@zuplo/cli 6.73.23 → 6.73.25

package/node_modules/@zuplo/runtime/out/esm/sdks/aws/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{i as a,j as l,k as c,l as o,o as p,p as y,q as m}from"../../chunk-QWO5UTVQ.js";import"../../chunk-VCMIY3WJ.js";import{a as i}from"../../chunk-2WLR6ZDZ.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
+import{h as a,i as l,j as c,k as o,n as p,o as y,p as m}from"../../chunk-V4X24KCQ.js";import"../../chunk-TRBIM47E.js";import"../../chunk-VCMIY3WJ.js";import{a as i}from"../../chunk-2WLR6ZDZ.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
 //# sourceMappingURL=index.js.map

package/node_modules/@zuplo/runtime/out/esm/sdks/aws/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["@zuplo/runtime/sdks/aws/sign.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;kKAiDA,eAAsBA,EACpBC,EACAC,EACkB,CAClB,IAAMC,EACJ,OAAOD,EAAQ,aAAgB,WAC3B,MAAMA,EAAQ,YAAY,EAC1BA,EAAQ,YAERE,EAASH,EAAQ,OAEjBI,EADUD,IAAW,OAASA,IAAW,QAAUH,EAAQ,MAAQ,KAClD,MAAMA,EAAQ,YAAY,EAAI,KAe/CK,EAAS,MAbA,IAAIC,EAAY,CAC7B,OAAAH,EACA,IAAKH,EAAQ,IACb,QAASA,EAAQ,QACjB,KAAAI,EACA,YAAaF,EAAY,YACzB,gBAAiBA,EAAY,gBAC7B,aAAcA,EAAY,aAC1B,QAASD,EAAQ,QACjB,OAAQA,EAAQ,OAChB,UAAWA,EAAQ,SACrB,CAAC,EAE2B,KAAK,EAEjC,OAAO,IAAI,QAAQI,EAAO,IAAI,SAAS,EAAG,CACxC,OAAQA,EAAO,OACf,QAASA,EAAO,QAChB,KAAMA,EAAO,IACf,CAAC,CACH,CAjCsBE,EAAAR,EAAA","names":["signRequest","request","options","credentials","method","body","signed","AwsV4Signer","__name"]}
+{"version":3,"sources":["@zuplo/runtime/sdks/aws/sign.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;kMAiDA,eAAsBA,EACpBC,EACAC,EACkB,CAClB,IAAMC,EACJ,OAAOD,EAAQ,aAAgB,WAC3B,MAAMA,EAAQ,YAAY,EAC1BA,EAAQ,YAERE,EAASH,EAAQ,OAEjBI,EADUD,IAAW,OAASA,IAAW,QAAUH,EAAQ,MAAQ,KAClD,MAAMA,EAAQ,YAAY,EAAI,KAe/CK,EAAS,MAbA,IAAIC,EAAY,CAC7B,OAAAH,EACA,IAAKH,EAAQ,IACb,QAASA,EAAQ,QACjB,KAAAI,EACA,YAAaF,EAAY,YACzB,gBAAiBA,EAAY,gBAC7B,aAAcA,EAAY,aAC1B,QAASD,EAAQ,QACjB,OAAQA,EAAQ,OAChB,UAAWA,EAAQ,SACrB,CAAC,EAE2B,KAAK,EAEjC,OAAO,IAAI,QAAQI,EAAO,IAAI,SAAS,EAAG,CACxC,OAAQA,EAAO,OACf,QAASA,EAAO,QAChB,KAAMA,EAAO,IACf,CAAC,CACH,CAjCsBE,EAAAR,EAAA","names":["signRequest","request","options","credentials","method","body","signed","AwsV4Signer","__name"]}

package/node_modules/@zuplo/runtime/out/types/index.d.ts

@@ -146,10 +146,16 @@ export declare interface AIGatewayAuthInboundPolicyOptions {
  * Authenticates requests to an AI Gateway v2 endpoint with application API
  * keys.
  *
- * Place this policy first in the inbound chain so the policies that follow can
- * use the authenticated app's configuration. Use `authHeader` and `authScheme`
- * when clients send their app key somewhere other than the default
- * `Authorization: Bearer` header.
+ * Place this policy first in the inbound chain. The policies that follow can
+ * read the authenticated application from `request.user` (`sub` is the
+ * application name, `data` its metadata), and the application's AI Gateway
+ * configuration takes effect for the request. Use `authHeader` and
+ * `authScheme` when clients send their app key somewhere other than the
+ * default `Authorization: Bearer` header.
+ *
+ * When the matched route captures an `app_id` path parameter (platform catch-all
+ * `/:app_id/v1/(.*)`), this policy also requires
+ * `configuration.id === request.params.app_id` and returns 403 on mismatch.
  *
  * @title AI Gateway Authentication (v2)
  * @product ai-gateway
@@ -161,7 +167,7 @@ export declare interface AIGatewayAuthInboundPolicyOptions {
  * @param context - The ZuploContext
  * @param unparsedOptions - The policy configuration options
  * @param policyName - The name of the policy instance
- * @returns The authenticated request with user info, or a 401 response if unauthorized
+ * @returns The authenticated request with user info, or a 401/403 response if unauthorized
  *
  * @example
  * ```json
@@ -240,7 +246,8 @@ export declare type AIGatewayCapability =
   | "audio_transcriptions";
 
 /**
- * Runs the inbound policy chain selected for an authenticated AI Gateway app.
+ * Runs the inbound policy chain from the app configuration provided by
+ * `ai-gateway-auth-v2-inbound`.
  *
  * Use this policy after AI Gateway Authentication (v2) when apps need
  * different combinations or ordering of AI Gateway policies. Applications
@@ -271,7 +278,7 @@ export declare class AIGatewayConfigurationExecutorV2InboundPolicy extends Inbou
 }
 
 /**
- * The application policy chain is supplied through the authenticated request configuration.
+ * This policy has no options. Each application's policy chain comes from its AI Gateway configuration.
  * @public
  */
 export declare interface AIGatewayConfigurationExecutorV2InboundPolicyOptions {}
@@ -386,6 +393,9 @@ export declare function aiGatewayHandlerV2(
  * This policy is meant to be used as singleton.
  * You should only have one for your entire Gateway.
  *
+ * The AI Gateway authentication policy provides the application's
+ * configuration and must run earlier on the route.
+ *
  * Metering runs at most once per request: when the policy appears more than
  * once in the effective chain (for example repeated
  * `configuration.inboundPolicyChain` entries, or a static route entry plus a
@@ -775,11 +785,9 @@ export declare interface AIGatewaySemanticCacheOutboundPolicyOptions {}
  * matching the firewall's single-policy shape (no separate outbound policy).
  *
  * Caching parameters (semanticTolerance, expirationSecondsTtl, namespace) come
- * from the policy options — the policy reads nothing from
- * `request.user.configuration` to decide whether to cache, and presence in the
- * route's chain is what enables it. An authenticated AI Gateway configuration
- * id always provides the cache namespace so application-supplied options cannot
- * cross tenant partitions.
+ * from the policy options, and presence in the route's chain is what enables
+ * it. An id from the authenticated app configuration always provides the cache
+ * namespace so application-supplied options cannot cross tenant partitions.
  *
  * Cache outcomes are reported on the response via the RFC 9211 `Cache-Status`
  * header under the cache name `zp-aigw-sem-cache` (hit:
@@ -1002,9 +1010,8 @@ export declare interface AkamaiAIFirewallPolicyOptions {
  *
  * Detects and blocks malicious AI inputs and outputs via Akamai's AI Firewall
  * service. Settings come from the policy options (configurationId, api-key,
- * applicationId, streamingAccumulation) — the policy reads nothing from
- * `request.user.configuration`, and presence in the route's `inbound[]` chain is
- * what enables it.
+ * applicationId, streamingAccumulation), and presence in the route's
+ * `inbound[]` chain is what enables it.
  *
  * Options are validated at request time and invalid options fail closed with a
  * ConfigurationError: detect-call failures deliberately fail open for
@@ -2866,7 +2873,7 @@ declare interface BuildRouteConfiguration {
 }
 
 /**
- * Partitions the cache when no authenticated AI Gateway configuration id is available. Authenticated AI Gateway applications always use their configuration id so cache entries remain isolated per tenant.
+ * Partitions the cache when the authenticated application has no configuration id. Applications with a configuration id always use it, so cache entries stay isolated per application.
  * @public
  */
 declare type CacheNamespace = string;
@@ -3365,8 +3372,8 @@ export declare interface CometOpikTracingPolicyOptions {
  * Traces both streaming and non-streaming AI Gateway responses to Comet Opik,
  * creating traces when requests start and spans when responses complete.
  * Credentials (apiKey, projectName, workspace, baseUrl) come from the policy
- * options — the policy reads nothing from `request.user.configuration` to decide
- * whether to run, and presence in the route's chain is what enables it.
+ * options. The authenticated app configuration is used only to label the
+ * model; presence in the route's chain is what enables the policy.
  *
  * For streaming responses, it clones the response stream and processes it in
  * the background using `waitUntil`, allowing the original stream to pass through
@@ -4777,9 +4784,9 @@ export declare interface GalileoTracingPolicyOptions {
  * Traces both streaming and non-streaming AI Gateway responses to Galileo's LLM
  * observability platform, creating complete traces with workflow and LLM spans
  * when responses complete. Credentials (apiKey, projectId, logStreamId, baseUrl)
- * come from the policy options — the policy reads nothing from
- * `request.user.configuration` to decide whether to run, and presence in the
- * route's chain is what enables it.
+ * come from the policy options. The authenticated app configuration is used
+ * only to label the model; presence in the route's chain is what enables the
+ * policy.
  *
  * For streaming responses, it clones the response stream and processes it in
  * the background using `waitUntil`, allowing the original stream to pass through