@adtl/gateway 0.7.0 → 0.8.1

package/dist/config.d.ts

@@ -12,11 +12,16 @@
  *       docs:
  *         url: https://example.com/mcp
  *         headers: { Authorization: "Bearer ${DOCS_TOKEN}" }
+ *     interceptorServers:                # optional: more interceptor servers, run beside ADTL's
+ *       pii: { url: https://pii.example.com/mcp }
+ *     interceptorOverrides:              # optional: per-interceptor execution policy (SEP-2624)
+ *       adtl.label: { timeoutMs: 10000 }
  *     principal: { id: "${USER}" }       # optional: who runs this gateway (default: anonymous)
  *     roles:                             # optional: who may use which tools (deny by default)
  *       maintainers: { members: [alice], tools: ["github.*"] }
  *       readers:     { members: ["*"],   tools: ["github.read_*", "github.get_*"] }
  *     cedar: { policies: ./adtl.cedar }  # optional: attribute-based rules (see cedar.ts)
+ *     openfga: { url: http://localhost:8080, storeId: "${FGA_STORE_ID}" }  # optional: relationship rules (see openfga.ts)
  *     approvals:                         # optional: make "ask" really ask
  *       timeoutSeconds: 50
  *       ntfy: { topic: "${ADTL_NTFY_TOPIC}" }
@@ -27,823 +32,272 @@
  *         from: adtl@example.com
  *         to: you@example.com
  *
- * `${VAR}` in command, args, env, cwd, url, headers, approval settings and principal.id is
+ * `${VAR}` in command, args, env, cwd, url, headers, approval settings, openfga settings and principal.id is
  * replaced from the gateway's environment. A missing variable is a config error,
  * unless a default is given: `${VAR:-default}`.
  */
 import { z } from "zod";
 export declare const StdioUpstreamSchema: z.ZodObject<{
     command: z.ZodString;
-    args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    args: z.ZodDefault<z.ZodArray<z.ZodString>>;
     env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     cwd: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    command: string;
-    args: string[];
-    env: Record<string, string>;
-    cwd?: string | undefined;
-}, {
-    command: string;
-    args?: string[] | undefined;
-    env?: Record<string, string> | undefined;
-    cwd?: string | undefined;
-}>;
+}, z.core.$strict>;
 export declare const HttpUpstreamSchema: z.ZodObject<{
     url: z.ZodString;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
-}, "strict", z.ZodTypeAny, {
-    url: string;
-    headers: Record<string, string>;
-}, {
-    url: string;
-    headers?: Record<string, string> | undefined;
-}>;
-export declare const UpstreamSchema: z.ZodUnion<[z.ZodObject<{
+}, z.core.$strict>;
+export declare const UpstreamSchema: z.ZodUnion<readonly [z.ZodObject<{
     command: z.ZodString;
-    args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    args: z.ZodDefault<z.ZodArray<z.ZodString>>;
     env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     cwd: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    command: string;
-    args: string[];
-    env: Record<string, string>;
-    cwd?: string | undefined;
-}, {
-    command: string;
-    args?: string[] | undefined;
-    env?: Record<string, string> | undefined;
-    cwd?: string | undefined;
-}>, z.ZodObject<{
+}, z.core.$strict>, z.ZodObject<{
     url: z.ZodString;
     headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
-}, "strict", z.ZodTypeAny, {
-    url: string;
-    headers: Record<string, string>;
-}, {
-    url: string;
-    headers?: Record<string, string> | undefined;
-}>]>;
+}, z.core.$strict>]>;
 export type StdioUpstream = z.infer<typeof StdioUpstreamSchema>;
 export type HttpUpstream = z.infer<typeof HttpUpstreamSchema>;
 export type Upstream = z.infer<typeof UpstreamSchema>;
 export declare const NtfyConfigSchema: z.ZodObject<{
     server: z.ZodDefault<z.ZodString>;
-    /** Topic approval requests are sent to. Anyone who can read it can approve: keep it secret. */
     topic: z.ZodString;
-    /** Topic answers are posted to. Default: `<topic>-reply`. */
     replyTopic: z.ZodOptional<z.ZodString>;
     token: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    server: string;
-    topic: string;
-    replyTopic?: string | undefined;
-    token?: string | undefined;
-}, {
-    topic: string;
-    server?: string | undefined;
-    replyTopic?: string | undefined;
-    token?: string | undefined;
-}>;
+}, z.core.$strict>;
 export declare const EmailConfigSchema: z.ZodObject<{
     smtp: z.ZodObject<{
         host: z.ZodString;
         port: z.ZodDefault<z.ZodNumber>;
-        /** TLS from the start. Default: true on port 465, otherwise STARTTLS. */
         secure: z.ZodOptional<z.ZodBoolean>;
         user: z.ZodOptional<z.ZodString>;
         pass: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        host: string;
-        port: number;
-        user?: string | undefined;
-        secure?: boolean | undefined;
-        pass?: string | undefined;
-    }, {
-        host: string;
-        user?: string | undefined;
-        port?: number | undefined;
-        secure?: boolean | undefined;
-        pass?: string | undefined;
-    }>;
+    }, z.core.$strict>;
     from: z.ZodString;
-    to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "atleastone">]>;
-    on: z.ZodDefault<z.ZodArray<z.ZodEnum<["pending", "blocked", "approved", "denied", "timeout", "undeliverable"]>, "atleastone">>;
-}, "strict", z.ZodTypeAny, {
-    on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
-    smtp: {
-        host: string;
-        port: number;
-        user?: string | undefined;
-        secure?: boolean | undefined;
-        pass?: string | undefined;
-    };
-    from: string;
-    to: string | [string, ...string[]];
-}, {
-    smtp: {
-        host: string;
-        user?: string | undefined;
-        port?: number | undefined;
-        secure?: boolean | undefined;
-        pass?: string | undefined;
-    };
-    from: string;
-    to: string | [string, ...string[]];
-    on?: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]] | undefined;
-}>;
+    to: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+    on: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        approved: "approved";
+        denied: "denied";
+        timeout: "timeout";
+        undeliverable: "undeliverable";
+        pending: "pending";
+        blocked: "blocked";
+    }>>>;
+}, z.core.$strict>;
 export declare const ApprovalsConfigSchema: z.ZodObject<{
-    /**
-     * How long a call waits for an answer; no answer means deny. Many MCP
-     * clients give up on a request after 60 seconds, hence the default.
-     */
     timeoutSeconds: z.ZodDefault<z.ZodNumber>;
     ntfy: z.ZodOptional<z.ZodObject<{
         server: z.ZodDefault<z.ZodString>;
-        /** Topic approval requests are sent to. Anyone who can read it can approve: keep it secret. */
         topic: z.ZodString;
-        /** Topic answers are posted to. Default: `<topic>-reply`. */
         replyTopic: z.ZodOptional<z.ZodString>;
         token: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        server: string;
-        topic: string;
-        replyTopic?: string | undefined;
-        token?: string | undefined;
-    }, {
-        topic: string;
-        server?: string | undefined;
-        replyTopic?: string | undefined;
-        token?: string | undefined;
-    }>>;
+    }, z.core.$strict>>;
     email: z.ZodOptional<z.ZodObject<{
         smtp: z.ZodObject<{
             host: z.ZodString;
             port: z.ZodDefault<z.ZodNumber>;
-            /** TLS from the start. Default: true on port 465, otherwise STARTTLS. */
             secure: z.ZodOptional<z.ZodBoolean>;
             user: z.ZodOptional<z.ZodString>;
             pass: z.ZodOptional<z.ZodString>;
-        }, "strict", z.ZodTypeAny, {
-            host: string;
-            port: number;
-            user?: string | undefined;
-            secure?: boolean | undefined;
-            pass?: string | undefined;
-        }, {
-            host: string;
-            user?: string | undefined;
-            port?: number | undefined;
-            secure?: boolean | undefined;
-            pass?: string | undefined;
-        }>;
+        }, z.core.$strict>;
         from: z.ZodString;
-        to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "atleastone">]>;
-        on: z.ZodDefault<z.ZodArray<z.ZodEnum<["pending", "blocked", "approved", "denied", "timeout", "undeliverable"]>, "atleastone">>;
-    }, "strict", z.ZodTypeAny, {
-        on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
-        smtp: {
-            host: string;
-            port: number;
-            user?: string | undefined;
-            secure?: boolean | undefined;
-            pass?: string | undefined;
-        };
-        from: string;
-        to: string | [string, ...string[]];
-    }, {
-        smtp: {
-            host: string;
-            user?: string | undefined;
-            port?: number | undefined;
-            secure?: boolean | undefined;
-            pass?: string | undefined;
-        };
-        from: string;
-        to: string | [string, ...string[]];
-        on?: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]] | undefined;
-    }>>;
-    /**
-     * Also ask in the MCP client (elicitation), when it supports it. Off by
-     * default: a client that accepts elicitations by itself would approve calls.
-     */
+        to: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+        on: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            approved: "approved";
+            denied: "denied";
+            timeout: "timeout";
+            undeliverable: "undeliverable";
+            pending: "pending";
+            blocked: "blocked";
+        }>>>;
+    }, z.core.$strict>>;
     elicitation: z.ZodDefault<z.ZodBoolean>;
-    /**
-     * Each approver's own channel, by principal id. Policy rules with
-     * `approvers: [role]` ask only these people, so the answer names who approved.
-     */
+    totp: z.ZodDefault<z.ZodBoolean>;
     approvers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         ntfy: z.ZodObject<{
             server: z.ZodDefault<z.ZodString>;
-            /** Topic approval requests are sent to. Anyone who can read it can approve: keep it secret. */
             topic: z.ZodString;
-            /** Topic answers are posted to. Default: `<topic>-reply`. */
             replyTopic: z.ZodOptional<z.ZodString>;
             token: z.ZodOptional<z.ZodString>;
-        }, "strict", z.ZodTypeAny, {
-            server: string;
-            topic: string;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        }, {
-            topic: string;
-            server?: string | undefined;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        }>;
-    }, "strict", z.ZodTypeAny, {
-        ntfy: {
-            server: string;
-            topic: string;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        };
-    }, {
-        ntfy: {
-            topic: string;
-            server?: string | undefined;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        };
-    }>>>;
-}, "strict", z.ZodTypeAny, {
-    timeoutSeconds: number;
-    elicitation: boolean;
-    approvers?: Record<string, {
-        ntfy: {
-            server: string;
-            topic: string;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        };
-    }> | undefined;
-    email?: {
-        on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
-        smtp: {
-            host: string;
-            port: number;
-            user?: string | undefined;
-            secure?: boolean | undefined;
-            pass?: string | undefined;
-        };
-        from: string;
-        to: string | [string, ...string[]];
-    } | undefined;
-    ntfy?: {
-        server: string;
-        topic: string;
-        replyTopic?: string | undefined;
-        token?: string | undefined;
-    } | undefined;
-}, {
-    approvers?: Record<string, {
-        ntfy: {
-            topic: string;
-            server?: string | undefined;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        };
-    }> | undefined;
-    email?: {
-        smtp: {
-            host: string;
-            user?: string | undefined;
-            port?: number | undefined;
-            secure?: boolean | undefined;
-            pass?: string | undefined;
-        };
-        from: string;
-        to: string | [string, ...string[]];
-        on?: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]] | undefined;
-    } | undefined;
-    timeoutSeconds?: number | undefined;
-    ntfy?: {
-        topic: string;
-        server?: string | undefined;
-        replyTopic?: string | undefined;
-        token?: string | undefined;
-    } | undefined;
-    elicitation?: boolean | undefined;
-}>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
 export type ApprovalsConfig = z.infer<typeof ApprovalsConfigSchema>;
 export declare const PrincipalConfigSchema: z.ZodObject<{
-    type: z.ZodDefault<z.ZodEnum<["user", "service"]>>;
+    type: z.ZodDefault<z.ZodEnum<{
+        user: "user";
+        service: "service";
+    }>>;
     id: z.ZodString;
     claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, "strict", z.ZodTypeAny, {
-    id: string;
-    type: "user" | "service";
-    claims?: Record<string, unknown> | undefined;
-}, {
-    id: string;
-    type?: "user" | "service" | undefined;
-    claims?: Record<string, unknown> | undefined;
-}>;
+}, z.core.$strict>;
 export type PrincipalConfig = z.infer<typeof PrincipalConfigSchema>;
-export declare const RoleSchema: z.ZodEffects<z.ZodObject<{
-    /** Principal ids; "*" means everyone, including an anonymous caller. */
-    members: z.ZodArray<z.ZodString, "atleastone">;
-    tools: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-    prompts: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-    /** Resource URI patterns, e.g. "github://acme/*". */
-    resources: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-}, "strict", z.ZodTypeAny, {
-    members: [string, ...string[]];
-    tools: string[];
-    prompts: string[];
-    resources: string[];
-}, {
-    members: [string, ...string[]];
-    tools?: string[] | undefined;
-    prompts?: string[] | undefined;
-    resources?: string[] | undefined;
-}>, {
-    members: [string, ...string[]];
-    tools: string[];
-    prompts: string[];
-    resources: string[];
-}, {
-    members: [string, ...string[]];
-    tools?: string[] | undefined;
-    prompts?: string[] | undefined;
-    resources?: string[] | undefined;
-}>;
+export declare const RoleSchema: z.ZodObject<{
+    members: z.ZodArray<z.ZodString>;
+    tools: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    prompts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    resources: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
 export type RoleConfig = z.infer<typeof RoleSchema>;
 export declare const CedarConfigSchema: z.ZodObject<{
-    /** Cedar policy file. Relative paths are resolved against the config file's directory. */
     policies: z.ZodString;
-    /** Optional Cedar entities JSON file: groups (`parents`) and attributes. */
     entities: z.ZodOptional<z.ZodString>;
-    /** IANA time zone for `context.time`, e.g. "Europe/Berlin". Default: the gateway's. */
-    timeZone: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-}, "strict", z.ZodTypeAny, {
-    policies: string;
-    entities?: string | undefined;
-    timeZone?: string | undefined;
-}, {
-    policies: string;
-    entities?: string | undefined;
-    timeZone?: string | undefined;
-}>;
+    timeZone: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
 export type CedarConfig = z.infer<typeof CedarConfigSchema>;
+export declare const OpenFgaConfigSchema: z.ZodObject<{
+    url: z.ZodString;
+    storeId: z.ZodString;
+    modelId: z.ZodOptional<z.ZodString>;
+    token: z.ZodOptional<z.ZodString>;
+    relation: z.ZodDefault<z.ZodString>;
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+    tools: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        relation: z.ZodOptional<z.ZodString>;
+        object: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type OpenFgaConfig = z.infer<typeof OpenFgaConfigSchema>;
+/** SEP-2624 InterceptorOverrides, set by the gateway owner for one interceptor. */
+export declare const InterceptorOverridesSchema: z.ZodObject<{
+    failOpen: z.ZodOptional<z.ZodBoolean>;
+    priorityHint: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+        request: z.ZodOptional<z.ZodNumber>;
+        response: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>]>>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        audit: "audit";
+    }>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    hooks: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        events: z.ZodArray<z.ZodString>;
+        phase: z.ZodEnum<{
+            request: "request";
+            response: "response";
+        }>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
 export declare const GatewayConfigSchema: z.ZodObject<{
-    upstreams: z.ZodEffects<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
+    upstreams: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
         command: z.ZodString;
-        args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
         env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
         cwd: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        command: string;
-        args: string[];
-        env: Record<string, string>;
-        cwd?: string | undefined;
-    }, {
-        command: string;
-        args?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        cwd?: string | undefined;
-    }>, z.ZodObject<{
+    }, z.core.$strict>, z.ZodObject<{
         url: z.ZodString;
         headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
-    }, "strict", z.ZodTypeAny, {
-        url: string;
-        headers: Record<string, string>;
-    }, {
-        url: string;
-        headers?: Record<string, string> | undefined;
-    }>]>>, Record<string, {
-        command: string;
-        args: string[];
-        env: Record<string, string>;
-        cwd?: string | undefined;
-    } | {
-        url: string;
-        headers: Record<string, string>;
-    }>, Record<string, {
-        command: string;
-        args?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        cwd?: string | undefined;
-    } | {
-        url: string;
-        headers?: Record<string, string> | undefined;
-    }>>, Record<string, {
-        command: string;
-        args: string[];
-        env: Record<string, string>;
-        cwd?: string | undefined;
-    } | {
-        url: string;
-        headers: Record<string, string>;
-    }>, Record<string, {
-        command: string;
-        args?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        cwd?: string | undefined;
-    } | {
-        url: string;
-        headers?: Record<string, string> | undefined;
-    }>>;
-    /** How to start the interceptor server. Default: the bundled adtl-interceptors with this same config file. */
+    }, z.core.$strict>]>>;
     interceptors: z.ZodOptional<z.ZodObject<{
         command: z.ZodString;
-        args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
         env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
         cwd: z.ZodOptional<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        command: string;
-        args: string[];
-        env: Record<string, string>;
-        cwd?: string | undefined;
-    }, {
-        command: string;
-        args?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        cwd?: string | undefined;
-    }>>;
-    /** Path of a JSONL audit log. Relative paths are resolved against the config file's directory. */
+    }, z.core.$strict>>;
+    interceptorServers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        cwd: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strict>]>>>;
     audit: z.ZodOptional<z.ZodString>;
-    /**
-     * `active` (default) enforces the policy. `audit` stops and changes nothing, and
-     * logs what would have been stopped: for trying a policy out safely.
-     */
-    mode: z.ZodDefault<z.ZodEnum<["active", "audit"]>>;
-    /** Human approvals for "ask" decisions. Without an answering channel, "ask" blocks. */
+    mode: z.ZodDefault<z.ZodEnum<{
+        active: "active";
+        audit: "audit";
+    }>>;
     approvals: z.ZodOptional<z.ZodObject<{
-        /**
-         * How long a call waits for an answer; no answer means deny. Many MCP
-         * clients give up on a request after 60 seconds, hence the default.
-         */
         timeoutSeconds: z.ZodDefault<z.ZodNumber>;
         ntfy: z.ZodOptional<z.ZodObject<{
             server: z.ZodDefault<z.ZodString>;
-            /** Topic approval requests are sent to. Anyone who can read it can approve: keep it secret. */
             topic: z.ZodString;
-            /** Topic answers are posted to. Default: `<topic>-reply`. */
             replyTopic: z.ZodOptional<z.ZodString>;
             token: z.ZodOptional<z.ZodString>;
-        }, "strict", z.ZodTypeAny, {
-            server: string;
-            topic: string;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        }, {
-            topic: string;
-            server?: string | undefined;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        }>>;
+        }, z.core.$strict>>;
         email: z.ZodOptional<z.ZodObject<{
             smtp: z.ZodObject<{
                 host: z.ZodString;
                 port: z.ZodDefault<z.ZodNumber>;
-                /** TLS from the start. Default: true on port 465, otherwise STARTTLS. */
                 secure: z.ZodOptional<z.ZodBoolean>;
                 user: z.ZodOptional<z.ZodString>;
                 pass: z.ZodOptional<z.ZodString>;
-            }, "strict", z.ZodTypeAny, {
-                host: string;
-                port: number;
-                user?: string | undefined;
-                secure?: boolean | undefined;
-                pass?: string | undefined;
-            }, {
-                host: string;
-                user?: string | undefined;
-                port?: number | undefined;
-                secure?: boolean | undefined;
-                pass?: string | undefined;
-            }>;
+            }, z.core.$strict>;
             from: z.ZodString;
-            to: z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "atleastone">]>;
-            on: z.ZodDefault<z.ZodArray<z.ZodEnum<["pending", "blocked", "approved", "denied", "timeout", "undeliverable"]>, "atleastone">>;
-        }, "strict", z.ZodTypeAny, {
-            on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
-            smtp: {
-                host: string;
-                port: number;
-                user?: string | undefined;
-                secure?: boolean | undefined;
-                pass?: string | undefined;
-            };
-            from: string;
-            to: string | [string, ...string[]];
-        }, {
-            smtp: {
-                host: string;
-                user?: string | undefined;
-                port?: number | undefined;
-                secure?: boolean | undefined;
-                pass?: string | undefined;
-            };
-            from: string;
-            to: string | [string, ...string[]];
-            on?: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]] | undefined;
-        }>>;
-        /**
-         * Also ask in the MCP client (elicitation), when it supports it. Off by
-         * default: a client that accepts elicitations by itself would approve calls.
-         */
+            to: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
+            on: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                approved: "approved";
+                denied: "denied";
+                timeout: "timeout";
+                undeliverable: "undeliverable";
+                pending: "pending";
+                blocked: "blocked";
+            }>>>;
+        }, z.core.$strict>>;
         elicitation: z.ZodDefault<z.ZodBoolean>;
-        /**
-         * Each approver's own channel, by principal id. Policy rules with
-         * `approvers: [role]` ask only these people, so the answer names who approved.
-         */
+        totp: z.ZodDefault<z.ZodBoolean>;
         approvers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             ntfy: z.ZodObject<{
                 server: z.ZodDefault<z.ZodString>;
-                /** Topic approval requests are sent to. Anyone who can read it can approve: keep it secret. */
                 topic: z.ZodString;
-                /** Topic answers are posted to. Default: `<topic>-reply`. */
                 replyTopic: z.ZodOptional<z.ZodString>;
                 token: z.ZodOptional<z.ZodString>;
-            }, "strict", z.ZodTypeAny, {
-                server: string;
-                topic: string;
-                replyTopic?: string | undefined;
-                token?: string | undefined;
-            }, {
-                topic: string;
-                server?: string | undefined;
-                replyTopic?: string | undefined;
-                token?: string | undefined;
-            }>;
-        }, "strict", z.ZodTypeAny, {
-            ntfy: {
-                server: string;
-                topic: string;
-                replyTopic?: string | undefined;
-                token?: string | undefined;
-            };
-        }, {
-            ntfy: {
-                topic: string;
-                server?: string | undefined;
-                replyTopic?: string | undefined;
-                token?: string | undefined;
-            };
-        }>>>;
-    }, "strict", z.ZodTypeAny, {
-        timeoutSeconds: number;
-        elicitation: boolean;
-        approvers?: Record<string, {
-            ntfy: {
-                server: string;
-                topic: string;
-                replyTopic?: string | undefined;
-                token?: string | undefined;
-            };
-        }> | undefined;
-        email?: {
-            on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
-            smtp: {
-                host: string;
-                port: number;
-                user?: string | undefined;
-                secure?: boolean | undefined;
-                pass?: string | undefined;
-            };
-            from: string;
-            to: string | [string, ...string[]];
-        } | undefined;
-        ntfy?: {
-            server: string;
-            topic: string;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        } | undefined;
-    }, {
-        approvers?: Record<string, {
-            ntfy: {
-                topic: string;
-                server?: string | undefined;
-                replyTopic?: string | undefined;
-                token?: string | undefined;
-            };
-        }> | undefined;
-        email?: {
-            smtp: {
-                host: string;
-                user?: string | undefined;
-                port?: number | undefined;
-                secure?: boolean | undefined;
-                pass?: string | undefined;
-            };
-            from: string;
-            to: string | [string, ...string[]];
-            on?: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]] | undefined;
-        } | undefined;
-        timeoutSeconds?: number | undefined;
-        ntfy?: {
-            topic: string;
-            server?: string | undefined;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        } | undefined;
-        elicitation?: boolean | undefined;
-    }>>;
-    /** Timeout for each interceptor invocation, in milliseconds. */
+            }, z.core.$strict>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
     interceptorTimeoutMs: z.ZodDefault<z.ZodNumber>;
-    /** Who runs this gateway. Passed to the authorizer and the interceptors. Default: anonymous. */
+    interceptorOverrides: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        failOpen: z.ZodOptional<z.ZodBoolean>;
+        priorityHint: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+            request: z.ZodOptional<z.ZodNumber>;
+            response: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>>;
+        mode: z.ZodOptional<z.ZodEnum<{
+            active: "active";
+            audit: "audit";
+        }>>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        hooks: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            events: z.ZodArray<z.ZodString>;
+            phase: z.ZodEnum<{
+                request: "request";
+                response: "response";
+            }>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>>;
     principal: z.ZodOptional<z.ZodObject<{
-        type: z.ZodDefault<z.ZodEnum<["user", "service"]>>;
+        type: z.ZodDefault<z.ZodEnum<{
+            user: "user";
+            service: "service";
+        }>>;
         id: z.ZodString;
         claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    }, "strict", z.ZodTypeAny, {
-        id: string;
-        type: "user" | "service";
-        claims?: Record<string, unknown> | undefined;
-    }, {
-        id: string;
-        type?: "user" | "service" | undefined;
-        claims?: Record<string, unknown> | undefined;
-    }>>;
-    /** Role-based authorization: when present, a call no role grants is denied. */
-    roles: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
-        /** Principal ids; "*" means everyone, including an anonymous caller. */
-        members: z.ZodArray<z.ZodString, "atleastone">;
-        tools: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-        prompts: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
-        /** Resource URI patterns, e.g. "github://acme/*". */
-        resources: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        members: [string, ...string[]];
-        tools: string[];
-        prompts: string[];
-        resources: string[];
-    }, {
-        members: [string, ...string[]];
-        tools?: string[] | undefined;
-        prompts?: string[] | undefined;
-        resources?: string[] | undefined;
-    }>, {
-        members: [string, ...string[]];
-        tools: string[];
-        prompts: string[];
-        resources: string[];
-    }, {
-        members: [string, ...string[]];
-        tools?: string[] | undefined;
-        prompts?: string[] | undefined;
-        resources?: string[] | undefined;
-    }>>, Record<string, {
-        members: [string, ...string[]];
-        tools: string[];
-        prompts: string[];
-        resources: string[];
-    }>, Record<string, {
-        members: [string, ...string[]];
-        tools?: string[] | undefined;
-        prompts?: string[] | undefined;
-        resources?: string[] | undefined;
-    }>>>;
-    /** Cedar authorization. With roles as well, both must allow. */
+    }, z.core.$strict>>;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        members: z.ZodArray<z.ZodString>;
+        tools: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        prompts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        resources: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
     cedar: z.ZodOptional<z.ZodObject<{
-        /** Cedar policy file. Relative paths are resolved against the config file's directory. */
         policies: z.ZodString;
-        /** Optional Cedar entities JSON file: groups (`parents`) and attributes. */
         entities: z.ZodOptional<z.ZodString>;
-        /** IANA time zone for `context.time`, e.g. "Europe/Berlin". Default: the gateway's. */
-        timeZone: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    }, "strict", z.ZodTypeAny, {
-        policies: string;
-        entities?: string | undefined;
-        timeZone?: string | undefined;
-    }, {
-        policies: string;
-        entities?: string | undefined;
-        timeZone?: string | undefined;
-    }>>;
-}, "strict", z.ZodTypeAny, {
-    mode: "active" | "audit";
-    upstreams: Record<string, {
-        command: string;
-        args: string[];
-        env: Record<string, string>;
-        cwd?: string | undefined;
-    } | {
-        url: string;
-        headers: Record<string, string>;
-    }>;
-    interceptorTimeoutMs: number;
-    audit?: string | undefined;
-    interceptors?: {
-        command: string;
-        args: string[];
-        env: Record<string, string>;
-        cwd?: string | undefined;
-    } | undefined;
-    principal?: {
-        id: string;
-        type: "user" | "service";
-        claims?: Record<string, unknown> | undefined;
-    } | undefined;
-    approvals?: {
-        timeoutSeconds: number;
-        elicitation: boolean;
-        approvers?: Record<string, {
-            ntfy: {
-                server: string;
-                topic: string;
-                replyTopic?: string | undefined;
-                token?: string | undefined;
-            };
-        }> | undefined;
-        email?: {
-            on: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]];
-            smtp: {
-                host: string;
-                port: number;
-                user?: string | undefined;
-                secure?: boolean | undefined;
-                pass?: string | undefined;
-            };
-            from: string;
-            to: string | [string, ...string[]];
-        } | undefined;
-        ntfy?: {
-            server: string;
-            topic: string;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        } | undefined;
-    } | undefined;
-    roles?: Record<string, {
-        members: [string, ...string[]];
-        tools: string[];
-        prompts: string[];
-        resources: string[];
-    }> | undefined;
-    cedar?: {
-        policies: string;
-        entities?: string | undefined;
-        timeZone?: string | undefined;
-    } | undefined;
-}, {
-    upstreams: Record<string, {
-        command: string;
-        args?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        cwd?: string | undefined;
-    } | {
-        url: string;
-        headers?: Record<string, string> | undefined;
-    }>;
-    mode?: "active" | "audit" | undefined;
-    audit?: string | undefined;
-    interceptors?: {
-        command: string;
-        args?: string[] | undefined;
-        env?: Record<string, string> | undefined;
-        cwd?: string | undefined;
-    } | undefined;
-    principal?: {
-        id: string;
-        type?: "user" | "service" | undefined;
-        claims?: Record<string, unknown> | undefined;
-    } | undefined;
-    approvals?: {
-        approvers?: Record<string, {
-            ntfy: {
-                topic: string;
-                server?: string | undefined;
-                replyTopic?: string | undefined;
-                token?: string | undefined;
-            };
-        }> | undefined;
-        email?: {
-            smtp: {
-                host: string;
-                user?: string | undefined;
-                port?: number | undefined;
-                secure?: boolean | undefined;
-                pass?: string | undefined;
-            };
-            from: string;
-            to: string | [string, ...string[]];
-            on?: ["approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked", ...("approved" | "denied" | "timeout" | "undeliverable" | "pending" | "blocked")[]] | undefined;
-        } | undefined;
-        timeoutSeconds?: number | undefined;
-        ntfy?: {
-            topic: string;
-            server?: string | undefined;
-            replyTopic?: string | undefined;
-            token?: string | undefined;
-        } | undefined;
-        elicitation?: boolean | undefined;
-    } | undefined;
-    interceptorTimeoutMs?: number | undefined;
-    roles?: Record<string, {
-        members: [string, ...string[]];
-        tools?: string[] | undefined;
-        prompts?: string[] | undefined;
-        resources?: string[] | undefined;
-    }> | undefined;
-    cedar?: {
-        policies: string;
-        entities?: string | undefined;
-        timeZone?: string | undefined;
-    } | undefined;
-}>;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    openfga: z.ZodOptional<z.ZodObject<{
+        url: z.ZodString;
+        storeId: z.ZodString;
+        modelId: z.ZodOptional<z.ZodString>;
+        token: z.ZodOptional<z.ZodString>;
+        relation: z.ZodDefault<z.ZodString>;
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        tools: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+            relation: z.ZodOptional<z.ZodString>;
+            object: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 export type GatewayConfig = z.infer<typeof GatewayConfigSchema>;
 export declare const TOOL_SEPARATOR = "__";
 export declare class EnvExpansionError extends Error {