// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

import { APIResource } from '../../../../../core/resource';
import { APIPromise } from '../../../../../core/api-promise';
import {
  PagePromise,
  V4PagePaginationArray,
  type V4PagePaginationArrayParams,
} from '../../../../../core/pagination';
import { RequestOptions } from '../../../../../internal/request-options';
import { path } from '../../../../../internal/utils/path';

export class BaseServers extends APIResource {
  static override readonly _key: readonly ['zeroTrust', 'access', 'aiControls', 'mcp', 'servers'] =
    Object.freeze(['zeroTrust', 'access', 'aiControls', 'mcp', 'servers'] as const);

  /**
   * Creates a new MCP server for connecting to an upstream MCP endpoint.
   *
   * @example
   * ```ts
   * const server =
   *   await client.zeroTrust.access.aiControls.mcp.servers.create(
   *     {
   *       account_id: 'a86a8f5c339544d7bdc89926de14fb8c',
   *       id: 'my-mcp-server',
   *       auth_type: 'unauthenticated',
   *       hostname: 'https://example.com/mcp',
   *       name: 'My MCP Server',
   *     },
   *   );
   * ```
   */
  create(params: ServerCreateParams, options?: RequestOptions): APIPromise<ServerCreateResponse> {
    const { account_id, ...body } = params;
    return (
      this._client.post(path`/accounts/${account_id}/access/ai-controls/mcp/servers`, {
        body,
        ...options,
      }) as APIPromise<{ result: ServerCreateResponse }>
    )._thenUnwrap((obj) => obj.result);
  }

  /**
   * Updates an MCP server's configuration and credentials.
   *
   * @example
   * ```ts
   * const server =
   *   await client.zeroTrust.access.aiControls.mcp.servers.update(
   *     'my-mcp-server',
   *     { account_id: 'a86a8f5c339544d7bdc89926de14fb8c' },
   *   );
   * ```
   */
  update(id: string, params: ServerUpdateParams, options?: RequestOptions): APIPromise<ServerUpdateResponse> {
    const { account_id, ...body } = params;
    return (
      this._client.put(path`/accounts/${account_id}/access/ai-controls/mcp/servers/${id}`, {
        body,
        ...options,
      }) as APIPromise<{ result: ServerUpdateResponse }>
    )._thenUnwrap((obj) => obj.result);
  }

  /**
   * Lists all MCP servers configured for the account.
   *
   * @example
   * ```ts
   * // Automatically fetches more pages as needed.
   * for await (const serverListResponse of client.zeroTrust.access.aiControls.mcp.servers.list(
   *   { account_id: 'a86a8f5c339544d7bdc89926de14fb8c' },
   * )) {
   *   // ...
   * }
   * ```
   */
  list(
    params: ServerListParams,
    options?: RequestOptions,
  ): PagePromise<ServerListResponsesV4PagePaginationArray, ServerListResponse> {
    const { account_id, ...query } = params;
    return this._client.getAPIList(
      path`/accounts/${account_id}/access/ai-controls/mcp/servers`,
      V4PagePaginationArray<ServerListResponse>,
      { query, ...options },
    );
  }

  /**
   * Deletes an MCP server from the account.
   *
   * @example
   * ```ts
   * const server =
   *   await client.zeroTrust.access.aiControls.mcp.servers.delete(
   *     'my-mcp-server',
   *     { account_id: 'a86a8f5c339544d7bdc89926de14fb8c' },
   *   );
   * ```
   */
  delete(id: string, params: ServerDeleteParams, options?: RequestOptions): APIPromise<ServerDeleteResponse> {
    const { account_id } = params;
    return (
      this._client.delete(
        path`/accounts/${account_id}/access/ai-controls/mcp/servers/${id}`,
        options,
      ) as APIPromise<{ result: ServerDeleteResponse }>
    )._thenUnwrap((obj) => obj.result);
  }

  /**
   * Retrieves an MCP server's configuration and capability sync state.
   *
   * @example
   * ```ts
   * const response =
   *   await client.zeroTrust.access.aiControls.mcp.servers.read(
   *     'my-mcp-server',
   *     { account_id: 'a86a8f5c339544d7bdc89926de14fb8c' },
   *   );
   * ```
   */
  read(id: string, params: ServerReadParams, options?: RequestOptions): APIPromise<ServerReadResponse> {
    const { account_id } = params;
    return (
      this._client.get(
        path`/accounts/${account_id}/access/ai-controls/mcp/servers/${id}`,
        options,
      ) as APIPromise<{ result: ServerReadResponse }>
    )._thenUnwrap((obj) => obj.result);
  }

  /**
   * Syncs an MCP server's capabilities and returns the updated server state,
   * including any connection errors.
   *
   * @example
   * ```ts
   * const response =
   *   await client.zeroTrust.access.aiControls.mcp.servers.sync(
   *     'my-mcp-server',
   *     { account_id: 'a86a8f5c339544d7bdc89926de14fb8c' },
   *   );
   * ```
   */
  sync(id: string, params: ServerSyncParams, options?: RequestOptions): APIPromise<ServerSyncResponse> {
    const { account_id } = params;
    return (
      this._client.post(
        path`/accounts/${account_id}/access/ai-controls/mcp/servers/${id}/sync`,
        options,
      ) as APIPromise<{ result: ServerSyncResponse }>
    )._thenUnwrap((obj) => obj.result);
  }
}
export class Servers extends BaseServers {}

export type ServerListResponsesV4PagePaginationArray = V4PagePaginationArray<ServerListResponse>;

export interface ServerCreateResponse {
  /**
   * Unique identifier for the MCP server.
   */
  id: string;

  /**
   * Authentication method used to connect to the upstream MCP server.
   */
  auth_type: 'oauth' | 'bearer' | 'unauthenticated';

  /**
   * URL of the upstream MCP endpoint.
   */
  hostname: string;

  /**
   * Display name for the MCP server.
   */
  name: string;

  prompts: Array<{ [key: string]: unknown }>;

  tools: Array<{ [key: string]: unknown }>;

  /**
   * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
   * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
   * endpoints + client_id for manual servers. Never includes the secret value.
   */
  auth_config_summary?: ServerCreateResponse.AuthConfigSummary;

  /**
   * Whether administrative authentication is required before capabilities can be
   * synced. Manual OAuth is user-managed and has no administrative authentication
   * flow.
   */
  authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';

  created_at?: string;

  created_by?: string;

  /**
   * Optional description of the MCP server.
   */
  description?: string | null;

  error?: string;

  error_details?: ServerCreateResponse.ErrorDetails;

  /**
   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
   * customer portal hostname. Defaults to false (off); opt in per server by setting
   * true.
   */
  is_shared_oauth_callback_enabled?: boolean;

  last_successful_sync?: string;

  last_synced?: string;

  modified_at?: string;

  modified_by?: string;

  /**
   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
   */
  secure_web_gateway?: boolean;

  /**
   * Current sync state of the server
   */
  status?: 'waiting' | 'ready' | 'stale' | 'error';

  /**
   * Server-wide prompt capability overrides.
   */
  updated_prompts?: Array<ServerCreateResponse.UpdatedPrompt>;

  /**
   * Server-wide tool capability overrides.
   */
  updated_tools?: Array<ServerCreateResponse.UpdatedTool>;
}

export namespace ServerCreateResponse {
  /**
   * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
   * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
   * endpoints + client_id for manual servers. Never includes the secret value.
   */
  export interface AuthConfigSummary {
    auth_mode?: 'dcr' | 'manual';

    client_secret_version?: number;

    config?: AuthConfigSummary.Config;

    has_client_secret?: boolean;

    registration_info?: AuthConfigSummary.RegistrationInfo;
  }

  export namespace AuthConfigSummary {
    export interface Config {
      authorization_endpoint?: string;

      issuer?: string;

      resource?: string;

      revocation_endpoint?: string;

      token_endpoint?: string;
    }

    export interface RegistrationInfo {
      client_id?: string;

      redirect_uris?: Array<string>;

      scope?: string;

      token_endpoint_auth_method?: string;
    }
  }

  export interface ErrorDetails {
    /**
     * Underlying error message
     */
    cause?: string;

    /**
     * True = MCP server returned an error. False = couldn't reach the server
     */
    is_upstream?: boolean;

    /**
     * MCP protocol error code
     */
    mcp_code?: number;

    /**
     * Whether the error is transient and worth retrying
     */
    retryable?: boolean;

    /**
     * HTTP status code from the server
     */
    status_code?: number;
  }

  export interface UpdatedPrompt {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }

  export interface UpdatedTool {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }
}

export interface ServerUpdateResponse {
  /**
   * Unique identifier for the MCP server.
   */
  id: string;

  /**
   * Authentication method used to connect to the upstream MCP server.
   */
  auth_type: 'oauth' | 'bearer' | 'unauthenticated';

  /**
   * URL of the upstream MCP endpoint.
   */
  hostname: string;

  /**
   * Display name for the MCP server.
   */
  name: string;

  prompts: Array<{ [key: string]: unknown }>;

  tools: Array<{ [key: string]: unknown }>;

  /**
   * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
   * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
   * endpoints + client_id for manual servers. Never includes the secret value.
   */
  auth_config_summary?: ServerUpdateResponse.AuthConfigSummary;

  /**
   * Whether administrative authentication is required before capabilities can be
   * synced. Manual OAuth is user-managed and has no administrative authentication
   * flow.
   */
  authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';

  created_at?: string;

  created_by?: string;

  /**
   * Optional description of the MCP server.
   */
  description?: string | null;

  error?: string;

  error_details?: ServerUpdateResponse.ErrorDetails;

  /**
   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
   * customer portal hostname. Defaults to false (off); opt in per server by setting
   * true.
   */
  is_shared_oauth_callback_enabled?: boolean;

  last_successful_sync?: string;

  last_synced?: string;

  modified_at?: string;

  modified_by?: string;

  /**
   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
   */
  secure_web_gateway?: boolean;

  /**
   * Current sync state of the server
   */
  status?: 'waiting' | 'ready' | 'stale' | 'error';

  /**
   * Server-wide prompt capability overrides.
   */
  updated_prompts?: Array<ServerUpdateResponse.UpdatedPrompt>;

  /**
   * Server-wide tool capability overrides.
   */
  updated_tools?: Array<ServerUpdateResponse.UpdatedTool>;
}

export namespace ServerUpdateResponse {
  /**
   * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
   * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
   * endpoints + client_id for manual servers. Never includes the secret value.
   */
  export interface AuthConfigSummary {
    auth_mode?: 'dcr' | 'manual';

    client_secret_version?: number;

    config?: AuthConfigSummary.Config;

    has_client_secret?: boolean;

    registration_info?: AuthConfigSummary.RegistrationInfo;
  }

  export namespace AuthConfigSummary {
    export interface Config {
      authorization_endpoint?: string;

      issuer?: string;

      resource?: string;

      revocation_endpoint?: string;

      token_endpoint?: string;
    }

    export interface RegistrationInfo {
      client_id?: string;

      redirect_uris?: Array<string>;

      scope?: string;

      token_endpoint_auth_method?: string;
    }
  }

  export interface ErrorDetails {
    /**
     * Underlying error message
     */
    cause?: string;

    /**
     * True = MCP server returned an error. False = couldn't reach the server
     */
    is_upstream?: boolean;

    /**
     * MCP protocol error code
     */
    mcp_code?: number;

    /**
     * Whether the error is transient and worth retrying
     */
    retryable?: boolean;

    /**
     * HTTP status code from the server
     */
    status_code?: number;
  }

  export interface UpdatedPrompt {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }

  export interface UpdatedTool {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }
}

export interface ServerListResponse {
  /**
   * Unique identifier for the MCP server.
   */
  id: string;

  /**
   * Authentication method used to connect to the upstream MCP server.
   */
  auth_type: 'oauth' | 'bearer' | 'unauthenticated';

  /**
   * URL of the upstream MCP endpoint.
   */
  hostname: string;

  /**
   * Display name for the MCP server.
   */
  name: string;

  prompts: Array<{ [key: string]: unknown }>;

  tools: Array<{ [key: string]: unknown }>;

  /**
   * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
   * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
   * endpoints + client_id for manual servers. Never includes the secret value.
   */
  auth_config_summary?: ServerListResponse.AuthConfigSummary;

  /**
   * Whether administrative authentication is required before capabilities can be
   * synced. Manual OAuth is user-managed and has no administrative authentication
   * flow.
   */
  authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';

  created_at?: string;

  created_by?: string;

  /**
   * Optional description of the MCP server.
   */
  description?: string | null;

  error?: string;

  error_details?: ServerListResponse.ErrorDetails;

  /**
   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
   * customer portal hostname. Defaults to false (off); opt in per server by setting
   * true.
   */
  is_shared_oauth_callback_enabled?: boolean;

  last_successful_sync?: string;

  last_synced?: string;

  modified_at?: string;

  modified_by?: string;

  /**
   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
   */
  secure_web_gateway?: boolean;

  /**
   * Current sync state of the server
   */
  status?: 'waiting' | 'ready' | 'stale' | 'error';

  /**
   * Server-wide prompt capability overrides.
   */
  updated_prompts?: Array<ServerListResponse.UpdatedPrompt>;

  /**
   * Server-wide tool capability overrides.
   */
  updated_tools?: Array<ServerListResponse.UpdatedTool>;
}

export namespace ServerListResponse {
  /**
   * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
   * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
   * endpoints + client_id for manual servers. Never includes the secret value.
   */
  export interface AuthConfigSummary {
    auth_mode?: 'dcr' | 'manual';

    client_secret_version?: number;

    config?: AuthConfigSummary.Config;

    has_client_secret?: boolean;

    registration_info?: AuthConfigSummary.RegistrationInfo;
  }

  export namespace AuthConfigSummary {
    export interface Config {
      authorization_endpoint?: string;

      issuer?: string;

      resource?: string;

      revocation_endpoint?: string;

      token_endpoint?: string;
    }

    export interface RegistrationInfo {
      client_id?: string;

      redirect_uris?: Array<string>;

      scope?: string;

      token_endpoint_auth_method?: string;
    }
  }

  export interface ErrorDetails {
    /**
     * Underlying error message
     */
    cause?: string;

    /**
     * True = MCP server returned an error. False = couldn't reach the server
     */
    is_upstream?: boolean;

    /**
     * MCP protocol error code
     */
    mcp_code?: number;

    /**
     * Whether the error is transient and worth retrying
     */
    retryable?: boolean;

    /**
     * HTTP status code from the server
     */
    status_code?: number;
  }

  export interface UpdatedPrompt {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }

  export interface UpdatedTool {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }
}

export interface ServerDeleteResponse {
  /**
   * Unique identifier for the MCP server.
   */
  id: string;

  /**
   * Authentication method used to connect to the upstream MCP server.
   */
  auth_type: 'oauth' | 'bearer' | 'unauthenticated';

  /**
   * URL of the upstream MCP endpoint.
   */
  hostname: string;

  /**
   * Display name for the MCP server.
   */
  name: string;

  prompts: Array<{ [key: string]: unknown }>;

  tools: Array<{ [key: string]: unknown }>;

  /**
   * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
   * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
   * endpoints + client_id for manual servers. Never includes the secret value.
   */
  auth_config_summary?: ServerDeleteResponse.AuthConfigSummary;

  /**
   * Whether administrative authentication is required before capabilities can be
   * synced. Manual OAuth is user-managed and has no administrative authentication
   * flow.
   */
  authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';

  created_at?: string;

  created_by?: string;

  /**
   * Optional description of the MCP server.
   */
  description?: string | null;

  error?: string;

  error_details?: ServerDeleteResponse.ErrorDetails;

  /**
   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
   * customer portal hostname. Defaults to false (off); opt in per server by setting
   * true.
   */
  is_shared_oauth_callback_enabled?: boolean;

  last_successful_sync?: string;

  last_synced?: string;

  modified_at?: string;

  modified_by?: string;

  /**
   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
   */
  secure_web_gateway?: boolean;

  /**
   * Current sync state of the server
   */
  status?: 'waiting' | 'ready' | 'stale' | 'error';

  /**
   * Server-wide prompt capability overrides.
   */
  updated_prompts?: Array<ServerDeleteResponse.UpdatedPrompt>;

  /**
   * Server-wide tool capability overrides.
   */
  updated_tools?: Array<ServerDeleteResponse.UpdatedTool>;
}

export namespace ServerDeleteResponse {
  /**
   * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
   * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
   * endpoints + client_id for manual servers. Never includes the secret value.
   */
  export interface AuthConfigSummary {
    auth_mode?: 'dcr' | 'manual';

    client_secret_version?: number;

    config?: AuthConfigSummary.Config;

    has_client_secret?: boolean;

    registration_info?: AuthConfigSummary.RegistrationInfo;
  }

  export namespace AuthConfigSummary {
    export interface Config {
      authorization_endpoint?: string;

      issuer?: string;

      resource?: string;

      revocation_endpoint?: string;

      token_endpoint?: string;
    }

    export interface RegistrationInfo {
      client_id?: string;

      redirect_uris?: Array<string>;

      scope?: string;

      token_endpoint_auth_method?: string;
    }
  }

  export interface ErrorDetails {
    /**
     * Underlying error message
     */
    cause?: string;

    /**
     * True = MCP server returned an error. False = couldn't reach the server
     */
    is_upstream?: boolean;

    /**
     * MCP protocol error code
     */
    mcp_code?: number;

    /**
     * Whether the error is transient and worth retrying
     */
    retryable?: boolean;

    /**
     * HTTP status code from the server
     */
    status_code?: number;
  }

  export interface UpdatedPrompt {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }

  export interface UpdatedTool {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }
}

export interface ServerReadResponse {
  /**
   * Unique identifier for the MCP server.
   */
  id: string;

  /**
   * Authentication method used to connect to the upstream MCP server.
   */
  auth_type: 'oauth' | 'bearer' | 'unauthenticated';

  /**
   * URL of the upstream MCP endpoint.
   */
  hostname: string;

  /**
   * Display name for the MCP server.
   */
  name: string;

  prompts: Array<{ [key: string]: unknown }>;

  tools: Array<{ [key: string]: unknown }>;

  /**
   * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
   * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
   * endpoints + client_id for manual servers. Never includes the secret value.
   */
  auth_config_summary?: ServerReadResponse.AuthConfigSummary;

  /**
   * Whether administrative authentication is required before capabilities can be
   * synced. Manual OAuth is user-managed and has no administrative authentication
   * flow.
   */
  authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';

  created_at?: string;

  created_by?: string;

  /**
   * Optional description of the MCP server.
   */
  description?: string | null;

  error?: string;

  error_details?: ServerReadResponse.ErrorDetails;

  /**
   * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
   * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
   * customer portal hostname. Defaults to false (off); opt in per server by setting
   * true.
   */
  is_shared_oauth_callback_enabled?: boolean;

  last_successful_sync?: string;

  last_synced?: string;

  modified_at?: string;

  modified_by?: string;

  /**
   * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
   */
  secure_web_gateway?: boolean;

  /**
   * Current sync state of the server
   */
  status?: 'waiting' | 'ready' | 'stale' | 'error';

  /**
   * Server-wide prompt capability overrides.
   */
  updated_prompts?: Array<ServerReadResponse.UpdatedPrompt>;

  /**
   * Server-wide tool capability overrides.
   */
  updated_tools?: Array<ServerReadResponse.UpdatedTool>;
}

export namespace ServerReadResponse {
  /**
   * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
   * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
   * endpoints + client_id for manual servers. Never includes the secret value.
   */
  export interface AuthConfigSummary {
    auth_mode?: 'dcr' | 'manual';

    client_secret_version?: number;

    config?: AuthConfigSummary.Config;

    has_client_secret?: boolean;

    registration_info?: AuthConfigSummary.RegistrationInfo;
  }

  export namespace AuthConfigSummary {
    export interface Config {
      authorization_endpoint?: string;

      issuer?: string;

      resource?: string;

      revocation_endpoint?: string;

      token_endpoint?: string;
    }

    export interface RegistrationInfo {
      client_id?: string;

      redirect_uris?: Array<string>;

      scope?: string;

      token_endpoint_auth_method?: string;
    }
  }

  export interface ErrorDetails {
    /**
     * Underlying error message
     */
    cause?: string;

    /**
     * True = MCP server returned an error. False = couldn't reach the server
     */
    is_upstream?: boolean;

    /**
     * MCP protocol error code
     */
    mcp_code?: number;

    /**
     * Whether the error is transient and worth retrying
     */
    retryable?: boolean;

    /**
     * HTTP status code from the server
     */
    status_code?: number;
  }

  export interface UpdatedPrompt {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }

  export interface UpdatedTool {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }
}

export interface ServerSyncResponse {
  error?: string;

  error_details?: ServerSyncResponse.ErrorDetails;

  status?: 'waiting' | 'ready' | 'stale' | 'error';
}

export namespace ServerSyncResponse {
  export interface ErrorDetails {
    /**
     * Underlying error message
     */
    cause?: string;

    /**
     * True = MCP server returned an error. False = couldn't reach the server
     */
    is_upstream?: boolean;

    /**
     * MCP protocol error code
     */
    mcp_code?: number;

    /**
     * Whether the error is transient and worth retrying
     */
    retryable?: boolean;

    /**
     * HTTP status code from the server
     */
    status_code?: number;
  }
}

export interface ServerCreateParams {
  /**
   * Path param
   */
  account_id: string;

  /**
   * Body param: Unique identifier for the MCP server.
   */
  id: string;

  /**
   * Body param: Authentication method used to connect to the upstream MCP server.
   */
  auth_type: 'oauth' | 'bearer' | 'unauthenticated';

  /**
   * Body param: URL of the upstream MCP endpoint.
   */
  hostname: string;

  /**
   * Body param: Display name for the MCP server.
   */
  name: string;

  /**
   * Body param: Static credential for the upstream MCP server. For auth_type
   * "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped
   * server-side as `Authorization: Bearer <token>`, or a JSON-encoded object of the
   * form `{"headers":{"Header-Name":"value",...}}` for custom or multiple static
   * headers (e.g. Cloudflare Access service tokens:
   * `{"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}`).
   */
  auth_credentials?: string;

  /**
   * Body param: Pre-registered OAuth client_secret. Write-only - accepted on
   * create/update when auth_credentials.auth_mode is 'manual'. Stored
   * AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.
   */
  client_secret?: string;

  /**
   * Body param: Optional description of the MCP server.
   */
  description?: string | null;

  /**
   * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
   * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
   * the customer portal hostname. Defaults to false (off); opt in per server by
   * setting true.
   */
  is_shared_oauth_callback_enabled?: boolean;

  /**
   * Body param: Route outbound traffic to this MCP server through Zero Trust Secure
   * Web Gateway.
   */
  secure_web_gateway?: boolean;

  /**
   * Body param: Server-wide prompt capability overrides.
   */
  updated_prompts?: Array<ServerCreateParams.UpdatedPrompt>;

  /**
   * Body param: Server-wide tool capability overrides.
   */
  updated_tools?: Array<ServerCreateParams.UpdatedTool>;
}

export namespace ServerCreateParams {
  export interface UpdatedPrompt {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }

  export interface UpdatedTool {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }
}

export interface ServerUpdateParams {
  /**
   * Path param
   */
  account_id: string;

  /**
   * Body param: Static credential for the upstream MCP server. For auth_type
   * "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped
   * server-side as `Authorization: Bearer <token>`, or a JSON-encoded object of the
   * form `{"headers":{"Header-Name":"value",...}}` for custom or multiple static
   * headers (e.g. Cloudflare Access service tokens:
   * `{"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}`).
   */
  auth_credentials?: string;

  /**
   * Body param: Pre-registered OAuth client_secret. Write-only - accepted on
   * create/update when auth_credentials.auth_mode is 'manual'. Stored
   * AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.
   */
  client_secret?: string;

  /**
   * Body param: Optional description of the MCP server.
   */
  description?: string | null;

  /**
   * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
   * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
   * the customer portal hostname. Defaults to false (off); opt in per server by
   * setting true.
   */
  is_shared_oauth_callback_enabled?: boolean;

  /**
   * Body param: Display name for the MCP server.
   */
  name?: string;

  /**
   * Body param: Route outbound traffic to this MCP server through Zero Trust Secure
   * Web Gateway.
   */
  secure_web_gateway?: boolean;

  /**
   * Body param: Server-wide prompt capability overrides.
   */
  updated_prompts?: Array<ServerUpdateParams.UpdatedPrompt>;

  /**
   * Body param: Server-wide tool capability overrides.
   */
  updated_tools?: Array<ServerUpdateParams.UpdatedTool>;
}

export namespace ServerUpdateParams {
  export interface UpdatedPrompt {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }

  export interface UpdatedTool {
    /**
     * Name of the tool or prompt capability to override.
     */
    name: string;

    /**
     * Custom name exposed for the capability.
     */
    alias?: string;

    /**
     * Custom description exposed for the capability.
     */
    description?: string;

    /**
     * Whether the capability is available through the MCP server.
     */
    enabled?: boolean;
  }
}

export interface ServerListParams extends V4PagePaginationArrayParams {
  /**
   * Path param
   */
  account_id: string;

  /**
   * Query param: Search by id, name
   */
  search?: string;
}

export interface ServerDeleteParams {
  account_id: string;
}

export interface ServerReadParams {
  account_id: string;
}

export interface ServerSyncParams {
  account_id: string;
}

export declare namespace Servers {
  export {
    type ServerCreateResponse as ServerCreateResponse,
    type ServerUpdateResponse as ServerUpdateResponse,
    type ServerListResponse as ServerListResponse,
    type ServerDeleteResponse as ServerDeleteResponse,
    type ServerReadResponse as ServerReadResponse,
    type ServerSyncResponse as ServerSyncResponse,
    type ServerListResponsesV4PagePaginationArray as ServerListResponsesV4PagePaginationArray,
    type ServerCreateParams as ServerCreateParams,
    type ServerUpdateParams as ServerUpdateParams,
    type ServerListParams as ServerListParams,
    type ServerDeleteParams as ServerDeleteParams,
    type ServerReadParams as ServerReadParams,
    type ServerSyncParams as ServerSyncParams,
  };
}