@zuplo/cli 6.72.2 → 6.72.3

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -2742,7 +2742,7 @@ export declare interface ClerkJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Your Clerk frontend api url, i.e. `https://sensible-skunk-49.clerk.accounts.dev`. Can be found in the Clerk portal: https://dashboard.clerk.com/last-active?path=api-keys.
+   * Your Clerk Frontend API URL, i.e. `https://verb-noun-00.clerk.accounts.dev`. Can be found in the Clerk portal: https://dashboard.clerk.com/last-active?path=api-keys.
    */
   frontendApiUrl: string;
   /**
@@ -7125,20 +7125,20 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
          */
         enabled: true;
         /**
-         * Trusted ID-JAG issuers. These values are never published in OAuth metadata.
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
          *
          * @minItems 1
          */
-        trustedIssuers: [
+        trustedIssuers?: [
           {
             /**
-             * Exact issuer URL expected in the ID-JAG iss claim.
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
              */
-            issuer: string;
+            issuer?: string;
             /**
-             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
              */
-            jwksUrl: string;
+            jwksUrl?: string;
             /**
              * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
              */
@@ -7150,13 +7150,13 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
           },
           ...{
             /**
-             * Exact issuer URL expected in the ID-JAG iss claim.
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
              */
-            issuer: string;
+            issuer?: string;
             /**
-             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
              */
-            jwksUrl: string;
+            jwksUrl?: string;
             /**
              * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
              */
@@ -7236,7 +7236,7 @@ declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<McpClerkOAuthInboundPolicyOptions> {
+export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<ValidatedClerkOAuthOptions> {
   #private;
   static readonly policyType = "mcp-clerk-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7284,6 +7284,69 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7294,6 +7357,37 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpClerkOAuthOptionsSchema: z.ZodObject<
+  {
+    frontendApiUrl: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Amazon Cognito.
@@ -7307,7 +7401,7 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<McpCognitoOAuthInboundPolicyOptions> {
+export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<ValidatedCognitoOAuthOptions> {
   #private;
   static readonly policyType = "mcp-cognito-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7363,6 +7457,69 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7377,6 +7534,45 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpCognitoOAuthOptionsSchema: z.ZodObject<
+  {
+    awsRegion: z.ZodString;
+    userPoolId: z.ZodString;
+    userPoolDomain: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Microsoft Entra ID.
@@ -7389,7 +7585,7 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<McpEntraOAuthInboundPolicyOptions> {
+export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<ValidatedEntraOAuthOptions> {
   #private;
   static readonly policyType = "mcp-entra-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7437,6 +7633,69 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7451,6 +7710,43 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpEntraOAuthOptionsSchema: z.ZodObject<
+  {
+    tenantId: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /* Excluded from this release type: McpGatewayOAuthProtectedResourcePlugin */
 
 /**
@@ -7466,7 +7762,7 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<McpGoogleOAuthInboundPolicyOptions> {
+export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<ValidatedGoogleOAuthOptions> {
   #private;
   static readonly policyType = "mcp-google-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7510,6 +7806,69 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7524,6 +7883,42 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpGoogleOAuthOptionsSchema: z.ZodObject<
+  {
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Keycloak.
@@ -7537,7 +7932,7 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<McpKeycloakOAuthInboundPolicyOptions> {
+export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<ValidatedKeycloakOAuthOptions> {
   #private;
   static readonly policyType = "mcp-keycloak-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7589,6 +7984,69 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7603,6 +8061,44 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpKeycloakOAuthOptionsSchema: z.ZodObject<
+  {
+    keycloakBaseUrl: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    realm: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Logto.
@@ -7615,7 +8111,7 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<McpLogtoOAuthInboundPolicyOptions> {
+export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<ValidatedLogtoOAuthOptions> {
   #private;
   static readonly policyType = "mcp-logto-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7663,6 +8159,69 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7677,6 +8236,43 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpLogtoOAuthOptionsSchema: z.ZodObject<
+  {
+    logtoEndpoint: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token.
  *
@@ -7804,20 +8400,20 @@ export declare interface McpOAuthInboundPolicyOptions {
          */
         enabled: true;
         /**
-         * Trusted ID-JAG issuers. These values are never published in OAuth metadata.
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
          *
          * @minItems 1
          */
-        trustedIssuers: [
+        trustedIssuers?: [
           {
             /**
-             * Exact issuer URL expected in the ID-JAG iss claim.
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
              */
-            issuer: string;
+            issuer?: string;
             /**
-             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
              */
-            jwksUrl: string;
+            jwksUrl?: string;
             /**
              * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
              */
@@ -7829,13 +8425,13 @@ export declare interface McpOAuthInboundPolicyOptions {
           },
           ...{
             /**
-             * Exact issuer URL expected in the ID-JAG iss claim.
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
              */
-            issuer: string;
+            issuer?: string;
             /**
-             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
              */
-            jwksUrl: string;
+            jwksUrl?: string;
             /**
              * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
              */
@@ -7855,108 +8451,198 @@ export declare interface McpOAuthInboundPolicyOptions {
 
 declare type McpOAuthRuntimeConfig = z.infer<
   typeof mcpOAuthRuntimeConfigSchema
->;
-
-declare const mcpOAuthRuntimeConfigSchema: z.ZodObject<
-  {
-    oidc: z.ZodObject<
-      {
-        issuer: z.ZodURL;
-        jwksUrl: z.ZodURL;
-        audience: z.ZodOptional<z.ZodString>;
-      },
-      z.core.$strip
-    >;
-    browserLogin: z.ZodObject<
-      {
-        url: z.ZodURL;
-        tokenUrl: z.ZodOptional<z.ZodURL>;
-        clientId: z.ZodOptional<z.ZodString>;
-        clientSecret: z.ZodOptional<z.ZodString>;
-        scope: z.ZodDefault<z.ZodString>;
-        audience: z.ZodOptional<z.ZodString>;
-        pkce: z.ZodDefault<
-          z.ZodEnum<{
-            none: "none";
-            S256: "S256";
-          }>
-        >;
-        remoteTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-        stateTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-        sessionTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-      },
-      z.core.$strict
-    >;
-    gateway: z.ZodPipe<
-      z.ZodDefault<
-        z.ZodObject<
-          {
-            accessTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-            refreshTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-            cimdEnabled: z.ZodDefault<z.ZodBoolean>;
-          },
-          z.core.$strict
-        >
-      >,
-      z.ZodTransform<
+>;
+
+declare const mcpOAuthRuntimeConfigSchema: z.ZodPipe<
+  z.ZodObject<
+    {
+      oidc: z.ZodObject<
         {
-          accessTokenTtlSeconds: number;
-          refreshTokenTtlSeconds: number;
-          downstreamCimdEnabled: boolean;
+          issuer: z.ZodURL;
+          jwksUrl: z.ZodURL;
+          audience: z.ZodOptional<z.ZodString>;
         },
+        z.core.$strip
+      >;
+      browserLogin: z.ZodObject<
         {
-          accessTokenTtlSeconds: number;
-          refreshTokenTtlSeconds: number;
-          cimdEnabled: boolean;
-        }
-      >
-    >;
-    idJag: z.ZodDefault<
-      z.ZodOptional<
+          url: z.ZodURL;
+          tokenUrl: z.ZodOptional<z.ZodURL>;
+          clientId: z.ZodOptional<z.ZodString>;
+          clientSecret: z.ZodOptional<z.ZodString>;
+          scope: z.ZodDefault<z.ZodString>;
+          audience: z.ZodOptional<z.ZodString>;
+          pkce: z.ZodDefault<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+          remoteTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+          stateTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+          sessionTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        },
+        z.core.$strict
+      >;
+      gateway: z.ZodPipe<
         z.ZodDefault<
-          z.ZodDiscriminatedUnion<
-            [
-              z.ZodObject<
-                {
-                  enabled: z.ZodLiteral<false>;
-                },
-                z.core.$strict
-              >,
-              z.ZodObject<
-                {
-                  enabled: z.ZodLiteral<true>;
-                  trustedIssuers: z.ZodArray<
-                    z.ZodObject<
-                      {
-                        issuer: z.ZodURL;
-                        jwksUrl: z.ZodURL;
-                        expectedClientIds: z.ZodOptional<
-                          z.ZodArray<z.ZodString>
-                        >;
-                        subjectMapping: z.ZodDefault<
-                          z.ZodEnum<{
-                            iss_prefix: "iss_prefix";
-                            iss_tenant_prefix: "iss_tenant_prefix";
-                            sub_id_only: "sub_id_only";
-                          }>
-                        >;
-                      },
-                      z.core.$strict
-                    >
-                  >;
-                  authorizationDetailsTypesAllowed: z.ZodOptional<
-                    z.ZodArray<z.ZodString>
-                  >;
-                },
-                z.core.$strict
-              >,
-            ]
+          z.ZodObject<
+            {
+              accessTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+              refreshTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+              cimdEnabled: z.ZodDefault<z.ZodBoolean>;
+            },
+            z.core.$strict
+          >
+        >,
+        z.ZodTransform<
+          {
+            accessTokenTtlSeconds: number;
+            refreshTokenTtlSeconds: number;
+            downstreamCimdEnabled: boolean;
+          },
+          {
+            accessTokenTtlSeconds: number;
+            refreshTokenTtlSeconds: number;
+            cimdEnabled: boolean;
+          }
+        >
+      >;
+      idJag: z.ZodDefault<
+        z.ZodOptional<
+          z.ZodDefault<
+            z.ZodDiscriminatedUnion<
+              [
+                z.ZodObject<
+                  {
+                    enabled: z.ZodLiteral<false>;
+                  },
+                  z.core.$strict
+                >,
+                z.ZodObject<
+                  {
+                    enabled: z.ZodLiteral<true>;
+                    trustedIssuers: z.ZodOptional<
+                      z.ZodArray<
+                        z.ZodObject<
+                          {
+                            issuer: z.ZodOptional<z.ZodURL>;
+                            jwksUrl: z.ZodOptional<z.ZodURL>;
+                            expectedClientIds: z.ZodOptional<
+                              z.ZodArray<z.ZodString>
+                            >;
+                            subjectMapping: z.ZodDefault<
+                              z.ZodEnum<{
+                                iss_prefix: "iss_prefix";
+                                iss_tenant_prefix: "iss_tenant_prefix";
+                                sub_id_only: "sub_id_only";
+                              }>
+                            >;
+                          },
+                          z.core.$strict
+                        >
+                      >
+                    >;
+                    authorizationDetailsTypesAllowed: z.ZodOptional<
+                      z.ZodArray<z.ZodString>
+                    >;
+                  },
+                  z.core.$strict
+                >,
+              ]
+            >
           >
         >
-      >
-    >;
-  },
-  z.core.$strict
+      >;
+    },
+    z.core.$strict
+  >,
+  z.ZodTransform<
+    {
+      idJag:
+        | {
+            enabled: false;
+          }
+        | {
+            enabled: true;
+            trustedIssuers: {
+              issuer: string;
+              jwksUrl: string;
+              subjectMapping:
+                | "iss_prefix"
+                | "iss_tenant_prefix"
+                | "sub_id_only";
+              expectedClientIds?: string[] | undefined;
+            }[];
+            authorizationDetailsTypesAllowed?: string[] | undefined;
+          };
+      oidc: {
+        issuer: string;
+        jwksUrl: string;
+        audience?: string | undefined;
+      };
+      browserLogin: {
+        url: string;
+        scope: string;
+        pkce: "none" | "S256";
+        remoteTimeoutMs: number;
+        stateTtlSeconds: number;
+        sessionTtlSeconds: number;
+        tokenUrl?: string | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        audience?: string | undefined;
+      };
+      gateway: {
+        accessTokenTtlSeconds: number;
+        refreshTokenTtlSeconds: number;
+        downstreamCimdEnabled: boolean;
+      };
+    },
+    {
+      oidc: {
+        issuer: string;
+        jwksUrl: string;
+        audience?: string | undefined;
+      };
+      browserLogin: {
+        url: string;
+        scope: string;
+        pkce: "none" | "S256";
+        remoteTimeoutMs: number;
+        stateTtlSeconds: number;
+        sessionTtlSeconds: number;
+        tokenUrl?: string | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        audience?: string | undefined;
+      };
+      gateway: {
+        accessTokenTtlSeconds: number;
+        refreshTokenTtlSeconds: number;
+        downstreamCimdEnabled: boolean;
+      };
+      idJag:
+        | {
+            enabled: false;
+          }
+        | {
+            enabled: true;
+            trustedIssuers?:
+              | {
+                  subjectMapping:
+                    | "iss_prefix"
+                    | "iss_tenant_prefix"
+                    | "sub_id_only";
+                  issuer?: string | undefined;
+                  jwksUrl?: string | undefined;
+                  expectedClientIds?: string[] | undefined;
+                }[]
+              | undefined;
+            authorizationDetailsTypesAllowed?: string[] | undefined;
+          };
+    }
+  >
 >;
 
 /**
@@ -7971,7 +8657,7 @@ declare const mcpOAuthRuntimeConfigSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<McpOktaOAuthInboundPolicyOptions> {
+export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<ValidatedOktaOAuthOptions> {
   #private;
   static readonly policyType = "mcp-okta-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8023,6 +8709,69 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -8037,6 +8786,44 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpOktaOAuthOptionsSchema: z.ZodObject<
+  {
+    oktaDomain: z.ZodString;
+    authorizationServerId: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to OneLogin.
@@ -8049,7 +8836,7 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<McpOneLoginOAuthInboundPolicyOptions> {
+export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<ValidatedOneLoginOAuthOptions> {
   #private;
   static readonly policyType = "mcp-onelogin-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8097,6 +8884,69 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -8107,6 +8957,37 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpOneLoginOAuthOptionsSchema: z.ZodObject<
+  {
+    oneLoginSubdomain: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to PingOne.
@@ -8120,7 +9001,7 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpPingOAuthInboundPolicy extends InboundPolicy<McpPingOAuthInboundPolicyOptions> {
+export declare class McpPingOAuthInboundPolicy extends InboundPolicy<ValidatedPingOAuthOptions> {
   #private;
   static readonly policyType = "mcp-ping-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8182,6 +9063,69 @@ export declare interface McpPingOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -8196,6 +9140,54 @@ export declare interface McpPingOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpPingOAuthOptionsSchema: z.ZodObject<
+  {
+    environmentId: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<
+      z.ZodEnum<{
+        "north-america": "north-america";
+        canada: "canada";
+        europe: "europe";
+        singapore: "singapore";
+        australia: "australia";
+        "asia-pacific": "asia-pacific";
+      }>
+    >;
+    customDomain: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * An MCP Server handler for Zuplo
  * Only POST requests are supported for the HTTP streamable MCP transport.
@@ -8246,7 +9238,7 @@ declare interface McpTool {
  * @public
  * @product mcp-gateway
  */
-export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<McpWorkosOAuthInboundPolicyOptions> {
+export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<ValidatedWorkosOAuthOptions> {
   #private;
   static readonly policyType = "mcp-workos-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8290,6 +9282,69 @@ export declare interface McpWorkosOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -8304,6 +9359,42 @@ export declare interface McpWorkosOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpWorkosOAuthOptionsSchema: z.ZodObject<
+  {
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 declare interface MemoryCacheOptions {
   maxSize: number;
 }
@@ -10384,7 +11475,7 @@ export declare interface PropelAuthJwtInboundPolicyOptions {
    */
   allowUnauthenticatedRequests?: boolean;
   /**
-   * Your PropelAuth authUrl. For example, `https://6587563.propelauthtest.com`.
+   * Your PropelAuth authUrl. For example, `https://12345678.propelauthtest.com`.
    */
   authUrl: string;
   /**
@@ -13114,6 +14205,157 @@ declare interface UnauthenticatedCredentialConfig {
   method: "none";
 }
 
+/**
+ * Resolves AWS credentials with STS AssumeRoleWithWebIdentity using Zuplo's
+ * ambient OIDC identity — no AWS keys are stored anywhere. The role's trust
+ * policy must trust the Zuplo OIDC identity provider. Resolved credentials are
+ * registered on the request context for the AWS Lambda handler and custom code
+ * to sign upstream requests with {@link AwsClient.fromContext}. This policy does
+ * not itself sign or forward the request.
+ *
+ * @title Upstream AWS Federated Auth
+ * @product api-gateway
+ * @beta
+ * @enterprise
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare class UpstreamAwsFederatedAuthInboundPolicy extends InboundPolicy<UpstreamAwsFederatedAuthInboundPolicyOptions> {
+  #private;
+  static readonly policyType = "upstream-aws-federated-auth";
+  constructor(
+    options: UpstreamAwsFederatedAuthInboundPolicyOptions,
+    policyName: string
+  );
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * The options for this policy.
+ * @public
+ */
+export declare interface UpstreamAwsFederatedAuthInboundPolicyOptions {
+  /**
+   * The IAM role to assume with STS AssumeRoleWithWebIdentity. The role's trust policy must trust the Zuplo OIDC identity provider.
+   */
+  roleArn: string;
+  /**
+   * The AWS region used for the STS endpoint and as the default signing region for consumers of the resolved credentials.
+   */
+  region: string;
+  /**
+   * The audience ('aud' claim) of the Zuplo-issued OIDC token. Must match a client ID configured on the IAM OIDC identity provider.
+   */
+  audience?: string;
+  /**
+   * The STS role session name recorded in AWS CloudTrail. Must match the pattern [\w+=,.@-]{2,64}.
+   */
+  roleSessionName?: string;
+  /**
+   * The lifetime in seconds of the temporary credentials requested from STS (900-43200). The assumed role's maximum session duration may further limit this value.
+   */
+  durationSeconds?: number;
+  /**
+   * Overrides the STS endpoint URL. Only needed for non-standard partitions such as AWS GovCloud or AWS China.
+   */
+  stsEndpoint?: string;
+  /**
+   * The number of times to retry fetching temporary credentials in the event of a failure.
+   */
+  tokenRetries?: number;
+  /**
+   * The number of seconds before credential expiration at which cached credentials are discarded and refreshed.
+   */
+  expirationOffsetSeconds?: number;
+}
+
+/**
+ * Resolves AWS credentials from static access keys (optionally exchanged for an
+ * IAM role's temporary credentials via STS AssumeRole) and registers them on
+ * the request context. The AWS Lambda handler and custom code read them with
+ * {@link AwsClient.fromContext} to sign upstream requests. This policy does not
+ * itself sign or forward the request.
+ *
+ * @title Upstream AWS Service Auth
+ * @product api-gateway
+ * @beta
+ * @enterprise
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare class UpstreamAwsServiceAuthInboundPolicy extends InboundPolicy<UpstreamAwsServiceAuthInboundPolicyOptions> {
+  #private;
+  static readonly policyType = "upstream-aws-service-auth";
+  constructor(
+    options: UpstreamAwsServiceAuthInboundPolicyOptions,
+    policyName: string
+  );
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * The options for this policy.
+ * @public
+ */
+export declare interface UpstreamAwsServiceAuthInboundPolicyOptions {
+  /**
+   * The AWS access key ID. Store the value in an environment variable rather than in source.
+   */
+  accessKeyId: string;
+  /**
+   * The AWS secret access key. Always store this in an environment variable.
+   */
+  secretAccessKey: string;
+  /**
+   * The AWS region. Used for the STS endpoint when 'roleArn' is set, and as the default signing region for consumers of the resolved credentials.
+   */
+  region: string;
+  /**
+   * The AWS session token, required only when the configured access key pair is itself a temporary credential.
+   */
+  sessionToken?: string;
+  /**
+   * An IAM role to assume using STS AssumeRole with the configured access keys. When set, the resolved credentials are the role's temporary credentials instead of the static keys.
+   */
+  roleArn?: string;
+  /**
+   * The external ID to pass to STS AssumeRole when the role's trust policy requires one.
+   */
+  externalId?: string;
+  /**
+   * The STS role session name recorded in AWS CloudTrail. Must match the pattern [\w+=,.@-]{2,64}.
+   */
+  roleSessionName?: string;
+  /**
+   * The lifetime in seconds of the temporary credentials requested from STS (900-43200). The assumed role's maximum session duration may further limit this value.
+   */
+  durationSeconds?: number;
+  /**
+   * Overrides the STS endpoint URL. Only needed for non-standard partitions such as AWS GovCloud or AWS China.
+   */
+  stsEndpoint?: string;
+  /**
+   * The number of times to retry fetching temporary credentials in the event of a failure.
+   */
+  tokenRetries?: number;
+  /**
+   * The number of seconds before credential expiration at which cached credentials are discarded and refreshed.
+   */
+  expirationOffsetSeconds?: number;
+}
+
 /**
  * Uses Azure Active Directory to add an Authorization header to the request
  * in order to authenticate requests using Azure identity.
@@ -13365,7 +14607,7 @@ export declare const UpstreamGcpServiceAuthInboundPolicy: InboundPolicyHandler<U
  */
 export declare interface UpstreamGcpServiceAuthInboundPolicyOptions {
   /**
-   * The audience for the service to be called. This is typically the URL of your service endpoint like 'https://my-service-a2ev-uc.a.run.app'. If calling a Google API, leave this empty.
+   * The audience for the service to be called. This is typically the URL of your service endpoint like 'https://my-backend-api-a1b2c3d4e5-uc.a.run.app'. If calling a Google API, leave this empty.
    */
   audience?: string;
   /**
@@ -13441,6 +14683,16 @@ export declare interface UpstreamZuploJwtAuthInboundPolicyOptions {
    * The audience claim for the JWT.
    */
   audience?: string;
+  /**
+   * The subject ('sub') claim for the minted JWT. Identifies the acting subject of the token (typically the gateway itself).
+   */
+  subject?: string;
+  /**
+   * Maps claims in the minted JWT to values from the authenticated user (request.user). Each key is the claim name to set; each value is a light JSON-path selector into request.user using dot or bracket notation (e.g. 'sub', 'data.role', or 'data["https://example.com/claim"]' for keys containing dots or slashes). When set, the policy requires an authenticated user and returns 401 if request.user is absent — it never mints a token with missing identity.
+   */
+  claimsFromUser?: {
+    [k: string]: string;
+  };
   /**
    * The header name where the JWT will be attached. Defaults to 'Authorization'.
    */
@@ -13621,8 +14873,48 @@ declare type ValidatedAuth0OAuthOptions = z.infer<
   typeof mcpAuth0OAuthOptionsSchema
 >;
 
+declare type ValidatedClerkOAuthOptions = z.infer<
+  typeof mcpClerkOAuthOptionsSchema
+>;
+
+declare type ValidatedCognitoOAuthOptions = z.infer<
+  typeof mcpCognitoOAuthOptionsSchema
+>;
+
+declare type ValidatedEntraOAuthOptions = z.infer<
+  typeof mcpEntraOAuthOptionsSchema
+>;
+
+declare type ValidatedGoogleOAuthOptions = z.infer<
+  typeof mcpGoogleOAuthOptionsSchema
+>;
+
+declare type ValidatedKeycloakOAuthOptions = z.infer<
+  typeof mcpKeycloakOAuthOptionsSchema
+>;
+
+declare type ValidatedLogtoOAuthOptions = z.infer<
+  typeof mcpLogtoOAuthOptionsSchema
+>;
+
+declare type ValidatedOktaOAuthOptions = z.infer<
+  typeof mcpOktaOAuthOptionsSchema
+>;
+
+declare type ValidatedOneLoginOAuthOptions = z.infer<
+  typeof mcpOneLoginOAuthOptionsSchema
+>;
+
 declare type ValidatedOptions = z.infer<typeof requireUserClaimsOptionsSchema>;
 
+declare type ValidatedPingOAuthOptions = z.infer<
+  typeof mcpPingOAuthOptionsSchema
+>;
+
+declare type ValidatedWorkosOAuthOptions = z.infer<
+  typeof mcpWorkosOAuthOptionsSchema
+>;
+
 /**
  * Validates the body of an incoming request based on a JSON schema.
  *