@zuplo/runtime 6.73.28 → 6.73.30

package/out/types/mcp-gateway/index.d.ts

@@ -1,5 +1,3 @@
-import { z } from "zod/v4";
-
 /**
  * Optional per-caller access control. Defaults to mode 'allPublic' (no access control). Set mode to 'rolesAndGroups' to match the caller's role/group claims against each capability's markup (a capability with no roles/groups/public markup is available to no one), or 'function' to delegate to a custom resolver.
  * @public
@@ -622,6 +620,27 @@ declare type IdJagClientAuth =
       expiresInSeconds?: number;
     };
 
+/**
+ * Hand-written mirror of {@link idJagConfigSchema}'s parsed output. Keeping
+ * the type hand-written keeps zod out of the public policy class signatures
+ * (this type is part of {@link McpOAuthRuntimeConfig}); the assertion below
+ * fails to compile on drift.
+ */
+declare type IdJagRuntimeConfig =
+  | {
+      enabled: false;
+    }
+  | {
+      enabled: true;
+      trustedIssuers: {
+        issuer: string;
+        jwksUrl: string;
+        expectedClientIds?: string[];
+        subjectMapping: "iss_prefix" | "iss_tenant_prefix" | "sub_id_only";
+      }[];
+      authorizationDetailsTypesAllowed?: string[];
+    };
+
 /**
  * A policy that can modify the incoming HTTP request before it is sent to
  * the handler. If a response is returned, the request is short-circuited and
@@ -1086,7 +1105,7 @@ declare interface Logger extends BaseLogger {
  * @title MCP Auth0 OAuth
  * @product mcp-gateway
  */
-export declare class McpAuth0OAuthInboundPolicy extends InboundPolicy<ValidatedAuth0OAuthOptions> {
+export declare class McpAuth0OAuthInboundPolicy extends InboundPolicy<McpAuth0OAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-auth0-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -1215,44 +1234,6 @@ export declare interface McpAuth0OAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
-  {
-    auth0Domain: z.ZodString;
-    audience: z.ZodOptional<z.ZodString>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Curate MCP capabilities advertised and reachable through `McpProxyHandler`.
  *
@@ -1269,7 +1250,7 @@ declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
  * @title MCP Capability Filter
  * @product mcp-gateway
  */
-export declare class McpCapabilityFilterInboundPolicy extends InboundPolicy<ValidatedOptions> {
+export declare class McpCapabilityFilterInboundPolicy extends InboundPolicy<McpCapabilityFilterInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-capability-filter";
   constructor(rawOptions: unknown, policyName: string);
@@ -1303,124 +1284,6 @@ export declare interface McpCapabilityFilterInboundPolicyOptions {
   accessControl?: AccessControl;
 }
 
-declare const mcpCapabilityFilterOptionsSchema: z.ZodObject<
-  {
-    tools: z.ZodOptional<
-      z.ZodArray<
-        z.ZodUnion<
-          readonly [
-            z.ZodString,
-            z.ZodObject<
-              {
-                name: z.ZodString;
-                description: z.ZodOptional<z.ZodString>;
-                annotations: z.ZodOptional<
-                  z.ZodRecord<z.ZodString, z.ZodUnknown>
-                >;
-                _meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                public: z.ZodOptional<z.ZodBoolean>;
-              },
-              z.core.$strict
-            >,
-          ]
-        >
-      >
-    >;
-    prompts: z.ZodOptional<
-      z.ZodArray<
-        z.ZodUnion<
-          readonly [
-            z.ZodString,
-            z.ZodObject<
-              {
-                name: z.ZodString;
-                description: z.ZodOptional<z.ZodString>;
-                _meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                public: z.ZodOptional<z.ZodBoolean>;
-              },
-              z.core.$strict
-            >,
-          ]
-        >
-      >
-    >;
-    resources: z.ZodOptional<
-      z.ZodArray<
-        z.ZodUnion<
-          readonly [
-            z.ZodString,
-            z.ZodObject<
-              {
-                uri: z.ZodString;
-                name: z.ZodOptional<z.ZodString>;
-                description: z.ZodOptional<z.ZodString>;
-                mimeType: z.ZodOptional<z.ZodString>;
-                _meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                public: z.ZodOptional<z.ZodBoolean>;
-              },
-              z.core.$strict
-            >,
-          ]
-        >
-      >
-    >;
-    resourceTemplates: z.ZodOptional<
-      z.ZodArray<
-        z.ZodUnion<
-          readonly [
-            z.ZodString,
-            z.ZodObject<
-              {
-                uriTemplate: z.ZodString;
-                name: z.ZodOptional<z.ZodString>;
-                description: z.ZodOptional<z.ZodString>;
-                mimeType: z.ZodOptional<z.ZodString>;
-                _meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-                roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                groups: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                public: z.ZodOptional<z.ZodBoolean>;
-              },
-              z.core.$strict
-            >,
-          ]
-        >
-      >
-    >;
-    accessControl: z.ZodOptional<
-      z.ZodObject<
-        {
-          mode: z.ZodOptional<
-            z.ZodEnum<{
-              function: "function";
-              allPublic: "allPublic";
-              rolesAndGroups: "rolesAndGroups";
-            }>
-          >;
-          roleClaim: z.ZodOptional<z.ZodString>;
-          groupClaim: z.ZodOptional<z.ZodString>;
-          identifier: z.ZodOptional<
-            z.ZodObject<
-              {
-                module: z.ZodUnknown;
-                export: z.ZodString;
-              },
-              z.core.$strict
-            >
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Resolves, per request, which MCP capabilities a caller may see and invoke.
  *
@@ -1431,6 +1294,13 @@ declare const mcpCapabilityFilterOptionsSchema: z.ZodObject<
  * `accessControl.identifier: { module, export }` to derive access any other way,
  * e.g. from an external entitlements API.
  *
+ * The `options` argument is the policy's configuration as authored in
+ * `policies.json`, with one caveat: `accessControl.identifier.module` is typed
+ * as the `$import(...)` string that was written there, but the value at runtime
+ * is the imported module itself — the build resolves `$import(...)` before the
+ * policy runs. It only ever describes how this resolver was loaded, so a
+ * resolver has no reason to read it.
+ *
  * @public
  */
 export declare type McpCapabilityResolver = (
@@ -1451,7 +1321,7 @@ export declare type McpCapabilityResolver = (
  * @public
  * @product mcp-gateway
  */
-export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<ValidatedClerkOAuthOptions> {
+export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<McpClerkOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-clerk-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -1572,37 +1442,6 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpClerkOAuthOptionsSchema: z.ZodObject<
-  {
-    frontendApiUrl: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Amazon Cognito.
@@ -1616,7 +1455,7 @@ declare const mcpClerkOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<ValidatedCognitoOAuthOptions> {
+export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<McpCognitoOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-cognito-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -1749,45 +1588,6 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpCognitoOAuthOptionsSchema: z.ZodObject<
-  {
-    awsRegion: z.ZodString;
-    userPoolId: z.ZodString;
-    userPoolDomain: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Microsoft Entra ID.
@@ -1800,7 +1600,7 @@ declare const mcpCognitoOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<ValidatedEntraOAuthOptions> {
+export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<McpEntraOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-entra-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -1925,43 +1725,6 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpEntraOAuthOptionsSchema: z.ZodObject<
-  {
-    tenantId: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Activates the MCP Gateway internal routes (OAuth authorization server,
  * upstream connection management, well-known metadata) on the runtime router.
@@ -2032,7 +1795,7 @@ export declare interface McpGatewayPluginOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<ValidatedGoogleOAuthOptions> {
+export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<McpGoogleOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-google-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -2153,42 +1916,6 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpGoogleOAuthOptionsSchema: z.ZodObject<
-  {
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Keycloak.
@@ -2202,7 +1929,7 @@ declare const mcpGoogleOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<ValidatedKeycloakOAuthOptions> {
+export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<McpKeycloakOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-keycloak-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -2331,44 +2058,6 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpKeycloakOAuthOptionsSchema: z.ZodObject<
-  {
-    keycloakBaseUrl: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    realm: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to Logto.
@@ -2381,7 +2070,7 @@ declare const mcpKeycloakOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<ValidatedLogtoOAuthOptions> {
+export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<McpLogtoOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-logto-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -2506,43 +2195,6 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpLogtoOAuthOptionsSchema: z.ZodObject<
-  {
-    logtoEndpoint: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token.
  *
@@ -2719,201 +2371,37 @@ export declare interface McpOAuthInboundPolicyOptions {
       };
 }
 
