@zuplo/runtime 7.14.0 → 7.14.3

package/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{G as p,L as c,O as u}from"../chunk-4SVXBKXH.js";import"../chunk-VP5Q3DEN.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{aa as i}from"../chunk-WUZE2HKB.js";import"../chunk-UKQQD2JN.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
+import{G as p,M as c,Q as u}from"../chunk-ADPB2ZMZ.js";import"../chunk-VP5Q3DEN.js";import{a as d}from"../chunk-7RNZS3GX.js";import"../chunk-A3QGJZO7.js";import"../chunk-C32OTSKW.js";import"../chunk-UKQQD2JN.js";import{aa as i}from"../chunk-UFTMOJ7K.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
 //# sourceMappingURL=index.js.map

package/out/esm/mocks/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["@zuplo/runtime/mocks/context.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;0QAkCO,SAASA,EACdC,EAA6D,CAC3D,QAAS,IAAI,QAAQ,yBAAyB,CAChD,EACA,CACA,IAAMC,EAAwC,CAAC,EAG/C,SAASC,EAAUC,EAA6B,CAC9CF,EAAkB,KAAK,QAAQ,QAAQE,CAAO,CAAC,CACjD,CAFS,OAAAC,EAAAF,EAAA,aAcF,CAAE,QAVO,IAAIG,EAAiB,CACnC,MAAO,CAAE,UAAAH,CAAU,EACnB,MAAOF,EAAQ,MACf,gBAAiBA,EAAQ,OAC3B,CAAC,EAMiB,eAJKI,EAAA,SAAY,CACjC,MAAM,QAAQ,IAAIH,CAAiB,CACrC,EAFuB,iBAIU,CACnC,CAvBgBG,EAAAL,EAAA,qBAyBhB,IAAMO,EAA2C,CAC/C,KAAM,IACN,QAAS,CAAC,KAAK,EACf,QAAS,CACP,OAAQ,CAAC,EACT,OAAQ,SACV,EACA,IAAKF,EAAA,KAAU,CAAC,GAAX,MACP,EAMaC,EAAN,cAA+B,WAAoC,CAzE1E,MAyE0E,CAAAD,EAAA,yBAC/DG,GACAC,GACA,UACA,UACA,IACA,MAEA,OACA,0BACA,cACA,iBAET,YAAY,CACV,MAAAC,EACA,MAAAC,EAAQJ,EACR,cAAAK,EACA,gBAAAC,CACF,EAUG,CACD,MAAM,EACN,KAAK,UAAY,OAAO,WAAW,EACnC,KAAK,UAAY,OAAO,WAAW,EAEnC,KAAK,IAAM,CACT,KAAMC,EAAU,QAAQ,KACxB,IAAKA,EAAU,QAAQ,IACvB,MAAOA,EAAU,QAAQ,MACzB,KAAMA,EAAU,QAAQ,KACxB,MAAOA,EAAU,QAAQ,MACzB,iBAAkBT,EAAA,IAAM,CAAC,EAAP,mBACpB,EACA,KAAK,OAAS,CAAC,EACf,KAAK,MAAQM,EACb,KAAK,0BAA4B,CAC/B,GAAI,cACJ,IAAK,KACL,eAAgB,eAChB,KAAM,UACN,OAAQ,aACR,WAAY,KACZ,KAAM,MACN,UAAW,KACX,QAAS,KACT,WAAY,QACZ,UAAW,MACX,SAAU,OACV,UAAW,OACX,SAAU,OACV,aAAc,OACd,WAAY,OACZ,6BAA8B,OAC9B,6BAA8B,OAC9B,4BAA6B,OAC7B,oBAAqB,OACrB,mBAAoB,OACpB,mBAAoB,OACpB,oBAAqB,MACvB,EACA,KAAK,cAAgBC,EACrB,KAAKJ,GAASE,EACd,KAAKD,GAAmBI,EACxB,KAAK,iBAAmB,IAAIE,EAA6B,KAAK,SAAS,CACzE,CAGA,UAAUX,EAAuB,CAC/B,KAAKI,GAAO,UAAUJ,CAAO,CAC/B,CAEA,oBACEY,EACAC,EACkC,CAClC,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,qBACED,EACAE,EACAD,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,YACEE,EACAC,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,uBAAuBC,EAAmC,CACxD,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,4BAA4BA,EAAwC,CAClE,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAQA,qBACEC,EACArB,EACM,CAIN,IAAIsB,EACJ,GAAI,CACFA,EAAMC,EAAuB,qBAAqB,IAAI,CACxD,MAAQ,CACND,EAAMC,EAAuB,WAC3B,KACA,IAAIC,EACF,KAAKhB,IAAoB,IAAI,QAAQ,yBAAyB,CAChE,CACF,CACF,CAKAc,EAAI,kBAAoB,SACxBG,EAA0B,KAAMH,EAAKD,EAASrB,CAAO,CACvD,CAgBA,IAAI,oBAAyE,CAC3E,IAAIsB,EACJ,GAAI,CACFA,EAAMC,EAAuB,qBAAqB,IAAI,CACxD,MAAQ,CACN,MAAO,CAAC,CACV,CACA,OAAQD,EAAI,iBAAiB,SAAW,CAAC,GAAG,IAAKI,IAAW,CAC1D,WAAYA,EAAM,WAClB,KAAMA,EAAM,IACd,EAAE,CACJ,CAES,iBACPC,EACAN,EACArB,EACM,CACN,IAAM4B,EAA8CxB,EAACyB,GAAM,CACzD,GAAI,CACF,OAAOR,GAAY,WAAaA,EAAQQ,CAAC,EAAIR,EAAQ,YAAYQ,CAAC,CACpE,OAASC,EAAK,CACZ,WAAK,IAAI,MACP,wBAAwBH,CAAI,mCAC9B,EACMG,CACR,CACF,EAToD,WAUpD,MAAM,iBAAiBH,EAAMC,EAAS5B,CAAO,CAC/C,CACF","names":["createMockContext","options","waitUntilPromises","waitUntil","promise","__name","MockZuploContext","DEFAULT_ROUTE_CONFIG","#event","#originalRequest","event","route","parentContext","originalRequest","internals_default","ZuploGatewayAnalyticsContext","policyName","request","response","input","init","hook","handler","ext","ZuploContextExtensions","ZuploRequest","registerPreRequestHandler","entry","type","wrapped","e","err"]}
+{"version":3,"sources":["@zuplo/runtime/mocks/context.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;uSAkCO,SAASA,EACdC,EAA6D,CAC3D,QAAS,IAAI,QAAQ,yBAAyB,CAChD,EACA,CACA,IAAMC,EAAwC,CAAC,EAG/C,SAASC,EAAUC,EAA6B,CAC9CF,EAAkB,KAAK,QAAQ,QAAQE,CAAO,CAAC,CACjD,CAFS,OAAAC,EAAAF,EAAA,aAcF,CAAE,QAVO,IAAIG,EAAiB,CACnC,MAAO,CAAE,UAAAH,CAAU,EACnB,MAAOF,EAAQ,MACf,gBAAiBA,EAAQ,OAC3B,CAAC,EAMiB,eAJKI,EAAA,SAAY,CACjC,MAAM,QAAQ,IAAIH,CAAiB,CACrC,EAFuB,iBAIU,CACnC,CAvBgBG,EAAAL,EAAA,qBAyBhB,IAAMO,EAA2C,CAC/C,KAAM,IACN,QAAS,CAAC,KAAK,EACf,QAAS,CACP,OAAQ,CAAC,EACT,OAAQ,SACV,EACA,IAAKF,EAAA,KAAU,CAAC,GAAX,MACP,EAMaC,EAAN,cAA+B,WAAoC,CAzE1E,MAyE0E,CAAAD,EAAA,yBAC/DG,GACAC,GACA,UACA,UACA,IACA,MAEA,OACA,0BACA,cACA,iBAET,YAAY,CACV,MAAAC,EACA,MAAAC,EAAQJ,EACR,cAAAK,EACA,gBAAAC,CACF,EAUG,CACD,MAAM,EACN,KAAK,UAAY,OAAO,WAAW,EACnC,KAAK,UAAY,OAAO,WAAW,EAEnC,KAAK,IAAM,CACT,KAAMC,EAAU,QAAQ,KACxB,IAAKA,EAAU,QAAQ,IACvB,MAAOA,EAAU,QAAQ,MACzB,KAAMA,EAAU,QAAQ,KACxB,MAAOA,EAAU,QAAQ,MACzB,iBAAkBT,EAAA,IAAM,CAAC,EAAP,mBACpB,EACA,KAAK,OAAS,CAAC,EACf,KAAK,MAAQM,EACb,KAAK,0BAA4B,CAC/B,GAAI,cACJ,IAAK,KACL,eAAgB,eAChB,KAAM,UACN,OAAQ,aACR,WAAY,KACZ,KAAM,MACN,UAAW,KACX,QAAS,KACT,WAAY,QACZ,UAAW,MACX,SAAU,OACV,UAAW,OACX,SAAU,OACV,aAAc,OACd,WAAY,OACZ,6BAA8B,OAC9B,6BAA8B,OAC9B,4BAA6B,OAC7B,oBAAqB,OACrB,mBAAoB,OACpB,mBAAoB,OACpB,oBAAqB,MACvB,EACA,KAAK,cAAgBC,EACrB,KAAKJ,GAASE,EACd,KAAKD,GAAmBI,EACxB,KAAK,iBAAmB,IAAIE,EAA6B,KAAK,SAAS,CACzE,CAGA,UAAUX,EAAuB,CAC/B,KAAKI,GAAO,UAAUJ,CAAO,CAC/B,CAEA,oBACEY,EACAC,EACkC,CAClC,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,qBACED,EACAE,EACAD,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAEA,YACEE,EACAC,EACmB,CACnB,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,uBAAuBC,EAAmC,CACxD,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAKA,4BAA4BA,EAAwC,CAClE,MAAM,IAAI,MAAM,iBAAiB,CACnC,CAQA,qBACEC,EACArB,EACM,CAIN,IAAIsB,EACJ,GAAI,CACFA,EAAMC,EAAuB,qBAAqB,IAAI,CACxD,MAAQ,CACND,EAAMC,EAAuB,WAC3B,KACA,IAAIC,EACF,KAAKhB,IAAoB,IAAI,QAAQ,yBAAyB,CAChE,CACF,CACF,CAKAc,EAAI,kBAAoB,SACxBG,EAA0B,KAAMH,EAAKD,EAASrB,CAAO,CACvD,CAgBA,IAAI,oBAAyE,CAC3E,IAAIsB,EACJ,GAAI,CACFA,EAAMC,EAAuB,qBAAqB,IAAI,CACxD,MAAQ,CACN,MAAO,CAAC,CACV,CACA,OAAQD,EAAI,iBAAiB,SAAW,CAAC,GAAG,IAAKI,IAAW,CAC1D,WAAYA,EAAM,WAClB,KAAMA,EAAM,IACd,EAAE,CACJ,CAES,iBACPC,EACAN,EACArB,EACM,CACN,IAAM4B,EAA8CxB,EAACyB,GAAM,CACzD,GAAI,CACF,OAAOR,GAAY,WAAaA,EAAQQ,CAAC,EAAIR,EAAQ,YAAYQ,CAAC,CACpE,OAASC,EAAK,CACZ,WAAK,IAAI,MACP,wBAAwBH,CAAI,mCAC9B,EACMG,CACR,CACF,EAToD,WAUpD,MAAM,iBAAiBH,EAAMC,EAAS5B,CAAO,CAC/C,CACF","names":["createMockContext","options","waitUntilPromises","waitUntil","promise","__name","MockZuploContext","DEFAULT_ROUTE_CONFIG","#event","#originalRequest","event","route","parentContext","originalRequest","internals_default","ZuploGatewayAnalyticsContext","policyName","request","response","input","init","hook","handler","ext","ZuploContextExtensions","ZuploRequest","registerPreRequestHandler","entry","type","wrapped","e","err"]}

