@zuplo/cli 6.70.56 → 6.70.59

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -7115,8 +7115,10 @@ export declare interface MTLSAuthMetadata {
   notAfter: string;
   /**
    * Certificate SHA-256 fingerprint formatted as uppercase colon-separated hex.
+   * Omitted when the upstream proxy did not provide the fingerprint and the
+   * full certificate body is unavailable.
    */
-  sha256Fingerprint: string;
+  sha256Fingerprint?: string;
 }
 
 declare interface MultiRequests {

package/node_modules/@zuplo/runtime/out/types/mcp-gateway/index.d.ts

@@ -1382,6 +1382,8 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
  * ```
  */
 export declare class McpGatewayPlugin extends SystemRuntimePlugin {
+  #private;
+  constructor(options?: McpGatewayPluginOptions);
   registerRoutes(options: {
     router: Router;
     runtimeSettings: RuntimeSettings;
@@ -1389,6 +1391,32 @@ export declare class McpGatewayPlugin extends SystemRuntimePlugin {
   }): void;
 }
 
+/**
+ * Options for the {@link McpGatewayPlugin}.
+ *
+ * @beta
+ */
+export declare interface McpGatewayPluginOptions {
+  /**
+   * Base path under which the gateway mounts its internal OAuth and
+   * upstream-connection action routes (e.g. `/oauth/token`,
+   * `/auth/connections/{id}/connect`). Namespacing these routes keeps them out
+   * of your API's route namespace so a route such as `/oauth/token` in
+   * `routes.oas.json` does not collide with the gateway's own endpoints.
+   *
+   * The OAuth discovery documents
+   * (`/.well-known/oauth-authorization-server` and
+   * `/.well-known/oauth-protected-resource/...`) always remain at the origin
+   * root, because RFC 8414 / RFC 9728 locate them relative to the gateway
+   * issuer; only the action routes move under `basePath`.
+   *
+   * Pass `"/"` to mount the action routes at the origin root.
+   *
+   * @default "/__zuplo"
+   */
+  basePath?: string;
+}
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Google.

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.70.56",
+  "version": "6.70.59",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/hasown/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v2.0.4](https://github.com/inspect-js/hasOwn/compare/v2.0.3...v2.0.4) - 2026-05-28
+
+### Commits
+
+- [types] drop the dead key-narrowing overload [`fdab00e`](https://github.com/inspect-js/hasOwn/commit/fdab00e2703e65411424e19bf86a7e72a8f10da9)
+- [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint` [`91f6247`](https://github.com/inspect-js/hasOwn/commit/91f624768dd0f7db0d019b89d4d86bd66e20ec30)
+
 ## [v2.0.3](https://github.com/inspect-js/hasOwn/compare/v2.0.2...v2.0.3) - 2026-04-17
 
 ### Commits

package/node_modules/hasown/index.d.ts

@@ -1,4 +1,3 @@
-declare function hasOwn<O, K extends PropertyKey>(o: O, p: K): p is K & keyof O;
 declare function hasOwn<O, K extends PropertyKey, V = unknown>(o: O, p: K): o is O & Record<K, V>;
 
 export = hasOwn;

package/node_modules/hasown/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "hasown",
-	"version": "2.0.3",
+	"version": "2.0.4",
 	"description": "A robust, ES3 compatible, \"has own property\" predicate.",
 	"main": "index.js",
 	"exports": {
@@ -52,13 +52,12 @@
 	},
 	"devDependencies": {
 		"@arethetypeswrong/cli": "^0.18.2",
-		"@ljharb/eslint-config": "^22.2.2",
+		"@ljharb/eslint-config": "^22.2.3",
 		"@ljharb/tsconfig": "^0.3.2",
 		"@types/function-bind": "^1.1.10",
 		"@types/tape": "^5.8.1",
-		"auto-changelog": "^2.5.0",
-		"encoding": "^0.1.13",
-		"eslint": "^10.2.0",
+		"auto-changelog": "^2.5.1",
+		"eslint": "^10.4.0",
 		"evalmd": "^0.0.19",
 		"in-publish": "^2.0.1",
 		"jiti": "^0.0.0",

package/node_modules/protobufjs/dist/light/protobuf.js

@@ -1,6 +1,6 @@
 /*!
- * protobuf.js v7.6.1 (c) 2016, daniel wirtz
- * compiled fri, 22 may 2026 02:52:08 utc
+ * protobuf.js v7.6.2 (c) 2016, daniel wirtz
+ * compiled sat, 30 may 2026 21:57:57 utc
  * licensed under the bsd-3-clause license
  * see: https://github.com/dcodeio/protobuf.js for details
  */
@@ -1207,7 +1207,7 @@ function genValuePartial_fromObject(gen, field, fieldIndex, prop) {
             } gen
             ("}");
         } else gen
-            ("if(typeof d%s!==\"object\")", prop)
+            ("if(!util.isObject(d%s))", prop)
                 ("throw TypeError(%j)", field.fullName + ": object expected")
             ("m%s=types[%i].fromObject(d%s,n+1)", prop, fieldIndex, prop);
     } else {
@@ -1274,6 +1274,8 @@ converter.fromObject = function fromObject(mtype) {
     var gen = util.codegen(["d", "n"], mtype.name + "$fromObject")
     ("if(d instanceof this.ctor)")
         ("return d")
+    ("if(!util.isObject(d))")
+        ("throw TypeError(%j)", mtype.fullName + ": object expected")
     ("if(n===undefined)n=0")
     ("if(n>util.recursionLimit)")
         ("throw Error(\"maximum nesting depth exceeded\")");
@@ -1288,7 +1290,7 @@ converter.fromObject = function fromObject(mtype) {
         // Map fields
         if (field.map) { gen
     ("if(d%s){", prop)
-        ("if(typeof d%s!==\"object\")", prop)
+        ("if(!util.isObject(d%s))", prop)
             ("throw TypeError(%j)", field.fullName + ": object expected")
         ("m%s={}", prop)
         ("for(var ks=Object.keys(d%s),i=0;i<ks.length;++i){", prop);
@@ -5049,7 +5051,7 @@ Root._configure = function(Type_, parse_, common_) {
 
 },{"16":16,"17":17,"23":23,"25":25,"35":35}],29:[function(require,module,exports){
 "use strict";
-module.exports = {};
+module.exports = Object.create(null);
 
 /**
  * Named roots.