@zuplo/cli 7.7.0 → 7.7.2

package/node_modules/@zuplo/runtime/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{b as l}from"../chunk-S4EBLGSU.js";import{_ as n}from"../chunk-XF3IIUDX.js";import{a as o}from"../chunk-TYV53J3B.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function t(r){e.push(Promise.resolve(r))}return o(t,"waitUntil"),{context:new s({event:{waitUntil:t},route:u.route}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(g,"createMockContext");var a={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},s=class extends EventTarget{static{o(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=a,parentContext:i}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=i,this.#e=e,this.analyticsContext=new l(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,i){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,t,i){let d=o(r=>{try{typeof t=="function"?t(r):t.handleEvent(r)}catch(p){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),p}},"wrapped");super.addEventListener(e,d,i)}};export{s as MockZuploContext,g as createMockContext};
+import{E as p,J as c,M as u}from"../chunk-BXPXENPX.js";import"../chunk-2DGFONEJ.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import"../chunk-WSCWEMBW.js";import{_ as i}from"../chunk-Z352SHBA.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
 //# sourceMappingURL=index.js.map

package/node_modules/@zuplo/runtime/out/esm/mocks/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["@zuplo/runtime/mocks/context.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;2HA4BO,SAASA,EACdC,EAA6D,CAC3D,QAAS,IAAI,QAAQ,yBAAyB,CAChD,EACA,CACA,IAAMC,EAAwC,CAAC,EAG/C,SAASC,EAAUC,EAA6B,CAC9CF,EAAkB,KAAK,QAAQ,QAAQE,CAAO,CAAC,CACjD,CAFS,OAAAC,EAAAF,EAAA,aAaF,CAAE,QATO,IAAIG,EAAiB,CACnC,MAAO,CAAE,UAAAH,CAAU,EACnB,MAAOF,EAAQ,KACjB,CAAC,EAMiB,eAJKI,EAAA,SAAY,CACjC,MAAM,QAAQ,IAAIH,CAAiB,CACrC,EAFuB,iBAIU,CACnC,CAtBgBG,EAAAL,EAAA,qBAwBhB,IAAMO,EAA2C,CAC/C,KAAM,IACN,QAAS,CAAC,KAAK,EACf,QAAS,CACP,OAAQ,CAAC,EACT,OAAQ,SACV,EACA,IAAKF,EAAA,KAAU,CAAC,GAAX,MACP,EAMaC,EAAN,cAA+B,WAAoC,CAlE1E,MAkE0E,CAAAD,EAAA,yBAC/DG,GACA,UACA,UACA,IACA,MAEA,OACA,0BACA,cACA,iBAET,YAAY,CACV,MAAAC,EACA,MAAAC,EAAQH,EACR,cAAAI,CACF,EAIG,CACD,MAAM,EACN,KAAK,UAAY,OAAO,WAAW,EACnC,KAAK,UAAY,OAAO,WAAW,EAEnC,KAAK,IAAM,CACT,KAAMC,EAAU,QAAQ,KACxB,IAAKA,EAAU,QAAQ,IACvB,MAAOA,EAAU,QAAQ,MACzB,KAAMA,EAAU,QAAQ,KACxB,MAAOA,EAAU,QAAQ,MACzB,iBAAkBP,EAAA,IAAM,CAAC,EAAP,mBACpB,EACA,KAAK,OAAS,CAAC,EACf,KAAK,MAAQK,EACb,KAAK,0BAA4B,CAC/B,GAAI,cACJ,IAAK,KACL,eAAgB,eAChB,KAAM,UACN,OAAQ,aACR,WAAY,KACZ,KAAM,MACN,UAAW,KACX,QAAS,KACT,WAAY,QACZ,UAAW,MACX,SAAU,OACV,UAAW,OACX,SAAU,OACV,aAAc,OACd,WAAY,OACZ,6BAA8B,OAC9B,6BAA8B,OAC9B,4BAA6B,OAC7B,oBAAqB,OACrB,mBAAoB,OACpB,mBAAoB,OACpB,oBAAqB,MACvB,EACA,KAAK,cAAgBC,EACrB,KAAKH,GAASC,EACd,KAAK,iBAAmB,IAAII,EAA6B,KAAK,SAAS,CACzE,CAGA,UAAUT,EAAuB,CAC/B,KAAKI,GAAO,UAAUJ,CAAO,CAC/B,CAEA,oBACEU,EACAC,EACkC,CAClC,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,qBACED,EACAE,EACAD,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,YACEE,EACAC,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,uBAAuBC,EAAmC,CACxD,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,4BAA4BA,EAAwC,CAClE,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAES,iBACPC,EACAC,EACApB,EACM,CACN,IAAMqB,EAA8CjB,EAACkB,GAAM,CACzD,GAAI,CACF,OAAOF,GAAY,WAAaA,EAAQE,CAAC,EAAIF,EAAQ,YAAYE,CAAC,CACpE,OAASC,EAAK,CACZ,WAAK,IAAI,MACP,wBAAwBJ,CAAI,mCAC9B,EACMI,CACR,CACF,EAToD,WAUpD,MAAM,iBAAiBJ,EAAME,EAASrB,CAAO,CAC/C,CACF","names":["createMockContext","options","waitUntilPromises","waitUntil","promise","__name","MockZuploContext","DEFAULT_ROUTE_CONFIG","#event","event","route","parentContext","internals_default","ZuploGatewayAnalyticsContext","policyName","request","response","input","init","hook","type","handler","wrapped","e","err"]}
+{"version":3,"sources":["@zuplo/runtime/mocks/context.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;yQAkCO,SAASA,EACdC,EAA6D,CAC3D,QAAS,IAAI,QAAQ,yBAAyB,CAChD,EACA,CACA,IAAMC,EAAwC,CAAC,EAG/C,SAASC,EAAUC,EAA6B,CAC9CF,EAAkB,KAAK,QAAQ,QAAQE,CAAO,CAAC,CACjD,CAFS,OAAAC,EAAAF,EAAA,aAcF,CAAE,QAVO,IAAIG,EAAiB,CACnC,MAAO,CAAE,UAAAH,CAAU,EACnB,MAAOF,EAAQ,MACf,gBAAiBA,EAAQ,OAC3B,CAAC,EAMiB,eAJKI,EAAA,SAAY,CACjC,MAAM,QAAQ,IAAIH,CAAiB,CACrC,EAFuB,iBAIU,CACnC,CAvBgBG,EAAAL,EAAA,qBAyBhB,IAAMO,EAA2C,CAC/C,KAAM,IACN,QAAS,CAAC,KAAK,EACf,QAAS,CACP,OAAQ,CAAC,EACT,OAAQ,SACV,EACA,IAAKF,EAAA,KAAU,CAAC,GAAX,MACP,EAMaC,EAAN,cAA+B,WAAoC,CAzE1E,MAyE0E,CAAAD,EAAA,yBAC/DG,GACAC,GACA,UACA,UACA,IACA,MAEA,OACA,0BACA,cACA,iBAET,YAAY,CACV,MAAAC,EACA,MAAAC,EAAQJ,EACR,cAAAK,EACA,gBAAAC,CACF,EAUG,CACD,MAAM,EACN,KAAK,UAAY,OAAO,WAAW,EACnC,KAAK,UAAY,OAAO,WAAW,EAEnC,KAAK,IAAM,CACT,KAAMC,EAAU,QAAQ,KACxB,IAAKA,EAAU,QAAQ,IACvB,MAAOA,EAAU,QAAQ,MACzB,KAAMA,EAAU,QAAQ,KACxB,MAAOA,EAAU,QAAQ,MACzB,iBAAkBT,EAAA,IAAM,CAAC,EAAP,mBACpB,EACA,KAAK,OAAS,CAAC,EACf,KAAK,MAAQM,EACb,KAAK,0BAA4B,CAC/B,GAAI,cACJ,IAAK,KACL,eAAgB,eAChB,KAAM,UACN,OAAQ,aACR,WAAY,KACZ,KAAM,MACN,UAAW,KACX,QAAS,KACT,WAAY,QACZ,UAAW,MACX,SAAU,OACV,UAAW,OACX,SAAU,OACV,aAAc,OACd,WAAY,OACZ,6BAA8B,OAC9B,6BAA8B,OAC9B,4BAA6B,OAC7B,oBAAqB,OACrB,mBAAoB,OACpB,mBAAoB,OACpB,oBAAqB,MACvB,EACA,KAAK,cAAgBC,EACrB,KAAKJ,GAASE,EACd,KAAKD,GAAmBI,EACxB,KAAK,iBAAmB,IAAIE,EAA6B,KAAK,SAAS,CACzE,CAGA,UAAUX,EAAuB,CAC/B,KAAKI,GAAO,UAAUJ,CAAO,CAC/B,CAEA,oBACEY,EACAC,EACkC,CAClC,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,qBACED,EACAE,EACAD,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,YACEE,EACAC,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,uBAAuBC,EAAmC,CACxD,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,4BAA4BA,EAAwC,CAClE,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAQA,qBACEC,EACArB,EACM,CAIN,IAAIsB,EACJ,GAAI,CACFA,EAAMC,EAAuB,qBAAqB,IAAI,CACxD,MAAQ,CACND,EAAMC,EAAuB,WAC3B,KACA,IAAIC,EACF,KAAKhB,IAAoB,IAAI,QAAQ,yBAAyB,CAChE,CACF,CACF,CAKAc,EAAI,kBAAoB,SACxBG,EAA0B,KAAMH,EAAKD,EAASrB,CAAO,CACvD,CAgBA,IAAI,oBAAyE,CAC3E,IAAIsB,EACJ,GAAI,CACFA,EAAMC,EAAuB,qBAAqB,IAAI,CACxD,MAAQ,CACN,MAAO,CAAC,CACV,CACA,OAAQD,EAAI,iBAAiB,SAAW,CAAC,GAAG,IAAKI,IAAW,CAC1D,WAAYA,EAAM,WAClB,KAAMA,EAAM,IACd,EAAE,CACJ,CAES,iBACPC,EACAN,EACArB,EACM,CACN,IAAM4B,EAA8CxB,EAACyB,GAAM,CACzD,GAAI,CACF,OAAOR,GAAY,WAAaA,EAAQQ,CAAC,EAAIR,EAAQ,YAAYQ,CAAC,CACpE,OAASC,EAAK,CACZ,WAAK,IAAI,MACP,wBAAwBH,CAAI,mCAC9B,EACMG,CACR,CACF,EAToD,WAUpD,MAAM,iBAAiBH,EAAMC,EAAS5B,CAAO,CAC/C,CACF","names":["createMockContext","options","waitUntilPromises","waitUntil","promise","__name","MockZuploContext","DEFAULT_ROUTE_CONFIG","#event","#originalRequest","event","route","parentContext","originalRequest","internals_default","ZuploGatewayAnalyticsContext","policyName","request","response","input","init","hook","handler","ext","ZuploContextExtensions","ZuploRequest","registerPreRequestHandler","entry","type","wrapped","e","err"]}

package/node_modules/@zuplo/runtime/out/esm/sdks/aws/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{H as a,I as l,J as c,K as o,N as p,O as y,P as m}from"../../chunk-K4TBJG47.js";import"../../chunk-UKQQD2JN.js";import"../../chunk-XF3IIUDX.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
+import{H as a,I as l,J as c,K as o,N as p,O as y,P as m}from"../../chunk-WSCWEMBW.js";import"../../chunk-Z352SHBA.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
 //# sourceMappingURL=index.js.map

package/node_modules/@zuplo/runtime/out/esm/sdks/aws/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["@zuplo/runtime/sdks/aws/sign.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;kMAiDA,eAAsBA,EACpBC,EACAC,EACkB,CAClB,IAAMC,EACJ,OAAOD,EAAQ,aAAgB,WAC3B,MAAMA,EAAQ,YAAY,EAC1BA,EAAQ,YAERE,EAASH,EAAQ,OAEjBI,EADUD,IAAW,OAASA,IAAW,QAAUH,EAAQ,MAAQ,KAClD,MAAMA,EAAQ,YAAY,EAAI,KAe/CK,EAAS,MAbA,IAAIC,EAAY,CAC7B,OAAAH,EACA,IAAKH,EAAQ,IACb,QAASA,EAAQ,QACjB,KAAAI,EACA,YAAaF,EAAY,YACzB,gBAAiBA,EAAY,gBAC7B,aAAcA,EAAY,aAC1B,QAASD,EAAQ,QACjB,OAAQA,EAAQ,OAChB,UAAWA,EAAQ,SACrB,CAAC,EAE2B,KAAK,EAEjC,OAAO,IAAI,QAAQI,EAAO,IAAI,SAAS,EAAG,CACxC,OAAQA,EAAO,OACf,QAASA,EAAO,QAChB,KAAMA,EAAO,IACf,CAAC,CACH,CAjCsBE,EAAAR,EAAA","names":["signRequest","request","options","credentials","method","body","signed","AwsV4Signer","__name"]}
+{"version":3,"sources":["@zuplo/runtime/sdks/aws/sign.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;kKAiDA,eAAsBA,EACpBC,EACAC,EACkB,CAClB,IAAMC,EACJ,OAAOD,EAAQ,aAAgB,WAC3B,MAAMA,EAAQ,YAAY,EAC1BA,EAAQ,YAERE,EAASH,EAAQ,OAEjBI,EADUD,IAAW,OAASA,IAAW,QAAUH,EAAQ,MAAQ,KAClD,MAAMA,EAAQ,YAAY,EAAI,KAe/CK,EAAS,MAbA,IAAIC,EAAY,CAC7B,OAAAH,EACA,IAAKH,EAAQ,IACb,QAASA,EAAQ,QACjB,KAAAI,EACA,YAAaF,EAAY,YACzB,gBAAiBA,EAAY,gBAC7B,aAAcA,EAAY,aAC1B,QAASD,EAAQ,QACjB,OAAQA,EAAQ,OAChB,UAAWA,EAAQ,SACrB,CAAC,EAE2B,KAAK,EAEjC,OAAO,IAAI,QAAQI,EAAO,IAAI,SAAS,EAAG,CACxC,OAAQA,EAAO,OACf,QAASA,EAAO,QAChB,KAAMA,EAAO,IACf,CAAC,CACH,CAjCsBE,EAAAR,EAAA","names":["signRequest","request","options","credentials","method","body","signed","AwsV4Signer","__name"]}

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -275,7 +275,9 @@ export declare class AIGatewayConfigurationExecutorV2InboundPolicy extends Inbou
     request: ZuploRequest,
     context: ZuploContext
   ): Promise<ZuploRequest | Response>;
+  private checkHierarchyLimits;
   private enforceHierarchyLimits;
+  private blockOnViolation;
   private emitHierarchyWarning;
   private getConsumerSub;
   private requestCapability;
@@ -12327,6 +12329,48 @@ export declare interface PolicyConfiguration {
  */
 declare type PolicyDirection = "inbound" | "outbound";
 
+/**
+ * Runs only if its handler's verdict wins, after the inbound chain has
+ * stopped — the one place a pre-request handler may touch shared context
+ * state. Resolve a `Response` to serve it, or `undefined` to withdraw the
+ * verdict and let the pipeline proceed.
+ * @beta
+ */
+export declare interface PreRequestCommit {
+  (): Promise<Response | undefined>;
+}
+
+/**
+ * Work started by an inbound policy that runs concurrently with the rest of
+ * the inbound policy chain. Registered with
+ * {@link ZuploContext.addPreRequestHandler}, started immediately.
+ *
+ * Resolve `undefined` to let the request proceed, a `Response` to
+ * short-circuit the pipeline with it, or a {@link PreRequestCommit} for a
+ * verdict that needs exclusive serve-time work.
+ *
+ * Handlers run out of order relative to the policies they overlap, so they
+ * must never mutate or consume the live request — capture what they need
+ * (for example via `request.clone()`) before registering.
+ * @beta
+ */
+export declare interface PreRequestHandler {
+  (api: PreRequestHandlerApi): Promise<Response | PreRequestCommit | undefined>;
+}
+
+/**
+ * The API handed to a {@link PreRequestHandler} when it starts.
+ * @beta
+ */
+export declare interface PreRequestHandlerApi {
+  /**
+   * Aborted when this handler's verdict can no longer win — another verdict
+   * was served, or the pipeline resolved with the chain's own response or an
+   * error. Pass it to `fetch()` so the external call is actually cancelled.
+   */
+  readonly signal: AbortSignal;
+}
+
 /**
  * @public
  */
@@ -15939,6 +15983,34 @@ export declare interface ZuploContext extends EventTarget {
   readonly addResponseSendingFinalHook: (
     hook: OnResponseSendingFinalHook
   ) => void;
+  /**
+   * Registers a pre-request handler: work started immediately that runs
+   * concurrently with the remaining inbound policy chain.
+   *
+   * The runtime checks the handler after each subsequent policy completes and
+   * serves its `Response` verdict if one has resolved (skipping the remaining
+   * policies, the route handler, and outbound policies). All outstanding
+   * handlers are awaited at a barrier just before the route handler dispatches
+   * upstream — the only point in the pipeline that blocks on a handler. A
+   * response produced by the policy chain itself (for example an
+   * authentication policy's 401) is served immediately: already-resolved
+   * verdicts from earlier-registered handlers still win, but a pending
+   * handler never delays it and is aborted instead.
+   *
+   * Handlers run out of order relative to the policies they overlap, so they
+   * must observe and veto, never transform: do not mutate or consume the live
+   * request from a handler. A handler that rejects fails the request closed
+   * (500); catch inside the handler and resolve `undefined` to fail open.
+   *
+   * May only be called during the inbound policy phase.
+   * @beta
+   */
+  readonly addPreRequestHandler: (
+    handler: PreRequestHandler,
+    options?: {
+      name?: string;
+    }
+  ) => void;
   /**
    * Appends an event listener for events whose type attribute value is type. The callback argument sets the callback that will be invoked when the event is dispatched.
    *

package/node_modules/@zuplo/runtime/out/types/internal/index.d.ts

@@ -1594,6 +1594,48 @@ declare interface PolicyConfiguration {
   options?: unknown;
 }
 
+/**
+ * Runs only if its handler's verdict wins, after the inbound chain has
+ * stopped — the one place a pre-request handler may touch shared context
+ * state. Resolve a `Response` to serve it, or `undefined` to withdraw the
+ * verdict and let the pipeline proceed.
+ * @beta
+ */
+declare interface PreRequestCommit {
+  (): Promise<Response | undefined>;
+}
+
+/**
+ * Work started by an inbound policy that runs concurrently with the rest of
+ * the inbound policy chain. Registered with
+ * {@link ZuploContext.addPreRequestHandler}, started immediately.
+ *
+ * Resolve `undefined` to let the request proceed, a `Response` to
+ * short-circuit the pipeline with it, or a {@link PreRequestCommit} for a
+ * verdict that needs exclusive serve-time work.
+ *
+ * Handlers run out of order relative to the policies they overlap, so they
+ * must never mutate or consume the live request — capture what they need
+ * (for example via `request.clone()`) before registering.
+ * @beta
+ */
+declare interface PreRequestHandler {
+  (api: PreRequestHandlerApi): Promise<Response | PreRequestCommit | undefined>;
+}
+
+/**
+ * The API handed to a {@link PreRequestHandler} when it starts.
+ * @beta
+ */
+declare interface PreRequestHandlerApi {
+  /**
+   * Aborted when this handler's verdict can no longer win — another verdict
+   * was served, or the pipeline resolved with the chain's own response or an
+   * error. Pass it to `fetch()` so the external call is actually cancelled.
+   */
+  readonly signal: AbortSignal;
+}
+
 /**
  * Generic type parameters for a request.
  * Extends RequestInitGeneric and adds query parameter typing.
@@ -1827,6 +1869,34 @@ declare interface ZuploContext extends EventTarget {
   readonly addResponseSendingFinalHook: (
     hook: OnResponseSendingFinalHook
   ) => void;
+  /**
+   * Registers a pre-request handler: work started immediately that runs
+   * concurrently with the remaining inbound policy chain.
+   *
+   * The runtime checks the handler after each subsequent policy completes and
+   * serves its `Response` verdict if one has resolved (skipping the remaining
+   * policies, the route handler, and outbound policies). All outstanding
+   * handlers are awaited at a barrier just before the route handler dispatches
+   * upstream — the only point in the pipeline that blocks on a handler. A
+   * response produced by the policy chain itself (for example an
+   * authentication policy's 401) is served immediately: already-resolved
+   * verdicts from earlier-registered handlers still win, but a pending
+   * handler never delays it and is aborted instead.
+   *
+   * Handlers run out of order relative to the policies they overlap, so they
+   * must observe and veto, never transform: do not mutate or consume the live
+   * request from a handler. A handler that rejects fails the request closed
+   * (500); catch inside the handler and resolve `undefined` to fail open.
+   *
+   * May only be called during the inbound policy phase.
+   * @beta
+   */
+  readonly addPreRequestHandler: (
+    handler: PreRequestHandler,
+    options?: {
+      name?: string;
+    }
+  ) => void;
   /**
    * Appends an event listener for events whose type attribute value is type. The callback argument sets the callback that will be invoked when the event is dispatched.
    *

package/node_modules/@zuplo/runtime/out/types/mcp/messages/index.d.ts

@@ -2064,6 +2064,48 @@ declare interface ParameterDefinition extends ParameterBaseObject {
   in: string;
 }
 
