@zuplo/cli 6.72.7 → 6.72.9

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -139,6 +139,35 @@ export declare interface AIGatewayAuthInboundPolicyOptions {
   authScheme?: string;
 }
 
+export declare type AIGatewayCapability =
+  | "completions"
+  | "embeddings"
+  | "rerank"
+  | "moderations"
+  | "images"
+  | "audio_speech"
+  | "audio_transcriptions";
+
+export declare interface AIGatewayCapabilityRouting {
+  model: AIGatewayModelRef;
+  fallback?: AIGatewayFallbackRef;
+  quotaFallback?: AIGatewayModelRef;
+}
+
+export declare interface AIGatewayCapabilitySelection {
+  candidates: AIGatewayModelCandidate[];
+  fallbackTimeoutSeconds?: number;
+  quotaFallback?: AIGatewayModelCandidate;
+}
+
+export declare interface AIGatewayFallbackRef extends AIGatewayModelRef {
+  /**
+   * Bounds the primary call before failing over. Defaults to 60 seconds and is
+   * only meaningful when a fallback is configured.
+   */
+  timeoutSeconds?: number;
+}
+
 /**
  * Handler that routes AI/LLM requests through Zuplo's LLM Translation Layer.
  * This handler forwards requests to the translation layer that handles provider-specific
@@ -165,6 +194,36 @@ export declare function aiGatewayHandler(
   context: ZuploContext
 ): Promise<Response>;
 
+/**
+ * Routes AI requests using the model selection stored in the request context.
+ * Attach the `ai-gateway-models-inbound` policy before this handler runs. To
+ * compute routing per request, set that policy's `routingFunction` option to
+ * a module export.
+ *
+ * @beta
+ * @param request - The incoming AI Gateway request.
+ * @param context - The ZuploContext containing the model selection.
+ * @returns A response from the selected AI provider.
+ *
+ * @public
+ * @example
+ * ```json
+ * {
+ *   "handler": {
+ *     "export": "aiGatewayHandlerV2",
+ *     "module": "$import(@zuplo/runtime)"
+ *   },
+ *   "policies": {
+ *     "inbound": ["ai-gateway-models"]
+ *   }
+ * }
+ * ```
+ */
+export declare function aiGatewayHandlerV2(
+  request: ZuploRequest,
+  context: ZuploContext
+): Promise<Response>;
+
 /* Excluded from this release type: AIGatewayMeterIncrements */
 
 /**
@@ -263,6 +322,69 @@ export declare interface AIGatewayMeteringInboundPolicyOptions {
   throwOnFailure?: boolean;
 }
 
+export declare interface AIGatewayModelCandidate {
+  provider: string;
+  model: string;
+  apiKey?: string;
+}
+
+export declare interface AIGatewayModelRef {
+  provider: string;
+  model: string;
+}
+
+export declare interface AIGatewayModelRouting {
+  providers: AIGatewayProviderCredential[];
+  completions?: AIGatewayCapabilityRouting;
+  embeddings?: AIGatewayCapabilityRouting;
+}
+
+export declare interface AIGatewayModelSelection {
+  byCapability: Partial<
+    Record<AIGatewayCapability, AIGatewayCapabilitySelection>
+  >;
+}
+
+/**
+ * Selects AI Gateway models and fallbacks for each configured capability.
+ *
+ * @title AI Gateway Models
+ * @beta
+ * @product ai-gateway
+ * @hidden
+ * @requiresAI
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns The request with the model selection stored in context
+ */
+export declare class AIGatewayModelsInboundPolicy extends InboundPolicy<AIGatewayModelsInboundPolicyOptions> {
+  #private;
+  static readonly policyType = "ai-gateway-models";
+  /* Excluded from this release type: setModelSelection */
+  /** Get the model selection for the current request. */
+  static getModelSelection(
+    context: ZuploContext
+  ): AIGatewayModelSelection | undefined;
+  constructor(options: AIGatewayModelsInboundPolicyOptions, policyName: string);
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * Options for provider credentials and per-capability AI model routing.
+ * @public
+ */
+export declare interface AIGatewayModelsInboundPolicyOptions {
+  providers?: Providers;
+  completions?: CompletionsRouting;
+  routingFunction?: RoutingFunction;
+  embeddings?: EmbeddingsRouting;
+}
+
 /**
  * Converts OpenAI Chat Completions format responses back to Anthropic Messages format.
  * This policy translates the response when the original request was in Anthropic format.
@@ -285,6 +407,44 @@ export declare const AIGatewayOpenAIToAnthropicOutboundPolicy: OutboundPolicyHan
  */
 export declare interface AIGatewayOpenAIToAnthropicOutboundPolicyOptions {}
 
+export declare interface AIGatewayProviderCredential {
+  provider: string;
+  apiKey: string;
+}
+
+/**
+ * Computes model routing for a request. Set as the models policy's
+ * `routingFunction` option. The returned routing is validated exactly like the
+ * static policy options and replaces them for the request. Return undefined to
+ * use `options.defaultRouting` unchanged. The function owns merge semantics:
+ * return the defaults as-is, a modified copy, or entirely new routing. The
+ * request is an isolated clone, so reading its body does not consume the request
+ * used by later policies or the route handler.
+ */
+export declare type AIGatewayRoutingFunction = (
+  request: ZuploRequest,
+  context: ZuploContext,
+  options: AIGatewayRoutingFunctionOptions
+) =>
+  | AIGatewayModelRouting
+  | undefined
+  | Promise<AIGatewayModelRouting | undefined>;
+
+/**
+ * Options passed to an {@link AIGatewayRoutingFunction}.
+ */
+export declare interface AIGatewayRoutingFunctionOptions {
+  /**
+   * The policy's parsed static routing from policies.json, or undefined when
+   * no static routing is configured.
+   */
+  defaultRouting: AIGatewayModelRouting | undefined;
+  /**
+   * The name of the models policy as set in policies.json.
+   */
+  policyName: string;
+}
+
 /**
  * AI Gateway Semantic Cache policy for caching chat completion responses
  * based on semantic similarity of user messages.
@@ -559,7 +719,7 @@ export declare function AkamaiAIFirewallInboundPolicy(
  */
 export declare interface AkamaiAIFirewallPolicyOptions {
   configurationId: ConfigurationID;
-  "api-key": APIKey;
+  "api-key": APIKey_2;
   applicationId?: ApplicationID;
   streamingAccumulation?: StreamingAccumulationSettings;
 }
@@ -599,7 +759,7 @@ export declare function AkamaiAIFirewallV2InboundPolicy(
  */
 export declare interface AkamaiAIFirewallV2PolicyOptions {
   configurationId: ConfigurationID_2;
-  "api-key": APIKey_2;
+  "api-key": APIKey_3;
   applicationId?: ApplicationID_2;
   streamingAccumulation?: StreamingAccumulationSettings_2;
   endpoints?: ApplicableEndpoints_2;
@@ -958,7 +1118,7 @@ export declare interface ApiAuthKeyInboundPolicyOptions {
 }
 
 /**
- * The API key for the AI Firewall.
+ * The API key itself. Use $env(MY_KEY) to substitute an environment variable at build time.
  * @public
  */
 declare type APIKey = string;
@@ -969,6 +1129,12 @@ declare type APIKey = string;
  */
 declare type APIKey_2 = string;
 
+/**
+ * The API key for the AI Firewall.
+ * @public
+ */
+declare type APIKey_3 = string;
+
 /**
  * Represents a consumer in the API Key service.
  * @public
@@ -3014,6 +3180,29 @@ declare interface CompatibilityFlags {
   return501ForUnsupportedHttpMethods: boolean;
 }
 
+/**
+ * Routing for chat completions, Responses, and Anthropic Messages requests.
+ * @public
+ */
+declare interface CompletionsRouting {
+  model: {
+    provider: string;
+    model: string;
+  };
+  fallback?: {
+    provider: string;
+    model: string;
+    /**
+     * How long the primary model may take before the fallback is attempted.
+     */
+    timeoutSeconds?: number;
+  };
+  quotaFallback?: {
+    provider: string;
+    model: string;
+  };
+}
+
 /**
  * @public
  */
@@ -3947,6 +4136,29 @@ export declare class DynatraceMetricsPlugin extends MetricsPlugin {
   static setContext(context: ZuploContext, data: DynatraceMetricsContext): void;
 }
 
+/**
+ * Routing for embedding requests.
+ * @public
+ */
+declare interface EmbeddingsRouting {
+  model: {
+    provider: string;
+    model: string;
+  };
+  fallback?: {
+    provider: string;
+    model: string;
+    /**
+     * How long the primary model may take before the fallback is attempted.
+     */
+    timeoutSeconds?: number;
+  };
+  quotaFallback?: {
+    provider: string;
+    model: string;
+  };
+}
+
 /**
  * Enable accumulation and validation of streaming responses.
  * @public
@@ -11484,6 +11696,29 @@ export declare interface PropelAuthJwtInboundPolicyOptions {
   oAuthResourceMetadataEnabled?: boolean;
 }
 
+/**
+ * The provider registry key, such as openai, anthropic, or a custom provider name.
+ * @public
+ */
+declare type Provider = string;
+
+/**
+ * Provider credentials used by model routing. Each entry must define apiKey.
+ *
+ * @minItems 1
+ * @public
+ */
+declare type Providers = [
+  {
+    provider: Provider;
+    apiKey: APIKey;
+  },
+  ...{
+    provider: Provider;
+    apiKey: APIKey;
+  }[],
+];
+
 /**
  * Extracts a query parameter and sets it as a header in the request.
  *
@@ -13301,6 +13536,21 @@ export declare interface RouteHandler<T = unknown> {
 
 /* Excluded from this release type: Router */
 
+/**
+ * Custom function that computes model routing for each request. The export must be an AIGatewayRoutingFunction. It receives the policy's parsed static routing (if any) as defaultRouting; its return value is validated like the static options and replaces the routing for the request. Returning undefined keeps the defaults unchanged.
+ * @public
+ */
+declare interface RoutingFunction {
+  /**
+   * Module to load the routing function from, e.g. $import(./modules/model-routing).
+   */
+  module: string;
+  /**
+   * Named export of the routing function, e.g. 'default' or 'routeModels'.
+   */
+  export: string;
+}
+
 /**
  * The authorization rule evaluated against the authenticated user's claims (request.user.data, populated by the authentication policy that runs before this one — a JWT policy, API key auth, mTLS, etc.). A rule is either a single claim check (eq, in, or startsWith) or an and/or combination of nested rules. Combinators may nest up to three levels deep. Requests that fail the rule receive a 403 Forbidden response.
  * @public
@@ -14774,6 +15024,21 @@ declare interface UrlConfig {
  *   }
  * }
  * ```
+ *
+ * @example
+ * ```json
+ * // Abort the request with a 504 if the upstream takes longer than 30 seconds
+ * {
+ *   "handler": {
+ *     "export": "urlForwardHandler",
+ *     "module": "$import(@zuplo/runtime)",
+ *     "options": {
+ *       "baseUrl": "https://backend.example.com",
+ *       "requestTimeoutSeconds": 30
+ *     }
+ *   }
+ * }
+ * ```
  */
 export declare function urlForwardHandler(
   request: ZuploRequest,
@@ -14841,6 +15106,21 @@ export declare function urlForwardHandler(
  *   }
  * }
  * ```
+ *
+ * @example
+ * ```json
+ * // Abort the request with a 504 if the upstream takes longer than 30 seconds
+ * {
+ *   "handler": {
+ *     "export": "urlRewriteHandler",
+ *     "module": "$import(@zuplo/runtime)",
+ *     "options": {
+ *       "rewritePattern": "https://backend.internal/api${url.pathname}",
+ *       "requestTimeoutSeconds": 30
+ *     }
+ *   }
+ * }
+ * ```
  */
 export declare function urlRewriteHandler(
   request: ZuploRequest,

package/node_modules/@zuplo/runtime/out/types/mcp-gateway/index.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod/v4";
 
 /**
- * Optional per-caller access control. Defaults to mode 'allPublic' (no access control). Set mode to 'rolesAndGroups' to match the caller's role/group claims against each capability's markup (every capability must then set roles/groups or public: true), or 'function' to delegate to a custom resolver.
+ * Optional per-caller access control. Defaults to mode 'allPublic' (no access control). Set mode to 'rolesAndGroups' to match the caller's role/group claims against each capability's markup (a capability with no roles/groups/public markup is available to no one), or 'function' to delegate to a custom resolver.
  * @public
  */
 declare interface AccessControl {
@@ -128,9 +128,9 @@ declare interface BuildRouteConfiguration {
  * `roles`/`groups`, each allowing a dot-path such as `realm_access.roles`).
  * `request.user.data` is populated by whichever auth policy ran (JWT claims,
  * API-key metadata, etc.). A capability marked `public: true` is allowed for
- * everyone; otherwise the caller must match any listed role or group. In this
- * mode every capability must be classified (see {@link assertClassified}), so
- * nothing is public by omission.
+ * everyone; otherwise the caller must match any listed role or group. A
+ * capability with no roles/groups/public markup is available to no one until
+ * it is classified, so nothing is ever exposed by omission.
  *
  * @public
  */
@@ -4541,7 +4541,7 @@ declare interface PromptProjection {
 }
 
 /**
- * Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' every capability must set roles/groups OR public: true (not both) — an unclassified capability is a configuration error, so nothing is ever exposed by omission.
+ * Access control: mark this capability as available to all callers. In mode 'rolesAndGroups' a capability with no roles/groups/public markup is available to no one until it is classified, so nothing is ever exposed by omission. Combining public: true with roles/groups is a configuration error.
  * @public
  */
 declare type Public = boolean;

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.72.7",
+  "version": "6.72.9",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/ws/lib/receiver.js

@@ -77,6 +77,7 @@ class Receiver extends Writable {
 
     this._totalPayloadLength = 0;
     this._messageLength = 0;
+    this._numFragments = 0;
     this._fragments = [];
 
     this._errored = false;
@@ -500,6 +501,19 @@ class Receiver extends Writable {
       return;
     }
 
+    if (this._maxFragments > 0 && ++this._numFragments > this._maxFragments) {
+      const error = this.createError(
+        RangeError,
+        'Too many message fragments',
+        false,
+        1008,
+        'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+      );
+
+      cb(error);
+      return;
+    }
+
     if (this._compressed) {
       this._state = INFLATING;
       this.decompress(data, cb);
@@ -507,22 +521,6 @@ class Receiver extends Writable {
     }
 
     if (data.length) {
-      if (
-        this._maxFragments > 0 &&
-        this._fragments.length >= this._maxFragments
-      ) {
-        const error = this.createError(
-          RangeError,
-          'Too many message fragments',
-          false,
-          1008,
-          'WS_ERR_TOO_MANY_BUFFERED_PARTS'
-        );
-
-        cb(error);
-        return;
-      }
-
       //
       // This message is not compressed so its length is the sum of the payload
       // length of all fragments.
@@ -562,22 +560,6 @@ class Receiver extends Writable {
           return;
         }
 
-        if (
-          this._maxFragments > 0 &&
-          this._fragments.length >= this._maxFragments
-        ) {
-          const error = this.createError(
-            RangeError,
-            'Too many message fragments',
-            false,
-            1008,
-            'WS_ERR_TOO_MANY_BUFFERED_PARTS'
-          );
-
-          cb(error);
-          return;
-        }
-
         this._fragments.push(buf);
       }
 
@@ -604,6 +586,7 @@ class Receiver extends Writable {
     this._totalPayloadLength = 0;
     this._messageLength = 0;
     this._fragmented = 0;
+    this._numFragments = 0;
     this._fragments = [];
 
     if (this._opcode === 2) {

package/node_modules/ws/lib/websocket-server.js

@@ -43,9 +43,9 @@ class WebSocketServer extends EventEmitter {
    *     called
    * @param {Function} [options.handleProtocols] A hook to handle protocols
    * @param {String} [options.host] The hostname where to bind the server
-   * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+   * @param {Number} [options.maxBufferedChunks=262144] The maximum number of
    *     buffered data chunks
-   * @param {Number} [options.maxFragments=131072] The maximum number of message
+   * @param {Number} [options.maxFragments=16384] The maximum number of message
    *     fragments
    * @param {Number} [options.maxPayload=104857600] The maximum allowed message
    *     size
@@ -69,8 +69,8 @@ class WebSocketServer extends EventEmitter {
     options = {
       allowSynchronousEvents: true,
       autoPong: true,
-      maxBufferedChunks: 1024 * 1024,
-      maxFragments: 128 * 1024,
+      maxBufferedChunks: 256 * 1024,
+      maxFragments: 16 * 1024,
       maxPayload: 100 * 1024 * 1024,
       skipUTF8Validation: false,
       perMessageDeflate: false,

package/node_modules/ws/lib/websocket.js

@@ -646,9 +646,9 @@ module.exports = WebSocket;
  *     masking key
  * @param {Number} [options.handshakeTimeout] Timeout in milliseconds for the
  *     handshake request
- * @param {Number} [options.maxBufferedChunks=1048576] The maximum number of
+ * @param {Number} [options.maxBufferedChunks=262144] The maximum number of
  *     buffered data chunks
- * @param {Number} [options.maxFragments=131072] The maximum number of message
+ * @param {Number} [options.maxFragments=16384] The maximum number of message
  *     fragments
  * @param {Number} [options.maxPayload=104857600] The maximum allowed message
  *     size
@@ -670,8 +670,8 @@ function initAsClient(websocket, address, protocols, options) {
     autoPong: true,
     closeTimeout: CLOSE_TIMEOUT,
     protocolVersion: protocolVersions[1],
-    maxBufferedChunks: 1024 * 1024,
-    maxFragments: 128 * 1024,
+    maxBufferedChunks: 256 * 1024,
+    maxFragments: 16 * 1024,
     maxPayload: 100 * 1024 * 1024,
     skipUTF8Validation: false,
     perMessageDeflate: true,

package/node_modules/ws/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ws",
-  "version": "8.21.0",
+  "version": "8.21.1",
   "description": "Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js",
   "keywords": [
     "HyBi",
@@ -66,5 +66,9 @@
     "nyc": "^15.0.0",
     "prettier": "^3.0.0",
     "utf-8-validate": "^6.0.0"
+  },
+  "allowScripts": {
+    "bufferutil": true,
+    "utf-8-validate": true
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "6.72.7",
+  "version": "6.72.9",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -27,10 +27,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.201.1",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "6.72.7",
+    "@zuplo/core": "6.72.9",
     "@zuplo/editor": "1.0.20821740935",
-    "@zuplo/openapi-tools": "6.72.7",
-    "@zuplo/runtime": "6.72.7",
+    "@zuplo/openapi-tools": "6.72.9",
+    "@zuplo/runtime": "6.72.9",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -61,8 +61,8 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "3.25.76",
-    "@zuplo/graphql": "6.72.7",
-    "@zuplo/otel": "6.72.7"
+    "@zuplo/graphql": "6.72.9",
+    "@zuplo/otel": "6.72.9"
   },
   "bundleDependencies": [
     "@inquirer/prompts",