@zuplo/runtime 6.70.25 → 6.70.27

package/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{b as d}from"../chunk-NW4YQXGC.js";import{_ as n,a as t}from"../chunk-JAEQKE5H.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function o(i){e.push(Promise.resolve(i))}return t(o,"waitUntil"),{context:new s({event:{waitUntil:o},route:u.route}),invokeResponse:t(async()=>{await Promise.all(e)},"invokeResponse")}}t(g,"createMockContext");var p={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:t(()=>({}),"raw")},s=class extends EventTarget{static{t(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:o=p,parentContext:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:t(()=>{},"setLogProperties")},this.custom={},this.route=o,this.incomingRequestProperties={asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0},this.parentContext=r,this.#e=e,this.analyticsContext=new d(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,o){throw new Error("Not implemented")}invokeOutboundPolicy(e,o,r){throw new Error("Not implemented")}invokeRoute(e,o){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,o,r){let l=t(i=>{try{typeof o=="function"?o(i):o.handleEvent(i)}catch(a){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),a}},"wrapped");super.addEventListener(e,l,r)}};export{s as MockZuploContext,g as createMockContext};
+import{b as d}from"../chunk-H7UGARU6.js";import{_ as n,a as t}from"../chunk-JAEQKE5H.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function o(i){e.push(Promise.resolve(i))}return t(o,"waitUntil"),{context:new s({event:{waitUntil:o},route:u.route}),invokeResponse:t(async()=>{await Promise.all(e)},"invokeResponse")}}t(g,"createMockContext");var p={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:t(()=>({}),"raw")},s=class extends EventTarget{static{t(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:o=p,parentContext:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:t(()=>{},"setLogProperties")},this.custom={},this.route=o,this.incomingRequestProperties={asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0},this.parentContext=r,this.#e=e,this.analyticsContext=new d(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,o){throw new Error("Not implemented")}invokeOutboundPolicy(e,o,r){throw new Error("Not implemented")}invokeRoute(e,o){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,o,r){let l=t(i=>{try{typeof o=="function"?o(i):o.handleEvent(i)}catch(a){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),a}},"wrapped");super.addEventListener(e,l,r)}};export{s as MockZuploContext,g as createMockContext};
 //# sourceMappingURL=index.js.map

package/out/types/index.d.ts

@@ -2957,54 +2957,38 @@ export declare interface ErrorHandler {
 declare type EventsInterval = number;
 
 declare const EventType: {
-  readonly MCP_TOOL_USAGE: "mcp_tool_usage";
-  readonly MCP_RESOURCE_READ: "mcp_resource_read";
-  readonly MCP_PROMPT_GET: "mcp_prompt_get";
-  readonly MCP_SESSION_START: "mcp_session_start";
   readonly AI_GATEWAY_COST_SUM: "ai_gateway_cost_sum";
   readonly AI_GATEWAY_REQUEST_COUNT: "ai_gateway_request_count";
   readonly AI_GATEWAY_TOKEN_SUM: "ai_gateway_token_sum";
   readonly AI_GATEWAY_LATENCY_HISTOGRAM: "ai_gateway_latency_histogram";
   readonly AI_GATEWAY_WARNING_COUNT: "ai_gateway_warning_count";
   readonly AI_GATEWAY_BLOCKED_COUNT: "ai_gateway_blocked_count";
-  readonly MCP_GATEWAY_REQUEST_RECEIVED: "mcp_gateway_request_received";
-  readonly MCP_GATEWAY_REQUEST_COMPLETED: "mcp_gateway_request_completed";
-  readonly MCP_GATEWAY_REQUEST_REJECTED: "mcp_gateway_request_rejected";
-  readonly MCP_GATEWAY_INITIALIZE_NEGOTIATED: "mcp_gateway_initialize_negotiated";
-  readonly MCP_GATEWAY_CLIENT_UNSUPPORTED_BEHAVIOR: "mcp_gateway_client_unsupported_behavior";
-  readonly MCP_GATEWAY_CATALOG_LISTED: "mcp_gateway_catalog_listed";
-  readonly MCP_GATEWAY_CATALOG_IMPORTED: "mcp_gateway_catalog_imported";
-  readonly MCP_GATEWAY_CATALOG_DRIFT_DETECTED: "mcp_gateway_catalog_drift_detected";
-  readonly MCP_GATEWAY_CAPABILITY_LISTED: "mcp_gateway_capability_listed";
-  readonly MCP_GATEWAY_CAPABILITY_INVOKED: "mcp_gateway_capability_invoked";
-  readonly MCP_GATEWAY_CAPABILITY_COMPLETED: "mcp_gateway_capability_completed";
-  readonly MCP_GATEWAY_CAPABILITY_FAILED: "mcp_gateway_capability_failed";
-  readonly MCP_GATEWAY_CAPABILITY_CONNECT_REQUIRED: "mcp_gateway_capability_connect_required";
-  readonly MCP_GATEWAY_AUTH_DOWNSTREAM_TOKEN_VALIDATED: "mcp_gateway_auth_downstream_token_validated";
-  readonly MCP_GATEWAY_AUTH_DOWNSTREAM_TOKEN_REJECTED: "mcp_gateway_auth_downstream_token_rejected";
-  readonly MCP_GATEWAY_OAUTH_CLIENT_REGISTERED: "mcp_gateway_oauth_client_registered";
-  readonly MCP_GATEWAY_OAUTH_AUTHORIZE_STARTED: "mcp_gateway_oauth_authorize_started";
-  readonly MCP_GATEWAY_OAUTH_AUTHORIZE_AWAITING_SETUP: "mcp_gateway_oauth_authorize_awaiting_setup";
-  readonly MCP_GATEWAY_OAUTH_TOKEN_ISSUED: "mcp_gateway_oauth_token_issued";
-  readonly MCP_GATEWAY_OAUTH_TOKEN_REFRESH_ROTATED: "mcp_gateway_oauth_token_refresh_rotated";
-  readonly MCP_GATEWAY_OAUTH_TOKEN_REVOKED: "mcp_gateway_oauth_token_revoked";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CONNECT_REQUIRED: "mcp_gateway_auth_upstream_connect_required";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CONNECT_STARTED: "mcp_gateway_auth_upstream_connect_started";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CALLBACK_RECEIVED: "mcp_gateway_auth_upstream_callback_received";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_TOKEN_EXCHANGE_SUCCEEDED: "mcp_gateway_auth_upstream_token_exchange_succeeded";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_TOKEN_EXCHANGE_FAILED: "mcp_gateway_auth_upstream_token_exchange_failed";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CREDENTIAL_RESOLVED: "mcp_gateway_auth_upstream_credential_resolved";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CREDENTIAL_MISSING: "mcp_gateway_auth_upstream_credential_missing";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_gateway_auth_upstream_reconsent_required";
-  readonly MCP_GATEWAY_POLICY_DECISION: "mcp_gateway_policy_decision";
-  readonly MCP_GATEWAY_GUARDRAIL_DECISION: "mcp_gateway_guardrail_decision";
-  readonly MCP_GATEWAY_RATE_LIMIT_DECISION: "mcp_gateway_rate_limit_decision";
-  readonly MCP_GATEWAY_UPSTREAM_REQUEST_SENT: "mcp_gateway_upstream_request_sent";
-  readonly MCP_GATEWAY_UPSTREAM_REQUEST_COMPLETED: "mcp_gateway_upstream_request_completed";
-  readonly MCP_GATEWAY_UPSTREAM_REQUEST_FAILED: "mcp_gateway_upstream_request_failed";
-  readonly MCP_GATEWAY_AUDIT_VIRTUAL_SERVER_CREATED: "mcp_gateway_audit_virtual_server_created";
-  readonly MCP_GATEWAY_AUDIT_VIRTUAL_SERVER_UPDATED: "mcp_gateway_audit_virtual_server_updated";
-  readonly MCP_GATEWAY_AUDIT_VIRTUAL_SERVER_DELETED: "mcp_gateway_audit_virtual_server_deleted";
+  readonly MCP_REQUEST_RECEIVED: "mcp_request_received";
+  readonly MCP_REQUEST_COMPLETED: "mcp_request_completed";
+  readonly MCP_REQUEST_REJECTED: "mcp_request_rejected";
+  readonly MCP_INITIALIZE_NEGOTIATED: "mcp_initialize_negotiated";
+  readonly MCP_CLIENT_UNSUPPORTED_BEHAVIOR: "mcp_client_unsupported_behavior";
+  readonly MCP_CAPABILITY_LISTED: "mcp_capability_listed";
+  readonly MCP_CAPABILITY_INVOKED: "mcp_capability_invoked";
+  readonly MCP_CAPABILITY_COMPLETED: "mcp_capability_completed";
+  readonly MCP_CAPABILITY_FAILED: "mcp_capability_failed";
+  readonly MCP_CAPABILITY_CONNECT_REQUIRED: "mcp_capability_connect_required";
+  readonly MCP_AUTH_DOWNSTREAM_TOKEN_VALIDATED: "mcp_auth_downstream_token_validated";
+  readonly MCP_AUTH_DOWNSTREAM_TOKEN_REJECTED: "mcp_auth_downstream_token_rejected";
+  readonly MCP_OAUTH_CLIENT_REGISTERED: "mcp_oauth_client_registered";
+  readonly MCP_OAUTH_AUTHORIZE_STARTED: "mcp_oauth_authorize_started";
+  readonly MCP_OAUTH_AUTHORIZE_AWAITING_SETUP: "mcp_oauth_authorize_awaiting_setup";
+  readonly MCP_OAUTH_TOKEN_ISSUED: "mcp_oauth_token_issued";
+  readonly MCP_OAUTH_TOKEN_REFRESH_ROTATED: "mcp_oauth_token_refresh_rotated";
+  readonly MCP_OAUTH_TOKEN_REVOKED: "mcp_oauth_token_revoked";
+  readonly MCP_AUTH_UPSTREAM_CONNECT_REQUIRED: "mcp_auth_upstream_connect_required";
+  readonly MCP_AUTH_UPSTREAM_CONNECT_STARTED: "mcp_auth_upstream_connect_started";
+  readonly MCP_AUTH_UPSTREAM_CALLBACK_RECEIVED: "mcp_auth_upstream_callback_received";
+  readonly MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_SUCCEEDED: "mcp_auth_upstream_token_exchange_succeeded";
+  readonly MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_FAILED: "mcp_auth_upstream_token_exchange_failed";
+  readonly MCP_AUTH_UPSTREAM_CREDENTIAL_RESOLVED: "mcp_auth_upstream_credential_resolved";
+  readonly MCP_AUTH_UPSTREAM_CREDENTIAL_MISSING: "mcp_auth_upstream_credential_missing";
+  readonly MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_auth_upstream_reconsent_required";
 };
 
 declare type EventType = (typeof EventType)[keyof typeof EventType];
@@ -7418,6 +7402,7 @@ declare interface ParsedCorsPolicyConfiguration {
  */
 declare interface ParsedRouteData extends Omit<RouteData, "corsPolicies"> {
   corsPolicies: ParsedCorsPolicyConfiguration[];
+  /* Excluded from this release type: getInboundPolicyInstance */
 }
 
 /**

package/out/types/mcp-gateway/index.d.ts

@@ -87,54 +87,38 @@ declare interface CorsPolicyConfiguration {
 declare type DevPortalType = "legacy" | "zudoku";
 
 declare const EventType: {
-  readonly MCP_TOOL_USAGE: "mcp_tool_usage";
-  readonly MCP_RESOURCE_READ: "mcp_resource_read";
-  readonly MCP_PROMPT_GET: "mcp_prompt_get";
-  readonly MCP_SESSION_START: "mcp_session_start";
   readonly AI_GATEWAY_COST_SUM: "ai_gateway_cost_sum";
   readonly AI_GATEWAY_REQUEST_COUNT: "ai_gateway_request_count";
   readonly AI_GATEWAY_TOKEN_SUM: "ai_gateway_token_sum";
   readonly AI_GATEWAY_LATENCY_HISTOGRAM: "ai_gateway_latency_histogram";
   readonly AI_GATEWAY_WARNING_COUNT: "ai_gateway_warning_count";
   readonly AI_GATEWAY_BLOCKED_COUNT: "ai_gateway_blocked_count";
-  readonly MCP_GATEWAY_REQUEST_RECEIVED: "mcp_gateway_request_received";
-  readonly MCP_GATEWAY_REQUEST_COMPLETED: "mcp_gateway_request_completed";
-  readonly MCP_GATEWAY_REQUEST_REJECTED: "mcp_gateway_request_rejected";
-  readonly MCP_GATEWAY_INITIALIZE_NEGOTIATED: "mcp_gateway_initialize_negotiated";
-  readonly MCP_GATEWAY_CLIENT_UNSUPPORTED_BEHAVIOR: "mcp_gateway_client_unsupported_behavior";
-  readonly MCP_GATEWAY_CATALOG_LISTED: "mcp_gateway_catalog_listed";
-  readonly MCP_GATEWAY_CATALOG_IMPORTED: "mcp_gateway_catalog_imported";
-  readonly MCP_GATEWAY_CATALOG_DRIFT_DETECTED: "mcp_gateway_catalog_drift_detected";
-  readonly MCP_GATEWAY_CAPABILITY_LISTED: "mcp_gateway_capability_listed";
-  readonly MCP_GATEWAY_CAPABILITY_INVOKED: "mcp_gateway_capability_invoked";
-  readonly MCP_GATEWAY_CAPABILITY_COMPLETED: "mcp_gateway_capability_completed";
-  readonly MCP_GATEWAY_CAPABILITY_FAILED: "mcp_gateway_capability_failed";
-  readonly MCP_GATEWAY_CAPABILITY_CONNECT_REQUIRED: "mcp_gateway_capability_connect_required";
-  readonly MCP_GATEWAY_AUTH_DOWNSTREAM_TOKEN_VALIDATED: "mcp_gateway_auth_downstream_token_validated";
-  readonly MCP_GATEWAY_AUTH_DOWNSTREAM_TOKEN_REJECTED: "mcp_gateway_auth_downstream_token_rejected";
-  readonly MCP_GATEWAY_OAUTH_CLIENT_REGISTERED: "mcp_gateway_oauth_client_registered";
-  readonly MCP_GATEWAY_OAUTH_AUTHORIZE_STARTED: "mcp_gateway_oauth_authorize_started";
-  readonly MCP_GATEWAY_OAUTH_AUTHORIZE_AWAITING_SETUP: "mcp_gateway_oauth_authorize_awaiting_setup";
-  readonly MCP_GATEWAY_OAUTH_TOKEN_ISSUED: "mcp_gateway_oauth_token_issued";
-  readonly MCP_GATEWAY_OAUTH_TOKEN_REFRESH_ROTATED: "mcp_gateway_oauth_token_refresh_rotated";
-  readonly MCP_GATEWAY_OAUTH_TOKEN_REVOKED: "mcp_gateway_oauth_token_revoked";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CONNECT_REQUIRED: "mcp_gateway_auth_upstream_connect_required";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CONNECT_STARTED: "mcp_gateway_auth_upstream_connect_started";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CALLBACK_RECEIVED: "mcp_gateway_auth_upstream_callback_received";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_TOKEN_EXCHANGE_SUCCEEDED: "mcp_gateway_auth_upstream_token_exchange_succeeded";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_TOKEN_EXCHANGE_FAILED: "mcp_gateway_auth_upstream_token_exchange_failed";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CREDENTIAL_RESOLVED: "mcp_gateway_auth_upstream_credential_resolved";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CREDENTIAL_MISSING: "mcp_gateway_auth_upstream_credential_missing";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_gateway_auth_upstream_reconsent_required";
-  readonly MCP_GATEWAY_POLICY_DECISION: "mcp_gateway_policy_decision";
-  readonly MCP_GATEWAY_GUARDRAIL_DECISION: "mcp_gateway_guardrail_decision";
-  readonly MCP_GATEWAY_RATE_LIMIT_DECISION: "mcp_gateway_rate_limit_decision";
-  readonly MCP_GATEWAY_UPSTREAM_REQUEST_SENT: "mcp_gateway_upstream_request_sent";
-  readonly MCP_GATEWAY_UPSTREAM_REQUEST_COMPLETED: "mcp_gateway_upstream_request_completed";
-  readonly MCP_GATEWAY_UPSTREAM_REQUEST_FAILED: "mcp_gateway_upstream_request_failed";
-  readonly MCP_GATEWAY_AUDIT_VIRTUAL_SERVER_CREATED: "mcp_gateway_audit_virtual_server_created";
-  readonly MCP_GATEWAY_AUDIT_VIRTUAL_SERVER_UPDATED: "mcp_gateway_audit_virtual_server_updated";
-  readonly MCP_GATEWAY_AUDIT_VIRTUAL_SERVER_DELETED: "mcp_gateway_audit_virtual_server_deleted";
+  readonly MCP_REQUEST_RECEIVED: "mcp_request_received";
+  readonly MCP_REQUEST_COMPLETED: "mcp_request_completed";
+  readonly MCP_REQUEST_REJECTED: "mcp_request_rejected";
+  readonly MCP_INITIALIZE_NEGOTIATED: "mcp_initialize_negotiated";
+  readonly MCP_CLIENT_UNSUPPORTED_BEHAVIOR: "mcp_client_unsupported_behavior";
+  readonly MCP_CAPABILITY_LISTED: "mcp_capability_listed";
+  readonly MCP_CAPABILITY_INVOKED: "mcp_capability_invoked";
+  readonly MCP_CAPABILITY_COMPLETED: "mcp_capability_completed";
+  readonly MCP_CAPABILITY_FAILED: "mcp_capability_failed";
+  readonly MCP_CAPABILITY_CONNECT_REQUIRED: "mcp_capability_connect_required";
+  readonly MCP_AUTH_DOWNSTREAM_TOKEN_VALIDATED: "mcp_auth_downstream_token_validated";
+  readonly MCP_AUTH_DOWNSTREAM_TOKEN_REJECTED: "mcp_auth_downstream_token_rejected";
+  readonly MCP_OAUTH_CLIENT_REGISTERED: "mcp_oauth_client_registered";
+  readonly MCP_OAUTH_AUTHORIZE_STARTED: "mcp_oauth_authorize_started";
+  readonly MCP_OAUTH_AUTHORIZE_AWAITING_SETUP: "mcp_oauth_authorize_awaiting_setup";
+  readonly MCP_OAUTH_TOKEN_ISSUED: "mcp_oauth_token_issued";
+  readonly MCP_OAUTH_TOKEN_REFRESH_ROTATED: "mcp_oauth_token_refresh_rotated";
+  readonly MCP_OAUTH_TOKEN_REVOKED: "mcp_oauth_token_revoked";
+  readonly MCP_AUTH_UPSTREAM_CONNECT_REQUIRED: "mcp_auth_upstream_connect_required";
+  readonly MCP_AUTH_UPSTREAM_CONNECT_STARTED: "mcp_auth_upstream_connect_started";
+  readonly MCP_AUTH_UPSTREAM_CALLBACK_RECEIVED: "mcp_auth_upstream_callback_received";
+  readonly MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_SUCCEEDED: "mcp_auth_upstream_token_exchange_succeeded";
+  readonly MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_FAILED: "mcp_auth_upstream_token_exchange_failed";
+  readonly MCP_AUTH_UPSTREAM_CREDENTIAL_RESOLVED: "mcp_auth_upstream_credential_resolved";
+  readonly MCP_AUTH_UPSTREAM_CREDENTIAL_MISSING: "mcp_auth_upstream_credential_missing";
+  readonly MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_auth_upstream_reconsent_required";
 };
 
 declare type EventType = (typeof EventType)[keyof typeof EventType];
@@ -504,52 +488,62 @@ declare type HttpStatusCodeRangeDefinition =
   | "5XX";
 
 /**
- * A function-based inbound policy that can modify the incoming HTTP request.
- * This is the simplest way to create custom policies without extending a class.
- *
- * @param request - The incoming Request
- * @param context - The current context of the Request
- * @param options - The configuration options for the policy
- * @param policyName - The name set on the policy in the configuration
- * @returns A Response to short-circuit or a Request to continue
+ * A policy that can modify the incoming HTTP request before it is sent to
+ * the handler. If a response is returned, the request is short-circuited and
+ * the response is returned to the client. If a Request is returned, policies
+ * or a handler that follow are executed.
  *
  * @public
  * @example
  * ```typescript
- * import { InboundPolicyHandler } from "@zuplo/runtime";
+ * import { InboundPolicy, ZuploContext, ZuploRequest } from "@zuplo/runtime";
  *
- * interface RateLimitOptions {
- *   requests: number;
- *   windowMs: number;
+ * interface MyPolicyOptions {
+ *   headerName: string;
+ *   headerValue: string;
  * }
  *
- * export const rateLimitPolicy: InboundPolicyHandler<RateLimitOptions> = async (
- *   request,
- *   context,
- *   options,
- *   policyName
- * ) => {
- *   const key = request.headers.get("x-api-key") || "anonymous";
- *   const count = await incrementCounter(key, options.windowMs);
+ * export class AddHeaderPolicy extends InboundPolicy<MyPolicyOptions> {
+ *   async handler(request: ZuploRequest, context: ZuploContext) {
+ *     // Add a custom header
+ *     request.headers.set(this.options.headerName, this.options.headerValue);
  *
- *   if (count > options.requests) {
- *     return new Response("Too Many Requests", { status: 429 });
- *   }
+ *     // Log the action
+ *     context.log.info(`Added header ${this.options.headerName}`);
  *
- *   // Add rate limit headers
- *   request.headers.set("X-RateLimit-Limit", options.requests.toString());
- *   request.headers.set("X-RateLimit-Remaining", (options.requests - count).toString());
+ *     // Continue to next policy/handler
+ *     return request;
+ *   }
+ * }
  *
- *   return request;
- * };
+ * // Usage in policies.json:
+ * // {
+ * //   "name": "add-custom-header",
+ * //   "policyType": "custom-add-header-policy",
+ * //   "handler": {
+ * //     "export": "AddHeaderPolicy",
+ * //     "module": "$import(./policies/add-header)",
+ * //     "options": {
+ * //       "headerName": "X-Custom-Header",
+ * //       "headerValue": "My Value"
+ * //     }
+ * //   }
+ * // }
  * ```
  */
-declare interface InboundPolicyHandler<TOptions = any> {
-  (
+declare abstract class InboundPolicy<
+  TOptions = any,
+> extends PolicyBase<TOptions> {
+  /**
+   * The handler that is called each time this policy is invoked
+   *
+   * @param request - The incoming Request
+   * @param context - The current context of the Request
+   * @returns A Response or Request object
+   */
+  abstract handler(
     request: ZuploRequest,
-    context: ZuploContext,
-    options: TOptions,
-    policyName: string
+    context: ZuploContext
   ): Promise<ZuploRequest | Response>;
 }
 
@@ -937,22 +931,27 @@ declare interface Logger extends BaseLogger {
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Auth0.
  *
- * Auth0-friendly wrapper around `McpOAuthInboundPolicy`. Provide
- * `auth0Domain` and `clientId`; the wrapper derives the OIDC issuer, JWKS URL,
- * and Auth0 authorize/token endpoints automatically. The resolved options are
- * translated into the generic `McpOAuthRuntimeConfig` at gateway initialization
- * time (see `setupRoutes`); this request-time entry point delegates straight
- * to the underlying OAuth implementation.
+ * Auth0-friendly wrapper around `McpOAuthInboundPolicy`. Provide `auth0Domain`
+ * and `clientId`; the constructor derives the OIDC issuer, JWKS URL, and Auth0
+ * authorize/token endpoints automatically and runs the resulting shape through
+ * the same Zod schema as the generic policy.
+ *
+ * Validation runs lazily inside the policy constructor, which the runtime
+ * caches per policy name — so a misconfigured policy fails the first request
+ * with a `ConfigurationError` (surfaced in the 500 problem body) rather than
+ * crashing boot.
  *
  * @hidden
  * @title MCP Auth0 OAuth
- * @param request - The ZuploRequest
- * @param context - The ZuploContext
- * @param _options - The policy options set in policies.json
- * @param _policyName - The name of the policy as set in policies.json
- * @returns A Request or a Response
  */
-export declare const McpAuth0OAuthInboundPolicy: InboundPolicyHandler<McpAuth0OAuthInboundPolicyOptions>;
+export declare class McpAuth0OAuthInboundPolicy extends InboundPolicy<McpAuth0OAuthInboundPolicyOptions> {
+  #private;
+  constructor(rawOptions: unknown, policyName: string);
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
 
 /**
  * The options for this policy.
@@ -964,9 +963,9 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
    */
   auth0Domain: string;
   /**
-   * Expected audience claim on tokens issued for the gateway. Surfaces both as the OIDC token audience and as the Auth0 authorize?audience= parameter.
+   * Optional Auth0 API audience. When set, the gateway sends it as the Auth0 authorize?audience= parameter and validates returned provider access tokens against it. Leave unset when Auth0 is only used for browser identity.
    */
-  audience: string;
+  audience?: string;
   /**
    * The Auth0 client_id registered for the gateway's browser login flow.
    */
@@ -1042,21 +1041,22 @@ export declare class McpGatewayPlugin extends SystemRuntimePlugin {
  * to the OpenID Connect identity provider configured via the `oidc` and
  * `browserLogin` policy options.
  *
- * The runtime resolves the policy options into a `McpOAuthRuntimeConfig` at
- * gateway-initialization time and threads them into the underlying OAuth
- * implementation. This policy's request-time job is to validate the bearer
- * token presented by the MCP client and hydrate the principal onto the
- * request context.
+ * Validation runs lazily inside the policy constructor, which the runtime
+ * caches per policy name — so a misconfigured policy fails the first request
+ * with a `ConfigurationError` (surfaced in the 500 problem body) rather than
+ * crashing boot.
  *
  * @hidden
  * @title MCP OAuth
- * @param request - The ZuploRequest
- * @param context - The ZuploContext
- * @param _options - The policy options set in policies.json
- * @param _policyName - The name of the policy as set in policies.json
- * @returns A Request or a Response
  */
-export declare const McpOAuthInboundPolicy: InboundPolicyHandler<McpOAuthInboundPolicyOptions>;
+export declare class McpOAuthInboundPolicy extends InboundPolicy<McpOAuthInboundPolicyOptions> {
+  #private;
+  constructor(rawOptions: unknown, policyName: string);
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
 
 /**
  * The options for this policy.
@@ -1141,19 +1141,27 @@ export declare interface McpOAuthInboundPolicyOptions {
 }
 
 /**
- * Bind a route to an upstream MCP server. Stores the resolved upstream binding
- * on the request context for `McpVirtualServerHandler`, which resolves
- * credentials during capability dispatch.
+ * Bind a route to an upstream MCP server. Resolves the upstream connection
+ * config plus per-request credential and appends a
+ * `ResolvedUpstreamBindingContext` onto the request context for
+ * `McpVirtualServerHandler` to pick up during capability dispatch.
+ *
+ * Validation runs lazily inside the policy constructor, which the runtime
+ * caches per policy name — so a misconfigured policy fails the first request
+ * with a `ConfigurationError` (surfaced in the 500 problem body) rather than
+ * crashing boot.
  *
  * @hidden
  * @title MCP Upstream Connection
- * @param request - The ZuploRequest
- * @param context - The ZuploContext
- * @param options - The policy options set in policies.json
- * @param policyName - The name of the policy as set in policies.json
- * @returns A Request or a Response
  */
-export declare const McpUpstreamConnectionInboundPolicy: InboundPolicyHandler<McpUpstreamConnectionInboundPolicyOptions>;
+export declare class McpUpstreamConnectionInboundPolicy extends InboundPolicy<McpUpstreamConnectionInboundPolicyOptions> {
+  #private;
+  constructor(rawOptions: unknown, policyName: string);
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
 
 /**
  * The options for this policy.
@@ -1189,12 +1197,12 @@ export declare interface McpUpstreamConnectionInboundPolicyOptions {
     required?: boolean;
   }[];
   /**
-   * Authentication mode. `user_oauth` performs per-user OAuth federation; `shared-oauth` uses a gateway-wide OAuth grant; `static_secret` / `user-secret` / `shared-secret` use a configured secret instead of OAuth.
+   * Authentication mode. `user-oauth` performs per-user OAuth federation; `shared-oauth` uses a gateway-wide OAuth grant; `static-secret` / `user-secret` / `shared-secret` use a configured secret instead of OAuth.
    */
   authMode:
-    | "user_oauth"
+    | "user-oauth"
     | "shared-oauth"
-    | "static_secret"
+    | "static-secret"
     | "user-secret"
     | "shared-secret";
   /**
@@ -1240,13 +1248,65 @@ export declare interface McpUpstreamConnectionInboundPolicyOptions {
           | "none";
       };
   /**
-   * Static secret configuration (for `static_secret`, `user-secret`, and `shared-secret` auth modes).
+   * Static secret configuration (for `static-secret`, `user-secret`, and `shared-secret` auth modes).
    */
   secret?: {
     [k: string]: unknown;
   };
 }
 
+/**
+ * Thin MCP upstream proxy. Pair this with `McpOAuthInboundPolicy` (or
+ * `McpAuth0OAuthInboundPolicy`) plus `McpUpstreamConnectionInboundPolicy`:
+ * the OAuth policy authenticates the request, the upstream-connection
+ * policy resolves a single upstream binding onto the request context, and
+ * this handler:
+ *
+ * 1. Reads the resolved binding off the context.
+ * 2. Resolves the per-request upstream credential (handling user OAuth
+ *    via the connection's auth provider when configured).
+ * 3. Builds a new `Request` targeting the upstream's MCP HTTP endpoint
+ *    with the customer's body and headers, plus the resolved credential
+ *    translated to `Authorization` / custom request headers.
+ * 4. `fetch`-es the upstream and returns the response untouched.
+ *
+ * Use this for the common single-upstream pass-through case (the new
+ * recommended shape). For multi-upstream aggregation or curated catalogs,
+ * use `McpVirtualServerHandler` instead.
+ *
+ * Any customer-supplied policy attached between the upstream-connection
+ * policy and this handler can observe or transform the rewritten
+ * `Request` before it leaves the gateway.
+ *
+ * @beta
+ *
+ * @example
+ * ```json
+ * // routes.oas.json — single-upstream MCP proxy
+ * {
+ *   "paths": {
+ *     "/mcp/linear": {
+ *       "post": {
+ *         "x-zuplo-route": {
+ *           "handler": {
+ *             "module": "$import(@zuplo/runtime)",
+ *             "export": "mcpUpstreamHandler"
+ *           },
+ *           "policies": {
+ *             "inbound": ["mcp-oauth", "mcp-upstream-linear"]
+ *           }
+ *         }
+ *       }
+ *     }
+ *   }
+ * }
+ * ```
+ */
+export declare function mcpUpstreamHandler(
+  request: ZuploRequest,
+  context: ZuploContext
+): Promise<Response>;
+
 /**
  * Implements the server-side MCP request lifecycle for the gateway. Pair with
  * `McpOAuthInboundPolicy` (or `McpAuth0OAuthInboundPolicy`) plus an
@@ -1911,6 +1971,20 @@ declare interface ParsedCorsPolicyConfiguration {
  */
 declare interface ParsedRouteData extends Omit<RouteData, "corsPolicies"> {
   corsPolicies: ParsedCorsPolicyConfiguration[];
+  /* Excluded from this release type: getInboundPolicyInstance */
+}
+
+/**
+ * The base class for inbound and outbound policies.
+ * Provides common functionality for all policy types.
+ *
+ * @public
+ */
+declare abstract class PolicyBase<TOptions = any> {
+  options: TOptions;
+  policyName: string;
+  policyType: string;
+  /* Excluded from this release type: __constructor */
 }
 
 /**

package/out/types/mocks/index.d.ts

@@ -78,54 +78,38 @@ export declare function createMockContext(options?: {
 };
 