+/**
+ * Runs only if its handler's verdict wins, after the inbound chain has
+ * stopped — the one place a pre-request handler may touch shared context
+ * state. Resolve a `Response` to serve it, or `undefined` to withdraw the
+ * verdict and let the pipeline proceed.
+ * @beta
+ */
+declare interface PreRequestCommit {
+  (): Promise<Response | undefined>;
+}
+
+/**
+ * Work started by an inbound policy that runs concurrently with the rest of
+ * the inbound policy chain. Registered with
+ * {@link ZuploContext.addPreRequestHandler}, started immediately.
+ *
+ * Resolve `undefined` to let the request proceed, a `Response` to
+ * short-circuit the pipeline with it, or a {@link PreRequestCommit} for a
+ * verdict that needs exclusive serve-time work.
+ *
+ * Handlers run out of order relative to the policies they overlap, so they
+ * must never mutate or consume the live request — capture what they need
+ * (for example via `request.clone()`) before registering.
+ * @beta
+ */
+declare interface PreRequestHandler {
+  (api: PreRequestHandlerApi): Promise<Response | PreRequestCommit | undefined>;
+}
+
+/**
+ * The API handed to a {@link PreRequestHandler} when it starts.
+ * @beta
+ */
+declare interface PreRequestHandlerApi {
+  /**
+   * Aborted when this handler's verdict can no longer win — another verdict
+   * was served, or the pipeline resolved with the chain's own response or an
+   * error. Pass it to `fetch()` so the external call is actually cancelled.
+   */
+  readonly signal: AbortSignal;
+}
+
 /**
  * Build an inbound policy handler that runs per-message MCP logic while the
  * runtime owns the batch mechanics.
@@ -2300,6 +2342,34 @@ declare interface ZuploContext extends EventTarget {
   readonly addResponseSendingFinalHook: (
     hook: OnResponseSendingFinalHook
   ) => void;
+  /**
+   * Registers a pre-request handler: work started immediately that runs
+   * concurrently with the remaining inbound policy chain.
+   *
+   * The runtime checks the handler after each subsequent policy completes and
+   * serves its `Response` verdict if one has resolved (skipping the remaining
+   * policies, the route handler, and outbound policies). All outstanding
+   * handlers are awaited at a barrier just before the route handler dispatches
+   * upstream — the only point in the pipeline that blocks on a handler. A
+   * response produced by the policy chain itself (for example an
+   * authentication policy's 401) is served immediately: already-resolved
+   * verdicts from earlier-registered handlers still win, but a pending
+   * handler never delays it and is aborted instead.
+   *
+   * Handlers run out of order relative to the policies they overlap, so they
+   * must observe and veto, never transform: do not mutate or consume the live
+   * request from a handler. A handler that rejects fails the request closed
+   * (500); catch inside the handler and resolve `undefined` to fail open.
+   *
+   * May only be called during the inbound policy phase.
+   * @beta
+   */
+  readonly addPreRequestHandler: (
+    handler: PreRequestHandler,
+    options?: {
+      name?: string;
+    }
+  ) => void;
   /**
    * Appends an event listener for events whose type attribute value is type. The callback argument sets the callback that will be invoked when the event is dispatched.
    *

package/node_modules/@zuplo/runtime/out/types/mcp-gateway/index.d.ts

@@ -3819,6 +3819,48 @@ declare interface PolicyConfiguration {
  */
 declare type PolicyDirection = "inbound" | "outbound";
 
+/**
+ * Runs only if its handler's verdict wins, after the inbound chain has
+ * stopped — the one place a pre-request handler may touch shared context
+ * state. Resolve a `Response` to serve it, or `undefined` to withdraw the
+ * verdict and let the pipeline proceed.
+ * @beta
+ */
+declare interface PreRequestCommit {
+  (): Promise<Response | undefined>;
+}
+
+/**
+ * Work started by an inbound policy that runs concurrently with the rest of
+ * the inbound policy chain. Registered with
+ * {@link ZuploContext.addPreRequestHandler}, started immediately.
+ *
+ * Resolve `undefined` to let the request proceed, a `Response` to
+ * short-circuit the pipeline with it, or a {@link PreRequestCommit} for a
+ * verdict that needs exclusive serve-time work.
+ *
+ * Handlers run out of order relative to the policies they overlap, so they
+ * must never mutate or consume the live request — capture what they need
+ * (for example via `request.clone()`) before registering.
+ * @beta
+ */
+declare interface PreRequestHandler {
+  (api: PreRequestHandlerApi): Promise<Response | PreRequestCommit | undefined>;
+}
+
+/**
+ * The API handed to a {@link PreRequestHandler} when it starts.
+ * @beta
+ */
+declare interface PreRequestHandlerApi {
+  /**
+   * Aborted when this handler's verdict can no longer win — another verdict
+   * was served, or the pipeline resolved with the chain's own response or an
+   * error. Pass it to `fetch()` so the external call is actually cancelled.
+   */
+  readonly signal: AbortSignal;
+}
+
 /**
  * @public
  */
@@ -4437,6 +4479,34 @@ declare interface ZuploContext extends EventTarget {
   readonly addResponseSendingFinalHook: (
     hook: OnResponseSendingFinalHook
   ) => void;
+  /**
+   * Registers a pre-request handler: work started immediately that runs
+   * concurrently with the remaining inbound policy chain.
+   *
+   * The runtime checks the handler after each subsequent policy completes and
+   * serves its `Response` verdict if one has resolved (skipping the remaining
+   * policies, the route handler, and outbound policies). All outstanding
+   * handlers are awaited at a barrier just before the route handler dispatches
+   * upstream — the only point in the pipeline that blocks on a handler. A
+   * response produced by the policy chain itself (for example an
+   * authentication policy's 401) is served immediately: already-resolved
+   * verdicts from earlier-registered handlers still win, but a pending
+   * handler never delays it and is aborted instead.
+   *
+   * Handlers run out of order relative to the policies they overlap, so they
+   * must observe and veto, never transform: do not mutate or consume the live
+   * request from a handler. A handler that rejects fails the request closed
+   * (500); catch inside the handler and resolve `undefined` to fail open.
+   *
+   * May only be called during the inbound policy phase.
+   * @beta
+   */
+  readonly addPreRequestHandler: (
+    handler: PreRequestHandler,
+    options?: {
+      name?: string;
+    }
+  ) => void;
   /**
    * Appends an event listener for events whose type attribute value is type. The callback argument sets the callback that will be invoked when the event is dispatched.
    *

package/node_modules/@zuplo/runtime/out/types/mocks/index.d.ts

@@ -916,10 +916,17 @@ export declare class MockZuploContext
     event,
     route,
     parentContext,
+    originalRequest,
   }: {
     event: ZuploEventContext;
     route?: RouteConfiguration;
     parentContext?: ZuploContext | undefined;
+    /**
+     * The request this context belongs to. Used to initialize the per-request
+     * state that hooks such as `addPreRequestHandler` write to, so a policy
+     * under test can register one without any additional setup.
+     */
+    originalRequest?: Request;
   });
   waitUntil(promise: Promise<any>): void;
   invokeInboundPolicy(
@@ -943,6 +950,36 @@ export declare class MockZuploContext
    * Fires immediately after the response is sent. Response cannot be modified.
    */
   addResponseSendingFinalHook(hook: OnResponseSendingFinalHook): void;
+  /**
+   * Registers a pre-request handler on the real per-context extensions so
+   * tests exercise the same registration, checkpoint, and barrier machinery
+   * as the runtime. Requires `ZuploContextExtensions.initialize(context,
+   * request)` to have been called first.
+   */
+  addPreRequestHandler(
+    handler: PreRequestHandler,
+    options?: {
+      name?: string;
+    }
+  ): void;
+  /**
+   * The pre-request handlers registered on this context, oldest first, for
+   * asserting what a policy under test registered. Reading this does not run,
+   * await, or cancel anything.
+   *
+   * @example
+   * ```typescript
+   * const { context } = createMockContext();
+   * await myPolicy(request, context, options, "my-policy");
+   * assert.deepEqual(context.preRequestHandlers, [
+   *   { policyName: "my-policy", name: "detect-input" },
+   * ]);
+   * ```
+   */
+  get preRequestHandlers(): {
+    policyName: string;
+    name: string | undefined;
+  }[];
   addEventListener<Type extends keyof Record<string, Event>>(
     type: Type,
     handler: EventListenerOrEventListenerObject,
@@ -1532,6 +1569,48 @@ declare interface ParameterDefinition extends ParameterBaseObject {
   in: string;
 }
 
+/**
+ * Runs only if its handler's verdict wins, after the inbound chain has
+ * stopped — the one place a pre-request handler may touch shared context
+ * state. Resolve a `Response` to serve it, or `undefined` to withdraw the
+ * verdict and let the pipeline proceed.
+ * @beta
+ */
+declare interface PreRequestCommit {
+  (): Promise<Response | undefined>;
+}
+
+/**
+ * Work started by an inbound policy that runs concurrently with the rest of
+ * the inbound policy chain. Registered with
+ * {@link ZuploContext.addPreRequestHandler}, started immediately.
+ *
+ * Resolve `undefined` to let the request proceed, a `Response` to
+ * short-circuit the pipeline with it, or a {@link PreRequestCommit} for a
+ * verdict that needs exclusive serve-time work.
+ *
+ * Handlers run out of order relative to the policies they overlap, so they
+ * must never mutate or consume the live request — capture what they need
+ * (for example via `request.clone()`) before registering.
+ * @beta
+ */
+declare interface PreRequestHandler {
+  (api: PreRequestHandlerApi): Promise<Response | PreRequestCommit | undefined>;
+}
+
+/**
+ * The API handed to a {@link PreRequestHandler} when it starts.
+ * @beta
+ */
+declare interface PreRequestHandlerApi {
+  /**
+   * Aborted when this handler's verdict can no longer win — another verdict
+   * was served, or the pipeline resolved with the chain's own response or an
+   * error. Pass it to `fetch()` so the external call is actually cancelled.
+   */
+  readonly signal: AbortSignal;
+}
+
 /**
  * Generic type parameters for a request.
  * Extends RequestInitGeneric and adds query parameter typing.
@@ -1737,6 +1816,34 @@ declare interface ZuploContext extends EventTarget {
   readonly addResponseSendingFinalHook: (
     hook: OnResponseSendingFinalHook
   ) => void;
+  /**
+   * Registers a pre-request handler: work started immediately that runs
+   * concurrently with the remaining inbound policy chain.
+   *
+   * The runtime checks the handler after each subsequent policy completes and
+   * serves its `Response` verdict if one has resolved (skipping the remaining
+   * policies, the route handler, and outbound policies). All outstanding
+   * handlers are awaited at a barrier just before the route handler dispatches
+   * upstream — the only point in the pipeline that blocks on a handler. A
+   * response produced by the policy chain itself (for example an
+   * authentication policy's 401) is served immediately: already-resolved
+   * verdicts from earlier-registered handlers still win, but a pending
+   * handler never delays it and is aborted instead.
+   *
+   * Handlers run out of order relative to the policies they overlap, so they
+   * must observe and veto, never transform: do not mutate or consume the live
+   * request from a handler. A handler that rejects fails the request closed
+   * (500); catch inside the handler and resolve `undefined` to fail open.
+   *
+   * May only be called during the inbound policy phase.
+   * @beta
+   */
+  readonly addPreRequestHandler: (
+    handler: PreRequestHandler,
+    options?: {
+      name?: string;
+    }
+  ) => void;
   /**
    * Appends an event listener for events whose type attribute value is type. The callback argument sets the callback that will be invoked when the event is dispatched.
    *

package/node_modules/@zuplo/runtime/out/types/sdks/aws/index.d.ts

@@ -1854,6 +1854,48 @@ declare interface ParameterDefinition extends ParameterBaseObject {
   in: string;
 }
 
+/**
+ * Runs only if its handler's verdict wins, after the inbound chain has
+ * stopped — the one place a pre-request handler may touch shared context
+ * state. Resolve a `Response` to serve it, or `undefined` to withdraw the
+ * verdict and let the pipeline proceed.
+ * @beta
+ */
+declare interface PreRequestCommit {
+  (): Promise<Response | undefined>;
+}
+
+/**
+ * Work started by an inbound policy that runs concurrently with the rest of
+ * the inbound policy chain. Registered with
+ * {@link ZuploContext.addPreRequestHandler}, started immediately.
+ *
+ * Resolve `undefined` to let the request proceed, a `Response` to
+ * short-circuit the pipeline with it, or a {@link PreRequestCommit} for a
+ * verdict that needs exclusive serve-time work.
+ *
+ * Handlers run out of order relative to the policies they overlap, so they
+ * must never mutate or consume the live request — capture what they need
+ * (for example via `request.clone()`) before registering.
+ * @beta
+ */
+declare interface PreRequestHandler {
+  (api: PreRequestHandlerApi): Promise<Response | PreRequestCommit | undefined>;
+}
+
+/**
+ * The API handed to a {@link PreRequestHandler} when it starts.
+ * @beta
+ */
+declare interface PreRequestHandlerApi {
+  /**
+   * Aborted when this handler's verdict can no longer win — another verdict
+   * was served, or the pipeline resolved with the chain's own response or an
+   * error. Pass it to `fetch()` so the external call is actually cancelled.
+   */
+  readonly signal: AbortSignal;
+}
+
 /**
  * Generic type parameters for a request.
  * Extends RequestInitGeneric and adds query parameter typing.
@@ -2143,6 +2185,34 @@ declare interface ZuploContext extends EventTarget {
   readonly addResponseSendingFinalHook: (
     hook: OnResponseSendingFinalHook
   ) => void;
+  /**
+   * Registers a pre-request handler: work started immediately that runs
+   * concurrently with the remaining inbound policy chain.
+   *
+   * The runtime checks the handler after each subsequent policy completes and
+   * serves its `Response` verdict if one has resolved (skipping the remaining
+   * policies, the route handler, and outbound policies). All outstanding
+   * handlers are awaited at a barrier just before the route handler dispatches
+   * upstream — the only point in the pipeline that blocks on a handler. A
+   * response produced by the policy chain itself (for example an
+   * authentication policy's 401) is served immediately: already-resolved
+   * verdicts from earlier-registered handlers still win, but a pending
+   * handler never delays it and is aborted instead.
+   *
+   * Handlers run out of order relative to the policies they overlap, so they
+   * must observe and veto, never transform: do not mutate or consume the live
+   * request from a handler. A handler that rejects fails the request closed
+   * (500); catch inside the handler and resolve `undefined` to fail open.
+   *
+   * May only be called during the inbound policy phase.
+   * @beta
+   */
+  readonly addPreRequestHandler: (
+    handler: PreRequestHandler,
+    options?: {
+      name?: string;
+    }
+  ) => void;
   /**
    * Appends an event listener for events whose type attribute value is type. The callback argument sets the callback that will be invoked when the event is dispatched.
    *

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.7.0",
+  "version": "7.7.2",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {