@zuplo/runtime 7.6.8 → 7.6.10

package/out/types/index.d.ts

@@ -1302,7 +1302,14 @@ export declare type AiRequestBody =
     }
   | {
       format: "anthropic-messages";
-      body: AnthropicMessagesRequest;
+      /**
+       * `/v1/messages` bodies carry a required `max_tokens`;
+       * `/v1/messages/count_tokens` bodies never do, and both classify as
+       * `anthropic-messages` because they are the same schema dialect. The union
+       * keeps a policy from reading `max_tokens` as if it were always present —
+       * narrow on it (or on `getFormat`'s endpoint) before relying on it.
+       */
+      body: AnthropicMessagesRequest | AnthropicCountTokensRequest;
     };
 
 /**
@@ -1749,6 +1756,19 @@ declare interface AndRule {
   and: [NestedRule, ...NestedRule[]];
 }
 
+/**
+ * A request to Anthropic's token-counting operation
+ * (`/v1/messages/count_tokens`).
+ *
+ * The request uses the Messages body shape but does not require `max_tokens`.
+ * The index signature preserves evolving Anthropic fields verbatim.
+ */
+declare interface AnthropicCountTokensRequest {
+  model: string;
+  messages: AnthropicMessage[];
+  [key: string]: unknown;
+}
+
 declare interface AnthropicMessage {
   role: "user" | "assistant";
   content:
@@ -2439,7 +2459,7 @@ export declare interface Auth0JwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -3849,7 +3869,7 @@ export declare interface ClerkJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -3934,7 +3954,7 @@ export declare interface CognitoJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -5462,7 +5482,7 @@ export declare interface FirebaseJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -10981,7 +11001,14 @@ declare type OAuthClientCredentialsLocation = "body" | "header";
  */
 export declare class OAuthProtectedResourcePlugin extends OAuthProtectedResourceBasePlugin {
   private options;
+  private readonly scopes;
   constructor(options: OAuthProtectedResourcePluginOptions);
+  /**
+   * The scope values configured through `scopesSupported`, or `undefined` when
+   * the option was not set. OAuth policies read this to populate the `scope`
+   * parameter of their `WWW-Authenticate` challenge.
+   */
+  get scopesSupported(): readonly string[] | undefined;
   protected getMetadataOptions(
     _request: ZuploRequest,
     _context: ZuploContext
@@ -11005,6 +11032,29 @@ export declare interface OAuthProtectedResourcePluginOptions {
    * This field is recommended by RFC 9728.
    */
   resourceName?: string;
+  /**
+   * Scope values that clients should request when obtaining an access token for
+   * this protected resource. Emitted as `scopes_supported` in the metadata
+   * document (RFC 9728) and, when an OAuth policy on the route has
+   * `oAuthResourceMetadataEnabled` set, as the `scope` parameter of the
+   * `WWW-Authenticate` challenge on 401 responses. MCP clients use these values
+   * to build their authorization request instead of asking for every scope the
+   * authorization server advertises.
+   *
+   * Each entry must be a single OAuth scope token (RFC 6749 §3.3): printable
+   * ASCII with no spaces, double quotes, or backslashes. The list must not be
+   * empty; omit the option to advertise no scopes.
+   *
+   * @example
+   * ```ts
+   * new OAuthProtectedResourcePlugin({
+   *   authorizationServers: ["https://acme.okta.com/oauth2/aus1a2b3c"],
+   *   resourceName: "Acme MCP",
+   *   scopesSupported: ["mcp:access", "openid", "offline_access"],
+   * });
+   * ```
+   */
+  scopesSupported?: string[];
 }
 
 /**
@@ -11091,7 +11141,7 @@ export declare interface OktaJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -11897,7 +11947,7 @@ export declare interface OpenIdJwtInboundPolicyOptions {
     [k: string]: string;
   };
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -12482,7 +12532,7 @@ export declare interface PropelAuthJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
@@ -14442,7 +14492,7 @@ export declare interface SupabaseJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Flag that determines whether OAuth protected resource metadata is enabled.
+   * Enables OAuth 2.0 Protected Resource Metadata discovery (RFC 9728). When `true`, requests without a bearer token receive a 401 whose `WWW-Authenticate` header points `resource_metadata` at the `/.well-known/oauth-protected-resource` document for the request path and, when the `OAuthProtectedResourcePlugin` declares `scopesSupported`, lists those scopes in `scope`. Requires the `OAuthProtectedResourcePlugin` in `zuplo.runtime.ts` or a user-defined route at that path.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.6.8",
+  "version": "7.6.10",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {