zuplo 6.70.66 → 6.70.67

package/docs/policies/akamai-ai-firewall/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/akamai-ai-firewall.json",
   "type": "object",
   "title": "Akamai AI Firewall",
   "isDeprecated": false,

package/docs/policies/akamai-firewall-for-ai-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/akamai-firewall-for-ai-inbound.json",
   "type": "object",
   "title": "Akamai Firewall for AI",
   "isDeprecated": false,

package/docs/policies/akamai-firewall-for-ai-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/akamai-firewall-for-ai-outbound.json",
   "type": "object",
   "title": "Akamai Firewall for AI",
   "isDeprecated": false,

package/docs/policies/amberflo-metering-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/amberflo-metering-inbound.json",
   "type": "object",
   "title": "Amberflo Metering / Billing",
   "isDeprecated": false,

package/docs/policies/api-key-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/api-key-inbound.json",
   "type": "object",
   "title": "API Key Authentication",
   "isDeprecated": false,

package/docs/policies/audit-log-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/audit-log-inbound.json",
   "type": "object",
   "title": "Audit Logs",
   "isDeprecated": false,

package/docs/policies/auth0-jwt-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/auth0-jwt-auth-inbound.json",
   "type": "object",
   "title": "Auth0 JWT Auth",
   "isDeprecated": false,

package/docs/policies/authzen-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/authzen-inbound.json",
   "type": "object",
   "title": "AuthZEN Authorization",
   "isDeprecated": false,

package/docs/policies/axiomatics-authz-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/axiomatics-authz-inbound.json",
   "type": "object",
   "title": "Axiomatics Authorization",
   "isDeprecated": false,

package/docs/policies/basic-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/basic-auth-inbound.json",
   "type": "object",
   "title": "Basic Auth",
   "isDeprecated": false,

package/docs/policies/bot-detection-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/bot-detection-inbound.json",
   "type": "object",
   "title": "Bot Detection",
   "isDeprecated": false,

package/docs/policies/brownout-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/brownout-inbound.json",
   "type": "object",
   "title": "Brown Out",
   "isDeprecated": false,

package/docs/policies/caching-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/caching-inbound.json",
   "type": "object",
   "title": "Caching",
   "isDeprecated": false,

package/docs/policies/change-method-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/change-method-inbound.json",
   "type": "object",
   "title": "Change Method",
   "isDeprecated": false,

package/docs/policies/clear-headers-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/clear-headers-inbound.json",
   "type": "object",
   "title": "Clear Request Headers",
   "isDeprecated": false,

package/docs/policies/clear-headers-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/clear-headers-outbound.json",
   "type": "object",
   "title": "Clear Response Headers",
   "isDeprecated": false,

package/docs/policies/clerk-jwt-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/clerk-jwt-auth-inbound.json",
   "type": "object",
   "title": "Clerk JWT Auth",
   "isDeprecated": false,

package/docs/policies/cognito-jwt-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/cognito-jwt-auth-inbound.json",
   "type": "object",
   "title": "AWS Cognito JWT Auth",
   "isDeprecated": false,

package/docs/policies/comet-opik-tracing-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/comet-opik-tracing-inbound.json",
   "type": "object",
   "title": "Comet Opik Tracing",
   "isDeprecated": false,

package/docs/policies/complex-rate-limit-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/complex-rate-limit-inbound.json",
   "type": "object",
   "title": "Complex Rate Limiting",
   "isDeprecated": false,

package/docs/policies/composite-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/composite-inbound.json",
   "type": "object",
   "title": "Composite Inbound (Group Policies)",
   "isDeprecated": false,

package/docs/policies/composite-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/composite-outbound.json",
   "type": "object",
   "title": "Composite Outbound (Group Policies)",
   "isDeprecated": false,

package/docs/policies/curity-phantom-token-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/curity-phantom-token-inbound.json",
   "type": "object",
   "title": "Curity Phantom Token Auth",
   "isDeprecated": false,

package/docs/policies/firebase-jwt-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/firebase-jwt-inbound.json",
   "type": "object",
   "title": "Firebase JWT Auth",
   "isDeprecated": false,

package/docs/policies/formdata-to-json-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/formdata-to-json-inbound.json",
   "type": "object",
   "title": "Form Data to JSON",
   "isDeprecated": false,

package/docs/policies/galileo-tracing-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/galileo-tracing-inbound.json",
   "type": "object",
   "title": "Galileo Tracing",
   "isDeprecated": false,

package/docs/policies/geo-filter-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/geo-filter-inbound.json",
   "type": "object",
   "title": "Geo-location filtering",
   "isDeprecated": false,

package/docs/policies/graphql-complexity-limit-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/graphql/schemas/graphql-complexity-limit-inbound.json",
   "type": "object",
   "title": "GraphQL Complexity Limit",
   "isDeprecated": false,

package/docs/policies/graphql-disable-introspection-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/graphql/schemas/graphql-disable-introspection-inbound.json",
   "type": "object",
   "title": "GraphQL Disable Introspection",
   "isDeprecated": false,

package/docs/policies/graphql-introspection-filter-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/graphql/schemas/graphql-introspection-filter-outbound.json",
   "type": "object",
   "title": "GraphQL Introspection Filter",
   "isDeprecated": false,

package/docs/policies/http-deprecation-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/http-deprecation-outbound.json",
   "type": "object",
   "title": "HTTP Deprecation",
   "isDeprecated": false,

package/docs/policies/jwt-scopes-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/jwt-scopes-inbound.json",
   "type": "object",
   "title": "JWT Scope Validation",
   "isDeprecated": false,

package/docs/policies/ldap-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/ldap-auth-inbound.json",
   "type": "object",
   "title": "LDAP Auth",
   "isDeprecated": false,

package/docs/policies/mcp-auth0-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-auth0-oauth-inbound.json",
   "type": "object",
   "title": "MCP Auth0 OAuth",
   "isDeprecated": false,
@@ -83,6 +83,81 @@
                 }
               }
             },
+            "idJag": {
+              "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
+              "oneOf": [
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["enabled"],
+                  "properties": {
+                    "enabled": {
+                      "const": false,
+                      "description": "Disable ID-JAG support."
+                    }
+                  }
+                },
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["enabled", "trustedIssuers"],
+                  "properties": {
+                    "enabled": {
+                      "const": true,
+                      "description": "Enable ID-JAG support."
+                    },
+                    "trustedIssuers": {
+                      "type": "array",
+                      "minItems": 1,
+                      "description": "Trusted ID-JAG issuers. These values are never published in OAuth metadata.",
+                      "items": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": ["issuer", "jwksUrl"],
+                        "properties": {
+                          "issuer": {
+                            "type": "string",
+                            "format": "uri",
+                            "description": "Exact issuer URL expected in the ID-JAG iss claim."
+                          },
+                          "jwksUrl": {
+                            "type": "string",
+                            "format": "uri",
+                            "description": "JWKS URL used to verify ID-JAG signatures from this issuer."
+                          },
+                          "expectedClientIds": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1
+                            },
+                            "description": "Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client."
+                          },
+                          "subjectMapping": {
+                            "type": "string",
+                            "enum": [
+                              "iss_prefix",
+                              "iss_tenant_prefix",
+                              "sub_id_only"
+                            ],
+                            "default": "iss_prefix",
+                            "description": "How the ID-JAG subject is mapped into the gateway subject ID."
+                          }
+                        }
+                      }
+                    },
+                    "authorizationDetailsTypesAllowed": {
+                      "type": "array",
+                      "items": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "description": "Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs."
+                    }
+                  }
+                }
+              ]
+            },
             "browserLoginOverrides": {
               "type": "object",
               "description": "Optional overrides for the derived browser-login settings.",

package/docs/policies/mcp-capability-filter-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-capability-filter-inbound.json",
   "type": "object",
   "title": "MCP Capability Filter",
   "isDeprecated": false,

package/docs/policies/mcp-clerk-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-clerk-oauth-inbound.json",
   "type": "object",
   "title": "MCP Clerk OAuth",
   "isDeprecated": false,

package/docs/policies/mcp-cognito-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-cognito-oauth-inbound.json",
   "type": "object",
   "title": "MCP Amazon Cognito OAuth",
   "isDeprecated": false,

package/docs/policies/mcp-entra-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-entra-oauth-inbound.json",
   "type": "object",
   "title": "MCP Microsoft Entra OAuth",
   "isDeprecated": false,

package/docs/policies/mcp-google-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-google-oauth-inbound.json",
   "type": "object",
   "title": "MCP Google OAuth",
   "isDeprecated": false,

package/docs/policies/mcp-keycloak-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-keycloak-oauth-inbound.json",
   "type": "object",
   "title": "MCP Keycloak OAuth",
   "isDeprecated": false,

package/docs/policies/mcp-logto-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-logto-oauth-inbound.json",
   "type": "object",
   "title": "MCP Logto OAuth",
   "isDeprecated": false,

package/docs/policies/mcp-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-oauth-inbound.json",
   "type": "object",
   "title": "MCP OAuth",
   "isDeprecated": false,
@@ -141,6 +141,81 @@
                   "description": "Whether to advertise client\\_id\\_metadata\\_document\\_supported in AS metadata."
                 }
               }
+            },
+            "idJag": {
+              "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
+              "oneOf": [
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["enabled"],
+                  "properties": {
+                    "enabled": {
+                      "const": false,
+                      "description": "Disable ID-JAG support."
+                    }
+                  }
+                },
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["enabled", "trustedIssuers"],
+                  "properties": {
+                    "enabled": {
+                      "const": true,
+                      "description": "Enable ID-JAG support."
+                    },
+                    "trustedIssuers": {
+                      "type": "array",
+                      "minItems": 1,
+                      "description": "Trusted ID-JAG issuers. These values are never published in OAuth metadata.",
+                      "items": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": ["issuer", "jwksUrl"],
+                        "properties": {
+                          "issuer": {
+                            "type": "string",
+                            "format": "uri",
+                            "description": "Exact issuer URL expected in the ID-JAG iss claim."
+                          },
+                          "jwksUrl": {
+                            "type": "string",
+                            "format": "uri",
+                            "description": "JWKS URL used to verify ID-JAG signatures from this issuer."
+                          },
+                          "expectedClientIds": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1
+                            },
+                            "description": "Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client."
+                          },
+                          "subjectMapping": {
+                            "type": "string",
+                            "enum": [
+                              "iss_prefix",
+                              "iss_tenant_prefix",
+                              "sub_id_only"
+                            ],
+                            "default": "iss_prefix",
+                            "description": "How the ID-JAG subject is mapped into the gateway subject ID."
+                          }
+                        }
+                      }
+                    },
+                    "authorizationDetailsTypesAllowed": {
+                      "type": "array",
+                      "items": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "description": "Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs."
+                    }
+                  }
+                }
+              ]
             }
           }
         }

package/docs/policies/mcp-okta-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-okta-oauth-inbound.json",
   "type": "object",
   "title": "MCP Okta OAuth",
   "isDeprecated": false,

package/docs/policies/mcp-onelogin-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-onelogin-oauth-inbound.json",
   "type": "object",
   "title": "MCP OneLogin OAuth",
   "isDeprecated": false,

package/docs/policies/mcp-ping-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-ping-oauth-inbound.json",
   "type": "object",
   "title": "MCP Ping OAuth",
   "isDeprecated": false,

package/docs/policies/mcp-token-exchange-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-token-exchange-inbound.json",
   "type": "object",
   "title": "MCP Token Exchange",
   "isDeprecated": false,

package/docs/policies/mcp-workos-oauth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mcp-workos-oauth-inbound.json",
   "type": "object",
   "title": "MCP WorkOS OAuth",
   "isDeprecated": false,

package/docs/policies/mock-api-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mock-api-inbound.json",
   "type": "object",
   "title": "Mock API Response",
   "isDeprecated": false,

package/docs/policies/moesif-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/moesif-inbound.json",
   "type": "object",
   "title": "Moesif Analytics & Billing",
   "isDeprecated": false,

package/docs/policies/monetization-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/monetization-inbound.json",
   "type": "object",
   "title": "Monetization",
   "isDeprecated": false,

package/docs/policies/mtls-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/mtls-auth-inbound.json",
   "type": "object",
   "title": "mTLS Auth",
   "isDeprecated": false,

package/docs/policies/okta-fga-authz-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/okta-fga-authz-inbound.json",
   "type": "object",
   "title": "Okta FGA Authorization",
   "isDeprecated": false,

package/docs/policies/okta-jwt-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/okta-jwt-auth-inbound.json",
   "type": "object",
   "title": "Okta JWT Auth",
   "isDeprecated": false,

package/docs/policies/open-id-jwt-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/open-id-jwt-auth-inbound.json",
   "type": "object",
   "title": "JWT Auth",
   "isDeprecated": false,

package/docs/policies/openfga-authz-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/openfga-authz-inbound.json",
   "type": "object",
   "title": "OpenFGA Authorization",
   "isDeprecated": false,

package/docs/policies/openmeter-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/openmeter-inbound.json",
   "type": "object",
   "title": "OpenMeter",
   "isDeprecated": false,

package/docs/policies/prompt-injection-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/prompt-injection-outbound.json",
   "type": "object",
   "title": "Prompt Injection Detection",
   "isDeprecated": false,

package/docs/policies/propel-auth-jwt-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/propel-auth-jwt-inbound.json",
   "type": "object",
   "title": "PropelAuth JWT Auth",
   "isDeprecated": false,

package/docs/policies/query-param-to-header-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/query-param-to-header-inbound.json",
   "type": "object",
   "title": "Query Parameter to Header",
   "isDeprecated": false,

package/docs/policies/quota-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/quota-inbound.json",
   "type": "object",
   "title": "Quota",
   "isDeprecated": false,

package/docs/policies/rate-limit-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/rate-limit-inbound.json",
   "type": "object",
   "title": "Rate Limiting",
   "isDeprecated": false,

package/docs/policies/readme-metrics-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/readme-metrics-inbound.json",
   "type": "object",
   "title": "Readme Metrics",
   "isDeprecated": false,

package/docs/policies/remove-headers-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/remove-headers-inbound.json",
   "type": "object",
   "title": "Remove Request Headers",
   "isDeprecated": false,

package/docs/policies/remove-headers-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/remove-headers-outbound.json",
   "type": "object",
   "title": "Remove Response Headers",
   "isDeprecated": false,

package/docs/policies/remove-query-params-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/remove-query-params-inbound.json",
   "type": "object",
   "title": "Remove Query Parameters",
   "isDeprecated": false,

package/docs/policies/replace-string-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/replace-string-outbound.json",
   "type": "object",
   "title": "Replace String in Response Body",
   "isDeprecated": false,

package/docs/policies/request-size-limit-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/request-size-limit-inbound.json",
   "type": "object",
   "title": "Request Size Limit",
   "isDeprecated": false,

package/docs/policies/request-validation-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/request-validation-inbound.json",
   "type": "object",
   "title": "Request Validation",
   "isDeprecated": false,

package/docs/policies/require-origin-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/require-origin-inbound.json",
   "type": "object",
   "title": "Require Origin",
   "isDeprecated": false,

package/docs/policies/secret-masking-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/secret-masking-outbound.json",
   "type": "object",
   "title": "Secret Masking",
   "isDeprecated": false,

package/docs/policies/semantic-cache-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/semantic-cache-inbound.json",
   "type": "object",
   "title": "Semantic Cache",
   "isDeprecated": false,

package/docs/policies/set-body-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/set-body-inbound.json",
   "type": "object",
   "title": "Set Body",
   "isDeprecated": false,

package/docs/policies/set-headers-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/set-headers-inbound.json",
   "type": "object",
   "title": "Add or Set Request Headers",
   "isDeprecated": false,

package/docs/policies/set-headers-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/set-headers-outbound.json",
   "type": "object",
   "title": "Set Headers",
   "isDeprecated": false,

package/docs/policies/set-query-params-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/set-query-params-inbound.json",
   "type": "object",
   "title": "Add or Set Query Parameters",
   "isDeprecated": false,

package/docs/policies/set-status-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/set-status-outbound.json",
   "type": "object",
   "title": "Set Status Code",
   "isDeprecated": false,

package/docs/policies/set-upstream-api-key-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/set-upstream-api-key-inbound.json",
   "type": "object",
   "title": "Set Upstream API Key",
   "isDeprecated": false,

package/docs/policies/sleep-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/sleep-inbound.json",
   "type": "object",
   "title": "Sleep / Delay",
   "isDeprecated": false,

package/docs/policies/stripe-webhook-verification-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/stripe-webhook-verification-inbound.json",
   "type": "object",
   "title": "Stripe Webhook Auth",
   "isDeprecated": false,

package/docs/policies/supabase-jwt-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/supabase-jwt-auth-inbound.json",
   "type": "object",
   "title": "Supabase JWT Auth",
   "isDeprecated": false,

package/docs/policies/upstream-azure-ad-service-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-azure-ad-service-auth-inbound.json",
   "type": "object",
   "title": "Upstream Azure AD Service Auth",
   "isDeprecated": false,

package/docs/policies/upstream-firebase-admin-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-firebase-admin-auth-inbound.json",
   "type": "object",
   "title": "Upstream Firebase Admin Auth",
   "isDeprecated": false,

package/docs/policies/upstream-firebase-user-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-firebase-user-auth-inbound.json",
   "type": "object",
   "title": "Upstream Firebase User Auth",
   "isDeprecated": false,

package/docs/policies/upstream-gcp-federated-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-gcp-federated-auth-inbound.json",
   "type": "object",
   "title": "Upstream GCP Federated Auth",
   "isDeprecated": false,

package/docs/policies/upstream-gcp-jwt-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-gcp-jwt-inbound.json",
   "type": "object",
   "title": "Upstream GCP Self-Signed JWT",
   "isDeprecated": false,

package/docs/policies/upstream-gcp-service-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-gcp-service-auth-inbound.json",
   "type": "object",
   "title": "Upstream GCP Service Auth",
   "isDeprecated": false,

package/docs/policies/upstream-zuplo-jwt-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/upstream-zuplo-jwt-auth-inbound.json",
   "type": "object",
   "title": "Upstream Zuplo JWT",
   "isDeprecated": false,

package/docs/policies/validate-json-schema-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/validate-json-schema-inbound.json",
   "type": "object",
   "title": "JSON Body Validation",
   "isDeprecated": true,

package/docs/policies/web-bot-auth-inbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/web-bot-auth-inbound.json",
   "type": "object",
   "title": "Web Bot Auth",
   "isDeprecated": false,

package/docs/policies/xml-to-json-outbound/schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/auth0-jwt-auth-inbound.json",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/xml-to-json-outbound.json",
   "type": "object",
   "title": "XML to JSON",
   "isDeprecated": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zuplo",
-  "version": "6.70.66",
+  "version": "6.70.67",
   "type": "module",
   "description": "The programmable API Gateway",
   "author": "Zuplo, Inc.",
@@ -19,9 +19,9 @@
     "zuplo": "zuplo.js"
   },
   "dependencies": {
-    "@zuplo/cli": "6.70.66",
-    "@zuplo/core": "6.70.66",
-    "@zuplo/runtime": "6.70.66",
+    "@zuplo/cli": "6.70.67",
+    "@zuplo/core": "6.70.67",
+    "@zuplo/runtime": "6.70.67",
     "@zuplo/test": "1.4.0"
   }
 }