@zuplo/runtime 7.14.5 → 7.14.8

package/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{G as p,M as c,Q as u}from"../chunk-UGZSO3CK.js";import"../chunk-VP5Q3DEN.js";import{a as d}from"../chunk-7RNZS3GX.js";import"../chunk-A3QGJZO7.js";import"../chunk-C32OTSKW.js";import"../chunk-UKQQD2JN.js";import{aa as i}from"../chunk-UFTMOJ7K.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
+import{G as p,M as c,Q as u}from"../chunk-DB6LKZ36.js";import"../chunk-VP5Q3DEN.js";import{a as d}from"../chunk-PY52EHDX.js";import"../chunk-A3QGJZO7.js";import"../chunk-6R2COTV6.js";import"../chunk-UKQQD2JN.js";import{aa as i}from"../chunk-2HVCLUM4.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
 //# sourceMappingURL=index.js.map

package/out/esm/sdks/aws/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{H as a,I as l,J as c,K as o,N as p,O as y,P as m}from"../../chunk-C32OTSKW.js";import"../../chunk-UKQQD2JN.js";import"../../chunk-UFTMOJ7K.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
+import{H as a,I as l,J as c,K as o,N as p,O as y,P as m}from"../../chunk-6R2COTV6.js";import"../../chunk-UKQQD2JN.js";import"../../chunk-2HVCLUM4.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
 //# sourceMappingURL=index.js.map

package/out/types/index.d.ts

@@ -4352,9 +4352,11 @@ declare interface CompatibilityFlags {
    * precompiled Ajv validators from the OpenAPI document, validated per the
    * dialect and OpenAPI version they declare (specs/mcp-tool-schemas.md), and
    * `prompts/list` also lists the arguments behind a prompt schema's `$ref`
-   * and `allOf`. `request-validation-inbound` validates with the same dialect,
-   * `format` and pattern rules, and keeps its parameter type coercion
-   * (specs/compat-improved-schema-validation.md).
+   * and `allOf`. A tool set to `toolInputStyle: "flat"` whose input can't be
+   * fully flattened fails the build instead of staying nested
+   * (specs/mcp-flat-input.md FLAT-18). `request-validation-inbound` validates
+   * with the same dialect, `format` and pattern rules, and keeps its parameter
+   * type coercion (specs/compat-improved-schema-validation.md).
    *
    * @compatibilityDate 2026-11-06
    */
@@ -4433,10 +4435,11 @@ declare interface CompatibilityFlags {
   omitMcpFieldsNewerThanNegotiatedVersion: boolean;
   /**
    * Whether built-in policies treat an empty or whitespace-only value for an
-   * optional string option as if the option were left out.
+   * optional string option as if the option were left out, and reject one for
+   * a required string option.
    *
    * `$env(VAR)` with `VAR` defined but empty reaches a policy as `""`, so this
-   * decides what an empty environment variable does to an optional option.
+   * decides what an empty environment variable does to a policy option.
    *
    * Before this flag: Many policies reject `""`. Some fail every request with
    * a `ConfigurationError` (for example `http-deprecation-outbound` `link`,
@@ -4451,11 +4454,18 @@ declare interface CompatibilityFlags {
    * current behavior. `BLANK_IS_NOT_UNSET` in
    * `policies/optional-string-options.spec.ts` lists them with the reason.
    *
+   * A required string option that is empty or whitespace-only fails with a
+   * `ConfigurationError` naming the option when the policy is created, instead
+   * of being sent as a blank credential, host or header. Required options
+   * where an empty value means something (`replace-string-outbound`
+   * `replaceWith`, `set-body-inbound` `body`) are used as given.
+   *
    * @compatibilityDate 2026-11-06
    */
   treatBlankOptionalStringOptionsAsUnset: boolean;
   /**
-   * Whether the MCP Gateway supports MCP protocol revision `2026-07-28`.
+   * Whether the MCP Gateway and `mcpServerHandler` support MCP protocol
+   * revision `2026-07-28`.
    *
    * MCP requests on `2025-11-25` and earlier get the same answers with or
    * without this flag, with one exception: an `initialize` reply the upstream
@@ -4472,11 +4482,24 @@ declare interface CompatibilityFlags {
    * reading it as `2026-07-28`. An upstream that answers only `server/discover`
    * is reported as unavailable, and a caller that hasn't connected the
    * upstream gets the `-32042` URL-elicitation error, which `2026-07-28`
-   * clients can't act on.
+   * clients can't act on. `mcpServerHandler` refuses a `2026-07-28`
+   * `MCP-Protocol-Version` header with HTTP 400 and `-32000`.
    *
-   * After this flag: The MCP Gateway handles `2026-07-28` requests as that
-   * revision requires:
+   * After this flag: The MCP Gateway and `mcpServerHandler` handle
+   * `2026-07-28` requests as that revision requires:
    *
+   * - `mcpServerHandler` serves a `2026-07-28` request: `server/discover`,
+   *   the per-request `_meta` envelope and its validation (`-32602`,
+   *   `-32020`, `-32022`), including the required `MCP-Protocol-Version`,
+   *   `Mcp-Method` and `Mcp-Name` headers,
+   *   HTTP `404` with `-32601` for the methods `2026-07-28` removed
+   *   (`initialize`, `ping`, `logging/setLevel`, `resources/subscribe`,
+   *   `resources/unsubscribe`), and `resultType`, `serverInfo` and
+   *   `ttlMs: 0` / `cacheScope: "private"` on its results. An unknown tool,
+   *   prompt or resource gets the MCP SDK's not-found error. The era comes
+   *   from the body, so a request that names `2026-07-28` only in
+   *   `params._meta`, with no header, gets HTTP `400` with `-32020`. The MCP
+   *   capability filter answers a hidden target with the same checks first.
    * - Upstream readiness falls back to `server/discover` when `initialize` is
    *   refused with a JSON-RPC error.
    * - `server/discover` gets the configured icon fallback, and the gateway
@@ -4488,10 +4511,18 @@ declare interface CompatibilityFlags {
    *   other event is relayed unchanged, and the stream is not buffered.
    * - A caller that hasn't connected the upstream gets an `input_required`
    *   result with a URL-mode connect elicitation (or `-32021` when the client
-   *   didn't declare URL elicitation), not `-32042`. Before the gateway
-   *   answers such a request itself, it refuses one a `2026-07-28` server
-   *   would refuse (`-32602`, `-32020` or `-32022`, HTTP 400), and it accepts
-   *   a notification with `202` and no body.
+   *   didn't declare URL elicitation), not `-32042`. Any other method, the
+   *   list methods included, gets `-32603` with the connect link in
+   *   `data.connectRequired`. Before the gateway answers such a request
+   *   itself, it refuses one a `2026-07-28` server would refuse (`-32602`,
+   *   `-32020` or `-32022`, HTTP 400), a request without a required
+   *   `MCP-Protocol-Version`, `Mcp-Method` or `Mcp-Name` header included, and
+   *   it accepts a notification with `202` and no body. Its own
+   *   `server/discover` answer lists `2026-07-28` and the 2025-era versions
+   *   the route relays through `initialize`.
+   * - A retry's `requestState` with the gateway's `zuplo-connect.` prefix
+   *   that doesn't verify under this deployment's key (another Zuplo
+   *   gateway's, behind this one) is passed to the upstream, not refused.
    * - The capability filter checks the `Mcp-Method` and `Mcp-Name` headers
    *   against the body (`-32020`), answers an unknown method spelling with
    *   HTTP `404`, marks lists and `resources/read` results on routes with
@@ -4548,6 +4579,97 @@ declare interface CompatibilityFlags {
    * @compatibilityDate 2026-11-06
    */
   rejectInvalidMcpResourceUris: boolean;
+  /**
+   * Whether the MCP Gateway follows the MCP transport, elicitation and
+   * authorization rules for the answers it builds itself on `2025-11-25` and
+   * earlier requests, and in its upstream readiness check.
+   *
+   * Before this flag:
+   *
+   * - A caller that hasn't connected the upstream gets a JSON-RPC error with
+   *   HTTP 200 for every message: `-32042` with a URL-mode elicitation when
+   *   the gateway has a connect URL, `-32600` when it doesn't. That includes
+   *   a notification or a JSON-RPC response (answered with an error that has
+   *   no `id`), an `initialize`, a client that never declared URL-mode
+   *   elicitation, and a client on a protocol version before `2025-11-25`,
+   *   which has no URL mode.
+   * - When the upstream still answers 401 after the gateway refreshed its
+   *   credential (or the gateway could not retry), and when it answers 403
+   *   with a `WWW-Authenticate` challenge, the client gets the upstream's
+   *   response, `WWW-Authenticate` included. The challenge points at the
+   *   upstream's authorization server, and the client reads the 401 as its
+   *   own gateway token failing.
+   * - The readiness check ends the upstream session it opened with
+   *   `MCP-Protocol-Version: 2025-11-25`, whatever version the upstream
+   *   negotiated.
+   *
+   * After this flag:
+   *
+   * - A request from a caller that hasn't connected the upstream is first
+   *   checked as `mcpServerHandler` checks it: a body that is not JSON (an
+   *   empty one included) gets HTTP `400` `-32700`, a message that is not
+   *   valid JSON-RPC `400` `-32600`, an `initialize` batched with other
+   *   messages `400` `-32600`, and an `MCP-Protocol-Version` the route does
+   *   not serve `400` `-32000` (a missing header is allowed; the route
+   *   serves its upstream's versions once the gateway has learned them). A
+   *   batch on `2025-06-18` or later is refused whole with `400` `-32600`.
+   * - A valid notification or JSON-RPC response is accepted with `202` and
+   *   no body, and dropped. `ping` gets an empty result. A `2025-03-26`
+   *   batch is answered per member.
+   * - The `-32042` URL-elicitation error is sent only to an `initialize` that
+   *   names `2025-11-25` (and not `2026-07-28` or later) and declares
+   *   `capabilities.elicitation.url`: the gateway keeps no session, so it
+   *   cannot know what a later request's client declared. Every other
+   *   connect-required answer is `-32603` with the connect link in
+   *   `data.connectRequired`, never `-32600`.
+   * - On a request the token exchange policy sent with the gateway's own
+   *   upstream credential, an upstream 401 the refresh did not fix, or an
+   *   upstream 403 with a `WWW-Authenticate` challenge, is answered by the
+   *   gateway with JSON-RPC `-32603` (`data.upstreamStatus`) and no
+   *   `WWW-Authenticate`; a message without a request gets HTTP `502` with
+   *   the error and no id. A route without the policy relays the challenge.
+   * - The readiness check ends the session with the version the upstream
+   *   negotiated in its `initialize` result.
+   * - The MCP capability filter answers a 2025-era request for a hidden
+   *   target as `mcpServerHandler` answers an absent one: its `406`, `415`,
+   *   invalid-message and batched-`initialize` `400`s and unsupported-version
+   *   `400` first, then a mistyped `arguments` `-32602`, then the not-found.
+   * - On a `2026-07-28` request (with `mcpProtocolVersion20260728`), a method
+   *   2026-07-28 removed (`ping`, `logging/setLevel`, …) gets `404`
+   *   `-32601` from the gateway instead of the connect-required error.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  mcpGatewaySpecCompliance: boolean;
+  /**
+   * Whether the MCP server handler checks the results and requests that MCP
+   * 2025-11-25 constrains and the handler did not check.
+   *
+   * Before this flag:
+   *
+   * - `prompts/get` returns the prompt route's messages as the route sent
+   *   them, so a `role` other than `user` or `assistant` (such as
+   *   `"system"`) or an invalid content block reaches the client.
+   * - A JSON-RPC batch (allowed on `2025-03-26` and earlier) whose answer has
+   *   one response gets that response as a bare object, not an array.
+   * - A tool from the deprecated `options.files` whose `x-zuplo-mcp-tool`
+   *   name is blank is registered with the name `""`.
+   *
+   * After this flag:
+   *
+   * - `prompts/get` answers JSON-RPC `-32603` naming the prompt and the first
+   *   invalid message when a message's `role` is not `user` or `assistant`,
+   *   or its `content` is not a content block the request's protocol version
+   *   defines (`audio` from `2025-03-26`, `resource_link` from `2025-06-18`).
+   *   A prompt message's `annotations.lastModified` may be any string, as
+   *   every revision's schema types it.
+   * - Every answer to a batch is an array.
+   * - A blank tool name falls back to the operationId, as on every other
+   *   path.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  mcpServerSpecCompliance: boolean;
 }
 
 declare interface CompletionsFallbacks {

package/out/types/internal/index.d.ts

@@ -223,9 +223,11 @@ declare interface CompatibilityFlags {
    * precompiled Ajv validators from the OpenAPI document, validated per the
    * dialect and OpenAPI version they declare (specs/mcp-tool-schemas.md), and
    * `prompts/list` also lists the arguments behind a prompt schema's `$ref`
-   * and `allOf`. `request-validation-inbound` validates with the same dialect,
-   * `format` and pattern rules, and keeps its parameter type coercion
-   * (specs/compat-improved-schema-validation.md).
+   * and `allOf`. A tool set to `toolInputStyle: "flat"` whose input can't be
+   * fully flattened fails the build instead of staying nested
+   * (specs/mcp-flat-input.md FLAT-18). `request-validation-inbound` validates
+   * with the same dialect, `format` and pattern rules, and keeps its parameter
+   * type coercion (specs/compat-improved-schema-validation.md).
    *
    * @compatibilityDate 2026-11-06
    */
@@ -304,10 +306,11 @@ declare interface CompatibilityFlags {
   omitMcpFieldsNewerThanNegotiatedVersion: boolean;
   /**
    * Whether built-in policies treat an empty or whitespace-only value for an
-   * optional string option as if the option were left out.
+   * optional string option as if the option were left out, and reject one for
+   * a required string option.
    *
    * `$env(VAR)` with `VAR` defined but empty reaches a policy as `""`, so this
-   * decides what an empty environment variable does to an optional option.
+   * decides what an empty environment variable does to a policy option.
    *
    * Before this flag: Many policies reject `""`. Some fail every request with
    * a `ConfigurationError` (for example `http-deprecation-outbound` `link`,
@@ -322,11 +325,18 @@ declare interface CompatibilityFlags {
    * current behavior. `BLANK_IS_NOT_UNSET` in
    * `policies/optional-string-options.spec.ts` lists them with the reason.
    *
+   * A required string option that is empty or whitespace-only fails with a
+   * `ConfigurationError` naming the option when the policy is created, instead
+   * of being sent as a blank credential, host or header. Required options
+   * where an empty value means something (`replace-string-outbound`
+   * `replaceWith`, `set-body-inbound` `body`) are used as given.
+   *
    * @compatibilityDate 2026-11-06
    */
   treatBlankOptionalStringOptionsAsUnset: boolean;
   /**
-   * Whether the MCP Gateway supports MCP protocol revision `2026-07-28`.
+   * Whether the MCP Gateway and `mcpServerHandler` support MCP protocol
+   * revision `2026-07-28`.
    *
    * MCP requests on `2025-11-25` and earlier get the same answers with or
    * without this flag, with one exception: an `initialize` reply the upstream
@@ -343,11 +353,24 @@ declare interface CompatibilityFlags {
    * reading it as `2026-07-28`. An upstream that answers only `server/discover`
    * is reported as unavailable, and a caller that hasn't connected the
    * upstream gets the `-32042` URL-elicitation error, which `2026-07-28`
-   * clients can't act on.
-   *
-   * After this flag: The MCP Gateway handles `2026-07-28` requests as that
-   * revision requires:
-   *
+   * clients can't act on. `mcpServerHandler` refuses a `2026-07-28`
+   * `MCP-Protocol-Version` header with HTTP 400 and `-32000`.
+   *
+   * After this flag: The MCP Gateway and `mcpServerHandler` handle
+   * `2026-07-28` requests as that revision requires:
+   *
+   * - `mcpServerHandler` serves a `2026-07-28` request: `server/discover`,
+   *   the per-request `_meta` envelope and its validation (`-32602`,
+   *   `-32020`, `-32022`), including the required `MCP-Protocol-Version`,
+   *   `Mcp-Method` and `Mcp-Name` headers,
+   *   HTTP `404` with `-32601` for the methods `2026-07-28` removed
+   *   (`initialize`, `ping`, `logging/setLevel`, `resources/subscribe`,
+   *   `resources/unsubscribe`), and `resultType`, `serverInfo` and
+   *   `ttlMs: 0` / `cacheScope: "private"` on its results. An unknown tool,
+   *   prompt or resource gets the MCP SDK's not-found error. The era comes
+   *   from the body, so a request that names `2026-07-28` only in
+   *   `params._meta`, with no header, gets HTTP `400` with `-32020`. The MCP
+   *   capability filter answers a hidden target with the same checks first.
    * - Upstream readiness falls back to `server/discover` when `initialize` is
    *   refused with a JSON-RPC error.
    * - `server/discover` gets the configured icon fallback, and the gateway
@@ -359,10 +382,18 @@ declare interface CompatibilityFlags {
    *   other event is relayed unchanged, and the stream is not buffered.
    * - A caller that hasn't connected the upstream gets an `input_required`
    *   result with a URL-mode connect elicitation (or `-32021` when the client
-   *   didn't declare URL elicitation), not `-32042`. Before the gateway
-   *   answers such a request itself, it refuses one a `2026-07-28` server
-   *   would refuse (`-32602`, `-32020` or `-32022`, HTTP 400), and it accepts
-   *   a notification with `202` and no body.
+   *   didn't declare URL elicitation), not `-32042`. Any other method, the
+   *   list methods included, gets `-32603` with the connect link in
+   *   `data.connectRequired`. Before the gateway answers such a request
+   *   itself, it refuses one a `2026-07-28` server would refuse (`-32602`,
+   *   `-32020` or `-32022`, HTTP 400), a request without a required
+   *   `MCP-Protocol-Version`, `Mcp-Method` or `Mcp-Name` header included, and
+   *   it accepts a notification with `202` and no body. Its own
+   *   `server/discover` answer lists `2026-07-28` and the 2025-era versions
+   *   the route relays through `initialize`.
+   * - A retry's `requestState` with the gateway's `zuplo-connect.` prefix
+   *   that doesn't verify under this deployment's key (another Zuplo
+   *   gateway's, behind this one) is passed to the upstream, not refused.
    * - The capability filter checks the `Mcp-Method` and `Mcp-Name` headers
    *   against the body (`-32020`), answers an unknown method spelling with
    *   HTTP `404`, marks lists and `resources/read` results on routes with
@@ -419,6 +450,97 @@ declare interface CompatibilityFlags {
    * @compatibilityDate 2026-11-06
    */
   rejectInvalidMcpResourceUris: boolean;
+  /**
+   * Whether the MCP Gateway follows the MCP transport, elicitation and
+   * authorization rules for the answers it builds itself on `2025-11-25` and
+   * earlier requests, and in its upstream readiness check.
+   *
+   * Before this flag:
+   *
+   * - A caller that hasn't connected the upstream gets a JSON-RPC error with
+   *   HTTP 200 for every message: `-32042` with a URL-mode elicitation when
+   *   the gateway has a connect URL, `-32600` when it doesn't. That includes
+   *   a notification or a JSON-RPC response (answered with an error that has
+   *   no `id`), an `initialize`, a client that never declared URL-mode
+   *   elicitation, and a client on a protocol version before `2025-11-25`,
+   *   which has no URL mode.
+   * - When the upstream still answers 401 after the gateway refreshed its
+   *   credential (or the gateway could not retry), and when it answers 403
+   *   with a `WWW-Authenticate` challenge, the client gets the upstream's
+   *   response, `WWW-Authenticate` included. The challenge points at the
+   *   upstream's authorization server, and the client reads the 401 as its
+   *   own gateway token failing.
+   * - The readiness check ends the upstream session it opened with
+   *   `MCP-Protocol-Version: 2025-11-25`, whatever version the upstream
+   *   negotiated.
+   *
+   * After this flag:
+   *
+   * - A request from a caller that hasn't connected the upstream is first
+   *   checked as `mcpServerHandler` checks it: a body that is not JSON (an
+   *   empty one included) gets HTTP `400` `-32700`, a message that is not
+   *   valid JSON-RPC `400` `-32600`, an `initialize` batched with other
+   *   messages `400` `-32600`, and an `MCP-Protocol-Version` the route does
+   *   not serve `400` `-32000` (a missing header is allowed; the route
+   *   serves its upstream's versions once the gateway has learned them). A
+   *   batch on `2025-06-18` or later is refused whole with `400` `-32600`.
+   * - A valid notification or JSON-RPC response is accepted with `202` and
+   *   no body, and dropped. `ping` gets an empty result. A `2025-03-26`
+   *   batch is answered per member.
+   * - The `-32042` URL-elicitation error is sent only to an `initialize` that
+   *   names `2025-11-25` (and not `2026-07-28` or later) and declares
+   *   `capabilities.elicitation.url`: the gateway keeps no session, so it
+   *   cannot know what a later request's client declared. Every other
+   *   connect-required answer is `-32603` with the connect link in
+   *   `data.connectRequired`, never `-32600`.
+   * - On a request the token exchange policy sent with the gateway's own
+   *   upstream credential, an upstream 401 the refresh did not fix, or an
+   *   upstream 403 with a `WWW-Authenticate` challenge, is answered by the
+   *   gateway with JSON-RPC `-32603` (`data.upstreamStatus`) and no
+   *   `WWW-Authenticate`; a message without a request gets HTTP `502` with
+   *   the error and no id. A route without the policy relays the challenge.
+   * - The readiness check ends the session with the version the upstream
+   *   negotiated in its `initialize` result.
+   * - The MCP capability filter answers a 2025-era request for a hidden
+   *   target as `mcpServerHandler` answers an absent one: its `406`, `415`,
+   *   invalid-message and batched-`initialize` `400`s and unsupported-version
+   *   `400` first, then a mistyped `arguments` `-32602`, then the not-found.
+   * - On a `2026-07-28` request (with `mcpProtocolVersion20260728`), a method
+   *   2026-07-28 removed (`ping`, `logging/setLevel`, …) gets `404`
+   *   `-32601` from the gateway instead of the connect-required error.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  mcpGatewaySpecCompliance: boolean;
+  /**
+   * Whether the MCP server handler checks the results and requests that MCP
+   * 2025-11-25 constrains and the handler did not check.
+   *
+   * Before this flag:
+   *
+   * - `prompts/get` returns the prompt route's messages as the route sent
+   *   them, so a `role` other than `user` or `assistant` (such as
+   *   `"system"`) or an invalid content block reaches the client.
+   * - A JSON-RPC batch (allowed on `2025-03-26` and earlier) whose answer has
+   *   one response gets that response as a bare object, not an array.
+   * - A tool from the deprecated `options.files` whose `x-zuplo-mcp-tool`
+   *   name is blank is registered with the name `""`.
+   *
+   * After this flag:
+   *
+   * - `prompts/get` answers JSON-RPC `-32603` naming the prompt and the first
+   *   invalid message when a message's `role` is not `user` or `assistant`,
+   *   or its `content` is not a content block the request's protocol version
+   *   defines (`audio` from `2025-03-26`, `resource_link` from `2025-06-18`).
+   *   A prompt message's `annotations.lastModified` may be any string, as
+   *   every revision's schema types it.
+   * - Every answer to a batch is an array.
+   * - A blank tool name falls back to the operationId, as on every other
+   *   path.
+   *
+   * @compatibilityDate 2026-11-06
+   */
+  mcpServerSpecCompliance: boolean;
 }
 
 /**

package/out/types/mcp-gateway/index.d.ts

@@ -2925,6 +2925,46 @@ export declare function McpProxyHandler(
   context: ZuploContext
 ): Promise<Response>;
 
+/**
+ * OpenTelemetry options for the MCP Gateway's `McpProxyHandler`, set under
+ * `telemetry` in the route's handler options. The same options as the MCP
+ * Server handler's `telemetry`.
+ */
+export declare interface McpProxyHandlerTelemetryOptions {
+  /**
+   * Record tool call content on the MCP SERVER and CLIENT spans of a
+   * forwarded `tools/call`: the arguments the client sent as
+   * `gen_ai.tool.call.arguments` and, when the upstream returns a result
+   * without `isError: true`, that result as `gen_ai.tool.call.result`. Both
+   * are JSON strings capped at 8192 UTF-16 code units.
+   *
+   * Off by default. Tool arguments and results often contain personal or
+   * otherwise sensitive data, and enabling this sends them to your telemetry
+   * backend.
+   *
+   * The gateway records content only for a `tools/call` it forwards upstream.
+   * A call a gateway policy answers itself (for example, by asking the client
+   * to connect the upstream) records neither attribute. A result is recorded
+   * when the JSON response, or the SSE event that carries it, is 1 MiB or
+   * less; a larger result is forwarded to the client but not recorded.
+   *
+   * @example
+   * ```json
+   * {
+   *   "handler": {
+   *     "export": "McpProxyHandler",
+   *     "module": "$import(@zuplo/runtime/mcp-gateway)",
+   *     "options": {
+   *       "rewritePattern": "https://mcp.example.com/mcp",
+   *       "telemetry": { "captureToolCallContent": true }
+   *     }
+   *   }
+   * }
+   * ```
+   */
+  captureToolCallContent?: boolean;
+}
+
 /**
  * Resolve a gateway-managed upstream MCP credential and apply it to the
  * request before the normal Zuplo route handler forwards the request.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.14.5",
+  "version": "7.14.8",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/out/esm/chunk-7RNZS3GX.js

@@ -1,26 +0,0 @@
-
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) Zuplo, Inc. All rights reserved.
- *
- *  This software and associated documentation files (the "Software") is intended to be used
- *  only by Zuplo customers solely to develop and test applications that will be deployed
- *  to Zuplo hosted services. You and others in your organization may use these files on your
- *  Development Devices solely for the above stated purpose.
- *
- *  Outside of uses stated above, no license is granted for any other purpose including
- *  without limitation the rights to use, copy, modify, merge, publish, distribute,
- *  sublicense, host, and/or sell copies of the Software.
- *
- *  The software may include third party components with separate legal notices or governed by
- *  other agreements, as described in licenses either embedded in or accompanying the Software.
- *
- *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, 
- *  INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR 
- *  PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE 
- *  FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR 
- *  OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER 
- *  DEALINGS IN THE SOFTWARE.
- *--------------------------------------------------------------------------------------------*/
-    
-import{a as g}from"./chunk-A3QGJZO7.js";import{$ as T}from"./chunk-UFTMOJ7K.js";import{a as r}from"./chunk-TYV53J3B.js";var P=class e extends Request{static{r(this,"ZuploRequest")}#t=void 0;#e;#n;constructor(t,n,s){super(t,n);let o=n?.params;this.#n=s,o?this.#e=o:t instanceof e?this.#e=t.#e:this.#e={};let a=n?.user;a?this.user=a:t instanceof e&&(this.user=t.user)}get originalRequest(){return this.#n??null}get query(){if(this.#t===void 0){let t={},n=new URL(this.url).searchParams;for(let[s,o]of n.entries())t[s]=o;this.#t=t}return g(this.#t)}get params(){return g(this.#e)}user};function h(){return T.instance.build.COMPATIBILITY_FLAGS.mcpProtocolVersion20260728===!0}r(h,"isMcp20260728Enabled");var S="2026-07-28",A="io.modelcontextprotocol/protocolVersion",U="io.modelcontextprotocol/clientCapabilities",B="io.modelcontextprotocol/clientInfo",W="io.modelcontextprotocol/serverInfo";var Q=/^\d{4}-\d{2}-\d{2}$/;function I(e){return typeof e=="string"&&Q.test(e)&&e>=S}r(I,"isModernProtocolVersion");function f(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}r(f,"isRecord");function k(e){if(!f(e)||!f(e.params))return;let t=e.params._meta;return f(t)?t:void 0}r(k,"readRequestMeta");function L(e){let t=k(e)?.[A];return typeof t=="string"?t:void 0}r(L,"readEnvelopeProtocolVersion");function Z(e){let t=k(e)?.[U];return f(t)?t:void 0}r(Z,"readEnvelopeClientCapabilities");function x(e,t){if(Array.isArray(t))return!1;let n=e.get("mcp-protocol-version"),s=L(t);return n!==null&&I(n)||s!==void 0&&I(s)}r(x,"isModernMcpRequest");var X="zuplo_upstream_connect";var M="2.0",R=-32600,N=-32602,se=-32603,re=-32001,b=10*1024*1024;function c(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}r(c,"isRecord");function y(e){return typeof e=="string"||typeof e=="number"}r(y,"isRequestId");function p(e){return e===null?"null":Array.isArray(e)?"an array":typeof e=="object"?"an object":typeof e=="string"?JSON.stringify(e.length>40?`${e.slice(0,40)}\u2026`:e):String(e)}r(p,"describeValue");function i(e){if(!(e===void 0||c(e)))return`params must be an object when present (got ${p(e)}).`}r(i,"optionalObjectParams");function u(e,t){return n=>{if(!c(n))return`params must be an object with a string \`${e}\` (got ${p(n)}). Example: ${t}`;if(typeof n[e]!="string")return`params.${e} must be a string (got ${p(n[e])}). Example: ${t}`}}r(u,"requireStringField");var v={initialize:i,ping:i,"tools/list":i,"tools/call":u("name",'{"name":"my_tool","arguments":{}}'),"prompts/list":i,"prompts/get":u("name",'{"name":"my_prompt"}'),"resources/list":i,"resources/templates/list":i,"resources/read":u("uri",'{"uri":"file:///a.txt"}'),"resources/subscribe":u("uri",'{"uri":"file:///a.txt"}'),"resources/unsubscribe":u("uri",'{"uri":"file:///a.txt"}'),"completion/complete":i,"logging/setLevel":u("level",'{"level":"info"}'),"server/discover":i,"subscriptions/listen":i,"tasks/get":u("taskId",'{"taskId":"task-123"}'),"tasks/update":u("taskId",'{"taskId":"task-123"}'),"tasks/cancel":u("taskId",'{"taskId":"task-123"}')},C={"notifications/initialized":i,"notifications/cancelled":i,"notifications/progress":i,"notifications/roots/list_changed":i,"notifications/subscriptions/acknowledged":i},j=new Set(["server/discover","subscriptions/listen","tasks/get","tasks/update","tasks/cancel"]),$=new Set(["notifications/subscriptions/acknowledged"]);function V(e,t){return Object.hasOwn(v,e)&&(t||!j.has(e))}r(V,"isKnownRequestMethod");function w(e,t){return Object.hasOwn(C,e)&&(t||!$.has(e))}r(w,"isKnownNotificationMethod");function l(e){return{type:"invalid",...e.method===void 0?{}:{method:e.method},id:e.id,error:{code:e.code,message:e.message},raw:e.raw}}r(l,"invalidMessage");function m(e){return y(e)?e:null}r(m,"usableId");function K(e,t,n,s){if(V(t,s)){let o=v[t](e.params);if(o!==void 0)return l({raw:e,method:t,id:n,code:N,message:`Invalid params for \`${t}\`: ${o}`});let a=e.params===void 0?{}:e.params;return{type:"request",method:t,id:n,params:a,raw:e}}return{type:"request",method:t,id:n,params:e.params,raw:e}}r(K,"classifyRequest");function Y(e,t,n){if(w(t,n)){let s=C[t](e.params);if(s!==void 0)return l({raw:e,method:t,id:null,code:N,message:`Invalid params for \`${t}\`: ${s}`});let o=e.params===void 0?{}:e.params;return{type:"notification",method:t,params:o,raw:e}}return{type:"notification",method:t,params:e.params,raw:e}}r(Y,"classifyNotification");function _(e,t=!1){if(!c(e)||e.jsonrpc!==M)return l({raw:e,id:m(c(e)?e.id:void 0),code:R,message:`Invalid Request: batch member is not a JSON-RPC 2.0 message (got ${p(e)}). Every member must include \`"jsonrpc":"2.0"\`.`});let n=e.method;if(typeof n=="string"){if(!("id"in e))return Y(e,n,t);let s=e.id;return y(s)?K(e,n,s,t):l({raw:e,method:n,id:null,code:R,message:`Invalid Request: request id must be a string or number (got ${p(s)}). The gateway cannot correlate a reply to this id \u2014 omit \`id\` to send a notification instead.`})}if(n!==void 0)return l({raw:e,id:m(e.id),code:R,message:`Invalid Request: method must be a string (got ${p(n)}).`});if("result"in e&&y(e.id)&&c(e.result))return{type:"result",id:e.id,result:e.result,raw:e};if("error"in e){let s=e.error;if(c(s)&&typeof s.code=="number"&&typeof s.message=="string"){let o={code:s.code,message:s.message,...s.data===void 0?{}:{data:s.data}};return{type:"error",id:m(e.id),error:o,raw:e}}}return l({raw:e,id:m(e.id),code:R,message:"Invalid Request: message has no `method` and is not a valid JSON-RPC result or error."})}r(_,"classifyMember");var D=new WeakMap,q=new WeakMap;function oe(e){return q.get(e)}r(oe,"getEnvelopeText");async function G(e){let t=e.headers.get("content-type");if(t===null||!t.toLowerCase().includes("json"))return null;let n=e.headers.get("content-length");if(n!==null&&Number(n)>b)return null;let s;try{s=await e.clone().text()}catch{return null}if(s.length>b)return null;let o;try{o=JSON.parse(s)}catch{return null}let a=e.headers.get("mcp-protocol-version");if(Array.isArray(o)){if(o.length>0&&!o.some(d=>c(d)&&d.jsonrpc===M))return null;let O={transport:"json",shape:"batch",messages:o.map(d=>_(d)),...a===null?{}:{protocolVersion:a}};return q.set(O,s),O}if(!c(o)||o.jsonrpc!==M)return null;let E={transport:"json",shape:"single",messages:[_(o,h()&&x(e.headers,o))],...a===null?{}:{protocolVersion:a}};return q.set(E,s),E}r(G,"parseEnvelope");function ie(e){let t=D.get(e);return t===void 0&&(t=G(e),D.set(e,t)),t}r(ie,"getRequest");export{P as a,h as b,S as c,A as d,U as e,B as f,W as g,I as h,L as i,Z as j,x as k,X as l,M as m,R as n,se as o,re as p,c as q,y as r,oe as s,ie as t};
-//# sourceMappingURL=chunk-7RNZS3GX.js.map

package/out/esm/chunk-7RNZS3GX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["@zuplo/runtime/request.ts","@zuplo/runtime/mcp-gateway/v2/runtime-utils/mcp-modern-protocol.ts","@zuplo/runtime/mcp/messages/parse.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;wHA0JO,IAAMA,EAAN,MAAMC,UAEH,OAAQ,CA5JlB,MA4JkB,CAAAC,EAAA,qBAChBC,GAAkD,OAClDC,GACAC,GAEA,YACEC,EACAC,EACAC,EACA,CACA,MAAMF,EAAOC,CAAI,EACjB,IAAME,EAASF,GAAM,OACrB,KAAKF,GAAmBG,EAIpBC,EACF,KAAKL,GAAUK,EACNH,aAAiBL,EAC1B,KAAKG,GAAUE,EAAMF,GAErB,KAAKA,GAAU,CAAC,EAGlB,IAAMM,EAAOH,GAAM,KACfG,EACF,KAAK,KAAOA,EACHJ,aAAiBL,IAC1B,KAAK,KAAOK,EAAM,KAEtB,CAWA,IAAI,iBAAkC,CACpC,OAAO,KAAKD,IAAoB,IAClC,CAeA,IAAI,OAA0D,CAE5D,GAAI,KAAKF,KAAW,OAAW,CAC7B,IAAMQ,EAA6B,CAAC,EAE9BC,EAAe,IAAI,IAAI,KAAK,GAAG,EAAE,aAEvC,OAAW,CAACC,EAAKC,CAAK,IAAKF,EAAa,QAAQ,EAC9CD,EAAME,CAAG,EAAIC,EAEf,KAAKX,GAASQ,CAChB,CAEA,OAAOI,EAAW,KAAKZ,EAAgD,CACzE,CAiBA,IAAI,QAA6D,CAC/D,OAAOY,EAAW,KAAKX,EAAO,CAChC,CAgBA,IACF,ECnPO,SAASY,GAAgC,CAC9C,OACEC,EAAY,SAAS,MAAM,oBACxB,6BAA+B,EAEtC,CALgBC,EAAAF,EAAA,wBAQT,IAAMG,EAA8B,aAG9BC,EACX,0CAEWC,EACX,6CAEWC,EAA2B,qCAE3BC,EAA2B,qCAMxC,IAAMC,EAA4B,sBAS3B,SAASC,EAAwBC,EAA2B,CACjE,OACE,OAAOA,GAAY,UACnBF,EAA0B,KAAKE,CAAO,GACtCA,GAAWC,CAEf,CANgBC,EAAAH,EAAA,2BAQhB,SAASI,EAASC,EAAkD,CAClE,OAAOA,IAAU,MAAQ,OAAOA,GAAU,UAAY,CAAC,MAAM,QAAQA,CAAK,CAC5E,CAFSF,EAAAC,EAAA,YAKT,SAASE,EACPC,EACqC,CACrC,GAAI,CAACH,EAASG,CAAO,GAAK,CAACH,EAASG,EAAQ,MAAM,EAChD,OAEF,IAAMC,EAAOD,EAAQ,OAAO,MAC5B,OAAOH,EAASI,CAAI,EAAIA,EAAO,MACjC,CARSL,EAAAG,EAAA,mBAcF,SAASG,EACdF,EACoB,CACpB,IAAMN,EAAUK,EAAgBC,CAAO,IAAIG,CAA6B,EACxE,OAAO,OAAOT,GAAY,SAAWA,EAAU,MACjD,CALgBE,EAAAM,EAAA,+BAWT,SAASE,EACdJ,EACqC,CACrC,IAAMK,EACJN,EAAgBC,CAAO,IAAIM,CAAgC,EAC7D,OAAOT,EAASQ,CAAY,EAAIA,EAAe,MACjD,CANgBT,EAAAQ,EAAA,kCAkBT,SAASG,EACdC,EACAR,EACS,CACT,GAAI,MAAM,QAAQA,CAAO,EACvB,MAAO,GAET,IAAMS,EAASD,EAAQ,IAAI,sBAAsB,EAC3CE,EAAQR,EAA4BF,CAAO,EACjD,OACGS,IAAW,MAAQhB,EAAwBgB,CAAM,GACjDC,IAAU,QAAajB,EAAwBiB,CAAK,CAEzD,CAbgBd,EAAAW,EAAA,sBAsBT,IAAMI,EAA4B,yBCpHlC,IAAMC,EAAkB,MAGlBC,EAAkB,OAClBC,EAAiB,OACjBC,GAAiB,OAEjBC,GAAgB,OAQvBC,EAAiB,GAAK,KAAO,KAE5B,SAASC,EAASC,EAAkD,CACzE,OAAOA,IAAU,MAAQ,OAAOA,GAAU,UAAY,CAAC,MAAM,QAAQA,CAAK,CAC5E,CAFgBC,EAAAF,EAAA,YAIT,SAASG,EAAYF,EAAuC,CACjE,OAAO,OAAOA,GAAU,UAAY,OAAOA,GAAU,QACvD,CAFgBC,EAAAC,EAAA,eAIhB,SAASC,EAAcH,EAAwB,CAC7C,OAAIA,IAAU,KACL,OAEL,MAAM,QAAQA,CAAK,EACd,WAEL,OAAOA,GAAU,SACZ,YAEL,OAAOA,GAAU,SACZ,KAAK,UAAUA,EAAM,OAAS,GAAK,GAAGA,EAAM,MAAM,EAAG,EAAE,CAAC,SAAMA,CAAK,EAErE,OAAOA,CAAK,CACrB,CAdSC,EAAAE,EAAA,iBAyBT,SAASC,EAAqBC,EAAqC,CACjE,GAAI,EAAAA,IAAW,QAAaN,EAASM,CAAM,GAG3C,MAAO,8CAA8CF,EAAcE,CAAM,CAAC,IAC5E,CALSJ,EAAAG,EAAA,wBAOT,SAASE,EAAmBC,EAAeC,EAA8B,CACvE,OAAQH,GAAW,CACjB,GAAI,CAACN,EAASM,CAAM,EAClB,MACE,4CAA4CE,CAAK,WACzCJ,EAAcE,CAAM,CAAC,eAAeG,CAAO,GAGvD,GAAI,OAAOH,EAAOE,CAAK,GAAM,SAC3B,MACE,UAAUA,CAAK,0BACPJ,EAAcE,EAAOE,CAAK,CAAC,CAAC,eAAeC,CAAO,EAIhE,CACF,CAhBSP,EAAAK,EAAA,sBAkBT,IAAMG,EAA8D,CAClE,WAAYL,EACZ,KAAMA,EACN,aAAcA,EACd,aAAcE,EAAmB,OAAQ,mCAAmC,EAC5E,eAAgBF,EAChB,cAAeE,EAAmB,OAAQ,sBAAsB,EAChE,iBAAkBF,EAClB,2BAA4BA,EAC5B,iBAAkBE,EAAmB,MAAO,yBAAyB,EACrE,sBAAuBA,EAAmB,MAAO,yBAAyB,EAC1E,wBAAyBA,EAAmB,MAAO,yBAAyB,EAC5E,sBAAuBF,EACvB,mBAAoBE,EAAmB,QAAS,kBAAkB,EAOlE,kBAAmBF,EACnB,uBAAwBA,EAGxB,YAAaE,EAAmB,SAAU,uBAAuB,EACjE,eAAgBA,EAAmB,SAAU,uBAAuB,EACpE,eAAgBA,EAAmB,SAAU,uBAAuB,CACtE,EAEMI,EAAwE,CAC5E,4BAA6BN,EAC7B,0BAA2BA,EAC3B,yBAA0BA,EAC1B,mCAAoCA,EAGpC,2CAA4CA,CAC9C,EASMO,EAAmD,IAAI,IAAI,CAC/D,kBACA,uBACA,YACA,eACA,cACF,CAAC,EACKC,EAAwD,IAAI,IAAI,CACpE,0CACF,CAAC,EAED,SAASC,EACPC,EACAC,EAC4B,CAC5B,OACE,OAAO,OAAON,EAAsBK,CAAM,IACzCC,GAAU,CAACJ,EAA4B,IAAIG,CAAM,EAEtD,CARSb,EAAAY,EAAA,wBAUT,SAASG,EACPF,EACAC,EACiC,CACjC,OACE,OAAO,OAAOL,EAA2BI,CAAM,IAC9CC,GAAU,CAACH,EAAiC,IAAIE,CAAM,EAE3D,CARSb,EAAAe,EAAA,6BAUT,SAASC,EAAeC,EAMT,CACb,MAAO,CACL,KAAM,UACN,GAAIA,EAAM,SAAW,OAAY,CAAC,EAAI,CAAE,OAAQA,EAAM,MAAO,EAC7D,GAAIA,EAAM,GACV,MAAO,CAAE,KAAMA,EAAM,KAAM,QAASA,EAAM,OAAQ,EAClD,IAAKA,EAAM,GACb,CACF,CAdSjB,EAAAgB,EAAA,kBAgBT,SAASE,EAASnB,EAAqC,CACrD,OAAOE,EAAYF,CAAK,EAAIA,EAAQ,IACtC,CAFSC,EAAAkB,EAAA,YAIT,SAASC,EACPC,EACAP,EACAQ,EACAP,EACY,CACZ,GAAIF,EAAqBC,EAAQC,CAAM,EAAG,CACxC,IAAMQ,EAAUd,EAAqBK,CAAM,EAAEO,EAAI,MAAM,EACvD,GAAIE,IAAY,OACd,OAAON,EAAe,CACpB,IAAAI,EACA,OAAAP,EACA,GAAAQ,EACA,KAAM3B,EACN,QAAS,wBAAwBmB,CAAM,OAAOS,CAAO,EACvD,CAAC,EAIH,IAAMlB,EAASgB,EAAI,SAAW,OAAY,CAAC,EAAIA,EAAI,OACnD,MAAO,CACL,KAAM,UACN,OAAAP,EACA,GAAAQ,EACA,OAAAjB,EACA,IAAAgB,CACF,CACF,CAIA,MAAO,CACL,KAAM,UACN,OAAAP,EACA,GAAAQ,EACA,OAAQD,EAAI,OACZ,IAAAA,CACF,CACF,CAtCSpB,EAAAmB,EAAA,mBAwCT,SAASI,EACPH,EACAP,EACAC,EACY,CACZ,GAAIC,EAA0BF,EAAQC,CAAM,EAAG,CAC7C,IAAMQ,EAAUb,EAA0BI,CAAM,EAAEO,EAAI,MAAM,EAC5D,GAAIE,IAAY,OACd,OAAON,EAAe,CACpB,IAAAI,EACA,OAAAP,EACA,GAAI,KACJ,KAAMnB,EACN,QAAS,wBAAwBmB,CAAM,OAAOS,CAAO,EACvD,CAAC,EAEH,IAAMlB,EAASgB,EAAI,SAAW,OAAY,CAAC,EAAIA,EAAI,OACnD,MAAO,CACL,KAAM,eACN,OAAAP,EACA,OAAAT,EACA,IAAAgB,CACF,CACF,CACA,MAAO,CACL,KAAM,eACN,OAAAP,EACA,OAAQO,EAAI,OACZ,IAAAA,CACF,CACF,CA9BSpB,EAAAuB,EAAA,wBAqCF,SAASC,EAAeJ,EAAcN,EAAS,GAAmB,CACvE,GAAI,CAAChB,EAASsB,CAAG,GAAKA,EAAI,UAAY5B,EACpC,OAAOwB,EAAe,CACpB,IAAAI,EACA,GAAIF,EAASpB,EAASsB,CAAG,EAAIA,EAAI,GAAK,MAAS,EAC/C,KAAM3B,EACN,QACE,oEACQS,EAAckB,CAAG,CAAC,mDAE9B,CAAC,EAGH,IAAMP,EAASO,EAAI,OACnB,GAAI,OAAOP,GAAW,SAAU,CAC9B,GAAI,EAAE,OAAQO,GACZ,OAAOG,EAAqBH,EAAKP,EAAQC,CAAM,EAEjD,IAAMO,EAAKD,EAAI,GACf,OAAKnB,EAAYoB,CAAE,EAYZF,EAAgBC,EAAKP,EAAQQ,EAAIP,CAAM,EAXrCE,EAAe,CACpB,IAAAI,EACA,OAAAP,EACA,GAAI,KACJ,KAAMpB,EACN,QACE,+DACQS,EAAcmB,CAAE,CAAC,uGAE7B,CAAC,CAGL,CAEA,GAAIR,IAAW,OACb,OAAOG,EAAe,CACpB,IAAAI,EACA,GAAIF,EAASE,EAAI,EAAE,EACnB,KAAM3B,EACN,QACE,iDACQS,EAAcW,CAAM,CAAC,IACjC,CAAC,EAKH,GAAI,WAAYO,GAAOnB,EAAYmB,EAAI,EAAE,GAAKtB,EAASsB,EAAI,MAAM,EAC/D,MAAO,CACL,KAAM,SACN,GAAIA,EAAI,GACR,OAAQA,EAAI,OACZ,IAAAA,CACF,EAEF,GAAI,UAAWA,EAAK,CAClB,IAAMK,EAAQL,EAAI,MAClB,GACEtB,EAAS2B,CAAK,GACd,OAAOA,EAAM,MAAS,UACtB,OAAOA,EAAM,SAAY,SACzB,CACA,IAAMC,EAAyB,CAC7B,KAAMD,EAAM,KACZ,QAASA,EAAM,QACf,GAAIA,EAAM,OAAS,OAAY,CAAC,EAAI,CAAE,KAAMA,EAAM,IAAK,CACzD,EACA,MAAO,CACL,KAAM,QACN,GAAIP,EAASE,EAAI,EAAE,EACnB,MAAOM,EACP,IAAAN,CACF,CACF,CACF,CAEA,OAAOJ,EAAe,CACpB,IAAAI,EACA,GAAIF,EAASE,EAAI,EAAE,EACnB,KAAM3B,EACN,QACE,uFAEJ,CAAC,CACH,CApFgBO,EAAAwB,EAAA,kBAsFhB,IAAMG,EAAgB,IAAI,QAGpBC,EAAe,IAAI,QAQlB,SAASC,GAAgBC,EAA2C,CACzE,OAAOF,EAAa,IAAIE,CAAQ,CAClC,CAFgB9B,EAAA6B,GAAA,mBAIhB,eAAeE,EAAcC,EAA+C,CAC1E,IAAMC,EAAcD,EAAQ,QAAQ,IAAI,cAAc,EACtD,GAAIC,IAAgB,MAAQ,CAACA,EAAY,YAAY,EAAE,SAAS,MAAM,EACpE,OAAO,KAET,IAAMC,EAAgBF,EAAQ,QAAQ,IAAI,gBAAgB,EAC1D,GAAIE,IAAkB,MAAQ,OAAOA,CAAa,EAAIrC,EACpD,OAAO,KAGT,IAAIsC,EACJ,GAAI,CACFA,EAAO,MAAMH,EAAQ,MAAM,EAAE,KAAK,CACpC,MAAQ,CACN,OAAO,IACT,CACA,GAAIG,EAAK,OAAStC,EAChB,OAAO,KAGT,IAAIuC,EACJ,GAAI,CACFA,EAAO,KAAK,MAAMD,CAAI,CACxB,MAAQ,CACN,OAAO,IACT,CAEA,IAAME,EAAkBL,EAAQ,QAAQ,IAAI,sBAAsB,EAElE,GAAI,MAAM,QAAQI,CAAI,EAAG,CAIvB,GACEA,EAAK,OAAS,GACd,CAACA,EAAK,KACHE,GAAWxC,EAASwC,CAAM,GAAKA,EAAO,UAAY9C,CACrD,EAEA,OAAO,KAET,IAAMsC,EAAwB,CAC5B,UAAW,OACX,MAAO,QAEP,SAAUM,EAAK,IAAKE,GAAWd,EAAec,CAAM,CAAC,EACrD,GAAID,IAAoB,KAAO,CAAC,EAAI,CAAE,gBAAAA,CAAgB,CACxD,EACA,OAAAT,EAAa,IAAIE,EAAUK,CAAI,EACxBL,CACT,CAEA,GAAI,CAAChC,EAASsC,CAAI,GAAKA,EAAK,UAAY5C,EACtC,OAAO,KAET,IAAMsC,EAAwB,CAC5B,UAAW,OACX,MAAO,SACP,SAAU,CACRN,EACEY,EACAG,EAAqB,GAAKC,EAAmBR,EAAQ,QAASI,CAAI,CACpE,CACF,EACA,GAAIC,IAAoB,KAAO,CAAC,EAAI,CAAE,gBAAAA,CAAgB,CACxD,EACA,OAAAT,EAAa,IAAIE,EAAUK,CAAI,EACxBL,CACT,CApEe9B,EAAA+B,EAAA,iBAkFR,SAASU,GAAWT,EAA+C,CACxE,IAAIU,EAASf,EAAc,IAAIK,CAAO,EACtC,OAAIU,IAAW,SACbA,EAASX,EAAcC,CAAO,EAC9BL,EAAc,IAAIK,EAASU,CAAM,GAE5BA,CACT,CAPgB1C,EAAAyC,GAAA","names":["ZuploRequest","_ZuploRequest","__name","#query","#params","#originalRequest","input","init","originalRequest","params","user","query","searchParams","key","value","deepFreeze","isMcp20260728Enabled","Environment","__name","MCP_MODERN_PROTOCOL_VERSION","MCP_PROTOCOL_VERSION_META_KEY","MCP_CLIENT_CAPABILITIES_META_KEY","MCP_CLIENT_INFO_META_KEY","MCP_SERVER_INFO_META_KEY","PROTOCOL_REVISION_PATTERN","isModernProtocolVersion","version","MCP_MODERN_PROTOCOL_VERSION","__name","isRecord","value","readRequestMeta","message","meta","readEnvelopeProtocolVersion","MCP_PROTOCOL_VERSION_META_KEY","readEnvelopeClientCapabilities","capabilities","MCP_CLIENT_CAPABILITIES_META_KEY","isModernMcpRequest","headers","header","claim","CONNECT_INPUT_REQUEST_KEY","JSONRPC_VERSION","INVALID_REQUEST","INVALID_PARAMS","INTERNAL_ERROR","NOT_PROCESSED","MAX_BODY_CHARS","isRecord","value","__name","isRequestId","describeValue","optionalObjectParams","params","requireStringField","field","example","REQUEST_PARAM_CHECKS","NOTIFICATION_PARAM_CHECKS","MODERN_ONLY_REQUEST_METHODS","MODERN_ONLY_NOTIFICATION_METHODS","isKnownRequestMethod","method","modern","isKnownNotificationMethod","invalidMessage","input","usableId","classifyRequest","raw","id","problem","classifyNotification","classifyMember","error","detail","envelopeCache","envelopeText","getEnvelopeText","envelope","parseEnvelope","request","contentType","contentLength","text","body","protocolVersion","member","isMcp20260728Enabled","isModernMcpRequest","getRequest","cached"]}