@zuplo/runtime 5.1574.0 → 5.1576.0

package/index.d.ts

@@ -2,17 +2,65 @@ import { KeyLike } from 'jose';
 import type { OpenAPIV3_1 } from 'openapi-types';
 import type { ValidateFunction as ValidateFunction_2 } from 'ajv';
 
+/**
+ * Amberflo is a usage metering and billing service. This policy allows you to send metering calls for each API to their meter ingest endpoint.
+ *
+ * @remarks
+ * Amberflo ([amberflo.io](https://www.amberflo.io/)) is a usage metering and
+ * billing service. This policy allows you to meter API calls going through Zuplo
+ * and send them to your Amberflo account using your Amberflo API key.
+ *
+ * Add the policy to each route you want to meter. Note you can specify the Meter
+ * API Name and Meter Value (meter increment) at the policy level.
+ *
+ * @title Amberflo Metering / Billing
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
 export declare function AmberfloMeteringInboundPolicy(request: ZuploRequest, context: ZuploContext, options: AmberfloMeteringInboundPolicyOptions, policyName: string): Promise<ZuploRequest<any, Record<string, string>, Record<string, string>>>;
 
+/**
+ * The options for this policy. Many of them can be overridden at the code level in a request using the `AmberfloMeteringPolicy.setRequestProperties` method.
+ */
 export declare interface AmberfloMeteringInboundPolicyOptions {
-    url: string;
-    customerIdPropertyPath?: string;
-    customerId?: string;
+    /**
+     * The API key to use when sending metering calls to Amberflo
+     */
     apiKey: string;
+    /**
+     * The name of the meter to use when sending metering calls to Amberflo (overridable in code)
+     */
     meterApiName?: string;
+    /**
+     * The value to use when sending metering calls to Amberflo (overridable in code)
+     */
     meterValue?: number;
-    dimensions?: Record<string, string>;
-    statusCodes: number[] | string;
+    /**
+     * The path to the property on `request.user`contains the customer ID. For example `.data.accountNumber` would read the `request.user.data.accountNumber` property.
+     */
+    customerIdPropertyPath?: string;
+    /**
+     * The default customerId for all metering calls - overridable in code and by `customerIdPropertyPath`
+     */
+    customerId?: string;
+    /**
+     * A dictionary of dimensions to be sent to Amberflo (extensible in code)
+     */
+    dimensions?: {
+        [k: string]: string;
+    };
+    /**
+     * A list of successful status codes and ranges "200-299, 304" that should trigger a metering call to Amberflo - defaults to `result.ok` (200-299) if not set.
+     */
+    statusCodes?: string | number[];
+    /**
+     * Optional, the URL to send metering events to (defaults to https://app.amberflo.io/ingest). This is useful for testing purposes.
+     */
+    url?: string;
 }
 
 declare interface AmberfloMeteringIngestPayload {
@@ -34,23 +82,96 @@ declare interface AmberfloMeteringProperties extends Omit<AmberfloMeteringIngest
 /* Excluded from this release type: API_KEY */
 
 /**
- * @deprecated Use ApiKeyInboundPolicy instead
+ * Authenticates requests based on API Keys using Zuplo API Management. You
+ * can learn more about the Zuplo API Key Service
+ * [here](https://zuplo.com/docs/articles/api-key-api#buckets)
+ *
+ * @remarks
+ * **This policy is deprecated. Use the new
+ * [API Key Authentication policy instead](https://zuplo.com/docs/policies/api-key-inbound)**
+ *
+ * This policy uses the managed API key storage provided by Zuplo.
+ * `allowUnauthenticatedRequests` defaults to false and rejects any request without
+ * a valid API key (returning a `401 - Unauthorized` response). You can override
+ * (set `"allowUnauthenticatedRequests" : true`) this to support multiple
+ * authentication methods or support both authenticated and anonymous requests.
+ *
+ * @deprecated Deprecated - Please use the new 'API Key Authentication' policy
+ * instead. This policy will continue to work but will be removed in a future
+ * version of Zuplo.
+ *
+ * @title API Key Authentication
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param unparsedOptions - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const ApiAuthKeyInboundPolicy: typeof ApiKeyInboundPolicy;
 
 /**
- * @deprecated Use ApiKeyInboundPolicyOptions instead
+ * The options for this policy
  */
-export declare type ApiAuthKeyInboundPolicyOptions = ApiKeyInboundPolicyOptions;
+export declare interface ApiAuthKeyInboundPolicyOptions {
+    /**
+     * If 'true' allows the request to continue even if authenticated. When 'false' (the default) any unauthenticated request is automatically rejected with a 401
+     */
+    allowUnauthenticatedRequests?: boolean;
+}
 
+/**
+ * Authenticates requests based on API Keys using Zuplo API Management. You can learn more about the Zuplo API Key Service [here](https://zuplo.com/docs/articles/api-key-api#buckets)
+ *
+ * @remarks
+ * Authenticate requests with Zuplo's fully managed API Key service. This policy is
+ * the easiest way to secure your API and can be combined with other policies like
+ * Rate limiting, quotas, and more to build a fully featured API to support your
+ * partners, developers, or customers.
+ *
+ * For more information on Zuplo's API Key Management service and options enabling
+ * self-serve API Key management see the following resources:
+ *
+ * - [API Key Authentication Overview](/docs/articles/api-key-management)
+ * - [API Key Management API](/docs/articles/api-key-api)
+ *
+ * @title API Key Authentication
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param unparsedOptions - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
 export declare function ApiKeyInboundPolicy(request: ZuploRequest, context: ZuploContext, unparsedOptions: ApiKeyInboundPolicyOptions, policyName: string): Promise<ZuploRequest<any, Record<string, string>, Record<string, string>> | Response>;
 
+/**
+ * The options for this policy
+ */
 export declare interface ApiKeyInboundPolicyOptions {
+    /**
+     * The name of the header with the key. Defaults to `Authorization`
+     */
     authHeader?: string;
+    /**
+     * The scheme used on the header. Defaults to `Bearer`
+     */
     authScheme?: string;
+    /**
+     * Optional - The name of the API Key service bucket. Defaults to the autogenerated bucket name for your project. You can contact `support@zuplo.com` to create a new bucket.
+     */
     bucketName?: string;
+    /**
+     * If requests should proceed even if the policy does not successfully authenticate the request. Defaults to false and rejects any request without a valid API key (returning a `401 - Unauthorized` response). Set to `true` to support multiple authentication methods or support both authenticated and anonymous requests.
+     */
     allowUnauthenticatedRequests?: boolean;
+    /**
+     * The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc..
+     */
     cacheTtlSeconds?: number;
+    /**
+     * Zuplo will automatically document your API key header within your OpenAPI specification & Developer Portal. Set this to `true` to disable this behavior.
+     */
     disableAutomaticallyAddingKeyHeaderToOpenApi?: boolean;
 }
 
@@ -122,32 +243,39 @@ declare interface AuditLogRequestFilter {
 }
 
 /**
- * @beta
- * Validate a JWT issued by Auth0
+ * Authenticate users using Auth0 issued JWT tokens.
+ *
+ * @remarks
+ * Authenticate requests with JWT tokens issued by Auth0. This is a customized
+ * version of the [OpenId JWT Policy](./open-id-jwt-auth-inbound.md) specifically
+ * for Auth0.
+ *
+ * @title Auth0 JWT Auth
+ * @public
  * @param request - The ZuploRequest
  * @param context - The ZuploContext
- * @param options - The configuration options
- * @returns
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const Auth0JwtInboundPolicy: InboundPolicyHandler<Auth0JwtInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface Auth0JwtInboundPolicyOptions {
     /**
-     * Your Auth0 domain, i.e. my-app.us.auth0.com
+     * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
      */
-    auth0Domain: string;
+    allowUnauthenticatedRequests?: boolean;
     /**
-     * The audience of your API, i.e. https://api.example.com/
+     * Your Auth0 domain. For example, my-company.auth0.com
      */
-    audience?: string;
+    auth0Domain: string;
     /**
-     * If false, a 403 will be returned if a valid
-     * Authorization header is not present
+     * The Auth0 audience of your API, for example https://api.example.com/
      */
-    allowUnauthenticatedRequests: boolean;
+    audience?: string;
 }
 
 declare interface AwsLambdaEventV1 {
@@ -303,28 +431,61 @@ declare abstract class BaseKeyValueStore {
 }
 
 /**
- * @beta
+ * An account object
  */
 declare interface BasicAuthAccount {
+    /**
+     * The username for the account (this will be the `sub` property on `request.user`.
+     */
     username: string;
+    /**
+     * The password for the account - note we recommend storing this in environment variables
+     */
     password: string;
-    data: unknown;
+    /**
+     * The data payload you want associated with this account (this will be the `data` property on `request.user`)
+     */
+    data?: {
+        [k: string]: unknown;
+    };
 }
 
 /**
- * @beta
+ * Authenticate requests using basic auth (i.e. username and password)
+ *
+ * @remarks
+ * The Basic Authentication policy allows you to authenticate incoming requests
+ * using the Basic authentication standard. You can configure multiple accounts
+ * with different passwords and a different bucket of user 'data'.
+ *
+ * The API will expect a Basic Auth header (you can generate samples
+ * [here](https://www.debugbear.com/basic-auth-header-generator)). Requests with
+ * invalid credentials (or no header) will not be authenticated. Authenticated
+ * requests will populate the `user` property of the `ZuploRequest` parameter on
+ * your RequestHandler.
+ *
+ * @title Basic Auth
+ * @public
  * @param request - The ZuploRequest
- * @param options - The configuration options
- * @returns
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const BasicAuthInboundPolicy: InboundPolicyHandler<BasicAuthInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface BasicAuthInboundPolicyOptions {
+    /**
+     * An array of account objects (username, password and data properties)
+     */
     accounts: BasicAuthAccount[];
-    allowUnauthenticatedRequests: boolean;
+    /**
+     * If 'true' allows the request to continue even if authenticated. When 'false' (the default) any unauthenticated request is automatically rejected with a 401
+     */
+    allowUnauthenticatedRequests?: boolean;
 }
 
 /* Excluded from this release type: BuildEnvironment */
@@ -369,106 +530,187 @@ declare interface CacheOptions {
     logger?: Logger;
 }
 
+/**
+ * Respond to matched incoming requests with cached content
+ *
+ * @title Caching
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
 export declare function CachingInboundPolicy(request: ZuploRequest, context: ZuploContext, options: CachingInboundPolicyOptions, policyName: string): Promise<ZuploRequest<any, Record<string, string>, Record<string, string>> | Response>;
 
+/**
+ * The options for this policy
+ */
 export declare interface CachingInboundPolicyOptions {
+    /**
+     * Optional, specifies an id or 'key' for this policy to store cache. This is useful for cache-busting. For example, set this property to an env var and if you change that env var value, you invalidate the cache.
+     */
     cacheId?: string;
+    /**
+     * By default, the Authorization header is always considered in the caching policy. You can disable by setting this to true
+     */
+    dangerouslyIgnoreAuthorizationHeader?: boolean;
+    /**
+     * The headers to be considered when caching
+     */
     headers?: string[];
+    /**
+     * HTTP Methods to be cached - defaults to GET if none specified. Valid methods are: GET, POST, PUT, PATCH, DELETE, HEAD
+     */
     cacheHttpMethods?: string[];
-    dangerouslyIgnoreAuthorizationHeader?: boolean;
+    /**
+     * The timeout of the cache in seconds
+     */
     expirationSecondsTtl?: number;
+    /**
+     * Response status codes to be cached - defaults to 200, 206, 301, 302, 303, 404, 410 if none specified
+     */
     statusCodes?: number[];
 }
 
 /**
- * @beta
+ * Changes the HTTP method of the incoming request.
+ *
+ * @title Change Method
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const ChangeMethodInboundPolicy: InboundPolicyHandler<ChangeMethodInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface ChangeMethodInboundPolicyOptions {
-    method: HttpMethod;
+    /**
+     * The HTTP Method to be used, e.g. POST, GET, PUT, PATCH, etc
+     */
+    method: string;
 }
 
 /**
- * @beta
+ * Removes all headers from the incoming request except for those in the exclude list.
+ *
+ * @title Clear Request Headers
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const ClearHeadersInboundPolicy: InboundPolicyHandler<ClearHeadersInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface ClearHeadersInboundPolicyOptions {
+    /**
+     * The headers that should not be removed
+     */
     exclude?: string[];
 }
 
 /**
- * @beta
+ * Removes all headers from the response except for those in the exclude list.
+ *
+ * @title Clear Response Headers
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const ClearHeadersOutboundPolicy: OutboundPolicyHandler<ClearHeadersOutboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface ClearHeadersOutboundPolicyOptions {
+    /**
+     * The headers that should not be removed
+     */
     exclude?: string[];
 }
 
 /**
- * @beta
- * Validate a JWT issued by Clerk
+ * Authenticate users using Clerk issued JWT tokens.
+ *
+ * @remarks
+ * Authenticate requests with JWT tokens issued by Clerk. This is a customized
+ * version of the [OpenId JWT Policy](./open-id-jwt-auth-inbound.md) specifically
+ * for Clerk.
+ *
+ * @title Clerk JWT Auth
+ * @public
  * @param request - The ZuploRequest
  * @param context - The ZuploContext
- * @param options - The configuration options
- * @returns
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const ClerkJwtInboundPolicy: InboundPolicyHandler<ClerkJwtInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface ClerkJwtInboundPolicyOptions {
     /**
-     * Your Clerk frontend api url, i.e. https://sensible-skunk-49.clerk.accounts.dev
-     * Can be found here: https://dashboard.clerk.com/last-active?path=api-keys
+     * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
      */
-    frontendApiUrl: string;
+    allowUnauthenticatedRequests?: boolean;
     /**
-     * If false, a 403 will be returned if a valid
-     * Authorization header is not present
+     * Your Clerk frontend api url, i.e. 'https://sensible-skunk-49.clerk.accounts.dev'. Can be found in the Clerk portal: https://dashboard.clerk.com/last-active?path=api-keys
      */
-    allowUnauthenticatedRequests: boolean;
+    frontendApiUrl: string;
 }
 
 /**
- * @beta
- * Validates a JWT issued by AWS Cognito
+ * Authenticate requests with JWT tokens issued by AWS Cognito.
+ *
+ * @remarks
+ * Authenticate requests with JWT tokens issued by AWS Cognito. This is a
+ * customized version of the [OpenId JWT Policy](./open-id-jwt-auth-inbound.md)
+ * specifically for AWS Cognito.
+ *
+ * See [this document](/docs/articles/oauth-authentication) for more information
+ * about OAuth authorization in Zuplo.
+ *
+ * @title AWS Cognito JWT Auth
+ * @public
  * @param request - The ZuploRequest
  * @param context - The ZuploContext
- * @param options - The configuration options
- * @returns
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const CognitoJwtInboundPolicy: InboundPolicyHandler<CognitoJwtInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface CognitoJwtInboundPolicyOptions {
     /**
-     * The AWS region, i.e. us-east-2
+     * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
      */
-    region: string;
+    allowUnauthenticatedRequests?: boolean;
     /**
-     * The Pool Id of your pool, i.e. us-east-2_joetMcQgH
+     * The AWS region where your Cognito instance is deployed
      */
-    userPoolId: string;
+    region: string;
     /**
-     * If false, a 403 will be returned if a valid
-     * Authorization header is not present
+     * The user pool identifier
      */
-    allowUnauthenticatedRequests: boolean;
+    userPoolId: string;
 }
 
 /**
@@ -477,17 +719,36 @@ export declare interface CognitoJwtInboundPolicyOptions {
 export declare type CompatibilityDate = "2023-03-14";
 
 /**
- * @beta
+ * Creates a composite, or group policy - composed of other policies. For reuse across routes.
+ *
+ * @remarks
+ * The Composite policy allows you to create groups of other policies, for easy
+ * reuse across multiple routes. Other policies are referenced by their `name`.
+ *
+ * :::warning
+ *
+ * Be careful not to create circular references which can cause your gateway to
+ * fail.
+ *
+ * :::
+ *
+ * @title Composite Inbound (Group Policies)
+ * @public
  * @param request - The ZuploRequest
- * @param options - The configuration options
- * @returns
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const CompositeInboundPolicy: InboundPolicyHandler<CompositeInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface CompositeInboundPolicyOptions {
+    /**
+     * The list of policy references (beware circular references)
+     */
     policies?: string[];
 }
 
@@ -653,62 +914,107 @@ export declare interface ErrorHandler {
 /* Excluded from this release type: ErrorObject */
 
 /**
- * @beta
- * Validate a JWT issued by Firebase
+ * Authenticate users using Firebase issued JWT tokens.
+ *
+ * @remarks
+ * Authenticate requests with JWT tokens issued by Firebase. The payload of the JWT
+ * token, if successfully authenticated, with be on the `request.user.data` object
+ * accessible to the runtime.
+ *
+ * See [this document](/docs/articles/oauth-authentication) for more information
+ * about OAuth authorization in Zuplo.
+ *
+ * @title Firebase JWT Auth
+ * @public
  * @param request - The ZuploRequest
  * @param context - The ZuploContext
- * @param options - The configuration options
- * @returns
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const FirebaseJwtInboundPolicy: InboundPolicyHandler<FirebaseJwtInboundPolicyOptions>;
 
+/**
+ * The options for this policy
+ */
 export declare interface FirebaseJwtInboundPolicyOptions {
     /**
-     * The Firebase project ID
+     * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
      */
-    projectId: string;
+    allowUnauthenticatedRequests?: boolean;
     /**
-     * If false, a 401 will be returned JWT is invalid, default to false
-     **/
-    allowUnauthenticatedRequests: boolean;
+     * Your Firebase Project ID
+     */
+    projectId: string;
 }
 
 /**
- * @beta
+ * Converts form data in the incoming request to JSON.
+ *
+ * @title Form Data to JSON
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const FormDataToJsonInboundPolicy: InboundPolicyHandler<FormDataToJsonInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface FormDataToJsonInboundPolicyOptions {
+    /**
+     * Should the policy return an error if the request is not of the type form data
+     */
     badRequestIfNotFormData?: boolean;
+    /**
+     * The name of the honeypot field. Used to provide basic spam filtering.
+     */
     optionalHoneypotName?: string;
 }
 
 /* Excluded from this release type: Gateway */
 
 /**
- * @beta
+ * Block requests based on geo-location parameters: country, region code, and ASN
+ *
+ * @title Geo-location filtering
+ * @public
  * @param request - The ZuploRequest
- * @param options - The configuration options
- * @returns
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const GeoFilterInboundPolicy: InboundPolicyHandler<GeoFilterInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface GeoFilterInboundPolicyOptions {
-    allow?: GeoSpec;
     block?: GeoSpec;
+    allow?: GeoSpec;
+    /**
+     * Optional, defaults to true. Specifies whether unknown geo-location parameters should be ignored (allowed through).
+     */
     ignoreUnknown?: boolean;
 }
 
 declare interface GeoSpec {
-    countries?: string | string[];
-    regionCodes?: string | string[];
-    asns?: string | string[];
+    /**
+     * comma separated string of country codes to allow (e.g. "US, CA")
+     */
+    countries?: string;
+    /**
+     * comma separated string of region codes to allow (e.g. "TX, WA")
+     */
+    regionCodes?: string;
+    /**
+     * comma separated string of ASNs to allow (e.g. "395747, 28304")
+     */
+    asns?: string;
 }
 
 export declare function getIdForParameterSchema(path: string, operation: string, type: string, name: string): string;
@@ -1891,9 +2197,26 @@ declare type Iso3166Alpha2Code = "AD" | "AE" | "AF" | "AG" | "AI" | "AL" | "AM"
 
 export declare function isZuploReadableEnvVariableName(name: string): boolean;
 
+/**
+ * Validates that the JWT token includes specific scopes
+ *
+ * @title JWT Scope Validation
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
 export declare const JWTScopeValidationInboundPolicy: InboundPolicyHandler<JWTScopeValidationInboundPolicyOptions>;
 
+/**
+ * The options for this policy
+ */
 export declare interface JWTScopeValidationInboundPolicyOptions {
+    /**
+     * An array of of JWT scopes
+     */
     scopes: string[];
 }
 
@@ -2028,13 +2351,39 @@ declare interface MetricsType {
     responseContentLength?: boolean;
 }
 
