@zuplo/cli 6.70.63 → 6.70.67

package/node_modules/@zuplo/runtime/out/types/mcp-gateway/index.d.ts

@@ -962,7 +962,7 @@ declare interface Logger extends BaseLogger {
  * @title MCP Auth0 OAuth
  * @product mcp-gateway
  */
-export declare class McpAuth0OAuthInboundPolicy extends InboundPolicy<McpAuth0OAuthInboundPolicyOptions> {
+export declare class McpAuth0OAuthInboundPolicy extends InboundPolicy<ValidatedAuth0OAuthOptions> {
   #private;
   constructor(rawOptions: unknown, policyName: string);
   handler(
@@ -1013,6 +1013,69 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata.
+         *
+         * @minItems 1
+         */
+        trustedIssuers: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim.
+             */
+            issuer: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             */
+            jwksUrl: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim.
+             */
+            issuer: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             */
+            jwksUrl: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -1023,6 +1086,38 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
+  {
+    auth0Domain: z.ZodString;
+    audience: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Curate MCP capabilities advertised and reachable through `McpProxyHandler`.
  *
@@ -1734,6 +1829,69 @@ export declare interface McpOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata.
+         *
+         * @minItems 1
+         */
+        trustedIssuers: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim.
+             */
+            issuer: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             */
+            jwksUrl: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim.
+             */
+            issuer: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             */
+            jwksUrl: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
 }
 
 declare type McpOAuthRuntimeConfig = z.infer<
@@ -1788,6 +1946,50 @@ declare const mcpOAuthRuntimeConfigSchema: z.ZodObject<
         }
       >
     >;
+    idJag: z.ZodDefault<
+      z.ZodOptional<
+        z.ZodDefault<
+          z.ZodDiscriminatedUnion<
+            [
+              z.ZodObject<
+                {
+                  enabled: z.ZodLiteral<false>;
+                },
+                z.core.$strict
+              >,
+              z.ZodObject<
+                {
+                  enabled: z.ZodLiteral<true>;
+                  trustedIssuers: z.ZodArray<
+                    z.ZodObject<
+                      {
+                        issuer: z.ZodURL;
+                        jwksUrl: z.ZodURL;
+                        expectedClientIds: z.ZodOptional<
+                          z.ZodArray<z.ZodString>
+                        >;
+                        subjectMapping: z.ZodDefault<
+                          z.ZodEnum<{
+                            iss_prefix: "iss_prefix";
+                            iss_tenant_prefix: "iss_tenant_prefix";
+                            sub_id_only: "sub_id_only";
+                          }>
+                        >;
+                      },
+                      z.core.$strict
+                    >
+                  >;
+                  authorizationDetailsTypesAllowed: z.ZodOptional<
+                    z.ZodArray<z.ZodString>
+                  >;
+                },
+                z.core.$strict
+              >,
+            ]
+          >
+        >
+      >
+    >;
   },
   z.core.$strict
 >;
@@ -3212,45 +3414,206 @@ declare const upstreamTokenExchangePolicyOptionsSchema: z.ZodObject<
     authMode: z.ZodEnum<{
       "user-oauth": "user-oauth";
       "shared-oauth": "shared-oauth";
+      "id-jag": "id-jag";
     }>;
     ownerMode: z.ZodEnum<{
       user: "user";
       shared: "shared";
     }>;
-    authConfig: z.ZodObject<
-      {
-        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        scopeDelimiter: z.ZodDefault<z.ZodString>;
-        clientRegistration: z.ZodDefault<
-          z.ZodDiscriminatedUnion<
-            [
-              z.ZodObject<
-                {
-                  mode: z.ZodLiteral<"auto">;
-                },
-                z.core.$strict
-              >,
-              z.ZodObject<
-                {
-                  mode: z.ZodLiteral<"manual">;
-                  clientId: z.ZodString;
-                  clientSecret: z.ZodOptional<z.ZodString>;
-                  tokenEndpointAuthMethod: z.ZodDefault<
-                    z.ZodEnum<{
-                      none: "none";
-                      client_secret_basic: "client_secret_basic";
-                      client_secret_post: "client_secret_post";
-                    }>
-                  >;
-                },
-                z.core.$strict
-              >,
-            ]
-          >
-        >;
-        redirectPath: z.ZodString;
-      },
-      z.core.$strict
+    authConfig: z.ZodDiscriminatedUnion<
+      [
+        z.ZodObject<
+          {
+            mode: z.ZodLiteral<"shared-oauth">;
+            oauth: z.ZodObject<
+              {
+                scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                scopeDelimiter: z.ZodDefault<z.ZodString>;
+                clientRegistration: z.ZodDefault<
+                  z.ZodDiscriminatedUnion<
+                    [
+                      z.ZodObject<
+                        {
+                          mode: z.ZodLiteral<"auto">;
+                        },
+                        z.core.$strict
+                      >,
+                      z.ZodObject<
+                        {
+                          mode: z.ZodLiteral<"manual">;
+                          clientId: z.ZodString;
+                          clientSecret: z.ZodOptional<z.ZodString>;
+                          tokenEndpointAuthMethod: z.ZodDefault<
+                            z.ZodEnum<{
+                              none: "none";
+                              client_secret_basic: "client_secret_basic";
+                              client_secret_post: "client_secret_post";
+                            }>
+                          >;
+                        },
+                        z.core.$strict
+                      >,
+                    ]
+                  >
+                >;
+                redirectPath: z.ZodString;
+              },
+              z.core.$strict
+            >;
+          },
+          z.core.$strict
+        >,
+        z.ZodObject<
+          {
+            mode: z.ZodLiteral<"user-oauth">;
+            oauth: z.ZodObject<
+              {
+                scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                scopeDelimiter: z.ZodDefault<z.ZodString>;
+                clientRegistration: z.ZodDefault<
+                  z.ZodDiscriminatedUnion<
+                    [
+                      z.ZodObject<
+                        {
+                          mode: z.ZodLiteral<"auto">;
+                        },
+                        z.core.$strict
+                      >,
+                      z.ZodObject<
+                        {
+                          mode: z.ZodLiteral<"manual">;
+                          clientId: z.ZodString;
+                          clientSecret: z.ZodOptional<z.ZodString>;
+                          tokenEndpointAuthMethod: z.ZodDefault<
+                            z.ZodEnum<{
+                              none: "none";
+                              client_secret_basic: "client_secret_basic";
+                              client_secret_post: "client_secret_post";
+                            }>
+                          >;
+                        },
+                        z.core.$strict
+                      >,
+                    ]
+                  >
+                >;
+                redirectPath: z.ZodString;
+              },
+              z.core.$strict
+            >;
+          },
+          z.core.$strict
+        >,
+        z.ZodObject<
+          {
+            mode: z.ZodLiteral<"id-jag">;
+            idJag: z.ZodObject<
+              {
+                scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+                scopeDelimiter: z.ZodDefault<z.ZodString>;
+                idp: z.ZodObject<
+                  {
+                    tokenUrl: z.ZodURL;
+                    clientAuth: z.ZodDiscriminatedUnion<
+                      [
+                        z.ZodObject<
+                          {
+                            method: z.ZodLiteral<"client_secret_post">;
+                            clientId: z.ZodString;
+                            clientSecret: z.ZodString;
+                          },
+                          z.core.$strict
+                        >,
+                        z.ZodObject<
+                          {
+                            method: z.ZodLiteral<"client_secret_basic">;
+                            clientId: z.ZodString;
+                            clientSecret: z.ZodString;
+                          },
+                          z.core.$strict
+                        >,
+                        z.ZodObject<
+                          {
+                            method: z.ZodLiteral<"private_key_jwt">;
+                            clientId: z.ZodString;
+                            privateKeyPem: z.ZodString;
+                            algorithm: z.ZodDefault<
+                              z.ZodEnum<{
+                                RS256: "RS256";
+                                RS384: "RS384";
+                                RS512: "RS512";
+                                ES256: "ES256";
+                                ES384: "ES384";
+                                ES512: "ES512";
+                              }>
+                            >;
+                            keyId: z.ZodOptional<z.ZodString>;
+                            audience: z.ZodOptional<z.ZodURL>;
+                            expiresInSeconds: z.ZodDefault<z.ZodNumber>;
+                          },
+                          z.core.$strict
+                        >,
+                      ]
+                    >;
+                  },
+                  z.core.$strict
+                >;
+                resourceAs: z.ZodObject<
+                  {
+                    tokenUrl: z.ZodURL;
+                    audience: z.ZodString;
+                    resource: z.ZodOptional<z.ZodString>;
+                    clientAuth: z.ZodDiscriminatedUnion<
+                      [
+                        z.ZodObject<
+                          {
+                            method: z.ZodLiteral<"client_secret_post">;
+                            clientId: z.ZodString;
+                            clientSecret: z.ZodString;
+                          },
+                          z.core.$strict
+                        >,
+                        z.ZodObject<
+                          {
+                            method: z.ZodLiteral<"client_secret_basic">;
+                            clientId: z.ZodString;
+                            clientSecret: z.ZodString;
+                          },
+                          z.core.$strict
+                        >,
+                        z.ZodObject<
+                          {
+                            method: z.ZodLiteral<"private_key_jwt">;
+                            clientId: z.ZodString;
+                            privateKeyPem: z.ZodString;
+                            algorithm: z.ZodDefault<
+                              z.ZodEnum<{
+                                RS256: "RS256";
+                                RS384: "RS384";
+                                RS512: "RS512";
+                                ES256: "ES256";
+                                ES384: "ES384";
+                                ES512: "ES512";
+                              }>
+                            >;
+                            keyId: z.ZodOptional<z.ZodString>;
+                            audience: z.ZodOptional<z.ZodURL>;
+                            expiresInSeconds: z.ZodDefault<z.ZodNumber>;
+                          },
+                          z.core.$strict
+                        >,
+                      ]
+                    >;
+                  },
+                  z.core.$strict
+                >;
+              },
+              z.core.$strict
+            >;
+          },
+          z.core.$strict
+        >,
+      ]
     >;
   },
   z.core.$strict
@@ -3263,6 +3626,10 @@ declare interface UrlConfig {
 
 declare type UserDataDefault = any;
 
+declare type ValidatedAuth0OAuthOptions = z.infer<
+  typeof mcpAuth0OAuthOptionsSchema
+>;
+
 declare type ValidatedOptions = z.infer<
   typeof mcpCapabilityFilterOptionsSchema
 >;

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.70.63",
+  "version": "6.70.67",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/hono/dist/cjs/middleware/bearer-auth/index.js

@@ -27,7 +27,7 @@ const PREFIX = "Bearer";
 const HEADER = "Authorization";
 const bearerAuth = (options) => {
   if (!("token" in options || "verifyToken" in options)) {
-    throw new Error('bearer auth middleware requires options for "token"');
+    throw new Error('bearer auth middleware requires options for "token" or "verifyToken"');
   }
   if (!options.realm) {
     options.realm = "";

package/node_modules/hono/dist/cjs/middleware/language/language.js

@@ -83,20 +83,12 @@ const normalizeLanguage = (lang, options) => {
   }
 };
 const detectFromQuery = (c, options) => {
-  try {
-    const query = c.req.query(options.lookupQueryString);
-    return normalizeLanguage(query, options);
-  } catch {
-    return void 0;
-  }
+  const query = c.req.query(options.lookupQueryString);
+  return normalizeLanguage(query, options);
 };
 const detectFromCookie = (c, options) => {
-  try {
-    const cookie = (0, import_cookie.getCookie)(c, options.lookupCookie);
-    return normalizeLanguage(cookie, options);
-  } catch {
-    return void 0;
-  }
+  const cookie = (0, import_cookie.getCookie)(c, options.lookupCookie);
+  return normalizeLanguage(cookie, options);
 };
 function detectFromHeader(c, options) {
   try {
@@ -117,14 +109,10 @@ function detectFromHeader(c, options) {
   }
 }
 function detectFromPath(c, options) {
-  try {
-    const url = new URL(c.req.url);
-    const pathSegments = url.pathname.split("/").filter(Boolean);
-    const langSegment = pathSegments[options.lookupFromPathIndex];
-    return normalizeLanguage(langSegment, options);
-  } catch {
-    return void 0;
-  }
+  const url = new URL(c.req.url);
+  const pathSegments = url.pathname.split("/").filter(Boolean);
+  const langSegment = pathSegments[options.lookupFromPathIndex];
+  return normalizeLanguage(langSegment, options);
 }
 const detectors = {
   querystring: detectFromQuery,
@@ -159,9 +147,6 @@ const detectLanguage = (c, options) => {
   let detectedLang;
   for (const detectorName of options.order) {
     const detector = detectors[detectorName];
-    if (!detector) {
-      continue;
-    }
     try {
       detectedLang = detector(c, options);
       if (detectedLang) {
@@ -194,15 +179,8 @@ const languageDetector = (userOptions) => {
   };
   validateOptions(options);
   return async function languageDetector2(ctx, next) {
-    try {
-      const lang = detectLanguage(ctx, options);
-      ctx.set("language", lang);
-    } catch (error) {
-      if (options.debug) {
-        console.error("Language detection failed:", error);
-      }
-      ctx.set("language", options.fallbackLanguage);
-    }
+    const lang = detectLanguage(ctx, options);
+    ctx.set("language", lang);
     await next();
   };
 };

package/node_modules/hono/dist/cjs/middleware/timing/timing.js

@@ -56,7 +56,9 @@ const timing = (config) => {
       endTime(c, "total");
     }
     if (options.autoEnd) {
-      timers.forEach((_, key) => endTime(c, key));
+      timers.forEach((_, key) => {
+        endTime(c, key);
+      });
     }
     const enabled = typeof options.enabled === "function" ? options.enabled(c) : options.enabled;
     if (enabled) {

package/node_modules/hono/dist/cjs/utils/ipaddr.js

@@ -43,7 +43,9 @@ const expandIPv6 = (ipV6) => {
     if (node !== "") {
       sections[i] = node.padStart(4, "0");
     } else {
-      sections[i + 1] === "" && sections.splice(i + 1, 1);
+      while (sections[i + 1] === "") {
+        sections.splice(i + 1, 1);
+      }
       sections[i] = new Array(8 - sections.length + 1).fill("0000").join(":");
     }
   }
@@ -263,6 +265,9 @@ const convertIPv4BinaryToString = (ipV4) => {
 const isIPv4MappedIPv6 = (ipv6binary) => ipv6binary >> 32n === 0xffffn;
 const convertIPv4MappedIPv6ToIPv4 = (ipv6binary) => ipv6binary & 0xffffffffn;
 const convertIPv6BinaryToString = (ipV6) => {
+  if (ipV6 === 0n) {
+    return "::";
+  }
   if (isIPv4MappedIPv6(ipV6)) {
     return `::ffff:${convertIPv4BinaryToString(convertIPv4MappedIPv6ToIPv4(ipV6))}`;
   }

package/node_modules/hono/dist/middleware/bearer-auth/index.js

@@ -6,7 +6,7 @@ var PREFIX = "Bearer";
 var HEADER = "Authorization";
 var bearerAuth = (options) => {
   if (!("token" in options || "verifyToken" in options)) {
-    throw new Error('bearer auth middleware requires options for "token"');
+    throw new Error('bearer auth middleware requires options for "token" or "verifyToken"');
   }
   if (!options.realm) {
     options.realm = "";