@zuplo/runtime 6.71.3 → 6.71.7

package/out/types/index.d.ts

@@ -6205,6 +6205,10 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -6232,6 +6236,12 @@ declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
           remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
           stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
           sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
         },
         z.core.$strict
       >
@@ -6384,6 +6394,10 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -6453,6 +6467,10 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -6521,6 +6539,10 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -6595,6 +6617,10 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -6664,6 +6690,10 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -6743,6 +6773,10 @@ export declare interface McpOAuthInboundPolicyOptions {
      * Optional audience parameter for the IdP authorization request (Auth0-style API audiences).
      */
     audience?: string;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow (e.g. OAuth 2.1 IdPs, hardened Okta/Entra tenants). Leave as "none" for IdPs that may reject unexpected PKCE parameters.
+     */
+    pkce?: "S256" | "none";
     /**
      * Timeout for outbound calls to the IdP (token exchange, JWKS fetch).
      */
@@ -6860,6 +6894,12 @@ declare const mcpOAuthRuntimeConfigSchema: z.ZodObject<
         clientSecret: z.ZodOptional<z.ZodString>;
         scope: z.ZodDefault<z.ZodString>;
         audience: z.ZodOptional<z.ZodString>;
+        pkce: z.ZodDefault<
+          z.ZodEnum<{
+            none: "none";
+            S256: "S256";
+          }>
+        >;
         remoteTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         stateTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         sessionTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -7008,6 +7048,10 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -7161,6 +7205,10 @@ export declare interface McpPingOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -7241,6 +7289,10 @@ export declare interface McpWorkosOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 

package/out/types/mcp-gateway/index.d.ts

@@ -1083,6 +1083,10 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -1110,6 +1114,12 @@ declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
           remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
           stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
           sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
         },
         z.core.$strict
       >
@@ -1387,6 +1397,10 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -1456,6 +1470,10 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -1579,6 +1597,10 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -1653,6 +1675,10 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -1722,6 +1748,10 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -1801,6 +1831,10 @@ export declare interface McpOAuthInboundPolicyOptions {
      * Optional audience parameter for the IdP authorization request (Auth0-style API audiences).
      */
     audience?: string;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow (e.g. OAuth 2.1 IdPs, hardened Okta/Entra tenants). Leave as "none" for IdPs that may reject unexpected PKCE parameters.
+     */
+    pkce?: "S256" | "none";
     /**
      * Timeout for outbound calls to the IdP (token exchange, JWKS fetch).
      */
@@ -1918,6 +1952,12 @@ declare const mcpOAuthRuntimeConfigSchema: z.ZodObject<
         clientSecret: z.ZodOptional<z.ZodString>;
         scope: z.ZodDefault<z.ZodString>;
         audience: z.ZodOptional<z.ZodString>;
+        pkce: z.ZodDefault<
+          z.ZodEnum<{
+            none: "none";
+            S256: "S256";
+          }>
+        >;
         remoteTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         stateTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
         sessionTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -2066,6 +2106,10 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -2219,6 +2263,10 @@ export declare interface McpPingOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 
@@ -2365,6 +2413,10 @@ export declare interface McpWorkosOAuthInboundPolicyOptions {
     remoteTimeoutMs?: number;
     stateTtlSeconds?: number;
     sessionTtlSeconds?: number;
+    /**
+     * Whether to send S256 PKCE on the federated browser-login authorization request and replay the verifier at the token exchange. Defaults to "none". Set to "S256" when the identity provider mandates PKCE on the authorization-code flow.
+     */
+    pkce?: "S256" | "none";
   };
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.71.3",
+  "version": "6.71.7",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {