@zuplo/cli 6.72.12 → 6.72.14

package/node_modules/@zuplo/runtime/out/esm/sdks/aws/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{i as a,j as l,k as c,l as o,o as p,p as y,q as m}from"../../chunk-K77Z5PRN.js";import{a as i}from"../../chunk-DSZS6PZJ.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
+import{i as a,j as l,k as c,l as o,o as p,p as y,q as m}from"../../chunk-J6K7HSIK.js";import{a as i}from"../../chunk-DSZS6PZJ.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
 //# sourceMappingURL=index.js.map

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -27,6 +27,9 @@ export declare type AiFormat =
  * Converts Anthropic Messages API format requests to OpenAI Chat Completions format.
  * This policy translates between the two formats to allow seamless routing to different providers.
  *
+ * @deprecated Platform AI Gateway routes use native Anthropic passthrough. This
+ * policy is retained for legacy custom routes that explicitly require translation.
+ *
  * @hidden
  * @title Anthropic to OpenAI Format Translator
  * @product ai-gateway
@@ -143,6 +146,10 @@ export declare interface AIGatewayAuthInboundPolicyOptions {
  * An AI Gateway capability that can have a resolved model selection.
  *
  * @public
+ * @example
+ * ```typescript
+ * const capability: AIGatewayCapability = "completions";
+ * ```
  */
 export declare type AIGatewayCapability =
   | "completions"
@@ -153,39 +160,6 @@ export declare type AIGatewayCapability =
   | "audio_speech"
   | "audio_transcriptions";
 
-/**
- * Primary and optional fallback routing for one AI Gateway capability.
- *
- * @public
- */
-export declare interface AIGatewayCapabilityRouting {
-  /** The primary provider and model. */
-  model: AIGatewayModelRef;
-  /** The provider and model used after a retryable error or timeout. */
-  fallback?: AIGatewayFallbackRef;
-  /** The provider and model used after a usage-limit-exceeded signal. */
-  quotaFallback?: AIGatewayModelRef;
-}
-
-export declare interface AIGatewayCapabilitySelection {
-  candidates: AIGatewayModelCandidate[];
-  fallbackTimeoutSeconds?: number;
-  quotaFallback?: AIGatewayModelCandidate;
-}
-
-/**
- * A model used after a retryable primary-provider failure or timeout.
- *
- * @public
- */
-export declare interface AIGatewayFallbackRef extends AIGatewayModelRef {
-  /**
-   * Bounds the primary call before failing over. Defaults to 60 seconds and is
-   * only meaningful when a fallback is configured.
-   */
-  timeoutSeconds?: number;
-}
-
 /**
  * Handler that routes AI/LLM requests through Zuplo's LLM Translation Layer.
  * This handler forwards requests to the translation layer that handles provider-specific
@@ -214,9 +188,9 @@ export declare function aiGatewayHandler(
 
 /**
  * Routes AI requests using the model selection stored in the request context.
- * Attach the `ai-gateway-model-routing-v2-inbound` policy before this handler runs. To
- * compute routing per request, set that policy's `routingFunction` option to
- * a module export.
+ * Attach the `ai-gateway-model-routing-v2-inbound` policy before this handler
+ * runs, or call `AIGatewayModelRouting.set(context, routing)` from a custom
+ * inbound policy.
  *
  * @beta
  * @param request - The incoming AI Gateway request.
@@ -340,23 +314,23 @@ export declare interface AIGatewayMeteringInboundPolicyOptions {
   throwOnFailure?: boolean;
 }
 
-export declare interface AIGatewayModelCandidate {
-  provider: string;
-  model: string;
-  apiKey?: string;
-}
-
 /**
- * Catalog information about a model that a routing function can inspect.
- *
- * Model catalog membership does not indicate that the project has credentials
- * for the model's provider. The policy resolves credentials only after the
- * routing function returns a provider and model.
+ * Catalog information about an AI Gateway model.
  *
  * @public
+ * @example
+ * ```typescript
+ * const model: AIGatewayModelInfo = {
+ *   model: "gpt-5",
+ *   capability: "completions",
+ *   status: "active",
+ *   inputCostPerToken: 0.00000125,
+ *   outputCostPerToken: 0.00001,
+ * };
+ * ```
  */
 export declare interface AIGatewayModelInfo {
-  /** The provider-specific model identifier to return in model routing. */
+  /** The provider-specific model identifier. */
   model: string;
   /** The AI Gateway capability supported by the model. */
   capability: "completions" | "embeddings";
@@ -369,59 +343,65 @@ export declare interface AIGatewayModelInfo {
 }
 
 /**
- * Identifies a provider and model in routing configuration.
- *
- * @public
- */
-export declare interface AIGatewayModelRef {
-  /** The case-insensitive provider identifier, such as `openai`. */
-  provider: string;
-  /** The provider-specific model identifier, such as `gpt-5`. */
-  model: string;
-}
-
-/**
- * Routing returned by an {@link AIGatewayRoutingFunction}.
+ * Sets and reads the model routing selected for an AI Gateway request.
  *
- * Omitted capabilities keep no implicit value. Return `undefined` from the
- * function, rather than an empty object, to preserve the policy's static
- * routing unchanged.
+ * The built-in model-routing policy matches the request against its allowList
+ * of {@link AIGatewayRouteTarget} items, then `set()`s the winning target.
+ * Custom policies can call `set()` directly instead. Provider API keys are
+ * resolved internally and are never returned by `get()`.
  *
  * @public
+ * @example
+ * ```typescript
+ * import { AIGatewayModelRouting } from "@zuplo/runtime";
+ *
+ * await AIGatewayModelRouting.set(context, {
+ *   completions: {
+ *     main: "openai/gpt-5",
+ *     backup: "anthropic/claude-sonnet-4-6",
+ *   },
+ * });
+ * const routing = AIGatewayModelRouting.get(context);
+ * ```
  */
-export declare interface AIGatewayModelRouting {
-  /** Routing for chat completions, Responses, and Anthropic Messages. */
-  completions?: AIGatewayCapabilityRouting;
-  /** Routing for embedding requests. */
-  embeddings?: AIGatewayCapabilityRouting;
-}
+export declare const AIGatewayModelRouting: {
+  set(context: ZuploContext, routing: AIGatewayRouting): Promise<void>;
+  get(context: ZuploContext): AIGatewayRouting | undefined;
+};
 
 /**
- * Selects AI Gateway models and fallbacks for the current request's capability.
+ * Matches AI Gateway requests against curated allow lists or open block lists,
+ * then stores the winning {@link AIGatewayRouteTarget} for the route handler.
  *
  * @title AI Gateway Model Routing (v2)
  * @beta
  * @product ai-gateway
- * @hidden
  * @requiresAI
  * @param request - The ZuploRequest
  * @param context - The ZuploContext
  * @param options - The policy options set in policies.json
  * @param policyName - The name of the policy as set in policies.json
- * @returns The request with the model selection stored in context
+ * @returns The request with model routing stored in context, or a 4xx response
+ * @example
+ * ```json
+ * {
+ *   "models": {
+ *     "completions": {
+ *       "allowList": [
+ *         "openai/gpt-5",
+ *         {
+ *           "main": "anthropic/claude-sonnet-4-6",
+ *           "backup": "openai/gpt-5-mini"
+ *         }
+ *       ]
+ *     }
+ *   }
+ * }
+ * ```
  */
 export declare class AIGatewayModelRoutingV2InboundPolicy extends InboundPolicy<AIGatewayModelRoutingV2InboundPolicyOptions> {
   #private;
   static readonly policyType = "ai-gateway-model-routing-v2";
-  /* Excluded from this release type: setModelSelection */
-  /** Get the model selection for the current request. */
-  static getModelSelection(
-    context: ZuploContext
-  ): AIGatewayModelSelection | undefined;
-  /** Get the provider catalog loaded for the current request. */
-  static getProviders(
-    context: ZuploContext
-  ): AIGatewayProviderInfo[] | undefined;
   constructor(
     options: AIGatewayModelRoutingV2InboundPolicyOptions,
     policyName: string
@@ -433,27 +413,38 @@ export declare class AIGatewayModelRoutingV2InboundPolicy extends InboundPolicy<
 }
 
 /**
- * Options for per-capability AI model routing. Provider credentials are resolved from the project's AI provider configuration or environment-variable conventions.
+ * Options for allowing or blocking provider/model routes for each AI Gateway capability.
  * @public
  */
-export declare type AIGatewayModelRoutingV2InboundPolicyOptions = {
-  [k: string]: unknown;
-} & {
-  completions?: CompletionsRouting;
-  routingFunction?: RoutingFunction;
-  embeddings?: EmbeddingsRouting;
-};
-
-export declare interface AIGatewayModelSelection {
-  byCapability: Partial<
-    Record<AIGatewayCapability, AIGatewayCapabilitySelection>
-  >;
+export declare interface AIGatewayModelRoutingV2InboundPolicyOptions {
+  models: Models;
 }
 
+/**
+ * Accesses the live AI Gateway provider and model catalog.
+ *
+ * Results use the existing 60-second catalog cache. Credentials and the names
+ * of their environment-variable bindings are never returned.
+ *
+ * @public
+ * @example
+ * ```typescript
+ * import { AIGatewayModels } from "@zuplo/runtime";
+ *
+ * const providers = await AIGatewayModels.load(context);
+ * ```
+ */
+export declare const AIGatewayModels: {
+  load(context: ZuploContext): Promise<AIGatewayProviderInfo[]>;
+};
+
 /**
  * Converts OpenAI Chat Completions format responses back to Anthropic Messages format.
  * This policy translates the response when the original request was in Anthropic format.
  *
+ * @deprecated Platform AI Gateway routes use native Anthropic passthrough. This
+ * policy is retained for legacy custom routes that explicitly require translation.
+ *
  * @hidden
  * @title OpenAI to Anthropic Format Translator
  * @product ai-gateway
@@ -473,14 +464,18 @@ export declare const AIGatewayOpenAIToAnthropicOutboundPolicy: OutboundPolicyHan
 export declare interface AIGatewayOpenAIToAnthropicOutboundPolicyOptions {}
 
 /**
- * Provider metadata and models supplied to a routing function.
+ * Public metadata for an AI Gateway provider and its models.
  *
- * Credentials and environment-variable names are never exposed to customer
- * code. A provider can appear in this catalog without a key configured for the
- * project, so routing functions should restrict candidates to providers that
- * the project is configured to use.
+ * Credentials and environment-variable names are never exposed.
  *
  * @public
+ * @example
+ * ```typescript
+ * const providers = await AIGatewayModels.load(context);
+ * const activeOpenAIModels = providers
+ *   .find((provider) => provider.name === "openai")
+ *   ?.models.filter((model) => model.status === "active");
+ * ```
  */
 export declare interface AIGatewayProviderInfo {
   /** The case-insensitive provider identifier used in model routing. */
@@ -496,51 +491,54 @@ export declare interface AIGatewayProviderInfo {
 }
 
 /**
- * Computes model routing for a request. Set as the model-routing policy's
- * `routingFunction` option. The returned routing is validated exactly like the
- * static policy options and replaces them for the request. Return undefined to
- * use `options.defaultRouting` unchanged. The function owns merge semantics:
- * return the defaults as-is, a modified copy, or entirely new routing. The
- * request is an isolated clone, so reading its body does not consume the request
- * used by later policies or the route handler.
+ * A single AI Gateway routing target.
+ *
+ * Model references use `"provider/model"`; the string form is shorthand for
+ * `{ main: "provider/model" }`. The built-in model-routing policy uses this
+ * same type for each allow-list item: it matches the request against its
+ * allowList and `set()`s the winning target.
  *
- * @param request - An isolated clone of the incoming gateway request.
- * @param context - The current Zuplo request context.
- * @param options - Static defaults, the live provider catalog, and policy name.
- * @returns Per-request model routing, or undefined to keep the static defaults.
  * @public
+ * @example
+ * ```typescript
+ * const target: AIGatewayRouteTarget = {
+ *   main: "openai/gpt-5",
+ *   backup: "anthropic/claude-sonnet-4-6",
+ *   fallbackTimeoutSeconds: 30,
+ *   quotaFallback: "openai/gpt-5-mini",
+ * };
+ * ```
  */
-export declare type AIGatewayRoutingFunction = (
-  request: ZuploRequest,
-  context: ZuploContext,
-  options: AIGatewayRoutingFunctionOptions
-) =>
-  | AIGatewayModelRouting
-  | undefined
-  | Promise<AIGatewayModelRouting | undefined>;
+export declare type AIGatewayRouteTarget =
+  | string
+  | {
+      main: string;
+      backup?: string;
+      fallbackTimeoutSeconds?: number;
+      quotaFallback?: string;
+    };
 
 /**
- * Options passed to an {@link AIGatewayRoutingFunction}.
+ * The model routing selected for the current AI Gateway request.
+ *
+ * Each capability accepts the same {@link AIGatewayRouteTarget} used by an
+ * allow-list item in the built-in policy. The policy matches its allowList and
+ * `set()`s the one winning target for the request.
  *
  * @public
+ * @example
+ * ```typescript
+ * const routing: AIGatewayRouting = {
+ *   completions: "openai/gpt-5",
+ *   embeddings: { main: "openai/text-embedding-3-small" },
+ * };
+ * ```
  */
-export declare interface AIGatewayRoutingFunctionOptions {
-  /**
-   * The policy's parsed static routing from policies.json, or undefined when
-   * no static routing is configured.
-   */
-  defaultRouting: AIGatewayModelRouting | undefined;
-  /**
-   * The live provider catalog, including model pricing and lifecycle status.
-   * Catalog membership does not guarantee that the project has credentials for
-   * a provider. Credentials and their environment-variable names are not
-   * exposed to the routing function.
-   */
-  providers: AIGatewayProviderInfo[];
-  /**
-   * The name of the model-routing policy as set in policies.json.
-   */
-  policyName: string;
+export declare interface AIGatewayRouting {
+  /** Routing for chat completions, Responses, and Anthropic Messages. */
+  completions?: AIGatewayRouteTarget;
+  /** Routing for embedding requests. */
+  embeddings?: AIGatewayRouteTarget;
 }
 
 /**
@@ -791,9 +789,9 @@ export declare interface AiUsage {
  * @product ai-gateway
  * @requiresAI
  *
- * This policy integrates with Akamai's AI Firewall service to detect
- * and block malicious AI inputs and outputs. It's self-contained and
- * handles both streaming and non-streaming responses.
+ * This policy integrates with Akamai's AI Firewall service to detect and block
+ * malicious AI inputs and outputs. It uses the shared AI Gateway shape and
+ * streaming helpers for both streaming and non-streaming responses.
  *
  * For streaming responses, it uses a transform stream that can block
  * content mid-stream if harmful content is detected.
@@ -1056,6 +1054,14 @@ export declare interface AkamaiFirewallForAiOutboundPolicyOptions {
   detectUrl?: string;
 }
 
+/**
+ * Curated targets clients may select; the first entry is the default when model is omitted.
+ *
+ * @minItems 1
+ * @public
+ */
+declare type AllowedModels = [RouteTarget, ...RouteTarget[]];
+
 /**
  * Amberflo is a usage metering and billing service. This policy allows
  * you to send metering calls for each API to their meter ingest endpoint.
@@ -1471,7 +1477,7 @@ declare interface APITokenCredentialConfig {
 }
 
 /**
- * The endpoint shapes to cache. Defaults to ['openai-chat'] — the cache keys off chat `messages` and skips other shapes.
+ * The endpoint shapes to cache. Defaults to ['openai-chat', 'anthropic-messages']; OpenAI Responses remains unsupported.
  * @public
  */
 declare type ApplicableEndpoints = (
@@ -2544,6 +2550,14 @@ declare interface BatchDispatcherOptions {
   name?: string;
 }
 
+/**
+ * Configured provider/model targets rejected in open-but-filtered mode; requests may use a bare model name or provider/model.
+ *
+ * @minItems 1
+ * @public
+ */
+declare type BlockedModels = [ProviderAndModel, ...ProviderAndModel[]];
+
 /**
  * The brownout policy allows performing scheduled downtime on your API
  *
@@ -2714,6 +2728,14 @@ export declare interface CachingInboundPolicyOptions {
   dangerouslyIgnoreAuthorizationHeader?: boolean;
 }
 
+/**
+ * Choose curated allow-list mode or open-but-filtered block-list mode.
+ * @public
+ */
+declare type CapabilityModelRules =
+  | CuratedModelRules
+  | OpenButFilteredModelRules;
+
 /**
  * Controls which parts of the incoming request are sent to Akamai for inspection. Akamai's detect endpoint receives the captured fields concatenated into a single labeled text payload as `llmInput`.
  * @public
@@ -3273,27 +3295,10 @@ declare interface CompatibilityFlags {
 }
 
 /**
- * Routing for chat completions, Responses, and Anthropic Messages requests.
+ * Rules for chat completions, Responses, and Anthropic Messages requests.
  * @public
  */
-declare interface CompletionsRouting {
-  model: {
-    provider: string;
-    model: string;
-  };
-  fallback?: {
-    provider: string;
-    model: string;
-    /**
-     * How long the primary model may take before the fallback is attempted.
-     */
-    timeoutSeconds?: number;
-  };
-  quotaFallback?: {
-    provider: string;
-    model: string;
-  };
-}
+declare type CompletionsModels = CapabilityModelRules;
 
 /**
  * @public
@@ -3718,6 +3723,14 @@ export declare class CryptoBeta extends BaseCryptoBeta {
   digest(algorithm: string, data: string): Promise<string>;
 }
 
+/**
+ * Allow only listed targets and use entry zero as the default.
+ * @public
+ */
+declare interface CuratedModelRules {
+  allowList: AllowedModels;
+}
+
 /**
  * Authenticate users using the Curity Phantom Token Pattern.
  *
@@ -4229,27 +4242,10 @@ export declare class DynatraceMetricsPlugin extends MetricsPlugin {
 }
 
 /**
- * Routing for embedding requests.
+ * Rules for embedding requests.
  * @public
  */
-declare interface EmbeddingsRouting {
-  model: {
-    provider: string;
-    model: string;
-  };
-  fallback?: {
-    provider: string;
-    model: string;
-    /**
-     * How long the primary model may take before the fallback is attempted.
-     */
-    timeoutSeconds?: number;
-  };
-  quotaFallback?: {
-    provider: string;
-    model: string;
-  };
-}
+declare type EmbeddingsModels = CapabilityModelRules;
 
 /**
  * Enable accumulation and validation of streaming responses.
@@ -4376,6 +4372,12 @@ export declare function extractStreamTextDelta(
   format: AiFormat
 ): string | undefined;
 
+/**
+ * How long the main model may take before the backup is attempted.
+ * @public
+ */
+declare type FallbackTimeoutSeconds = number;
+
 declare interface FetchOptions<T> {
   method?: HttpMethod_2;
   data?: T;
@@ -9925,6 +9927,26 @@ declare interface ModelConfiguration {
   provider: string;
 }
 
+/**
+ * A primary model and optional failure or quota fallbacks.
+ * @public
+ */
+declare interface ModelRouteTarget {
+  main: ProviderAndModel1;
+  backup?: ProviderAndModel2;
+  fallbackTimeoutSeconds?: FallbackTimeoutSeconds;
+  quotaFallback?: ProviderAndModel3;
+}
+
+/**
+ * Declarative model-routing rules, grouped by AI Gateway capability.
+ * @public
+ */
+declare interface Models {
+  completions?: CompletionsModels;
+  embeddings?: EmbeddingsModels;
+}
+
 declare type Modify<T, R> = Omit<T, keyof R> & R;
 
 declare interface MoesifContext {
@@ -11072,6 +11094,14 @@ declare namespace OpenAPIV3_1 {
   }
 }
 
+/**
+ * Allow any requested target except those explicitly blocked.
+ * @public
+ */
+declare interface OpenButFilteredModelRules {
+  blockList: BlockedModels;
+}
+
 /**
  * Authorize requests using OpenFGA.
  *
@@ -11788,6 +11818,30 @@ export declare interface PropelAuthJwtInboundPolicyOptions {
   oAuthResourceMetadataEnabled?: boolean;
 }
 
+/**
+ * A model reference in provider/model form, split on the first slash.
+ * @public
+ */
+declare type ProviderAndModel = string;
+
+/**
+ * A model reference in provider/model form, split on the first slash.
+ * @public
+ */
+declare type ProviderAndModel1 = string;
+
+/**
+ * A model reference in provider/model form, split on the first slash.
+ * @public
+ */
+declare type ProviderAndModel2 = string;
+
+/**
+ * A model reference in provider/model form, split on the first slash.
+ * @public
+ */
+declare type ProviderAndModel3 = string;
+
 /**
  * Extracts a query parameter and sets it as a header in the request.
  *
@@ -13606,19 +13660,10 @@ export declare interface RouteHandler<T = unknown> {
 /* Excluded from this release type: Router */
 
 /**
- * Custom function that computes model routing for each request. It receives defaultRouting and the project's provider catalog, including pricing. Returning undefined keeps the defaults unchanged.
+ * A provider/model string shorthand or a full model route target.
  * @public
  */
-declare interface RoutingFunction {
-  /**
-   * Module to load the routing function from, e.g. $import(./modules/model-routing).
-   */
-  module: string;
-  /**
-   * Named export of the routing function, e.g. 'default' or 'routeModels'.
-   */
-  export: string;
-}
+declare type RouteTarget = ProviderAndModel | ModelRouteTarget;
 
 /**
  * The authorization rule evaluated against the authenticated user's claims (request.user.data, populated by the authentication policy that runs before this one — a JWT policy, API key auth, mTLS, etc.). A rule is either a single claim check (eq, in, or startsWith) or an and/or combination of nested rules. Combinators may nest up to three levels deep. Requests that fail the rule receive a 403 Forbidden response.

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.72.12",
+  "version": "6.72.14",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {