@zuplo/cli 6.72.2 → 6.72.7

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -125,6 +125,10 @@ export declare function AIGatewayAuthInboundPolicy(
  * @public
  */
 export declare interface AIGatewayAuthInboundPolicyOptions {
+  /**
+   * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
+   */
+  cacheTtlSeconds?: number;
   /**
    * The name of the header with the key.
    */
@@ -133,10 +137,6 @@ export declare interface AIGatewayAuthInboundPolicyOptions {
    * The scheme used on the header.
    */
   authScheme?: string;
-  /**
-   * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
-   */
-  cacheTtlSeconds?: number;
 }
 
 /**
@@ -383,8 +383,8 @@ export declare function AIGatewaySemanticCacheV2InboundPolicy(
 export declare interface AIGatewaySemanticCacheV2InboundPolicyOptions {
   semanticTolerance?: SemanticTolerance;
   expirationSecondsTtl?: CacheTTLSeconds;
-  maxConversationLength?: MaxConversationLength;
   namespace?: CacheNamespace;
+  maxConversationLength?: MaxConversationLength;
   endpoints?: ApplicableEndpoints;
   onUnknownShape?: OnUnknownShape;
 }
@@ -1142,6 +1142,10 @@ export declare function ApiKeyInboundPolicy(
  * @public
  */
 export declare interface ApiKeyInboundPolicyOptions {
+  /**
+   * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
+   */
+  cacheTtlSeconds?: number;
   /**
    * The name of the header with the key.
    */
@@ -1162,10 +1166,6 @@ export declare interface ApiKeyInboundPolicyOptions {
    * If requests should proceed even if the policy does not successfully authenticate the request. Defaults to false and rejects any request without a valid API key (returning a `401 - Unauthorized` response). Set to `true` to support multiple authentication methods or support both authenticated and anonymous requests.
    */
   allowUnauthenticatedRequests?: boolean;
-  /**
-   * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
-   */
-  cacheTtlSeconds?: number;
   /**
    * Zuplo will automatically document your API key header within your OpenAPI specification & Developer Portal. Set this to `true` to disable this behavior.
    */
@@ -1577,10 +1577,6 @@ export declare const Auth0JwtInboundPolicy: InboundPolicyHandler<Auth0JwtInbound
  * @public
  */
 export declare interface Auth0JwtInboundPolicyOptions {
-  /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Your Auth0 domain. For example, `my-company.auth0.com`.
    */
@@ -1589,6 +1585,10 @@ export declare interface Auth0JwtInboundPolicyOptions {
    * The Auth0 audience of your API, for example `https://api.example.com/`.
    */
   audience?: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -1653,10 +1653,6 @@ export declare interface AuthZenInboundPolicyOptions {
    * The hostname of the AuthZen PDP service.
    */
   authorizerHostname: string;
-  /**
-   * The authorization header to use when communicating with the AuthZen PDP service.
-   */
-  authorizerAuthorizationHeader?: string;
   /**
    * The subject of the request.
    */
@@ -1695,6 +1691,10 @@ export declare interface AuthZenInboundPolicyOptions {
     name: string;
     [k: string]: unknown;
   };
+  /**
+   * The authorization header to use when communicating with the AuthZen PDP service.
+   */
+  authorizerAuthorizationHeader?: string;
   /**
    * If explicitly set to false, the policy will not throw an error if there is any problem communicating with the AuthZen PDP service and allow calls through. By default throwOnError is assumed to be on/true.
    */
@@ -1992,10 +1992,6 @@ export declare class AxiomaticsAuthZInboundPolicy extends InboundPolicy<Axiomati
  * @public
  */
 export declare interface AxiomaticsAuthZInboundPolicyOptions {
-  /**
-   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
-   */
-  allowUnauthorizedRequests?: boolean;
   /**
    * The URL to which the plugin will make a JSON POST request before proxying the original request.
    */
@@ -2008,6 +2004,10 @@ export declare interface AxiomaticsAuthZInboundPolicyOptions {
    * The password to use when authenticating with the PDP.
    */
   pdpPassword: string;
+  /**
+   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
+   */
+  allowUnauthorizedRequests?: boolean;
   /**
    * Indicates whether the plugin should include default action attributes in the authorization request.
    */
@@ -2261,7 +2261,7 @@ export declare interface BasicAuthInboundPolicyOptions {
    */
   accounts: BasicAuthAccount[];
   /**
-   * If 'true' allows the request to continue even if authenticated. When 'false' (the default) any unauthenticated request is automatically rejected with a 401.
+   * If 'true' allows the request to continue even if unauthenticated. When 'false' (the default) any unauthenticated request is automatically rejected with a 401.
    */
   allowUnauthenticatedRequests?: boolean;
 }
@@ -2431,13 +2431,9 @@ export declare function CachingInboundPolicy(
  */
 export declare interface CachingInboundPolicyOptions {
   /**
-   * Specifies an id or 'key' for this policy to store cache. This is useful for cache-busting. For example, set this property to an env var and if you change that env var value, you invalidate the cache.
-   */
-  cacheId?: string;
-  /**
-   * By default, the Authorization header is always considered in the caching policy. You can disable by setting this to `true`.
+   * The timeout of the cache in seconds.
    */
-  dangerouslyIgnoreAuthorizationHeader?: boolean;
+  expirationSecondsTtl?: number;
   /**
    * The headers to be considered when caching.
    */
@@ -2446,14 +2442,18 @@ export declare interface CachingInboundPolicyOptions {
    * HTTP Methods to be cached. Valid methods are: GET, POST, PUT, PATCH, DELETE, HEAD.
    */
   cacheHttpMethods?: ("GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD")[];
-  /**
-   * The timeout of the cache in seconds.
-   */
-  expirationSecondsTtl?: number;
   /**
    * Response status codes to be cached.
    */
   statusCodes?: number[];
+  /**
+   * Specifies an id or 'key' for this policy to store cache. This is useful for cache-busting. For example, set this property to an env var and if you change that env var value, you invalidate the cache.
+   */
+  cacheId?: string;
+  /**
+   * By default, the Authorization header is always considered in the caching policy. You can disable by setting this to `true`.
+   */
+  dangerouslyIgnoreAuthorizationHeader?: boolean;
 }
 
 /**
@@ -2738,13 +2738,13 @@ export declare const ClerkJwtInboundPolicy: InboundPolicyHandler<ClerkJwtInbound
  */
 export declare interface ClerkJwtInboundPolicyOptions {
   /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   * Your Clerk Frontend API URL, i.e. `https://verb-noun-00.clerk.accounts.dev`. Can be found in the Clerk portal: https://dashboard.clerk.com/last-active?path=api-keys.
    */
-  allowUnauthenticatedRequests?: boolean;
+  frontendApiUrl: string;
   /**
-   * Your Clerk frontend api url, i.e. `https://sensible-skunk-49.clerk.accounts.dev`. Can be found in the Clerk portal: https://dashboard.clerk.com/last-active?path=api-keys.
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
    */
-  frontendApiUrl: string;
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -2810,10 +2810,6 @@ export declare const CognitoJwtInboundPolicy: InboundPolicyHandler<CognitoJwtInb
  * @public
  */
 export declare interface CognitoJwtInboundPolicyOptions {
-  /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * The AWS region where your Cognito instance is deployed.
    */
@@ -2822,6 +2818,10 @@ export declare interface CognitoJwtInboundPolicyOptions {
    * The user pool identifier.
    */
   userPoolId: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -3677,10 +3677,6 @@ export declare interface DataLossPreventionInboundPolicyOptions {
     | "secret-twilio"
     | "secret-zuplo"
   )[];
-  /**
-   * Additional customer-defined regex recognizers. Invalid patterns are logged and skipped rather than failing the request.
-   */
-  customPatterns?: DlpCustomPattern[];
   /**
    * What to do when sensitive data is detected. `mask` redacts matches before forwarding the request, `block` rejects with a 422 listing only the detected entity names, and `log` records a warning and forwards the request unchanged.
    */
@@ -3689,6 +3685,10 @@ export declare interface DataLossPreventionInboundPolicyOptions {
    * The string that replaces detected values when `action` is `mask`.
    */
   mask?: string;
+  /**
+   * Additional customer-defined regex recognizers. Invalid patterns are logged and skipped rather than failing the request.
+   */
+  customPatterns?: DlpCustomPattern[];
   /**
    * Minimum confidence (0-1) a match must reach to count as a finding. Context-dependent recognizers (for example `finance-us-bank-account` or `finance-us-aba-routing`) sit below the default threshold of 0.5 until a context word near the match boosts them above it. Lower the threshold to surface them everywhere; raise it to keep only prefix- or checksum-validated matches.
    */
@@ -3820,10 +3820,6 @@ export declare interface DataLossPreventionOutboundPolicyOptions {
     | "secret-twilio"
     | "secret-zuplo"
   )[];
-  /**
-   * Additional customer-defined regex recognizers. Invalid patterns are logged and skipped rather than failing the response.
-   */
-  customPatterns?: DlpCustomPattern_2[];
   /**
    * What to do when sensitive data is detected. `mask` redacts matches before returning the response, `block` replaces the response with a 422 listing only the detected entity names, and `log` records a warning and returns the response unchanged.
    */
@@ -3832,6 +3828,10 @@ export declare interface DataLossPreventionOutboundPolicyOptions {
    * The string that replaces detected values when `action` is `mask`.
    */
   mask?: string;
+  /**
+   * Additional customer-defined regex recognizers. Invalid patterns are logged and skipped rather than failing the response.
+   */
+  customPatterns?: DlpCustomPattern_2[];
   /**
    * Minimum confidence (0-1) a match must reach to count as a finding. Context-dependent recognizers (for example `finance-us-bank-account` or `finance-us-aba-routing`) sit below the default threshold of 0.5 until a context word near the match boosts them above it. Lower the threshold to surface them everywhere; raise it to keep only prefix- or checksum-validated matches.
    */
@@ -4111,14 +4111,14 @@ export declare const FirebaseJwtInboundPolicy: InboundPolicyHandler<FirebaseJwtI
  * @public
  */
 export declare interface FirebaseJwtInboundPolicyOptions {
-  /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Your Firebase Project ID.
    */
   projectId: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -7125,20 +7125,20 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
          */
         enabled: true;
         /**
-         * Trusted ID-JAG issuers. These values are never published in OAuth metadata.
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
          *
          * @minItems 1
          */
-        trustedIssuers: [
+        trustedIssuers?: [
           {
             /**
-             * Exact issuer URL expected in the ID-JAG iss claim.
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
              */
-            issuer: string;
+            issuer?: string;
             /**
-             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
              */
-            jwksUrl: string;
+            jwksUrl?: string;
             /**
              * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
              */
@@ -7150,13 +7150,13 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
           },
           ...{
             /**
-             * Exact issuer URL expected in the ID-JAG iss claim.
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
              */
-            issuer: string;
+            issuer?: string;
             /**
-             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
              */
-            jwksUrl: string;
+            jwksUrl?: string;
             /**
              * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
              */
@@ -7236,7 +7236,7 @@ declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<McpClerkOAuthInboundPolicyOptions> {
+export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<ValidatedClerkOAuthOptions> {
   #private;
   static readonly policyType = "mcp-clerk-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7284,6 +7284,69 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7294,6 +7357,37 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpClerkOAuthOptionsSchema: z.ZodObject<
+  {
+    frontendApiUrl: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Amazon Cognito.
@@ -7307,7 +7401,7 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<McpCognitoOAuthInboundPolicyOptions> {
+export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<ValidatedCognitoOAuthOptions> {
   #private;
   static readonly policyType = "mcp-cognito-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7363,6 +7457,69 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7377,27 +7534,66 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
   };
 }
 
-/**
- * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
- * with browser login delegated to Microsoft Entra ID.
- *
- * Entra-friendly wrapper around `McpOAuthInboundPolicy`. Provide a tenant UUID,
- * application client id, and client secret; the constructor derives the Entra
- * v2 issuer, JWKS URL, authorize URL, and token URL.
- *
- * @title MCP Microsoft Entra OAuth
- * @public
- * @product mcp-gateway
- */
-export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<McpEntraOAuthInboundPolicyOptions> {
-  #private;
-  static readonly policyType = "mcp-entra-oauth";
-  constructor(rawOptions: unknown, policyName: string);
-  handler(
-    request: ZuploRequest,
-    context: ZuploContext
-  ): Promise<ZuploRequest | Response>;
-}
+declare const mcpCognitoOAuthOptionsSchema: z.ZodObject<
+  {
+    awsRegion: z.ZodString;
+    userPoolId: z.ZodString;
+    userPoolDomain: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
+/**
+ * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
+ * with browser login delegated to Microsoft Entra ID.
+ *
+ * Entra-friendly wrapper around `McpOAuthInboundPolicy`. Provide a tenant UUID,
+ * application client id, and client secret; the constructor derives the Entra
+ * v2 issuer, JWKS URL, authorize URL, and token URL.
+ *
+ * @title MCP Microsoft Entra OAuth
+ * @public
+ * @product mcp-gateway
+ */
+export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<ValidatedEntraOAuthOptions> {
+  #private;
+  static readonly policyType = "mcp-entra-oauth";
+  constructor(rawOptions: unknown, policyName: string);
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
 
 /**
  * The options for this policy.
@@ -7437,6 +7633,69 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7451,6 +7710,43 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpEntraOAuthOptionsSchema: z.ZodObject<
+  {
+    tenantId: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /* Excluded from this release type: McpGatewayOAuthProtectedResourcePlugin */
 
 /**
@@ -7466,7 +7762,7 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<McpGoogleOAuthInboundPolicyOptions> {
+export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<ValidatedGoogleOAuthOptions> {
   #private;
   static readonly policyType = "mcp-google-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7510,6 +7806,69 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7524,6 +7883,42 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpGoogleOAuthOptionsSchema: z.ZodObject<
+  {
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Keycloak.
@@ -7537,7 +7932,7 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<McpKeycloakOAuthInboundPolicyOptions> {
+export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<ValidatedKeycloakOAuthOptions> {
   #private;
   static readonly policyType = "mcp-keycloak-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7589,6 +7984,69 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7603,6 +8061,44 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpKeycloakOAuthOptionsSchema: z.ZodObject<
+  {
+    keycloakBaseUrl: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    realm: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Logto.
@@ -7615,7 +8111,7 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<McpLogtoOAuthInboundPolicyOptions> {
+export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<ValidatedLogtoOAuthOptions> {
   #private;
   static readonly policyType = "mcp-logto-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7663,6 +8159,69 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -7677,6 +8236,43 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpLogtoOAuthOptionsSchema: z.ZodObject<
+  {
+    logtoEndpoint: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token.
  *
@@ -7804,20 +8400,20 @@ export declare interface McpOAuthInboundPolicyOptions {
          */
         enabled: true;
         /**
-         * Trusted ID-JAG issuers. These values are never published in OAuth metadata.
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
          *
          * @minItems 1
          */
-        trustedIssuers: [
+        trustedIssuers?: [
           {
             /**
-             * Exact issuer URL expected in the ID-JAG iss claim.
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
              */
-            issuer: string;
+            issuer?: string;
             /**
-             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
              */
-            jwksUrl: string;
+            jwksUrl?: string;
             /**
              * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
              */
@@ -7829,13 +8425,13 @@ export declare interface McpOAuthInboundPolicyOptions {
           },
           ...{
             /**
-             * Exact issuer URL expected in the ID-JAG iss claim.
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
              */
-            issuer: string;
+            issuer?: string;
             /**
-             * JWKS URL used to verify ID-JAG signatures from this issuer.
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
              */
-            jwksUrl: string;
+            jwksUrl?: string;
             /**
              * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
              */
@@ -7857,106 +8453,196 @@ declare type McpOAuthRuntimeConfig = z.infer<
   typeof mcpOAuthRuntimeConfigSchema
 >;
 
-declare const mcpOAuthRuntimeConfigSchema: z.ZodObject<
-  {
-    oidc: z.ZodObject<
-      {
-        issuer: z.ZodURL;
-        jwksUrl: z.ZodURL;
-        audience: z.ZodOptional<z.ZodString>;
-      },
-      z.core.$strip
-    >;
-    browserLogin: z.ZodObject<
-      {
-        url: z.ZodURL;
-        tokenUrl: z.ZodOptional<z.ZodURL>;
-        clientId: z.ZodOptional<z.ZodString>;
-        clientSecret: z.ZodOptional<z.ZodString>;
-        scope: z.ZodDefault<z.ZodString>;
-        audience: z.ZodOptional<z.ZodString>;
-        pkce: z.ZodDefault<
-          z.ZodEnum<{
-            none: "none";
-            S256: "S256";
-          }>
-        >;
-        remoteTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-        stateTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-        sessionTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-      },
-      z.core.$strict
-    >;
-    gateway: z.ZodPipe<
-      z.ZodDefault<
-        z.ZodObject<
-          {
-            accessTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-            refreshTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-            cimdEnabled: z.ZodDefault<z.ZodBoolean>;
-          },
-          z.core.$strict
-        >
-      >,
-      z.ZodTransform<
+declare const mcpOAuthRuntimeConfigSchema: z.ZodPipe<
+  z.ZodObject<
+    {
+      oidc: z.ZodObject<
         {
-          accessTokenTtlSeconds: number;
-          refreshTokenTtlSeconds: number;
-          downstreamCimdEnabled: boolean;
+          issuer: z.ZodURL;
+          jwksUrl: z.ZodURL;
+          audience: z.ZodOptional<z.ZodString>;
         },
+        z.core.$strip
+      >;
+      browserLogin: z.ZodObject<
         {
-          accessTokenTtlSeconds: number;
-          refreshTokenTtlSeconds: number;
-          cimdEnabled: boolean;
-        }
-      >
-    >;
-    idJag: z.ZodDefault<
-      z.ZodOptional<
+          url: z.ZodURL;
+          tokenUrl: z.ZodOptional<z.ZodURL>;
+          clientId: z.ZodOptional<z.ZodString>;
+          clientSecret: z.ZodOptional<z.ZodString>;
+          scope: z.ZodDefault<z.ZodString>;
+          audience: z.ZodOptional<z.ZodString>;
+          pkce: z.ZodDefault<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+          remoteTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+          stateTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+          sessionTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        },
+        z.core.$strict
+      >;
+      gateway: z.ZodPipe<
         z.ZodDefault<
-          z.ZodDiscriminatedUnion<
-            [
-              z.ZodObject<
-                {
-                  enabled: z.ZodLiteral<false>;
-                },
-                z.core.$strict
-              >,
-              z.ZodObject<
-                {
-                  enabled: z.ZodLiteral<true>;
-                  trustedIssuers: z.ZodArray<
-                    z.ZodObject<
-                      {
-                        issuer: z.ZodURL;
-                        jwksUrl: z.ZodURL;
-                        expectedClientIds: z.ZodOptional<
-                          z.ZodArray<z.ZodString>
-                        >;
-                        subjectMapping: z.ZodDefault<
-                          z.ZodEnum<{
-                            iss_prefix: "iss_prefix";
-                            iss_tenant_prefix: "iss_tenant_prefix";
-                            sub_id_only: "sub_id_only";
-                          }>
-                        >;
-                      },
-                      z.core.$strict
-                    >
-                  >;
-                  authorizationDetailsTypesAllowed: z.ZodOptional<
-                    z.ZodArray<z.ZodString>
-                  >;
-                },
-                z.core.$strict
-              >,
-            ]
+          z.ZodObject<
+            {
+              accessTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+              refreshTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+              cimdEnabled: z.ZodDefault<z.ZodBoolean>;
+            },
+            z.core.$strict
           >
+        >,
+        z.ZodTransform<
+          {
+            accessTokenTtlSeconds: number;
+            refreshTokenTtlSeconds: number;
+            downstreamCimdEnabled: boolean;
+          },
+          {
+            accessTokenTtlSeconds: number;
+            refreshTokenTtlSeconds: number;
+            cimdEnabled: boolean;
+          }
         >
-      >
-    >;
-  },
-  z.core.$strict
+      >;
+      idJag: z.ZodDefault<
+        z.ZodOptional<
+          z.ZodDefault<
+            z.ZodDiscriminatedUnion<
+              [
+                z.ZodObject<
+                  {
+                    enabled: z.ZodLiteral<false>;
+                  },
+                  z.core.$strict
+                >,
+                z.ZodObject<
+                  {
+                    enabled: z.ZodLiteral<true>;
+                    trustedIssuers: z.ZodOptional<
+                      z.ZodArray<
+                        z.ZodObject<
+                          {
+                            issuer: z.ZodOptional<z.ZodURL>;
+                            jwksUrl: z.ZodOptional<z.ZodURL>;
+                            expectedClientIds: z.ZodOptional<
+                              z.ZodArray<z.ZodString>
+                            >;
+                            subjectMapping: z.ZodDefault<
+                              z.ZodEnum<{
+                                iss_prefix: "iss_prefix";
+                                iss_tenant_prefix: "iss_tenant_prefix";
+                                sub_id_only: "sub_id_only";
+                              }>
+                            >;
+                          },
+                          z.core.$strict
+                        >
+                      >
+                    >;
+                    authorizationDetailsTypesAllowed: z.ZodOptional<
+                      z.ZodArray<z.ZodString>
+                    >;
+                  },
+                  z.core.$strict
+                >,
+              ]
+            >
+          >
+        >
+      >;
+    },
+    z.core.$strict
+  >,
+  z.ZodTransform<
+    {
+      idJag:
+        | {
+            enabled: false;
+          }
+        | {
+            enabled: true;
+            trustedIssuers: {
+              issuer: string;
+              jwksUrl: string;
+              subjectMapping:
+                | "iss_prefix"
+                | "iss_tenant_prefix"
+                | "sub_id_only";
+              expectedClientIds?: string[] | undefined;
+            }[];
+            authorizationDetailsTypesAllowed?: string[] | undefined;
+          };
+      oidc: {
+        issuer: string;
+        jwksUrl: string;
+        audience?: string | undefined;
+      };
+      browserLogin: {
+        url: string;
+        scope: string;
+        pkce: "none" | "S256";
+        remoteTimeoutMs: number;
+        stateTtlSeconds: number;
+        sessionTtlSeconds: number;
+        tokenUrl?: string | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        audience?: string | undefined;
+      };
+      gateway: {
+        accessTokenTtlSeconds: number;
+        refreshTokenTtlSeconds: number;
+        downstreamCimdEnabled: boolean;
+      };
+    },
+    {
+      oidc: {
+        issuer: string;
+        jwksUrl: string;
+        audience?: string | undefined;
+      };
+      browserLogin: {
+        url: string;
+        scope: string;
+        pkce: "none" | "S256";
+        remoteTimeoutMs: number;
+        stateTtlSeconds: number;
+        sessionTtlSeconds: number;
+        tokenUrl?: string | undefined;
+        clientId?: string | undefined;
+        clientSecret?: string | undefined;
+        audience?: string | undefined;
+      };
+      gateway: {
+        accessTokenTtlSeconds: number;
+        refreshTokenTtlSeconds: number;
+        downstreamCimdEnabled: boolean;
+      };
+      idJag:
+        | {
+            enabled: false;
+          }
+        | {
+            enabled: true;
+            trustedIssuers?:
+              | {
+                  subjectMapping:
+                    | "iss_prefix"
+                    | "iss_tenant_prefix"
+                    | "sub_id_only";
+                  issuer?: string | undefined;
+                  jwksUrl?: string | undefined;
+                  expectedClientIds?: string[] | undefined;
+                }[]
+              | undefined;
+            authorizationDetailsTypesAllowed?: string[] | undefined;
+          };
+    }
+  >
 >;
 
 /**
@@ -7971,7 +8657,7 @@ declare const mcpOAuthRuntimeConfigSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<McpOktaOAuthInboundPolicyOptions> {
+export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<ValidatedOktaOAuthOptions> {
   #private;
   static readonly policyType = "mcp-okta-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8023,6 +8709,69 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -8037,6 +8786,44 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpOktaOAuthOptionsSchema: z.ZodObject<
+  {
+    oktaDomain: z.ZodString;
+    authorizationServerId: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to OneLogin.
@@ -8049,7 +8836,7 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<McpOneLoginOAuthInboundPolicyOptions> {
+export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<ValidatedOneLoginOAuthOptions> {
   #private;
   static readonly policyType = "mcp-onelogin-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8097,6 +8884,69 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -8107,6 +8957,37 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpOneLoginOAuthOptionsSchema: z.ZodObject<
+  {
+    oneLoginSubdomain: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to PingOne.
@@ -8120,7 +9001,7 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpPingOAuthInboundPolicy extends InboundPolicy<McpPingOAuthInboundPolicyOptions> {
+export declare class McpPingOAuthInboundPolicy extends InboundPolicy<ValidatedPingOAuthOptions> {
   #private;
   static readonly policyType = "mcp-ping-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8182,6 +9063,69 @@ export declare interface McpPingOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -8196,6 +9140,54 @@ export declare interface McpPingOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpPingOAuthOptionsSchema: z.ZodObject<
+  {
+    environmentId: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<
+      z.ZodEnum<{
+        "north-america": "north-america";
+        canada: "canada";
+        europe: "europe";
+        singapore: "singapore";
+        australia: "australia";
+        "asia-pacific": "asia-pacific";
+      }>
+    >;
+    customDomain: z.ZodOptional<z.ZodString>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 /**
  * An MCP Server handler for Zuplo
  * Only POST requests are supported for the HTTP streamable MCP transport.
@@ -8246,7 +9238,7 @@ declare interface McpTool {
  * @public
  * @product mcp-gateway
  */
-export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<McpWorkosOAuthInboundPolicyOptions> {
+export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<ValidatedWorkosOAuthOptions> {
   #private;
   static readonly policyType = "mcp-workos-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8290,6 +9282,69 @@ export declare interface McpWorkosOAuthInboundPolicyOptions {
      */
     cimdEnabled?: boolean;
   };
+  /**
+   * Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.
+   */
+  idJag?:
+    | {
+        /**
+         * Disable ID-JAG support.
+         */
+        enabled: false;
+      }
+    | {
+        /**
+         * Enable ID-JAG support.
+         */
+        enabled: true;
+        /**
+         * Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.
+         *
+         * @minItems 1
+         */
+        trustedIssuers?: [
+          {
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          },
+          ...{
+            /**
+             * Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP.
+             */
+            issuer?: string;
+            /**
+             * JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP.
+             */
+            jwksUrl?: string;
+            /**
+             * Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client.
+             */
+            expectedClientIds?: string[];
+            /**
+             * How the ID-JAG subject is mapped into the gateway subject ID.
+             */
+            subjectMapping?: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+          }[],
+        ];
+        /**
+         * Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs.
+         */
+        authorizationDetailsTypesAllowed?: string[];
+      };
   /**
    * Optional overrides for the derived browser-login settings.
    */
@@ -8304,6 +9359,42 @@ export declare interface McpWorkosOAuthInboundPolicyOptions {
   };
 }
 
+declare const mcpWorkosOAuthOptionsSchema: z.ZodObject<
+  {
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scope: z.ZodOptional<z.ZodString>;
+    gateway: z.ZodOptional<
+      z.ZodObject<
+        {
+          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
+        },
+        z.core.$strict
+      >
+    >;
+    idJag: z.ZodOptional<z.ZodUnknown>;
+    browserLoginOverrides: z.ZodOptional<
+      z.ZodObject<
+        {
+          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
+          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
+          pkce: z.ZodOptional<
+            z.ZodEnum<{
+              none: "none";
+              S256: "S256";
+            }>
+          >;
+        },
+        z.core.$strict
+      >
+    >;
+  },
+  z.core.$strict
+>;
+
 declare interface MemoryCacheOptions {
   maxSize: number;
 }
@@ -8656,6 +9747,16 @@ export declare class MonetizationInboundPolicy extends InboundPolicy<Monetizatio
  * @public
  */
 export declare interface MonetizationInboundPolicyOptions {
+  /**
+   * The meters to be used by the policy against the subscription quota.
+   */
+  meters?: {
+    [k: string]: number;
+  };
+  /**
+   * A list of entitlement keys that the subscription must have access to (hasAccess=true) for the request to be allowed. If any required entitlement is missing or does not have access, the request will be rejected with a 403 Forbidden.
+   */
+  requiredEntitlements?: string[];
   /**
    * The name of the header with the key.
    */
@@ -8668,24 +9769,10 @@ export declare interface MonetizationInboundPolicyOptions {
    * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
    */
   cacheTtlSeconds?: number;
-  /**
-   * The meters to be used by the policy against the subscription quota.
-   */
-  meters?: {
-    /**
-     * This interface was referenced by `undefined`'s JSON-Schema definition
-     * via the `patternProperty` "^.*$".
-     */
-    [k: string]: number;
-  };
   /**
    * A list of successful status codes and ranges "200-299, 304" that should trigger a metering call.
    */
   meterOnStatusCodes?: string | number[];
-  /**
-   * A list of entitlement keys that the subscription must have access to (hasAccess=true) for the request to be allowed. If any required entitlement is missing or does not have access, the request will be rejected with a 403 Forbidden.
-   */
-  requiredEntitlements?: string[];
 }
 
 /**
@@ -8780,14 +9867,14 @@ export declare type MTLSAuthInboundPolicyOptions = (
       [k: string]: unknown;
     }
 ) & {
-  /**
-   * Allows requests to continue even when mTLS verification fails, no client certificate is presented, or the certificate metadata cannot be parsed. Defaults to false.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Fully qualified issuer distinguished name to require on the client certificate. The policy rejects certificates whose parsed issuer DN does not match this string exactly. Required unless `allowUnauthenticatedRequests` is `true`. The expected format matches the parsed metadata issuer, e.g. "CN=example-ca, O=Example, C=US".
    */
   certIssuerDN?: string;
+  /**
+   * Allows requests to continue even when mTLS verification fails, no client certificate is presented, or the certificate metadata cannot be parsed. Defaults to false.
+   */
+  allowUnauthenticatedRequests?: boolean;
 };
 
 /**
@@ -8976,10 +10063,6 @@ export declare interface OktaFGAAuthZInboundPolicyOptions {
    * The ID of the authorization model.
    */
   authorizationModelId: string;
-  /**
-   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
-   */
-  allowUnauthorizedRequests?: boolean;
   credentials: {
     /**
      * The client ID.
@@ -8991,6 +10074,10 @@ export declare interface OktaFGAAuthZInboundPolicyOptions {
     clientSecret: string;
     [k: string]: unknown;
   };
+  /**
+   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
+   */
+  allowUnauthorizedRequests?: boolean;
 }
 
 /**
@@ -9010,12 +10097,8 @@ export declare const OktaJwtInboundPolicy: InboundPolicyHandler<OktaJwtInboundPo
 /**
  * The options for this policy.
  * @public
- */
-export declare interface OktaJwtInboundPolicyOptions {
-  /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
+ */
+export declare interface OktaJwtInboundPolicyOptions {
   /**
    * Your Okta authorization server's issuer URL. For example, `https://dev-12345.okta.com/oauth2/abc`.
    */
@@ -9024,6 +10107,10 @@ export declare interface OktaJwtInboundPolicyOptions {
    * The Okta audience of your API, for example `api://my-api`.
    */
   audience?: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -9715,15 +10802,15 @@ export declare interface OpenFGAAuthZInboundPolicyOptions {
    * The ID of the authorization model.
    */
   authorizationModelId: string;
-  /**
-   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
-   */
-  allowUnauthorizedRequests?: boolean;
   credentials:
     | UnauthenticatedCredentialConfig
     | APITokenCredentialConfig
     | HeaderCredentialsConfig
     | ClientCredentialsConfig;
+  /**
+   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
+   */
+  allowUnauthorizedRequests?: boolean;
 }
 
 declare interface OpenFGACheck {
@@ -9773,10 +10860,6 @@ declare interface OpenIdJwtInboundPolicyInternalOptions extends Omit<
  * @public
  */
 export declare interface OpenIdJwtInboundPolicyOptions {
-  /**
-   * The name of the header with the key.
-   */
-  authHeader?: string;
   /**
    * The expected issuer claim in the JWT token.
    */
@@ -9793,6 +10876,10 @@ export declare interface OpenIdJwtInboundPolicyOptions {
    * The key used to verify the signature of the JWT token (either this or `jwkUrl` must be set).
    */
   secret?: string;
+  /**
+   * The name of the header with the key.
+   */
+  authHeader?: string;
   /**
    * indicates whether the request should continue if authentication fails. Defaults is `false` which means unauthenticated users will automatically receive a 401 response.
    */
@@ -9901,10 +10988,6 @@ export declare class OpenMeterInboundPolicy extends InboundPolicy<OpenMeterInbou
  * @public
  */
 export declare interface OpenMeterInboundPolicyOptions {
-  /**
-   * The URL of the OpenMeter API endpoint.
-   */
-  apiUrl?: string;
   /**
    * The API key to use when sending metering calls to OpenMeter.
    */
@@ -9913,6 +10996,14 @@ export declare interface OpenMeterInboundPolicyOptions {
    * A single meter configuration or an array of meter configurations for OpenMeter.
    */
   meter?: Meter | Meter[];
+  /**
+   * A list of entitlements (feature keys) required in order for the call to be allowed.
+   */
+  requiredEntitlements?: string[];
+  /**
+   * The URL of the OpenMeter API endpoint.
+   */
+  apiUrl?: string;
   /**
    * A list of successful status codes and ranges "200-299, 304" that should trigger a metering event.
    */
@@ -9921,10 +11012,6 @@ export declare interface OpenMeterInboundPolicyOptions {
    * The event's source (e.g. the service name).
    */
   eventSource?: string;
-  /**
-   * A list of entitlements (feature keys) required in order for the call to be allowed.
-   */
-  requiredEntitlements?: string[];
   /**
    * The path to the property on `request.user` that contains the subject used for meters and entitlements. For example `.data.accountId` would read the `request.user.data.accountId` property.
    */
@@ -10350,14 +11437,14 @@ export declare interface PromptInjectionDetectionOutboundPolicyOptions {
    * Model to use for classification.
    */
   model?: string;
-  /**
-   * Base URL for the OpenAI compatible API.
-   */
-  baseUrl?: string;
   /**
    * Whether to block traffic if the classifier fails. When disabled, allows traffic flow if the classifier or inference API is unavailable.
    */
   strict?: boolean;
+  /**
+   * Base URL for the OpenAI compatible API.
+   */
+  baseUrl?: string;
 }
 
 /**
@@ -10380,17 +11467,17 @@ export declare const PropelAuthJwtInboundPolicy: InboundPolicyHandler<PropelAuth
  */
 export declare interface PropelAuthJwtInboundPolicyOptions {
   /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
-  /**
-   * Your PropelAuth authUrl. For example, `https://6587563.propelauthtest.com`.
+   * Your PropelAuth authUrl. For example, `https://12345678.propelauthtest.com`.
    */
   authUrl: string;
   /**
    * Your public (verifier) key that is used to verify access tokens. This key has a value that begins with '-----BEGIN PUBLIC KEY-----'. Make sure to remove all line breaks from the key before saving the variable.
    */
   verifierKey: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -10486,16 +11573,16 @@ export declare interface QuotaInboundPolicyOptions {
    * The quota by.
    */
   quotaBy: "user" | "function";
-  /**
-   * How the policy determines the anchor date for ongoing quota cycles - defaults to `first-api-call` which uses the first API call for this key.
-   */
-  quotaAnchorMode?: "first-api-call" | "function";
   /**
    * The allowances for the quota.
    */
   allowances?: {
     [k: string]: number;
   };
+  /**
+   * How the policy determines the anchor date for ongoing quota cycles - defaults to `first-api-call` which uses the first API call for this key.
+   */
+  quotaAnchorMode?: "first-api-call" | "function";
   /**
    * A list of successful status codes and ranges "200-299, 304" that should trigger a quota increment.
    */
@@ -10720,14 +11807,14 @@ declare interface ReadmeMeteringInboundPolicyOptions {
    * The API key to use when sending metrics calls to Readme.
    */
   apiKey: string;
-  /**
-   * This is the path to the property on `request.user` that contains the label you want to use. For example `.data.accountNumber` would read the `request.user.data.accountNumber` property.
-   */
-  userLabelPropertyPath?: string;
   /**
    * This is the path to the property on `request.user` that contains the e-mail of the user. For example `.data.email` would read the `request.user.data.email` property.
    */
   userEmailPropertyPath?: string;
+  /**
+   * This is the path to the property on `request.user` that contains the label you want to use. For example `.data.accountNumber` would read the `request.user.data.accountNumber` property.
+   */
+  userLabelPropertyPath?: string;
   /**
    * Whether the data should be ingested as 'development' mode or not. Defaults to true for working-copy and false for all other environments.
    */
@@ -11190,14 +12277,14 @@ export declare const RequestValidationInboundPolicy: InboundPolicyHandler<Reques
  * @public
  */
 export declare interface RequestValidationInboundPolicyOptions {
-  /**
-   * The log level to use when logging validation errors.
-   */
-  logLevel?: "error" | "warn" | "info" | "debug";
   validateBody?: ValidationOptions;
   validateQueryParameters?: ValidationOptions1;
   validatePathParameters?: ValidationOptions2;
   validateHeaders?: ValidationOptions3;
+  /**
+   * The log level to use when logging validation errors.
+   */
+  logLevel?: "error" | "warn" | "info" | "debug";
   /**
    * Whether to include the request in the logs.
    */
@@ -12411,6 +13498,10 @@ export declare type SemanticCacheInboundPolicyOptions = {
    * Determines how the cache key is generated. Use 'function' for custom logic or 'propertyPath' to extract from JSON body.
    */
   cacheBy: "function" | "propertyPath";
+  /**
+   * The path to the property in the request body (JSON) to use as cache key. For example '.userId' would read the 'userId' property from the request body. Only works with cacheBy=propertyPath.
+   */
+  cacheByPropertyPath?: string;
   /**
    * The function that returns dynamic cache key data. Used only with `cacheBy=function`.
    */
@@ -12424,10 +13515,6 @@ export declare type SemanticCacheInboundPolicyOptions = {
      */
     module: string;
   };
-  /**
-   * The path to the property in the request body (JSON) to use as cache key. For example '.userId' would read the 'userId' property from the request body. Only works with cacheBy=propertyPath.
-   */
-  cacheByPropertyPath?: string;
   /**
    * Response status codes to be cached.
    */
@@ -12662,14 +13749,14 @@ export declare const SetUpstreamApiKeyInboundPolicy: InboundPolicyHandler<SetUps
  * @public
  */
 export declare interface SetUpstreamApiKeyInboundPolicyOptions {
-  /**
-   * The name of the header to set on the request. Defaults to `Authorization`.
-   */
-  header?: string;
   /**
    * The value of the header. Most commonly an environment variable reference such as `Bearer $env(UPSTREAM_API_KEY)` so the secret is sourced from your environment.
    */
   value: string;
+  /**
+   * The name of the header to set on the request. Defaults to `Authorization`.
+   */
+  header?: string;
   /**
    * Overwrite the value if the header is already present in the request.
    */
@@ -12911,7 +13998,7 @@ export declare interface StripeWebhookVerificationInboundPolicyOptions {
    */
   signingSecret: string;
   /**
-   * The allowed clock skew in seconds between the time the webhook signature was crated and the current time.
+   * The allowed clock skew in seconds between the time the webhook signature was created and the current time.
    */
   tolerance?: number;
 }
@@ -12960,16 +14047,16 @@ export declare interface SupabaseJwtInboundPolicyOptions {
    * The key used to verify the signature of the JWT token.
    */
   secret: string;
-  /**
-   * Indicates whether the request should continue if authentication fails. Default is `false` which means unauthenticated users will automatically receive a 401 response.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Any claims that must be present for authentication to succeed - multiple valid values can be specified for each claim.
    */
   requiredClaims?: {
     [k: string]: string[];
   };
+  /**
+   * Indicates whether the request should continue if authentication fails. Default is `false` which means unauthenticated users will automatically receive a 401 response.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -13114,6 +14201,157 @@ declare interface UnauthenticatedCredentialConfig {
   method: "none";
 }
 
+/**
+ * Resolves AWS credentials with STS AssumeRoleWithWebIdentity using Zuplo's
+ * ambient OIDC identity — no AWS keys are stored anywhere. The role's trust
+ * policy must trust the Zuplo OIDC identity provider. Resolved credentials are
+ * registered on the request context for the AWS Lambda handler and custom code
+ * to sign upstream requests with {@link AwsClient.fromContext}. This policy does
+ * not itself sign or forward the request.
+ *
+ * @title Upstream AWS Federated Auth
+ * @product api-gateway
+ * @beta
+ * @enterprise
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare class UpstreamAwsFederatedAuthInboundPolicy extends InboundPolicy<UpstreamAwsFederatedAuthInboundPolicyOptions> {
+  #private;
+  static readonly policyType = "upstream-aws-federated-auth";
+  constructor(
+    options: UpstreamAwsFederatedAuthInboundPolicyOptions,
+    policyName: string
+  );
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * The options for this policy.
+ * @public
+ */
+export declare interface UpstreamAwsFederatedAuthInboundPolicyOptions {
+  /**
+   * The IAM role to assume with STS AssumeRoleWithWebIdentity. The role's trust policy must trust the Zuplo OIDC identity provider.
+   */
+  roleArn: string;
+  /**
+   * The AWS region used for the STS endpoint and as the default signing region for consumers of the resolved credentials.
+   */
+  region: string;
+  /**
+   * The audience ('aud' claim) of the Zuplo-issued OIDC token. Must match a client ID configured on the IAM OIDC identity provider.
+   */
+  audience?: string;
+  /**
+   * The STS role session name recorded in AWS CloudTrail. Must match the pattern [\w+=,.@-]{2,64}.
+   */
+  roleSessionName?: string;
+  /**
+   * The lifetime in seconds of the temporary credentials requested from STS (900-43200). The assumed role's maximum session duration may further limit this value.
+   */
+  durationSeconds?: number;
+  /**
+   * Overrides the STS endpoint URL. Only needed for non-standard partitions such as AWS GovCloud or AWS China.
+   */
+  stsEndpoint?: string;
+  /**
+   * The number of times to retry fetching temporary credentials in the event of a failure.
+   */
+  tokenRetries?: number;
+  /**
+   * The number of seconds before credential expiration at which cached credentials are discarded and refreshed.
+   */
+  expirationOffsetSeconds?: number;
+}
+
+/**
+ * Resolves AWS credentials from static access keys (optionally exchanged for an
+ * IAM role's temporary credentials via STS AssumeRole) and registers them on
+ * the request context. The AWS Lambda handler and custom code read them with
+ * {@link AwsClient.fromContext} to sign upstream requests. This policy does not
+ * itself sign or forward the request.
+ *
+ * @title Upstream AWS Service Auth
+ * @product api-gateway
+ * @beta
+ * @enterprise
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare class UpstreamAwsServiceAuthInboundPolicy extends InboundPolicy<UpstreamAwsServiceAuthInboundPolicyOptions> {
+  #private;
+  static readonly policyType = "upstream-aws-service-auth";
+  constructor(
+    options: UpstreamAwsServiceAuthInboundPolicyOptions,
+    policyName: string
+  );
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * The options for this policy.
+ * @public
+ */
+export declare interface UpstreamAwsServiceAuthInboundPolicyOptions {
+  /**
+   * The AWS access key ID. Store the value in an environment variable rather than in source.
+   */
+  accessKeyId: string;
+  /**
+   * The AWS secret access key. Always store this in an environment variable.
+   */
+  secretAccessKey: string;
+  /**
+   * The AWS region. Used for the STS endpoint when 'roleArn' is set, and as the default signing region for consumers of the resolved credentials.
+   */
+  region: string;
+  /**
+   * The AWS session token, required only when the configured access key pair is itself a temporary credential.
+   */
+  sessionToken?: string;
+  /**
+   * An IAM role to assume using STS AssumeRole with the configured access keys. When set, the resolved credentials are the role's temporary credentials instead of the static keys.
+   */
+  roleArn?: string;
+  /**
+   * The external ID to pass to STS AssumeRole when the role's trust policy requires one.
+   */
+  externalId?: string;
+  /**
+   * The STS role session name recorded in AWS CloudTrail. Must match the pattern [\w+=,.@-]{2,64}.
+   */
+  roleSessionName?: string;
+  /**
+   * The lifetime in seconds of the temporary credentials requested from STS (900-43200). The assumed role's maximum session duration may further limit this value.
+   */
+  durationSeconds?: number;
+  /**
+   * Overrides the STS endpoint URL. Only needed for non-standard partitions such as AWS GovCloud or AWS China.
+   */
+  stsEndpoint?: string;
+  /**
+   * The number of times to retry fetching temporary credentials in the event of a failure.
+   */
+  tokenRetries?: number;
+  /**
+   * The number of seconds before credential expiration at which cached credentials are discarded and refreshed.
+   */
+  expirationOffsetSeconds?: number;
+}
+
 /**
  * Uses Azure Active Directory to add an Authorization header to the request
  * in order to authenticate requests using Azure identity.
@@ -13148,7 +14386,7 @@ export declare interface UpstreamAzureAdServiceAuthInboundPolicyOptions {
    */
   activeDirectoryClientSecret: string;
   /**
-   * The number of times to retry fetching the token in the event of a failure..
+   * The number of times to retry fetching the token in the event of a failure.
    */
   tokenRetries?: number;
   /**
@@ -13223,15 +14461,15 @@ export declare interface UpstreamFirebaseUserAuthInboundPolicyOptions {
    * The property on the incoming request.user object to retrieve the value of the userId.
    */
   userIdPropertyPath?: string;
-  /**
-   * Additional claims to include in the custom token's payload.
-   */
-  developerClaims?: Record<string, string | number | boolean | null>;
   /**
    * The Firebase Web API Key (found in project settings)
    * @see {@link https://firebase.google.com/docs/projects/api-keys|Firebase API Keys}.
    */
   webApiKey: string;
+  /**
+   * Additional claims to include in the custom token's payload.
+   */
+  developerClaims?: Record<string, string | number | boolean | null>;
   /**
    * The number of times to retry fetching the token in the event of a failure.
    */
@@ -13365,7 +14603,7 @@ export declare const UpstreamGcpServiceAuthInboundPolicy: InboundPolicyHandler<U
  */
 export declare interface UpstreamGcpServiceAuthInboundPolicyOptions {
   /**
-   * The audience for the service to be called. This is typically the URL of your service endpoint like 'https://my-service-a2ev-uc.a.run.app'. If calling a Google API, leave this empty.
+   * The audience for the service to be called. This is typically the URL of your service endpoint like 'https://my-backend-api-a1b2c3d4e5-uc.a.run.app'. If calling a Google API, leave this empty.
    */
   audience?: string;
   /**
@@ -13441,6 +14679,20 @@ export declare interface UpstreamZuploJwtAuthInboundPolicyOptions {
    * The audience claim for the JWT.
    */
   audience?: string;
+  /**
+   * JWT expiration time. Can be a number (seconds) or a string with units (e.g., '5m' for 5 minutes, '1h' for 1 hour, '7d' for 7 days). Defaults to 300 seconds (5 minutes).
+   */
+  expiresIn?: number | string;
+  /**
+   * The subject ('sub') claim for the minted JWT. Identifies the acting subject of the token (typically the gateway itself).
+   */
+  subject?: string;
+  /**
+   * Maps claims in the minted JWT to values from the authenticated user (request.user). Each key is the claim name to set; each value is a light JSON-path selector into request.user using dot or bracket notation (e.g. 'sub', 'data.role', or 'data["https://example.com/claim"]' for keys containing dots or slashes). When set, the policy requires an authenticated user and returns 401 if request.user is absent — it never mints a token with missing identity.
+   */
+  claimsFromUser?: {
+    [k: string]: string;
+  };
   /**
    * The header name where the JWT will be attached. Defaults to 'Authorization'.
    */
@@ -13455,10 +14707,6 @@ export declare interface UpstreamZuploJwtAuthInboundPolicyOptions {
   additionalClaims?: {
     [k: string]: unknown;
   };
-  /**
-   * JWT expiration time. Can be a number (seconds) or a string with units (e.g., '5m' for 5 minutes, '1h' for 1 hour, '7d' for 7 days). Defaults to 300 seconds (5 minutes).
-   */
-  expiresIn?: number | string;
 }
 
 declare interface UrlConfig {
@@ -13621,8 +14869,48 @@ declare type ValidatedAuth0OAuthOptions = z.infer<
   typeof mcpAuth0OAuthOptionsSchema
 >;
 
+declare type ValidatedClerkOAuthOptions = z.infer<
+  typeof mcpClerkOAuthOptionsSchema
+>;
+
+declare type ValidatedCognitoOAuthOptions = z.infer<
+  typeof mcpCognitoOAuthOptionsSchema
+>;
+
+declare type ValidatedEntraOAuthOptions = z.infer<
+  typeof mcpEntraOAuthOptionsSchema
+>;
+
+declare type ValidatedGoogleOAuthOptions = z.infer<
+  typeof mcpGoogleOAuthOptionsSchema
+>;
+
+declare type ValidatedKeycloakOAuthOptions = z.infer<
+  typeof mcpKeycloakOAuthOptionsSchema
+>;
+
+declare type ValidatedLogtoOAuthOptions = z.infer<
+  typeof mcpLogtoOAuthOptionsSchema
+>;
+
+declare type ValidatedOktaOAuthOptions = z.infer<
+  typeof mcpOktaOAuthOptionsSchema
+>;
+
+declare type ValidatedOneLoginOAuthOptions = z.infer<
+  typeof mcpOneLoginOAuthOptionsSchema
+>;
+
 declare type ValidatedOptions = z.infer<typeof requireUserClaimsOptionsSchema>;
 
+declare type ValidatedPingOAuthOptions = z.infer<
+  typeof mcpPingOAuthOptionsSchema
+>;
+
+declare type ValidatedWorkosOAuthOptions = z.infer<
+  typeof mcpWorkosOAuthOptionsSchema
+>;
+
 /**
  * Validates the body of an incoming request based on a JSON schema.
  *
@@ -13950,6 +15238,10 @@ export declare interface XmlToJsonPolicyOptions {
    * Ignore tag attributes.
    */
   ignoreAttributes?: boolean;
+  /**
+   * Remove surrounding whitespace from tag or attribute value.
+   */
+  trimValues?: boolean;
   /**
    * At particular point, if you don't want to parse a tag and it's nested tags then you can set their path in stopNodes. You can also set tags which should not be processed irrespective of their path using * as the wildcard.
    */
@@ -13962,10 +15254,6 @@ export declare interface XmlToJsonPolicyOptions {
    * Text value of a tag is parsed to #text property by default.
    */
   textNodeName?: string;
-  /**
-   * Remove surrounding whitespace from tag or attribute value.
-   */
-  trimValues?: boolean;
   /**
    * A list of status codes and ranges "200-299, 304" that should the XML parser should run on. If not set, the parser will run on all status codes.
    */