@zuplo/runtime 7.6.7 → 7.6.9

package/out/types/index.d.ts

@@ -1302,7 +1302,14 @@ export declare type AiRequestBody =
     }
   | {
       format: "anthropic-messages";
-      body: AnthropicMessagesRequest;
+      /**
+       * `/v1/messages` bodies carry a required `max_tokens`;
+       * `/v1/messages/count_tokens` bodies never do, and both classify as
+       * `anthropic-messages` because they are the same schema dialect. The union
+       * keeps a policy from reading `max_tokens` as if it were always present —
+       * narrow on it (or on `getFormat`'s endpoint) before relying on it.
+       */
+      body: AnthropicMessagesRequest | AnthropicCountTokensRequest;
     };
 
 /**
@@ -1749,6 +1756,19 @@ declare interface AndRule {
   and: [NestedRule, ...NestedRule[]];
 }
 
+/**
+ * A request to Anthropic's token-counting operation
+ * (`/v1/messages/count_tokens`).
+ *
+ * The request uses the Messages body shape but does not require `max_tokens`.
+ * The index signature preserves evolving Anthropic fields verbatim.
+ */
+declare interface AnthropicCountTokensRequest {
+  model: string;
+  messages: AnthropicMessage[];
+  [key: string]: unknown;
+}
+
 declare interface AnthropicMessage {
   role: "user" | "assistant";
   content:
@@ -2439,7 +2459,7 @@ export declare interface Auth0JwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -3748,25 +3768,25 @@ declare type ClaimCheck = EqualsRule | InRule | StartsWithRule;
 declare type ClassifierAppAPIKey = string;
 
 /**
- * The AI Gateway application id whose `/v1/chat/completions` route runs the classifier. The policy calls `/{classifierAppID}/v1/chat/completions` via `context.invokeRoute`.
+ * The AI Gateway application id used to run the classifier prompt and evaluate the user's request.
  * @public
  */
 declare type ClassifierAppID = string;
 
 /**
- * The `providerName/model` reference the classifier chat/completions request should use.
+ * The model (`providerName/model`) the classifier uses to evaluate the user's request. E.g. `openai/gpt-4o-mini`.
  * @public
  */
 declare type ClassifierModel = string;
 
 /**
- * System prompt for the classifier. If it includes `{{intents}}`, that placeholder is replaced with the configured intent id/description list. A string or an array of lines (joined with newlines). Omit to use the built-in classifier prompt.
+ * Prompt used to analyze and classify the user message. Omit to use the built-in classifier prompt.
  * @public
  */
 declare type ClassifierPrompt = string | [string, ...string[]];
 
 /**
- * How long to wait for the classifier `invokeRoute` call before skipping classification and forwarding the original request.
+ * Timeout configured for the classifier task. When exceeded, the request is forwarded without classification to the original model.
  * @public
  */
 declare type ClassifierTimeoutMs = number;
@@ -3849,7 +3869,7 @@ export declare interface ClerkJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -3934,7 +3954,7 @@ export declare interface CognitoJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -5462,7 +5482,7 @@ export declare interface FirebaseJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -7843,19 +7863,19 @@ declare interface InRule {
 }
 
 /**
- * Short description shown to the classifier for this intent.
+ * Short description of the intent label.
  * @public
  */
 declare type IntentDescription = string;
 
 /**
- * Stable intent identifier written into the classifier JSON schema enum.
+ * Label used to classify the intent of the user message being evaluated.
  * @public
  */
 declare type IntentID = string;
 
 /**
- * Labels the classifier may assign. Used to build the JSON schema enum and injected into `classifierPrompt` at `{{intents}}`. Omit to use the built-in taxonomy (code, summarization, translation, qa, conversation, classification, creative_writing, agentic, document_qa, other).
+ * Dictionary of intents used to classify the user message being evaluated. Omit to use the built-in dictionary (code, summarization, translation, qa, conversation, classification, creative_writing, agentic, document_qa, other).
  *
  * @minItems 1
  * @public
@@ -8528,7 +8548,7 @@ declare type LowComplexityModel = string;
 declare type MaxConversationLength = number;
 
 /**
- * Maximum characters of user prompt sent to the classifier. Longer prompts are truncated.
+ * Maximum characters of user message sent to the classifier. Longer messages get truncated.
  * @public
  */
 declare type MaxPromptCharacters = number;
@@ -10584,7 +10604,7 @@ declare interface Models {
 }
 
 /**
- * `providerName/model` routing by classified complexity. All of `low`, `medium`, and `high` are required. Used only when `smartRoutingEnabled` is true.
+ * Enables which model will be used based on the classifier results (`low`, `medium` and `high`). This configuration is applied only when `smartRoutingEnabled` is true and confidence score meets the `minConfidenceForRouting` threshold.
  * @public
  */
 declare interface ModelsByComplexity {
@@ -10981,7 +11001,14 @@ declare type OAuthClientCredentialsLocation = "body" | "header";
  */
 export declare class OAuthProtectedResourcePlugin extends OAuthProtectedResourceBasePlugin {
   private options;
+  private readonly scopes;
   constructor(options: OAuthProtectedResourcePluginOptions);
+  /**
+   * The scope values configured through `scopesSupported`, or `undefined` when
+   * the option was not set. OAuth policies read this to populate the `scope`
+   * parameter of their `WWW-Authenticate` challenge.
+   */
+  get scopesSupported(): readonly string[] | undefined;
   protected getMetadataOptions(
     _request: ZuploRequest,
     _context: ZuploContext
@@ -11005,6 +11032,29 @@ export declare interface OAuthProtectedResourcePluginOptions {
    * This field is recommended by RFC 9728.
    */
   resourceName?: string;
+  /**
+   * Scope values that clients should request when obtaining an access token for
+   * this protected resource. Emitted as `scopes_supported` in the metadata
+   * document (RFC 9728) and, when an OAuth policy on the route has
+   * `oAuthResourceMetadataEnabled` set, as the `scope` parameter of the
+   * `WWW-Authenticate` challenge on 401 responses. MCP clients use these values
+   * to build their authorization request instead of asking for every scope the
+   * authorization server advertises.
+   *
+   * Each entry must be a single OAuth scope token (RFC 6749 §3.3): printable
+   * ASCII with no spaces, double quotes, or backslashes. The list must not be
+   * empty; omit the option to advertise no scopes.
+   *
+   * @example
+   * ```ts
+   * new OAuthProtectedResourcePlugin({
+   *   authorizationServers: ["https://acme.okta.com/oauth2/aus1a2b3c"],
+   *   resourceName: "Acme MCP",
+   *   scopesSupported: ["mcp:access", "openid", "offline_access"],
+   * });
+   * ```
+   */
+  scopesSupported?: string[];
 }
 
 /**
@@ -11091,7 +11141,7 @@ export declare interface OktaJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -11897,7 +11947,7 @@ export declare interface OpenIdJwtInboundPolicyOptions {
     [k: string]: string;
   };
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -12482,7 +12532,7 @@ export declare interface PropelAuthJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -14179,7 +14229,7 @@ export declare interface SleepInboundPolicyOptions {
 }
 
 /**
- * When true, apply model routing from `modelsByComplexity` when confidence is high enough and the intent is known. Classification still runs when false.
+ * When true, apply model routing based on the models set in `modelsByComplexity` when confidence score meets the `minConfidenceForRouting` threshold. When set to false, classification still runs but model routing is not applied, useful for debugging or testing the classifier prompt.
  * @public
  */
 declare type SmartRoutingEnabled = boolean;
@@ -14442,7 +14492,7 @@ export declare interface SupabaseJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.6.7",
+  "version": "7.6.9",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {