@zuplo/runtime 6.72.3 → 6.72.8

package/out/types/mcp-gateway/index.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod/v4";
 
 /**
- * Optional per-caller access control. Defaults to mode 'allPublic' (no access control). Set mode to 'rolesAndGroups' to match the caller's role/group claims against each capability's markup (every capability must then set roles/groups or public: true), or 'function' to delegate to a custom resolver.
+ * Optional per-caller access control. Defaults to mode 'allPublic' (no access control). Set mode to 'rolesAndGroups' to match the caller's role/group claims against each capability's markup (a capability with no roles/groups/public markup is available to no one), or 'function' to delegate to a custom resolver.
  * @public
  */
 declare interface AccessControl {
@@ -128,9 +128,9 @@ declare interface BuildRouteConfiguration {
  * `roles`/`groups`, each allowing a dot-path such as `realm_access.roles`).
  * `request.user.data` is populated by whichever auth policy ran (JWT claims,
  * API-key metadata, etc.). A capability marked `public: true` is allowed for
- * everyone; otherwise the caller must match any listed role or group. In this
- * mode every capability must be classified (see {@link assertClassified}), so
- * nothing is public by omission.
+ * everyone; otherwise the caller must match any listed role or group. A
+ * capability with no roles/groups/public markup is available to no one until
+ * it is classified, so nothing is ever exposed by omission.
  *
  * @public
  */
@@ -3501,10 +3501,6 @@ export declare interface McpTokenExchangeInboundPolicyOptions {
    * Optional human-readable summary of the upstream, shown on the consent page.
    */
   summary?: string;
-  /**
-   * Optional override for the upstream's OAuth protected-resource metadata URL. Defaults from the route handler's rewritePattern.
-   */
-  protectedResourceMetadataUrl?: string;
   /**
    * Authentication mode. `user-oauth` performs per-user OAuth federation; `shared-oauth` uses a gateway-wide OAuth grant; `id-jag` exchanges the caller's identity assertion at the configured IdP for an ID-JAG (Identity Assertion JWT Authorization Grant, also known as Cross-App Access / XAA), then redeems it at the upstream Resource Authorization Server for an upstream access token.
    */
@@ -3513,6 +3509,10 @@ export declare interface McpTokenExchangeInboundPolicyOptions {
    * OAuth scopes to request from the upstream (for OAuth modes).
    */
   scopes?: string[];
+  /**
+   * Optional override for the upstream's OAuth protected-resource metadata URL. Defaults from the route handler's rewritePattern.
+   */
+  protectedResourceMetadataUrl?: string;
   /**
    * Delimiter used to join scopes in the OAuth authorization request. Defaults to a single space.
    */
@@ -4541,7 +4541,7 @@ declare interface PromptProjection {
 }
 
 /**
- * Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' every capability must set roles/groups OR public: true (not both) — an unclassified capability is a configuration error, so nothing is ever exposed by omission.
+ * Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' a capability with no roles/groups/public markup is available to no one until it is classified, so nothing is ever exposed by omission. Combining public: true with roles/groups is a configuration error.
  * @public
  */
 declare type Public = boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.72.3",
+  "version": "6.72.8",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {