@zuplo/cli 6.72.9 → 6.72.11

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -139,6 +139,11 @@ export declare interface AIGatewayAuthInboundPolicyOptions {
   authScheme?: string;
 }
 
+/**
+ * An AI Gateway capability that can have a resolved model selection.
+ *
+ * @public
+ */
 export declare type AIGatewayCapability =
   | "completions"
   | "embeddings"
@@ -148,9 +153,17 @@ export declare type AIGatewayCapability =
   | "audio_speech"
   | "audio_transcriptions";
 
+/**
+ * Primary and optional fallback routing for one AI Gateway capability.
+ *
+ * @public
+ */
 export declare interface AIGatewayCapabilityRouting {
+  /** The primary provider and model. */
   model: AIGatewayModelRef;
+  /** The provider and model used after a retryable error or timeout. */
   fallback?: AIGatewayFallbackRef;
+  /** The provider and model used after a usage-limit-exceeded signal. */
   quotaFallback?: AIGatewayModelRef;
 }
 
@@ -160,6 +173,11 @@ export declare interface AIGatewayCapabilitySelection {
   quotaFallback?: AIGatewayModelCandidate;
 }
 
+/**
+ * A model used after a retryable primary-provider failure or timeout.
+ *
+ * @public
+ */
 export declare interface AIGatewayFallbackRef extends AIGatewayModelRef {
   /**
    * Bounds the primary call before failing over. Defaults to 60 seconds and is
@@ -196,7 +214,7 @@ export declare function aiGatewayHandler(
 
 /**
  * Routes AI requests using the model selection stored in the request context.
- * Attach the `ai-gateway-models-inbound` policy before this handler runs. To
+ * Attach the `ai-gateway-model-routing-v2-inbound` policy before this handler runs. To
  * compute routing per request, set that policy's `routingFunction` option to
  * a module export.
  *
@@ -214,7 +232,7 @@ export declare function aiGatewayHandler(
  *     "module": "$import(@zuplo/runtime)"
  *   },
  *   "policies": {
- *     "inbound": ["ai-gateway-models"]
+ *     "inbound": ["ai-gateway-model-routing-v2-inbound"]
  *   }
  * }
  * ```
@@ -328,27 +346,60 @@ export declare interface AIGatewayModelCandidate {
   apiKey?: string;
 }
 
+/**
+ * Catalog information about a model that a routing function can inspect.
+ *
+ * Model catalog membership does not indicate that the project has credentials
+ * for the model's provider. The policy resolves credentials only after the
+ * routing function returns a provider and model.
+ *
+ * @public
+ */
+export declare interface AIGatewayModelInfo {
+  /** The provider-specific model identifier to return in model routing. */
+  model: string;
+  /** The AI Gateway capability supported by the model. */
+  capability: "completions" | "embeddings";
+  /** Whether the model is available for new routing or has been deprecated. */
+  status: "active" | "deprecated";
+  /** The catalog's normalized price in USD for one input token. */
+  inputCostPerToken: number;
+  /** The catalog's normalized price in USD for one output token. */
+  outputCostPerToken: number;
+}
+
+/**
+ * Identifies a provider and model in routing configuration.
+ *
+ * @public
+ */
 export declare interface AIGatewayModelRef {
+  /** The case-insensitive provider identifier, such as `openai`. */
   provider: string;
+  /** The provider-specific model identifier, such as `gpt-5`. */
   model: string;
 }
 
+/**
+ * Routing returned by an {@link AIGatewayRoutingFunction}.
+ *
+ * Omitted capabilities keep no implicit value. Return `undefined` from the
+ * function, rather than an empty object, to preserve the policy's static
+ * routing unchanged.
+ *
+ * @public
+ */
 export declare interface AIGatewayModelRouting {
-  providers: AIGatewayProviderCredential[];
+  /** Routing for chat completions, Responses, and Anthropic Messages. */
   completions?: AIGatewayCapabilityRouting;
+  /** Routing for embedding requests. */
   embeddings?: AIGatewayCapabilityRouting;
 }
 
-export declare interface AIGatewayModelSelection {
-  byCapability: Partial<
-    Record<AIGatewayCapability, AIGatewayCapabilitySelection>
-  >;
-}
-
 /**
- * Selects AI Gateway models and fallbacks for each configured capability.
+ * Selects AI Gateway models and fallbacks for the current request's capability.
  *
- * @title AI Gateway Models
+ * @title AI Gateway Model Routing (v2)
  * @beta
  * @product ai-gateway
  * @hidden
@@ -359,15 +410,22 @@ export declare interface AIGatewayModelSelection {
  * @param policyName - The name of the policy as set in policies.json
  * @returns The request with the model selection stored in context
  */
-export declare class AIGatewayModelsInboundPolicy extends InboundPolicy<AIGatewayModelsInboundPolicyOptions> {
+export declare class AIGatewayModelRoutingV2InboundPolicy extends InboundPolicy<AIGatewayModelRoutingV2InboundPolicyOptions> {
   #private;
-  static readonly policyType = "ai-gateway-models";
+  static readonly policyType = "ai-gateway-model-routing-v2";
   /* Excluded from this release type: setModelSelection */
   /** Get the model selection for the current request. */
   static getModelSelection(
     context: ZuploContext
   ): AIGatewayModelSelection | undefined;
-  constructor(options: AIGatewayModelsInboundPolicyOptions, policyName: string);
+  /** Get the provider catalog loaded for the current request. */
+  static getProviders(
+    context: ZuploContext
+  ): AIGatewayProviderInfo[] | undefined;
+  constructor(
+    options: AIGatewayModelRoutingV2InboundPolicyOptions,
+    policyName: string
+  );
   handler(
     request: ZuploRequest,
     context: ZuploContext
@@ -375,14 +433,21 @@ export declare class AIGatewayModelsInboundPolicy extends InboundPolicy<AIGatewa
 }
 
 /**
- * Options for provider credentials and per-capability AI model routing.
+ * Options for per-capability AI model routing. Provider credentials are resolved from the project's AI provider configuration or environment-variable conventions.
  * @public
  */
-export declare interface AIGatewayModelsInboundPolicyOptions {
-  providers?: Providers;
+export declare type AIGatewayModelRoutingV2InboundPolicyOptions = {
+  [k: string]: unknown;
+} & {
   completions?: CompletionsRouting;
   routingFunction?: RoutingFunction;
   embeddings?: EmbeddingsRouting;
+};
+
+export declare interface AIGatewayModelSelection {
+  byCapability: Partial<
+    Record<AIGatewayCapability, AIGatewayCapabilitySelection>
+  >;
 }
 
 /**
@@ -407,19 +472,43 @@ export declare const AIGatewayOpenAIToAnthropicOutboundPolicy: OutboundPolicyHan
  */
 export declare interface AIGatewayOpenAIToAnthropicOutboundPolicyOptions {}
 
-export declare interface AIGatewayProviderCredential {
-  provider: string;
-  apiKey: string;
+/**
+ * Provider metadata and models supplied to a routing function.
+ *
+ * Credentials and environment-variable names are never exposed to customer
+ * code. A provider can appear in this catalog without a key configured for the
+ * project, so routing functions should restrict candidates to providers that
+ * the project is configured to use.
+ *
+ * @public
+ */
+export declare interface AIGatewayProviderInfo {
+  /** The case-insensitive provider identifier used in model routing. */
+  name: string;
+  /** The provider's human-readable display name, when available. */
+  label?: string;
+  /** The provider's request base URL, when supplied by the catalog. */
+  baseUrl?: string;
+  /** Whether this provider was defined by the customer. */
+  isCustom?: boolean;
+  /** Models currently listed for this provider in the live catalog. */
+  models: AIGatewayModelInfo[];
 }
 
 /**
- * Computes model routing for a request. Set as the models policy's
+ * Computes model routing for a request. Set as the model-routing policy's
  * `routingFunction` option. The returned routing is validated exactly like the
  * static policy options and replaces them for the request. Return undefined to
  * use `options.defaultRouting` unchanged. The function owns merge semantics:
  * return the defaults as-is, a modified copy, or entirely new routing. The
  * request is an isolated clone, so reading its body does not consume the request
  * used by later policies or the route handler.
+ *
+ * @param request - An isolated clone of the incoming gateway request.
+ * @param context - The current Zuplo request context.
+ * @param options - Static defaults, the live provider catalog, and policy name.
+ * @returns Per-request model routing, or undefined to keep the static defaults.
+ * @public
  */
 export declare type AIGatewayRoutingFunction = (
   request: ZuploRequest,
@@ -432,6 +521,8 @@ export declare type AIGatewayRoutingFunction = (
 
 /**
  * Options passed to an {@link AIGatewayRoutingFunction}.
+ *
+ * @public
  */
 export declare interface AIGatewayRoutingFunctionOptions {
   /**
@@ -440,7 +531,14 @@ export declare interface AIGatewayRoutingFunctionOptions {
    */
   defaultRouting: AIGatewayModelRouting | undefined;
   /**
-   * The name of the models policy as set in policies.json.
+   * The live provider catalog, including model pricing and lifecycle status.
+   * Catalog membership does not guarantee that the project has credentials for
+   * a provider. Credentials and their environment-variable names are not
+   * exposed to the routing function.
+   */
+  providers: AIGatewayProviderInfo[];
+  /**
+   * The name of the model-routing policy as set in policies.json.
    */
   policyName: string;
 }
@@ -719,7 +817,7 @@ export declare function AkamaiAIFirewallInboundPolicy(
  */
 export declare interface AkamaiAIFirewallPolicyOptions {
   configurationId: ConfigurationID;
-  "api-key": APIKey_2;
+  "api-key": APIKey;
   applicationId?: ApplicationID;
   streamingAccumulation?: StreamingAccumulationSettings;
 }
@@ -759,7 +857,7 @@ export declare function AkamaiAIFirewallV2InboundPolicy(
  */
 export declare interface AkamaiAIFirewallV2PolicyOptions {
   configurationId: ConfigurationID_2;
-  "api-key": APIKey_3;
+  "api-key": APIKey_2;
   applicationId?: ApplicationID_2;
   streamingAccumulation?: StreamingAccumulationSettings_2;
   endpoints?: ApplicableEndpoints_2;
@@ -1118,7 +1216,7 @@ export declare interface ApiAuthKeyInboundPolicyOptions {
 }
 
 /**
- * The API key itself. Use $env(MY_KEY) to substitute an environment variable at build time.
+ * The API key for the AI Firewall.
  * @public
  */
 declare type APIKey = string;
@@ -1129,12 +1227,6 @@ declare type APIKey = string;
  */
 declare type APIKey_2 = string;
 
-/**
- * The API key for the AI Firewall.
- * @public
- */
-declare type APIKey_3 = string;
-
 /**
  * Represents a consumer in the API Key service.
  * @public
@@ -11696,29 +11788,6 @@ export declare interface PropelAuthJwtInboundPolicyOptions {
   oAuthResourceMetadataEnabled?: boolean;
 }
 
-/**
- * The provider registry key, such as openai, anthropic, or a custom provider name.
- * @public
- */
-declare type Provider = string;
-
-/**
- * Provider credentials used by model routing. Each entry must define apiKey.
- *
- * @minItems 1
- * @public
- */
-declare type Providers = [
-  {
-    provider: Provider;
-    apiKey: APIKey;
-  },
-  ...{
-    provider: Provider;
-    apiKey: APIKey;
-  }[],
-];
-
 /**
  * Extracts a query parameter and sets it as a header in the request.
  *
@@ -13537,7 +13606,7 @@ export declare interface RouteHandler<T = unknown> {
 /* Excluded from this release type: Router */
 
 /**
- * Custom function that computes model routing for each request. The export must be an AIGatewayRoutingFunction. It receives the policy's parsed static routing (if any) as defaultRouting; its return value is validated like the static options and replaces the routing for the request. Returning undefined keeps the defaults unchanged.
+ * Custom function that computes model routing for each request. It receives defaultRouting and the project's provider catalog, including pricing. Returning undefined keeps the defaults unchanged.
  * @public
  */
 declare interface RoutingFunction {

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.72.9",
+  "version": "6.72.11",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/avvio/.github/dependabot.yml

@@ -2,12 +2,52 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
     open-pull-requests-limit: 10
 
   - package-ecosystem: "npm"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    versioning-strategy: "increase-if-necessary"
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+    ignore:
+      # TODO: remove ignore until neostandard support ESLint 10
+      - dependency-name: "eslint"
+      - dependency-name: "neostandard"
+      - dependency-name: "@stylistic/*"
     open-pull-requests-limit: 10
+    groups:
+      # Production dependencies with breaking changes
+      dependencies:
+        dependency-type: "production"
+      # ESLint related dependencies
+      dev-dependencies-eslint:
+        patterns:
+          - "eslint"
+          - "neostandard"
+          - "@stylistic/*"
+      # TypeScript related dependencies
+      dev-dependencies-typescript:
+        patterns:
+          - "@types/*"
+          - "tstyche"
+          - "typescript"

package/node_modules/avvio/.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
     with:
       license-check: true
       lint: true

package/node_modules/avvio/.github/workflows/lock-threads.yml

@@ -0,0 +1,19 @@
+name: Lock Threads
+
+on:
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+concurrency:
+  group: lock
+
+permissions:
+  contents: read
+
+jobs:
+  lock-threads:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6

package/node_modules/avvio/LICENSE

@@ -1,9 +1,7 @@
 MIT License
 
 Copyright (c) 2016-2020 Matteo Collina
-Copyright (c) 2020-present The Fastify team
-
-The Fastify team members are listed at https://github.com/fastify/fastify#team.
+Copyright (c) 2020-present The Fastify team <https://github.com/fastify/fastify#team>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/node_modules/avvio/README.md

@@ -584,7 +584,7 @@ app.close()
 
 <a name="symbol-asyncdispose"></a>
 
-### app[Symbol.asyncDispose]()
+### app\[Symbol.asyncDispose\]()
 
 This method is an alias for [`app.close()`](#close) and is used to support the [ECMAScript Explicit Resource Management](https://tc39.es/proposal-explicit-resource-management/) proposal. It allows you to use the `await using` syntax to automatically close the avvio instance when it goes out of scope.
 
@@ -595,14 +595,14 @@ Example:
 ```js
 test('my test', async () => {
   await using app = avvio()
-  
+
   app.use(function (server, opts, done) {
     // Your plugin code
     done()
   })
-  
+
   await app.ready()
-  
+
   // app.close() will be called automatically when exiting this scope
 })
 ```

package/node_modules/avvio/{boot.js → index.js}

@@ -476,9 +476,14 @@ function callWithCbOrNextTick (func, cb) {
     executeWithThenable(func, [err], cb)
   } else {
     if (this._opts.timeout === 0) {
+      let completed = false
       const wrapCb = (err) => {
+        if (completed) {
+          return
+        }
+        completed = true
         this._error = err
-        cb(this._error)
+        process.nextTick(cb, this._error)
       }
 
       if (func.length === 2) {
@@ -513,8 +518,9 @@ function timeoutCall (func, rootErr, context, cb) {
   function timeoutCb (err) {
     if (timer) {
       clearTimeout(timer)
+      timer = null
       this._error = err
-      cb(this._error)
+      process.nextTick(cb, this._error)
     } else {
       // timeout has been triggered
       // can not call cb twice

package/node_modules/avvio/package.json

@@ -1,8 +1,8 @@
 {
   "name": "avvio",
-  "version": "9.2.0",
+  "version": "9.3.0",
   "description": "Asynchronous bootstrapping of Node applications",
-  "main": "boot.js",
+  "main": "index.js",
   "type": "commonjs",
   "types": "index.d.ts",
   "scripts": {
@@ -27,7 +27,7 @@
   "contributors": [
     {
       "name": "Tomas Della Vedova",
-      "url": "http://delved.org"
+      "url": "https://delvedor.dev"
     },
     {
       "name": "Manuel Spigolon",
@@ -60,12 +60,12 @@
   ],
   "devDependencies": {
     "@jsumners/line-reporter": "^1.0.1",
-    "@types/node": "^25.0.3",
-    "borp": "^0.21.0",
-    "c8": "^10.1.3",
+    "@types/node": "^26.0.0",
+    "borp": "^1.0.0",
+    "c8": "^11.0.0",
     "eslint": "^9.17.0",
-    "neostandard": "^0.12.0",
-    "typescript": "~5.9.2"
+    "neostandard": "^0.13.0",
+    "typescript": "~6.0.2"
   },
   "dependencies": {
     "@fastify/error": "^4.0.0",

package/node_modules/avvio/test/esm.mjs

@@ -1,5 +1,5 @@
 import { test } from 'node:test'
-import boot from '../boot.js'
+import boot from '../index.js'
 
 await test('support import', async (t) => {
   const app = boot()

package/node_modules/avvio/test/gh-issues/fastify-6843.test.js

@@ -0,0 +1,48 @@
+'use strict'
+
+const { test } = require('node:test')
+const boot = require('../..')
+
+for (const timeout of [0, 10000]) {
+  test(`synchronous ready callbacks do not overflow the stack with a ${timeout} ms timeout`, async (t) => {
+    const app = boot({}, { timeout })
+    const total = 10000
+    let completed = 0
+
+    app.use((server, options, done) => done())
+
+    for (let i = 0; i < total; i++) {
+      app.ready((err, context, done) => {
+        if (err) {
+          done(err)
+          return
+        }
+
+        completed++
+
+        // Fastify wraps callback-style hooks this way so that thrown hook
+        // errors are forwarded to Avvio.
+        try {
+          done()
+        } catch (error) {
+          done(error)
+        }
+      })
+    }
+
+    await app.ready()
+
+    t.assert.strictEqual(completed, total)
+  })
+
+  test(`ready callbacks complete only once with a ${timeout} ms timeout`, async () => {
+    const app = boot({}, { timeout })
+
+    app.ready((err, context, done) => {
+      done(err)
+      done(new Error('should be ignored'))
+    })
+
+    await app.ready()
+  })
+}

package/node_modules/avvio/test/on-ready-timeout-await.test.js

@@ -3,7 +3,7 @@
 /* eslint no-prototype-builtins: off */
 
 const { test } = require('node:test')
-const boot = require('../boot')
+const boot = require('..')
 
 test('onReadyTimeout', async (t) => {
   const app = boot({}, {

package/node_modules/avvio/test/types/index.ts

@@ -1,5 +1,5 @@
 /* eslint-disable @typescript-eslint/no-unused-expressions */
-import * as avvio from '../../'
+import avvio from '../../'
 
 {
   // avvio with no argument

package/node_modules/avvio/test/types/tsconfig.json

@@ -1,7 +1,10 @@
 {
   "compilerOptions": {
-    "target": "es6",
-    "module": "commonjs",
+    "target": "es2022",
+    "module": "node16",
+    "moduleResolution": "node16",
+    "lib": ["es2022", "esnext.disposable"],
+    "types": ["node"],
     "noEmit": true,
     "strict": true
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "6.72.9",
+  "version": "6.72.11",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -27,10 +27,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.201.1",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "6.72.9",
+    "@zuplo/core": "6.72.11",
     "@zuplo/editor": "1.0.20821740935",
-    "@zuplo/openapi-tools": "6.72.9",
-    "@zuplo/runtime": "6.72.9",
+    "@zuplo/openapi-tools": "6.72.11",
+    "@zuplo/runtime": "6.72.11",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -61,8 +61,8 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "3.25.76",
-    "@zuplo/graphql": "6.72.9",
-    "@zuplo/otel": "6.72.9"
+    "@zuplo/graphql": "6.72.11",
+    "@zuplo/otel": "6.72.11"
   },
   "bundleDependencies": [
     "@inquirer/prompts",