@zuplo/cli 6.73.13 → 6.73.15

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -142,6 +142,85 @@ export declare interface AIGatewayAuthInboundPolicyOptions {
   authScheme?: string;
 }
 
+/**
+ * Authenticates requests to an AI Gateway v2 endpoint with application API
+ * keys.
+ *
+ * Place this policy first in the inbound chain so the policies that follow can
+ * use the authenticated app's configuration. Use `authHeader` and `authScheme`
+ * when clients send their app key somewhere other than the default
+ * `Authorization: Bearer` header.
+ *
+ * @title AI Gateway Authentication (v2)
+ * @product ai-gateway
+ * @hidden
+ * @requiresAI
+ * @public
+ *
+ * @param request - The incoming ZuploRequest
+ * @param context - The ZuploContext
+ * @param unparsedOptions - The policy configuration options
+ * @param policyName - The name of the policy instance
+ * @returns The authenticated request with user info, or a 401 response if unauthorized
+ *
+ * @example
+ * ```json
+ * // policies.json - Authenticate an AI Gateway v2 route
+ * {
+ *   "name": "ai-gateway-auth",
+ *   "policyType": "ai-gateway-auth-v2",
+ *   "handler": {
+ *     "export": "AIGatewayAuthV2InboundPolicy",
+ *     "module": "$import(@zuplo/runtime)",
+ *     "options": {
+ *        "cacheTtlSeconds": 300
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ * @example
+ * ```json
+ * // Accept an app key from a custom header
+ * {
+ *   "handler": {
+ *     "export": "AIGatewayAuthV2InboundPolicy",
+ *     "module": "$import(@zuplo/runtime)",
+ *     "options": {
+ *       "authHeader": "x-api-key",
+ *       "authScheme": ""
+ *     }
+ *   }
+ * }
+ * ```
+ *
+ */
+export declare function AIGatewayAuthV2InboundPolicy(
+  request: ZuploRequest,
+  context: ZuploContext,
+  unparsedOptions: AIGatewayAuthV2InboundPolicyOptions,
+  policyName: string
+): Promise<Response | ZuploRequest<RequestGeneric_2>>;
+
+/**
+ * The options for this policy.
+ * @public
+ */
+export declare interface AIGatewayAuthV2InboundPolicyOptions {
+  /**
+   * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc.
+   */
+  cacheTtlSeconds?: number;
+  /**
+   * The name of the header with the key.
+   */
+  authHeader?: string;
+  /**
+   * The scheme used on the header.
+   */
+  authScheme?: string;
+}
+
 /**
  * An AI Gateway capability that can have a resolved model selection.
  *
@@ -160,6 +239,88 @@ export declare type AIGatewayCapability =
   | "audio_speech"
   | "audio_transcriptions";
 
+/**
+ * Runs the inbound policy chain selected for an authenticated AI Gateway app.
+ *
+ * Use this policy after AI Gateway Authentication (v2) when apps need
+ * different combinations or ordering of AI Gateway policies. Applications
+ * select from policies pre-declared by the gateway. Applications without a
+ * `inboundPolicyChain`, or with an empty chain, run no application-selected
+ * policies.
+ * Entry options replace the declaration's options as a complete object; omit
+ * them to inherit the declaration, including environment-backed credentials.
+ *
+ * @title AI Gateway Configuration Executor (v2)
+ * @product ai-gateway
+ * @hidden
+ * @requiresAI
+ */
+export declare class AIGatewayConfigurationExecutorV2InboundPolicy extends InboundPolicy<AIGatewayConfigurationExecutorV2InboundPolicyOptions> {
+  #private;
+  static readonly policyType = "ai-gateway-configuration-executor-v2";
+  constructor(
+    options: AIGatewayConfigurationExecutorV2InboundPolicyOptions,
+    policyName: string
+  );
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * The application policy chain is supplied through the authenticated request configuration.
+ * @public
+ */
+export declare interface AIGatewayConfigurationExecutorV2InboundPolicyOptions {}
+
+/**
+ * Adds failure and quota fallbacks to an existing AI Gateway model selection.
+ *
+ * Place this policy after AI Gateway Model Filtering (v2). It never creates a
+ * model selection, so a misplaced policy cannot bypass filtering.
+ *
+ * @title AI Gateway Fallback Model (v2)
+ * @beta
+ * @product ai-gateway
+ * @requiresAI
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns The unchanged request after enriching an existing model selection
+ * @example
+ * ```json
+ * {
+ *   "models": {
+ *     "completions": {
+ *       "fallback": "anthropic/claude-haiku-4-5",
+ *       "quotaFallback": "openai/gpt-4o-mini"
+ *     }
+ *   },
+ *   "fallbackTimeoutSeconds": 60
+ * }
+ * ```
+ */
+export declare class AIGatewayFallbackModelV2InboundPolicy extends InboundPolicy<AIGatewayFallbackModelV2InboundPolicyOptions> {
+  #private;
+  static readonly policyType = "ai-gateway-fallback-model-v2";
+  constructor(
+    options: AIGatewayFallbackModelV2InboundPolicyOptions,
+    policyName: string
+  );
+  handler(request: ZuploRequest, context: ZuploContext): Promise<ZuploRequest>;
+}
+
+/**
+ * Options for adding failure and quota fallbacks to an existing AI Gateway model selection.
+ * @public
+ */
+export declare interface AIGatewayFallbackModelV2InboundPolicyOptions {
+  models: FallbackModels;
+  fallbackTimeoutSeconds?: FallbackTimeoutSeconds;
+}
+
 /**
  * Handler that routes AI/LLM requests through Zuplo's LLM Translation Layer.
  * This handler forwards requests to the translation layer that handles provider-specific
@@ -188,7 +349,7 @@ export declare function aiGatewayHandler(
 
 /**
  * Routes AI requests using the model selection stored in the request context.
- * Attach the `ai-gateway-model-routing-v2-inbound` policy before this handler
+ * Attach the `ai-gateway-model-filtering-v2-inbound` policy before this handler
  * runs, or call `AIGatewayModelRouting.set(context, routing)` from a custom
  * inbound policy.
  *
@@ -206,7 +367,7 @@ export declare function aiGatewayHandler(
  *     "module": "$import(@zuplo/runtime)"
  *   },
  *   "policies": {
- *     "inbound": ["ai-gateway-model-routing-v2-inbound"]
+ *     "inbound": ["ai-gateway-model-filtering-v2-inbound"]
  *   }
  * }
  * ```
@@ -275,12 +436,11 @@ export declare class AIGatewayMeteringInboundPolicy extends InboundPolicy<AIGate
   private requestCapability;
   /**
    * Validate and return the configured quota fallback when it applies to *this*
-   * request's capability, or `undefined` otherwise (no config, malformed config,
-   * an unsupported path, or no model configured for the request's capability).
-   * Returning `undefined` blocks the request with a 429 — so a fallback is only
-   * counted and applied when the handler can actually serve the request with it.
-   * The config is customer-authored and reaches us through an `unknown` cast, so
-   * we validate it through Zod before acting on it.
+   * request's capability, or `undefined` otherwise. A resolved selection is
+   * already validated and returns a presence-only marker; legacy configuration
+   * is customer-authored and validated through Zod before use. Returning
+   * `undefined` blocks the request with a 429, so a fallback is counted only
+   * when the handler can serve the request with it.
    */
   private resolveQuotaFallback;
   private checkHierarchicalQuotaLimits;
@@ -314,6 +474,54 @@ export declare interface AIGatewayMeteringInboundPolicyOptions {
   throwOnFailure?: boolean;
 }
 
+/**
+ * Matches AI Gateway requests against curated allow lists or open block lists,
+ * then stores the winning model reference for the route handler.
+ *
+ * @title AI Gateway Model Filtering (v2)
+ * @beta
+ * @product ai-gateway
+ * @requiresAI
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns The request with model routing stored in context, or a 4xx response
+ * @example
+ * ```json
+ * {
+ *   "models": {
+ *     "completions": {
+ *       "allowList": [
+ *         "openai/gpt-5",
+ *         "anthropic/claude-sonnet-4-6"
+ *       ]
+ *     }
+ *   }
+ * }
+ * ```
+ */
+export declare class AIGatewayModelFilteringV2InboundPolicy extends InboundPolicy<AIGatewayModelFilteringV2InboundPolicyOptions> {
+  #private;
+  static readonly policyType = "ai-gateway-model-filtering-v2";
+  constructor(
+    options: AIGatewayModelFilteringV2InboundPolicyOptions,
+    policyName: string
+  );
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * Options for allowing or blocking providerName/model references for each AI Gateway capability.
+ * @public
+ */
+export declare interface AIGatewayModelFilteringV2InboundPolicyOptions {
+  models: Models;
+}
+
 /**
  * Catalog information about an AI Gateway model.
  *
@@ -369,57 +577,6 @@ export declare const AIGatewayModelRouting: {
   get(context: ZuploContext): AIGatewayRouting | undefined;
 };
 
-/**
- * Matches AI Gateway requests against curated allow lists or open block lists,
- * then stores the winning {@link AIGatewayRouteTarget} for the route handler.
- *
- * @title AI Gateway Model Routing (v2)
- * @beta
- * @product ai-gateway
- * @requiresAI
- * @param request - The ZuploRequest
- * @param context - The ZuploContext
- * @param options - The policy options set in policies.json
- * @param policyName - The name of the policy as set in policies.json
- * @returns The request with model routing stored in context, or a 4xx response
- * @example
- * ```json
- * {
- *   "models": {
- *     "completions": {
- *       "allowList": [
- *         "openai/gpt-5",
- *         {
- *           "main": "anthropic/claude-sonnet-4-6",
- *           "backup": "openai/gpt-5-mini"
- *         }
- *       ]
- *     }
- *   }
- * }
- * ```
- */
-export declare class AIGatewayModelRoutingV2InboundPolicy extends InboundPolicy<AIGatewayModelRoutingV2InboundPolicyOptions> {
-  #private;
-  static readonly policyType = "ai-gateway-model-routing-v2";
-  constructor(
-    options: AIGatewayModelRoutingV2InboundPolicyOptions,
-    policyName: string
-  );
-  handler(
-    request: ZuploRequest,
-    context: ZuploContext
-  ): Promise<ZuploRequest | Response>;
-}
-
-/**
- * Options for allowing or blocking providerName/model routes for each AI Gateway capability.
- * @public
- */
-export declare interface AIGatewayModelRoutingV2InboundPolicyOptions {
-  models: Models;
-}
-
 /**
  * Accesses the live AI Gateway provider and model catalog.
  *
@@ -612,8 +769,9 @@ export declare interface AIGatewaySemanticCacheOutboundPolicyOptions {}
  * Caching parameters (semanticTolerance, expirationSecondsTtl, namespace) come
  * from the policy options — the policy reads nothing from
  * `request.user.configuration` to decide whether to cache, and presence in the
- * route's chain is what enables it. `namespace` defaults to the AI Gateway
- * configuration id when omitted so caching stays scoped per tenant.
+ * route's chain is what enables it. An authenticated AI Gateway configuration
+ * id always provides the cache namespace so application-supplied options cannot
+ * cross tenant partitions.
  *
  * Cache outcomes are reported on the response via the RFC 9211 `Cache-Status`
  * header under the cache name `zp-aigw-sem-cache` (hit:
@@ -1062,12 +1220,18 @@ export declare interface AkamaiFirewallForAiOutboundPolicyOptions {
 }
 
 /**
- * Curated targets clients may select; the first entry is the default when model is omitted.
+ * Models clients may select; the first entry is the default when model is omitted.
  *
  * @minItems 1
  * @public
  */
-declare type AllowedModels = [RouteTarget, ...RouteTarget[]];
+declare type AllowedModels = [ProviderAndModel, ...ProviderAndModel[]];
+
+/**
+ * @minItems 1
+ * @public
+ */
+declare type AllowedModels1 = [ProviderAndModel, ...ProviderAndModel[]];
 
 /**
  * Amberflo is a usage metering and billing service. This policy allows
@@ -2574,13 +2738,19 @@ declare interface BatchDispatcherOptions {
 /* Excluded from this release type: BatchDispatchOptions */
 
 /**
- * Configured providerName/model targets rejected in open-but-filtered mode.
+ * Models rejected in open-but-filtered mode.
  *
  * @minItems 1
  * @public
  */
 declare type BlockedModels = [ProviderAndModel, ...ProviderAndModel[]];
 
+/**
+ * @minItems 1
+ * @public
+ */
+declare type BlockedModels1 = [ProviderAndModel, ...ProviderAndModel[]];
+
 /**
  * The brownout policy allows performing scheduled downtime on your API
  *
@@ -2683,7 +2853,7 @@ declare interface BuildRouteConfiguration {
 }
 
 /**
- * Partitions the cache. Omit to default to the AI Gateway configuration id, which keeps caching scoped per tenant.
+ * Partitions the cache when no authenticated AI Gateway configuration id is available. Authenticated AI Gateway applications always use their configuration id so cache entries remain isolated per tenant.
  * @public
  */
 declare type CacheNamespace = string;
@@ -2751,14 +2921,6 @@ export declare interface CachingInboundPolicyOptions {
   dangerouslyIgnoreAuthorizationHeader?: boolean;
 }
 
-/**
- * Choose curated allow-list mode or open-but-filtered block-list mode.
- * @public
- */
-declare type CapabilityModelRules =
-  | CuratedModelRules
-  | OpenButFilteredModelRules;
-
 /**
  * Controls which parts of the incoming request are sent to Akamai for inspection. Akamai's detect endpoint receives the captured fields concatenated into a single labeled text payload as `llmInput`.
  * @public
@@ -3317,11 +3479,22 @@ declare interface CompatibilityFlags {
   return501ForUnsupportedHttpMethods: boolean;
 }
 
+declare interface CompletionsFallbacks {
+  fallback?: FallbackModel;
+  quotaFallback?: QuotaFallbackModel;
+}
+
 /**
  * Rules for chat completions, Responses, and Anthropic Messages requests.
  * @public
  */
-declare type CompletionsModels = CapabilityModelRules;
+declare type CompletionsModels =
+  | {
+      allowList: AllowedModels;
+    }
+  | {
+      blockList: BlockedModels;
+    };
 
 /**
  * @public
@@ -3746,14 +3919,6 @@ export declare class CryptoBeta extends BaseCryptoBeta {
   digest(algorithm: string, data: string): Promise<string>;
 }
 
-/**
- * Allow only listed targets and use entry zero as the default.
- * @public
- */
-declare interface CuratedModelRules {
-  allowList: AllowedModels;
-}
-
 /**
  * Authenticate users using the Curity Phantom Token Pattern.
  *
@@ -4266,11 +4431,22 @@ export declare class DynatraceMetricsPlugin extends MetricsPlugin {
   static setContext(context: ZuploContext, data: DynatraceMetricsContext): void;
 }
 
+declare interface EmbeddingsFallbacks {
+  fallback?: FallbackModel;
+  quotaFallback?: QuotaFallbackModel;
+}
+
 /**
  * Rules for embedding requests.
  * @public
  */
-declare type EmbeddingsModels = CapabilityModelRules;
+declare type EmbeddingsModels =
+  | {
+      allowList: AllowedModels1;
+    }
+  | {
+      blockList: BlockedModels1;
+    };
 
 /**
  * Enable accumulation and validation of streaming responses.
@@ -4399,7 +4575,22 @@ export declare function extractStreamTextDelta(
 ): string | undefined;
 
 /**
- * How long the main model may take before the backup is attempted.
+ * The model attempted after a retryable error or timeout.
+ * @public
+ */
+declare type FallbackModel = string;
+
+/**
+ * Fallbacks grouped by AI Gateway capability.
+ * @public
+ */
+declare interface FallbackModels {
+  completions?: CompletionsFallbacks;
+  embeddings?: EmbeddingsFallbacks;
+}
+
+/**
+ * How long a primary model may take before the failure fallback is attempted.
  * @public
  */
 declare type FallbackTimeoutSeconds = number;
@@ -9954,18 +10145,7 @@ declare interface ModelConfiguration {
 }
 
 /**
- * A primary model and optional failure or quota fallbacks.
- * @public
- */
-declare interface ModelRouteTarget {
-  main: ProviderAndModel1;
-  backup?: ProviderAndModel2;
-  fallbackTimeoutSeconds?: FallbackTimeoutSeconds;
-  quotaFallback?: ProviderAndModel3;
-}
-
-/**
- * Declarative model-routing rules, grouped by AI Gateway capability.
+ * Model filtering rules grouped by AI Gateway capability.
  * @public
  */
 declare interface Models {
@@ -11121,14 +11301,6 @@ declare namespace OpenAPIV3_1 {
   }
 }
 
-/**
- * Allow any requested target except those explicitly blocked.
- * @public
- */
-declare interface OpenButFilteredModelRules {
-  blockList: BlockedModels;
-}
-
 /**
  * Authorize requests using OpenFGA.
  *
@@ -11852,24 +12024,6 @@ export declare interface PropelAuthJwtInboundPolicyOptions {
  */
 declare type ProviderAndModel = string;
 
-/**
- * A model reference in providerName/model form, split on the first slash.
- * @public
- */
-declare type ProviderAndModel1 = string;
-
-/**
- * A model reference in providerName/model form, split on the first slash.
- * @public
- */
-declare type ProviderAndModel2 = string;
-
-/**
- * A model reference in providerName/model form, split on the first slash.
- * @public
- */
-declare type ProviderAndModel3 = string;
-
 /**
  * Extracts a query parameter and sets it as a header in the request.
  *
@@ -11914,6 +12068,12 @@ export declare interface QuotaDetail {
   };
 }
 
+/**
+ * The model selected after a usage-limit-exceeded signal.
+ * @public
+ */
+declare type QuotaFallbackModel = string;
+
 /**
  * Global quota fallback models, keyed by capability. Applied whenever any
  * configured quota limit (any meter/period) is exceeded.
@@ -13687,12 +13847,6 @@ export declare interface RouteHandler<T = unknown> {
 
 /* Excluded from this release type: Router */
 
-/**
- * A providerName/model string shorthand or a full model route target.
- * @public
- */
-declare type RouteTarget = ProviderAndModel | ModelRouteTarget;
-
 /**
  * The authorization rule evaluated against the authenticated user's claims (request.user.data, populated by the authentication policy that runs before this one — a JWT policy, API key auth, mTLS, etc.). A rule is either a single claim check (eq, in, or startsWith) or an and/or combination of nested rules. Combinators may nest up to three levels deep. Requests that fail the rule receive a 403 Forbidden response.
  * @public

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.73.13",
+  "version": "6.73.15",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/hono/dist/cjs/helper/streaming/sse.js

@@ -42,7 +42,7 @@ class SSEStreamingApi extends import_stream.StreamingApi {
     const sseData = [
       message.event && `event: ${message.event}`,
       dataLines,
-      message.id && `id: ${message.id}`,
+      message.id !== void 0 && `id: ${message.id}`,
       message.retry !== void 0 && `retry: ${message.retry}`
     ].filter(Boolean).join("\n") + "\n\n";
     await this.write(sseData);

package/node_modules/hono/dist/cjs/middleware/secure-headers/secure-headers.js

@@ -71,14 +71,20 @@ const secureHeaders = (customOptions) => {
   const headersToSet = getFilteredHeaders(options);
   const callbacks = [];
   if (options.contentSecurityPolicy) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicy);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicy,
+      "Content-Security-Policy"
+    );
     if (callback) {
       callbacks.push(callback);
     }
     headersToSet.push(["Content-Security-Policy", value]);
   }
   if (options.contentSecurityPolicyReportOnly) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicyReportOnly);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicyReportOnly,
+      "Content-Security-Policy-Report-Only"
+    );
     if (callback) {
       callbacks.push(callback);
     }
@@ -111,7 +117,7 @@ function getFilteredHeaders(options) {
     return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
   });
 }
-function getCSPDirectives(contentSecurityPolicy) {
+function getCSPDirectives(contentSecurityPolicy, headerName) {
   const callbacks = [];
   const resultValues = [];
   for (const [directive, value] of Object.entries(contentSecurityPolicy)) {
@@ -136,7 +142,7 @@ function getCSPDirectives(contentSecurityPolicy) {
   resultValues.pop();
   return callbacks.length === 0 ? [void 0, resultValues.join("")] : [
     (ctx, headersToSet) => headersToSet.map((values) => {
-      if (values[0] === "Content-Security-Policy" || values[0] === "Content-Security-Policy-Report-Only") {
+      if (values[0] === headerName) {
         const clone = values[1].slice();
         callbacks.forEach((cb) => {
           cb(ctx, clone);

package/node_modules/hono/dist/cjs/request.js

@@ -98,7 +98,7 @@ class HonoRequest {
     if (name) {
       return this.raw.headers.get(name) ?? void 0;
     }
-    const headerData = {};
+    const headerData = /* @__PURE__ */ Object.create(null);
     this.raw.headers.forEach((value, key) => {
       headerData[key] = value;
     });

package/node_modules/hono/dist/cjs/utils/accept.js

@@ -146,7 +146,7 @@ const getNextParam = (acceptHeader, startIndex) => {
 const getNextAcceptValue = (acceptHeader, startIndex) => {
   const accept = {
     type: "",
-    params: {},
+    params: /* @__PURE__ */ Object.create(null),
     q: 1
   };
   startIndex = consumeWhitespace(acceptHeader, startIndex);

package/node_modules/hono/dist/cjs/utils/url.js

@@ -192,7 +192,7 @@ const _getQueryParam = (url, key, multiple) => {
       return void 0;
     }
   }
-  const results = {};
+  const results = /* @__PURE__ */ Object.create(null);
   encoded ??= /[%+]/.test(url);
   let keyIndex = url.indexOf("?", 8);
   while (keyIndex !== -1) {

package/node_modules/hono/dist/helper/streaming/sse.js

@@ -20,7 +20,7 @@ var SSEStreamingApi = class extends StreamingApi {
     const sseData = [
       message.event && `event: ${message.event}`,
       dataLines,
-      message.id && `id: ${message.id}`,
+      message.id !== void 0 && `id: ${message.id}`,
       message.retry !== void 0 && `retry: ${message.retry}`
     ].filter(Boolean).join("\n") + "\n\n";
     await this.write(sseData);