messages`).
+ *
+ * The gateway forwards this body to Anthropic verbatim on the native passthrough
+ * path, so the shape mirrors Anthropic's API rather than an internal contract.
+ * The index signature carries evolving Anthropic fields (`thinking`,
+ * `tool_choice`, `top_k`, structured `system` blocks, …) through unchanged.
+ */
 declare interface AnthropicMessagesRequest {
   model: string;
   messages: AnthropicMessage[];
@@ -908,6 +914,7 @@ declare interface AnthropicMessagesRequest {
   stream?: boolean;
   metadata?: Record<string, unknown>;
   tools?: unknown[];
+  [key: string]: unknown;
 }
 
 /**
@@ -1439,6 +1446,7 @@ export declare interface Auth0JwtInboundPolicyOptions {
  */
 export declare class AuthZenInboundPolicy extends InboundPolicy<AuthZenInboundPolicyOptions> {
   #private;
+  static readonly policyType = "authzen";
   constructor(options: AuthZenInboundPolicyOptions, policyName: string);
   /**
    * The handler that is called each time this policy is invoked
@@ -1759,6 +1767,7 @@ export declare class AWSLoggingPlugin extends LogPlugin {
  */
 export declare class AxiomaticsAuthZInboundPolicy extends InboundPolicy<AxiomaticsAuthZInboundPolicyOptions> {
   #private;
+  static readonly policyType = "axiomatics-authz";
   private pdpService;
   static setAuthAttributes(
     context: ZuploContext,
@@ -2126,6 +2135,7 @@ declare interface BatchDispatcherOptions {
  * @returns A Request or a Response
  */
 export declare class BrownoutInboundPolicy extends InboundPolicy<BrownoutInboundPolicyOptions> {
+  static readonly policyType = "brownout";
   crons: Cron[];
   constructor(options: BrownoutInboundPolicyOptions, policyName: string);
   handler(
@@ -2856,6 +2866,7 @@ export declare type ComplexRateLimitFunction =
  * @returns A Request or a Response
  */
 export declare class ComplexRateLimitInboundPolicy extends InboundPolicy<ComplexRateLimitInboundPolicyOptions> {
+  static readonly policyType = "complex-rate-limit";
   /**
    * Override the increments for a limit in the current request.
    *
@@ -3863,6 +3874,20 @@ export declare function extractGraphqlErrors(
   bodyText: string
 ): GraphqlResponseError[] | null;
 
+/**
+ * Pull the incremental ASSISTANT TEXT from a parsed stream event per shape. The
+ * single source of truth for "is this delta assistant text" — chat
+ * `choices[].delta.content`, Responses `response.output_text.delta` only (NOT
+ * tool-args / audio / refusal / code deltas), Anthropic `content_block_delta`.
+ * Stream-scanning policies (e.g. the firewall accumulator) should call this
+ * rather than re-deriving the per-shape extraction.
+ * @public
+ */
+export declare function extractStreamTextDelta(
+  parsed: unknown,
+  format: AiFormat
+): string | undefined;
+
 declare interface FetchOptions<T> {
   method?: HttpMethod_2;
   data?: T;
@@ -4305,6 +4330,21 @@ export declare interface GraphqlAnalyticsOutboundPolicyOptions {
   maxScanBytes?: number;
 }
 
+/**
+ * GraphQL response-cache outcome, as decided by the Zuplo-provided GraphQL
+ * Cache policy (`graphql-cache-inbound`) and reported on its `x-cache`
+ * response header:
+ *  - `"hit"`  — the response was served from cache.
+ *  - `"miss"` — a cache-eligible query that was not in cache (forwarded to
+ *               the origin).
+ *
+ * Operations that are not cache-eligible (mutations, subscriptions,
+ * uncacheable/credentialed requests) — or that ran on a route without the
+ * GraphQL Cache policy — carry no cache state (`null`), and are excluded
+ * from the cache-hit-rate denominator.
+ */
+export declare type GraphqlCacheState = "hit" | "miss";
+
 /**
  * One GraphQL error extracted from a response body, reduced to the
  * fields the GraphQL Analytics outbound policy consumes for
@@ -6031,6 +6071,7 @@ declare interface ImageGenerationTool {
 export declare abstract class InboundPolicy<
   TOptions = any,
 > extends PolicyBase<TOptions> {
+  readonly direction: PolicyDirection;
   /**
    * The handler that is called each time this policy is invoked
    *
@@ -6789,6 +6830,7 @@ declare type LokiTransportVersion = 1 | 2;
  */
 export declare class McpAuth0OAuthInboundPolicy extends InboundPolicy<ValidatedAuth0OAuthOptions> {
   #private;
+  static readonly policyType = "mcp-auth0-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -6967,6 +7009,7 @@ declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
  */
 export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<McpClerkOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-clerk-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7037,6 +7080,7 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
  */
 export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<McpCognitoOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-cognito-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7118,6 +7162,7 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
  */
 export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<McpEntraOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-entra-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7194,6 +7239,7 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
  */
 export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<McpGoogleOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-google-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7264,6 +7310,7 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
  */
 export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<McpKeycloakOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-keycloak-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7341,6 +7388,7 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
  */
 export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<McpLogtoOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-logto-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7419,6 +7467,7 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
  * @product mcp-gateway
  */
 export declare class McpOAuthInboundPolicy extends InboundPolicy<McpOAuthRuntimeConfig> {
+  static readonly policyType = "mcp-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7695,6 +7744,7 @@ declare const mcpOAuthRuntimeConfigSchema: z.ZodObject<
  */
 export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<McpOktaOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-okta-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7772,6 +7822,7 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
  */
 export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<McpOneLoginOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-onelogin-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7842,6 +7893,7 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
  */
 export declare class McpPingOAuthInboundPolicy extends InboundPolicy<McpPingOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-ping-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7967,6 +8019,7 @@ declare interface McpTool {
  */
 export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<McpWorkosOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-workos-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -8310,6 +8363,7 @@ export declare interface MoesifInboundPolicyOptions {
  */
 export declare class MonetizationInboundPolicy extends InboundPolicy<MonetizationInboundPolicyOptions> {
   #private;
+  static readonly policyType = "monetization";
   /**
    * Set the monetization subscription data for the current request.
    *
@@ -8632,6 +8686,7 @@ export declare interface OAuthProtectedResourcePluginOptions {
  * @returns A Request or a Response
  */
 export declare class OktaFGAAuthZInboundPolicy extends BaseOpenFGAAuthZInboundPolicy {
+  static readonly policyType = "oktafga-authz";
   constructor(options: OktaFGAAuthZInboundPolicyOptions, policyName: string);
 }
 
@@ -9371,7 +9426,7 @@ declare namespace OpenAPIV3_1 {
  * @returns A Request or a Response
  */
 export declare class OpenFGAAuthZInboundPolicy extends BaseOpenFGAAuthZInboundPolicy {
-  constructor(options: OpenFGAAuthZInboundPolicyOptions, policyName: string);
+  static readonly policyType = "openfga-authz";
 }
 
 /**
@@ -9507,6 +9562,7 @@ export declare interface OpenIdJwtInboundPolicyOptions {
  */
 export declare class OpenMeterInboundPolicy extends InboundPolicy<OpenMeterInboundPolicyOptions> {
   #private;
+  static readonly policyType = "openmeter-metering";
   constructor(options: OpenMeterInboundPolicyOptions, policyName: string);
   handler(
     request: ZuploRequest<RequestGeneric>,
@@ -9692,6 +9748,7 @@ export declare class OTelMetricsPlugin extends MetricsPlugin {
 export declare abstract class OutboundPolicy<
   TOptions = any,
 > extends PolicyBase<TOptions> {
+  readonly direction: PolicyDirection;
   /**
    * The handler that is called each time this policy is invoked
    *
@@ -9818,16 +9875,11 @@ declare interface ParsedRouteData extends Omit<RouteData, "corsPolicies"> {
   /* Excluded from this release type: getInboundPolicyInstance */
 }
 
-/**
- * The base class for inbound and outbound policies.
- * Provides common functionality for all policy types.
- *
- * @public
- */
 declare abstract class PolicyBase<TOptions = any> {
   options: TOptions;
   policyName: string;
-  policyType: string;
+  /* Excluded from this release type: policyType */
+  /* Excluded from this release type: direction */
   /* Excluded from this release type: __constructor */
 }
 
@@ -9841,6 +9893,22 @@ export declare interface PolicyConfiguration {
   options?: unknown;
 }
 
+/**
+ * The base class for inbound and outbound policies.
+ * Provides common functionality for all policy types.
+ *
+ * @public
+ */
+/**
+ * The pipeline phase a policy runs in. Inbound policies run on the request
+ * before the handler; outbound policies run on the response after it. This is
+ * determined structurally by whether a policy extends {@link InboundPolicy} or
+ * {@link OutboundPolicy}, so it can never drift from the policy's real phase.
+ *
+ * @public
+ */
+declare type PolicyDirection = "inbound" | "outbound";
+
 /**
  * @public
  */
@@ -10118,7 +10186,7 @@ declare interface QuotaFallbackModels {
  */
 export declare class QuotaInboundPolicy extends InboundPolicy<QuotaInboundPolicyOptions> {
   #private;
-  constructor(options: QuotaInboundPolicyOptions, policyName: string);
+  static readonly policyType = "quota";
   handler(
     request: ZuploRequest<RequestGeneric>,
     context: ZuploContext
@@ -10416,6 +10484,28 @@ export declare function ReadmeMetricsInboundPolicy(
   policyName: string
 ): Promise<ZuploRequest<RequestGeneric_2>>;
 
+/**
+ * Record the GraphQL response-cache outcome for the in-flight operation so
+ * the analytics middleware can emit it as the `cacheState` dimension on the
+ * `graphql_operation` event.
+ *
+ * Called by the Zuplo-provided GraphQL Cache policy (`graphql-cache-inbound`,
+ * in the `@zuplo/graphql` package) the moment it resolves a cache hit or
+ * miss — synchronously during inbound processing, before the analytics
+ * middleware finalizes the event. Mirrors how the GraphQL Analytics outbound
+ * policy feeds errors through {@link getOperationContext}.
+ *
+ * No-op when the request isn't running the GraphQL analytics middleware (the
+ * route lacks the `x-graphql: true` marker, so there's no operation context to
+ * write to), so it's always safe to call.
+ *
+ * @public
+ */
+export declare function recordGraphqlCacheState(
+  context: ZuploContext,
+  cacheState: GraphqlCacheState
+): void;
+
 /**
  * Handler that returns HTTP redirects.
  * Useful for URL shortening, legacy URL handling, or routing to external services.
@@ -11367,7 +11457,7 @@ export declare type SemanticCacheInboundPolicyOptions = {
 };
 
 /**
- * Similarity threshold (0-1) for a cache hit. Higher values require closer semantic matches. Defaults to 0.8.
+ * The semantic similarity threshold for semantic cache matches. Values closer to 0 require closer similarity, while larger values allow more flexible matching. Default is 0.2.
  * @public
  */
 declare type SemanticTolerance = number;
@@ -11422,7 +11512,7 @@ export declare interface SetBodyInboundPolicyOptions {
  * @param policyName - The name of the policy as set in policies.json
  * @returns A Request or a Response
  */
-export declare const SetHeadersInboundPolicy: InboundPolicyHandler<SetHeadersInboundPolicyOptions>;
+export declare const SetHeadersInboundPolicy: InboundPolicyHandler_2<SetHeadersInboundPolicyOptions>;
 
 /**
  * The options for this policy.
@@ -11810,10 +11900,7 @@ export declare class StreamingZoneCache {
  * @returns A Request or a Response
  */
 export declare class StripeWebhookVerificationInboundPolicy extends InboundPolicy<StripeWebhookVerificationInboundPolicyOptions> {
-  constructor(
-    options: StripeWebhookVerificationInboundPolicyOptions,
-    policyName: string
-  );
+  static readonly policyType = "stripe-webhook-verification";
   handler(
     request: ZuploRequest,
     context: ZuploContext
@@ -12177,6 +12264,7 @@ export declare interface UpstreamFirebaseUserAuthInboundPolicyOptions {
  * @returns A Request or a Response
  */
 export declare class UpstreamGcpFederatedAuthInboundPolicy extends InboundPolicy<UpstreamGcpFederatedAuthInboundPolicyOptions> {
+  static readonly policyType = "upstream-gcp-federated-auth";
   private cacheName;
   private normalizedWorkloadIdentityProvider;
   constructor(
@@ -12332,6 +12420,7 @@ export declare interface UpstreamGcpServiceAuthInboundPolicyOptions {
  * @returns A ZuploRequest
  */
 export declare class UpstreamZuploJwtAuthInboundPolicy extends InboundPolicy<UpstreamZuploJwtAuthInboundPolicyOptions> {
+  static readonly policyType = "upstream-zuplo-jwt";
   constructor(
     options: UpstreamZuploJwtAuthInboundPolicyOptions,
     policyName: string
@@ -12833,6 +12922,7 @@ declare interface XacmlRequest {
  * @returns A Request or a Response
  */
 export declare class XmlToJsonOutboundPolicy extends OutboundPolicy<XmlToJsonPolicyOptions> {
+  static readonly policyType = "xml-to-json";
   private parser;
   private parseOnStatusCodes;
   constructor(options: XmlToJsonPolicyOptions, policyName: string);

package/node_modules/@zuplo/runtime/out/types/mcp-gateway/index.d.ts

@@ -546,6 +546,7 @@ declare type HttpStatusCodeRangeDefinition =
 declare abstract class InboundPolicy<
   TOptions = any,
 > extends PolicyBase<TOptions> {
+  readonly direction: PolicyDirection;
   /**
    * The handler that is called each time this policy is invoked
    *
@@ -964,6 +965,7 @@ declare interface Logger extends BaseLogger {
  */
 export declare class McpAuth0OAuthInboundPolicy extends InboundPolicy<ValidatedAuth0OAuthOptions> {
   #private;
+  static readonly policyType = "mcp-auth0-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -1142,6 +1144,7 @@ declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
  */
 export declare class McpCapabilityFilterInboundPolicy extends InboundPolicy<ValidatedOptions> {
   #private;
+  static readonly policyType = "mcp-capability-filter";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -1267,6 +1270,7 @@ declare const mcpCapabilityFilterOptionsSchema: z.ZodObject<
  */
 export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<McpClerkOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-clerk-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -1337,6 +1341,7 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
  */
 export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<McpCognitoOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-cognito-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -1418,6 +1423,7 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
  */
 export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<McpEntraOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-entra-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -1549,6 +1555,7 @@ export declare interface McpGatewayPluginOptions {
  */
 export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<McpGoogleOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-google-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -1619,6 +1626,7 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
  */
 export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<McpKeycloakOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-keycloak-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -1696,6 +1704,7 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
  */
 export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<McpLogtoOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-logto-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -1774,6 +1783,7 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
  * @product mcp-gateway
  */
 export declare class McpOAuthInboundPolicy extends InboundPolicy<McpOAuthRuntimeConfig> {
+  static readonly policyType = "mcp-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -2050,6 +2060,7 @@ declare const mcpOAuthRuntimeConfigSchema: z.ZodObject<
  */
 export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<McpOktaOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-okta-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -2127,6 +2138,7 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
  */
 export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<McpOneLoginOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-onelogin-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -2197,6 +2209,7 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
  */
 export declare class McpPingOAuthInboundPolicy extends InboundPolicy<McpPingOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-ping-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -2289,6 +2302,7 @@ export declare function McpProxyHandler(
  * @product mcp-gateway
  */
 export declare class McpTokenExchangeInboundPolicy extends InboundPolicy<UpstreamTokenExchangePolicyOptions> {
+  static readonly policyType = "mcp-token-exchange";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -2365,6 +2379,7 @@ export declare interface McpTokenExchangeInboundPolicyOptions {
  */
 export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<McpWorkosOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-workos-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -3048,16 +3063,11 @@ declare interface ParsedRouteData extends Omit<RouteData, "corsPolicies"> {
   /* Excluded from this release type: getInboundPolicyInstance */
 }
 
-/**
- * The base class for inbound and outbound policies.
- * Provides common functionality for all policy types.
- *
- * @public
- */
 declare abstract class PolicyBase<TOptions = any> {
   options: TOptions;
   policyName: string;
-  policyType: string;
+  /* Excluded from this release type: policyType */
+  /* Excluded from this release type: direction */
   /* Excluded from this release type: __constructor */
 }
 
@@ -3071,6 +3081,22 @@ declare interface PolicyConfiguration {
   options?: unknown;
 }
 
+/**
+ * The base class for inbound and outbound policies.
+ * Provides common functionality for all policy types.
+ *
+ * @public
+ */
+/**
+ * The pipeline phase a policy runs in. Inbound policies run on the request
+ * before the handler; outbound policies run on the response after it. This is
+ * determined structurally by whether a policy extends {@link InboundPolicy} or
+ * {@link OutboundPolicy}, so it can never drift from the policy's real phase.
+ *
+ * @public
+ */
+declare type PolicyDirection = "inbound" | "outbound";
+
 /**
  * @public
  */

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.71.22",
+  "version": "6.71.23",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/iconv-lite/encodings/sbcs-data.js

@@ -109,6 +109,8 @@ module.exports = {
 
   hebrew: "iso88598",
   hebrew8: "iso88598",
+  iso88598i: "iso88598",
+  iso88598e: "iso88598",
 
   turkish: "iso88599",
   turkish8: "iso88599",

package/node_modules/iconv-lite/encodings/utf32.js

@@ -31,7 +31,9 @@ function Utf32Encoder (options, codec) {
 
 Utf32Encoder.prototype.write = function (str) {
   var src = Buffer.from(str, "ucs2")
-  var dst = Buffer.alloc(src.length * 2)
+  // src.length * 2 covers this chunk's code units (4 bytes each); the extra 4 bytes leave room for a
+  // high surrogate held over from a previous chunk, which is flushed ahead of this chunk's units.
+  var dst = Buffer.alloc(src.length * 2 + 4)
   var write32 = this.isLE ? dst.writeUInt32LE : dst.writeUInt32BE
   var offset = 0
 
@@ -113,9 +115,9 @@ Utf32Decoder.prototype.write = function (src) {
       // NOTE: codepoint is a signed int32 and can be negative.
       // NOTE: We copied this block from below to help V8 optimize it (it works with array, not buffer).
       if (isLE) {
-        codepoint = overflow[i] | (overflow[i + 1] << 8) | (overflow[i + 2] << 16) | (overflow[i + 3] << 24)
+        codepoint = overflow[0] | (overflow[1] << 8) | (overflow[2] << 16) | (overflow[3] << 24)
       } else {
-        codepoint = overflow[i + 3] | (overflow[i + 2] << 8) | (overflow[i + 1] << 16) | (overflow[i] << 24)
+        codepoint = overflow[3] | (overflow[2] << 8) | (overflow[1] << 16) | (overflow[0] << 24)
       }
       overflow.length = 0
 
@@ -169,7 +171,12 @@ function _writeCodepoint (dst, offset, codepoint, badChar) {
 };
 
 Utf32Decoder.prototype.end = function () {
+  if (this.overflow.length === 0) { return }
+
+  // A leftover, incomplete 4-byte code unit at the end of the input is ill-formed. Substitute a
+  // single U+FFFD (Unicode Standard conformance clause C10) instead of silently dropping the bytes.
   this.overflow.length = 0
+  return String.fromCharCode(this.badChar)
 }
 
 // == UTF-32 Auto codec =============================================================

package/node_modules/iconv-lite/package.json

@@ -1,7 +1,7 @@
 {
     "name": "iconv-lite",
     "description": "Convert character encodings in pure javascript.",
-    "version": "0.7.2",
+    "version": "0.7.3",
     "license": "MIT",
     "keywords": [
         "iconv",
@@ -46,7 +46,7 @@
         "stream": false
     },
     "devDependencies": {
-        "@arethetypeswrong/cli": "^0.17.4",
+        "@arethetypeswrong/cli": "^0.18.4",
         "@stylistic/eslint-plugin": "^5.1.0",
         "@stylistic/eslint-plugin-js": "^4.1.0",
         "@types/node": "^24.0.12",

package/node_modules/iconv-lite/types/encodings.d.ts

@@ -276,6 +276,8 @@ export type Encoding =
   | "iso88596"
   | "iso88597"
   | "iso88598"
+  | "iso88598e"
+  | "iso88598i"
   | "iso88599"
   | "isoceltic"
   | "isoir100"

package/node_modules/protobufjs/dist/light/protobuf.js

@@ -1,6 +1,6 @@
 /*!
- * protobuf.js v7.6.4 (c) 2016, daniel wirtz
- * compiled fri, 12 jun 2026 12:10:46 utc
+ * protobuf.js v7.6.5 (c) 2016, daniel wirtz
+ * compiled sat, 04 jul 2026 01:13:07 utc
  * licensed under the bsd-3-clause license
  * see: https://github.com/dcodeio/protobuf.js for details
  */

package/node_modules/protobufjs/dist/light/protobuf.min.js

@@ -1,6 +1,6 @@
 /*!
- * protobuf.js v7.6.4 (c) 2016, daniel wirtz
- * compiled fri, 12 jun 2026 12:10:47 utc
+ * protobuf.js v7.6.5 (c) 2016, daniel wirtz
+ * compiled sat, 04 jul 2026 01:13:07 utc
  * licensed under the bsd-3-clause license
  * see: https://github.com/dcodeio/protobuf.js for details
  */

package/node_modules/protobufjs/dist/minimal/protobuf.js

@@ -1,6 +1,6 @@
 /*!
- * protobuf.js v7.6.4 (c) 2016, daniel wirtz
- * compiled fri, 12 jun 2026 12:10:46 utc
+ * protobuf.js v7.6.5 (c) 2016, daniel wirtz
+ * compiled sat, 04 jul 2026 01:13:07 utc
  * licensed under the bsd-3-clause license
  * see: https://github.com/dcodeio/protobuf.js for details
  */