 declare const EventType: {
-  readonly MCP_TOOL_USAGE: "mcp_tool_usage";
-  readonly MCP_RESOURCE_READ: "mcp_resource_read";
-  readonly MCP_PROMPT_GET: "mcp_prompt_get";
-  readonly MCP_SESSION_START: "mcp_session_start";
   readonly AI_GATEWAY_COST_SUM: "ai_gateway_cost_sum";
   readonly AI_GATEWAY_REQUEST_COUNT: "ai_gateway_request_count";
   readonly AI_GATEWAY_TOKEN_SUM: "ai_gateway_token_sum";
   readonly AI_GATEWAY_LATENCY_HISTOGRAM: "ai_gateway_latency_histogram";
   readonly AI_GATEWAY_WARNING_COUNT: "ai_gateway_warning_count";
   readonly AI_GATEWAY_BLOCKED_COUNT: "ai_gateway_blocked_count";
-  readonly MCP_GATEWAY_REQUEST_RECEIVED: "mcp_gateway_request_received";
-  readonly MCP_GATEWAY_REQUEST_COMPLETED: "mcp_gateway_request_completed";
-  readonly MCP_GATEWAY_REQUEST_REJECTED: "mcp_gateway_request_rejected";
-  readonly MCP_GATEWAY_INITIALIZE_NEGOTIATED: "mcp_gateway_initialize_negotiated";
-  readonly MCP_GATEWAY_CLIENT_UNSUPPORTED_BEHAVIOR: "mcp_gateway_client_unsupported_behavior";
-  readonly MCP_GATEWAY_CATALOG_LISTED: "mcp_gateway_catalog_listed";
-  readonly MCP_GATEWAY_CATALOG_IMPORTED: "mcp_gateway_catalog_imported";
-  readonly MCP_GATEWAY_CATALOG_DRIFT_DETECTED: "mcp_gateway_catalog_drift_detected";
-  readonly MCP_GATEWAY_CAPABILITY_LISTED: "mcp_gateway_capability_listed";
-  readonly MCP_GATEWAY_CAPABILITY_INVOKED: "mcp_gateway_capability_invoked";
-  readonly MCP_GATEWAY_CAPABILITY_COMPLETED: "mcp_gateway_capability_completed";
-  readonly MCP_GATEWAY_CAPABILITY_FAILED: "mcp_gateway_capability_failed";
-  readonly MCP_GATEWAY_CAPABILITY_CONNECT_REQUIRED: "mcp_gateway_capability_connect_required";
-  readonly MCP_GATEWAY_AUTH_DOWNSTREAM_TOKEN_VALIDATED: "mcp_gateway_auth_downstream_token_validated";
-  readonly MCP_GATEWAY_AUTH_DOWNSTREAM_TOKEN_REJECTED: "mcp_gateway_auth_downstream_token_rejected";
-  readonly MCP_GATEWAY_OAUTH_CLIENT_REGISTERED: "mcp_gateway_oauth_client_registered";
-  readonly MCP_GATEWAY_OAUTH_AUTHORIZE_STARTED: "mcp_gateway_oauth_authorize_started";
-  readonly MCP_GATEWAY_OAUTH_AUTHORIZE_AWAITING_SETUP: "mcp_gateway_oauth_authorize_awaiting_setup";
-  readonly MCP_GATEWAY_OAUTH_TOKEN_ISSUED: "mcp_gateway_oauth_token_issued";
-  readonly MCP_GATEWAY_OAUTH_TOKEN_REFRESH_ROTATED: "mcp_gateway_oauth_token_refresh_rotated";
-  readonly MCP_GATEWAY_OAUTH_TOKEN_REVOKED: "mcp_gateway_oauth_token_revoked";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CONNECT_REQUIRED: "mcp_gateway_auth_upstream_connect_required";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CONNECT_STARTED: "mcp_gateway_auth_upstream_connect_started";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CALLBACK_RECEIVED: "mcp_gateway_auth_upstream_callback_received";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_TOKEN_EXCHANGE_SUCCEEDED: "mcp_gateway_auth_upstream_token_exchange_succeeded";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_TOKEN_EXCHANGE_FAILED: "mcp_gateway_auth_upstream_token_exchange_failed";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CREDENTIAL_RESOLVED: "mcp_gateway_auth_upstream_credential_resolved";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_CREDENTIAL_MISSING: "mcp_gateway_auth_upstream_credential_missing";
-  readonly MCP_GATEWAY_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_gateway_auth_upstream_reconsent_required";
-  readonly MCP_GATEWAY_POLICY_DECISION: "mcp_gateway_policy_decision";
-  readonly MCP_GATEWAY_GUARDRAIL_DECISION: "mcp_gateway_guardrail_decision";
-  readonly MCP_GATEWAY_RATE_LIMIT_DECISION: "mcp_gateway_rate_limit_decision";
-  readonly MCP_GATEWAY_UPSTREAM_REQUEST_SENT: "mcp_gateway_upstream_request_sent";
-  readonly MCP_GATEWAY_UPSTREAM_REQUEST_COMPLETED: "mcp_gateway_upstream_request_completed";
-  readonly MCP_GATEWAY_UPSTREAM_REQUEST_FAILED: "mcp_gateway_upstream_request_failed";
-  readonly MCP_GATEWAY_AUDIT_VIRTUAL_SERVER_CREATED: "mcp_gateway_audit_virtual_server_created";
-  readonly MCP_GATEWAY_AUDIT_VIRTUAL_SERVER_UPDATED: "mcp_gateway_audit_virtual_server_updated";
-  readonly MCP_GATEWAY_AUDIT_VIRTUAL_SERVER_DELETED: "mcp_gateway_audit_virtual_server_deleted";
+  readonly MCP_REQUEST_RECEIVED: "mcp_request_received";
+  readonly MCP_REQUEST_COMPLETED: "mcp_request_completed";
+  readonly MCP_REQUEST_REJECTED: "mcp_request_rejected";
+  readonly MCP_INITIALIZE_NEGOTIATED: "mcp_initialize_negotiated";
+  readonly MCP_CLIENT_UNSUPPORTED_BEHAVIOR: "mcp_client_unsupported_behavior";
+  readonly MCP_CAPABILITY_LISTED: "mcp_capability_listed";
+  readonly MCP_CAPABILITY_INVOKED: "mcp_capability_invoked";
+  readonly MCP_CAPABILITY_COMPLETED: "mcp_capability_completed";
+  readonly MCP_CAPABILITY_FAILED: "mcp_capability_failed";
+  readonly MCP_CAPABILITY_CONNECT_REQUIRED: "mcp_capability_connect_required";
+  readonly MCP_AUTH_DOWNSTREAM_TOKEN_VALIDATED: "mcp_auth_downstream_token_validated";
+  readonly MCP_AUTH_DOWNSTREAM_TOKEN_REJECTED: "mcp_auth_downstream_token_rejected";
+  readonly MCP_OAUTH_CLIENT_REGISTERED: "mcp_oauth_client_registered";
+  readonly MCP_OAUTH_AUTHORIZE_STARTED: "mcp_oauth_authorize_started";
+  readonly MCP_OAUTH_AUTHORIZE_AWAITING_SETUP: "mcp_oauth_authorize_awaiting_setup";
+  readonly MCP_OAUTH_TOKEN_ISSUED: "mcp_oauth_token_issued";
+  readonly MCP_OAUTH_TOKEN_REFRESH_ROTATED: "mcp_oauth_token_refresh_rotated";
+  readonly MCP_OAUTH_TOKEN_REVOKED: "mcp_oauth_token_revoked";
+  readonly MCP_AUTH_UPSTREAM_CONNECT_REQUIRED: "mcp_auth_upstream_connect_required";
+  readonly MCP_AUTH_UPSTREAM_CONNECT_STARTED: "mcp_auth_upstream_connect_started";
+  readonly MCP_AUTH_UPSTREAM_CALLBACK_RECEIVED: "mcp_auth_upstream_callback_received";
+  readonly MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_SUCCEEDED: "mcp_auth_upstream_token_exchange_succeeded";
+  readonly MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_FAILED: "mcp_auth_upstream_token_exchange_failed";
+  readonly MCP_AUTH_UPSTREAM_CREDENTIAL_RESOLVED: "mcp_auth_upstream_credential_resolved";
+  readonly MCP_AUTH_UPSTREAM_CREDENTIAL_MISSING: "mcp_auth_upstream_credential_missing";
+  readonly MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED: "mcp_auth_upstream_reconsent_required";
 };
 
 declare type EventType = (typeof EventType)[keyof typeof EventType];

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.70.25",
+  "version": "6.70.27",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {