@zuplo/cli 7.9.12 → 7.9.13

package/dist/source/ai-gateway/catalog.json

@@ -0,0 +1,411 @@
+{
+    "formatVersion": 1,
+    "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+    "snapshots": [
+        {
+            "revision": "f9f94ab6646b82abc66a167c95669a50b3e20a7dea224cac0d3893d4ddde6620",
+            "sourceCommit": "3fa357e4ada23887c79964dda62dad06032f418f",
+            "files": {
+                "README-template.md": "# AI Gateway\n\nThis project is a Zuplo AI Gateway. It exposes the canonical AI Gateway\noperations (`/v1/chat/completions`, `/v1/messages`, `/v1/responses`, and\n`/v1/embeddings`) through `aiGatewayHandlerV2` under `/{app_id}/*`. Only paths\nwhose suffix is a supported `/v1/...` operation succeed; other paths under\n`/{app_id}` return 404.\n\nEach route invokes `ai-gateway-configuration-loader-v2-inbound`, which loads\nthe application's configuration from the `app_id` path segment, then\n`ai-gateway-configuration-executor-v2-inbound`, which runs its\n`inboundPolicyChain`. Applications may select only from the policies\npre-declared in `config/policies.json`. To require application API keys for a\nspecific app, add `ai-gateway-auth-v2-inbound` to that application's\n`inboundPolicyChain`. Adding it on the route before the loader requires a key\nfor every application on the route.\n\n## Customizing the gateway\n\n- Declare additional selectable policies (including custom code policies) in\n  `config/policies.json`.\n- Pushes to your default branch deploy the gateway to production.\n",
+                "config/ai.oas.json": "{\n  \"openapi\": \"3.1.0\",\n  \"info\": {\n    \"version\": \"1.0.0\",\n    \"title\": \"AI Gateway API\",\n    \"description\": \"A unified API gateway for multiple AI providers. OpenAI-compatible ops are served under /{app_id}/v1/*; other paths under /{app_id} are rejected.\"\n  },\n  \"paths\": {\n    \"/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,delete\": {\n        \"summary\": \"AI Gateway catch-all\",\n        \"description\": \"Routes AI requests under /{app_id}/* to the AI Gateway handler. The configuration loader loads the application configuration from the app_id path segment; the configuration executor then runs the application's inboundPolicyChain. Only paths whose suffix is a supported /v1/... operation succeed (/v1/chat/completions, /v1/embeddings, /v1/messages, /v1/responses and its sub-resources); anything else under /{app_id} returns 404.\",\n        \"operationId\": \"aiGatewayCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"401\": {\n            \"description\": \"Unauthorized — returned only when the application's inboundPolicyChain includes ai-gateway-auth-v2-inbound, or authentication runs before the configuration loader\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden — returned by per-app policies, such as an API key issued for a different app_id or a model the app does not allow\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-v2-inbound\",\n              \"ai-gateway-configuration-executor-v2-inbound\"\n            ]\n          }\n        }\n      }\n    }\n  }\n}\n",
+                "config/policies.json": "{\n  \"policies\": [\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayAuthV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-auth-v2-inbound\",\n      \"policyType\": \"ai-gateway-auth-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationLoaderV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-configuration-loader-v2-inbound\",\n      \"policyType\": \"ai-gateway-configuration-loader-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationExecutorV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-configuration-executor-v2-inbound\",\n      \"policyType\": \"ai-gateway-configuration-executor-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayMeteringV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-metering-v2-inbound\",\n      \"policyType\": \"ai-gateway-metering-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayModelFilteringV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"allowList\": [\"openai/gpt-4o-mini\"]\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-model-filtering-v2-inbound\",\n      \"policyType\": \"ai-gateway-model-filtering-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayFallbackModelV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"fallback\": \"openai/gpt-4o-mini\"\n            }\n          },\n          \"fallbackTimeoutSeconds\": 60\n        }\n      },\n      \"name\": \"ai-gateway-fallback-model-v2-inbound\",\n      \"policyType\": \"ai-gateway-fallback-model-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewaySemanticCacheV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"semanticTolerance\": 0.4,\n          \"expirationSecondsTtl\": 3600\n        }\n      },\n      \"name\": \"ai-gateway-semantic-cache-v2-inbound\",\n      \"policyType\": \"ai-gateway-semantic-cache-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AkamaiAIFirewallV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"configurationId\": \"\",\n          \"api-key\": \"\"\n        }\n      },\n      \"name\": \"akamai-ai-firewall-v2-inbound\",\n      \"policyType\": \"akamai-ai-firewall-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"CometOpikTracingV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectName\": \"\",\n          \"workspace\": \"\"\n        }\n      },\n      \"name\": \"comet-opik-tracing-v2-inbound\",\n      \"policyType\": \"comet-opik-tracing-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"GalileoTracingV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectId\": \"\",\n          \"logStreamId\": \"\"\n        }\n      },\n      \"name\": \"galileo-tracing-v2-inbound\",\n      \"policyType\": \"galileo-tracing-v2-inbound\"\n    }\n  ]\n}\n",
+                "env.example": "# Optional credentials for the pre-declared AI Gateway policies in\n# config/policies.json. Only required when an application's policy chain\n# selects the matching policy. Configure these as environment variables on\n# your Zuplo project (Settings -> Environment Variables) for deployed\n# environments.\n\n",
+                "gitignore": ".zuplo/\n.cache/\ndist/\nnode_modules/\n\n# OS Stuff\n\n.DS_Store\n",
+                "tsconfig.json": "{\n  \"include\": [\"modules/**/*\", \".zuplo/**/*\"],\n  \"exclude\": [\"./node_modules\", \"./dist\", \"./docs\", \"./examples\"],\n  \"compilerOptions\": {\n    \"module\": \"ESNext\",\n    \"target\": \"ES2022\",\n    \"lib\": [\"ESNext\", \"WebWorker\", \"Webworker.Iterable\"],\n    \"preserveConstEnums\": true,\n    \"moduleResolution\": \"Bundler\",\n    \"useUnknownInCatchVariables\": false,\n    \"forceConsistentCasingInFileNames\": true,\n    \"importHelpers\": true,\n    \"removeComments\": true,\n    \"esModuleInterop\": true,\n    \"noEmit\": true,\n    \"skipLibCheck\": true,\n    \"strictNullChecks\": true,\n    \"experimentalDecorators\": true\n  }\n}\n",
+                "zuplo.jsonc": "{\n  \"version\": 1,\n  \"compatibilityDate\": \"2026-03-01\"\n}\n"
+            }
+        },
+        {
+            "revision": "e291749bef80347f9b04b6b48b15c0060d9f46c929fdff584c65e21dd2a1617b",
+            "sourceCommit": "4bb1d5adf9be0eebda1a5742d37ea871d012c8e4",
+            "files": {
+                "README-template.md": "# AI Gateway\n\nThis project is a Zuplo AI Gateway. It exposes the canonical AI Gateway\noperations (`/v1/chat/completions`, `/v1/messages`, `/v1/responses`, and\n`/v1/embeddings`) through `aiGatewayHandlerV2` under `/{app_id}/*`. Only paths\nwhose suffix is a supported `/v1/...` operation succeed; other paths under\n`/{app_id}` return 404.\n\nEach route invokes `ai-gateway-configuration-loader-v2-inbound`, which loads\nthe application's configuration from the `app_id` path segment, then\n`ai-gateway-configuration-executor-v2-inbound`, which runs its\n`inboundPolicyChain`. Applications may select only from the policies\npre-declared in `config/policies.json`. To require application API keys for a\nspecific app, add `ai-gateway-auth-v2-inbound` to that application's\n`inboundPolicyChain`. Adding it on the route before the loader requires a key\nfor every application on the route.\n\n## Customizing the gateway\n\n- Declare additional selectable policies (including custom code policies) in\n  `config/policies.json`.\n- Pushes to your default branch deploy the gateway to production.\n",
+                "config/ai.oas.json": "{\n  \"openapi\": \"3.1.0\",\n  \"info\": {\n    \"version\": \"1.0.0\",\n    \"title\": \"AI Gateway API\",\n    \"description\": \"A unified API gateway for multiple AI providers. OpenAI-compatible ops are served under /{app_id}/v1/*; other paths under /{app_id} are rejected.\"\n  },\n  \"paths\": {\n    \"/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,delete\": {\n        \"summary\": \"AI Gateway catch-all\",\n        \"description\": \"Routes AI requests under /{app_id}/* to the AI Gateway handler. The configuration loader loads the application configuration from the app_id path segment; the configuration executor then runs the application's inboundPolicyChain. Only paths whose suffix is a supported /v1/... operation succeed (/v1/chat/completions, /v1/embeddings, /v1/messages, /v1/responses and its sub-resources); anything else under /{app_id} returns 404.\",\n        \"operationId\": \"aiGatewayCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"401\": {\n            \"description\": \"Unauthorized — returned only when the application's inboundPolicyChain includes ai-gateway-auth-v2-inbound, or authentication runs before the configuration loader\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden — returned by per-app policies, such as an API key issued for a different app_id or a model the app does not allow\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-v2-inbound\",\n              \"ai-gateway-configuration-executor-v2-inbound\"\n            ]\n          }\n        }\n      }\n    }\n  }\n}\n",
+                "config/policies.json": "{\n  \"policies\": [\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayAuthV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-auth-v2-inbound\",\n      \"policyType\": \"ai-gateway-auth-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationLoaderV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"cacheTtlSeconds\": 5\n        }\n      },\n      \"name\": \"ai-gateway-configuration-loader-v2-inbound\",\n      \"policyType\": \"ai-gateway-configuration-loader-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationExecutorV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-configuration-executor-v2-inbound\",\n      \"policyType\": \"ai-gateway-configuration-executor-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayMeteringV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-metering-v2-inbound\",\n      \"policyType\": \"ai-gateway-metering-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayModelFilteringV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"allowList\": [\"openai/gpt-4o-mini\"]\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-model-filtering-v2-inbound\",\n      \"policyType\": \"ai-gateway-model-filtering-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayFallbackModelV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"fallback\": \"openai/gpt-4o-mini\"\n            }\n          },\n          \"fallbackTimeoutSeconds\": 60\n        }\n      },\n      \"name\": \"ai-gateway-fallback-model-v2-inbound\",\n      \"policyType\": \"ai-gateway-fallback-model-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewaySemanticCacheV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"semanticTolerance\": 0.4,\n          \"expirationSecondsTtl\": 3600\n        }\n      },\n      \"name\": \"ai-gateway-semantic-cache-v2-inbound\",\n      \"policyType\": \"ai-gateway-semantic-cache-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AkamaiAIFirewallV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"configurationId\": \"\",\n          \"api-key\": \"\"\n        }\n      },\n      \"name\": \"akamai-ai-firewall-v2-inbound\",\n      \"policyType\": \"akamai-ai-firewall-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"CometOpikTracingV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectName\": \"\",\n          \"workspace\": \"\"\n        }\n      },\n      \"name\": \"comet-opik-tracing-v2-inbound\",\n      \"policyType\": \"comet-opik-tracing-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"GalileoTracingV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectId\": \"\",\n          \"logStreamId\": \"\"\n        }\n      },\n      \"name\": \"galileo-tracing-v2-inbound\",\n      \"policyType\": \"galileo-tracing-v2-inbound\"\n    }\n  ]\n}\n",
+                "env.example": "# Optional credentials for the pre-declared AI Gateway policies in\n# config/policies.json. Only required when an application's policy chain\n# selects the matching policy. Configure these as environment variables on\n# your Zuplo project (Settings -> Environment Variables) for deployed\n# environments.\n\n",
+                "gitignore": ".zuplo/\n.cache/\ndist/\nnode_modules/\n\n# OS Stuff\n\n.DS_Store\n",
+                "tsconfig.json": "{\n  \"include\": [\"modules/**/*\", \".zuplo/**/*\"],\n  \"exclude\": [\"./node_modules\", \"./dist\", \"./docs\", \"./examples\"],\n  \"compilerOptions\": {\n    \"module\": \"ESNext\",\n    \"target\": \"ES2022\",\n    \"lib\": [\"ESNext\", \"WebWorker\", \"Webworker.Iterable\"],\n    \"preserveConstEnums\": true,\n    \"moduleResolution\": \"Bundler\",\n    \"useUnknownInCatchVariables\": false,\n    \"forceConsistentCasingInFileNames\": true,\n    \"importHelpers\": true,\n    \"removeComments\": true,\n    \"esModuleInterop\": true,\n    \"noEmit\": true,\n    \"skipLibCheck\": true,\n    \"strictNullChecks\": true,\n    \"experimentalDecorators\": true\n  }\n}\n",
+                "zuplo.jsonc": "{\n  \"version\": 1,\n  \"compatibilityDate\": \"2026-03-01\"\n}\n"
+            }
+        },
+        {
+            "revision": "ccce9317ba85ee5807a35073652af29b80c0c97a4cbdc39b16c2b40ed4ce0351",
+            "sourceCommit": "ee4e306a854ed7b20316edc68a23d66e950dd9a2",
+            "files": {
+                "README-template.md": "# AI Gateway\n\nThis project is a Zuplo AI Gateway. It exposes the canonical AI Gateway\noperations (`/v1/chat/completions`, `/v1/messages`, `/v1/responses`, and\n`/v1/embeddings`) through `aiGatewayHandlerV2` under `/{app_id}/*`. Only paths\nwhose suffix is a supported `/v1/...` operation succeed; other paths under\n`/{app_id}` return 404.\n\nEach route invokes `ai-gateway-configuration-loader-v2-inbound`, which loads the\napplication's configuration from the `app_id` path segment, then\n`ai-gateway-configuration-executor-v2-inbound`, which runs its\n`inboundPolicyChain`. Applications may select only from the policies\npre-declared in `config/policies.json`. To require application API keys for a\nspecific app, add `ai-gateway-auth-v2-inbound` to that application's\n`inboundPolicyChain`. Adding it on the route before the loader requires a key\nfor every application on the route.\n\n## Customizing the gateway\n\n- Declare additional selectable policies (including custom code policies) in\n  `config/policies.json`.\n- Pushes to your default branch deploy the gateway to production.\n",
+                "config/ai.oas.json": "{\n  \"openapi\": \"3.1.0\",\n  \"info\": {\n    \"version\": \"1.0.0\",\n    \"title\": \"AI Gateway API\",\n    \"description\": \"A unified API gateway for multiple AI providers. OpenAI-compatible ops are served under /{app_id}/v1/*, AWS Bedrock Runtime ops under /{app_id}/model/{modelId}/{operation}; other paths under /{app_id} are rejected.\"\n  },\n  \"paths\": {\n    \"/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,put,patch,delete,head\": {\n        \"summary\": \"AI Gateway catch-all\",\n        \"description\": \"Routes AI requests under /{app_id}/* to the AI Gateway handler. The configuration loader loads the application configuration from the app_id path segment; the configuration executor then runs the application's inboundPolicyChain. Two path shapes succeed: a supported /v1/... operation (see resolveBasePath in packages/runtime/src/llm-translation/index.ts for the current set) and a Bedrock Runtime operation addressed AWS's way as /model/{modelId}/{operation} (see matchBedrockRuntimeRoute in packages/runtime/src/ai-gateway/bedrock-runtime-route.ts). Anything else under /{app_id} returns 404.\",\n        \"operationId\": \"aiGatewayCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"401\": {\n            \"description\": \"Unauthorized — returned only when the application's inboundPolicyChain includes ai-gateway-auth-v2-inbound, or authentication runs before the configuration loader\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden — returned by per-app policies, such as an API key issued for a different app_id or a model the app does not allow\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-v2-inbound\",\n              \"ai-gateway-configuration-executor-v2-inbound\"\n            ]\n          }\n        }\n      }\n    }\n  }\n}\n",
+                "config/policies.json": "{\n  \"policies\": [\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayAuthV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-auth-v2-inbound\",\n      \"policyType\": \"ai-gateway-auth-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayInternalOnlyInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-internal-only-inbound\",\n      \"policyType\": \"ai-gateway-internal-only\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationLoaderV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"cacheTtlSeconds\": 5\n        }\n      },\n      \"name\": \"ai-gateway-configuration-loader-v2-inbound\",\n      \"policyType\": \"ai-gateway-configuration-loader-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationExecutorV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-configuration-executor-v2-inbound\",\n      \"policyType\": \"ai-gateway-configuration-executor-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayMeteringV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-metering-v2-inbound\",\n      \"policyType\": \"ai-gateway-metering-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayModelFilteringV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"allowList\": [\"openai/gpt-4o-mini\"]\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-model-filtering-v2-inbound\",\n      \"policyType\": \"ai-gateway-model-filtering-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayFallbackModelV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"fallback\": \"openai/gpt-4o-mini\"\n            }\n          },\n          \"fallbackTimeoutSeconds\": 60\n        }\n      },\n      \"name\": \"ai-gateway-fallback-model-v2-inbound\",\n      \"policyType\": \"ai-gateway-fallback-model-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewaySemanticCacheV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"semanticTolerance\": 0.4,\n          \"expirationSecondsTtl\": 3600\n        }\n      },\n      \"name\": \"ai-gateway-semantic-cache-v2-inbound\",\n      \"policyType\": \"ai-gateway-semantic-cache-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AkamaiAIFirewallV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"configurationId\": \"\",\n          \"api-key\": \"\"\n        }\n      },\n      \"name\": \"akamai-ai-firewall-v2-inbound\",\n      \"policyType\": \"akamai-ai-firewall-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayPromptInjectionPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"execution\": \"parallel\"\n        }\n      },\n      \"name\": \"ai-gateway-prompt-injection\",\n      \"policyType\": \"ai-gateway-prompt-injection\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"CometOpikTracingV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectName\": \"\",\n          \"workspace\": \"\"\n        }\n      },\n      \"name\": \"comet-opik-tracing-v2-inbound\",\n      \"policyType\": \"comet-opik-tracing-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"GalileoTracingV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectId\": \"\",\n          \"logStreamId\": \"\"\n        }\n      },\n      \"name\": \"galileo-tracing-v2-inbound\",\n      \"policyType\": \"galileo-tracing-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayDlpInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"rules\": {\n            \"inbound\": {\n              \"pii\": {\n                \"action\": \"mask\"\n              },\n              \"contact-email\": {\n                \"action\": \"off\"\n              },\n              \"finance-credit-card\": {\n                \"action\": \"mask\"\n              },\n              \"finance-iban\": {\n                \"action\": \"mask\"\n              }\n            },\n            \"outbound\": {\n              \"pii\": {\n                \"action\": \"mask\"\n              },\n              \"contact-email\": {\n                \"action\": \"off\"\n              },\n              \"finance-credit-card\": {\n                \"action\": \"mask\"\n              },\n              \"finance-iban\": {\n                \"action\": \"mask\"\n              }\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-dlp-inbound\",\n      \"policyType\": \"ai-gateway-dlp\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewaySmartRouterInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"classifierAppID\": \"\",\n          \"classifierModel\": \"openai/gpt-4o-mini\",\n          \"smartRoutingEnabled\": false,\n          \"modelsByComplexity\": {\n            \"low\": \"openai/gpt-4o-mini\",\n            \"medium\": \"openai/gpt-4o\",\n            \"high\": \"openai/gpt-5\"\n          }\n        }\n      },\n      \"name\": \"ai-gateway-smart-router-inbound\",\n      \"policyType\": \"ai-gateway-smart-router\"\n    }\n  ]\n}\n",
+                "env.example": "# Optional credentials for the pre-declared AI Gateway policies in\n# config/policies.json. Only required when an application's policy chain\n# selects the matching policy. Configure these as environment variables on\n# your Zuplo project (Settings -> Environment Variables) for deployed\n# environments.\n\n",
+                "gitignore": ".zuplo/\n.cache/\ndist/\nnode_modules/\n\n# OS Stuff\n\n.DS_Store\n",
+                "tsconfig.json": "{\n  \"include\": [\"modules/**/*\", \".zuplo/**/*\"],\n  \"exclude\": [\"./node_modules\", \"./dist\", \"./docs\", \"./examples\"],\n  \"compilerOptions\": {\n    \"module\": \"ESNext\",\n    \"target\": \"ES2022\",\n    \"lib\": [\"ESNext\", \"WebWorker\", \"Webworker.Iterable\"],\n    \"preserveConstEnums\": true,\n    \"moduleResolution\": \"Bundler\",\n    \"useUnknownInCatchVariables\": false,\n    \"forceConsistentCasingInFileNames\": true,\n    \"importHelpers\": true,\n    \"removeComments\": true,\n    \"esModuleInterop\": true,\n    \"noEmit\": true,\n    \"skipLibCheck\": true,\n    \"strictNullChecks\": true,\n    \"experimentalDecorators\": true\n  }\n}\n",
+                "zuplo.jsonc": "{\n  \"version\": 1,\n  \"compatibilityDate\": \"2026-03-01\"\n}\n"
+            }
+        },
+        {
+            "revision": "5a36ec349bb12f720f8e4e70c9799a5c35c62cc08106bd7f17b319c348d2a483",
+            "sourceCommit": "28e3ec39391f174b51a63fe03c2f389480507798",
+            "files": {
+                "README-template.md": "## Zuplo AI Gateway\n\nThis is a Zuplo AI Gateway that was created with\n[`create-zuplo-api`](https://zuplo.com/docs). It gives your applications one\nOpenAI-compatible API in front of many AI providers, with per-app keys, model\ncontrols, budgets, caching, and guardrails.\n\n## Getting Started\n\nThe gateway loads each app's configuration (providers, models, and policies)\nfrom your Zuplo account at request time, so the project must be linked to a\nZuplo project before it can serve requests.\n\n1. Link the project. This writes your project's settings to `.env.zuplo`, which\n   is gitignored:\n\n   ```bash\n   npx zuplo link\n   ```\n\n2. In the [Zuplo Portal](https://portal.zuplo.com), add a provider and create an\n   app. Each app gets its own API URL and API key. See\n   [Apps](https://zuplo.com/docs/ai-gateway/apps).\n\n3. Start the development server:\n\n   ```bash\n   npm run dev\n   # or\n   yarn dev\n   # or\n   pnpm dev\n   ```\n\n4. Send a request to the local gateway. Replace `<app_id>` with the ID from your\n   app's API URL and set `ZUPLO_APP_API_KEY` to the app's API key:\n\n   ```bash\n   curl http://localhost:9000/<app_id>/v1/chat/completions \\\n     -H \"Authorization: Bearer $ZUPLO_APP_API_KEY\" \\\n     -H \"Content-Type: application/json\" \\\n     -d '{\n       \"model\": \"openai/gpt-4o-mini\",\n       \"messages\": [{ \"role\": \"user\", \"content\": \"Say hi\" }]\n     }'\n   ```\n\n## Endpoints\n\nEvery request is scoped to an app by the first path segment, `/{app_id}`. For\nthe supported endpoints and which providers serve each one, see the\n[AI Gateway documentation](https://zuplo.com/docs/ai-gateway/overview).\n\n## Project Structure\n\n| Path                       | What it does                                                           |\n| -------------------------- | ---------------------------------------------------------------------- |\n| `config/ai.oas.json`       | The catch-all route that sends `/{app_id}/*` to the AI Gateway handler |\n| `config/policies.json`     | The policies an app can select for its policy chain                    |\n| `modules/zuplo.runtime.ts` | Runtime plugins, such as tracing and logging                           |\n| `.env.example`             | Sample environment variables. Copy it to `.env` for local development  |\n\nAn app runs only the policies listed in its policy chain, and it can select only\npolicies declared in `config/policies.json`. To add your own policy, write it in\n`modules/` and declare it in `config/policies.json`.\n\n## Debugging\n\nIn VS Code, open **Run and Debug**, select **Launch & Attach Zuplo**, and click\nthe green play button.\n\nFor other editors and more details, see the\n[debugging guide](https://zuplo.com/docs/articles/local-development-debugging).\n\n## Deploying\n\nConnect the project to source control in the Zuplo Portal. Pushes to your\ndefault branch deploy the gateway to production.\n\n## Learn More\n\nTo learn more about the AI Gateway, visit the\n[AI Gateway documentation](https://zuplo.com/docs/ai-gateway/overview).\n\nTo connect with the community join [Discord](https://discord.zuplo.com).\n",
+                "config/ai.oas.json": "{\n  \"openapi\": \"3.1.0\",\n  \"info\": {\n    \"version\": \"1.0.0\",\n    \"title\": \"AI Gateway API\",\n    \"description\": \"A unified API gateway for multiple AI providers. OpenAI-compatible ops are served under /{app_id}/v1/*, AWS Bedrock Runtime ops under /{app_id}/model/{modelId}/{operation}; other paths under /{app_id} are rejected.\"\n  },\n  \"paths\": {\n    \"/u/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,put,patch,delete,head\": {\n        \"summary\": \"AI Gateway User App catch-all\",\n        \"description\": \"Routes User App requests under /u/{app_id}/* to the AI Gateway handler. The configuration kind must be ai-user-app.\",\n        \"operationId\": \"aiGatewayUserAppCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden \\u2014 public User App routes require trusted internal access; application API keys cannot authenticate trusted User App calls\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-v2-inbound\",\n              \"ai-gateway-configuration-executor-v2-inbound\"\n            ]\n          }\n        }\n      }\n    },\n    \"/a/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,put,patch,delete,head\": {\n        \"summary\": \"AI Gateway AI App catch-all\",\n        \"description\": \"Routes AI App requests under /a/{app_id}/* to the AI Gateway handler. The configuration kind must be ai-app.\",\n        \"operationId\": \"aiGatewayAIAppCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"401\": {\n            \"description\": \"Unauthorized \\u2014 returned only when the application's inboundPolicyChain includes ai-gateway-auth-v2-inbound, or authentication runs before the configuration loader\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden \\u2014 returned by per-app policies, such as an API key issued for a different app_id or a model the app does not allow\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-v2-inbound\",\n              \"ai-gateway-configuration-executor-v2-inbound\"\n            ]\n          }\n        }\n      }\n    },\n    \"/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,put,patch,delete,head\": {\n        \"summary\": \"AI Gateway catch-all\",\n        \"description\": \"Routes AI requests under /{app_id}/* to the AI Gateway handler. The configuration loader loads the application configuration from the app_id path segment; the configuration executor then runs the application's inboundPolicyChain. Two path shapes succeed: a supported /v1/... operation (see resolveBasePath in packages/runtime/src/llm-translation/index.ts for the current set) and a Bedrock Runtime operation addressed AWS's way as /model/{modelId}/{operation} (see matchBedrockRuntimeRoute in packages/runtime/src/ai-gateway/bedrock-runtime-route.ts). Anything else under /{app_id} returns 404.\",\n        \"operationId\": \"aiGatewayCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"401\": {\n            \"description\": \"Unauthorized \\u2014 returned only when the application's inboundPolicyChain includes ai-gateway-auth-v2-inbound, or authentication runs before the configuration loader\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden \\u2014 returned by per-app policies, such as an API key issued for a different app_id or a model the app does not allow\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-v2-inbound\",\n              \"ai-gateway-configuration-executor-v2-inbound\"\n            ]\n          }\n        }\n      }\n    }\n  }\n}\n",
+                "config/policies.json": "{\n  \"policies\": [\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayAuthV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-auth-v2-inbound\",\n      \"policyType\": \"ai-gateway-auth-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayInternalOnlyInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-internal-only-inbound\",\n      \"policyType\": \"ai-gateway-internal-only\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationLoaderV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"cacheTtlSeconds\": 5\n        }\n      },\n      \"name\": \"ai-gateway-configuration-loader-v2-inbound\",\n      \"policyType\": \"ai-gateway-configuration-loader-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationExecutorV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-configuration-executor-v2-inbound\",\n      \"policyType\": \"ai-gateway-configuration-executor-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayMeteringV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-metering-v2-inbound\",\n      \"policyType\": \"ai-gateway-metering-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayModelFilteringV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"allowList\": [\"openai/gpt-4o-mini\"]\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-model-filtering-v2-inbound\",\n      \"policyType\": \"ai-gateway-model-filtering-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayFallbackModelV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"fallback\": \"openai/gpt-4o-mini\"\n            }\n          },\n          \"fallbackTimeoutSeconds\": 60\n        }\n      },\n      \"name\": \"ai-gateway-fallback-model-v2-inbound\",\n      \"policyType\": \"ai-gateway-fallback-model-v2\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewaySemanticCacheV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"semanticTolerance\": 0.4,\n          \"expirationSecondsTtl\": 3600\n        }\n      },\n      \"name\": \"ai-gateway-semantic-cache-v2-inbound\",\n      \"policyType\": \"ai-gateway-semantic-cache-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AkamaiAIFirewallV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"configurationId\": \"\",\n          \"api-key\": \"\"\n        }\n      },\n      \"name\": \"akamai-ai-firewall-v2-inbound\",\n      \"policyType\": \"akamai-ai-firewall-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayPromptInjectionPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"execution\": \"parallel\"\n        }\n      },\n      \"name\": \"ai-gateway-prompt-injection\",\n      \"policyType\": \"ai-gateway-prompt-injection\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"CometOpikTracingV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectName\": \"\",\n          \"workspace\": \"\"\n        }\n      },\n      \"name\": \"comet-opik-tracing-v2-inbound\",\n      \"policyType\": \"comet-opik-tracing-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"GalileoTracingV2InboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectId\": \"\",\n          \"logStreamId\": \"\"\n        }\n      },\n      \"name\": \"galileo-tracing-v2-inbound\",\n      \"policyType\": \"galileo-tracing-v2-inbound\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayDlpInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"rules\": {\n            \"inbound\": {\n              \"pii\": {\n                \"action\": \"mask\"\n              },\n              \"contact-email\": {\n                \"action\": \"off\"\n              },\n              \"finance-credit-card\": {\n                \"action\": \"mask\"\n              },\n              \"finance-iban\": {\n                \"action\": \"mask\"\n              }\n            },\n            \"outbound\": {\n              \"pii\": {\n                \"action\": \"mask\"\n              },\n              \"contact-email\": {\n                \"action\": \"off\"\n              },\n              \"finance-credit-card\": {\n                \"action\": \"mask\"\n              },\n              \"finance-iban\": {\n                \"action\": \"mask\"\n              }\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-dlp-inbound\",\n      \"policyType\": \"ai-gateway-dlp\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewaySmartRouterInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"classifierAppID\": \"\",\n          \"classifierModel\": \"openai/gpt-4o-mini\",\n          \"smartRoutingEnabled\": false,\n          \"modelsByComplexity\": {\n            \"low\": \"openai/gpt-4o-mini\",\n            \"medium\": \"openai/gpt-4o\",\n            \"high\": \"openai/gpt-5\"\n          }\n        }\n      },\n      \"name\": \"ai-gateway-smart-router-inbound\",\n      \"policyType\": \"ai-gateway-smart-router\"\n    }\n  ]\n}\n",
+                "modules/zuplo.runtime.ts": "import type { RuntimeExtensions } from \"@zuplo/runtime\";\n\n/**\n * `runtimeInit` runs once when your gateway boots. Use it to register plugins\n * and lifecycle hooks. Docs:\n * https://zuplo.com/docs/programmable-api/runtime-extensions\n */\nexport function runtimeInit(runtime: RuntimeExtensions) {\n  // `runtime` is unused until you enable a plugin below. This reference keeps\n  // linters from flagging it; delete it once you call `runtime.addPlugin`.\n  void runtime;\n\n  // --- OpenTelemetry tracing (optional) ------------------------------------\n  // Send traces to Zuplo's built-in tracing. This can also be configured to\n  // send traces to a third-party service such as Honeycomb, Grafana, and\n  // others. Docs: https://zuplo.com/docs/articles/opentelemetry\n  //\n  // To enable, run `npm install @zuplo/otel`, then import `OpenTelemetryPlugin`\n  // from \"@zuplo/otel\" and `environment` from \"@zuplo/runtime\":\n  // const isWorkingCopy =\n  //   environment.ZUPLO_ENVIRONMENT_STAGE === \"working-copy\";\n  // runtime.addPlugin(\n  //   new OpenTelemetryPlugin({\n  //     sampling: {\n  //       headSampler: { ratio: isWorkingCopy ? 1 : 0.1 },\n  //     },\n  //   }),\n  // );\n  // --- Logging (optional) --------------------------------------------------\n  // Ship request logs to Datadog. Other log integrations (New Relic, Splunk,\n  // Loki, Dynatrace, and others) follow the same pattern — see the logging\n  // overview at https://zuplo.com/docs/articles/logging.\n  // Docs: https://zuplo.com/docs/articles/log-plugin-datadog\n  //\n  // To enable, import the plugin and `environment` from \"@zuplo/runtime\":\n  // runtime.addPlugin(\n  //   new DataDogLoggingPlugin({\n  //     apiKey: environment.DATADOG_API_KEY,\n  //     source: \"my-ai-gateway\",\n  //   }),\n  // );\n}\n",
+                "tsconfig.json": "{\n  \"include\": [\"modules/**/*\", \".zuplo/**/*\"],\n  \"exclude\": [\"./node_modules\", \"./dist\", \"./docs\", \"./examples\"],\n  \"compilerOptions\": {\n    \"module\": \"ESNext\",\n    \"target\": \"ES2022\",\n    \"lib\": [\"ESNext\", \"WebWorker\", \"Webworker.Iterable\"],\n    \"preserveConstEnums\": true,\n    \"moduleResolution\": \"Bundler\",\n    \"useUnknownInCatchVariables\": false,\n    \"forceConsistentCasingInFileNames\": true,\n    \"importHelpers\": true,\n    \"removeComments\": true,\n    \"esModuleInterop\": true,\n    \"noEmit\": true,\n    \"skipLibCheck\": true,\n    \"strictNullChecks\": true,\n    \"experimentalDecorators\": true\n  }\n}\n",
+                "zuplo.jsonc": "{\n  \"version\": 1,\n  \"compatibilityDate\": \"2026-03-01\"\n}\n"
+            }
+        },
+        {
+            "revision": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "sourceCommit": "305f4ccb60af80b580ce8271b9e100554aadc61a",
+            "files": {
+                "README-template.md": "## Zuplo AI Gateway\n\nThis is a Zuplo AI Gateway that was created with\n[`create-zuplo-api`](https://zuplo.com/docs). It gives your applications one\nOpenAI-compatible API in front of many AI providers, with per-app keys, model\ncontrols, budgets, caching, and guardrails.\n\n## Getting Started\n\nThe gateway loads each app's configuration (providers, models, and policies)\nfrom your Zuplo account at request time, so the project must be linked to a\nZuplo project before it can serve requests.\n\n1. Link the project. This writes your project's settings to `.env.zuplo`, which\n   is gitignored:\n\n   ```bash\n   npx zuplo link\n   ```\n\n2. In the [Zuplo Portal](https://portal.zuplo.com), add a provider and create an\n   app. Each app gets its own API URL and API key. See\n   [Apps](https://zuplo.com/docs/ai-gateway/apps).\n\n3. Start the development server:\n\n   ```bash\n   npm run dev\n   # or\n   yarn dev\n   # or\n   pnpm dev\n   ```\n\n4. Send a request to the local gateway. Replace `<app_id>` with the ID from your\n   app's API URL and set `ZUPLO_APP_API_KEY` to the app's API key:\n\n   ```bash\n   curl http://localhost:9000/<app_id>/v1/chat/completions \\\n     -H \"Authorization: Bearer $ZUPLO_APP_API_KEY\" \\\n     -H \"Content-Type: application/json\" \\\n     -d '{\n       \"model\": \"openai/gpt-4o-mini\",\n       \"messages\": [{ \"role\": \"user\", \"content\": \"Say hi\" }]\n     }'\n   ```\n\n## Endpoints\n\nEvery request is scoped to an app by the first path segment, `/{app_id}`. For\nthe supported endpoints and which providers serve each one, see the\n[AI Gateway documentation](https://zuplo.com/docs/ai-gateway/overview).\n\n## Project Structure\n\n| Path                       | What it does                                                           |\n| -------------------------- | ---------------------------------------------------------------------- |\n| `config/ai.oas.json`       | The catch-all route that sends `/{app_id}/*` to the AI Gateway handler |\n| `config/policies.json`     | The policies an app can select for its policy chain                    |\n| `modules/zuplo.runtime.ts` | Runtime plugins, such as tracing and logging                           |\n| `.env.example`             | Sample environment variables. Copy it to `.env` for local development  |\n\nAn app runs only the policies listed in its policy chain, and it can select only\npolicies declared in `config/policies.json`. To add your own policy, write it in\n`modules/` and declare it in `config/policies.json`.\n\n## Debugging\n\nIn VS Code, open **Run and Debug**, select **Launch & Attach Zuplo**, and click\nthe green play button.\n\nFor other editors and more details, see the\n[debugging guide](https://zuplo.com/docs/articles/local-development-debugging).\n\n## Deploying\n\nConnect the project to source control in the Zuplo Portal. Pushes to your\ndefault branch deploy the gateway to production.\n\n## Learn More\n\nTo learn more about the AI Gateway, visit the\n[AI Gateway documentation](https://zuplo.com/docs/ai-gateway/overview).\n\nTo connect with the community join [Discord](https://discord.zuplo.com).\n",
+                "config/ai.oas.json": "{\n  \"openapi\": \"3.1.0\",\n  \"info\": {\n    \"version\": \"1.0.0\",\n    \"title\": \"AI Gateway API\",\n    \"description\": \"A unified API gateway for multiple AI providers. OpenAI-compatible ops are served under /{app_id}/v1/*, AWS Bedrock Runtime ops under /{app_id}/model/{modelId}/{operation}; other paths under /{app_id} are rejected.\"\n  },\n  \"paths\": {\n    \"/u/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,put,patch,delete,head\": {\n        \"summary\": \"AI Gateway User App catch-all\",\n        \"description\": \"Routes User App requests under /u/{app_id}/* to the AI Gateway handler. The configuration kind must be ai-user-app.\",\n        \"operationId\": \"aiGatewayUserAppCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden \\u2014 User App routes require a personal API key issued for this User App; application API keys cannot authenticate them\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-inbound\",\n              \"ai-gateway-configuration-executor-inbound\"\n            ]\n          }\n        }\n      }\n    },\n    \"/a/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,put,patch,delete,head\": {\n        \"summary\": \"AI Gateway AI App catch-all\",\n        \"description\": \"Routes AI App requests under /a/{app_id}/* to the AI Gateway handler. The configuration kind must be ai-app.\",\n        \"operationId\": \"aiGatewayAIAppCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"401\": {\n            \"description\": \"Unauthorized \\u2014 returned only when the application's inboundPolicyChain includes ai-gateway-auth-inbound, or authentication runs before the configuration loader\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden \\u2014 returned by per-app policies, such as an API key issued for a different app_id or a model the app does not allow\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-inbound\",\n              \"ai-gateway-configuration-executor-inbound\"\n            ]\n          }\n        }\n      }\n    },\n    \"/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,put,patch,delete,head\": {\n        \"summary\": \"AI Gateway catch-all\",\n        \"description\": \"Routes AI requests under /{app_id}/* to the AI Gateway handler. The configuration loader loads the application configuration from the app_id path segment; the configuration executor then runs the application's inboundPolicyChain. Two path shapes succeed: a supported /v1/... operation (see resolveBasePath in packages/runtime/src/llm-translation/index.ts for the current set) and a Bedrock Runtime operation addressed AWS's way as /model/{modelId}/{operation} (see matchBedrockRuntimeRoute in packages/runtime/src/ai-gateway/bedrock-runtime-route.ts). Anything else under /{app_id} returns 404.\",\n        \"operationId\": \"aiGatewayCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"401\": {\n            \"description\": \"Unauthorized \\u2014 returned only when the application's inboundPolicyChain includes ai-gateway-auth-inbound, or authentication runs before the configuration loader\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden \\u2014 returned by per-app policies, such as an API key issued for a different app_id or a model the app does not allow\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-inbound\",\n              \"ai-gateway-configuration-executor-inbound\"\n            ]\n          }\n        }\n      }\n    }\n  }\n}\n",
+                "config/policies.json": "{\n  \"policies\": [\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayAuthInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-auth-inbound\",\n      \"policyType\": \"ai-gateway-auth\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayInternalOnlyInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-internal-only-inbound\",\n      \"policyType\": \"ai-gateway-internal-only\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationLoaderInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"cacheTtlSeconds\": 5\n        }\n      },\n      \"name\": \"ai-gateway-configuration-loader-inbound\",\n      \"policyType\": \"ai-gateway-configuration-loader\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationExecutorInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-configuration-executor-inbound\",\n      \"policyType\": \"ai-gateway-configuration-executor\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayMeteringInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-metering-inbound\",\n      \"policyType\": \"ai-gateway-metering\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayModelOverrideInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"default\": \"openai/gpt-4o-mini\"\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-model-override-inbound\",\n      \"policyType\": \"ai-gateway-model-override\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayModelFilteringInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"allowList\": [\"openai/gpt-4o-mini\"]\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-model-filtering-inbound\",\n      \"policyType\": \"ai-gateway-model-filtering\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayFallbackModelInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"fallback\": \"openai/gpt-4o-mini\"\n            }\n          },\n          \"fallbackTimeoutSeconds\": 60\n        }\n      },\n      \"name\": \"ai-gateway-fallback-model-inbound\",\n      \"policyType\": \"ai-gateway-fallback-model\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewaySemanticCacheInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"semanticTolerance\": 0.4,\n          \"expirationSecondsTtl\": 3600\n        }\n      },\n      \"name\": \"ai-gateway-semantic-cache-inbound\",\n      \"policyType\": \"ai-gateway-semantic-cache\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayAkamaiFirewallInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"configurationId\": \"\",\n          \"api-key\": \"\"\n        }\n      },\n      \"name\": \"ai-gateway-akamai-firewall-inbound\",\n      \"policyType\": \"ai-gateway-akamai-firewall\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayPromptInjectionPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"execution\": \"parallel\"\n        }\n      },\n      \"name\": \"ai-gateway-prompt-injection\",\n      \"policyType\": \"ai-gateway-prompt-injection\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayOpikTracingInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectName\": \"\",\n          \"workspace\": \"\"\n        }\n      },\n      \"name\": \"ai-gateway-opik-tracing-inbound\",\n      \"policyType\": \"ai-gateway-opik-tracing\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayGalileoTracingInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectId\": \"\",\n          \"logStreamId\": \"\"\n        }\n      },\n      \"name\": \"ai-gateway-galileo-tracing-inbound\",\n      \"policyType\": \"ai-gateway-galileo-tracing\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayDlpInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"rules\": {\n            \"inbound\": {\n              \"pii\": {\n                \"action\": \"mask\"\n              },\n              \"contact-email\": {\n                \"action\": \"off\"\n              },\n              \"finance-credit-card\": {\n                \"action\": \"mask\"\n              },\n              \"finance-iban\": {\n                \"action\": \"mask\"\n              }\n            },\n            \"outbound\": {\n              \"pii\": {\n                \"action\": \"mask\"\n              },\n              \"contact-email\": {\n                \"action\": \"off\"\n              },\n              \"finance-credit-card\": {\n                \"action\": \"mask\"\n              },\n              \"finance-iban\": {\n                \"action\": \"mask\"\n              }\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-dlp-inbound\",\n      \"policyType\": \"ai-gateway-dlp\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewaySmartRouterInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"classifier\": {\n            \"app\": {\n              \"appId\": \"\",\n              \"model\": \"openai/gpt-4o-mini\"\n            }\n          },\n          \"modelsByComplexity\": {\n            \"low\": \"openai/gpt-4o-mini\",\n            \"medium\": \"openai/gpt-4o\",\n            \"high\": \"openai/gpt-5\"\n          }\n        }\n      },\n      \"name\": \"ai-gateway-smart-router-inbound\",\n      \"policyType\": \"ai-gateway-smart-router\"\n    }\n  ]\n}\n",
+                "modules/zuplo.runtime.ts": "import type { RuntimeExtensions } from \"@zuplo/runtime\";\n\n/**\n * `runtimeInit` runs once when your gateway boots. Use it to register plugins\n * and lifecycle hooks. Docs:\n * https://zuplo.com/docs/programmable-api/runtime-extensions\n */\nexport function runtimeInit(runtime: RuntimeExtensions) {\n  // `runtime` is unused until you enable a plugin below. This reference keeps\n  // linters from flagging it; delete it once you call `runtime.addPlugin`.\n  void runtime;\n\n  // --- OpenTelemetry tracing (optional) ------------------------------------\n  // Send traces to Zuplo's built-in tracing. This can also be configured to\n  // send traces to a third-party service such as Honeycomb, Grafana, and\n  // others. Docs: https://zuplo.com/docs/articles/opentelemetry\n  //\n  // To enable, run `npm install @zuplo/otel`, then import `OpenTelemetryPlugin`\n  // from \"@zuplo/otel\" and `environment` from \"@zuplo/runtime\":\n  // const isWorkingCopy =\n  //   environment.ZUPLO_ENVIRONMENT_STAGE === \"working-copy\";\n  // runtime.addPlugin(\n  //   new OpenTelemetryPlugin({\n  //     sampling: {\n  //       headSampler: { ratio: isWorkingCopy ? 1 : 0.1 },\n  //     },\n  //   }),\n  // );\n  // --- Logging (optional) --------------------------------------------------\n  // Ship request logs to Datadog. Other log integrations (New Relic, Splunk,\n  // Loki, Dynatrace, and others) follow the same pattern — see the logging\n  // overview at https://zuplo.com/docs/articles/logging.\n  // Docs: https://zuplo.com/docs/articles/log-plugin-datadog\n  //\n  // To enable, import the plugin and `environment` from \"@zuplo/runtime\":\n  // runtime.addPlugin(\n  //   new DataDogLoggingPlugin({\n  //     apiKey: environment.DATADOG_API_KEY,\n  //     source: \"my-ai-gateway\",\n  //   }),\n  // );\n}\n",
+                "tsconfig.json": "{\n  \"include\": [\"modules/**/*\", \".zuplo/**/*\"],\n  \"exclude\": [\"./node_modules\", \"./dist\", \"./docs\", \"./examples\"],\n  \"compilerOptions\": {\n    \"module\": \"ESNext\",\n    \"target\": \"ES2022\",\n    \"lib\": [\"ESNext\", \"WebWorker\", \"Webworker.Iterable\"],\n    \"preserveConstEnums\": true,\n    \"moduleResolution\": \"Bundler\",\n    \"useUnknownInCatchVariables\": false,\n    \"forceConsistentCasingInFileNames\": true,\n    \"importHelpers\": true,\n    \"removeComments\": true,\n    \"esModuleInterop\": true,\n    \"noEmit\": true,\n    \"skipLibCheck\": true,\n    \"strictNullChecks\": true,\n    \"experimentalDecorators\": true\n  }\n}\n",
+                "zuplo.jsonc": "{\n  \"version\": 1,\n  \"compatibilityDate\": \"2026-03-01\"\n}\n"
+            }
+        },
+        {
+            "revision": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "sourceCommit": "5c44f3afdbe710e6bd0e727a7e6cd9d2e99666cd",
+            "files": {
+                "README-template.md": "## Zuplo AI Gateway\n\nThis is a Zuplo AI Gateway that was created with\n[`create-zuplo-api`](https://zuplo.com/docs). It gives your applications one\nOpenAI-compatible API in front of many AI providers, with per-app keys, model\ncontrols, budgets, caching, and guardrails.\n\n## Getting Started\n\nThe gateway loads each app's configuration (providers, models, and policies)\nfrom your Zuplo account at request time, so the project must be linked to a\nZuplo project before it can serve requests.\n\n1. Link the project. This writes your project's settings to `.env.zuplo`, which\n   is gitignored:\n\n   ```bash\n   npx zuplo link\n   ```\n\n2. In the [Zuplo Portal](https://portal.zuplo.com), add a provider and create an\n   app. Each app gets its own API URL and API key. See\n   [Apps](https://zuplo.com/docs/ai-gateway/apps).\n\n3. Start the development server:\n\n   ```bash\n   npm run dev\n   # or\n   yarn dev\n   # or\n   pnpm dev\n   ```\n\n4. Send a request to the local gateway. Replace `<app_id>` with the ID from your\n   app's API URL and set `ZUPLO_APP_API_KEY` to the app's API key:\n\n   ```bash\n   curl http://localhost:9000/<app_id>/v1/chat/completions \\\n     -H \"Authorization: Bearer $ZUPLO_APP_API_KEY\" \\\n     -H \"Content-Type: application/json\" \\\n     -d '{\n       \"model\": \"openai/gpt-4o-mini\",\n       \"messages\": [{ \"role\": \"user\", \"content\": \"Say hi\" }]\n     }'\n   ```\n\n## Endpoints\n\nEvery request is scoped to an app by the first path segment, `/{app_id}`. For\nthe supported endpoints and which providers serve each one, see the\n[AI Gateway documentation](https://zuplo.com/docs/ai-gateway/overview).\n\n## Project Structure\n\n| Path                       | What it does                                                           |\n| -------------------------- | ---------------------------------------------------------------------- |\n| `config/ai.oas.json`       | The catch-all route that sends `/{app_id}/*` to the AI Gateway handler |\n| `config/policies.json`     | The policies an app can select for its policy chain                    |\n| `modules/zuplo.runtime.ts` | Runtime plugins, such as tracing and logging                           |\n| `.env.example`             | Sample environment variables. Copy it to `.env` for local development  |\n\nAn app runs only the policies listed in its policy chain, and it can select only\npolicies declared in `config/policies.json`. To add your own policy, write it in\n`modules/` and declare it in `config/policies.json`.\n\n## Debugging\n\nIn VS Code, open **Run and Debug**, select **Launch & Attach Zuplo**, and click\nthe green play button.\n\nFor other editors and more details, see the\n[debugging guide](https://zuplo.com/docs/articles/local-development-debugging).\n\n## Deploying\n\nConnect the project to source control in the Zuplo Portal. Pushes to your\ndefault branch deploy the gateway to production.\n\n## Learn More\n\nTo learn more about the AI Gateway, visit the\n[AI Gateway documentation](https://zuplo.com/docs/ai-gateway/overview).\n\nTo connect with the community join [Discord](https://discord.zuplo.com).\n",
+                "config/ai.oas.json": "{\n  \"openapi\": \"3.1.0\",\n  \"info\": {\n    \"version\": \"1.0.0\",\n    \"title\": \"AI Gateway API\",\n    \"description\": \"A unified API gateway for multiple AI providers. OpenAI-compatible ops are served under /{app_id}/v1/*, AWS Bedrock Runtime ops under /{app_id}/model/{modelId}/{operation}; other paths under /{app_id} are rejected.\"\n  },\n  \"paths\": {\n    \"/u/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,put,patch,delete,head\": {\n        \"summary\": \"AI Gateway User App catch-all\",\n        \"description\": \"Routes User App requests under /u/{app_id}/* to the AI Gateway handler. The configuration kind must be ai-user-app.\",\n        \"operationId\": \"aiGatewayUserAppCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden \\u2014 User App routes require a personal API key issued for this User App; application API keys cannot authenticate them\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-inbound\",\n              \"ai-gateway-configuration-executor-inbound\"\n            ]\n          }\n        }\n      }\n    },\n    \"/a/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,put,patch,delete,head\": {\n        \"summary\": \"AI Gateway AI App catch-all\",\n        \"description\": \"Routes AI App requests under /a/{app_id}/* to the AI Gateway handler. The configuration kind must be ai-app.\",\n        \"operationId\": \"aiGatewayAIAppCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"401\": {\n            \"description\": \"Unauthorized \\u2014 returned only when the application's inboundPolicyChain includes ai-gateway-auth-inbound, or authentication runs before the configuration loader\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden \\u2014 returned by per-app policies, such as an API key issued for a different app_id or a model the app does not allow\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-inbound\",\n              \"ai-gateway-configuration-executor-inbound\"\n            ]\n          }\n        }\n      }\n    },\n    \"/:app_id/(.*)\": {\n      \"x-zuplo-path\": {\n        \"pathMode\": \"url-pattern\"\n      },\n      \"get,post,put,patch,delete,head\": {\n        \"summary\": \"AI Gateway catch-all\",\n        \"description\": \"Routes AI requests under /{app_id}/* to the AI Gateway handler. The configuration loader loads the application configuration from the app_id path segment; the configuration executor then runs the application's inboundPolicyChain. Two path shapes succeed: a supported /v1/... operation (see resolveBasePath in packages/runtime/src/llm-translation/index.ts for the current set) and a Bedrock Runtime operation addressed AWS's way as /model/{modelId}/{operation} (see matchBedrockRuntimeRoute in packages/runtime/src/ai-gateway/bedrock-runtime-route.ts). Anything else under /{app_id} returns 404.\",\n        \"operationId\": \"aiGatewayCatchAll\",\n        \"responses\": {\n          \"200\": {\n            \"description\": \"Successful AI Gateway response\"\n          },\n          \"400\": {\n            \"description\": \"Bad request\"\n          },\n          \"401\": {\n            \"description\": \"Unauthorized \\u2014 returned only when the application's inboundPolicyChain includes ai-gateway-auth-inbound, or authentication runs before the configuration loader\"\n          },\n          \"403\": {\n            \"description\": \"Forbidden \\u2014 returned by per-app policies, such as an API key issued for a different app_id or a model the app does not allow\"\n          },\n          \"404\": {\n            \"description\": \"Unsupported AI Gateway endpoint\"\n          },\n          \"500\": {\n            \"description\": \"Internal server error\"\n          }\n        },\n        \"x-zuplo-route\": {\n          \"corsPolicy\": \"none\",\n          \"handler\": {\n            \"export\": \"aiGatewayHandlerV2\",\n            \"module\": \"$import(@zuplo/runtime)\",\n            \"options\": {}\n          },\n          \"policies\": {\n            \"inbound\": [\n              \"ai-gateway-configuration-loader-inbound\",\n              \"ai-gateway-configuration-executor-inbound\"\n            ]\n          }\n        }\n      }\n    }\n  }\n}\n",
+                "config/policies.json": "{\n  \"policies\": [\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayAuthInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-auth-inbound\",\n      \"policyType\": \"ai-gateway-auth\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"InternalOnlyInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"internal-only-inbound\",\n      \"policyType\": \"internal-only\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationLoaderInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"cacheTtlSeconds\": 5\n        }\n      },\n      \"name\": \"ai-gateway-configuration-loader-inbound\",\n      \"policyType\": \"ai-gateway-configuration-loader\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayConfigurationExecutorInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-configuration-executor-inbound\",\n      \"policyType\": \"ai-gateway-configuration-executor\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayMeteringInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {}\n      },\n      \"name\": \"ai-gateway-metering-inbound\",\n      \"policyType\": \"ai-gateway-metering\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayModelOverrideInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"default\": \"openai/gpt-4o-mini\"\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-model-override-inbound\",\n      \"policyType\": \"ai-gateway-model-override\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayModelFilteringInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"allowList\": [\"openai/gpt-4o-mini\"]\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-model-filtering-inbound\",\n      \"policyType\": \"ai-gateway-model-filtering\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayFallbackModelInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"models\": {\n            \"completions\": {\n              \"fallback\": \"openai/gpt-4o-mini\"\n            }\n          },\n          \"fallbackTimeoutSeconds\": 60\n        }\n      },\n      \"name\": \"ai-gateway-fallback-model-inbound\",\n      \"policyType\": \"ai-gateway-fallback-model\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewaySemanticCacheInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"semanticTolerance\": 0.4,\n          \"expirationSecondsTtl\": 3600\n        }\n      },\n      \"name\": \"ai-gateway-semantic-cache-inbound\",\n      \"policyType\": \"ai-gateway-semantic-cache\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayAkamaiFirewallInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"configurationId\": \"\",\n          \"api-key\": \"\"\n        }\n      },\n      \"name\": \"ai-gateway-akamai-firewall-inbound\",\n      \"policyType\": \"ai-gateway-akamai-firewall\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayPromptInjectionPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"execution\": \"parallel\"\n        }\n      },\n      \"name\": \"ai-gateway-prompt-injection\",\n      \"policyType\": \"ai-gateway-prompt-injection\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayOpikTracingInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectName\": \"\",\n          \"workspace\": \"\"\n        }\n      },\n      \"name\": \"ai-gateway-opik-tracing-inbound\",\n      \"policyType\": \"ai-gateway-opik-tracing\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayGalileoTracingInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"apiKey\": \"\",\n          \"projectId\": \"\",\n          \"logStreamId\": \"\"\n        }\n      },\n      \"name\": \"ai-gateway-galileo-tracing-inbound\",\n      \"policyType\": \"ai-gateway-galileo-tracing\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewayDlpInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"rules\": {\n            \"inbound\": {\n              \"pii\": {\n                \"action\": \"mask\"\n              },\n              \"contact-email\": {\n                \"action\": \"off\"\n              },\n              \"finance-credit-card\": {\n                \"action\": \"mask\"\n              },\n              \"finance-iban\": {\n                \"action\": \"mask\"\n              }\n            },\n            \"outbound\": {\n              \"pii\": {\n                \"action\": \"mask\"\n              },\n              \"contact-email\": {\n                \"action\": \"off\"\n              },\n              \"finance-credit-card\": {\n                \"action\": \"mask\"\n              },\n              \"finance-iban\": {\n                \"action\": \"mask\"\n              }\n            }\n          }\n        }\n      },\n      \"name\": \"ai-gateway-dlp-inbound\",\n      \"policyType\": \"ai-gateway-dlp\"\n    },\n    {\n      \"handler\": {\n        \"export\": \"AIGatewaySmartRouterInboundPolicy\",\n        \"module\": \"$import(@zuplo/runtime)\",\n        \"options\": {\n          \"classifier\": {\n            \"app\": {\n              \"appId\": \"\",\n              \"model\": \"openai/gpt-4o-mini\"\n            }\n          },\n          \"modelsByComplexity\": {\n            \"low\": \"openai/gpt-4o-mini\",\n            \"medium\": \"openai/gpt-4o\",\n            \"high\": \"openai/gpt-5\"\n          }\n        }\n      },\n      \"name\": \"ai-gateway-smart-router-inbound\",\n      \"policyType\": \"ai-gateway-smart-router\"\n    }\n  ]\n}\n",
+                "modules/zuplo.runtime.ts": "import type { RuntimeExtensions } from \"@zuplo/runtime\";\n\n/**\n * `runtimeInit` runs once when your gateway boots. Use it to register plugins\n * and lifecycle hooks. Docs:\n * https://zuplo.com/docs/programmable-api/runtime-extensions\n */\nexport function runtimeInit(runtime: RuntimeExtensions) {\n  // `runtime` is unused until you enable a plugin below. This reference keeps\n  // linters from flagging it; delete it once you call `runtime.addPlugin`.\n  void runtime;\n\n  // --- OpenTelemetry tracing (optional) ------------------------------------\n  // Send traces to Zuplo's built-in tracing. This can also be configured to\n  // send traces to a third-party service such as Honeycomb, Grafana, and\n  // others. Docs: https://zuplo.com/docs/articles/opentelemetry\n  //\n  // To enable, run `npm install @zuplo/otel`, then import `OpenTelemetryPlugin`\n  // from \"@zuplo/otel\" and `environment` from \"@zuplo/runtime\":\n  // const isWorkingCopy =\n  //   environment.ZUPLO_ENVIRONMENT_STAGE === \"working-copy\";\n  // runtime.addPlugin(\n  //   new OpenTelemetryPlugin({\n  //     sampling: {\n  //       headSampler: { ratio: isWorkingCopy ? 1 : 0.1 },\n  //     },\n  //   }),\n  // );\n  // --- Logging (optional) --------------------------------------------------\n  // Ship request logs to Datadog. Other log integrations (New Relic, Splunk,\n  // Loki, Dynatrace, and others) follow the same pattern — see the logging\n  // overview at https://zuplo.com/docs/articles/logging.\n  // Docs: https://zuplo.com/docs/articles/log-plugin-datadog\n  //\n  // To enable, import the plugin and `environment` from \"@zuplo/runtime\":\n  // runtime.addPlugin(\n  //   new DataDogLoggingPlugin({\n  //     apiKey: environment.DATADOG_API_KEY,\n  //     source: \"my-ai-gateway\",\n  //   }),\n  // );\n}\n",
+                "tsconfig.json": "{\n  \"include\": [\"modules/**/*\", \".zuplo/**/*\"],\n  \"exclude\": [\"./node_modules\", \"./dist\", \"./docs\", \"./examples\"],\n  \"compilerOptions\": {\n    \"module\": \"ESNext\",\n    \"target\": \"ES2022\",\n    \"lib\": [\"ESNext\", \"WebWorker\", \"Webworker.Iterable\"],\n    \"preserveConstEnums\": true,\n    \"moduleResolution\": \"Bundler\",\n    \"useUnknownInCatchVariables\": false,\n    \"forceConsistentCasingInFileNames\": true,\n    \"importHelpers\": true,\n    \"removeComments\": true,\n    \"esModuleInterop\": true,\n    \"noEmit\": true,\n    \"skipLibCheck\": true,\n    \"strictNullChecks\": true,\n    \"experimentalDecorators\": true\n  }\n}\n",
+                "zuplo.jsonc": "{\n  \"version\": 1,\n  \"compatibilityDate\": \"2026-03-01\"\n}\n"
+            }
+        }
+    ],
+    "aliases": {
+        "ai-gateway-auth-v2": "ai-gateway-auth-inbound",
+        "ai-gateway-auth-v2-inbound": "ai-gateway-auth-inbound",
+        "ai-gateway-metering-v2": "ai-gateway-metering-inbound",
+        "ai-gateway-metering-v2-inbound": "ai-gateway-metering-inbound",
+        "ai-gateway-semantic-cache-v2": "ai-gateway-semantic-cache-inbound",
+        "ai-gateway-semantic-cache-v2-inbound": "ai-gateway-semantic-cache-inbound",
+        "ai-gateway-semantic-cache-inbound-v2": "ai-gateway-semantic-cache-inbound",
+        "ai-gateway-model-filtering-v2": "ai-gateway-model-filtering-inbound",
+        "ai-gateway-model-filtering-v2-inbound": "ai-gateway-model-filtering-inbound",
+        "ai-gateway-fallback-model-v2": "ai-gateway-fallback-model-inbound",
+        "ai-gateway-fallback-model-v2-inbound": "ai-gateway-fallback-model-inbound",
+        "ai-gateway-configuration-loader-v2": "ai-gateway-configuration-loader-inbound",
+        "ai-gateway-configuration-loader-v2-inbound": "ai-gateway-configuration-loader-inbound",
+        "ai-gateway-configuration-executor-v2": "ai-gateway-configuration-executor-inbound",
+        "ai-gateway-configuration-executor-v2-inbound": "ai-gateway-configuration-executor-inbound",
+        "akamai-ai-firewall-v2": "ai-gateway-akamai-firewall-inbound",
+        "akamai-ai-firewall-v2-inbound": "ai-gateway-akamai-firewall-inbound",
+        "akamai-ai-firewall-inbound-v2": "ai-gateway-akamai-firewall-inbound",
+        "comet-opik-tracing-v2": "ai-gateway-opik-tracing-inbound",
+        "comet-opik-tracing-v2-inbound": "ai-gateway-opik-tracing-inbound",
+        "comet-opik-tracing-inbound-v2": "ai-gateway-opik-tracing-inbound",
+        "galileo-tracing-v2": "ai-gateway-galileo-tracing-inbound",
+        "galileo-tracing-v2-inbound": "ai-gateway-galileo-tracing-inbound",
+        "galileo-tracing-inbound-v2": "ai-gateway-galileo-tracing-inbound",
+        "ai-gateway-internal-only": "internal-only-inbound",
+        "ai-gateway-internal-only-inbound": "internal-only-inbound"
+    },
+    "steps": [
+        {
+            "id": "route:/u/:app_id/(.*)",
+            "kind": "route",
+            "key": "/u/:app_id/(.*)",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Insert before /:app_id/(.*), with the displayed inbound policy order."
+        },
+        {
+            "id": "route:/a/:app_id/(.*)",
+            "kind": "route",
+            "key": "/a/:app_id/(.*)",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Insert before /:app_id/(.*), with the displayed inbound policy order."
+        },
+        {
+            "id": "route:/:app_id/(.*)",
+            "kind": "route",
+            "key": "/:app_id/(.*)",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-auth-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-auth-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-internal-only-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-internal-only-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-configuration-loader-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-configuration-loader-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-configuration-executor-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-configuration-executor-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-metering-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-metering-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-model-override-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-model-override-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-model-filtering-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-model-filtering-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-fallback-model-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-fallback-model-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-semantic-cache-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-semantic-cache-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-akamai-firewall-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-akamai-firewall-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-prompt-injection",
+            "kind": "policy",
+            "key": "ai-gateway-prompt-injection",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-opik-tracing-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-opik-tracing-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-galileo-tracing-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-galileo-tracing-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-dlp-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-dlp-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "policy:ai-gateway-smart-router-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-smart-router-inbound",
+            "target": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:route:/u/:app_id/(.*)",
+            "kind": "route",
+            "key": "/u/:app_id/(.*)",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Insert before /:app_id/(.*), with the displayed inbound policy order."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:route:/a/:app_id/(.*)",
+            "kind": "route",
+            "key": "/a/:app_id/(.*)",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Insert before /:app_id/(.*), with the displayed inbound policy order."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:route:/:app_id/(.*)",
+            "kind": "route",
+            "key": "/:app_id/(.*)",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-auth-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-auth-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-internal-only-inbound",
+            "kind": "policy",
+            "key": "internal-only-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Add only if neither internal-only-inbound nor its historical AI Gateway alias is declared. Preserve existing declarations and application chain references."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-configuration-loader-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-configuration-loader-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-configuration-executor-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-configuration-executor-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-metering-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-metering-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-model-override-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-model-override-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-model-filtering-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-model-filtering-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-fallback-model-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-fallback-model-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-semantic-cache-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-semantic-cache-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-akamai-firewall-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-akamai-firewall-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-prompt-injection",
+            "kind": "policy",
+            "key": "ai-gateway-prompt-injection",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-opik-tracing-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-opik-tracing-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-galileo-tracing-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-galileo-tracing-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-dlp-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-dlp-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        },
+        {
+            "id": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4:policy:ai-gateway-smart-router-inbound",
+            "kind": "policy",
+            "key": "ai-gateway-smart-router-inbound",
+            "target": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "runtime": "release",
+            "instructions": "Review the definition and application policy chains before adding it."
+        }
+    ],
+    "assessments": [
+        {
+            "revision": "d86ffae8998e43d71f8f543b1269a5f1e9b4bf78c45f22c7022a7feb7f4fa766",
+            "classification": "additions",
+            "instructions": "Only missing routes and policy declarations are eligible. Existing definitions, including changed defaults and historical aliases, remain customer-owned. Existing policy changes require manual review."
+        },
+        {
+            "revision": "256d7e12d04fba5317a0a6277edf7eb7f1e798385af6f75aed34426aa5b771f4",
+            "classification": "additions",
+            "instructions": "The Internal Only policy now uses internal-only-inbound, InternalOnlyInboundPolicy, and policyType internal-only. Existing AI Gateway names remain supported runtime aliases and are preserved; do not add a duplicate declaration or automatically rename existing configuration. Missing declarations use the new name. Other existing policy options and defaults still require separate review."
+        }
+    ]
+}