-declare type McpOAuthRuntimeConfig = z.infer<
-  typeof mcpOAuthRuntimeConfigSchema
->;
-
-declare const mcpOAuthRuntimeConfigSchema: z.ZodPipe<
-  z.ZodObject<
-    {
-      oidc: z.ZodObject<
-        {
-          issuer: z.ZodURL;
-          jwksUrl: z.ZodURL;
-          audience: z.ZodOptional<z.ZodString>;
-        },
-        z.core.$strip
-      >;
-      browserLogin: z.ZodObject<
-        {
-          url: z.ZodURL;
-          tokenUrl: z.ZodOptional<z.ZodURL>;
-          clientId: z.ZodOptional<z.ZodString>;
-          clientSecret: z.ZodOptional<z.ZodString>;
-          scope: z.ZodDefault<z.ZodString>;
-          audience: z.ZodOptional<z.ZodString>;
-          pkce: z.ZodDefault<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-          remoteTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-          stateTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-          sessionTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-        },
-        z.core.$strict
-      >;
-      gateway: z.ZodPipe<
-        z.ZodDefault<
-          z.ZodObject<
-            {
-              accessTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-              refreshTokenTtlSeconds: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
-              cimdEnabled: z.ZodDefault<z.ZodBoolean>;
-            },
-            z.core.$strict
-          >
-        >,
-        z.ZodTransform<
-          {
-            accessTokenTtlSeconds: number;
-            refreshTokenTtlSeconds: number;
-            downstreamCimdEnabled: boolean;
-          },
-          {
-            accessTokenTtlSeconds: number;
-            refreshTokenTtlSeconds: number;
-            cimdEnabled: boolean;
-          }
-        >
-      >;
-      idJag: z.ZodDefault<
-        z.ZodOptional<
-          z.ZodDefault<
-            z.ZodDiscriminatedUnion<
-              [
-                z.ZodObject<
-                  {
-                    enabled: z.ZodLiteral<false>;
-                  },
-                  z.core.$strict
-                >,
-                z.ZodObject<
-                  {
-                    enabled: z.ZodLiteral<true>;
-                    trustedIssuers: z.ZodOptional<
-                      z.ZodArray<
-                        z.ZodObject<
-                          {
-                            issuer: z.ZodOptional<z.ZodURL>;
-                            jwksUrl: z.ZodOptional<z.ZodURL>;
-                            expectedClientIds: z.ZodOptional<
-                              z.ZodArray<z.ZodString>
-                            >;
-                            subjectMapping: z.ZodDefault<
-                              z.ZodEnum<{
-                                iss_prefix: "iss_prefix";
-                                iss_tenant_prefix: "iss_tenant_prefix";
-                                sub_id_only: "sub_id_only";
-                              }>
-                            >;
-                          },
-                          z.core.$strict
-                        >
-                      >
-                    >;
-                    authorizationDetailsTypesAllowed: z.ZodOptional<
-                      z.ZodArray<z.ZodString>
-                    >;
-                  },
-                  z.core.$strict
-                >,
-              ]
-            >
-          >
-        >
-      >;
-    },
-    z.core.$strict
-  >,
-  z.ZodTransform<
-    {
-      idJag:
-        | {
-            enabled: false;
-          }
-        | {
-            enabled: true;
-            trustedIssuers: {
-              issuer: string;
-              jwksUrl: string;
-              subjectMapping:
-                | "iss_prefix"
-                | "iss_tenant_prefix"
-                | "sub_id_only";
-              expectedClientIds?: string[] | undefined;
-            }[];
-            authorizationDetailsTypesAllowed?: string[] | undefined;
-          };
-      oidc: {
-        issuer: string;
-        jwksUrl: string;
-        audience?: string | undefined;
-      };
-      browserLogin: {
-        url: string;
-        scope: string;
-        pkce: "none" | "S256";
-        remoteTimeoutMs: number;
-        stateTtlSeconds: number;
-        sessionTtlSeconds: number;
-        tokenUrl?: string | undefined;
-        clientId?: string | undefined;
-        clientSecret?: string | undefined;
-        audience?: string | undefined;
-      };
-      gateway: {
-        accessTokenTtlSeconds: number;
-        refreshTokenTtlSeconds: number;
-        downstreamCimdEnabled: boolean;
-      };
-    },
-    {
-      oidc: {
-        issuer: string;
-        jwksUrl: string;
-        audience?: string | undefined;
-      };
-      browserLogin: {
-        url: string;
-        scope: string;
-        pkce: "none" | "S256";
-        remoteTimeoutMs: number;
-        stateTtlSeconds: number;
-        sessionTtlSeconds: number;
-        tokenUrl?: string | undefined;
-        clientId?: string | undefined;
-        clientSecret?: string | undefined;
-        audience?: string | undefined;
-      };
-      gateway: {
-        accessTokenTtlSeconds: number;
-        refreshTokenTtlSeconds: number;
-        downstreamCimdEnabled: boolean;
-      };
-      idJag:
-        | {
-            enabled: false;
-          }
-        | {
-            enabled: true;
-            trustedIssuers?:
-              | {
-                  subjectMapping:
-                    | "iss_prefix"
-                    | "iss_tenant_prefix"
-                    | "sub_id_only";
-                  issuer?: string | undefined;
-                  jwksUrl?: string | undefined;
-                  expectedClientIds?: string[] | undefined;
-                }[]
-              | undefined;
-            authorizationDetailsTypesAllowed?: string[] | undefined;
-          };
-    }
-  >
->;
+/**
+ * The gateway's resolved OAuth runtime configuration — the parsed, defaulted
+ * output of {@link mcpOAuthRuntimeConfigSchema}. Hand-written so the public
+ * MCP OAuth policy class signatures contain no zod types; the assertion below
+ * fails to compile if this interface drifts from the schema.
+ */
+declare interface McpOAuthRuntimeConfig {
+  oidc: {
+    issuer: string;
+    jwksUrl: string;
+    audience?: string;
+  };
+  browserLogin: {
+    url: string;
+    tokenUrl?: string;
+    clientId?: string;
+    clientSecret?: string;
+    scope: string;
+    audience?: string;
+    pkce: "S256" | "none";
+    remoteTimeoutMs: number;
+    stateTtlSeconds: number;
+    sessionTtlSeconds: number;
+  };
+  gateway: {
+    accessTokenTtlSeconds: number;
+    refreshTokenTtlSeconds: number;
+    downstreamCimdEnabled: boolean;
+  };
+  idJag: IdJagRuntimeConfig;
+}
 
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
@@ -2927,7 +2415,7 @@ declare const mcpOAuthRuntimeConfigSchema: z.ZodPipe<
  * @public
  * @product mcp-gateway
  */
-export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<ValidatedOktaOAuthOptions> {
+export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<McpOktaOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-okta-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -3056,44 +2544,6 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpOktaOAuthOptionsSchema: z.ZodObject<
-  {
-    oktaDomain: z.ZodString;
-    authorizationServerId: z.ZodOptional<z.ZodString>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to OneLogin.
@@ -3106,7 +2556,7 @@ declare const mcpOktaOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<ValidatedOneLoginOAuthOptions> {
+export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<McpOneLoginOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-onelogin-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -3227,37 +2677,6 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpOneLoginOAuthOptionsSchema: z.ZodObject<
-  {
-    oneLoginSubdomain: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Authenticate MCP gateway requests using a gateway-issued OAuth access token,
  * with browser login delegated to PingOne.
@@ -3271,7 +2690,7 @@ declare const mcpOneLoginOAuthOptionsSchema: z.ZodObject<
  * @public
  * @product mcp-gateway
  */
-export declare class McpPingOAuthInboundPolicy extends InboundPolicy<ValidatedPingOAuthOptions> {
+export declare class McpPingOAuthInboundPolicy extends InboundPolicy<McpPingOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-ping-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -3410,54 +2829,6 @@ export declare interface McpPingOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpPingOAuthOptionsSchema: z.ZodObject<
-  {
-    environmentId: z.ZodOptional<z.ZodString>;
-    region: z.ZodOptional<
-      z.ZodEnum<{
-        "north-america": "north-america";
-        canada: "canada";
-        europe: "europe";
-        singapore: "singapore";
-        australia: "australia";
-        "asia-pacific": "asia-pacific";
-      }>
-    >;
-    customDomain: z.ZodOptional<z.ZodString>;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 export declare function McpProxyHandler(
   request: ZuploRequest,
   context: ZuploContext
@@ -3477,6 +2848,7 @@ export declare function McpProxyHandler(
  * @product mcp-gateway
  */
 export declare class McpTokenExchangeInboundPolicy extends InboundPolicy<UpstreamTokenExchangePolicyOptions> {
+  #private;
   static readonly policyType = "mcp-token-exchange";
   constructor(rawOptions: unknown, policyName: string);
   handler(
@@ -3597,7 +2969,7 @@ export declare interface McpTokenExchangeInboundPolicyOptions {
  * @public
  * @product mcp-gateway
  */
-export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<ValidatedWorkosOAuthOptions> {
+export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<McpWorkosOAuthInboundPolicyOptions> {
   #private;
   static readonly policyType = "mcp-workos-oauth";
   constructor(rawOptions: unknown, policyName: string);
@@ -3718,42 +3090,6 @@ export declare interface McpWorkosOAuthInboundPolicyOptions {
   };
 }
 
-declare const mcpWorkosOAuthOptionsSchema: z.ZodObject<
-  {
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    scope: z.ZodOptional<z.ZodString>;
-    gateway: z.ZodOptional<
-      z.ZodObject<
-        {
-          accessTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          refreshTokenTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          cimdEnabled: z.ZodOptional<z.ZodBoolean>;
-        },
-        z.core.$strict
-      >
-    >;
-    idJag: z.ZodOptional<z.ZodUnknown>;
-    browserLoginOverrides: z.ZodOptional<
-      z.ZodObject<
-        {
-          remoteTimeoutMs: z.ZodOptional<z.ZodNumber>;
-          stateTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          sessionTtlSeconds: z.ZodOptional<z.ZodNumber>;
-          pkce: z.ZodOptional<
-            z.ZodEnum<{
-              none: "none";
-              S256: "S256";
-            }>
-          >;
-        },
-        z.core.$strict
-      >
-    >;
-  },
-  z.core.$strict
->;
-
 /**
  * Arbitrary MCP _meta fields to expose downstream.
  * @public
@@ -4597,6 +3933,23 @@ declare interface RequestUser<TUserData> {
   data: TUserData;
 }
 
+/**
+ * Resolved upstream auth configuration, discriminated by auth mode.
+ */
+declare type ResolvedUpstreamAuthConfig =
+  | {
+      mode: "shared-oauth";
+      oauth: UpstreamOAuthConfig;
+    }
+  | {
+      mode: "user-oauth";
+      oauth: UpstreamOAuthConfig;
+    }
+  | {
+      mode: "id-jag";
+      idJag: UpstreamIdJagConfig;
+    };
+
 declare type ResolveRequestParams<
   TParams extends RequestParamsDefault | undefined,
 > = TParams extends RequestParamsDefault ? TParams : RequestParamsDefault;
@@ -4796,334 +4149,131 @@ declare interface ToolProjection {
   public?: Public;
 }
 
-declare type UpstreamTokenExchangePolicyOptions = z.infer<
-  typeof upstreamTokenExchangePolicyOptionsSchema
->;
-
-declare const upstreamTokenExchangePolicyOptionsSchema: z.ZodObject<
-  {
-    id: z.core.$ZodBranded<z.ZodString, "UpstreamServerId">;
-    displayName: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
-    serverInfo: z.ZodOptional<
-      z.ZodObject<
-        {
-          version: z.ZodString;
-          websiteUrl: z.ZodOptional<z.ZodString>;
-          description: z.ZodOptional<z.ZodString>;
-          icons: z.ZodOptional<
-            z.ZodArray<
-              z.ZodObject<
-                {
-                  src: z.ZodString;
-                  mimeType: z.ZodOptional<z.ZodString>;
-                  sizes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                  theme: z.ZodOptional<
-                    z.ZodEnum<{
-                      light: "light";
-                      dark: "dark";
-                    }>
-                  >;
-                },
-                z.core.$strip
-              >
-            >
-          >;
-          name: z.ZodString;
-          title: z.ZodOptional<z.ZodString>;
-        },
-        z.core.$strip
-      >
-    >;
-    protectedResourceMetadataUrl: z.ZodOptional<z.ZodURL>;
-    authMode: z.ZodEnum<{
-      "user-oauth": "user-oauth";
-      "shared-oauth": "shared-oauth";
-      "id-jag": "id-jag";
-    }>;
-    ownerMode: z.ZodEnum<{
-      user: "user";
-      shared: "shared";
-    }>;
-    authConfig: z.ZodDiscriminatedUnion<
-      [
-        z.ZodObject<
-          {
-            mode: z.ZodLiteral<"shared-oauth">;
-            oauth: z.ZodObject<
-              {
-                scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-                scopeDelimiter: z.ZodDefault<z.ZodString>;
-                prompt: z.ZodOptional<
-                  z.ZodUnion<
-                    [
-                      z.ZodEnum<{
-                        none: "none";
-                        login: "login";
-                        consent: "consent";
-                        select_account: "select_account";
-                      }>,
-                      z.ZodLiteral<false>,
-                    ]
-                  >
-                >;
-                clientRegistration: z.ZodDefault<
-                  z.ZodDiscriminatedUnion<
-                    [
-                      z.ZodObject<
-                        {
-                          mode: z.ZodLiteral<"auto">;
-                        },
-                        z.core.$strict
-                      >,
-                      z.ZodObject<
-                        {
-                          mode: z.ZodLiteral<"manual">;
-                          clientId: z.ZodString;
-                          clientSecret: z.ZodOptional<z.ZodString>;
-                          tokenEndpointAuthMethod: z.ZodDefault<
-                            z.ZodEnum<{
-                              none: "none";
-                              client_secret_basic: "client_secret_basic";
-                              client_secret_post: "client_secret_post";
-                            }>
-                          >;
-                        },
-                        z.core.$strict
-                      >,
-                    ]
-                  >
-                >;
-                redirectPath: z.ZodString;
-              },
-              z.core.$strict
-            >;
-          },
-          z.core.$strict
-        >,
-        z.ZodObject<
-          {
-            mode: z.ZodLiteral<"user-oauth">;
-            oauth: z.ZodObject<
-              {
-                scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-                scopeDelimiter: z.ZodDefault<z.ZodString>;
-                prompt: z.ZodOptional<
-                  z.ZodUnion<
-                    [
-                      z.ZodEnum<{
-                        none: "none";
-                        login: "login";
-                        consent: "consent";
-                        select_account: "select_account";
-                      }>,
-                      z.ZodLiteral<false>,
-                    ]
-                  >
-                >;
-                clientRegistration: z.ZodDefault<
-                  z.ZodDiscriminatedUnion<
-                    [
-                      z.ZodObject<
-                        {
-                          mode: z.ZodLiteral<"auto">;
-                        },
-                        z.core.$strict
-                      >,
-                      z.ZodObject<
-                        {
-                          mode: z.ZodLiteral<"manual">;
-                          clientId: z.ZodString;
-                          clientSecret: z.ZodOptional<z.ZodString>;
-                          tokenEndpointAuthMethod: z.ZodDefault<
-                            z.ZodEnum<{
-                              none: "none";
-                              client_secret_basic: "client_secret_basic";
-                              client_secret_post: "client_secret_post";
-                            }>
-                          >;
-                        },
-                        z.core.$strict
-                      >,
-                    ]
-                  >
-                >;
-                redirectPath: z.ZodString;
-              },
-              z.core.$strict
-            >;
-          },
-          z.core.$strict
-        >,
-        z.ZodObject<
-          {
-            mode: z.ZodLiteral<"id-jag">;
-            idJag: z.ZodObject<
-              {
-                scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-                scopeDelimiter: z.ZodDefault<z.ZodString>;
-                idp: z.ZodObject<
-                  {
-                    tokenUrl: z.ZodURL;
-                    clientAuth: z.ZodDiscriminatedUnion<
-                      [
-                        z.ZodObject<
-                          {
-                            method: z.ZodLiteral<"client_secret_post">;
-                            clientId: z.ZodString;
-                            clientSecret: z.ZodString;
-                          },
-                          z.core.$strict
-                        >,
-                        z.ZodObject<
-                          {
-                            method: z.ZodLiteral<"client_secret_basic">;
-                            clientId: z.ZodString;
-                            clientSecret: z.ZodString;
-                          },
-                          z.core.$strict
-                        >,
-                        z.ZodObject<
-                          {
-                            method: z.ZodLiteral<"private_key_jwt">;
-                            clientId: z.ZodString;
-                            privateKeyPem: z.ZodString;
-                            algorithm: z.ZodDefault<
-                              z.ZodEnum<{
-                                RS256: "RS256";
-                                RS384: "RS384";
-                                RS512: "RS512";
-                                ES256: "ES256";
-                                ES384: "ES384";
-                                ES512: "ES512";
-                              }>
-                            >;
-                            keyId: z.ZodOptional<z.ZodString>;
-                            audience: z.ZodOptional<z.ZodURL>;
-                            expiresInSeconds: z.ZodDefault<z.ZodNumber>;
-                          },
-                          z.core.$strict
-                        >,
-                      ]
-                    >;
-                  },
-                  z.core.$strict
-                >;
-                resourceAs: z.ZodObject<
-                  {
-                    tokenUrl: z.ZodURL;
-                    audience: z.ZodString;
-                    resource: z.ZodOptional<z.ZodString>;
-                    clientAuth: z.ZodDiscriminatedUnion<
-                      [
-                        z.ZodObject<
-                          {
-                            method: z.ZodLiteral<"client_secret_post">;
-                            clientId: z.ZodString;
-                            clientSecret: z.ZodString;
-                          },
-                          z.core.$strict
-                        >,
-                        z.ZodObject<
-                          {
-                            method: z.ZodLiteral<"client_secret_basic">;
-                            clientId: z.ZodString;
-                            clientSecret: z.ZodString;
-                          },
-                          z.core.$strict
-                        >,
-                        z.ZodObject<
-                          {
-                            method: z.ZodLiteral<"private_key_jwt">;
-                            clientId: z.ZodString;
-                            privateKeyPem: z.ZodString;
-                            algorithm: z.ZodDefault<
-                              z.ZodEnum<{
-                                RS256: "RS256";
-                                RS384: "RS384";
-                                RS512: "RS512";
-                                ES256: "ES256";
-                                ES384: "ES384";
-                                ES512: "ES512";
-                              }>
-                            >;
-                            keyId: z.ZodOptional<z.ZodString>;
-                            audience: z.ZodOptional<z.ZodURL>;
-                            expiresInSeconds: z.ZodDefault<z.ZodNumber>;
-                          },
-                          z.core.$strict
-                        >,
-                      ]
-                    >;
-                  },
-                  z.core.$strict
-                >;
-              },
-              z.core.$strict
-            >;
-          },
-          z.core.$strict
-        >,
-      ]
-    >;
-  },
-  z.core.$strict
->;
+/**
+ * Client authentication for the ID-JAG token exchange legs.
+ */
+declare type UpstreamIdJagClientAuthConfig =
+  | {
+      method: "client_secret_post";
+      clientId: string;
+      clientSecret: string;
+    }
+  | {
+      method: "client_secret_basic";
+      clientId: string;
+      clientSecret: string;
+    }
+  | {
+      method: "private_key_jwt";
+      clientId: string;
+      privateKeyPem: string;
+      algorithm: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512";
+      keyId?: string;
+      audience?: string;
+      expiresInSeconds: number;
+    };
 
-declare interface UrlConfig {
-  defaultUrl: string;
-  urls: string[];
+/**
+ * Resolved ID-JAG (identity-chaining JWT authorization grant) configuration.
+ */
+declare interface UpstreamIdJagConfig {
+  scopes: string[];
+  scopeDelimiter: string;
+  idp: {
+    tokenUrl: string;
+    clientAuth: UpstreamIdJagClientAuthConfig;
+  };
+  resourceAs: {
+    tokenUrl: string;
+    audience: string;
+    resource?: string;
+    clientAuth: UpstreamIdJagClientAuthConfig;
+  };
 }
 
-declare type UserDataDefault = any;
-
-declare type ValidatedAuth0OAuthOptions = z.infer<
-  typeof mcpAuth0OAuthOptionsSchema
->;
-
-declare type ValidatedClerkOAuthOptions = z.infer<
-  typeof mcpClerkOAuthOptionsSchema
->;
-
-declare type ValidatedCognitoOAuthOptions = z.infer<
-  typeof mcpCognitoOAuthOptionsSchema
->;
-
-declare type ValidatedEntraOAuthOptions = z.infer<
-  typeof mcpEntraOAuthOptionsSchema
->;
-
-declare type ValidatedGoogleOAuthOptions = z.infer<
-  typeof mcpGoogleOAuthOptionsSchema
->;
-
-declare type ValidatedKeycloakOAuthOptions = z.infer<
-  typeof mcpKeycloakOAuthOptionsSchema
->;
+/**
+ * Resolved upstream OAuth client registration: dynamic registration
+ * (`auto`) or a pre-registered client (`manual`).
+ */
+declare type UpstreamOAuthClientRegistrationConfig =
+  | {
+      mode: "auto";
+    }
+  | {
+      mode: "manual";
+      clientId: string;
+      clientSecret?: string;
+      tokenEndpointAuthMethod:
+        | "none"
+        | "client_secret_basic"
+        | "client_secret_post";
+    };
 
-declare type ValidatedLogtoOAuthOptions = z.infer<
-  typeof mcpLogtoOAuthOptionsSchema
->;
+/**
+ * Resolved upstream OAuth profile configuration (scopes, prompt override,
+ * client registration, and the gateway-derived redirect path).
+ */
+declare interface UpstreamOAuthConfig {
+  scopes: string[];
+  scopeDelimiter: string;
+  prompt?: UpstreamOAuthPromptOverride;
+  clientRegistration: UpstreamOAuthClientRegistrationConfig;
+  redirectPath: string;
+}
 
-declare type ValidatedOktaOAuthOptions = z.infer<
-  typeof mcpOktaOAuthOptionsSchema
->;
+/**
+ * Overrides the OIDC `prompt` parameter on upstream authorization requests.
+ * See {@link upstreamOAuthPromptOverrideSchema} for semantics.
+ */
+declare type UpstreamOAuthPromptOverride =
+  | "none"
+  | "login"
+  | "consent"
+  | "select_account"
+  | false
+  | undefined;
 
-declare type ValidatedOneLoginOAuthOptions = z.infer<
-  typeof mcpOneLoginOAuthOptionsSchema
->;
+/**
+ * Upstream MCP server implementation metadata (MCP `Implementation` shape).
+ */
+declare interface UpstreamServerInfo {
+  name: string;
+  title?: string;
+  version: string;
+  websiteUrl?: string;
+  description?: string;
+  icons?: {
+    src: string;
+    mimeType?: string;
+    sizes?: string[];
+    theme?: "light" | "dark";
+  }[];
+}
 
-declare type ValidatedOptions = z.infer<
-  typeof mcpCapabilityFilterOptionsSchema
->;
+/**
+ * Validated options of the MCP token exchange policy — a fully-resolved
+ * upstream MCP connection. This is the public shape exposed on the policy
+ * class; it is identical to {@link ResolvedUpstreamTokenExchangePolicyOptions}
+ * except that the internal `UpstreamServerId` brand on `id` is widened to a
+ * plain `string`.
+ */
+declare interface UpstreamTokenExchangePolicyOptions {
+  id: string;
+  displayName: string;
+  description?: string;
+  serverInfo?: UpstreamServerInfo;
+  protectedResourceMetadataUrl?: string;
+  authMode: "shared-oauth" | "user-oauth" | "id-jag";
+  ownerMode: "user" | "shared";
+  authConfig: ResolvedUpstreamAuthConfig;
+}
 
-declare type ValidatedPingOAuthOptions = z.infer<
-  typeof mcpPingOAuthOptionsSchema
->;
+declare interface UrlConfig {
+  defaultUrl: string;
+  urls: string[];
+}
 
-declare type ValidatedWorkosOAuthOptions = z.infer<
-  typeof mcpWorkosOAuthOptionsSchema
->;
+declare type UserDataDefault = any;
 
 /**
  * @public