@frontmcp/sdk 0.12.2 → 1.0.0-beta.2

package/common/metadata/front-mcp.metadata.d.ts

@@ -1,5 +1,7 @@
 import { z } from 'zod';
 import { AuthOptions, ServerInfoOptions, AuthOptionsInput, RedisOptionsInput, PubsubOptionsInput, TransportOptionsInput, PaginationOptions, HttpOptionsInput, LoggingOptionsInput, ElicitationOptionsInput, SkillsConfigOptionsInput, ExtAppsOptionsInput, SqliteOptionsInput } from '../types';
+import { type PackageLoader } from './app.metadata';
+import { type GuardConfig } from '@frontmcp/guard';
 import { AppType, PluginType, ProviderType, ResourceType, SkillType, ToolType } from '../interfaces';
 export interface FrontMcpBaseMetadata {
     info: ServerInfoOptions;
@@ -143,6 +145,27 @@ export interface FrontMcpBaseMetadata {
      * Used by the Unix socket daemon mode and other local runtimes.
      */
     sqlite?: SqliteOptionsInput;
+    /**
+     * Default package loader config for all npm/esm apps.
+     * Individual apps can override this via `packageConfig.loader`.
+     */
+    loader?: PackageLoader;
+    /**
+     * UI rendering configuration.
+     * Controls CDN overrides for widget import resolution.
+     *
+     * @example Override @frontmcp/ui to load from local dev server
+     * ```typescript
+     * ui: {
+     *   cdnOverrides: {
+     *     '@frontmcp/ui': 'http://localhost:5173/@frontmcp/ui',
+     *   },
+     * }
+     * ```
+     */
+    ui?: {
+        cdnOverrides?: Record<string, string>;
+    };
     /**
      * Jobs and workflows configuration.
      * Enables the jobs/workflows system for saved, discoverable, triggerable executions.
@@ -169,6 +192,32 @@ export interface FrontMcpBaseMetadata {
             keyPrefix?: string;
         };
     };
+    /**
+     * Rate limiting, concurrency control, and timeout configuration.
+     * Controls global and default throttle behavior for all entities.
+     *
+     * @default { enabled: false }
+     *
+     * @example Global rate limiting by IP
+     * ```typescript
+     * throttle: {
+     *   enabled: true,
+     *   global: { maxRequests: 1000, windowMs: 60_000, partitionBy: 'ip' },
+     *   defaultTimeout: { executeMs: 30_000 },
+     * }
+     * ```
+     *
+     * @example With Redis backend and per-tool defaults
+     * ```typescript
+     * throttle: {
+     *   enabled: true,
+     *   defaultRateLimit: { maxRequests: 60, windowMs: 60_000, partitionBy: 'session' },
+     *   defaultConcurrency: { maxConcurrent: 10 },
+     *   defaultTimeout: { executeMs: 30_000 },
+     * }
+     * ```
+     */
+    throttle?: GuardConfig;
 }
 export declare const frontMcpBaseSchema: z.ZodObject<{
     info: z.ZodObject<{
@@ -187,7 +236,7 @@ export declare const frontMcpBaseSchema: z.ZodObject<{
         }, z.core.$strip>>>;
     }, z.core.$strip>;
     providers: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
-    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
+    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<string | import("libs/di/dist/interfaces/base.interface").Type<unknown>, string | import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     resources: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     skills: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     plugins: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
@@ -690,6 +739,9 @@ export declare const frontMcpBaseSchema: z.ZodObject<{
         ttlCleanupIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
         walMode: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     }, z.core.$strip>>;
+    ui: z.ZodOptional<z.ZodObject<{
+        cdnOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
     jobs: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodBoolean;
         store: z.ZodOptional<z.ZodObject<{
@@ -737,6 +789,102 @@ export declare const frontMcpBaseSchema: z.ZodObject<{
             keyPrefix: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    loader: z.ZodOptional<z.ZodObject<{
+        url: z.ZodOptional<z.ZodString>;
+        registryUrl: z.ZodOptional<z.ZodString>;
+        token: z.ZodOptional<z.ZodString>;
+        tokenEnvVar: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    throttle: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        storage: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        global: z.ZodOptional<z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            windowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        globalConcurrency: z.ZodOptional<z.ZodObject<{
+            maxConcurrent: z.ZodNumber;
+            queueTimeoutMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultRateLimit: z.ZodOptional<z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            windowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultConcurrency: z.ZodOptional<z.ZodObject<{
+            maxConcurrent: z.ZodNumber;
+            queueTimeoutMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultTimeout: z.ZodOptional<z.ZodObject<{
+            executeMs: z.ZodNumber;
+        }, z.core.$strip>>;
+        ipFilter: z.ZodOptional<z.ZodObject<{
+            allowList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denyList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            defaultAction: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>>;
+            trustProxy: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            trustedProxyDepth: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export interface FrontMcpMultiAppMetadata extends FrontMcpBaseMetadata {
     splitByApp?: false;
@@ -759,7 +907,7 @@ declare const frontMcpMultiAppSchema: z.ZodObject<{
         }, z.core.$strip>>>;
     }, z.core.$strip>;
     providers: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
-    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
+    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<string | import("libs/di/dist/interfaces/base.interface").Type<unknown>, string | import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     resources: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     skills: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     plugins: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
@@ -1262,6 +1410,9 @@ declare const frontMcpMultiAppSchema: z.ZodObject<{
         ttlCleanupIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
         walMode: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     }, z.core.$strip>>;
+    ui: z.ZodOptional<z.ZodObject<{
+        cdnOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
     jobs: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodBoolean;
         store: z.ZodOptional<z.ZodObject<{
@@ -1309,6 +1460,102 @@ declare const frontMcpMultiAppSchema: z.ZodObject<{
             keyPrefix: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    loader: z.ZodOptional<z.ZodObject<{
+        url: z.ZodOptional<z.ZodString>;
+        registryUrl: z.ZodOptional<z.ZodString>;
+        token: z.ZodOptional<z.ZodString>;
+        tokenEnvVar: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    throttle: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        storage: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        global: z.ZodOptional<z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            windowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        globalConcurrency: z.ZodOptional<z.ZodObject<{
+            maxConcurrent: z.ZodNumber;
+            queueTimeoutMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultRateLimit: z.ZodOptional<z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            windowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultConcurrency: z.ZodOptional<z.ZodObject<{
+            maxConcurrent: z.ZodNumber;
+            queueTimeoutMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultTimeout: z.ZodOptional<z.ZodObject<{
+            executeMs: z.ZodNumber;
+        }, z.core.$strip>>;
+        ipFilter: z.ZodOptional<z.ZodObject<{
+            allowList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denyList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            defaultAction: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>>;
+            trustProxy: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            trustedProxyDepth: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     splitByApp: z.ZodDefault<z.ZodLiteral<false>>;
     auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         mode: z.ZodLiteral<"public">;
@@ -1325,33 +1572,33 @@ declare const frontMcpMultiAppSchema: z.ZodObject<{
         }, z.core.$strip>>;
         signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
     }, z.core.$strip>, z.ZodObject<{
-        mode: z.ZodLiteral<"transparent">;
-        remote: z.ZodObject<{
-            provider: z.ZodString;
+        expectedAudience: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        requiredScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        allowAnonymous: z.ZodDefault<z.ZodBoolean>;
+        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publicAccess: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            rateLimit: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        provider: z.ZodString;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        providerConfig: z.ZodOptional<z.ZodObject<{
             name: z.ZodOptional<z.ZodString>;
             id: z.ZodOptional<z.ZodString>;
             jwks: z.ZodOptional<z.ZodObject<{
                 keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
             }, z.core.$strip>>;
             jwksUri: z.ZodOptional<z.ZodString>;
-            clientId: z.ZodOptional<z.ZodString>;
-            clientSecret: z.ZodOptional<z.ZodString>;
-            scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
             dcrEnabled: z.ZodDefault<z.ZodBoolean>;
             authEndpoint: z.ZodOptional<z.ZodString>;
             tokenEndpoint: z.ZodOptional<z.ZodString>;
             registrationEndpoint: z.ZodOptional<z.ZodString>;
             userInfoEndpoint: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>;
-        expectedAudience: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-        requiredScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        allowAnonymous: z.ZodDefault<z.ZodBoolean>;
-        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        publicAccess: z.ZodOptional<z.ZodObject<{
-            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
-            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
-            rateLimit: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
+        mode: z.ZodLiteral<"transparent">;
     }, z.core.$strip>, z.ZodObject<{
         local: z.ZodOptional<z.ZodObject<{
             signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
@@ -1360,11 +1607,8 @@ declare const frontMcpMultiAppSchema: z.ZodObject<{
             }, z.core.$strip>>;
             issuer: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
-        tokenStorage: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"memory">;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"redis">;
-            config: z.ZodObject<{
+        tokenStorage: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"memory">, z.ZodObject<{
+            redis: z.ZodObject<{
                 host: z.ZodString;
                 port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
                 password: z.ZodOptional<z.ZodString>;
@@ -1373,7 +1617,7 @@ declare const frontMcpMultiAppSchema: z.ZodObject<{
                 keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
                 defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
             }, z.core.$strip>;
-        }, z.core.$strip>], "type">>;
+        }, z.core.$strip>]>>;
         allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
         anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
         publicAccess: z.ZodOptional<z.ZodObject<{
@@ -1450,8 +1694,7 @@ declare const frontMcpMultiAppSchema: z.ZodObject<{
                 maxRedirects: z.ZodDefault<z.ZodNumber>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
-        mode: z.ZodLiteral<"orchestrated">;
-        type: z.ZodLiteral<"local">;
+        mode: z.ZodLiteral<"local">;
     }, z.core.$strip>, z.ZodObject<{
         local: z.ZodOptional<z.ZodObject<{
             signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
@@ -1460,11 +1703,8 @@ declare const frontMcpMultiAppSchema: z.ZodObject<{
             }, z.core.$strip>>;
             issuer: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
-        tokenStorage: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"memory">;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"redis">;
-            config: z.ZodObject<{
+        tokenStorage: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"memory">, z.ZodObject<{
+            redis: z.ZodObject<{
                 host: z.ZodString;
                 port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
                 password: z.ZodOptional<z.ZodString>;
@@ -1473,7 +1713,7 @@ declare const frontMcpMultiAppSchema: z.ZodObject<{
                 keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
                 defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
             }, z.core.$strip>;
-        }, z.core.$strip>], "type">>;
+        }, z.core.$strip>]>>;
         allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
         anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
         publicAccess: z.ZodOptional<z.ZodObject<{
@@ -1550,30 +1790,29 @@ declare const frontMcpMultiAppSchema: z.ZodObject<{
                 maxRedirects: z.ZodDefault<z.ZodNumber>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
-        mode: z.ZodLiteral<"orchestrated">;
-        type: z.ZodLiteral<"remote">;
-        remote: z.ZodObject<{
-            provider: z.ZodString;
+        provider: z.ZodString;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        providerConfig: z.ZodOptional<z.ZodObject<{
             name: z.ZodOptional<z.ZodString>;
             id: z.ZodOptional<z.ZodString>;
             jwks: z.ZodOptional<z.ZodObject<{
                 keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
             }, z.core.$strip>>;
             jwksUri: z.ZodOptional<z.ZodString>;
-            clientId: z.ZodOptional<z.ZodString>;
-            clientSecret: z.ZodOptional<z.ZodString>;
-            scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
             dcrEnabled: z.ZodDefault<z.ZodBoolean>;
             authEndpoint: z.ZodOptional<z.ZodString>;
             tokenEndpoint: z.ZodOptional<z.ZodString>;
             registrationEndpoint: z.ZodOptional<z.ZodString>;
             userInfoEndpoint: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>;
+        }, z.core.$strip>>;
+        mode: z.ZodLiteral<"remote">;
     }, z.core.$strip>]>>;
 }, z.core.$strip>;
 export interface FrontMcpSplitByAppMetadata extends FrontMcpBaseMetadata {
     splitByApp: true;
-    auth?: never;
+    auth?: AuthOptionsInput;
 }
 declare const frontMcpSplitByAppSchema: z.ZodObject<{
     info: z.ZodObject<{
@@ -1592,7 +1831,7 @@ declare const frontMcpSplitByAppSchema: z.ZodObject<{
         }, z.core.$strip>>>;
     }, z.core.$strip>;
     providers: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
-    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
+    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<string | import("libs/di/dist/interfaces/base.interface").Type<unknown>, string | import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     resources: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     skills: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     plugins: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
@@ -2095,6 +2334,9 @@ declare const frontMcpSplitByAppSchema: z.ZodObject<{
         ttlCleanupIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
         walMode: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     }, z.core.$strip>>;
+    ui: z.ZodOptional<z.ZodObject<{
+        cdnOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
     jobs: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodBoolean;
         store: z.ZodOptional<z.ZodObject<{
@@ -2142,188 +2384,535 @@ declare const frontMcpSplitByAppSchema: z.ZodObject<{
             keyPrefix: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
-    splitByApp: z.ZodLiteral<true>;
-    auth: z.ZodOptional<z.ZodNever>;
-}, z.core.$strip>;
-export type FrontMcpMetadata = FrontMcpMultiAppMetadata | FrontMcpSplitByAppMetadata;
-export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
-    info: z.ZodObject<{
-        name: z.ZodString;
-        title: z.ZodOptional<z.ZodString>;
-        version: z.ZodString;
-        websiteUrl: z.ZodOptional<z.ZodURL>;
-        icons: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            src: z.ZodString;
-            mimeType: z.ZodOptional<z.ZodString>;
-            sizes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            theme: z.ZodOptional<z.ZodEnum<{
-                light: "light";
-                dark: "dark";
-            }>>;
-        }, z.core.$strip>>>;
-    }, z.core.$strip>;
-    providers: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
-    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
-    resources: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
-    skills: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
-    plugins: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
-    apps: z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>;
-    serve: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-    http: z.ZodOptional<z.ZodObject<{
-        port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        entryPath: z.ZodDefault<z.ZodString>;
-        hostFactory: z.ZodOptional<z.ZodAny>;
-        socketPath: z.ZodOptional<z.ZodString>;
-        cors: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
-            origin: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString, z.ZodArray<z.ZodString>, z.ZodCustom<(origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => void, (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => void>]>>;
-            credentials: z.ZodOptional<z.ZodBoolean>;
-            maxAge: z.ZodOptional<z.ZodNumber>;
-        }, z.core.$strip>]>>;
-    }, z.core.$strip>>;
-    redis: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
-        provider: z.ZodLiteral<"redis">;
-        host: z.ZodString;
-        port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        password: z.ZodOptional<z.ZodString>;
-        db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-        defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-    }, z.core.$strip>, z.ZodObject<{
-        provider: z.ZodLiteral<"vercel-kv">;
+    loader: z.ZodOptional<z.ZodObject<{
         url: z.ZodOptional<z.ZodString>;
+        registryUrl: z.ZodOptional<z.ZodString>;
         token: z.ZodOptional<z.ZodString>;
+        tokenEnvVar: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    throttle: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        storage: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
         keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-        defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-    }, z.core.$strip>, z.ZodPipe<z.ZodObject<{
-        host: z.ZodString;
-        port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        password: z.ZodOptional<z.ZodString>;
-        db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-        defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-    }, z.core.$strip>, z.ZodTransform<{
-        provider: "redis";
-        host: string;
-        port: number;
-        db: number;
-        tls: boolean;
-        keyPrefix: string;
-        defaultTtlMs: number;
-        password?: string | undefined;
-    }, {
-        host: string;
-        port: number;
-        db: number;
-        tls: boolean;
-        keyPrefix: string;
-        defaultTtlMs: number;
-        password?: string | undefined;
-    }>>]>>;
-    pubsub: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
-        provider: z.ZodLiteral<"redis">;
-        host: z.ZodString;
-        port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        password: z.ZodOptional<z.ZodString>;
-        db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-        defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-    }, z.core.$strip>, z.ZodPipe<z.ZodObject<{
-        host: z.ZodString;
-        port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        password: z.ZodOptional<z.ZodString>;
-        db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-        defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-    }, z.core.$strip>, z.ZodTransform<{
-        provider: "redis";
-        host: string;
-        port: number;
-        db: number;
-        tls: boolean;
-        keyPrefix: string;
-        defaultTtlMs: number;
-        password?: string | undefined;
-    }, {
-        host: string;
-        port: number;
-        db: number;
-        tls: boolean;
-        keyPrefix: string;
-        defaultTtlMs: number;
-        password?: string | undefined;
-    }>>]>>;
-    transport: z.ZodPipe<z.ZodOptional<z.ZodObject<{
-        sessionMode: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"stateful">, z.ZodLiteral<"stateless">, z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>]>>>;
-        platformDetection: z.ZodOptional<z.ZodObject<{
-            mappings: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                pattern: z.ZodUnion<readonly [z.ZodString, z.ZodCustom<RegExp, RegExp>]>;
-                platform: z.ZodEnum<{
-                    unknown: "unknown";
-                    openai: "openai";
-                    claude: "claude";
-                    gemini: "gemini";
-                    cursor: "cursor";
-                    continue: "continue";
-                    cody: "cody";
-                    "generic-mcp": "generic-mcp";
-                    "ext-apps": "ext-apps";
-                }>;
-            }, z.core.$strip>>>;
-            customOnly: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        global: z.ZodOptional<z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            windowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
         }, z.core.$strip>>;
-        protocol: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
-            modern: "modern";
-            legacy: "legacy";
-            "stateless-api": "stateless-api";
-            full: "full";
-        }>, z.ZodObject<{
-            sse: z.ZodOptional<z.ZodBoolean>;
-            streamable: z.ZodOptional<z.ZodBoolean>;
-            json: z.ZodOptional<z.ZodBoolean>;
-            stateless: z.ZodOptional<z.ZodBoolean>;
-            legacy: z.ZodOptional<z.ZodBoolean>;
-            strictSession: z.ZodOptional<z.ZodBoolean>;
-        }, z.core.$strip>]>>>;
-        persistence: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
-            redis: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
-                provider: z.ZodLiteral<"redis">;
-                host: z.ZodString;
-                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                password: z.ZodOptional<z.ZodString>;
-                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-            }, z.core.$strip>, z.ZodObject<{
-                provider: z.ZodLiteral<"vercel-kv">;
-                url: z.ZodOptional<z.ZodString>;
-                token: z.ZodOptional<z.ZodString>;
-                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-            }, z.core.$strip>, z.ZodPipe<z.ZodObject<{
-                host: z.ZodString;
-                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                password: z.ZodOptional<z.ZodString>;
-                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-            }, z.core.$strip>, z.ZodTransform<{
-                provider: "redis";
-                host: string;
-                port: number;
-                db: number;
-                tls: boolean;
-                keyPrefix: string;
-                defaultTtlMs: number;
-                password?: string | undefined;
-            }, {
-                host: string;
-                port: number;
+        globalConcurrency: z.ZodOptional<z.ZodObject<{
+            maxConcurrent: z.ZodNumber;
+            queueTimeoutMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultRateLimit: z.ZodOptional<z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            windowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultConcurrency: z.ZodOptional<z.ZodObject<{
+            maxConcurrent: z.ZodNumber;
+            queueTimeoutMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultTimeout: z.ZodOptional<z.ZodObject<{
+            executeMs: z.ZodNumber;
+        }, z.core.$strip>>;
+        ipFilter: z.ZodOptional<z.ZodObject<{
+            allowList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denyList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            defaultAction: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>>;
+            trustProxy: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            trustedProxyDepth: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    splitByApp: z.ZodLiteral<true>;
+    auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        mode: z.ZodLiteral<"public">;
+        issuer: z.ZodOptional<z.ZodString>;
+        sessionTtl: z.ZodDefault<z.ZodNumber>;
+        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publicAccess: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            rateLimit: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        jwks: z.ZodOptional<z.ZodObject<{
+            keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
+        }, z.core.$strip>>;
+        signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+    }, z.core.$strip>, z.ZodObject<{
+        expectedAudience: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        requiredScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        allowAnonymous: z.ZodDefault<z.ZodBoolean>;
+        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publicAccess: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            rateLimit: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        provider: z.ZodString;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        providerConfig: z.ZodOptional<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            id: z.ZodOptional<z.ZodString>;
+            jwks: z.ZodOptional<z.ZodObject<{
+                keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
+            }, z.core.$strip>>;
+            jwksUri: z.ZodOptional<z.ZodString>;
+            dcrEnabled: z.ZodDefault<z.ZodBoolean>;
+            authEndpoint: z.ZodOptional<z.ZodString>;
+            tokenEndpoint: z.ZodOptional<z.ZodString>;
+            registrationEndpoint: z.ZodOptional<z.ZodString>;
+            userInfoEndpoint: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        mode: z.ZodLiteral<"transparent">;
+    }, z.core.$strip>, z.ZodObject<{
+        local: z.ZodOptional<z.ZodObject<{
+            signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+            jwks: z.ZodOptional<z.ZodObject<{
+                keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
+            }, z.core.$strip>>;
+            issuer: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        tokenStorage: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"memory">, z.ZodObject<{
+            redis: z.ZodObject<{
+                host: z.ZodString;
+                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                password: z.ZodOptional<z.ZodString>;
+                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, z.core.$strip>;
+        }, z.core.$strip>]>>;
+        allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
+        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publicAccess: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            rateLimit: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        consent: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            groupByApp: z.ZodDefault<z.ZodBoolean>;
+            showDescriptions: z.ZodDefault<z.ZodBoolean>;
+            allowSelectAll: z.ZodDefault<z.ZodBoolean>;
+            requireSelection: z.ZodDefault<z.ZodBoolean>;
+            customMessage: z.ZodOptional<z.ZodString>;
+            rememberConsent: z.ZodDefault<z.ZodBoolean>;
+            excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            defaultSelectedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        federatedAuth: z.ZodOptional<z.ZodObject<{
+            stateValidation: z.ZodDefault<z.ZodEnum<{
+                format: "format";
+                strict: "strict";
+            }>>;
+        }, z.core.$strip>>;
+        refresh: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            skewSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        expectedAudience: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        incrementalAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            skippedAppBehavior: z.ZodDefault<z.ZodEnum<{
+                anonymous: "anonymous";
+                "require-auth": "require-auth";
+            }>>;
+            allowSkip: z.ZodDefault<z.ZodBoolean>;
+            showAllAppsAtOnce: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        cimd: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            cache: z.ZodOptional<z.ZodObject<{
+                type: z.ZodDefault<z.ZodEnum<{
+                    memory: "memory";
+                    redis: "redis";
+                }>>;
+                defaultTtlMs: z.ZodDefault<z.ZodNumber>;
+                maxTtlMs: z.ZodDefault<z.ZodNumber>;
+                minTtlMs: z.ZodDefault<z.ZodNumber>;
+                redis: z.ZodOptional<z.ZodObject<{
+                    url: z.ZodOptional<z.ZodString>;
+                    host: z.ZodOptional<z.ZodString>;
+                    port: z.ZodOptional<z.ZodNumber>;
+                    password: z.ZodOptional<z.ZodString>;
+                    db: z.ZodOptional<z.ZodNumber>;
+                    tls: z.ZodOptional<z.ZodBoolean>;
+                    keyPrefix: z.ZodDefault<z.ZodString>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            security: z.ZodOptional<z.ZodObject<{
+                blockPrivateIPs: z.ZodDefault<z.ZodBoolean>;
+                allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                warnOnLocalhostRedirects: z.ZodDefault<z.ZodBoolean>;
+                allowInsecureForTesting: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            network: z.ZodOptional<z.ZodObject<{
+                timeoutMs: z.ZodDefault<z.ZodNumber>;
+                maxResponseSizeBytes: z.ZodDefault<z.ZodNumber>;
+                redirectPolicy: z.ZodDefault<z.ZodEnum<{
+                    deny: "deny";
+                    "same-origin": "same-origin";
+                    allow: "allow";
+                }>>;
+                maxRedirects: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        mode: z.ZodLiteral<"local">;
+    }, z.core.$strip>, z.ZodObject<{
+        local: z.ZodOptional<z.ZodObject<{
+            signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+            jwks: z.ZodOptional<z.ZodObject<{
+                keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
+            }, z.core.$strip>>;
+            issuer: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        tokenStorage: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"memory">, z.ZodObject<{
+            redis: z.ZodObject<{
+                host: z.ZodString;
+                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                password: z.ZodOptional<z.ZodString>;
+                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, z.core.$strip>;
+        }, z.core.$strip>]>>;
+        allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
+        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publicAccess: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            rateLimit: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        consent: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            groupByApp: z.ZodDefault<z.ZodBoolean>;
+            showDescriptions: z.ZodDefault<z.ZodBoolean>;
+            allowSelectAll: z.ZodDefault<z.ZodBoolean>;
+            requireSelection: z.ZodDefault<z.ZodBoolean>;
+            customMessage: z.ZodOptional<z.ZodString>;
+            rememberConsent: z.ZodDefault<z.ZodBoolean>;
+            excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            defaultSelectedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        federatedAuth: z.ZodOptional<z.ZodObject<{
+            stateValidation: z.ZodDefault<z.ZodEnum<{
+                format: "format";
+                strict: "strict";
+            }>>;
+        }, z.core.$strip>>;
+        refresh: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            skewSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        expectedAudience: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        incrementalAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            skippedAppBehavior: z.ZodDefault<z.ZodEnum<{
+                anonymous: "anonymous";
+                "require-auth": "require-auth";
+            }>>;
+            allowSkip: z.ZodDefault<z.ZodBoolean>;
+            showAllAppsAtOnce: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        cimd: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            cache: z.ZodOptional<z.ZodObject<{
+                type: z.ZodDefault<z.ZodEnum<{
+                    memory: "memory";
+                    redis: "redis";
+                }>>;
+                defaultTtlMs: z.ZodDefault<z.ZodNumber>;
+                maxTtlMs: z.ZodDefault<z.ZodNumber>;
+                minTtlMs: z.ZodDefault<z.ZodNumber>;
+                redis: z.ZodOptional<z.ZodObject<{
+                    url: z.ZodOptional<z.ZodString>;
+                    host: z.ZodOptional<z.ZodString>;
+                    port: z.ZodOptional<z.ZodNumber>;
+                    password: z.ZodOptional<z.ZodString>;
+                    db: z.ZodOptional<z.ZodNumber>;
+                    tls: z.ZodOptional<z.ZodBoolean>;
+                    keyPrefix: z.ZodDefault<z.ZodString>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            security: z.ZodOptional<z.ZodObject<{
+                blockPrivateIPs: z.ZodDefault<z.ZodBoolean>;
+                allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                warnOnLocalhostRedirects: z.ZodDefault<z.ZodBoolean>;
+                allowInsecureForTesting: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            network: z.ZodOptional<z.ZodObject<{
+                timeoutMs: z.ZodDefault<z.ZodNumber>;
+                maxResponseSizeBytes: z.ZodDefault<z.ZodNumber>;
+                redirectPolicy: z.ZodDefault<z.ZodEnum<{
+                    deny: "deny";
+                    "same-origin": "same-origin";
+                    allow: "allow";
+                }>>;
+                maxRedirects: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        provider: z.ZodString;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        providerConfig: z.ZodOptional<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            id: z.ZodOptional<z.ZodString>;
+            jwks: z.ZodOptional<z.ZodObject<{
+                keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
+            }, z.core.$strip>>;
+            jwksUri: z.ZodOptional<z.ZodString>;
+            dcrEnabled: z.ZodDefault<z.ZodBoolean>;
+            authEndpoint: z.ZodOptional<z.ZodString>;
+            tokenEndpoint: z.ZodOptional<z.ZodString>;
+            registrationEndpoint: z.ZodOptional<z.ZodString>;
+            userInfoEndpoint: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        mode: z.ZodLiteral<"remote">;
+    }, z.core.$strip>]>>;
+}, z.core.$strip>;
+export type FrontMcpMetadata = FrontMcpMultiAppMetadata | FrontMcpSplitByAppMetadata;
+export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
+    info: z.ZodObject<{
+        name: z.ZodString;
+        title: z.ZodOptional<z.ZodString>;
+        version: z.ZodString;
+        websiteUrl: z.ZodOptional<z.ZodURL>;
+        icons: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            src: z.ZodString;
+            mimeType: z.ZodOptional<z.ZodString>;
+            sizes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            theme: z.ZodOptional<z.ZodEnum<{
+                light: "light";
+                dark: "dark";
+            }>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+    providers: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
+    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<string | import("libs/di/dist/interfaces/base.interface").Type<unknown>, string | import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
+    resources: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
+    skills: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
+    plugins: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
+    apps: z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>;
+    serve: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    http: z.ZodOptional<z.ZodObject<{
+        port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        entryPath: z.ZodDefault<z.ZodString>;
+        hostFactory: z.ZodOptional<z.ZodAny>;
+        socketPath: z.ZodOptional<z.ZodString>;
+        cors: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+            origin: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString, z.ZodArray<z.ZodString>, z.ZodCustom<(origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => void, (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => void>]>>;
+            credentials: z.ZodOptional<z.ZodBoolean>;
+            maxAge: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>]>>;
+    }, z.core.$strip>>;
+    redis: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        provider: z.ZodLiteral<"redis">;
+        host: z.ZodString;
+        port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        password: z.ZodOptional<z.ZodString>;
+        db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.core.$strip>, z.ZodObject<{
+        provider: z.ZodLiteral<"vercel-kv">;
+        url: z.ZodOptional<z.ZodString>;
+        token: z.ZodOptional<z.ZodString>;
+        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.core.$strip>, z.ZodPipe<z.ZodObject<{
+        host: z.ZodString;
+        port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        password: z.ZodOptional<z.ZodString>;
+        db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.core.$strip>, z.ZodTransform<{
+        provider: "redis";
+        host: string;
+        port: number;
+        db: number;
+        tls: boolean;
+        keyPrefix: string;
+        defaultTtlMs: number;
+        password?: string | undefined;
+    }, {
+        host: string;
+        port: number;
+        db: number;
+        tls: boolean;
+        keyPrefix: string;
+        defaultTtlMs: number;
+        password?: string | undefined;
+    }>>]>>;
+    pubsub: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        provider: z.ZodLiteral<"redis">;
+        host: z.ZodString;
+        port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        password: z.ZodOptional<z.ZodString>;
+        db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.core.$strip>, z.ZodPipe<z.ZodObject<{
+        host: z.ZodString;
+        port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        password: z.ZodOptional<z.ZodString>;
+        db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    }, z.core.$strip>, z.ZodTransform<{
+        provider: "redis";
+        host: string;
+        port: number;
+        db: number;
+        tls: boolean;
+        keyPrefix: string;
+        defaultTtlMs: number;
+        password?: string | undefined;
+    }, {
+        host: string;
+        port: number;
+        db: number;
+        tls: boolean;
+        keyPrefix: string;
+        defaultTtlMs: number;
+        password?: string | undefined;
+    }>>]>>;
+    transport: z.ZodPipe<z.ZodOptional<z.ZodObject<{
+        sessionMode: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"stateful">, z.ZodLiteral<"stateless">, z.ZodFunction<z.core.$ZodFunctionArgs, z.core.$ZodFunctionOut>]>>>;
+        platformDetection: z.ZodOptional<z.ZodObject<{
+            mappings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                pattern: z.ZodUnion<readonly [z.ZodString, z.ZodCustom<RegExp, RegExp>]>;
+                platform: z.ZodEnum<{
+                    unknown: "unknown";
+                    openai: "openai";
+                    claude: "claude";
+                    gemini: "gemini";
+                    cursor: "cursor";
+                    continue: "continue";
+                    cody: "cody";
+                    "generic-mcp": "generic-mcp";
+                    "ext-apps": "ext-apps";
+                }>;
+            }, z.core.$strip>>>;
+            customOnly: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        }, z.core.$strip>>;
+        protocol: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+            modern: "modern";
+            legacy: "legacy";
+            "stateless-api": "stateless-api";
+            full: "full";
+        }>, z.ZodObject<{
+            sse: z.ZodOptional<z.ZodBoolean>;
+            streamable: z.ZodOptional<z.ZodBoolean>;
+            json: z.ZodOptional<z.ZodBoolean>;
+            stateless: z.ZodOptional<z.ZodBoolean>;
+            legacy: z.ZodOptional<z.ZodBoolean>;
+            strictSession: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>]>>>;
+        persistence: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
+            redis: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                provider: z.ZodLiteral<"redis">;
+                host: z.ZodString;
+                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                password: z.ZodOptional<z.ZodString>;
+                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, z.core.$strip>, z.ZodObject<{
+                provider: z.ZodLiteral<"vercel-kv">;
+                url: z.ZodOptional<z.ZodString>;
+                token: z.ZodOptional<z.ZodString>;
+                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, z.core.$strip>, z.ZodPipe<z.ZodObject<{
+                host: z.ZodString;
+                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                password: z.ZodOptional<z.ZodString>;
+                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, z.core.$strip>, z.ZodTransform<{
+                provider: "redis";
+                host: string;
+                port: number;
+                db: number;
+                tls: boolean;
+                keyPrefix: string;
+                defaultTtlMs: number;
+                password?: string | undefined;
+            }, {
+                host: string;
+                port: number;
                 db: number;
                 tls: boolean;
                 keyPrefix: string;
@@ -2666,6 +3255,9 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         ttlCleanupIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
         walMode: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     }, z.core.$strip>>;
+    ui: z.ZodOptional<z.ZodObject<{
+        cdnOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
     jobs: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodBoolean;
         store: z.ZodOptional<z.ZodObject<{
@@ -2713,6 +3305,102 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             keyPrefix: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    loader: z.ZodOptional<z.ZodObject<{
+        url: z.ZodOptional<z.ZodString>;
+        registryUrl: z.ZodOptional<z.ZodString>;
+        token: z.ZodOptional<z.ZodString>;
+        tokenEnvVar: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    throttle: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        storage: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        global: z.ZodOptional<z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            windowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        globalConcurrency: z.ZodOptional<z.ZodObject<{
+            maxConcurrent: z.ZodNumber;
+            queueTimeoutMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultRateLimit: z.ZodOptional<z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            windowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultConcurrency: z.ZodOptional<z.ZodObject<{
+            maxConcurrent: z.ZodNumber;
+            queueTimeoutMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultTimeout: z.ZodOptional<z.ZodObject<{
+            executeMs: z.ZodNumber;
+        }, z.core.$strip>>;
+        ipFilter: z.ZodOptional<z.ZodObject<{
+            allowList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denyList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            defaultAction: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>>;
+            trustProxy: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            trustedProxyDepth: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     splitByApp: z.ZodDefault<z.ZodLiteral<false>>;
     auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         mode: z.ZodLiteral<"public">;
@@ -2729,33 +3417,33 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         }, z.core.$strip>>;
         signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
     }, z.core.$strip>, z.ZodObject<{
-        mode: z.ZodLiteral<"transparent">;
-        remote: z.ZodObject<{
-            provider: z.ZodString;
+        expectedAudience: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        requiredScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        allowAnonymous: z.ZodDefault<z.ZodBoolean>;
+        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publicAccess: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            rateLimit: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        provider: z.ZodString;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        providerConfig: z.ZodOptional<z.ZodObject<{
             name: z.ZodOptional<z.ZodString>;
             id: z.ZodOptional<z.ZodString>;
             jwks: z.ZodOptional<z.ZodObject<{
                 keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
             }, z.core.$strip>>;
             jwksUri: z.ZodOptional<z.ZodString>;
-            clientId: z.ZodOptional<z.ZodString>;
-            clientSecret: z.ZodOptional<z.ZodString>;
-            scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
             dcrEnabled: z.ZodDefault<z.ZodBoolean>;
             authEndpoint: z.ZodOptional<z.ZodString>;
             tokenEndpoint: z.ZodOptional<z.ZodString>;
             registrationEndpoint: z.ZodOptional<z.ZodString>;
             userInfoEndpoint: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>;
-        expectedAudience: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
-        requiredScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        allowAnonymous: z.ZodDefault<z.ZodBoolean>;
-        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        publicAccess: z.ZodOptional<z.ZodObject<{
-            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
-            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
-            rateLimit: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
+        mode: z.ZodLiteral<"transparent">;
     }, z.core.$strip>, z.ZodObject<{
         local: z.ZodOptional<z.ZodObject<{
             signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
@@ -2764,11 +3452,8 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             }, z.core.$strip>>;
             issuer: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
-        tokenStorage: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"memory">;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"redis">;
-            config: z.ZodObject<{
+        tokenStorage: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"memory">, z.ZodObject<{
+            redis: z.ZodObject<{
                 host: z.ZodString;
                 port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
                 password: z.ZodOptional<z.ZodString>;
@@ -2777,7 +3462,7 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
                 keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
                 defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
             }, z.core.$strip>;
-        }, z.core.$strip>], "type">>;
+        }, z.core.$strip>]>>;
         allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
         anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
         publicAccess: z.ZodOptional<z.ZodObject<{
@@ -2854,8 +3539,7 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
                 maxRedirects: z.ZodDefault<z.ZodNumber>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
-        mode: z.ZodLiteral<"orchestrated">;
-        type: z.ZodLiteral<"local">;
+        mode: z.ZodLiteral<"local">;
     }, z.core.$strip>, z.ZodObject<{
         local: z.ZodOptional<z.ZodObject<{
             signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
@@ -2864,11 +3548,8 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             }, z.core.$strip>>;
             issuer: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
-        tokenStorage: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
-            type: z.ZodLiteral<"memory">;
-        }, z.core.$strip>, z.ZodObject<{
-            type: z.ZodLiteral<"redis">;
-            config: z.ZodObject<{
+        tokenStorage: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"memory">, z.ZodObject<{
+            redis: z.ZodObject<{
                 host: z.ZodString;
                 port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
                 password: z.ZodOptional<z.ZodString>;
@@ -2877,7 +3558,7 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
                 keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
                 defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
             }, z.core.$strip>;
-        }, z.core.$strip>], "type">>;
+        }, z.core.$strip>]>>;
         allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
         anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
         publicAccess: z.ZodOptional<z.ZodObject<{
@@ -2954,25 +3635,24 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
                 maxRedirects: z.ZodDefault<z.ZodNumber>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
-        mode: z.ZodLiteral<"orchestrated">;
-        type: z.ZodLiteral<"remote">;
-        remote: z.ZodObject<{
-            provider: z.ZodString;
+        provider: z.ZodString;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        providerConfig: z.ZodOptional<z.ZodObject<{
             name: z.ZodOptional<z.ZodString>;
             id: z.ZodOptional<z.ZodString>;
             jwks: z.ZodOptional<z.ZodObject<{
                 keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
             }, z.core.$strip>>;
             jwksUri: z.ZodOptional<z.ZodString>;
-            clientId: z.ZodOptional<z.ZodString>;
-            clientSecret: z.ZodOptional<z.ZodString>;
-            scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
             dcrEnabled: z.ZodDefault<z.ZodBoolean>;
             authEndpoint: z.ZodOptional<z.ZodString>;
             tokenEndpoint: z.ZodOptional<z.ZodString>;
             registrationEndpoint: z.ZodOptional<z.ZodString>;
             userInfoEndpoint: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>;
+        }, z.core.$strip>>;
+        mode: z.ZodLiteral<"remote">;
     }, z.core.$strip>]>>;
 }, z.core.$strip>, z.ZodObject<{
     info: z.ZodObject<{
@@ -2991,7 +3671,7 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         }, z.core.$strip>>>;
     }, z.core.$strip>;
     providers: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
-    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
+    tools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<string | import("libs/di/dist/interfaces/base.interface").Type<unknown>, string | import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     resources: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     skills: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
     plugins: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodCustom<import("libs/di/dist/interfaces/base.interface").Type<unknown>, import("libs/di/dist/interfaces/base.interface").Type<unknown>>>>>;
@@ -3485,34 +4165,310 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             }>>>;
             logging: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    sqlite: z.ZodOptional<z.ZodObject<{
-        path: z.ZodString;
-        encryption: z.ZodOptional<z.ZodObject<{
-            secret: z.ZodString;
+    }, z.core.$strip>>;
+    sqlite: z.ZodOptional<z.ZodObject<{
+        path: z.ZodString;
+        encryption: z.ZodOptional<z.ZodObject<{
+            secret: z.ZodString;
+        }, z.core.$strip>>;
+        ttlCleanupIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        walMode: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    }, z.core.$strip>>;
+    ui: z.ZodOptional<z.ZodObject<{
+        cdnOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+    jobs: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        store: z.ZodOptional<z.ZodObject<{
+            redis: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+                provider: z.ZodLiteral<"redis">;
+                host: z.ZodString;
+                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                password: z.ZodOptional<z.ZodString>;
+                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, z.core.$strip>, z.ZodObject<{
+                provider: z.ZodLiteral<"vercel-kv">;
+                url: z.ZodOptional<z.ZodString>;
+                token: z.ZodOptional<z.ZodString>;
+                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, z.core.$strip>, z.ZodPipe<z.ZodObject<{
+                host: z.ZodString;
+                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                password: z.ZodOptional<z.ZodString>;
+                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, z.core.$strip>, z.ZodTransform<{
+                provider: "redis";
+                host: string;
+                port: number;
+                db: number;
+                tls: boolean;
+                keyPrefix: string;
+                defaultTtlMs: number;
+                password?: string | undefined;
+            }, {
+                host: string;
+                port: number;
+                db: number;
+                tls: boolean;
+                keyPrefix: string;
+                defaultTtlMs: number;
+                password?: string | undefined;
+            }>>]>>;
+            keyPrefix: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    loader: z.ZodOptional<z.ZodObject<{
+        url: z.ZodOptional<z.ZodString>;
+        registryUrl: z.ZodOptional<z.ZodString>;
+        token: z.ZodOptional<z.ZodString>;
+        tokenEnvVar: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    throttle: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        storage: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+        keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        global: z.ZodOptional<z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            windowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        globalConcurrency: z.ZodOptional<z.ZodObject<{
+            maxConcurrent: z.ZodNumber;
+            queueTimeoutMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultRateLimit: z.ZodOptional<z.ZodObject<{
+            maxRequests: z.ZodNumber;
+            windowMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultConcurrency: z.ZodOptional<z.ZodObject<{
+            maxConcurrent: z.ZodNumber;
+            queueTimeoutMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            partitionBy: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                ip: "ip";
+                session: "session";
+                userId: "userId";
+                global: "global";
+            }>, z.ZodCustom<(ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string, (ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string>]>>>;
+        }, z.core.$strip>>;
+        defaultTimeout: z.ZodOptional<z.ZodObject<{
+            executeMs: z.ZodNumber;
+        }, z.core.$strip>>;
+        ipFilter: z.ZodOptional<z.ZodObject<{
+            allowList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            denyList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            defaultAction: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+            }>>>;
+            trustProxy: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+            trustedProxyDepth: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    splitByApp: z.ZodLiteral<true>;
+    auth: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        mode: z.ZodLiteral<"public">;
+        issuer: z.ZodOptional<z.ZodString>;
+        sessionTtl: z.ZodDefault<z.ZodNumber>;
+        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publicAccess: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            rateLimit: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        jwks: z.ZodOptional<z.ZodObject<{
+            keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
+        }, z.core.$strip>>;
+        signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+    }, z.core.$strip>, z.ZodObject<{
+        expectedAudience: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        requiredScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        allowAnonymous: z.ZodDefault<z.ZodBoolean>;
+        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publicAccess: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            rateLimit: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        provider: z.ZodString;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        providerConfig: z.ZodOptional<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            id: z.ZodOptional<z.ZodString>;
+            jwks: z.ZodOptional<z.ZodObject<{
+                keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
+            }, z.core.$strip>>;
+            jwksUri: z.ZodOptional<z.ZodString>;
+            dcrEnabled: z.ZodDefault<z.ZodBoolean>;
+            authEndpoint: z.ZodOptional<z.ZodString>;
+            tokenEndpoint: z.ZodOptional<z.ZodString>;
+            registrationEndpoint: z.ZodOptional<z.ZodString>;
+            userInfoEndpoint: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        mode: z.ZodLiteral<"transparent">;
+    }, z.core.$strip>, z.ZodObject<{
+        local: z.ZodOptional<z.ZodObject<{
+            signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+            jwks: z.ZodOptional<z.ZodObject<{
+                keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
+            }, z.core.$strip>>;
+            issuer: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        tokenStorage: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"memory">, z.ZodObject<{
+            redis: z.ZodObject<{
+                host: z.ZodString;
+                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                password: z.ZodOptional<z.ZodString>;
+                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+            }, z.core.$strip>;
+        }, z.core.$strip>]>>;
+        allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
+        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publicAccess: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            rateLimit: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        consent: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            groupByApp: z.ZodDefault<z.ZodBoolean>;
+            showDescriptions: z.ZodDefault<z.ZodBoolean>;
+            allowSelectAll: z.ZodDefault<z.ZodBoolean>;
+            requireSelection: z.ZodDefault<z.ZodBoolean>;
+            customMessage: z.ZodOptional<z.ZodString>;
+            rememberConsent: z.ZodDefault<z.ZodBoolean>;
+            excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            defaultSelectedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        federatedAuth: z.ZodOptional<z.ZodObject<{
+            stateValidation: z.ZodDefault<z.ZodEnum<{
+                format: "format";
+                strict: "strict";
+            }>>;
+        }, z.core.$strip>>;
+        refresh: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            skewSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        expectedAudience: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        incrementalAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            skippedAppBehavior: z.ZodDefault<z.ZodEnum<{
+                anonymous: "anonymous";
+                "require-auth": "require-auth";
+            }>>;
+            allowSkip: z.ZodDefault<z.ZodBoolean>;
+            showAllAppsAtOnce: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        cimd: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            cache: z.ZodOptional<z.ZodObject<{
+                type: z.ZodDefault<z.ZodEnum<{
+                    memory: "memory";
+                    redis: "redis";
+                }>>;
+                defaultTtlMs: z.ZodDefault<z.ZodNumber>;
+                maxTtlMs: z.ZodDefault<z.ZodNumber>;
+                minTtlMs: z.ZodDefault<z.ZodNumber>;
+                redis: z.ZodOptional<z.ZodObject<{
+                    url: z.ZodOptional<z.ZodString>;
+                    host: z.ZodOptional<z.ZodString>;
+                    port: z.ZodOptional<z.ZodNumber>;
+                    password: z.ZodOptional<z.ZodString>;
+                    db: z.ZodOptional<z.ZodNumber>;
+                    tls: z.ZodOptional<z.ZodBoolean>;
+                    keyPrefix: z.ZodDefault<z.ZodString>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            security: z.ZodOptional<z.ZodObject<{
+                blockPrivateIPs: z.ZodDefault<z.ZodBoolean>;
+                allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                warnOnLocalhostRedirects: z.ZodDefault<z.ZodBoolean>;
+                allowInsecureForTesting: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            network: z.ZodOptional<z.ZodObject<{
+                timeoutMs: z.ZodDefault<z.ZodNumber>;
+                maxResponseSizeBytes: z.ZodDefault<z.ZodNumber>;
+                redirectPolicy: z.ZodDefault<z.ZodEnum<{
+                    deny: "deny";
+                    "same-origin": "same-origin";
+                    allow: "allow";
+                }>>;
+                maxRedirects: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        mode: z.ZodLiteral<"local">;
+    }, z.core.$strip>, z.ZodObject<{
+        local: z.ZodOptional<z.ZodObject<{
+            signKey: z.ZodOptional<z.ZodUnion<[z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>, z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>]>>;
+            jwks: z.ZodOptional<z.ZodObject<{
+                keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
+            }, z.core.$strip>>;
+            issuer: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>;
-        ttlCleanupIntervalMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-        walMode: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-    }, z.core.$strip>>;
-    jobs: z.ZodOptional<z.ZodObject<{
-        enabled: z.ZodBoolean;
-        store: z.ZodOptional<z.ZodObject<{
-            redis: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
-                provider: z.ZodLiteral<"redis">;
-                host: z.ZodString;
-                port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                password: z.ZodOptional<z.ZodString>;
-                db: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-                tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
-                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-            }, z.core.$strip>, z.ZodObject<{
-                provider: z.ZodLiteral<"vercel-kv">;
-                url: z.ZodOptional<z.ZodString>;
-                token: z.ZodOptional<z.ZodString>;
-                keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
-                defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-            }, z.core.$strip>, z.ZodPipe<z.ZodObject<{
+        tokenStorage: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"memory">, z.ZodObject<{
+            redis: z.ZodObject<{
                 host: z.ZodString;
                 port: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
                 password: z.ZodOptional<z.ZodString>;
@@ -3520,29 +4476,103 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
                 tls: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
                 keyPrefix: z.ZodDefault<z.ZodOptional<z.ZodString>>;
                 defaultTtlMs: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
-            }, z.core.$strip>, z.ZodTransform<{
-                provider: "redis";
-                host: string;
-                port: number;
-                db: number;
-                tls: boolean;
-                keyPrefix: string;
-                defaultTtlMs: number;
-                password?: string | undefined;
-            }, {
-                host: string;
-                port: number;
-                db: number;
-                tls: boolean;
-                keyPrefix: string;
-                defaultTtlMs: number;
-                password?: string | undefined;
-            }>>]>>;
-            keyPrefix: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+        }, z.core.$strip>]>>;
+        allowDefaultPublic: z.ZodDefault<z.ZodBoolean>;
+        anonymousScopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publicAccess: z.ZodOptional<z.ZodObject<{
+            tools: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            prompts: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"all">, z.ZodArray<z.ZodString>]>>;
+            rateLimit: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
-    }, z.core.$strip>>;
-    splitByApp: z.ZodLiteral<true>;
-    auth: z.ZodOptional<z.ZodNever>;
+        consent: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            groupByApp: z.ZodDefault<z.ZodBoolean>;
+            showDescriptions: z.ZodDefault<z.ZodBoolean>;
+            allowSelectAll: z.ZodDefault<z.ZodBoolean>;
+            requireSelection: z.ZodDefault<z.ZodBoolean>;
+            customMessage: z.ZodOptional<z.ZodString>;
+            rememberConsent: z.ZodDefault<z.ZodBoolean>;
+            excludedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            defaultSelectedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+        federatedAuth: z.ZodOptional<z.ZodObject<{
+            stateValidation: z.ZodDefault<z.ZodEnum<{
+                format: "format";
+                strict: "strict";
+            }>>;
+        }, z.core.$strip>>;
+        refresh: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            skewSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
+        expectedAudience: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        incrementalAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            skippedAppBehavior: z.ZodDefault<z.ZodEnum<{
+                anonymous: "anonymous";
+                "require-auth": "require-auth";
+            }>>;
+            allowSkip: z.ZodDefault<z.ZodBoolean>;
+            showAllAppsAtOnce: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        cimd: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            cache: z.ZodOptional<z.ZodObject<{
+                type: z.ZodDefault<z.ZodEnum<{
+                    memory: "memory";
+                    redis: "redis";
+                }>>;
+                defaultTtlMs: z.ZodDefault<z.ZodNumber>;
+                maxTtlMs: z.ZodDefault<z.ZodNumber>;
+                minTtlMs: z.ZodDefault<z.ZodNumber>;
+                redis: z.ZodOptional<z.ZodObject<{
+                    url: z.ZodOptional<z.ZodString>;
+                    host: z.ZodOptional<z.ZodString>;
+                    port: z.ZodOptional<z.ZodNumber>;
+                    password: z.ZodOptional<z.ZodString>;
+                    db: z.ZodOptional<z.ZodNumber>;
+                    tls: z.ZodOptional<z.ZodBoolean>;
+                    keyPrefix: z.ZodDefault<z.ZodString>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            security: z.ZodOptional<z.ZodObject<{
+                blockPrivateIPs: z.ZodDefault<z.ZodBoolean>;
+                allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                blockedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                warnOnLocalhostRedirects: z.ZodDefault<z.ZodBoolean>;
+                allowInsecureForTesting: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            network: z.ZodOptional<z.ZodObject<{
+                timeoutMs: z.ZodDefault<z.ZodNumber>;
+                maxResponseSizeBytes: z.ZodDefault<z.ZodNumber>;
+                redirectPolicy: z.ZodDefault<z.ZodEnum<{
+                    deny: "deny";
+                    "same-origin": "same-origin";
+                    allow: "allow";
+                }>>;
+                maxRedirects: z.ZodDefault<z.ZodNumber>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        provider: z.ZodString;
+        clientId: z.ZodOptional<z.ZodString>;
+        clientSecret: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        providerConfig: z.ZodOptional<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            id: z.ZodOptional<z.ZodString>;
+            jwks: z.ZodOptional<z.ZodObject<{
+                keys: z.ZodArray<z.ZodType<import("libs/auth/dist/common/jwt.types").JWK, unknown, z.core.$ZodTypeInternals<import("libs/auth/dist/common/jwt.types").JWK, unknown>>>;
+            }, z.core.$strip>>;
+            jwksUri: z.ZodOptional<z.ZodString>;
+            dcrEnabled: z.ZodDefault<z.ZodBoolean>;
+            authEndpoint: z.ZodOptional<z.ZodString>;
+            tokenEndpoint: z.ZodOptional<z.ZodString>;
+            registrationEndpoint: z.ZodOptional<z.ZodString>;
+            userInfoEndpoint: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        mode: z.ZodLiteral<"remote">;
+    }, z.core.$strip>]>>;
 }, z.core.$strip>]>, z.ZodTransform<{
     info: {
         name: string;
@@ -3557,7 +4587,7 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         }[] | undefined;
     };
     providers: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
-    tools: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
+    tools: (string | import("libs/di/dist/interfaces/base.interface").Type<unknown>)[];
     resources: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
     skills: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
     plugins: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
@@ -3794,6 +4824,9 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             secret: string;
         } | undefined;
     } | undefined;
+    ui?: {
+        cdnOverrides?: Record<string, string> | undefined;
+    } | undefined;
     jobs?: {
         enabled: boolean;
         store?: {
@@ -3825,6 +4858,65 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             keyPrefix?: string | undefined;
         } | undefined;
     } | undefined;
+    loader?: {
+        url?: string | undefined;
+        registryUrl?: string | undefined;
+        token?: string | undefined;
+        tokenEnvVar?: string | undefined;
+    } | undefined;
+    throttle?: {
+        enabled: boolean;
+        keyPrefix: string;
+        storage?: {
+            [x: string]: unknown;
+        } | undefined;
+        global?: {
+            maxRequests: number;
+            windowMs: number;
+            partitionBy: "session" | "global" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string) | "ip" | "userId";
+        } | undefined;
+        globalConcurrency?: {
+            maxConcurrent: number;
+            queueTimeoutMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultRateLimit?: {
+            maxRequests: number;
+            windowMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultConcurrency?: {
+            maxConcurrent: number;
+            queueTimeoutMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultTimeout?: {
+            executeMs: number;
+        } | undefined;
+        ipFilter?: {
+            defaultAction: "deny" | "allow";
+            trustProxy: boolean;
+            trustedProxyDepth: number;
+            allowList?: string[] | undefined;
+            denyList?: string[] | undefined;
+        } | undefined;
+    } | undefined;
     auth?: {
         mode: "public";
         sessionTtl: number;
@@ -3840,9 +4932,21 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         } | undefined;
         signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
     } | {
+        requiredScopes: string[];
+        allowAnonymous: boolean;
+        anonymousScopes: string[];
+        provider: string;
         mode: "transparent";
-        remote: {
-            provider: string;
+        expectedAudience?: string | string[] | undefined;
+        publicAccess?: {
+            tools: string[] | "all";
+            prompts: string[] | "all";
+            rateLimit: number;
+        } | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        scopes?: string[] | undefined;
+        providerConfig?: {
             dcrEnabled: boolean;
             name?: string | undefined;
             id?: string | undefined;
@@ -3850,29 +4954,14 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
                 keys: import("libs/auth/dist/common/jwt.types").JWK[];
             } | undefined;
             jwksUri?: string | undefined;
-            clientId?: string | undefined;
-            clientSecret?: string | undefined;
-            scopes?: string[] | undefined;
             authEndpoint?: string | undefined;
             tokenEndpoint?: string | undefined;
             registrationEndpoint?: string | undefined;
             userInfoEndpoint?: string | undefined;
-        };
-        requiredScopes: string[];
-        allowAnonymous: boolean;
-        anonymousScopes: string[];
-        expectedAudience?: string | string[] | undefined;
-        publicAccess?: {
-            tools: string[] | "all";
-            prompts: string[] | "all";
-            rateLimit: number;
         } | undefined;
     } | {
-        tokenStorage: {
-            type: "memory";
-        } | {
-            type: "redis";
-            config: {
+        tokenStorage: "memory" | {
+            redis: {
                 host: string;
                 port: number;
                 db: number;
@@ -3884,8 +4973,7 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         };
         allowDefaultPublic: boolean;
         anonymousScopes: string[];
-        mode: "orchestrated";
-        type: "local";
+        mode: "local";
         local?: {
             signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
             jwks?: {
@@ -3955,11 +5043,8 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             } | undefined;
         } | undefined;
     } | {
-        tokenStorage: {
-            type: "memory";
-        } | {
-            type: "redis";
-            config: {
+        tokenStorage: "memory" | {
+            redis: {
                 host: string;
                 port: number;
                 db: number;
@@ -3971,25 +5056,8 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         };
         allowDefaultPublic: boolean;
         anonymousScopes: string[];
-        mode: "orchestrated";
-        type: "remote";
-        remote: {
-            provider: string;
-            dcrEnabled: boolean;
-            name?: string | undefined;
-            id?: string | undefined;
-            jwks?: {
-                keys: import("libs/auth/dist/common/jwt.types").JWK[];
-            } | undefined;
-            jwksUri?: string | undefined;
-            clientId?: string | undefined;
-            clientSecret?: string | undefined;
-            scopes?: string[] | undefined;
-            authEndpoint?: string | undefined;
-            tokenEndpoint?: string | undefined;
-            registrationEndpoint?: string | undefined;
-            userInfoEndpoint?: string | undefined;
-        };
+        provider: string;
+        mode: "remote";
         local?: {
             signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
             jwks?: {
@@ -4058,6 +5126,22 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
                 maxRedirects: number;
             } | undefined;
         } | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        scopes?: string[] | undefined;
+        providerConfig?: {
+            dcrEnabled: boolean;
+            name?: string | undefined;
+            id?: string | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            jwksUri?: string | undefined;
+            authEndpoint?: string | undefined;
+            tokenEndpoint?: string | undefined;
+            registrationEndpoint?: string | undefined;
+            userInfoEndpoint?: string | undefined;
+        } | undefined;
     } | undefined;
 } | {
     info: {
@@ -4073,7 +5157,7 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         }[] | undefined;
     };
     providers: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
-    tools: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
+    tools: (string | import("libs/di/dist/interfaces/base.interface").Type<unknown>)[];
     resources: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
     skills: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
     plugins: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
@@ -4302,19 +5386,152 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             logging?: boolean | undefined;
         } | undefined;
     } | undefined;
-    sqlite?: {
-        path: string;
-        ttlCleanupIntervalMs: number;
-        walMode: boolean;
-        encryption?: {
-            secret: string;
-        } | undefined;
+    sqlite?: {
+        path: string;
+        ttlCleanupIntervalMs: number;
+        walMode: boolean;
+        encryption?: {
+            secret: string;
+        } | undefined;
+    } | undefined;
+    ui?: {
+        cdnOverrides?: Record<string, string> | undefined;
+    } | undefined;
+    jobs?: {
+        enabled: boolean;
+        store?: {
+            redis?: {
+                provider: "redis";
+                host: string;
+                port: number;
+                db: number;
+                tls: boolean;
+                keyPrefix: string;
+                defaultTtlMs: number;
+                password?: string | undefined;
+            } | {
+                provider: "redis";
+                host: string;
+                port: number;
+                db: number;
+                tls: boolean;
+                keyPrefix: string;
+                defaultTtlMs: number;
+                password?: string | undefined;
+            } | {
+                provider: "vercel-kv";
+                keyPrefix: string;
+                defaultTtlMs: number;
+                url?: string | undefined;
+                token?: string | undefined;
+            } | undefined;
+            keyPrefix?: string | undefined;
+        } | undefined;
+    } | undefined;
+    loader?: {
+        url?: string | undefined;
+        registryUrl?: string | undefined;
+        token?: string | undefined;
+        tokenEnvVar?: string | undefined;
     } | undefined;
-    jobs?: {
+    throttle?: {
         enabled: boolean;
-        store?: {
-            redis?: {
-                provider: "redis";
+        keyPrefix: string;
+        storage?: {
+            [x: string]: unknown;
+        } | undefined;
+        global?: {
+            maxRequests: number;
+            windowMs: number;
+            partitionBy: "session" | "global" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string) | "ip" | "userId";
+        } | undefined;
+        globalConcurrency?: {
+            maxConcurrent: number;
+            queueTimeoutMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultRateLimit?: {
+            maxRequests: number;
+            windowMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultConcurrency?: {
+            maxConcurrent: number;
+            queueTimeoutMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultTimeout?: {
+            executeMs: number;
+        } | undefined;
+        ipFilter?: {
+            defaultAction: "deny" | "allow";
+            trustProxy: boolean;
+            trustedProxyDepth: number;
+            allowList?: string[] | undefined;
+            denyList?: string[] | undefined;
+        } | undefined;
+    } | undefined;
+    auth?: {
+        mode: "public";
+        sessionTtl: number;
+        anonymousScopes: string[];
+        issuer?: string | undefined;
+        publicAccess?: {
+            tools: string[] | "all";
+            prompts: string[] | "all";
+            rateLimit: number;
+        } | undefined;
+        jwks?: {
+            keys: import("libs/auth/dist/common/jwt.types").JWK[];
+        } | undefined;
+        signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
+    } | {
+        requiredScopes: string[];
+        allowAnonymous: boolean;
+        anonymousScopes: string[];
+        provider: string;
+        mode: "transparent";
+        expectedAudience?: string | string[] | undefined;
+        publicAccess?: {
+            tools: string[] | "all";
+            prompts: string[] | "all";
+            rateLimit: number;
+        } | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        scopes?: string[] | undefined;
+        providerConfig?: {
+            dcrEnabled: boolean;
+            name?: string | undefined;
+            id?: string | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            jwksUri?: string | undefined;
+            authEndpoint?: string | undefined;
+            tokenEndpoint?: string | undefined;
+            registrationEndpoint?: string | undefined;
+            userInfoEndpoint?: string | undefined;
+        } | undefined;
+    } | {
+        tokenStorage: "memory" | {
+            redis: {
                 host: string;
                 port: number;
                 db: number;
@@ -4322,8 +5539,82 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
                 keyPrefix: string;
                 defaultTtlMs: number;
                 password?: string | undefined;
-            } | {
-                provider: "redis";
+            };
+        };
+        allowDefaultPublic: boolean;
+        anonymousScopes: string[];
+        mode: "local";
+        local?: {
+            signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            issuer?: string | undefined;
+        } | undefined;
+        publicAccess?: {
+            tools: string[] | "all";
+            prompts: string[] | "all";
+            rateLimit: number;
+        } | undefined;
+        consent?: {
+            enabled: boolean;
+            groupByApp: boolean;
+            showDescriptions: boolean;
+            allowSelectAll: boolean;
+            requireSelection: boolean;
+            rememberConsent: boolean;
+            customMessage?: string | undefined;
+            excludedTools?: string[] | undefined;
+            defaultSelectedTools?: string[] | undefined;
+        } | undefined;
+        federatedAuth?: {
+            stateValidation: "format" | "strict";
+        } | undefined;
+        refresh?: {
+            enabled: boolean;
+            skewSeconds: number;
+        } | undefined;
+        expectedAudience?: string | string[] | undefined;
+        incrementalAuth?: {
+            enabled: boolean;
+            skippedAppBehavior: "anonymous" | "require-auth";
+            allowSkip: boolean;
+            showAllAppsAtOnce: boolean;
+        } | undefined;
+        cimd?: {
+            enabled: boolean;
+            cache?: {
+                type: "memory" | "redis";
+                defaultTtlMs: number;
+                maxTtlMs: number;
+                minTtlMs: number;
+                redis?: {
+                    keyPrefix: string;
+                    url?: string | undefined;
+                    host?: string | undefined;
+                    port?: number | undefined;
+                    password?: string | undefined;
+                    db?: number | undefined;
+                    tls?: boolean | undefined;
+                } | undefined;
+            } | undefined;
+            security?: {
+                blockPrivateIPs: boolean;
+                warnOnLocalhostRedirects: boolean;
+                allowInsecureForTesting: boolean;
+                allowedDomains?: string[] | undefined;
+                blockedDomains?: string[] | undefined;
+            } | undefined;
+            network?: {
+                timeoutMs: number;
+                maxResponseSizeBytes: number;
+                redirectPolicy: "deny" | "same-origin" | "allow";
+                maxRedirects: number;
+            } | undefined;
+        } | undefined;
+    } | {
+        tokenStorage: "memory" | {
+            redis: {
                 host: string;
                 port: number;
                 db: number;
@@ -4331,17 +5622,97 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
                 keyPrefix: string;
                 defaultTtlMs: number;
                 password?: string | undefined;
-            } | {
-                provider: "vercel-kv";
-                keyPrefix: string;
+            };
+        };
+        allowDefaultPublic: boolean;
+        anonymousScopes: string[];
+        provider: string;
+        mode: "remote";
+        local?: {
+            signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            issuer?: string | undefined;
+        } | undefined;
+        publicAccess?: {
+            tools: string[] | "all";
+            prompts: string[] | "all";
+            rateLimit: number;
+        } | undefined;
+        consent?: {
+            enabled: boolean;
+            groupByApp: boolean;
+            showDescriptions: boolean;
+            allowSelectAll: boolean;
+            requireSelection: boolean;
+            rememberConsent: boolean;
+            customMessage?: string | undefined;
+            excludedTools?: string[] | undefined;
+            defaultSelectedTools?: string[] | undefined;
+        } | undefined;
+        federatedAuth?: {
+            stateValidation: "format" | "strict";
+        } | undefined;
+        refresh?: {
+            enabled: boolean;
+            skewSeconds: number;
+        } | undefined;
+        expectedAudience?: string | string[] | undefined;
+        incrementalAuth?: {
+            enabled: boolean;
+            skippedAppBehavior: "anonymous" | "require-auth";
+            allowSkip: boolean;
+            showAllAppsAtOnce: boolean;
+        } | undefined;
+        cimd?: {
+            enabled: boolean;
+            cache?: {
+                type: "memory" | "redis";
                 defaultTtlMs: number;
-                url?: string | undefined;
-                token?: string | undefined;
+                maxTtlMs: number;
+                minTtlMs: number;
+                redis?: {
+                    keyPrefix: string;
+                    url?: string | undefined;
+                    host?: string | undefined;
+                    port?: number | undefined;
+                    password?: string | undefined;
+                    db?: number | undefined;
+                    tls?: boolean | undefined;
+                } | undefined;
             } | undefined;
-            keyPrefix?: string | undefined;
+            security?: {
+                blockPrivateIPs: boolean;
+                warnOnLocalhostRedirects: boolean;
+                allowInsecureForTesting: boolean;
+                allowedDomains?: string[] | undefined;
+                blockedDomains?: string[] | undefined;
+            } | undefined;
+            network?: {
+                timeoutMs: number;
+                maxResponseSizeBytes: number;
+                redirectPolicy: "deny" | "same-origin" | "allow";
+                maxRedirects: number;
+            } | undefined;
+        } | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        scopes?: string[] | undefined;
+        providerConfig?: {
+            dcrEnabled: boolean;
+            name?: string | undefined;
+            id?: string | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            jwksUri?: string | undefined;
+            authEndpoint?: string | undefined;
+            tokenEndpoint?: string | undefined;
+            registrationEndpoint?: string | undefined;
+            userInfoEndpoint?: string | undefined;
         } | undefined;
     } | undefined;
-    auth?: undefined;
 }, {
     info: {
         name: string;
@@ -4356,7 +5727,7 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         }[] | undefined;
     };
     providers: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
-    tools: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
+    tools: (string | import("libs/di/dist/interfaces/base.interface").Type<unknown>)[];
     resources: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
     skills: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
     plugins: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
@@ -4593,6 +5964,9 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             secret: string;
         } | undefined;
     } | undefined;
+    ui?: {
+        cdnOverrides?: Record<string, string> | undefined;
+    } | undefined;
     jobs?: {
         enabled: boolean;
         store?: {
@@ -4624,6 +5998,65 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             keyPrefix?: string | undefined;
         } | undefined;
     } | undefined;
+    loader?: {
+        url?: string | undefined;
+        registryUrl?: string | undefined;
+        token?: string | undefined;
+        tokenEnvVar?: string | undefined;
+    } | undefined;
+    throttle?: {
+        enabled: boolean;
+        keyPrefix: string;
+        storage?: {
+            [x: string]: unknown;
+        } | undefined;
+        global?: {
+            maxRequests: number;
+            windowMs: number;
+            partitionBy: "session" | "global" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string) | "ip" | "userId";
+        } | undefined;
+        globalConcurrency?: {
+            maxConcurrent: number;
+            queueTimeoutMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultRateLimit?: {
+            maxRequests: number;
+            windowMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultConcurrency?: {
+            maxConcurrent: number;
+            queueTimeoutMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultTimeout?: {
+            executeMs: number;
+        } | undefined;
+        ipFilter?: {
+            defaultAction: "deny" | "allow";
+            trustProxy: boolean;
+            trustedProxyDepth: number;
+            allowList?: string[] | undefined;
+            denyList?: string[] | undefined;
+        } | undefined;
+    } | undefined;
     auth?: {
         mode: "public";
         sessionTtl: number;
@@ -4639,39 +6072,36 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         } | undefined;
         signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
     } | {
-        mode: "transparent";
-        remote: {
-            provider: string;
-            dcrEnabled: boolean;
-            name?: string | undefined;
-            id?: string | undefined;
-            jwks?: {
-                keys: import("libs/auth/dist/common/jwt.types").JWK[];
-            } | undefined;
-            jwksUri?: string | undefined;
-            clientId?: string | undefined;
-            clientSecret?: string | undefined;
-            scopes?: string[] | undefined;
-            authEndpoint?: string | undefined;
-            tokenEndpoint?: string | undefined;
-            registrationEndpoint?: string | undefined;
-            userInfoEndpoint?: string | undefined;
-        };
         requiredScopes: string[];
         allowAnonymous: boolean;
         anonymousScopes: string[];
+        provider: string;
+        mode: "transparent";
         expectedAudience?: string | string[] | undefined;
         publicAccess?: {
             tools: string[] | "all";
             prompts: string[] | "all";
             rateLimit: number;
         } | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        scopes?: string[] | undefined;
+        providerConfig?: {
+            dcrEnabled: boolean;
+            name?: string | undefined;
+            id?: string | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            jwksUri?: string | undefined;
+            authEndpoint?: string | undefined;
+            tokenEndpoint?: string | undefined;
+            registrationEndpoint?: string | undefined;
+            userInfoEndpoint?: string | undefined;
+        } | undefined;
     } | {
-        tokenStorage: {
-            type: "memory";
-        } | {
-            type: "redis";
-            config: {
+        tokenStorage: "memory" | {
+            redis: {
                 host: string;
                 port: number;
                 db: number;
@@ -4683,8 +6113,7 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         };
         allowDefaultPublic: boolean;
         anonymousScopes: string[];
-        mode: "orchestrated";
-        type: "local";
+        mode: "local";
         local?: {
             signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
             jwks?: {
@@ -4754,11 +6183,8 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             } | undefined;
         } | undefined;
     } | {
-        tokenStorage: {
-            type: "memory";
-        } | {
-            type: "redis";
-            config: {
+        tokenStorage: "memory" | {
+            redis: {
                 host: string;
                 port: number;
                 db: number;
@@ -4770,25 +6196,8 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         };
         allowDefaultPublic: boolean;
         anonymousScopes: string[];
-        mode: "orchestrated";
-        type: "remote";
-        remote: {
-            provider: string;
-            dcrEnabled: boolean;
-            name?: string | undefined;
-            id?: string | undefined;
-            jwks?: {
-                keys: import("libs/auth/dist/common/jwt.types").JWK[];
-            } | undefined;
-            jwksUri?: string | undefined;
-            clientId?: string | undefined;
-            clientSecret?: string | undefined;
-            scopes?: string[] | undefined;
-            authEndpoint?: string | undefined;
-            tokenEndpoint?: string | undefined;
-            registrationEndpoint?: string | undefined;
-            userInfoEndpoint?: string | undefined;
-        };
+        provider: string;
+        mode: "remote";
         local?: {
             signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
             jwks?: {
@@ -4857,6 +6266,22 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
                 maxRedirects: number;
             } | undefined;
         } | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        scopes?: string[] | undefined;
+        providerConfig?: {
+            dcrEnabled: boolean;
+            name?: string | undefined;
+            id?: string | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            jwksUri?: string | undefined;
+            authEndpoint?: string | undefined;
+            tokenEndpoint?: string | undefined;
+            registrationEndpoint?: string | undefined;
+            userInfoEndpoint?: string | undefined;
+        } | undefined;
     } | undefined;
 } | {
     info: {
@@ -4872,7 +6297,7 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
         }[] | undefined;
     };
     providers: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
-    tools: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
+    tools: (string | import("libs/di/dist/interfaces/base.interface").Type<unknown>)[];
     resources: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
     skills: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
     plugins: import("libs/di/dist/interfaces/base.interface").Type<unknown>[];
@@ -5109,6 +6534,9 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             secret: string;
         } | undefined;
     } | undefined;
+    ui?: {
+        cdnOverrides?: Record<string, string> | undefined;
+    } | undefined;
     jobs?: {
         enabled: boolean;
         store?: {
@@ -5140,15 +6568,304 @@ export declare const frontMcpMetadataSchema: z.ZodPipe<z.ZodUnion<[z.ZodObject<{
             keyPrefix?: string | undefined;
         } | undefined;
     } | undefined;
-    auth?: undefined;
+    loader?: {
+        url?: string | undefined;
+        registryUrl?: string | undefined;
+        token?: string | undefined;
+        tokenEnvVar?: string | undefined;
+    } | undefined;
+    throttle?: {
+        enabled: boolean;
+        keyPrefix: string;
+        storage?: {
+            [x: string]: unknown;
+        } | undefined;
+        global?: {
+            maxRequests: number;
+            windowMs: number;
+            partitionBy: "session" | "global" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string) | "ip" | "userId";
+        } | undefined;
+        globalConcurrency?: {
+            maxConcurrent: number;
+            queueTimeoutMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultRateLimit?: {
+            maxRequests: number;
+            windowMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultConcurrency?: {
+            maxConcurrent: number;
+            queueTimeoutMs: number;
+            partitionBy: "session" | "global" | "ip" | "userId" | ((ctx: {
+                sessionId: string;
+                clientIp?: string;
+                userId?: string;
+            }) => string);
+        } | undefined;
+        defaultTimeout?: {
+            executeMs: number;
+        } | undefined;
+        ipFilter?: {
+            defaultAction: "deny" | "allow";
+            trustProxy: boolean;
+            trustedProxyDepth: number;
+            allowList?: string[] | undefined;
+            denyList?: string[] | undefined;
+        } | undefined;
+    } | undefined;
+    auth?: {
+        mode: "public";
+        sessionTtl: number;
+        anonymousScopes: string[];
+        issuer?: string | undefined;
+        publicAccess?: {
+            tools: string[] | "all";
+            prompts: string[] | "all";
+            rateLimit: number;
+        } | undefined;
+        jwks?: {
+            keys: import("libs/auth/dist/common/jwt.types").JWK[];
+        } | undefined;
+        signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
+    } | {
+        requiredScopes: string[];
+        allowAnonymous: boolean;
+        anonymousScopes: string[];
+        provider: string;
+        mode: "transparent";
+        expectedAudience?: string | string[] | undefined;
+        publicAccess?: {
+            tools: string[] | "all";
+            prompts: string[] | "all";
+            rateLimit: number;
+        } | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        scopes?: string[] | undefined;
+        providerConfig?: {
+            dcrEnabled: boolean;
+            name?: string | undefined;
+            id?: string | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            jwksUri?: string | undefined;
+            authEndpoint?: string | undefined;
+            tokenEndpoint?: string | undefined;
+            registrationEndpoint?: string | undefined;
+            userInfoEndpoint?: string | undefined;
+        } | undefined;
+    } | {
+        tokenStorage: "memory" | {
+            redis: {
+                host: string;
+                port: number;
+                db: number;
+                tls: boolean;
+                keyPrefix: string;
+                defaultTtlMs: number;
+                password?: string | undefined;
+            };
+        };
+        allowDefaultPublic: boolean;
+        anonymousScopes: string[];
+        mode: "local";
+        local?: {
+            signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            issuer?: string | undefined;
+        } | undefined;
+        publicAccess?: {
+            tools: string[] | "all";
+            prompts: string[] | "all";
+            rateLimit: number;
+        } | undefined;
+        consent?: {
+            enabled: boolean;
+            groupByApp: boolean;
+            showDescriptions: boolean;
+            allowSelectAll: boolean;
+            requireSelection: boolean;
+            rememberConsent: boolean;
+            customMessage?: string | undefined;
+            excludedTools?: string[] | undefined;
+            defaultSelectedTools?: string[] | undefined;
+        } | undefined;
+        federatedAuth?: {
+            stateValidation: "format" | "strict";
+        } | undefined;
+        refresh?: {
+            enabled: boolean;
+            skewSeconds: number;
+        } | undefined;
+        expectedAudience?: string | string[] | undefined;
+        incrementalAuth?: {
+            enabled: boolean;
+            skippedAppBehavior: "anonymous" | "require-auth";
+            allowSkip: boolean;
+            showAllAppsAtOnce: boolean;
+        } | undefined;
+        cimd?: {
+            enabled: boolean;
+            cache?: {
+                type: "memory" | "redis";
+                defaultTtlMs: number;
+                maxTtlMs: number;
+                minTtlMs: number;
+                redis?: {
+                    keyPrefix: string;
+                    url?: string | undefined;
+                    host?: string | undefined;
+                    port?: number | undefined;
+                    password?: string | undefined;
+                    db?: number | undefined;
+                    tls?: boolean | undefined;
+                } | undefined;
+            } | undefined;
+            security?: {
+                blockPrivateIPs: boolean;
+                warnOnLocalhostRedirects: boolean;
+                allowInsecureForTesting: boolean;
+                allowedDomains?: string[] | undefined;
+                blockedDomains?: string[] | undefined;
+            } | undefined;
+            network?: {
+                timeoutMs: number;
+                maxResponseSizeBytes: number;
+                redirectPolicy: "deny" | "same-origin" | "allow";
+                maxRedirects: number;
+            } | undefined;
+        } | undefined;
+    } | {
+        tokenStorage: "memory" | {
+            redis: {
+                host: string;
+                port: number;
+                db: number;
+                tls: boolean;
+                keyPrefix: string;
+                defaultTtlMs: number;
+                password?: string | undefined;
+            };
+        };
+        allowDefaultPublic: boolean;
+        anonymousScopes: string[];
+        provider: string;
+        mode: "remote";
+        local?: {
+            signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            issuer?: string | undefined;
+        } | undefined;
+        publicAccess?: {
+            tools: string[] | "all";
+            prompts: string[] | "all";
+            rateLimit: number;
+        } | undefined;
+        consent?: {
+            enabled: boolean;
+            groupByApp: boolean;
+            showDescriptions: boolean;
+            allowSelectAll: boolean;
+            requireSelection: boolean;
+            rememberConsent: boolean;
+            customMessage?: string | undefined;
+            excludedTools?: string[] | undefined;
+            defaultSelectedTools?: string[] | undefined;
+        } | undefined;
+        federatedAuth?: {
+            stateValidation: "format" | "strict";
+        } | undefined;
+        refresh?: {
+            enabled: boolean;
+            skewSeconds: number;
+        } | undefined;
+        expectedAudience?: string | string[] | undefined;
+        incrementalAuth?: {
+            enabled: boolean;
+            skippedAppBehavior: "anonymous" | "require-auth";
+            allowSkip: boolean;
+            showAllAppsAtOnce: boolean;
+        } | undefined;
+        cimd?: {
+            enabled: boolean;
+            cache?: {
+                type: "memory" | "redis";
+                defaultTtlMs: number;
+                maxTtlMs: number;
+                minTtlMs: number;
+                redis?: {
+                    keyPrefix: string;
+                    url?: string | undefined;
+                    host?: string | undefined;
+                    port?: number | undefined;
+                    password?: string | undefined;
+                    db?: number | undefined;
+                    tls?: boolean | undefined;
+                } | undefined;
+            } | undefined;
+            security?: {
+                blockPrivateIPs: boolean;
+                warnOnLocalhostRedirects: boolean;
+                allowInsecureForTesting: boolean;
+                allowedDomains?: string[] | undefined;
+                blockedDomains?: string[] | undefined;
+            } | undefined;
+            network?: {
+                timeoutMs: number;
+                maxResponseSizeBytes: number;
+                redirectPolicy: "deny" | "same-origin" | "allow";
+                maxRedirects: number;
+            } | undefined;
+        } | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        scopes?: string[] | undefined;
+        providerConfig?: {
+            dcrEnabled: boolean;
+            name?: string | undefined;
+            id?: string | undefined;
+            jwks?: {
+                keys: import("libs/auth/dist/common/jwt.types").JWK[];
+            } | undefined;
+            jwksUri?: string | undefined;
+            authEndpoint?: string | undefined;
+            tokenEndpoint?: string | undefined;
+            registrationEndpoint?: string | undefined;
+            userInfoEndpoint?: string | undefined;
+        } | undefined;
+    } | undefined;
 }>>;
+/**
+ * Parse config with minimal validation for CLI mode.
+ * Skips transport auto-persistence and deep validation of unused subsystems.
+ */
+export declare function parseFrontMcpConfigLite(input: FrontMcpConfigInput): FrontMcpConfigType;
 export type FrontMcpMultiAppConfig = z.infer<typeof frontMcpMultiAppSchema>;
 export type FrontMcpSplitByAppConfig = z.infer<typeof frontMcpSplitByAppSchema>;
 /** Output type after zod parsing (with defaults applied) */
 export type FrontMcpConfigType = z.infer<typeof frontMcpMetadataSchema>;
 /** Input type for FrontMCP configuration (before zod defaults) */
 export type FrontMcpConfigInput = z.input<typeof frontMcpMetadataSchema>;
-export interface AppScopeMetadata extends Omit<FrontMcpSplitByAppMetadata, 'auth' | 'splitByApp'> {
+export interface AppScopeMetadata extends Omit<FrontMcpSplitByAppMetadata, 'splitByApp'> {
     id: string;
     apps: [AppType];
     auth?: AuthOptions;