zuplo 6.72.0 → 6.72.1

package/docs/analytics/access-and-entitlements.md

@@ -5,23 +5,22 @@ sidebar_label: "Access & Entitlements"
 
 ## When to use this
 
-- Confirm whether your account can see advanced analytics.
+- Confirm whether your account can see analytics.
 - Find out how many days of history you have access to.
 - Understand the trial banner or the demo mode link.
 
 ## Plan requirements
 
-Advanced analytics must be enabled on your account. Without it, the Analytics
-page shows an upsell view with a **Contact Sales** call-to-action and no charts.
+Analytics must be enabled on your account. Without it, the Analytics page shows
+an upsell view with a **Contact Sales** call-to-action and no charts.
 
 ## Free trial
 
-New accounts with advanced analytics enabled get an automatic free trial. The
-trial:
+New accounts with analytics enabled get an automatic free trial. The trial:
 
 - Runs for the same number of days as your account's retention window.
 - Shows a banner across the top of the Analytics page: "You're on a {N}-day
-  preview of Advanced Analytics, {N} days left."
+  preview of Analytics, {N} days left."
 - Includes two call-to-actions: **View demo →** (loads the dashboard with sample
   data) and **Contact sales**.
 
@@ -54,8 +53,8 @@ Append `?demo=true` to the Analytics URL, or click **View demo →** in the tria
 banner, to switch into demo mode. In demo mode:
 
 - Charts and tables are populated with synthetic sample data.
-- A persistent banner reads: "You're viewing the Advanced Analytics demo with
-  sample data. Your real analytics aren't shown here."
+- A persistent banner reads: "You're viewing the Analytics demo with sample
+  data. Your real analytics aren't shown here."
 
 Remove the `demo` parameter from the URL to return to your real data.
 

package/docs/analytics/overview.md

@@ -56,12 +56,12 @@ You'll see a subset of sections depending on your plan and project setup:
 
 | Section   | When it appears                                            |
 | --------- | ---------------------------------------------------------- |
-| Requests  | All accounts with advanced analytics enabled.              |
+| Requests  | All accounts with analytics enabled.                       |
 | Origins   | The project uses managed-edge origins.                     |
-| Consumers | All accounts with advanced analytics enabled.              |
-| Agents    | All accounts with advanced analytics enabled.              |
+| Consumers | All accounts with analytics enabled.                       |
+| Agents    | All accounts with analytics enabled.                       |
 | MCP       | The project type is **standard** and the project uses MCP. |
 | GraphQL   | The project proxies a GraphQL API.                         |
 
-If you don't see Analytics at all, your account likely doesn't have advanced
-analytics enabled. See [Access and entitlements](./access-and-entitlements.md).
+If you don't see Analytics at all, your account likely doesn't have analytics
+enabled. See [Access and entitlements](./access-and-entitlements.md).

package/docs/analytics/shared-controls.md

@@ -99,8 +99,8 @@ Banners appear at the top of the page in this priority order:
 1. **Preview banner**: when `preview=1` is set. Indicates legacy preview mode.
 2. **Demo banner**: when `demo=true` is set. Reminds you sample data is shown
    instead of your real analytics.
-3. **Trial banner**: for new accounts with advanced analytics. Shows days
-   remaining and offers **View demo →** and **Contact Sales**.
+3. **Trial banner**: for new accounts with analytics. Shows days remaining and
+   offers **View demo →** and **Contact Sales**.
 
 ## Loading and empty states
 

package/docs/dev-portal/zudoku/components/landing-page.mdx

@@ -10,7 +10,7 @@ A ready-made, customizable landing page for your developer portal. It comes in t
 covering the most common layouts: a centered hero, a two-column split hero, and a compact
 documentation hub.
 
-Use it as the `element` of a [custom page](/dev-portal/zudoku/custom-pages) — typically your home page:
+Use it as the `element` of a [custom page](/dev-portal/zudoku/guides/custom-pages) — typically your home page:
 
 ```tsx title=zudoku.config.tsx
 import { LandingPage } from "zudoku/components";

package/docs/policies/mcp-token-exchange-inbound/doc.md

@@ -65,9 +65,47 @@ can discover:
 2. The upstream protected resource metadata `scopes_supported` value.
 3. No `scope` parameter if the upstream does not advertise one.
 
-Explicit configured scopes always win. Use them for providers such as Microsoft
-365 where the correct resource-specific application scope is known from the
-provider configuration rather than from MCP discovery.
+Explicit configured scopes always win: they are sent as the `scope` parameter on
+the upstream authorization request even when the upstream advertises a different
+`scopes_supported` in its protected resource metadata. Use them for providers
+such as Microsoft 365 where the correct resource-specific application scope is
+known from the provider configuration rather than from MCP discovery, or to add
+`offline_access` when the upstream requires it for refresh-token issuance but
+does not advertise it.
+
+## Consent Prompt Override
+
+The MCP SDK that the gateway uses as its upstream OAuth client adds
+`prompt=consent` to the authorization request whenever the requested scope
+includes `offline_access`, because most providers require a fresh consent grant
+before issuing a refresh token. The gateway itself never injects `prompt`; the
+`prompt` option strips or replaces the SDK's parameter at the gateway's
+authorization seam. Some providers honor `prompt=consent` literally: Microsoft
+Entra ID forces the consent screen on every single authorization, even after a
+tenant admin has granted org-wide admin consent.
+
+Set `prompt` to control this behavior:
+
+- **Unset** (default): keep the SDK's behavior, including the automatic
+  `prompt=consent` for `offline_access`.
+- **`false`**: strip the `prompt` parameter from the authorization request. Use
+  this for Entra upstreams where a tenant admin has already granted admin
+  consent — users connect without seeing the consent screen, and refresh tokens
+  are still issued because admin consent satisfies the requirement.
+- **`"none"` / `"login"` / `"consent"` / `"select_account"`**: set or replace
+  the `prompt` parameter with an explicit value.
+
+Note that the effective scope can include `offline_access` even when `scopes` is
+not configured, because the gateway also reads scopes from the upstream's
+`WWW-Authenticate` challenge and protected resource metadata.
+
+**Warning**: stripping `prompt=consent` while requesting `offline_access` can
+silently prevent refresh-token issuance on providers that require a fresh
+consent grant for offline access (for example, Google). Only use `false` when
+the provider grants offline access through pre-authorized or admin consent, such
+as Entra tenant admin consent. If connections start requiring frequent
+reauthorization after setting `prompt: false`, remove the option so the consent
+grant is requested again.
 
 ## Route Shape
 

package/docs/policies/mcp-token-exchange-inbound/schema.json

@@ -71,6 +71,19 @@
               "type": "string",
               "description": "Delimiter used to join scopes in the OAuth authorization request. Defaults to a single space."
             },
+            "prompt": {
+              "description": "Overrides the OIDC `prompt` parameter on upstream authorization requests. The MCP SDK adds `prompt=consent` whenever the requested scope includes `offline_access`, which forces a consent screen on every authorization on providers like Microsoft Entra ID even after a tenant admin has granted org-wide admin consent. Leave unset to keep the SDK's behavior; set to `false` to strip the `prompt` parameter; set an explicit value to replace it. Warning: stripping `prompt=consent` while requesting `offline_access` can silently prevent refresh-token issuance on providers that require a fresh consent grant for offline access (e.g. Google) — only use this when the provider grants offline access via pre-authorized/admin consent (e.g. Entra tenant admin consent).",
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": ["none", "login", "consent", "select_account"]
+                },
+                {
+                  "type": "boolean",
+                  "const": false
+                }
+              ]
+            },
             "clientRegistration": {
               "description": "OAuth client registration mode. Defaults to `auto`, which uses Client ID Metadata Documents when the upstream advertises support and falls back to Dynamic Client Registration otherwise.",
               "oneOf": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zuplo",
-  "version": "6.72.0",
+  "version": "6.72.1",
   "type": "module",
   "description": "The programmable API Gateway",
   "author": "Zuplo, Inc.",
@@ -19,9 +19,9 @@
     "zuplo": "zuplo.js"
   },
   "dependencies": {
-    "@zuplo/cli": "6.72.0",
-    "@zuplo/core": "6.72.0",
-    "@zuplo/runtime": "6.72.0",
+    "@zuplo/cli": "6.72.1",
+    "@zuplo/core": "6.72.1",
+    "@zuplo/runtime": "6.72.1",
     "@zuplo/test": "1.4.0"
   }
 }