@zuplo/cli 6.73.14 → 6.73.15

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -274,6 +274,53 @@ export declare class AIGatewayConfigurationExecutorV2InboundPolicy extends Inbou
  */
 export declare interface AIGatewayConfigurationExecutorV2InboundPolicyOptions {}
 
+/**
+ * Adds failure and quota fallbacks to an existing AI Gateway model selection.
+ *
+ * Place this policy after AI Gateway Model Filtering (v2). It never creates a
+ * model selection, so a misplaced policy cannot bypass filtering.
+ *
+ * @title AI Gateway Fallback Model (v2)
+ * @beta
+ * @product ai-gateway
+ * @requiresAI
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns The unchanged request after enriching an existing model selection
+ * @example
+ * ```json
+ * {
+ *   "models": {
+ *     "completions": {
+ *       "fallback": "anthropic/claude-haiku-4-5",
+ *       "quotaFallback": "openai/gpt-4o-mini"
+ *     }
+ *   },
+ *   "fallbackTimeoutSeconds": 60
+ * }
+ * ```
+ */
+export declare class AIGatewayFallbackModelV2InboundPolicy extends InboundPolicy<AIGatewayFallbackModelV2InboundPolicyOptions> {
+  #private;
+  static readonly policyType = "ai-gateway-fallback-model-v2";
+  constructor(
+    options: AIGatewayFallbackModelV2InboundPolicyOptions,
+    policyName: string
+  );
+  handler(request: ZuploRequest, context: ZuploContext): Promise<ZuploRequest>;
+}
+
+/**
+ * Options for adding failure and quota fallbacks to an existing AI Gateway model selection.
+ * @public
+ */
+export declare interface AIGatewayFallbackModelV2InboundPolicyOptions {
+  models: FallbackModels;
+  fallbackTimeoutSeconds?: FallbackTimeoutSeconds;
+}
+
 /**
  * Handler that routes AI/LLM requests through Zuplo's LLM Translation Layer.
  * This handler forwards requests to the translation layer that handles provider-specific
@@ -302,7 +349,7 @@ export declare function aiGatewayHandler(
 
 /**
  * Routes AI requests using the model selection stored in the request context.
- * Attach the `ai-gateway-model-routing-v2-inbound` policy before this handler
+ * Attach the `ai-gateway-model-filtering-v2-inbound` policy before this handler
  * runs, or call `AIGatewayModelRouting.set(context, routing)` from a custom
  * inbound policy.
  *
@@ -320,7 +367,7 @@ export declare function aiGatewayHandler(
  *     "module": "$import(@zuplo/runtime)"
  *   },
  *   "policies": {
- *     "inbound": ["ai-gateway-model-routing-v2-inbound"]
+ *     "inbound": ["ai-gateway-model-filtering-v2-inbound"]
  *   }
  * }
  * ```
@@ -389,12 +436,11 @@ export declare class AIGatewayMeteringInboundPolicy extends InboundPolicy<AIGate
   private requestCapability;
   /**
    * Validate and return the configured quota fallback when it applies to *this*
-   * request's capability, or `undefined` otherwise (no config, malformed config,
-   * an unsupported path, or no model configured for the request's capability).
-   * Returning `undefined` blocks the request with a 429 — so a fallback is only
-   * counted and applied when the handler can actually serve the request with it.
-   * The config is customer-authored and reaches us through an `unknown` cast, so
-   * we validate it through Zod before acting on it.
+   * request's capability, or `undefined` otherwise. A resolved selection is
+   * already validated and returns a presence-only marker; legacy configuration
+   * is customer-authored and validated through Zod before use. Returning
+   * `undefined` blocks the request with a 429, so a fallback is counted only
+   * when the handler can serve the request with it.
    */
   private resolveQuotaFallback;
   private checkHierarchicalQuotaLimits;
@@ -428,6 +474,54 @@ export declare interface AIGatewayMeteringInboundPolicyOptions {
   throwOnFailure?: boolean;
 }
 
+/**
+ * Matches AI Gateway requests against curated allow lists or open block lists,
+ * then stores the winning model reference for the route handler.
+ *
+ * @title AI Gateway Model Filtering (v2)
+ * @beta
+ * @product ai-gateway
+ * @requiresAI
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns The request with model routing stored in context, or a 4xx response
+ * @example
+ * ```json
+ * {
+ *   "models": {
+ *     "completions": {
+ *       "allowList": [
+ *         "openai/gpt-5",
+ *         "anthropic/claude-sonnet-4-6"
+ *       ]
+ *     }
+ *   }
+ * }
+ * ```
+ */
+export declare class AIGatewayModelFilteringV2InboundPolicy extends InboundPolicy<AIGatewayModelFilteringV2InboundPolicyOptions> {
+  #private;
+  static readonly policyType = "ai-gateway-model-filtering-v2";
+  constructor(
+    options: AIGatewayModelFilteringV2InboundPolicyOptions,
+    policyName: string
+  );
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * Options for allowing or blocking providerName/model references for each AI Gateway capability.
+ * @public
+ */
+export declare interface AIGatewayModelFilteringV2InboundPolicyOptions {
+  models: Models;
+}
+
 /**
  * Catalog information about an AI Gateway model.
  *
@@ -483,57 +577,6 @@ export declare const AIGatewayModelRouting: {
   get(context: ZuploContext): AIGatewayRouting | undefined;
 };
 
-/**
- * Matches AI Gateway requests against curated allow lists or open block lists,
- * then stores the winning {@link AIGatewayRouteTarget} for the route handler.
- *
- * @title AI Gateway Model Routing (v2)
- * @beta
- * @product ai-gateway
- * @requiresAI
- * @param request - The ZuploRequest
- * @param context - The ZuploContext
- * @param options - The policy options set in policies.json
- * @param policyName - The name of the policy as set in policies.json
- * @returns The request with model routing stored in context, or a 4xx response
- * @example
- * ```json
- * {
- *   "models": {
- *     "completions": {
- *       "allowList": [
- *         "openai/gpt-5",
- *         {
- *           "main": "anthropic/claude-sonnet-4-6",
- *           "backup": "openai/gpt-5-mini"
- *         }
- *       ]
- *     }
- *   }
- * }
- * ```
- */
-export declare class AIGatewayModelRoutingV2InboundPolicy extends InboundPolicy<AIGatewayModelRoutingV2InboundPolicyOptions> {
-  #private;
-  static readonly policyType = "ai-gateway-model-routing-v2";
-  constructor(
-    options: AIGatewayModelRoutingV2InboundPolicyOptions,
-    policyName: string
-  );
-  handler(
-    request: ZuploRequest,
-    context: ZuploContext
-  ): Promise<ZuploRequest | Response>;
-}
-
-/**
- * Options for allowing or blocking providerName/model routes for each AI Gateway capability.
- * @public
- */
-export declare interface AIGatewayModelRoutingV2InboundPolicyOptions {
-  models: Models;
-}
-
 /**
  * Accesses the live AI Gateway provider and model catalog.
  *
@@ -1177,12 +1220,18 @@ export declare interface AkamaiFirewallForAiOutboundPolicyOptions {
 }
 
 /**
- * Curated targets clients may select; the first entry is the default when model is omitted.
+ * Models clients may select; the first entry is the default when model is omitted.
  *
  * @minItems 1
  * @public
  */
-declare type AllowedModels = [RouteTarget, ...RouteTarget[]];
+declare type AllowedModels = [ProviderAndModel, ...ProviderAndModel[]];
+
+/**
+ * @minItems 1
+ * @public
+ */
+declare type AllowedModels1 = [ProviderAndModel, ...ProviderAndModel[]];
 
 /**
  * Amberflo is a usage metering and billing service. This policy allows
@@ -2689,13 +2738,19 @@ declare interface BatchDispatcherOptions {
 /* Excluded from this release type: BatchDispatchOptions */
 
 /**
- * Configured providerName/model targets rejected in open-but-filtered mode.
+ * Models rejected in open-but-filtered mode.
  *
  * @minItems 1
  * @public
  */
 declare type BlockedModels = [ProviderAndModel, ...ProviderAndModel[]];
 
+/**
+ * @minItems 1
+ * @public
+ */
+declare type BlockedModels1 = [ProviderAndModel, ...ProviderAndModel[]];
+
 /**
  * The brownout policy allows performing scheduled downtime on your API
  *
@@ -2866,14 +2921,6 @@ export declare interface CachingInboundPolicyOptions {
   dangerouslyIgnoreAuthorizationHeader?: boolean;
 }
 
-/**
- * Choose curated allow-list mode or open-but-filtered block-list mode.
- * @public
- */
-declare type CapabilityModelRules =
-  | CuratedModelRules
-  | OpenButFilteredModelRules;
-
 /**
  * Controls which parts of the incoming request are sent to Akamai for inspection. Akamai's detect endpoint receives the captured fields concatenated into a single labeled text payload as `llmInput`.
  * @public
@@ -3432,11 +3479,22 @@ declare interface CompatibilityFlags {
   return501ForUnsupportedHttpMethods: boolean;
 }
 
+declare interface CompletionsFallbacks {
+  fallback?: FallbackModel;
+  quotaFallback?: QuotaFallbackModel;
+}
+
 /**
  * Rules for chat completions, Responses, and Anthropic Messages requests.
  * @public
  */
-declare type CompletionsModels = CapabilityModelRules;
+declare type CompletionsModels =
+  | {
+      allowList: AllowedModels;
+    }
+  | {
+      blockList: BlockedModels;
+    };
 
 /**
  * @public
@@ -3861,14 +3919,6 @@ export declare class CryptoBeta extends BaseCryptoBeta {
   digest(algorithm: string, data: string): Promise<string>;
 }
 
-/**
- * Allow only listed targets and use entry zero as the default.
- * @public
- */
-declare interface CuratedModelRules {
-  allowList: AllowedModels;
-}
-
 /**
  * Authenticate users using the Curity Phantom Token Pattern.
  *
@@ -4381,11 +4431,22 @@ export declare class DynatraceMetricsPlugin extends MetricsPlugin {
   static setContext(context: ZuploContext, data: DynatraceMetricsContext): void;
 }
 
+declare interface EmbeddingsFallbacks {
+  fallback?: FallbackModel;
+  quotaFallback?: QuotaFallbackModel;
+}
+
 /**
  * Rules for embedding requests.
  * @public
  */
-declare type EmbeddingsModels = CapabilityModelRules;
+declare type EmbeddingsModels =
+  | {
+      allowList: AllowedModels1;
+    }
+  | {
+      blockList: BlockedModels1;
+    };
 
 /**
  * Enable accumulation and validation of streaming responses.
@@ -4514,7 +4575,22 @@ export declare function extractStreamTextDelta(
 ): string | undefined;
 
 /**
- * How long the main model may take before the backup is attempted.
+ * The model attempted after a retryable error or timeout.
+ * @public
+ */
+declare type FallbackModel = string;
+
+/**
+ * Fallbacks grouped by AI Gateway capability.
+ * @public
+ */
+declare interface FallbackModels {
+  completions?: CompletionsFallbacks;
+  embeddings?: EmbeddingsFallbacks;
+}
+
+/**
+ * How long a primary model may take before the failure fallback is attempted.
  * @public
  */
 declare type FallbackTimeoutSeconds = number;
@@ -10069,18 +10145,7 @@ declare interface ModelConfiguration {
 }
 
 /**
- * A primary model and optional failure or quota fallbacks.
- * @public
- */
-declare interface ModelRouteTarget {
-  main: ProviderAndModel1;
-  backup?: ProviderAndModel2;
-  fallbackTimeoutSeconds?: FallbackTimeoutSeconds;
-  quotaFallback?: ProviderAndModel3;
-}
-
-/**
- * Declarative model-routing rules, grouped by AI Gateway capability.
+ * Model filtering rules grouped by AI Gateway capability.
  * @public
  */
 declare interface Models {
@@ -11236,14 +11301,6 @@ declare namespace OpenAPIV3_1 {
   }
 }
 
-/**
- * Allow any requested target except those explicitly blocked.
- * @public
- */
-declare interface OpenButFilteredModelRules {
-  blockList: BlockedModels;
-}
-
 /**
  * Authorize requests using OpenFGA.
  *
@@ -11967,24 +12024,6 @@ export declare interface PropelAuthJwtInboundPolicyOptions {
  */
 declare type ProviderAndModel = string;
 
-/**
- * A model reference in providerName/model form, split on the first slash.
- * @public
- */
-declare type ProviderAndModel1 = string;
-
-/**
- * A model reference in providerName/model form, split on the first slash.
- * @public
- */
-declare type ProviderAndModel2 = string;
-
-/**
- * A model reference in providerName/model form, split on the first slash.
- * @public
- */
-declare type ProviderAndModel3 = string;
-
 /**
  * Extracts a query parameter and sets it as a header in the request.
  *
@@ -12029,6 +12068,12 @@ export declare interface QuotaDetail {
   };
 }
 
+/**
+ * The model selected after a usage-limit-exceeded signal.
+ * @public
+ */
+declare type QuotaFallbackModel = string;
+
 /**
  * Global quota fallback models, keyed by capability. Applied whenever any
  * configured quota limit (any meter/period) is exceeded.
@@ -13802,12 +13847,6 @@ export declare interface RouteHandler<T = unknown> {
 
 /* Excluded from this release type: Router */
 
-/**
- * A providerName/model string shorthand or a full model route target.
- * @public
- */
-declare type RouteTarget = ProviderAndModel | ModelRouteTarget;
-
 /**
  * The authorization rule evaluated against the authenticated user's claims (request.user.data, populated by the authentication policy that runs before this one — a JWT policy, API key auth, mTLS, etc.). A rule is either a single claim check (eq, in, or startsWith) or an and/or combination of nested rules. Combinators may nest up to three levels deep. Requests that fail the rule receive a 403 Forbidden response.
  * @public

package/node_modules/@zuplo/runtime/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "6.73.14",
+  "version": "6.73.15",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {

package/node_modules/hono/dist/cjs/helper/streaming/sse.js

@@ -42,7 +42,7 @@ class SSEStreamingApi extends import_stream.StreamingApi {
     const sseData = [
       message.event && `event: ${message.event}`,
       dataLines,
-      message.id && `id: ${message.id}`,
+      message.id !== void 0 && `id: ${message.id}`,
       message.retry !== void 0 && `retry: ${message.retry}`
     ].filter(Boolean).join("\n") + "\n\n";
     await this.write(sseData);

package/node_modules/hono/dist/cjs/middleware/secure-headers/secure-headers.js

@@ -71,14 +71,20 @@ const secureHeaders = (customOptions) => {
   const headersToSet = getFilteredHeaders(options);
   const callbacks = [];
   if (options.contentSecurityPolicy) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicy);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicy,
+      "Content-Security-Policy"
+    );
     if (callback) {
       callbacks.push(callback);
     }
     headersToSet.push(["Content-Security-Policy", value]);
   }
   if (options.contentSecurityPolicyReportOnly) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicyReportOnly);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicyReportOnly,
+      "Content-Security-Policy-Report-Only"
+    );
     if (callback) {
       callbacks.push(callback);
     }
@@ -111,7 +117,7 @@ function getFilteredHeaders(options) {
     return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
   });
 }
-function getCSPDirectives(contentSecurityPolicy) {
+function getCSPDirectives(contentSecurityPolicy, headerName) {
   const callbacks = [];
   const resultValues = [];
   for (const [directive, value] of Object.entries(contentSecurityPolicy)) {
@@ -136,7 +142,7 @@ function getCSPDirectives(contentSecurityPolicy) {
   resultValues.pop();
   return callbacks.length === 0 ? [void 0, resultValues.join("")] : [
     (ctx, headersToSet) => headersToSet.map((values) => {
-      if (values[0] === "Content-Security-Policy" || values[0] === "Content-Security-Policy-Report-Only") {
+      if (values[0] === headerName) {
         const clone = values[1].slice();
         callbacks.forEach((cb) => {
           cb(ctx, clone);

package/node_modules/hono/dist/cjs/request.js

@@ -98,7 +98,7 @@ class HonoRequest {
     if (name) {
       return this.raw.headers.get(name) ?? void 0;
     }
-    const headerData = {};
+    const headerData = /* @__PURE__ */ Object.create(null);
     this.raw.headers.forEach((value, key) => {
       headerData[key] = value;
     });

package/node_modules/hono/dist/cjs/utils/accept.js

@@ -146,7 +146,7 @@ const getNextParam = (acceptHeader, startIndex) => {
 const getNextAcceptValue = (acceptHeader, startIndex) => {
   const accept = {
     type: "",
-    params: {},
+    params: /* @__PURE__ */ Object.create(null),
     q: 1
   };
   startIndex = consumeWhitespace(acceptHeader, startIndex);

package/node_modules/hono/dist/cjs/utils/url.js

@@ -192,7 +192,7 @@ const _getQueryParam = (url, key, multiple) => {
       return void 0;
     }
   }
-  const results = {};
+  const results = /* @__PURE__ */ Object.create(null);
   encoded ??= /[%+]/.test(url);
   let keyIndex = url.indexOf("?", 8);
   while (keyIndex !== -1) {

package/node_modules/hono/dist/helper/streaming/sse.js

@@ -20,7 +20,7 @@ var SSEStreamingApi = class extends StreamingApi {
     const sseData = [
       message.event && `event: ${message.event}`,
       dataLines,
-      message.id && `id: ${message.id}`,
+      message.id !== void 0 && `id: ${message.id}`,
       message.retry !== void 0 && `retry: ${message.retry}`
     ].filter(Boolean).join("\n") + "\n\n";
     await this.write(sseData);

package/node_modules/hono/dist/middleware/secure-headers/secure-headers.js

@@ -49,14 +49,20 @@ var secureHeaders = (customOptions) => {
   const headersToSet = getFilteredHeaders(options);
   const callbacks = [];
   if (options.contentSecurityPolicy) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicy);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicy,
+      "Content-Security-Policy"
+    );
     if (callback) {
       callbacks.push(callback);
     }
     headersToSet.push(["Content-Security-Policy", value]);
   }
   if (options.contentSecurityPolicyReportOnly) {
-    const [callback, value] = getCSPDirectives(options.contentSecurityPolicyReportOnly);
+    const [callback, value] = getCSPDirectives(
+      options.contentSecurityPolicyReportOnly,
+      "Content-Security-Policy-Report-Only"
+    );
     if (callback) {
       callbacks.push(callback);
     }
@@ -89,7 +95,7 @@ function getFilteredHeaders(options) {
     return typeof overrideValue === "string" ? [defaultValue[0], overrideValue] : defaultValue;
   });
 }
-function getCSPDirectives(contentSecurityPolicy) {
+function getCSPDirectives(contentSecurityPolicy, headerName) {
   const callbacks = [];
   const resultValues = [];
   for (const [directive, value] of Object.entries(contentSecurityPolicy)) {
@@ -114,7 +120,7 @@ function getCSPDirectives(contentSecurityPolicy) {
   resultValues.pop();
   return callbacks.length === 0 ? [void 0, resultValues.join("")] : [
     (ctx, headersToSet) => headersToSet.map((values) => {
-      if (values[0] === "Content-Security-Policy" || values[0] === "Content-Security-Policy-Report-Only") {
+      if (values[0] === headerName) {
         const clone = values[1].slice();
         callbacks.forEach((cb) => {
           cb(ctx, clone);

package/node_modules/hono/dist/request.js

@@ -76,7 +76,7 @@ var HonoRequest = class {
     if (name) {
       return this.raw.headers.get(name) ?? void 0;
     }
-    const headerData = {};
+    const headerData = /* @__PURE__ */ Object.create(null);
     this.raw.headers.forEach((value, key) => {
       headerData[key] = value;
     });

package/node_modules/hono/dist/types/adapter/aws-lambda/types.d.ts

@@ -96,6 +96,15 @@ interface Authorizer {
         userArn: string;
         userId: string;
     };
+    jwt?: {
+        claims: Record<string, string | number | boolean | string[]>;
+        scopes: string[] | null;
+    };
+    /**
+     * The `context` object returned by a Lambda (REQUEST) authorizer.
+     * It is `null` when the authorizer returns no context.
+     */
+    lambda?: Record<string, unknown> | null;
 }
 export interface ApiGatewayRequestContextV2 {
     accountId: string;

package/node_modules/hono/dist/utils/accept.js

@@ -125,7 +125,7 @@ var getNextParam = (acceptHeader, startIndex) => {
 var getNextAcceptValue = (acceptHeader, startIndex) => {
   const accept = {
     type: "",
-    params: {},
+    params: /* @__PURE__ */ Object.create(null),
     q: 1
   };
   startIndex = consumeWhitespace(acceptHeader, startIndex);

package/node_modules/hono/dist/utils/url.js

@@ -159,7 +159,7 @@ var _getQueryParam = (url, key, multiple) => {
       return void 0;
     }
   }
-  const results = {};
+  const results = /* @__PURE__ */ Object.create(null);
   encoded ??= /[%+]/.test(url);
   let keyIndex = url.indexOf("?", 8);
   while (keyIndex !== -1) {

package/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.12.31",
+  "version": "4.12.32",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/cli",
-  "version": "6.73.14",
+  "version": "6.73.15",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "type": "module",
@@ -27,10 +27,10 @@
     "@opentelemetry/api": "1.9.0",
     "@opentelemetry/api-logs": "0.201.1",
     "@swc/core": "1.10.18",
-    "@zuplo/core": "6.73.14",
+    "@zuplo/core": "6.73.15",
     "@zuplo/editor": "1.0.29844086763",
-    "@zuplo/openapi-tools": "6.73.14",
-    "@zuplo/runtime": "6.73.14",
+    "@zuplo/openapi-tools": "6.73.15",
+    "@zuplo/runtime": "6.73.15",
     "chalk": "5.4.1",
     "chokidar": "3.5.3",
     "cookie": "1.0.2",
@@ -61,8 +61,8 @@
     "workerd": "1.20241230.0",
     "yargs": "17.7.2",
     "zod": "3.25.76",
-    "@zuplo/graphql": "6.73.14",
-    "@zuplo/otel": "6.73.14"
+    "@zuplo/graphql": "6.73.15",
+    "@zuplo/otel": "6.73.15"
   },
   "bundleDependencies": [
     "@inquirer/prompts",