@agentproto/auth 1.0.2 → 1.0.3

package/dist/index.d.ts

@@ -569,7 +569,10 @@ type AuthMethod = "oauth-bearer" | "api-key";
  *  {@link AuthProfile.models}) services every model the profile is otherwise
  *  eligible for — today's behavior. `mode: "allow"` narrows the profile to
  *  exactly `ids`: it services a model only when the model's catalog identity
- *  (its `vendor/product` or its route-qualified `ref`) is in the list. The
+ *  — its route-qualified `ref` (`z-ai/glm-5.2@openrouter`), its
+ *  route-independent `vendor/product` (`z-ai/glm-5.2`), or (DIRECT routes
+ *  only) the bare product (`claude-opus-4-8`) — is in the list; see
+ *  `profileAllowsModel` in `catalog-models.ts` for the exact match rule. The
  *  intersection is applied INSIDE the catalog eligibility join
  *  (`catalog-models.ts`), never at the endpoint/method predicate here, so a
  *  curated profile stays endpoint-eligible but only makes its chosen model

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentproto/auth",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "@agentproto/auth — AIP-50 AUTH.md reference implementation. Auth-provider doctype: how CLI tools and agents authenticate to API servers via a standardized discovery chain and pluggable flow engines, aligned to the WorkOS auth.md open standard.",
   "keywords": [
     "agentproto",
@@ -43,7 +43,7 @@
   },
   "dependencies": {
     "gray-matter": "^4.0.3",
-    "zod": "^4.5.4",
+    "zod": "^4.6.5",
     "@agentproto/define-doctype": "0.1.2"
   },
   "devDependencies": {