@zuplo/cli 7.4.1 → 7.4.4

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -15661,12 +15661,69 @@ export declare class ZuploMcpSdk {
    */
   getRawCallToolRequest(): CallToolRequest | null;
   /**
-   * Sets the MCP request/response context object.
-   * Use this to set `_meta` that should be included in the tool result.
+   * Overrides fields of the MCP tool result the gateway is about to send.
    *
-   * @param req - The object containing metadata (e.g. `{ _meta: { ... } }`)
+   * Every field is independently optional; an absent field keeps the value
+   * the gateway derives from the downstream response. The most useful
+   * combination is `content` alone: the human-readable summary replaces the
+   * raw serialized body while `structuredContent` is still auto-derived from
+   * it — one call, compact model context, full data preserved.
+   *
+   * @example A compact summary for the model, full JSON in structuredContent
+   * ```ts
+   * const response = await context.invokeRoute("/todos");
+   * new ZuploMcpSdk(context).setRawCallToolResult({
+   *   content: [{ type: "text", text: "Fetched the todo list" }],
+   * });
+   * return response;
+   * ```
+   *
+   * Notes:
+   *
+   * - The stored value is *consumed* when the gateway builds the tool result
+   *   (asymmetric with {@link getRawCallToolRequest}, which can be read any
+   *   number of times).
+   * - The value is written to the context that carried the matching
+   *   `tools/call` request, which is looked up exactly one `invokeRoute`
+   *   generation up. Calling this from a grandchild invocation (a route that
+   *   itself invokes another route) silently stores the override where the
+   *   gateway never reads it.
+   * - `isError` is deliberately not overridable: it follows the status of the
+   *   response your handler returns, so upstream failures cannot be masked.
+   * - `structuredContent` must be a JSON object. The MCP 2025-11-25 wire
+   *   format rejects arrays and scalars here.
+   * - Declining the spec's backwards-compatibility SHOULD (mirroring
+   *   serialized JSON into a text block) has a concrete cost: clients that
+   *   predate `structuredContent` see only your summary in `content`.
+   * - MCP reserves `_meta` keys with the `modelcontextprotocol.io/` prefix
+   *   for the protocol itself; use your own prefix for application metadata.
+   *
+   * @param result - The fields to override on the tool result
+   */
+  setRawCallToolResult(result: ZuploMcpToolResultOverride): void;
+}
+
+/**
+ * The subset of a `tools/call` result a module author may override via
+ * {@link ZuploMcpSdk.setRawCallToolResult}. Every field is independently
+ * optional; an absent field keeps the value the gateway derives from the
+ * downstream response.
+ */
+export declare interface ZuploMcpToolResultOverride {
+  /**
+   * Content blocks for the model to read. Replaces the gateway's default
+   * (the serialized downstream body in a single text block).
+   */
+  content?: CallToolResult["content"];
+  /**
+   * The structured form of the tool's output. MUST be a JSON object — the
+   * MCP 2025-11-25 wire format rejects arrays/strings/numbers here.
+   */
+  structuredContent?: Record<string, unknown>;
+  /**
+   * Per-call metadata. Replaces the gateway's default of `{}`.
    */
-  setRawCallToolResult(req: CallToolResult): void;
+  _meta?: Record<string, unknown>;
 }
 
 /**

package/node_modules/@zuplo/runtime/out/types/mcp-gateway/index.d.ts

@@ -1759,8 +1759,11 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
 /**
  * Activates the MCP Gateway internal routes (OAuth authorization server,
  * upstream connection management, well-known metadata) on the runtime router.
- * When no MCP-related policy is present the plugin registers no routes; it
- * still records `plugin.mcp-gateway` feature usage on construction so gateway
+ * It also serves a read-only MCP Server Registry API (v0.1) advertising the
+ * gateway's MCP routes — mounted at `/__zuplo/mcp-registry` by default and
+ * configurable or disableable via the `registry` option. When no MCP-related
+ * policy is present the plugin registers no OAuth routes; it still records
+ * `plugin.mcp-gateway` feature usage on construction so gateway
  * adoption is visible in telemetry regardless of route configuration.
  *
  * Importing from `@zuplo/runtime/mcp-gateway` is the opt-in: the runtime core
@@ -1811,6 +1814,40 @@ export declare interface McpGatewayPluginOptions {
    * @default "/__zuplo"
    */
   basePath?: string;
+  /**
+   * Configures the read-only MCP Server Registry API. Enabled by default;
+   * pass `{ enabled: false }` to turn it off.
+   */
+  registry?: McpGatewayRegistryOptions;
+}
+
+/**
+ * Options for the MCP Server Registry API served by the gateway.
+ *
+ * The registry is a read-only MCP Server Registry (v0.1) that advertises the
+ * gateway's own MCP routes, so MCP clients and subregistries can discover
+ * them. Discovery endpoints are unauthenticated per the registry
+ * specification; publishing endpoints respond `501`.
+ *
+ * @beta
+ */
+export declare interface McpGatewayRegistryOptions {
+  /**
+   * Set to `false` to disable the registry entirely. No registry routes are
+   * registered when disabled.
+   *
+   * @default true
+   */
+  enabled?: boolean;
+  /**
+   * Absolute URL path where the registry API mounts. The registry endpoints
+   * live below this path (e.g. `{path}/v0.1/servers`). Defaults to
+   * `/mcp-registry` under the configured `basePath`, so with the default
+   * `basePath` the registry is served at `/__zuplo/mcp-registry`.
+   *
+   * @default "{basePath}/mcp-registry"
+   */
+  path?: string;
 }
 
 /**

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.4.1",
+  "version": "7.4.4",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/negotiator/lib/accept.js

@@ -0,0 +1,54 @@
+/*!
+ * negotiator
+ * Copyright(c) 2026 Blake Embrey
+ * MIT Licensed
+ */
+
+'use strict';
+
+var contentType = require('content-type');
+
+/**
+ * Module exports.
+ * @private
+ */
+
+module.exports = parseAccept;
+
+/**
+ * Parse an Accept-style header.
+ * @private
+ */
+
+function parseAccept(header) {
+  var values = [];
+  var index = 0;
+
+  while (index < header.length) {
+    var start = skipOptionalWhitespace(header, index);
+    var parsed = contentType.parse(header, { comma: true, start: start });
+
+    // `content-type` normalizes the type, but accept methods return original casing.
+    parsed.type = header.slice(start, start + parsed.type.length);
+    values.push(parsed);
+
+    index = parsed.index + 1;
+  }
+
+  return values;
+}
+
+/**
+ * Skip optional whitespace.
+ * @private
+ */
+
+function skipOptionalWhitespace(header, index) {
+  var cursor = index;
+
+  while (header.charCodeAt(cursor) === 0x20 || header.charCodeAt(cursor) === 0x09) {
+    cursor++;
+  }
+
+  return cursor;
+}

package/node_modules/negotiator/lib/charset.js

@@ -8,6 +8,8 @@
 
 'use strict';
 
+var parseAccept = require('./accept');
+
 /**
  * Module exports.
  * @public
@@ -21,55 +23,29 @@ module.exports.preferredCharsets = preferredCharsets;
  * @private
  */
 
-var simpleCharsetRegExp = /^\s*([^\s;]+)\s*(?:;(.*))?$/;
-
-/**
- * Parse the Accept-Charset header.
- * @private
- */
-
 function parseAcceptCharset(accept) {
-  var accepts = accept.split(',');
+  var accepts = parseAccept(accept);
 
   for (var i = 0, j = 0; i < accepts.length; i++) {
-    var charset = parseCharset(accepts[i].trim(), i);
-
-    if (charset) {
-      accepts[j++] = charset;
-    }
+    var charset = formatCharset(accepts[i], i);
+    if (charset) accepts[j++] = charset;
   }
 
-  // trim accepts
   accepts.length = j;
-
   return accepts;
 }
 
 /**
- * Parse a charset from the Accept-Charset header.
+ * Format a parsed charset for negotiation.
  * @private
  */
 
-function parseCharset(str, i) {
-  var match = simpleCharsetRegExp.exec(str);
-  if (!match) return null;
-
-  var charset = match[1];
-  var q = 1;
-  if (match[2]) {
-    var params = match[2].split(';')
-    for (var j = 0; j < params.length; j++) {
-      var p = params[j].trim().split('=');
-      if (p[0] === 'q') {
-        q = parseFloat(p[1]);
-        break;
-      }
-    }
-  }
+function formatCharset(parsed, i) {
+  if (!parsed.type) return null;
 
   return {
-    charset: charset,
-    q: q,
+    charset: parsed.type,
+    q: parsed.parameters.q ? parseFloat(parsed.parameters.q) : 1,
     i: i
   };
 }

package/node_modules/negotiator/lib/encoding.js

@@ -8,6 +8,8 @@
 
 'use strict';
 
+var parseAccept = require('./accept');
+
 /**
  * Module exports.
  * @public
@@ -21,20 +23,13 @@ module.exports.preferredEncodings = preferredEncodings;
  * @private
  */
 
-var simpleEncodingRegExp = /^\s*([^\s;]+)\s*(?:;(.*))?$/;
-
-/**
- * Parse the Accept-Encoding header.
- * @private
- */
-
 function parseAcceptEncoding(accept) {
-  var accepts = accept.split(',');
+  var accepts = parseAccept(accept);
   var hasIdentity = false;
   var minQuality = 1;
 
   for (var i = 0, j = 0; i < accepts.length; i++) {
-    var encoding = parseEncoding(accepts[i].trim(), i);
+    var encoding = formatEncoding(accepts[i], i);
 
     if (encoding) {
       accepts[j++] = encoding;
@@ -55,37 +50,21 @@ function parseAcceptEncoding(accept) {
     };
   }
 
-  // trim accepts
   accepts.length = j;
-
   return accepts;
 }
 
 /**
- * Parse an encoding from the Accept-Encoding header.
+ * Format a parsed encoding for negotiation.
  * @private
  */
 
-function parseEncoding(str, i) {
-  var match = simpleEncodingRegExp.exec(str);
-  if (!match) return null;
-
-  var encoding = match[1];
-  var q = 1;
-  if (match[2]) {
-    var params = match[2].split(';');
-    for (var j = 0; j < params.length; j++) {
-      var p = params[j].trim().split('=');
-      if (p[0] === 'q') {
-        q = parseFloat(p[1]);
-        break;
-      }
-    }
-  }
+function formatEncoding(parsed, i) {
+  if (!parsed.type) return null;
 
   return {
-    encoding: encoding,
-    q: q,
+    encoding: parsed.type,
+    q: parsed.parameters.q ? parseFloat(parsed.parameters.q) : 1,
     i: i
   };
 }

package/node_modules/negotiator/lib/language.js

@@ -8,6 +8,9 @@
 
 'use strict';
 
+var contentType = require('content-type');
+var parseAccept = require('./accept');
+
 /**
  * Module exports.
  * @public
@@ -21,60 +24,36 @@ module.exports.preferredLanguages = preferredLanguages;
  * @private
  */
 
-var simpleLanguageRegExp = /^\s*([^\s\-;]+)(?:-([^\s;]+))?\s*(?:;(.*))?$/;
-
-/**
- * Parse the Accept-Language header.
- * @private
- */
-
 function parseAcceptLanguage(accept) {
-  var accepts = accept.split(',');
+  var accepts = parseAccept(accept);
 
   for (var i = 0, j = 0; i < accepts.length; i++) {
-    var language = parseLanguage(accepts[i].trim(), i);
-
-    if (language) {
-      accepts[j++] = language;
-    }
+    var language = formatLanguage(accepts[i], i);
+    if (language) accepts[j++] = language;
   }
 
-  // trim accepts
   accepts.length = j;
-
   return accepts;
 }
 
 /**
- * Parse a language from the Accept-Language header.
+ * Format a parsed language for negotiation.
  * @private
  */
 
-function parseLanguage(str, i) {
-  var match = simpleLanguageRegExp.exec(str);
-  if (!match) return null;
-
-  var prefix = match[1]
-  var suffix = match[2]
-  var full = prefix
+function formatLanguage(parsed, i) {
+  if (!parsed.type) return null;
 
-  if (suffix) full += "-" + suffix;
-
-  var q = 1;
-  if (match[3]) {
-    var params = match[3].split(';')
-    for (var j = 0; j < params.length; j++) {
-      var p = params[j].split('=');
-      if (p[0] === 'q') q = parseFloat(p[1]);
-    }
-  }
+  var hyphen = parsed.type.indexOf('-');
+  var prefix = hyphen === -1 ? parsed.type : parsed.type.slice(0, hyphen);
+  var suffix = hyphen === -1 ? undefined : parsed.type.slice(hyphen + 1);
 
   return {
     prefix: prefix,
     suffix: suffix,
-    q: q,
+    q: parsed.parameters.q ? parseFloat(parsed.parameters.q) : 1,
     i: i,
-    full: full
+    full: parsed.type
   };
 }
 
@@ -103,7 +82,7 @@ function getLanguagePriority(language, accepted, index) {
  */
 
 function specify(language, spec, index) {
-  var p = parseLanguage(language)
+  var p = formatLanguage(contentType.parse(language), 0)
   if (!p) return null;
   var s = 0;
   if(spec.full.toLowerCase() === p.full.toLowerCase()){

package/node_modules/negotiator/lib/mediaType.js

@@ -8,6 +8,9 @@
 
 'use strict';
 
+var contentType = require('content-type');
+var parseAcceptHeader = require('./accept');
+
 /**
  * Module exports.
  * @public
@@ -21,71 +24,35 @@ module.exports.preferredMediaTypes = preferredMediaTypes;
  * @private
  */
 
-var simpleMediaTypeRegExp = /^\s*([^\s\/;]+)\/([^;\s]+)\s*(?:;(.*))?$/;
-
-/**
- * Parse the Accept header.
- * @private
- */
-
 function parseAccept(accept) {
-  var accepts = splitMediaTypes(accept);
+  var accepts = parseAcceptHeader(accept);
 
   for (var i = 0, j = 0; i < accepts.length; i++) {
-    var mediaType = parseMediaType(accepts[i].trim(), i);
-
-    if (mediaType) {
-      accepts[j++] = mediaType;
-    }
+    var mediaType = formatMediaType(accepts[i], i);
+    if (mediaType) accepts[j++] = mediaType;
   }
 
-  // trim accepts
   accepts.length = j;
-
   return accepts;
 }
 
 /**
- * Parse a media type from the Accept header.
+ * Format a parsed content type for negotiation.
  * @private
  */
 
-function parseMediaType(str, i) {
-  var match = simpleMediaTypeRegExp.exec(str);
-  if (!match) return null;
-
-  var params = Object.create(null);
-  var q = 1;
-  var subtype = match[2];
-  var type = match[1];
-
-  if (match[3]) {
-    var kvps = splitParameters(match[3]).map(splitKeyValuePair);
-
-    for (var j = 0; j < kvps.length; j++) {
-      var pair = kvps[j];
-      var key = pair[0].toLowerCase();
-      var val = pair[1];
+function formatMediaType(parsed, i) {
+  var slash = parsed.type.indexOf('/');
+  if (slash === -1) return null;
 
-      // get the value, unwrapping quotes
-      var value = val && val[0] === '"' && val[val.length - 1] === '"'
-        ? val.slice(1, -1)
-        : val;
+  var q = parsed.parameters.q ? parseFloat(parsed.parameters.q) : 1;
 
-      if (key === 'q') {
-        q = parseFloat(value);
-        break;
-      }
-
-      // store parameter
-      params[key] = value;
-    }
-  }
+  delete parsed.parameters.q;
 
   return {
-    type: type,
-    subtype: subtype,
-    params: params,
+    type: parsed.type.slice(0, slash),
+    subtype: parsed.type.slice(slash + 1),
+    params: parsed.parameters,
     q: q,
     i: i
   };
@@ -116,7 +83,7 @@ function getMediaTypePriority(type, accepted, index) {
  */
 
 function specify(type, spec, index) {
-  var p = parseMediaType(type);
+  var p = formatMediaType(contentType.parse(type), 0);
   var s = 0;
 
   if (!p) {
@@ -207,88 +174,3 @@ function getFullType(spec) {
 function isQuality(spec) {
   return spec.q > 0;
 }
-
-/**
- * Count the number of quotes in a string.
- * @private
- */
-
-function quoteCount(string) {
-  var count = 0;
-  var index = 0;
-
-  while ((index = string.indexOf('"', index)) !== -1) {
-    count++;
-    index++;
-  }
-
-  return count;
-}
-
-/**
- * Split a key value pair.
- * @private
- */
-
-function splitKeyValuePair(str) {
-  var index = str.indexOf('=');
-  var key;
-  var val;
-
-  if (index === -1) {
-    key = str;
-  } else {
-    key = str.slice(0, index);
-    val = str.slice(index + 1);
-  }
-
-  return [key, val];
-}
-
-/**
- * Split an Accept header into media types.
- * @private
- */
-
-function splitMediaTypes(accept) {
-  var accepts = accept.split(',');
-
-  for (var i = 1, j = 0; i < accepts.length; i++) {
-    if (quoteCount(accepts[j]) % 2 == 0) {
-      accepts[++j] = accepts[i];
-    } else {
-      accepts[j] += ',' + accepts[i];
-    }
-  }
-
-  // trim accepts
-  accepts.length = j + 1;
-
-  return accepts;
-}
-
-/**
- * Split a string of parameters.
- * @private
- */
-
-function splitParameters(str) {
-  var parameters = str.split(';');
-
-  for (var i = 1, j = 0; i < parameters.length; i++) {
-    if (quoteCount(parameters[j]) % 2 == 0) {
-      parameters[++j] = parameters[i];
-    } else {
-      parameters[j] += ';' + parameters[i];
-    }
-  }
-
-  // trim parameters
-  parameters.length = j + 1;
-
-  for (var i = 0; i < parameters.length; i++) {
-    parameters[i] = parameters[i].trim();
-  }
-
-  return parameters;
-}

package/node_modules/negotiator/node_modules/content-type/LICENSE

@@ -0,0 +1,22 @@
+(The MIT License)
+
+Copyright (c) 2015 Douglas Christopher Wilson
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.