package/out/esm/sdks/aws/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{Ia as a,Ja as l,Ka as c,La as o,Oa as p,Pa as y,Qa as m}from"../../chunk-WUZE2HKB.js";import"../../chunk-UKQQD2JN.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
+import{H as a,I as l,J as c,K as o,N as p,O as y,P as m}from"../../chunk-C32OTSKW.js";import"../../chunk-UKQQD2JN.js";import"../../chunk-UFTMOJ7K.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
 //# sourceMappingURL=index.js.map

package/out/esm/sdks/aws/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["@zuplo/runtime/sdks/aws/sign.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;yKAiDA,eAAsBA,EACpBC,EACAC,EACkB,CAClB,IAAMC,EACJ,OAAOD,EAAQ,aAAgB,WAC3B,MAAMA,EAAQ,YAAY,EAC1BA,EAAQ,YAERE,EAASH,EAAQ,OAEjBI,EADUD,IAAW,OAASA,IAAW,QAAUH,EAAQ,MAAQ,KAClD,MAAMA,EAAQ,YAAY,EAAI,KAe/CK,EAAS,MAbA,IAAIC,EAAY,CAC7B,OAAAH,EACA,IAAKH,EAAQ,IACb,QAASA,EAAQ,QACjB,KAAAI,EACA,YAAaF,EAAY,YACzB,gBAAiBA,EAAY,gBAC7B,aAAcA,EAAY,aAC1B,QAASD,EAAQ,QACjB,OAAQA,EAAQ,OAChB,UAAWA,EAAQ,SACrB,CAAC,EAE2B,KAAK,EAEjC,OAAO,IAAI,QAAQI,EAAO,IAAI,SAAS,EAAG,CACxC,OAAQA,EAAO,OACf,QAASA,EAAO,QAChB,KAAMA,EAAO,IACf,CAAC,CACH,CAjCsBE,EAAAR,EAAA","names":["signRequest","request","options","credentials","method","body","signed","AwsV4Signer","__name"]}
+{"version":3,"sources":["@zuplo/runtime/sdks/aws/sign.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;kMAiDA,eAAsBA,EACpBC,EACAC,EACkB,CAClB,IAAMC,EACJ,OAAOD,EAAQ,aAAgB,WAC3B,MAAMA,EAAQ,YAAY,EAC1BA,EAAQ,YAERE,EAASH,EAAQ,OAEjBI,EADUD,IAAW,OAASA,IAAW,QAAUH,EAAQ,MAAQ,KAClD,MAAMA,EAAQ,YAAY,EAAI,KAe/CK,EAAS,MAbA,IAAIC,EAAY,CAC7B,OAAAH,EACA,IAAKH,EAAQ,IACb,QAASA,EAAQ,QACjB,KAAAI,EACA,YAAaF,EAAY,YACzB,gBAAiBA,EAAY,gBAC7B,aAAcA,EAAY,aAC1B,QAASD,EAAQ,QACjB,OAAQA,EAAQ,OAChB,UAAWA,EAAQ,SACrB,CAAC,EAE2B,KAAK,EAEjC,OAAO,IAAI,QAAQI,EAAO,IAAI,SAAS,EAAG,CACxC,OAAQA,EAAO,OACf,QAASA,EAAO,QAChB,KAAMA,EAAO,IACf,CAAC,CACH,CAjCsBE,EAAAR,EAAA","names":["signRequest","request","options","credentials","method","body","signed","AwsV4Signer","__name"]}

package/out/types/index.d.ts

@@ -4454,6 +4454,70 @@ declare interface CompatibilityFlags {
    * @compatibilityDate 2026-11-06
    */
   treatBlankOptionalStringOptionsAsUnset: boolean;
+  /**
+   * Whether the MCP Gateway supports MCP protocol revision `2026-07-28`.
+   *
+   * MCP requests on `2025-11-25` and earlier get the same answers with or
+   * without this flag, with one exception: an `initialize` reply the upstream
+   * sends as an SSE stream gets the configured icon fallback (see below).
+   * Otherwise, per-request behavior changes only for a request that names
+   * `2026-07-28` or a later dated revision (in the `MCP-Protocol-Version`
+   * header or the `params._meta` envelope). Three changes have no
+   * per-request version and apply to the whole project: upstream readiness,
+   * RFC 9207 `iss` on the gateway's authorization server, and the capability
+   * filter's handling of `subscriptions/listen`, a method only `2026-07-28`
+   * defines.
+   *
+   * Before this flag: The MCP Gateway relays `2026-07-28` traffic without
+   * reading it as `2026-07-28`. An upstream that answers only `server/discover`
+   * is reported as unavailable, and a caller that hasn't connected the
+   * upstream gets the `-32042` URL-elicitation error, which `2026-07-28`
+   * clients can't act on.
+   *
+   * After this flag: The MCP Gateway handles `2026-07-28` requests as that
+   * revision requires:
+   *
+   * - Upstream readiness falls back to `server/discover` when `initialize` is
+   *   refused with a JSON-RPC error.
+   * - `server/discover` gets the configured icon fallback, and the gateway
+   *   answers it itself for a caller that hasn't connected the upstream.
+   * - The configured icon fallback (`serverInfo.icons`) is also added to an
+   *   `initialize` or `server/discover` reply the upstream sends as an SSE
+   *   stream, not only to a JSON one. Only the JSON-RPC response to that
+   *   request changes, and only when its `serverInfo` has no icons; every
+   *   other event is relayed unchanged, and the stream is not buffered.
+   * - A caller that hasn't connected the upstream gets an `input_required`
+   *   result with a URL-mode connect elicitation (or `-32021` when the client
+   *   didn't declare URL elicitation), not `-32042`. Before the gateway
+   *   answers such a request itself, it refuses one a `2026-07-28` server
+   *   would refuse (`-32602`, `-32020` or `-32022`, HTTP 400), and it accepts
+   *   a notification with `202` and no body.
+   * - The capability filter checks the `Mcp-Method` and `Mcp-Name` headers
+   *   against the body (`-32020`), answers an unknown method spelling with
+   *   HTTP `404`, marks lists and `resources/read` results on routes with
+   *   per-caller access control `cacheScope: "private"`, and answers a hidden
+   *   tool, prompt or resource with the MCP SDK's not-found error when the
+   *   `MCP-Protocol-Version` header names `2026-07-28`.
+   * - The capability filter removes hidden URIs from every
+   *   `subscriptions/listen` and its notifications, and refuses a listen with
+   *   a respelled method or ambiguous keys.
+   * - Long-lived streams: on `subscriptions/listen` the request timeout
+   *   bounds only the wait for response headers; every other request keeps
+   *   the timeout on the whole response. A client disconnect cancels the
+   *   upstream request.
+   * - Authorization responses from the gateway's authorization server (the
+   *   code redirect, the `access_denied` redirect and error redirects) carry
+   *   the RFC 9207 `iss` parameter, and its authorization-server metadata
+   *   advertises `authorization_response_iss_parameter_supported: true`. An
+   *   MCP SDK client that validates `iss` then rejects a callback without it.
+   * - On Cloudflare Workers (managed edge and `zuplo dev`), the flag also turns
+   *   on the Workers `enable_request_signal` compatibility flag. That makes
+   *   `request.signal` fire when the client disconnects, for all code in the
+   *   project, not only the MCP Gateway.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  mcpProtocolVersion20260728: boolean;
   /**
    * Whether the MCP server handler answers `resources/read` with a JSON-RPC
    * error when the resource's route answers an error status.
@@ -16665,6 +16729,62 @@ export declare class ZuploMcpSdk {
    * @returns The MCP call tool request object or null if not found
    */
   getRawCallToolRequest(): CallToolRequest | null;
+  /**
+   * The MCP session ID of the request being served: the `Mcp-Session-Id`
+   * header the client sent, or undefined when it sent none.
+   *
+   * Works in tool, prompt and resource routes, including routes they invoke
+   * in turn: it looks at this context and every `invokeRoute` ancestor.
+   *
+   * Undefined in a route invoked for a member of a JSON-RPC batch
+   * (2025-03-26): the server reads request details only from a single
+   * message.
+   *
+   * @beta
+   * @returns The session ID, or undefined outside an MCP Server request
+   */
+  getSessionId(): string | undefined;
+  /**
+   * The MCP protocol version of the request being served: the
+   * `MCP-Protocol-Version` header, the 2026-07-28 `params._meta` version
+   * envelope, the version the client requested on `initialize`, or
+   * `"2025-03-26"` when none is present (the version the MCP specification
+   * tells a server to assume without the header).
+   *
+   * Undefined in a route invoked for a member of a JSON-RPC batch
+   * (2025-03-26): the server reads request details only from a single
+   * message.
+   *
+   * @beta
+   * @returns The protocol version, or undefined outside an MCP Server request
+   */
+  getProtocolVersion(): string | undefined;
+  /**
+   * The `params._meta` object of the JSON-RPC request being served, for
+   * example a client's progress token or vendor metadata. Trace context keys
+   * (`traceparent`, `tracestate`, `baggage`) appear here as sent; the
+   * gateway does not apply `baggage` to the route's outbound requests.
+   *
+   * Undefined in a route invoked for a member of a JSON-RPC batch
+   * (2025-03-26): the server reads request details only from a single
+   * message.
+   *
+   * @beta
+   * @returns The `_meta` object, or undefined when the request has none
+   */
+  getRequestMeta(): Record<string, unknown> | undefined;
+  /**
+   * The JSON-RPC `id` of the request being served.
+   *
+   * Undefined in a route invoked for a member of a JSON-RPC batch
+   * (2025-03-26): the server reads request details only from a single
+   * message.
+   *
+   * @beta
+   * @returns The id, or undefined for a notification or outside an MCP
+   * Server request
+   */
+  getJsonRpcId(): string | number | undefined;
   /**
    * Overrides fields of the MCP tool result the gateway is about to send.
    *

package/out/types/internal/index.d.ts

@@ -325,6 +325,70 @@ declare interface CompatibilityFlags {
    * @compatibilityDate 2026-11-06
    */
   treatBlankOptionalStringOptionsAsUnset: boolean;
+  /**
+   * Whether the MCP Gateway supports MCP protocol revision `2026-07-28`.
+   *
+   * MCP requests on `2025-11-25` and earlier get the same answers with or
+   * without this flag, with one exception: an `initialize` reply the upstream
+   * sends as an SSE stream gets the configured icon fallback (see below).
+   * Otherwise, per-request behavior changes only for a request that names
+   * `2026-07-28` or a later dated revision (in the `MCP-Protocol-Version`
+   * header or the `params._meta` envelope). Three changes have no
+   * per-request version and apply to the whole project: upstream readiness,
+   * RFC 9207 `iss` on the gateway's authorization server, and the capability
+   * filter's handling of `subscriptions/listen`, a method only `2026-07-28`
+   * defines.
+   *
+   * Before this flag: The MCP Gateway relays `2026-07-28` traffic without
+   * reading it as `2026-07-28`. An upstream that answers only `server/discover`
+   * is reported as unavailable, and a caller that hasn't connected the
+   * upstream gets the `-32042` URL-elicitation error, which `2026-07-28`
+   * clients can't act on.
+   *
+   * After this flag: The MCP Gateway handles `2026-07-28` requests as that
+   * revision requires:
+   *
+   * - Upstream readiness falls back to `server/discover` when `initialize` is
+   *   refused with a JSON-RPC error.
+   * - `server/discover` gets the configured icon fallback, and the gateway
+   *   answers it itself for a caller that hasn't connected the upstream.
+   * - The configured icon fallback (`serverInfo.icons`) is also added to an
+   *   `initialize` or `server/discover` reply the upstream sends as an SSE
+   *   stream, not only to a JSON one. Only the JSON-RPC response to that
+   *   request changes, and only when its `serverInfo` has no icons; every
+   *   other event is relayed unchanged, and the stream is not buffered.
+   * - A caller that hasn't connected the upstream gets an `input_required`
+   *   result with a URL-mode connect elicitation (or `-32021` when the client
+   *   didn't declare URL elicitation), not `-32042`. Before the gateway
+   *   answers such a request itself, it refuses one a `2026-07-28` server
+   *   would refuse (`-32602`, `-32020` or `-32022`, HTTP 400), and it accepts
+   *   a notification with `202` and no body.
+   * - The capability filter checks the `Mcp-Method` and `Mcp-Name` headers
+   *   against the body (`-32020`), answers an unknown method spelling with
+   *   HTTP `404`, marks lists and `resources/read` results on routes with
+   *   per-caller access control `cacheScope: "private"`, and answers a hidden
+   *   tool, prompt or resource with the MCP SDK's not-found error when the
+   *   `MCP-Protocol-Version` header names `2026-07-28`.
+   * - The capability filter removes hidden URIs from every
+   *   `subscriptions/listen` and its notifications, and refuses a listen with
+   *   a respelled method or ambiguous keys.
+   * - Long-lived streams: on `subscriptions/listen` the request timeout
+   *   bounds only the wait for response headers; every other request keeps
+   *   the timeout on the whole response. A client disconnect cancels the
+   *   upstream request.
+   * - Authorization responses from the gateway's authorization server (the
+   *   code redirect, the `access_denied` redirect and error redirects) carry
+   *   the RFC 9207 `iss` parameter, and its authorization-server metadata
+   *   advertises `authorization_response_iss_parameter_supported: true`. An
+   *   MCP SDK client that validates `iss` then rejects a callback without it.
+   * - On Cloudflare Workers (managed edge and `zuplo dev`), the flag also turns
+   *   on the Workers `enable_request_signal` compatibility flag. That makes
+   *   `request.signal` fire when the client disconnects, for all code in the
+   *   project, not only the MCP Gateway.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  mcpProtocolVersion20260728: boolean;
   /**
    * Whether the MCP server handler answers `resources/read` with a JSON-RPC
    * error when the resource's route answers an error status.

package/out/types/mcp/messages/index.d.ts

@@ -1070,6 +1070,15 @@ export declare interface McpCompleteParams extends McpParams {
   };
 }
 
+/**
+ * Params for `server/discover` (MCP 2026-07-28). The request carries only the
+ * standard per-request `_meta` envelope (`io.modelcontextprotocol/protocolVersion`
+ * and `io.modelcontextprotocol/clientCapabilities`), so every field is optional.
+ *
+ * @beta
+ */
+export declare type McpDiscoverParams = McpParams;
+
 /**
  * A parsed view of an MCP HTTP request body.
  *
@@ -1268,6 +1277,12 @@ export declare interface McpNotificationParamsMap {
   readonly "notifications/cancelled": McpCancelledParams;
   readonly "notifications/progress": McpProgressParams;
   readonly "notifications/roots/list_changed": McpParams;
+  /**
+   * MCP 2026-07-28. Sent by the server as the first event of a
+   * `subscriptions/listen` stream, so it travels server→client and a request
+   * body never carries it; it is listed so response-side tooling can name it.
+   */
+  readonly "notifications/subscriptions/acknowledged": McpParams;
 }
 
 /**
@@ -1407,6 +1422,11 @@ export declare type McpRequestMethod = keyof McpRequestParamsMap;
  * their params shapes. Unknown or future methods still surface as requests
  * (with `method: string`); they are never dropped.
  *
+ * The MCP 2026-07-28 methods (`server/discover`, `subscriptions/listen`,
+ * `tasks/*`) are typed only on a 2026-07-28 request with the
+ * `mcpProtocolVersion20260728` compatibility flag on. On any other request
+ * they surface as unknown methods.
+ *
  * @beta
  */
 export declare interface McpRequestParamsMap {
@@ -1423,6 +1443,16 @@ export declare interface McpRequestParamsMap {
   readonly "resources/unsubscribe": McpResourceParams;
   readonly "completion/complete": McpCompleteParams;
   readonly "logging/setLevel": McpSetLevelParams;
+  /** MCP 2026-07-28. */
+  readonly "server/discover": McpDiscoverParams;
+  /** MCP 2026-07-28. */
+  readonly "subscriptions/listen": McpSubscriptionsListenParams;
+  /** MCP 2026-07-28, `io.modelcontextprotocol/tasks` extension. */
+  readonly "tasks/get": McpTaskParams;
+  /** MCP 2026-07-28, `io.modelcontextprotocol/tasks` extension. */
+  readonly "tasks/update": McpTaskUpdateParams;
+  /** MCP 2026-07-28, `io.modelcontextprotocol/tasks` extension. */
+  readonly "tasks/cancel": McpTaskParams;
 }
 
 /**
@@ -1451,6 +1481,54 @@ export declare interface McpSetLevelParams extends McpParams {
   readonly level: string;
 }
 
+/**
+ * The notification categories a client asks for in `subscriptions/listen`
+ * (MCP 2026-07-28).
+ *
+ * @beta
+ */
+export declare interface McpSubscriptionFilter {
+  readonly toolsListChanged?: boolean;
+  readonly promptsListChanged?: boolean;
+  readonly resourcesListChanged?: boolean;
+  /** Resource URIs the client wants `notifications/resources/updated` for. */
+  readonly resourceSubscriptions?: readonly string[];
+  readonly [key: string]: unknown;
+}
+
+/**
+ * Params for `subscriptions/listen` (MCP 2026-07-28): the long-lived POST whose
+ * response stream replaces the GET stream and `resources/subscribe`. The
+ * parser does not require `notifications`; the gateway observes traffic rather
+ * than enforcing the schema.
+ *
+ * @beta
+ */
+export declare interface McpSubscriptionsListenParams extends McpParams {
+  readonly notifications?: McpSubscriptionFilter;
+}
+
+/**
+ * Params for the task requests of the `io.modelcontextprotocol/tasks`
+ * extension (`tasks/get`, `tasks/update`, `tasks/cancel`). `taskId` is
+ * guaranteed by the parser; over HTTP it is also the `Mcp-Name` header value.
+ *
+ * @beta
+ */
+export declare interface McpTaskParams extends McpParams {
+  readonly taskId: string;
+}
+
+/**
+ * Params for `tasks/update`: the client's answers to the task's pending
+ * `inputRequests`.
+ *
+ * @beta
+ */
+export declare interface McpTaskUpdateParams extends McpTaskParams {
+  readonly inputResponses?: Record<string, unknown>;
+}
+
 /**
  * Params for `tools/call`. `name` is guaranteed: a `tools/call` request
  * without a string `name` is classified as an invalid member instead of a

package/out/types/mcp-gateway/index.d.ts

@@ -2916,8 +2916,9 @@ export declare interface McpPingOAuthInboundPolicyOptions {
  *
  * The upstream response streams back to the client as soon as its headers
  * arrive. A tap observes the stream on the side; as soon as it sees the
- * JSON-RPC response (or the stream ends without one), the terminal
- * capability analytics event is emitted from `context.waitUntil`.
+ * JSON-RPC response (or the stream ends without one), the MCP SERVER and
+ * CLIENT spans end and the terminal capability analytics event is emitted,
+ * from `context.waitUntil`.
  */
 export declare function McpProxyHandler(
   request: ZuploRequest,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.14.0",
+  "version": "7.14.3",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {