@zuplo/runtime 6.73.28 → 6.73.30

package/out/types/index.d.ts

@@ -5,7 +5,6 @@ import { InboundPolicyHandler as InboundPolicyHandler_2 } from "../../policies.j
 import { KeyLike } from "jose";
 import { RequestGeneric as RequestGeneric_2 } from "../../request.js";
 import type { ValidateFunction } from "ajv";
-import { z } from "zod/v4";
 
 /**
  * The request/response **schema dialect** a policy is dealing with — named after
@@ -357,10 +356,10 @@ export declare function aiGatewayHandler(
 ): Promise<Response>;
 
 /**
- * Routes AI requests using the model selection stored in the request context.
- * Attach the `ai-gateway-model-filtering-v2-inbound` policy before this handler
- * runs, or call `AIGatewayModelRouting.set(context, routing)` from a custom
- * inbound policy.
+ * Routes AI requests using a model selection stored in request context by a
+ * filtering or custom-routing policy. When no policy selected routing, the
+ * handler uses the request's `providerName/model` as the route target. Requests
+ * without preselected routing must include a qualified model.
  *
  * @beta
  * @param request - The incoming AI Gateway request.
@@ -374,9 +373,6 @@ export declare function aiGatewayHandler(
  *   "handler": {
  *     "export": "aiGatewayHandlerV2",
  *     "module": "$import(@zuplo/runtime)"
- *   },
- *   "policies": {
- *     "inbound": ["ai-gateway-model-filtering-v2-inbound"]
  *   }
  * }
  * ```
@@ -475,7 +471,6 @@ export declare class AIGatewayMeteringInboundPolicy extends InboundPolicy<AIGate
     increments: AIGatewayMeterIncrements,
     context: ZuploContext
   ): Promise<void>;
-  private static incrementMetersInternal;
   private checkWarnings;
   private checkQuotaWarning;
   private createHierarchicalQuotaExceededResponse;
@@ -492,6 +487,131 @@ export declare interface AIGatewayMeteringInboundPolicyOptions {
   throwOnFailure?: boolean;
 }
 
+/**
+ * Meters AI Gateway v2 usage and enforces options-driven usage limits.
+ *
+ * The authentication policy must run before this policy so the app
+ * configuration id is available for meter storage and analytics.
+ *
+ * @title AI Gateway Metering (v2)
+ * @beta
+ * @product ai-gateway
+ * @requiresAI
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns The request, or a 429 response when a limit is exceeded
+ */
+export declare class AIGatewayMeteringV2InboundPolicy extends InboundPolicy<AIGatewayMeteringV2InboundPolicyOptions> {
+  #private;
+  static readonly policyType = "ai-gateway-metering-v2";
+  constructor(
+    options: AIGatewayMeteringV2InboundPolicyOptions,
+    policyName: string
+  );
+  /** Set the meter increments accumulated for this request. */
+  static setIncrements(
+    context: ZuploContext,
+    increments: AIGatewayMeterIncrements
+  ): void;
+  /** Read the meter increments accumulated for this request. */
+  static getIncrements(context: ZuploContext): AIGatewayMeterIncrements;
+  /** Set the quota-fallback marker for this request. */
+  static setQuotaFallback(
+    context: ZuploContext,
+    quotaFallback: QuotaFallbackModels
+  ): void;
+  /** Read the quota-fallback marker for this request. */
+  static getQuotaFallback(
+    context: ZuploContext
+  ): QuotaFallbackModels | undefined;
+  /**
+   * Compose request-scoped limit overrides with any limits already set.
+   *
+   * Limits intentionally merge at each meter, period, and setting leaf because
+   * independent policies may tighten one path without restating sibling limits.
+   * Defined values from the newest call win; undefined values never erase an
+   * earlier value.
+   *
+   * @param context - The current request context
+   * @param limits - Limits or partial leaf overrides to compose
+   */
+  static setLimits(
+    context: ZuploContext,
+    limits: AIGatewayMeteringV2LimitOverrides
+  ): void;
+  /** Read request-scoped limit overrides. */
+  static getLimits(
+    context: ZuploContext
+  ): AIGatewayMeteringV2LimitOverrides | undefined;
+  /** Increment meters directly, for example after a streaming response. */
+  static incrementMeters(
+    configurationId: string,
+    increments: AIGatewayMeterIncrements,
+    context: ZuploContext
+  ): Promise<void>;
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+  private resolveConfiguration;
+  private fetchCurrentMeters;
+  private checkWarnings;
+  private hasWarning;
+  private findViolation;
+  private requestCapability;
+  private createQuotaExceededResponse;
+}
+
+/**
+ * Options for metering AI Gateway v2 usage and enforcing request-time limits.
+ * @public
+ */
+export declare interface AIGatewayMeteringV2InboundPolicyOptions {
+  /**
+   * Throw when the metering service is unavailable instead of failing open.
+   */
+  throwOnFailure?: boolean;
+  /**
+   * Usage limits grouped by meter.
+   */
+  limits?: {
+    costs?: QuotaLimit;
+    tokens?: QuotaLimit;
+    requests?: QuotaLimit;
+  };
+}
+
+/**
+ * Request-scoped usage-limit overrides accepted by
+ * `AIGatewayMeteringV2InboundPolicy.setLimits`.
+ */
+export declare interface AIGatewayMeteringV2LimitOverrides {
+  costs?: AIGatewayMeteringV2MeterLimitOverrides;
+  tokens?: AIGatewayMeteringV2MeterLimitOverrides;
+  requests?: AIGatewayMeteringV2MeterLimitOverrides;
+}
+
+/** Daily and monthly overrides for one usage meter. */
+declare interface AIGatewayMeteringV2MeterLimitOverrides {
+  daily?: AIGatewayMeteringV2PeriodLimitOverride;
+  monthly?: AIGatewayMeteringV2PeriodLimitOverride;
+}
+
+/** Settings that a policy can override for one usage-limit period. */
+declare interface AIGatewayMeteringV2PeriodLimitOverride {
+  enabled?: boolean;
+  limit?: number;
+  warning?: AIGatewayMeteringV2WarningLimitOverride;
+}
+
+/** Warning settings that a policy can override for one usage-limit period. */
+declare interface AIGatewayMeteringV2WarningLimitOverride {
+  enabled?: boolean;
+  threshold?: number;
+}
+
 /**
  * Matches AI Gateway requests against curated allow lists or open block lists,
  * then stores the winning model reference for the route handler.
@@ -573,8 +693,10 @@ export declare interface AIGatewayModelInfo {
  *
  * The built-in model-routing policy matches the request against its allowList
  * of {@link AIGatewayRouteTarget} items, then `set()`s the winning target.
- * Custom policies can call `set()` directly instead. Provider API keys are
- * resolved internally and are never returned by `get()`.
+ * Custom policies can call `set()` directly instead. If neither kind of policy
+ * selects routing, `aiGatewayHandlerV2` calls `set()` with the request's
+ * `providerName/model`. Provider API keys are resolved internally and are never
+ * returned by `get()`.
  *
  * @public
  * @example
@@ -6731,6 +6853,27 @@ export declare interface HydrolixRequestLoggerPluginOptions<T> {
   batchPeriodSeconds?: number;
 }
 
+/**
+ * Hand-written mirror of {@link idJagConfigSchema}'s parsed output. Keeping
+ * the type hand-written keeps zod out of the public policy class signatures
+ * (this type is part of {@link McpOAuthRuntimeConfig}); the assertion below
+ * fails to compile on drift.
+ */
+declare type IdJagRuntimeConfig =
+  | {
+      enabled: false;
+    }
+  | {
+      enabled: true;
+      trustedIssuers: {
+        issuer: string;
+        jwksUrl: string;
+        expectedClientIds?: string[];
+        subjectMapping: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+      }[];
+      authorizationDetailsTypesAllowed?: string[];
+    };
+
 /**
  * Image generation tool
  */
@@ -7600,7 +7743,7 @@ declare type MaxConversationLength = number;
  * @title MCP Auth0 OAuth
  * @product mcp-gateway
  */
-export declare class McpAuth0OAuthInboundPolicy extends InboundPolicy<ValidatedAuth0OAuthOptions> {
+export declare class McpAuth0OAuthInboundPolicy extends InboundPolicy<McpAuth0OAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-auth0-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7729,44 +7872,6 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
-  {
-    auth0Domain: z.ZodString;
-    audience: z.ZodOptional<z.ZodString>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Clerk.
@@ -7779,7 +7884,7 @@ declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<ValidatedClerkOAuthOptions> {
+export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<McpClerkOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-clerk-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -7900,37 +8005,6 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpClerkOAuthOptionsSchema: z.ZodObject<
-  {
-    frontendApiUrl: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Amazon Cognito.
@@ -7944,7 +8018,7 @@ declare const mcpClerkOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<ValidatedCognitoOAuthOptions> {
+export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<McpCognitoOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-cognito-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8077,45 +8151,6 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpCognitoOAuthOptionsSchema: z.ZodObject<
-  {
-    awsRegion: z.ZodString;
-    userPoolId: z.ZodString;
-    userPoolDomain: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Microsoft Entra ID.
@@ -8128,7 +8163,7 @@ declare const mcpCognitoOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<ValidatedEntraOAuthOptions> {
+export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<McpEntraOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-entra-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8253,43 +8288,6 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpEntraOAuthOptionsSchema: z.ZodObject<
-  {
-    tenantId: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /* Excluded from this release type: McpGatewayOAuthProtectedResourcePlugin */
 
 /**
@@ -8305,7 +8303,7 @@ declare const mcpEntraOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<ValidatedGoogleOAuthOptions> {
+export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<McpGoogleOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-google-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8426,42 +8424,6 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpGoogleOAuthOptionsSchema: z.ZodObject<
-  {
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Keycloak.
@@ -8475,7 +8437,7 @@ declare const mcpGoogleOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<ValidatedKeycloakOAuthOptions> {
+export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<McpKeycloakOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-keycloak-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8604,44 +8566,6 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpKeycloakOAuthOptionsSchema: z.ZodObject<
-  {
-    keycloakBaseUrl: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    realm: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Logto.
@@ -8654,7 +8578,7 @@ declare const mcpKeycloakOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<ValidatedLogtoOAuthOptions> {
+export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<McpLogtoOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-logto-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -8779,43 +8703,6 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpLogtoOAuthOptionsSchema: z.ZodObject<
-  {
-    logtoEndpoint: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token.
  *
@@ -8992,201 +8879,37 @@ export declare interface McpOAuthInboundPolicyOptions {
       };
 }
 
-declare type McpOAuthRuntimeConfig = z.infer<
-  typeof mcpOAuthRuntimeConfigSchema
->;
-
-declare const mcpOAuthRuntimeConfigSchema: z.ZodPipe<
-  z.ZodObject<
-    {
-      oidc: z.ZodObject<
-        {
-          issuer: z.ZodURL;
-          jwksUrl: z.ZodURL;
-          audience: z.ZodOptional<z.ZodString>;
-        },
-        z.core.$strip
-      >;
-      browserLogin: z.ZodObject<
-        {
-          url: z.ZodURL;
-          tokenUrl: z.ZodOptional<z.ZodURL>;
-          clientId: z.ZodOptional<z.ZodString>;
-          clientSecret: z.ZodOptional<z.ZodString>;
-          scope: z.ZodDefault<z.ZodString>;
-          audience: z.ZodOptional<z.ZodString>;
-          pkce: z.ZodDefault<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-          remoteTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-          stateTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-          sessionTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-        },
-        z.core.$strict
-      >;
-      gateway: z.ZodPipe<
-        z.ZodDefault<
-          z.ZodObject<
-            {
-              accessTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-              refreshTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-              cimdEnabled: z.ZodDefault<z.ZodBoolean>;
-            },
-            z.core.$strict
-          >
-        >,
-        z.ZodTransform<
-          {
-            accessTokenTtlSeconds: number;
-            refreshTokenTtlSeconds: number;
-            downstreamCimdEnabled: boolean;
-          },
-          {
-            accessTokenTtlSeconds: number;
-            refreshTokenTtlSeconds: number;
-            cimdEnabled: boolean;
-          }
-        >
-      >;
-      idJag: z.ZodDefault<
-        z.ZodOptional<
-          z.ZodDefault<
-            z.ZodDiscriminatedUnion<
-              [
-                z.ZodObject<
-                  {
-                    enabled: z.ZodLiteral<false>;
-                  },
-                  z.core.$strict
-                >,
-                z.ZodObject<
-                  {
-                    enabled: z.ZodLiteral<true>;
-                    trustedIssuers: z.ZodOptional<
-                      z.ZodArray<
-                        z.ZodObject<
-                          {
-                            issuer: z.ZodOptional<z.ZodURL>;
-                            jwksUrl: z.ZodOptional<z.ZodURL>;
-                            expectedClientIds: z.ZodOptional<
-                              z.ZodArray<z.ZodString>
-                            >;
-                            subjectMapping: z.ZodDefault<
-                              z.ZodEnum<{
-                                iss_prefix: "iss_prefix";
-                                iss_tenant_prefix: "iss_tenant_prefix";
-                                sub_id_only: "sub_id_only";
-                              }>
-                            >;
-                          },
-                          z.core.$strict
-                        >
-                      >
-                    >;
-                    authorizationDetailsTypesAllowed: z.ZodOptional<
-                      z.ZodArray<z.ZodString>
-                    >;
-                  },
-                  z.core.$strict
-                >,
-              ]
-            >
-          >
-        >
-      >;
-    },
-    z.core.$strict
-  >,
-  z.ZodTransform<
-    {
-      idJag:
-        | {
-            enabled: false;
-          }
-        | {
-            enabled: true;
-            trustedIssuers: {
-              issuer: string;
-              jwksUrl: string;
-              subjectMapping:
-                | "iss_prefix"
-                | "iss_tenant_prefix"
-                | "sub_id_only";
-              expectedClientIds?: string[] | undefined;
-            }[];
-            authorizationDetailsTypesAllowed?: string[] | undefined;
-          };
-      oidc: {
-        issuer: string;
-        jwksUrl: string;
-        audience?: string | undefined;
-      };
-      browserLogin: {
-        url: string;
-        scope: string;
-        pkce: "none" | "S256";
-        remoteTimeoutMs: number;
-        stateTtlSeconds: number;
-        sessionTtlSeconds: number;
-        tokenUrl?: string | undefined;
-        clientId?: string | undefined;
-        clientSecret?: string | undefined;
-        audience?: string | undefined;
-      };
-      gateway: {
-        accessTokenTtlSeconds: number;
-        refreshTokenTtlSeconds: number;
-        downstreamCimdEnabled: boolean;
-      };
-    },
-    {
-      oidc: {
-        issuer: string;
-        jwksUrl: string;
-        audience?: string | undefined;
-      };
-      browserLogin: {
-        url: string;
-        scope: string;
-        pkce: "none" | "S256";
-        remoteTimeoutMs: number;
-        stateTtlSeconds: number;
-        sessionTtlSeconds: number;
-        tokenUrl?: string | undefined;
-        clientId?: string | undefined;
-        clientSecret?: string | undefined;
-        audience?: string | undefined;
-      };
-      gateway: {
-        accessTokenTtlSeconds: number;
-        refreshTokenTtlSeconds: number;
-        downstreamCimdEnabled: boolean;
-      };
-      idJag:
-        | {
-            enabled: false;
-          }
-        | {
-            enabled: true;
-            trustedIssuers?:
-              | {
-                  subjectMapping:
-                    | "iss_prefix"
-                    | "iss_tenant_prefix"
-                    | "sub_id_only";
-                  issuer?: string | undefined;
-                  jwksUrl?: string | undefined;
-                  expectedClientIds?: string[] | undefined;
-                }[]
-              | undefined;
-            authorizationDetailsTypesAllowed?: string[] | undefined;
-          };
-    }
-  >
->;
+/**
+ * The gateway's resolved OAuth runtime configuration — the parsed, defaulted
+ * output of {@link mcpOAuthRuntimeConfigSchema}. Hand-written so the public
+ * MCP OAuth policy class signatures contain no zod types; the assertion below
+ * fails to compile if this interface drifts from the schema.
+ */
+declare interface McpOAuthRuntimeConfig {
+  oidc: {
+    issuer: string;
+    jwksUrl: string;
+    audience?: string;
+  };
+  browserLogin: {
+    url: string;
+    tokenUrl?: string;
+    clientId?: string;
+    clientSecret?: string;
+    scope: string;
+    audience?: string;
+    pkce: "S256" | "none";
+    remoteTimeoutMs: number;
+    stateTtlSeconds: number;
+    sessionTtlSeconds: number;
+  };
+  gateway: {
+    accessTokenTtlSeconds: number;
+    refreshTokenTtlSeconds: number;
+    downstreamCimdEnabled: boolean;
+  };
+  idJag: IdJagRuntimeConfig;
+}
 
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
@@ -9200,7 +8923,7 @@ declare const mcpOAuthRuntimeConfigSchema: z.ZodPipe<
  * @public
  * @product mcp-gateway
  */
-export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<ValidatedOktaOAuthOptions> {
+export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<McpOktaOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-okta-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -9329,44 +9052,6 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpOktaOAuthOptionsSchema: z.ZodObject<
-  {
-    oktaDomain: z.ZodString;
-    authorizationServerId: z.ZodOptional<z.ZodString>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to OneLogin.
@@ -9379,7 +9064,7 @@ declare const mcpOktaOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<ValidatedOneLoginOAuthOptions> {
+export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<McpOneLoginOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-onelogin-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -9500,37 +9185,6 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpOneLoginOAuthOptionsSchema: z.ZodObject<
-  {
-    oneLoginSubdomain: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to PingOne.
@@ -9544,7 +9198,7 @@ declare const mcpOneLoginOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpPingOAuthInboundPolicy extends InboundPolicy<ValidatedPingOAuthOptions> {
+export declare class McpPingOAuthInboundPolicy extends InboundPolicy<McpPingOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-ping-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -9683,54 +9337,6 @@ export declare interface McpPingOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpPingOAuthOptionsSchema: z.ZodObject<
-  {
-    environmentId: z.ZodOptional<z.ZodString>;
-    region: z.ZodOptional<
-      z.ZodEnum<{
-        "north-america": "north-america";
-        canada: "canada";
-        europe: "europe";
-        singapore: "singapore";
-        australia: "australia";
-        "asia-pacific": "asia-pacific";
-      }>
-    >;
-    customDomain: z.ZodOptional<z.ZodString>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * An MCP Server handler for Zuplo
  * Only POST requests are supported for the HTTP streamable MCP transport.
@@ -9781,7 +9387,7 @@ declare interface McpTool {
  * @public
  * @product mcp-gateway
  */
-export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<ValidatedWorkosOAuthOptions> {
+export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<McpWorkosOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-workos-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -9902,42 +9508,6 @@ export declare interface McpWorkosOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpWorkosOAuthOptionsSchema: z.ZodObject<
-  {
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 declare interface MemoryCacheOptions {
   maxSize: number;
 }
@@ -12178,6 +11748,17 @@ export declare interface QuotaInboundPolicyOptions {
   };
 }
 
+declare interface QuotaLimit {
+  daily?: QuotaSettings;
+  monthly?: QuotaSettings;
+}
+
+declare interface QuotaSettings {
+  enabled: boolean;
+  limit?: number;
+  warning?: WarningSettings;
+}
+
 /**
  * The identifying element of the request that enforces distinct rate limits. For example, you can limit by `user`, `ip`, `function` or `all` - function allows you to specify a simple function to create a string identifier to create a rate-limit group.
  * @public
@@ -12915,7 +12496,7 @@ export declare interface RequireOriginInboundPolicyOptions {
  * @product api-gateway
  * @public
  */
-export declare class RequireUserClaimsInboundPolicy extends InboundPolicy<ValidatedOptions> {
+export declare class RequireUserClaimsInboundPolicy extends InboundPolicy<RequireUserClaimsInboundPolicyOptions> {
   #private;
   static readonly policyType = "require-user-claims";
   constructor(rawOptions: unknown, policyName: string);
@@ -12933,667 +12514,6 @@ export declare interface RequireUserClaimsInboundPolicyOptions {
   rule: Rule;
 }
 
-declare const requireUserClaimsOptionsSchema: z.ZodObject<
-  {
-    rule: z.ZodUnion<
-      readonly [
-        z.ZodObject<
-          {
-            and: z.ZodArray<
-              z.ZodUnion<
-                readonly [
-                  z.ZodObject<
-                    {
-                      and: z.ZodArray<
-                        z.ZodUnion<
-                          readonly [
-                            z.ZodObject<
-                              {
-                                and: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          eq: z.ZodUnion<
-                                            readonly [
-                                              z.ZodString,
-                                              z.ZodNumber,
-                                              z.ZodBoolean,
-                                            ]
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          in: z.ZodArray<
-                                            z.ZodUnion<
-                                              readonly [
-                                                z.ZodString,
-                                                z.ZodNumber,
-                                                z.ZodBoolean,
-                                              ]
-                                            >
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          startsWith: z.ZodString;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                or: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          eq: z.ZodUnion<
-                                            readonly [
-                                              z.ZodString,
-                                              z.ZodNumber,
-                                              z.ZodBoolean,
-                                            ]
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          in: z.ZodArray<
-                                            z.ZodUnion<
-                                              readonly [
-                                                z.ZodString,
-                                                z.ZodNumber,
-                                                z.ZodBoolean,
-                                              ]
-                                            >
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          startsWith: z.ZodString;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                eq: z.ZodUnion<
-                                  readonly [
-                                    z.ZodString,
-                                    z.ZodNumber,
-                                    z.ZodBoolean,
-                                  ]
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                in: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodString,
-                                      z.ZodNumber,
-                                      z.ZodBoolean,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                startsWith: z.ZodString;
-                              },
-                              z.core.$strict
-                            >,
-                          ]
-                        >
-                      >;
-                    },
-                    z.core.$strict
-                  >,
-                  z.ZodObject<
-                    {
-                      or: z.ZodArray<
-                        z.ZodUnion<
-                          readonly [
-                            z.ZodObject<
-                              {
-                                and: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          eq: z.ZodUnion<
-                                            readonly [
-                                              z.ZodString,
-                                              z.ZodNumber,
-                                              z.ZodBoolean,
-                                            ]
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          in: z.ZodArray<
-                                            z.ZodUnion<
-                                              readonly [
-                                                z.ZodString,
-                                                z.ZodNumber,
-                                                z.ZodBoolean,
-                                              ]
-                                            >
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          startsWith: z.ZodString;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                or: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          eq: z.ZodUnion<
-                                            readonly [
-                                              z.ZodString,
-                                              z.ZodNumber,
-                                              z.ZodBoolean,
-                                            ]
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          in: z.ZodArray<
-                                            z.ZodUnion<
-                                              readonly [
-                                                z.ZodString,
-                                                z.ZodNumber,
-                                                z.ZodBoolean,
-                                              ]
-                                            >
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          startsWith: z.ZodString;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                eq: z.ZodUnion<
-                                  readonly [
-                                    z.ZodString,
-                                    z.ZodNumber,
-                                    z.ZodBoolean,
-                                  ]
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                in: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodString,
-                                      z.ZodNumber,
-                                      z.ZodBoolean,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                startsWith: z.ZodString;
-                              },
-                              z.core.$strict
-                            >,
-                          ]
-                        >
-                      >;
-                    },
-                    z.core.$strict
-                  >,
-                  z.ZodObject<
-                    {
-                      claim: z.ZodString;
-                      eq: z.ZodUnion<
-                        readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]
-                      >;
-                    },
-                    z.core.$strict
-                  >,
-                  z.ZodObject<
-                    {
-                      claim: z.ZodString;
-                      in: z.ZodArray<
-                        z.ZodUnion<
-                          readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]
-                        >
-                      >;
-                    },
-                    z.core.$strict
-                  >,
-                  z.ZodObject<
-                    {
-                      claim: z.ZodString;
-                      startsWith: z.ZodString;
-                    },
-                    z.core.$strict
-                  >,
-                ]
-              >
-            >;
-          },
-          z.core.$strict
-        >,
-        z.ZodObject<
-          {
-            or: z.ZodArray<
-              z.ZodUnion<
-                readonly [
-                  z.ZodObject<
-                    {
-                      and: z.ZodArray<
-                        z.ZodUnion<
-                          readonly [
-                            z.ZodObject<
-                              {
-                                and: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          eq: z.ZodUnion<
-                                            readonly [
-                                              z.ZodString,
-                                              z.ZodNumber,
-                                              z.ZodBoolean,
-                                            ]
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          in: z.ZodArray<
-                                            z.ZodUnion<
-                                              readonly [
-                                                z.ZodString,
-                                                z.ZodNumber,
-                                                z.ZodBoolean,
-                                              ]
-                                            >
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          startsWith: z.ZodString;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                or: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          eq: z.ZodUnion<
-                                            readonly [
-                                              z.ZodString,
-                                              z.ZodNumber,
-                                              z.ZodBoolean,
-                                            ]
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          in: z.ZodArray<
-                                            z.ZodUnion<
-                                              readonly [
-                                                z.ZodString,
-                                                z.ZodNumber,
-                                                z.ZodBoolean,
-                                              ]
-                                            >
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          startsWith: z.ZodString;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                eq: z.ZodUnion<
-                                  readonly [
-                                    z.ZodString,
-                                    z.ZodNumber,
-                                    z.ZodBoolean,
-                                  ]
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                in: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodString,
-                                      z.ZodNumber,
-                                      z.ZodBoolean,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                startsWith: z.ZodString;
-                              },
-                              z.core.$strict
-                            >,
-                          ]
-                        >
-                      >;
-                    },
-                    z.core.$strict
-                  >,
-                  z.ZodObject<
-                    {
-                      or: z.ZodArray<
-                        z.ZodUnion<
-                          readonly [
-                            z.ZodObject<
-                              {
-                                and: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          eq: z.ZodUnion<
-                                            readonly [
-                                              z.ZodString,
-                                              z.ZodNumber,
-                                              z.ZodBoolean,
-                                            ]
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          in: z.ZodArray<
-                                            z.ZodUnion<
-                                              readonly [
-                                                z.ZodString,
-                                                z.ZodNumber,
-                                                z.ZodBoolean,
-                                              ]
-                                            >
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          startsWith: z.ZodString;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                or: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          eq: z.ZodUnion<
-                                            readonly [
-                                              z.ZodString,
-                                              z.ZodNumber,
-                                              z.ZodBoolean,
-                                            ]
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          in: z.ZodArray<
-                                            z.ZodUnion<
-                                              readonly [
-                                                z.ZodString,
-                                                z.ZodNumber,
-                                                z.ZodBoolean,
-                                              ]
-                                            >
-                                          >;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                      z.ZodObject<
-                                        {
-                                          claim: z.ZodString;
-                                          startsWith: z.ZodString;
-                                        },
-                                        z.core.$strict
-                                      >,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                eq: z.ZodUnion<
-                                  readonly [
-                                    z.ZodString,
-                                    z.ZodNumber,
-                                    z.ZodBoolean,
-                                  ]
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                in: z.ZodArray<
-                                  z.ZodUnion<
-                                    readonly [
-                                      z.ZodString,
-                                      z.ZodNumber,
-                                      z.ZodBoolean,
-                                    ]
-                                  >
-                                >;
-                              },
-                              z.core.$strict
-                            >,
-                            z.ZodObject<
-                              {
-                                claim: z.ZodString;
-                                startsWith: z.ZodString;
-                              },
-                              z.core.$strict
-                            >,
-                          ]
-                        >
-                      >;
-                    },
-                    z.core.$strict
-                  >,
-                  z.ZodObject<
-                    {
-                      claim: z.ZodString;
-                      eq: z.ZodUnion<
-                        readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]
-                      >;
-                    },
-                    z.core.$strict
-                  >,
-                  z.ZodObject<
-                    {
-                      claim: z.ZodString;
-                      in: z.ZodArray<
-                        z.ZodUnion<
-                          readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]
-                        >
-                      >;
-                    },
-                    z.core.$strict
-                  >,
-                  z.ZodObject<
-                    {
-                      claim: z.ZodString;
-                      startsWith: z.ZodString;
-                    },
-                    z.core.$strict
-                  >,
-                ]
-              >
-            >;
-          },
-          z.core.$strict
-        >,
-        z.ZodObject<
-          {
-            claim: z.ZodString;
-            eq: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>;
-          },
-          z.core.$strict
-        >,
-        z.ZodObject<
-          {
-            claim: z.ZodString;
-            in: z.ZodArray<
-              z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>
-            >;
-          },
-          z.core.$strict
-        >,
-        z.ZodObject<
-          {
-            claim: z.ZodString;
-            startsWith: z.ZodString;
-          },
-          z.core.$strict
-        >,
-      ]
-    >;
-  },
-  z.core.$strict
->;
-
 declare type ResolveRequestParams<
   TParams extends RequestParamsDefault | undefined,
 > = TParams extends RequestParamsDefault ? TParams : RequestParamsDefault;
@@ -15551,52 +14471,6 @@ declare interface Usage {
 
 declare type UserDataDefault = any;
 
-declare type ValidatedAuth0OAuthOptions = z.infer<
-  typeof mcpAuth0OAuthOptionsSchema
->;
-
-declare type ValidatedClerkOAuthOptions = z.infer<
-  typeof mcpClerkOAuthOptionsSchema
->;
-
-declare type ValidatedCognitoOAuthOptions = z.infer<
-  typeof mcpCognitoOAuthOptionsSchema
->;
-
-declare type ValidatedEntraOAuthOptions = z.infer<
-  typeof mcpEntraOAuthOptionsSchema
->;
-
-declare type ValidatedGoogleOAuthOptions = z.infer<
-  typeof mcpGoogleOAuthOptionsSchema
->;
-
-declare type ValidatedKeycloakOAuthOptions = z.infer<
-  typeof mcpKeycloakOAuthOptionsSchema
->;
-
-declare type ValidatedLogtoOAuthOptions = z.infer<
-  typeof mcpLogtoOAuthOptionsSchema
->;
-
-declare type ValidatedOktaOAuthOptions = z.infer<
-  typeof mcpOktaOAuthOptionsSchema
->;
-
-declare type ValidatedOneLoginOAuthOptions = z.infer<
-  typeof mcpOneLoginOAuthOptionsSchema
->;
-
-declare type ValidatedOptions = z.infer<typeof requireUserClaimsOptionsSchema>;
-
-declare type ValidatedPingOAuthOptions = z.infer<
-  typeof mcpPingOAuthOptionsSchema
->;
-
-declare type ValidatedWorkosOAuthOptions = z.infer<
-  typeof mcpWorkosOAuthOptionsSchema
->;
-
 /**
  * Validates the body of an incoming request based on a JSON schema.
  *
@@ -15720,6 +14594,14 @@ declare interface WaitUntilFunc {
   (promise: Promise<any>): void;
 }
 
+declare interface WarningSettings {
+  enabled: boolean;
+  /**
+   * Percentage of the limit at which to emit a warning event.
+   */
+  threshold?: number;
+}
+
 /**
  * Authenticate bots using web-bot-auth HTTP Message Signatures.
  *