@zuplo/cli 6.72.3 → 6.72.8

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -125,6 +125,10 @@ export declare function AIGatewayAuthInboundPolicy(
  * @public
  */
 export declare interface AIGatewayAuthInboundPolicyOptions {
+  /**
+   * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
+   */
+  cacheTtlSeconds?: number;
   /**
    * The name of the header with the key.
    */
@@ -133,10 +137,35 @@ export declare interface AIGatewayAuthInboundPolicyOptions {
    * The scheme used on the header.
    */
   authScheme?: string;
+}
+
+export declare type AIGatewayCapability =
+  | "completions"
+  | "embeddings"
+  | "rerank"
+  | "moderations"
+  | "images"
+  | "audio_speech"
+  | "audio_transcriptions";
+
+export declare interface AIGatewayCapabilityRouting {
+  model: AIGatewayModelRef;
+  fallback?: AIGatewayFallbackRef;
+  quotaFallback?: AIGatewayModelRef;
+}
+
+export declare interface AIGatewayCapabilitySelection {
+  candidates: AIGatewayModelCandidate[];
+  fallbackTimeoutSeconds?: number;
+  quotaFallback?: AIGatewayModelCandidate;
+}
+
+export declare interface AIGatewayFallbackRef extends AIGatewayModelRef {
   /**
-   * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
+   * Bounds the primary call before failing over. Defaults to 60 seconds and is
+   * only meaningful when a fallback is configured.
    */
-  cacheTtlSeconds?: number;
+  timeoutSeconds?: number;
 }
 
 /**
@@ -165,6 +194,36 @@ export declare function aiGatewayHandler(
   context: ZuploContext
 ): Promise<Response>;
 
+/**
+ * Routes AI requests using the model selection stored in the request context.
+ * Attach the `ai-gateway-models-inbound` policy before this handler runs. To
+ * compute routing per request, set that policy's `routingFunction` option to
+ * a module export.
+ *
+ * @beta
+ * @param request - The incoming AI Gateway request.
+ * @param context - The ZuploContext containing the model selection.
+ * @returns A response from the selected AI provider.
+ *
+ * @public
+ * @example
+ * ```json
+ * {
+ *   "handler": {
+ *     "export": "aiGatewayHandlerV2",
+ *     "module": "$import(@zuplo/runtime)"
+ *   },
+ *   "policies": {
+ *     "inbound": ["ai-gateway-models"]
+ *   }
+ * }
+ * ```
+ */
+export declare function aiGatewayHandlerV2(
+  request: ZuploRequest,
+  context: ZuploContext
+): Promise<Response>;
+
 /* Excluded from this release type: AIGatewayMeterIncrements */
 
 /**
@@ -263,6 +322,69 @@ export declare interface AIGatewayMeteringInboundPolicyOptions {
   throwOnFailure?: boolean;
 }
 
+export declare interface AIGatewayModelCandidate {
+  provider: string;
+  model: string;
+  apiKey?: string;
+}
+
+export declare interface AIGatewayModelRef {
+  provider: string;
+  model: string;
+}
+
+export declare interface AIGatewayModelRouting {
+  providers: AIGatewayProviderCredential[];
+  completions?: AIGatewayCapabilityRouting;
+  embeddings?: AIGatewayCapabilityRouting;
+}
+
+export declare interface AIGatewayModelSelection {
+  byCapability: Partial<
+    Record<AIGatewayCapability, AIGatewayCapabilitySelection>
+  >;
+}
+
+/**
+ * Selects AI Gateway models and fallbacks for each configured capability.
+ *
+ * @title AI Gateway Models
+ * @beta
+ * @product ai-gateway
+ * @hidden
+ * @requiresAI
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns The request with the model selection stored in context
+ */
+export declare class AIGatewayModelsInboundPolicy extends InboundPolicy<AIGatewayModelsInboundPolicyOptions> {
+  #private;
+  static readonly policyType = "ai-gateway-models";
+  /* Excluded from this release type: setModelSelection */
+  /** Get the model selection for the current request. */
+  static getModelSelection(
+    context: ZuploContext
+  ): AIGatewayModelSelection | undefined;
+  constructor(options: AIGatewayModelsInboundPolicyOptions, policyName: string);
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * Options for provider credentials and per-capability AI model routing.
+ * @public
+ */
+export declare interface AIGatewayModelsInboundPolicyOptions {
+  providers?: Providers;
+  completions?: CompletionsRouting;
+  routingFunction?: RoutingFunction;
+  embeddings?: EmbeddingsRouting;
+}
+
 /**
  * Converts OpenAI Chat Completions format responses back to Anthropic Messages format.
  * This policy translates the response when the original request was in Anthropic format.
@@ -285,6 +407,44 @@ export declare const AIGatewayOpenAIToAnthropicOutboundPolicy: OutboundPolicyHan
  */
 export declare interface AIGatewayOpenAIToAnthropicOutboundPolicyOptions {}
 
+export declare interface AIGatewayProviderCredential {
+  provider: string;
+  apiKey: string;
+}
+
+/**
+ * Computes model routing for a request. Set as the models policy's
+ * `routingFunction` option. The returned routing is validated exactly like the
+ * static policy options and replaces them for the request. Return undefined to
+ * use `options.defaultRouting` unchanged. The function owns merge semantics:
+ * return the defaults as-is, a modified copy, or entirely new routing. The
+ * request is an isolated clone, so reading its body does not consume the request
+ * used by later policies or the route handler.
+ */
+export declare type AIGatewayRoutingFunction = (
+  request: ZuploRequest,
+  context: ZuploContext,
+  options: AIGatewayRoutingFunctionOptions
+) =>
+  | AIGatewayModelRouting
+  | undefined
+  | Promise<AIGatewayModelRouting | undefined>;
+
+/**
+ * Options passed to an {@link AIGatewayRoutingFunction}.
+ */
+export declare interface AIGatewayRoutingFunctionOptions {
+  /**
+   * The policy's parsed static routing from policies.json, or undefined when
+   * no static routing is configured.
+   */
+  defaultRouting: AIGatewayModelRouting | undefined;
+  /**
+   * The name of the models policy as set in policies.json.
+   */
+  policyName: string;
+}
+
 /**
  * AI Gateway Semantic Cache policy for caching chat completion responses
  * based on semantic similarity of user messages.
@@ -383,8 +543,8 @@ export declare function AIGatewaySemanticCacheV2InboundPolicy(
 export declare interface AIGatewaySemanticCacheV2InboundPolicyOptions {
   semanticTolerance?: SemanticTolerance;
   expirationSecondsTtl?: CacheTTLSeconds;
-  maxConversationLength?: MaxConversationLength;
   namespace?: CacheNamespace;
+  maxConversationLength?: MaxConversationLength;
   endpoints?: ApplicableEndpoints;
   onUnknownShape?: OnUnknownShape;
 }
@@ -559,7 +719,7 @@ export declare function AkamaiAIFirewallInboundPolicy(
  */
 export declare interface AkamaiAIFirewallPolicyOptions {
   configurationId: ConfigurationID;
-  "api-key": APIKey;
+  "api-key": APIKey_2;
   applicationId?: ApplicationID;
   streamingAccumulation?: StreamingAccumulationSettings;
 }
@@ -599,7 +759,7 @@ export declare function AkamaiAIFirewallV2InboundPolicy(
  */
 export declare interface AkamaiAIFirewallV2PolicyOptions {
   configurationId: ConfigurationID_2;
-  "api-key": APIKey_2;
+  "api-key": APIKey_3;
   applicationId?: ApplicationID_2;
   streamingAccumulation?: StreamingAccumulationSettings_2;
   endpoints?: ApplicableEndpoints_2;
@@ -958,7 +1118,7 @@ export declare interface ApiAuthKeyInboundPolicyOptions {
 }
 
 /**
- * The API key for the AI Firewall.
+ * The API key itself. Use $env(MY_KEY) to substitute an environment variable at build time.
  * @public
  */
 declare type APIKey = string;
@@ -969,6 +1129,12 @@ declare type APIKey = string;
  */
 declare type APIKey_2 = string;
 
+/**
+ * The API key for the AI Firewall.
+ * @public
+ */
+declare type APIKey_3 = string;
+
 /**
  * Represents a consumer in the API Key service.
  * @public
@@ -1142,6 +1308,10 @@ export declare function ApiKeyInboundPolicy(
  * @public
  */
 export declare interface ApiKeyInboundPolicyOptions {
+  /**
+   * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
+   */
+  cacheTtlSeconds?: number;
   /**
    * The name of the header with the key.
    */
@@ -1162,10 +1332,6 @@ export declare interface ApiKeyInboundPolicyOptions {
    * If requests should proceed even if the policy does not successfully authenticate the request. Defaults to false and rejects any request without a valid API key (returning a `401 - Unauthorized` response). Set to `true` to support multiple authentication methods or support both authenticated and anonymous requests.
    */
   allowUnauthenticatedRequests?: boolean;
-  /**
-   * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
-   */
-  cacheTtlSeconds?: number;
   /**
    * Zuplo will automatically document your API key header within your OpenAPI specification & Developer Portal. Set this to `true` to disable this behavior.
    */
@@ -1577,10 +1743,6 @@ export declare const Auth0JwtInboundPolicy: InboundPolicyHandler<Auth0JwtInbound
  * @public
  */
 export declare interface Auth0JwtInboundPolicyOptions {
-  /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Your Auth0 domain. For example, `my-company.auth0.com`.
    */
@@ -1589,6 +1751,10 @@ export declare interface Auth0JwtInboundPolicyOptions {
    * The Auth0 audience of your API, for example `https://api.example.com/`.
    */
   audience?: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -1653,10 +1819,6 @@ export declare interface AuthZenInboundPolicyOptions {
    * The hostname of the AuthZen PDP service.
    */
   authorizerHostname: string;
-  /**
-   * The authorization header to use when communicating with the AuthZen PDP service.
-   */
-  authorizerAuthorizationHeader?: string;
   /**
    * The subject of the request.
    */
@@ -1695,6 +1857,10 @@ export declare interface AuthZenInboundPolicyOptions {
     name: string;
     [k: string]: unknown;
   };
+  /**
+   * The authorization header to use when communicating with the AuthZen PDP service.
+   */
+  authorizerAuthorizationHeader?: string;
   /**
    * If explicitly set to false, the policy will not throw an error if there is any problem communicating with the AuthZen PDP service and allow calls through. By default throwOnError is assumed to be on/true.
    */
@@ -1992,10 +2158,6 @@ export declare class AxiomaticsAuthZInboundPolicy extends InboundPolicy<Axiomati
  * @public
  */
 export declare interface AxiomaticsAuthZInboundPolicyOptions {
-  /**
-   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
-   */
-  allowUnauthorizedRequests?: boolean;
   /**
    * The URL to which the plugin will make a JSON POST request before proxying the original request.
    */
@@ -2008,6 +2170,10 @@ export declare interface AxiomaticsAuthZInboundPolicyOptions {
    * The password to use when authenticating with the PDP.
    */
   pdpPassword: string;
+  /**
+   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
+   */
+  allowUnauthorizedRequests?: boolean;
   /**
    * Indicates whether the plugin should include default action attributes in the authorization request.
    */
@@ -2261,7 +2427,7 @@ export declare interface BasicAuthInboundPolicyOptions {
    */
   accounts: BasicAuthAccount[];
   /**
-   * If 'true' allows the request to continue even if authenticated. When 'false' (the default) any unauthenticated request is automatically rejected with a 401.
+   * If 'true' allows the request to continue even if unauthenticated. When 'false' (the default) any unauthenticated request is automatically rejected with a 401.
    */
   allowUnauthenticatedRequests?: boolean;
 }
@@ -2431,13 +2597,9 @@ export declare function CachingInboundPolicy(
  */
 export declare interface CachingInboundPolicyOptions {
   /**
-   * Specifies an id or 'key' for this policy to store cache. This is useful for cache-busting. For example, set this property to an env var and if you change that env var value, you invalidate the cache.
-   */
-  cacheId?: string;
-  /**
-   * By default, the Authorization header is always considered in the caching policy. You can disable by setting this to `true`.
+   * The timeout of the cache in seconds.
    */
-  dangerouslyIgnoreAuthorizationHeader?: boolean;
+  expirationSecondsTtl?: number;
   /**
    * The headers to be considered when caching.
    */
@@ -2446,14 +2608,18 @@ export declare interface CachingInboundPolicyOptions {
    * HTTP Methods to be cached. Valid methods are: GET, POST, PUT, PATCH, DELETE, HEAD.
    */
   cacheHttpMethods?: ("GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD")[];
-  /**
-   * The timeout of the cache in seconds.
-   */
-  expirationSecondsTtl?: number;
   /**
    * Response status codes to be cached.
    */
   statusCodes?: number[];
+  /**
+   * Specifies an id or 'key' for this policy to store cache. This is useful for cache-busting. For example, set this property to an env var and if you change that env var value, you invalidate the cache.
+   */
+  cacheId?: string;
+  /**
+   * By default, the Authorization header is always considered in the caching policy. You can disable by setting this to `true`.
+   */
+  dangerouslyIgnoreAuthorizationHeader?: boolean;
 }
 
 /**
@@ -2737,14 +2903,14 @@ export declare const ClerkJwtInboundPolicy: InboundPolicyHandler<ClerkJwtInbound
  * @public
  */
 export declare interface ClerkJwtInboundPolicyOptions {
-  /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Your Clerk Frontend API URL, i.e. `https://verb-noun-00.clerk.accounts.dev`. Can be found in the Clerk portal: https://dashboard.clerk.com/last-active?path=api-keys.
    */
   frontendApiUrl: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -2810,10 +2976,6 @@ export declare const CognitoJwtInboundPolicy: InboundPolicyHandler<CognitoJwtInb
  * @public
  */
 export declare interface CognitoJwtInboundPolicyOptions {
-  /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * The AWS region where your Cognito instance is deployed.
    */
@@ -2822,6 +2984,10 @@ export declare interface CognitoJwtInboundPolicyOptions {
    * The user pool identifier.
    */
   userPoolId: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -3014,6 +3180,29 @@ declare interface CompatibilityFlags {
   return501ForUnsupportedHttpMethods: boolean;
 }
 
+/**
+ * Routing for chat completions, Responses, and Anthropic Messages requests.
+ * @public
+ */
+declare interface CompletionsRouting {
+  model: {
+    provider: string;
+    model: string;
+  };
+  fallback?: {
+    provider: string;
+    model: string;
+    /**
+     * How long the primary model may take before the fallback is attempted.
+     */
+    timeoutSeconds?: number;
+  };
+  quotaFallback?: {
+    provider: string;
+    model: string;
+  };
+}
+
 /**
  * @public
  */
@@ -3677,10 +3866,6 @@ export declare interface DataLossPreventionInboundPolicyOptions {
     | "secret-twilio"
     | "secret-zuplo"
   )[];
-  /**
-   * Additional customer-defined regex recognizers. Invalid patterns are logged and skipped rather than failing the request.
-   */
-  customPatterns?: DlpCustomPattern[];
   /**
    * What to do when sensitive data is detected. `mask` redacts matches before forwarding the request, `block` rejects with a 422 listing only the detected entity names, and `log` records a warning and forwards the request unchanged.
    */
@@ -3689,6 +3874,10 @@ export declare interface DataLossPreventionInboundPolicyOptions {
    * The string that replaces detected values when `action` is `mask`.
    */
   mask?: string;
+  /**
+   * Additional customer-defined regex recognizers. Invalid patterns are logged and skipped rather than failing the request.
+   */
+  customPatterns?: DlpCustomPattern[];
   /**
    * Minimum confidence (0-1) a match must reach to count as a finding. Context-dependent recognizers (for example `finance-us-bank-account` or `finance-us-aba-routing`) sit below the default threshold of 0.5 until a context word near the match boosts them above it. Lower the threshold to surface them everywhere; raise it to keep only prefix- or checksum-validated matches.
    */
@@ -3820,10 +4009,6 @@ export declare interface DataLossPreventionOutboundPolicyOptions {
     | "secret-twilio"
     | "secret-zuplo"
   )[];
-  /**
-   * Additional customer-defined regex recognizers. Invalid patterns are logged and skipped rather than failing the response.
-   */
-  customPatterns?: DlpCustomPattern_2[];
   /**
    * What to do when sensitive data is detected. `mask` redacts matches before returning the response, `block` replaces the response with a 422 listing only the detected entity names, and `log` records a warning and returns the response unchanged.
    */
@@ -3832,6 +4017,10 @@ export declare interface DataLossPreventionOutboundPolicyOptions {
    * The string that replaces detected values when `action` is `mask`.
    */
   mask?: string;
+  /**
+   * Additional customer-defined regex recognizers. Invalid patterns are logged and skipped rather than failing the response.
+   */
+  customPatterns?: DlpCustomPattern_2[];
   /**
    * Minimum confidence (0-1) a match must reach to count as a finding. Context-dependent recognizers (for example `finance-us-bank-account` or `finance-us-aba-routing`) sit below the default threshold of 0.5 until a context word near the match boosts them above it. Lower the threshold to surface them everywhere; raise it to keep only prefix- or checksum-validated matches.
    */
@@ -3947,6 +4136,29 @@ export declare class DynatraceMetricsPlugin extends MetricsPlugin {
   static setContext(context: ZuploContext, data: DynatraceMetricsContext): void;
 }
 
+/**
+ * Routing for embedding requests.
+ * @public
+ */
+declare interface EmbeddingsRouting {
+  model: {
+    provider: string;
+    model: string;
+  };
+  fallback?: {
+    provider: string;
+    model: string;
+    /**
+     * How long the primary model may take before the fallback is attempted.
+     */
+    timeoutSeconds?: number;
+  };
+  quotaFallback?: {
+    provider: string;
+    model: string;
+  };
+}
+
 /**
  * Enable accumulation and validation of streaming responses.
  * @public
@@ -4111,14 +4323,14 @@ export declare const FirebaseJwtInboundPolicy: InboundPolicyHandler<FirebaseJwtI
  * @public
  */
 export declare interface FirebaseJwtInboundPolicyOptions {
-  /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Your Firebase Project ID.
    */
   projectId: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -9747,6 +9959,16 @@ export declare class MonetizationInboundPolicy extends InboundPolicy<Monetizatio
  * @public
  */
 export declare interface MonetizationInboundPolicyOptions {
+  /**
+   * The meters to be used by the policy against the subscription quota.
+   */
+  meters?: {
+    [k: string]: number;
+  };
+  /**
+   * A list of entitlement keys that the subscription must have access to (hasAccess=true) for the request to be allowed. If any required entitlement is missing or does not have access, the request will be rejected with a 403 Forbidden.
+   */
+  requiredEntitlements?: string[];
   /**
    * The name of the header with the key.
    */
@@ -9759,24 +9981,10 @@ export declare interface MonetizationInboundPolicyOptions {
    * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
    */
   cacheTtlSeconds?: number;
-  /**
-   * The meters to be used by the policy against the subscription quota.
-   */
-  meters?: {
-    /**
-     * This interface was referenced by `undefined`'s JSON-Schema definition
-     * via the `patternProperty` "^.*$".
-     */
-    [k: string]: number;
-  };
   /**
    * A list of successful status codes and ranges "200-299, 304" that should trigger a metering call.
    */
   meterOnStatusCodes?: string | number[];
-  /**
-   * A list of entitlement keys that the subscription must have access to (hasAccess=true) for the request to be allowed. If any required entitlement is missing or does not have access, the request will be rejected with a 403 Forbidden.
-   */
-  requiredEntitlements?: string[];
 }
 
 /**
@@ -9871,14 +10079,14 @@ export declare type MTLSAuthInboundPolicyOptions = (
       [k: string]: unknown;
     }
 ) & {
-  /**
-   * Allows requests to continue even when mTLS verification fails, no client certificate is presented, or the certificate metadata cannot be parsed. Defaults to false.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Fully qualified issuer distinguished name to require on the client certificate. The policy rejects certificates whose parsed issuer DN does not match this string exactly. Required unless `allowUnauthenticatedRequests` is `true`. The expected format matches the parsed metadata issuer, e.g. "CN=example-ca, O=Example, C=US".
    */
   certIssuerDN?: string;
+  /**
+   * Allows requests to continue even when mTLS verification fails, no client certificate is presented, or the certificate metadata cannot be parsed. Defaults to false.
+   */
+  allowUnauthenticatedRequests?: boolean;
 };
 
 /**
@@ -10067,10 +10275,6 @@ export declare interface OktaFGAAuthZInboundPolicyOptions {
    * The ID of the authorization model.
    */
   authorizationModelId: string;
-  /**
-   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
-   */
-  allowUnauthorizedRequests?: boolean;
   credentials: {
     /**
      * The client ID.
@@ -10082,6 +10286,10 @@ export declare interface OktaFGAAuthZInboundPolicyOptions {
     clientSecret: string;
     [k: string]: unknown;
   };
+  /**
+   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
+   */
+  allowUnauthorizedRequests?: boolean;
 }
 
 /**
@@ -10103,10 +10311,6 @@ export declare const OktaJwtInboundPolicy: InboundPolicyHandler<OktaJwtInboundPo
  * @public
  */
 export declare interface OktaJwtInboundPolicyOptions {
-  /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Your Okta authorization server's issuer URL. For example, `https://dev-12345.okta.com/oauth2/abc`.
    */
@@ -10115,6 +10319,10 @@ export declare interface OktaJwtInboundPolicyOptions {
    * The Okta audience of your API, for example `api://my-api`.
    */
   audience?: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -10806,15 +11014,15 @@ export declare interface OpenFGAAuthZInboundPolicyOptions {
    * The ID of the authorization model.
    */
   authorizationModelId: string;
-  /**
-   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
-   */
-  allowUnauthorizedRequests?: boolean;
   credentials:
     | UnauthenticatedCredentialConfig
     | APITokenCredentialConfig
     | HeaderCredentialsConfig
     | ClientCredentialsConfig;
+  /**
+   * Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response.
+   */
+  allowUnauthorizedRequests?: boolean;
 }
 
 declare interface OpenFGACheck {
@@ -10864,10 +11072,6 @@ declare interface OpenIdJwtInboundPolicyInternalOptions extends Omit<
  * @public
  */
 export declare interface OpenIdJwtInboundPolicyOptions {
-  /**
-   * The name of the header with the key.
-   */
-  authHeader?: string;
   /**
    * The expected issuer claim in the JWT token.
    */
@@ -10884,6 +11088,10 @@ export declare interface OpenIdJwtInboundPolicyOptions {
    * The key used to verify the signature of the JWT token (either this or `jwkUrl` must be set).
    */
   secret?: string;
+  /**
+   * The name of the header with the key.
+   */
+  authHeader?: string;
   /**
    * indicates whether the request should continue if authentication fails. Defaults is `false` which means unauthenticated users will automatically receive a 401 response.
    */
@@ -10992,10 +11200,6 @@ export declare class OpenMeterInboundPolicy extends InboundPolicy<OpenMeterInbou
  * @public
  */
 export declare interface OpenMeterInboundPolicyOptions {
-  /**
-   * The URL of the OpenMeter API endpoint.
-   */
-  apiUrl?: string;
   /**
    * The API key to use when sending metering calls to OpenMeter.
    */
@@ -11004,6 +11208,14 @@ export declare interface OpenMeterInboundPolicyOptions {
    * A single meter configuration or an array of meter configurations for OpenMeter.
    */
   meter?: Meter | Meter[];
+  /**
+   * A list of entitlements (feature keys) required in order for the call to be allowed.
+   */
+  requiredEntitlements?: string[];
+  /**
+   * The URL of the OpenMeter API endpoint.
+   */
+  apiUrl?: string;
   /**
    * A list of successful status codes and ranges "200-299, 304" that should trigger a metering event.
    */
@@ -11012,10 +11224,6 @@ export declare interface OpenMeterInboundPolicyOptions {
    * The event's source (e.g. the service name).
    */
   eventSource?: string;
-  /**
-   * A list of entitlements (feature keys) required in order for the call to be allowed.
-   */
-  requiredEntitlements?: string[];
   /**
    * The path to the property on `request.user` that contains the subject used for meters and entitlements. For example `.data.accountId` would read the `request.user.data.accountId` property.
    */
@@ -11441,14 +11649,14 @@ export declare interface PromptInjectionDetectionOutboundPolicyOptions {
    * Model to use for classification.
    */
   model?: string;
-  /**
-   * Base URL for the OpenAI compatible API.
-   */
-  baseUrl?: string;
   /**
    * Whether to block traffic if the classifier fails. When disabled, allows traffic flow if the classifier or inference API is unavailable.
    */
   strict?: boolean;
+  /**
+   * Base URL for the OpenAI compatible API.
+   */
+  baseUrl?: string;
 }
 
 /**
@@ -11470,10 +11678,6 @@ export declare const PropelAuthJwtInboundPolicy: InboundPolicyHandler<PropelAuth
  * @public
  */
 export declare interface PropelAuthJwtInboundPolicyOptions {
-  /**
-   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Your PropelAuth authUrl. For example, `https://12345678.propelauthtest.com`.
    */
@@ -11482,12 +11686,39 @@ export declare interface PropelAuthJwtInboundPolicyOptions {
    * Your public (verifier) key that is used to verify access tokens. This key has a value that begins with '-----BEGIN PUBLIC KEY-----'. Make sure to remove all line breaks from the key before saving the variable.
    */
   verifierKey: string;
+  /**
+   * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
   oAuthResourceMetadataEnabled?: boolean;
 }
 
+/**
+ * The provider registry key, such as openai, anthropic, or a custom provider name.
+ * @public
+ */
+declare type Provider = string;
+
+/**
+ * Provider credentials used by model routing. Each entry must define apiKey.
+ *
+ * @minItems 1
+ * @public
+ */
+declare type Providers = [
+  {
+    provider: Provider;
+    apiKey: APIKey;
+  },
+  ...{
+    provider: Provider;
+    apiKey: APIKey;
+  }[],
+];
+
 /**
  * Extracts a query parameter and sets it as a header in the request.
  *
@@ -11577,16 +11808,16 @@ export declare interface QuotaInboundPolicyOptions {
    * The quota by.
    */
   quotaBy: "user" | "function";
-  /**
-   * How the policy determines the anchor date for ongoing quota cycles - defaults to `first-api-call` which uses the first API call for this key.
-   */
-  quotaAnchorMode?: "first-api-call" | "function";
   /**
    * The allowances for the quota.
    */
   allowances?: {
     [k: string]: number;
   };
+  /**
+   * How the policy determines the anchor date for ongoing quota cycles - defaults to `first-api-call` which uses the first API call for this key.
+   */
+  quotaAnchorMode?: "first-api-call" | "function";
   /**
    * A list of successful status codes and ranges "200-299, 304" that should trigger a quota increment.
    */
@@ -11811,14 +12042,14 @@ declare interface ReadmeMeteringInboundPolicyOptions {
    * The API key to use when sending metrics calls to Readme.
    */
   apiKey: string;
-  /**
-   * This is the path to the property on `request.user` that contains the label you want to use. For example `.data.accountNumber` would read the `request.user.data.accountNumber` property.
-   */
-  userLabelPropertyPath?: string;
   /**
    * This is the path to the property on `request.user` that contains the e-mail of the user. For example `.data.email` would read the `request.user.data.email` property.
    */
   userEmailPropertyPath?: string;
+  /**
+   * This is the path to the property on `request.user` that contains the label you want to use. For example `.data.accountNumber` would read the `request.user.data.accountNumber` property.
+   */
+  userLabelPropertyPath?: string;
   /**
    * Whether the data should be ingested as 'development' mode or not. Defaults to true for working-copy and false for all other environments.
    */
@@ -12281,14 +12512,14 @@ export declare const RequestValidationInboundPolicy: InboundPolicyHandler<Reques
  * @public
  */
 export declare interface RequestValidationInboundPolicyOptions {
-  /**
-   * The log level to use when logging validation errors.
-   */
-  logLevel?: "error" | "warn" | "info" | "debug";
   validateBody?: ValidationOptions;
   validateQueryParameters?: ValidationOptions1;
   validatePathParameters?: ValidationOptions2;
   validateHeaders?: ValidationOptions3;
+  /**
+   * The log level to use when logging validation errors.
+   */
+  logLevel?: "error" | "warn" | "info" | "debug";
   /**
    * Whether to include the request in the logs.
    */
@@ -13305,6 +13536,21 @@ export declare interface RouteHandler<T = unknown> {
 
 /* Excluded from this release type: Router */
 
+/**
+ * Custom function that computes model routing for each request. The export must be an AIGatewayRoutingFunction. It receives the policy's parsed static routing (if any) as defaultRouting; its return value is validated like the static options and replaces the routing for the request. Returning undefined keeps the defaults unchanged.
+ * @public
+ */
+declare interface RoutingFunction {
+  /**
+   * Module to load the routing function from, e.g. $import(./modules/model-routing).
+   */
+  module: string;
+  /**
+   * Named export of the routing function, e.g. 'default' or 'routeModels'.
+   */
+  export: string;
+}
+
 /**
  * The authorization rule evaluated against the authenticated user's claims (request.user.data, populated by the authentication policy that runs before this one — a JWT policy, API key auth, mTLS, etc.). A rule is either a single claim check (eq, in, or startsWith) or an and/or combination of nested rules. Combinators may nest up to three levels deep. Requests that fail the rule receive a 403 Forbidden response.
  * @public
@@ -13502,6 +13748,10 @@ export declare type SemanticCacheInboundPolicyOptions = {
    * Determines how the cache key is generated. Use 'function' for custom logic or 'propertyPath' to extract from JSON body.
    */
   cacheBy: "function" | "propertyPath";
+  /**
+   * The path to the property in the request body (JSON) to use as cache key. For example '.userId' would read the 'userId' property from the request body. Only works with cacheBy=propertyPath.
+   */
+  cacheByPropertyPath?: string;
   /**
    * The function that returns dynamic cache key data. Used only with `cacheBy=function`.
    */
@@ -13515,10 +13765,6 @@ export declare type SemanticCacheInboundPolicyOptions = {
      */
     module: string;
   };
-  /**
-   * The path to the property in the request body (JSON) to use as cache key. For example '.userId' would read the 'userId' property from the request body. Only works with cacheBy=propertyPath.
-   */
-  cacheByPropertyPath?: string;
   /**
    * Response status codes to be cached.
    */
@@ -13753,14 +13999,14 @@ export declare const SetUpstreamApiKeyInboundPolicy: InboundPolicyHandler<SetUps
  * @public
  */
 export declare interface SetUpstreamApiKeyInboundPolicyOptions {
-  /**
-   * The name of the header to set on the request. Defaults to `Authorization`.
-   */
-  header?: string;
   /**
    * The value of the header. Most commonly an environment variable reference such as `Bearer $env(UPSTREAM_API_KEY)` so the secret is sourced from your environment.
    */
   value: string;
+  /**
+   * The name of the header to set on the request. Defaults to `Authorization`.
+   */
+  header?: string;
   /**
    * Overwrite the value if the header is already present in the request.
    */
@@ -14002,7 +14248,7 @@ export declare interface StripeWebhookVerificationInboundPolicyOptions {
    */
   signingSecret: string;
   /**
-   * The allowed clock skew in seconds between the time the webhook signature was crated and the current time.
+   * The allowed clock skew in seconds between the time the webhook signature was created and the current time.
    */
   tolerance?: number;
 }
@@ -14051,16 +14297,16 @@ export declare interface SupabaseJwtInboundPolicyOptions {
    * The key used to verify the signature of the JWT token.
    */
   secret: string;
-  /**
-   * Indicates whether the request should continue if authentication fails. Default is `false` which means unauthenticated users will automatically receive a 401 response.
-   */
-  allowUnauthenticatedRequests?: boolean;
   /**
    * Any claims that must be present for authentication to succeed - multiple valid values can be specified for each claim.
    */
   requiredClaims?: {
     [k: string]: string[];
   };
+  /**
+   * Indicates whether the request should continue if authentication fails. Default is `false` which means unauthenticated users will automatically receive a 401 response.
+   */
+  allowUnauthenticatedRequests?: boolean;
   /**
    * Flag that determines whether OAuth protected resource metadata is enabled.
    */
@@ -14390,7 +14636,7 @@ export declare interface UpstreamAzureAdServiceAuthInboundPolicyOptions {
    */
   activeDirectoryClientSecret: string;
   /**
-   * The number of times to retry fetching the token in the event of a failure..
+   * The number of times to retry fetching the token in the event of a failure.
    */
   tokenRetries?: number;
   /**
@@ -14465,15 +14711,15 @@ export declare interface UpstreamFirebaseUserAuthInboundPolicyOptions {
    * The property on the incoming request.user object to retrieve the value of the userId.
    */
   userIdPropertyPath?: string;
-  /**
-   * Additional claims to include in the custom token's payload.
-   */
-  developerClaims?: Record<string, string | number | boolean | null>;
   /**
    * The Firebase Web API Key (found in project settings)
    * @see {@link https://firebase.google.com/docs/projects/api-keys|Firebase API Keys}.
    */
   webApiKey: string;
+  /**
+   * Additional claims to include in the custom token's payload.
+   */
+  developerClaims?: Record<string, string | number | boolean | null>;
   /**
    * The number of times to retry fetching the token in the event of a failure.
    */
@@ -14683,6 +14929,10 @@ export declare interface UpstreamZuploJwtAuthInboundPolicyOptions {
    * The audience claim for the JWT.
    */
   audience?: string;
+  /**
+   * JWT expiration time. Can be a number (seconds) or a string with units (e.g., '5m' for 5 minutes, '1h' for 1 hour, '7d' for 7 days). Defaults to 300 seconds (5 minutes).
+   */
+  expiresIn?: number | string;
   /**
    * The subject ('sub') claim for the minted JWT. Identifies the acting subject of the token (typically the gateway itself).
    */
@@ -14707,10 +14957,6 @@ export declare interface UpstreamZuploJwtAuthInboundPolicyOptions {
   additionalClaims?: {
     [k: string]: unknown;
   };
-  /**
-   * JWT expiration time. Can be a number (seconds) or a string with units (e.g., '5m' for 5 minutes, '1h' for 1 hour, '7d' for 7 days). Defaults to 300 seconds (5 minutes).
-   */
-  expiresIn?: number | string;
 }
 
 declare interface UrlConfig {
@@ -14778,6 +15024,21 @@ declare interface UrlConfig {
  *   }
  * }
  * ```
+ *
+ * @example
+ * ```json
+ * // Abort the request with a 504 if the upstream takes longer than 30 seconds
+ * {
+ *   "handler": {
+ *     "export": "urlForwardHandler",
+ *     "module": "$import(@zuplo/runtime)",
+ *     "options": {
+ *       "baseUrl": "https://backend.example.com",
+ *       "requestTimeoutSeconds": 30
+ *     }
+ *   }
+ * }
+ * ```
  */
 export declare function urlForwardHandler(
   request: ZuploRequest,
@@ -14845,6 +15106,21 @@ export declare function urlForwardHandler(
  *   }
  * }
  * ```
+ *
+ * @example
+ * ```json
+ * // Abort the request with a 504 if the upstream takes longer than 30 seconds
+ * {
+ *   "handler": {
+ *     "export": "urlRewriteHandler",
+ *     "module": "$import(@zuplo/runtime)",
+ *     "options": {
+ *       "rewritePattern": "https://backend.internal/api${url.pathname}",
+ *       "requestTimeoutSeconds": 30
+ *     }
+ *   }
+ * }
+ * ```
  */
 export declare function urlRewriteHandler(
   request: ZuploRequest,
@@ -15242,6 +15518,10 @@ export declare interface XmlToJsonPolicyOptions {
    * Ignore tag attributes.
    */
   ignoreAttributes?: boolean;
+  /**
+   * Remove surrounding whitespace from tag or attribute value.
+   */
+  trimValues?: boolean;
   /**
    * At particular point, if you don't want to parse a tag and it's nested tags then you can set their path in stopNodes. You can also set tags which should not be processed irrespective of their path using * as the wildcard.
    */
@@ -15254,10 +15534,6 @@ export declare interface XmlToJsonPolicyOptions {
    * Text value of a tag is parsed to #text property by default.
    */
   textNodeName?: string;
-  /**
-   * Remove surrounding whitespace from tag or attribute value.
-   */
-  trimValues?: boolean;
   /**
    * A list of status codes and ranges "200-299, 304" that should the XML parser should run on. If not set, the parser will run on all status codes.
    */