+/**
+ * The options for this policy
+ */
 export declare interface MockApiInboundOptions {
+    /**
+     * Optional. Indicates whether the response should be selected randomly, from the available examples (that match any filter criteria). If `false` the first matching example is used.
+     */
     random?: boolean;
+    /**
+     * Optional. Specifies a prefix to match the responses to select from. Typically this is a status code like "200" or "2XX". If you want the policy to select randomly from all 2XX codes, set this property to "2" and random to `true`.
+     */
     responsePrefixFilter?: string;
+    /**
+     * Optional. Specify the content-type of the response to select from. If not specified, the first matching response is used (or random).
+     */
     contentType?: string;
+    /**
+     * Optional. Specify the name of the example to select. If not specified, the first matching response is used (or random).
+     */
     exampleName?: string;
 }
 
+/**
+ * Returns example responses from the OpenAPI document associated with this route.
+ *
+ * @title Mock API Response
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
 export declare const MockApiInboundPolicy: InboundPolicyHandler<MockApiInboundOptions>;
 
 declare type Modify<T, R> = Omit<T, keyof R> & R;
@@ -2047,11 +2396,42 @@ declare interface MoesifContext {
     metadata?: unknown;
 }
 
+/**
+ * Moesif is an API analytics and billing service. This policy allows you to send metering calls for each API to their events batch endpoint.
+ *
+ * @remarks
+ * Moesif [moesif.com](https://moesif.com) is an API analytics and monetization
+ * platform. This policy allows you to measure (and meter) API calls flowing
+ * through your Zuplo gateway.
+ *
+ * Add the policy to each route you want to meter. Note you can specify the Meter
+ * API Name and Meter Value (meter increment) at the policy level.
+ *
+ * @title Moesif Analytics & Billing
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
 export declare function MoesifInboundPolicy(request: ZuploRequest, context: ZuploContext, passedOptions: MoesifInboundPolicyOptions, policyName: string): Promise<ZuploRequest<any, Record<string, string>, Record<string, string>>>;
 
+/**
+ * The options for this policy. Many of them can be overridden at the code level in a request using the `AmberfloMeteringPolicy.setRequestProperties` method.
+ */
 export declare interface MoesifInboundPolicyOptions {
+    /**
+     * Your Moesif application ID (required)
+     */
     applicationId: string;
+    /**
+     * Set to false to disable sending the request body to Moesif (optional)
+     */
     logRequestBody?: boolean;
+    /**
+     * Set to false to disable sending the response body to Moesif (optional)
+     */
     logResponseBody?: boolean;
 }
 
@@ -2060,32 +2440,42 @@ declare interface NotFoundOptions {
 }
 
 /**
- * @beta
- * Validate a JWT issued by Okta
+ * Authenticate users using Okta issued JWT tokens.
+ *
+ * @remarks
+ * Authenticate requests with JWT tokens issued by Okta. This is a customized
+ * version of the [OpenId JWT Policy](./open-id-jwt-auth-inbound.md) specifically
+ * for Okta.
+ *
+ * See [this document](/docs/articles/oauth-authentication) for more information
+ * about OAuth authorization in Zuplo.
+ *
+ * @title Okta JWT Auth
+ * @public
  * @param request - The ZuploRequest
  * @param context - The ZuploContext
- * @param options - The configuration options
- * @returns
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const OktaJwtInboundPolicy: InboundPolicyHandler<OktaJwtInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface OktaJwtInboundPolicyOptions {
     /**
-     * Your Okta authorization server's issuer URL, i.e. https://dev-12345.okta.com/oauth2/abc
+     * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
      */
-    issuerUrl: string;
+    allowUnauthenticatedRequests?: boolean;
     /**
-     * The audience of your API, i.e. api://my-api
+     * Your Okta authorization server's issuer URL. For example, https://dev-12345.okta.com/oauth2/abc
      */
-    audience?: string;
+    issuerUrl: string;
     /**
-     * If false, a 403 will be returned if a valid
-     * Authorization header is not present
+     * The Okta audience of your API, for example api://my-api
      */
-    allowUnauthenticatedRequests: boolean;
+    audience?: string;
 }
 
 /**
@@ -2122,48 +2512,71 @@ declare interface OnSendingAwsLambdaEventHook {
 export declare function openApiSpecHandler(request: ZuploRequest, context: ZuploContext): Promise<Response>;
 
 /**
- * @beta
- * Validates a JWT issued by a Open Id service
+ * The Open ID JWT Authentication policy allows you to authenticate incoming requests using an Open ID compliant bearer token.
+ *
+ * @remarks
+ * The Open ID JWT Authentication policy allows you to authenticate incoming
+ * requests using an Open ID-compliant bearer token. It works with common
+ * authentication services like Auth0 (sample here) but should also work with any
+ * valid Open ID JWT token.
+ *
+ * When configured, you can have Zuplo check incoming requests for a JWT token and
+ * automatically populate the `ZuploRequest` 's `user` property with a user object.
+ * This `user` object will have a `sub` property - taking the `sub` id from the JWT
+ * token. It will also have a `data` property populated by other data returned in
+ * the JWT token (including any claims).
+ *
+ * See [this document](/docs/articles/oauth-authentication) for more information
+ * about OAuth authorization in Zuplo.
+ *
+ * @title JWT Auth
+ * @public
  * @param request - The ZuploRequest
  * @param context - The ZuploContext
- * @param options - The configuration options
- * @returns
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
-export declare const OpenIdJwtInboundPolicy: InboundPolicyHandler<OpenIdJwtInboundPolicyOptions>;
+export declare const OpenIdJwtInboundPolicy: InboundPolicyHandler<OpenIdJwtInboundPolicyInternalOptions>;
+
+declare interface OpenIdJwtInboundPolicyInternalOptions extends Omit<OpenIdJwtInboundPolicyOptions, "secret"> {
+    secret?: string | KeyLike;
+}
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface OpenIdJwtInboundPolicyOptions {
     /**
-     * The issuer of the token
+     * The expected issuer claim in the JWT token.
      */
     issuer?: string;
     /**
-     * The API Audience
+     * The expected audience claim in the JWT token (optional).
      */
     audience?: string;
     /**
-     * The URL to the Json Web Token Key Set
+     * the url of the JSON Web Key Set (JWKS) - this is used to validate the JWT token signature (either this or `secret` must be set).
      */
     jwkUrl?: string;
     /**
-     * The secret used to sign the JWT token
+     * The key used to verify the signature of the JWT token (either this or `jwkUrl` must be set)
      */
-    secret?: string | KeyLike;
+    secret?: string;
     /**
-     * If false, a 401 will be returned if a valid
-     * Authorization header is not present
+     * indicates whether the request should continue if authentication fails. Defaults is `false` which means unauthenticated users will automatically receive a 401 response.
      */
     allowUnauthenticatedRequests?: boolean;
     /**
-     * The name of the property on the JWT to be used as the sub
+     * The name of the property in the JWT token that contains the user's unique identifier. Defaults to `sub`.
      */
     subPropertyName?: string;
     /**
-     * Additional headers to send with the JWK request
+     * Additional headers to send with the JWK request.
      */
-    headers?: Record<string, string>;
+    headers?: {
+        [k: string]: string;
+    };
 }
 
 export declare const originalFetch: typeof fetch;
@@ -2322,76 +2735,111 @@ export declare class ProblemResponseFormatter {
 }
 
 /**
- * @beta
- * Validate a JWT issued by PropelAuth
+ * Authenticate users using PropelAuth issued JWT tokens.
+ *
+ * @remarks
+ * Authenticate requests with JWT tokens issued by
+ * [PropelAuth](https://propelauth.com). This is a customized version of the
+ * [OpenId JWT Policy](./open-id-jwt-auth-inbound.md) specifically for PropelAuth.
+ *
+ * @title PropelAuth JWT Auth
+ * @public
  * @param request - The ZuploRequest
  * @param context - The ZuploContext
- * @param options - The configuration options
- * @returns
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const PropelAuthJwtInboundPolicy: InboundPolicyHandler<PropelAuthJwtInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface PropelAuthJwtInboundPolicyOptions {
     /**
-     * Your PropelAuth 'authUrl', i.e. https://6586563.propelauthtest.com
+     * Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic.
      */
-    authUrl: string;
+    allowUnauthenticatedRequests?: boolean;
     /**
-     * Your public (verifier) key that is used to verify access tokens
+     * Your PropelAuth authUrl. For example, https://6587563.propelauthtest.com
      */
-    verifierKey: string;
+    authUrl: string;
     /**
-     * If false, a 403 will be returned if a valid
-     * Authorization header is not present
+     * Your public (verifier) key that is used to verify access tokens. This key has a value that begins with '-----BEGIN PUBLIC KEY-----'. Make sure to remove all line breaks from the key before saving the variable.
      */
-    allowUnauthenticatedRequests: boolean;
+    verifierKey: string;
 }
 
 /* Excluded from this release type: purgeGatewayCache */
 
 /**
- * @beta
+ * The identifying element of the request that enforces distinct rate limits. For example, you can limit by `user`, `ip`, `function` or `all` - function allows you to specify a simple function to create a string identifier to create a rate-limit group
  */
-declare type RateLimitByType = "function" | "user" | "ip" | "all";
+declare type RateLimitByType = "user" | "ip" | "function" | "all";
 
 /**
- * @beta
+ * Adds the retry-after header, defaults to true
  */
 declare type RateLimitHeaderMode = "none" | "retry-after";
 
 /**
- * @beta
+ * The rate-limiting policy is used to limit the number of requests that can be made against your API based on a key.
+ *
+ * @remarks
+ * Rate-limiting allows you to set a maximum rate of requests for your API gateway.
+ * This is useful to enforce rate limits agreed with your clients and protect your
+ * downstream services.
+ *
+ * The Zuplo Rate-Limit allows you to limit based on different attributes of the
+ * incoming request. For example, you might set a rate limit of 10 requests per
+ * second per user, or 20 requests per second for a given IP address.
+ *
+ * The Zuplo rate-limiter also allows you to set a custom bucket name by which to
+ * effect a rate-limit using a function.
+ *
+ * When a client reaches a rate limit - they will receive a `429` response code.
+ *
+ * @title Rate Limiting
+ * @public
  * @param request - The ZuploRequest
- * @param options - The configuration options
- * @returns
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 declare const RateLimitInboundPolicy: InboundPolicyHandler<RateLimitInboundPolicyOptions>;
 export { RateLimitInboundPolicy as BasicRateLimitInboundPolicy }
 export { RateLimitInboundPolicy }
 
 /**
- * @beta
+ * The options for this policy
  */
 declare interface RateLimitInboundPolicyOptions {
+    rateLimitBy: RateLimitByType;
+    /**
+     * The max number of requests allowed in the given time window
+     */
     requestsAllowed: number;
+    /**
+     * The time window in which the requests are rate-limited. The count restarts after each window expires
+     */
     timeWindowMinutes: number;
-    identifier: {
-        module: any;
-        export: string;
-    };
-    export: string;
-    rateLimitBy: RateLimitByType;
-    region?: string;
     /**
-     * Adds the retry-after header, defaults to true
+     * The function that returns dynamic configuration data. Used only with `rateLimitBy=function`
      */
+    identifier?: {
+        /**
+         * used only with rateLimitBy=function. Specifies the export to load your custom bucket function, e.g. `default`, `rateLimitIdentifier`.
+         */
+        export: string;
+        /**
+         * Specifies the module to load your custom bucket function, in the format `$import(./modules/my-module)`
+         */
+        module: string;
+    };
     headerMode?: RateLimitHeaderMode;
     /**
-     * If true, the policy will throw an error in the event
-     * there is a problem connecting to the rate limit service
+     * If true, the policy will throw an error in the event there is a problem connecting to the rate limit service
      */
     throwOnFailure?: boolean;
     mode?: RateLimitMode;
@@ -2399,17 +2847,59 @@ declare interface RateLimitInboundPolicyOptions {
 export { RateLimitInboundPolicyOptions as BasicRateLimitInboundPolicyOptions }
 export { RateLimitInboundPolicyOptions }
 
+/**
+ * The mode of the policy. If set to `async`, the policy will check if the request is over the rate limit without blocking. This can result in some requests allowed over the rate limit.
+ */
 declare type RateLimitMode = "strict" | "async";
 
+/**
+ * The options for this policy. Many of them can be overridden at the code level in a request using the `AmberfloMeteringPolicy.setRequestProperties` method.
+ */
 declare interface ReadmeMeteringInboundPolicyOptions {
+    /**
+     * The API key to use when sending metrics calls to Readme
+     */
     apiKey: string;
-    development?: boolean;
-    userEmailPropertyPath?: string;
+    /**
+     * Optional - defaults to '.sub'. This is the path to the property on `request.user` that contains the label you want to use. For example `.data.accountNumber` would read the `request.user.data.accountNumber` property.
+     */
     userLabelPropertyPath?: string;
+    /**
+     * Optional - defaults to empty. This is the path to the property on `request.user` that contains the e-mail of the user. For example `.data.email` would read the `request.user.data.email` property.
+     */
+    userEmailPropertyPath?: string;
+    /**
+     * Optional. Whether the data should be ingested as 'development' mode or not. Defaults to true for working-copy and false for all other environments.
+     */
+    development?: boolean;
+    /**
+     * Optional - defaults to false. When true, Zuplo sends the full request path (which might contain sensitive information). By default, we only send the route path which should not contain sensitive information.
+     */
     useFullRequestPath?: boolean;
+    /**
+     * Optional, the URL to send metering events to (defaults to https://metrics.readme.io/request). This is useful for testing purposes.
+     */
     url?: string;
 }
 
+/**
+ * Readme is a developer documentation and API metrics company. This policy pushes logs to their API calls dashboard.
+ *
+ * @remarks
+ * Readme ([readme.com](https://readme.com)) is a developer Documentation and
+ * metrics service. This policy pushes the request/response data to their ingestion
+ * endpoint so you can see your Zuplo API traffic in their API calls dashboard.
+ *
+ * ![Readme API Calls Dashboard](https://cdn.zuplo.com/assets/071b2ead-7769-413b-a66a-133ae6fd755d.png)
+ *
+ * @title Readme Metrics
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
 export declare function ReadmeMetricsInboundPolicy(request: ZuploRequest, context: ZuploContext, options: ReadmeMeteringInboundPolicyOptions, policyName: string): Promise<ZuploRequest<any, Record<string, string>, Record<string, string>>>;
 
 /**
@@ -2421,62 +2911,129 @@ export declare function ReadmeMetricsInboundPolicy(request: ZuploRequest, contex
 export declare function redirectHandler(request: ZuploRequest, context: ZuploContext): Promise<Response>;
 
 /**
- * @beta
+ * Remove headers from the incoming request.
+ *
+ * @title Remove Request Headers
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const RemoveHeadersInboundPolicy: InboundPolicyHandler<RemoveHeadersInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface RemoveHeadersInboundPolicyOptions {
-    headers?: string[];
+    /**
+     * A list of headers to be removed from the incoming request
+     */
+    headers: string[];
 }
 
 /**
- * @beta
+ * Remove configured headers from the outgoing response.
+ *
+ * @title Remove Response Headers
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const RemoveHeadersOutboundPolicy: OutboundPolicyHandler<RemoveHeadersOutboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface RemoveHeadersOutboundPolicyOptions {
+    /**
+     * A list of headers to be removed from the incoming request
+     */
     headers: string[];
 }
 
 /**
- * @beta
+ * Remove query parameters from the incoming request
+ *
+ * @title Remove Query Parameters
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const RemoveQueryParamsInboundPolicy: InboundPolicyHandler<RemoveQueryParamsInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface RemoveQueryParamsInboundPolicyOptions {
+    /**
+     * Array of query parameters to be removed
+     */
     params: string[];
 }
 
 /**
- * @beta
+ * Replace a string in the incoming request body
+ *
+ * @title Replace String in Response Body
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const ReplaceStringOutboundPolicy: OutboundPolicyHandler<ReplaceStringOutboundPolicyOptions>;
 
+/**
+ * The options for this policy
+ */
 export declare interface ReplaceStringOutboundPolicyOptions {
+    /**
+     * The type of string replacement to perform
+     */
     mode: "regexp" | "string";
+    /**
+     * The pattern to match
+     */
     match: string;
+    /**
+     * The value to each match is replaced with
+     */
     replaceWith: string;
 }
 
 /**
- * @beta
+ * Enforces a maximum size in bytes of the incoming request.
+ *
+ * @title Request Size Limit
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const RequestSizeLimitInboundPolicy: InboundPolicyHandler<RequestSizeLimitInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface RequestSizeLimitInboundPolicyOptions {
+    /**
+     * The maximum size of the request in bytes
+     */
     maxSizeInBytes: number;
+    /**
+     * If true, the policy will reject any request with a `content-length` header in excess of `maxSizeInBytes` bytes value, but will not verify the actual size of the request. This is more efficient and offers slightly better memory usage but should only be used if you trust/control the clients calling the gateway to send an accurate content-length. If false, the gateway will actually verify the request size and reject any request with a size in excess of the stated maximum.
+     */
     trustContentLengthHeader?: boolean;
 }
 
@@ -2488,27 +3045,112 @@ export declare interface RequestUser<TUserData = any> {
     data: TUserData;
 }
 
-export declare const RequestValidationInboundPolicy: InboundPolicyHandler;
+/**
+ * Validate inbound requests based on Open API specification
+ *
+ * @remarks
+ * The Request Validation policy is used to validate incoming requests based on
+ * schemas in OpenAPI specifications.
+ *
+ * When configured, any requests that do not conform to your OpenAPI schema will be
+ * rejected with a `400: Bad Request` response containing a detailed error message
+ * (in JSON) explaining why the request was not accepted.
+ *
+ * Here's an example of how to specify a schema for validation in a request body in
+ * OpenAPI.
+ *
+ * ```json
+ *   "requestBody": {
+ *     "description": "user to add to the system",
+ *     "content": {
+ *       "application/json": {
+ *         "schema": {
+ *           "type": "object",
+ *           "properties": {
+ *             "name": {
+ *               "type": "string"
+ *             },
+ *             "age": {
+ *               "type": "integer"
+ *             }
+ *           },
+ *           "required": [
+ *             "name",
+ *             "age"
+ *           ]
+ *         }
+ *       }
+ *     }
+ *   }
+ * ```
+ *
+ * @title Request Validation
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare const RequestValidationInboundPolicy: InboundPolicyHandler<RequestValidationInboundPolicyOptions>;
 
+/**
+ * The options for this policy
+ */
 export declare interface RequestValidationInboundPolicyOptions {
-    logLevel?: LogLevel;
+    /**
+     * Optional. Specify one of the log levels: 'error | warn | info | debug'. Default: info
+     */
+    logLevel?: string;
     validateBody?: ValidationOptions;
-    validateQueryParameters?: ValidationOptions;
-    validatePathParameters?: ValidationOptions;
-    validateHeaders?: ValidationOptions;
+    validateQueryParameters?: ValidationOptions1;
+    validatePathParameters?: ValidationOptions2;
+    validateHeaders?: ValidationOptions3;
+    /**
+     * Optional. Specify whether to include the request in the logs. Default: false
+     */
     includeRequestInLogs?: boolean;
 }
 
 /**
- * @beta
+ * Sets an allow-list for an origin header
+ *
+ * @remarks
+ * The Require Origin policy is used to enforce that the client is sending an
+ * `origin` header that matches your allow-list specified in the policy options.
+ *
+ * This is useful if you want to stop any browser traffic from different domains.
+ *
+ * However, it is important to note that it does not guarantee that traffic is only
+ * coming from a browser. Somebody could simulate a browser request from a backend
+ * server and set any origin they like.
+ *
+ * If the incoming origin is missing, or not allowed - a 400 Forbidden Problem
+ * Response will be sent to the client. You can customize the `detail` property in
+ * the policy options.
+ *
+ * @title Require Origin
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
-declare type RequiredClaims = Record<string, string[]>;
-
 export declare const RequireOriginInboundPolicy: InboundPolicyHandler<RequireOriginInboundPolicyOptions>;
 
+/**
+ * The options for this policy
+ */
 export declare interface RequireOriginInboundPolicyOptions {
-    origins?: string[] | string;
-    failureDetail: string;
+    /**
+     * A comma separated string containing valid origins
+     */
+    origins: string;
+    /**
+     * The `detail` of the HTTP Problem response, if the origin is missing or disallowed
+     */
+    failureDetail?: string;
 }
 
 /**
@@ -2645,7 +3287,7 @@ export declare function sanitizedIdentifierName(name: string): string;
 /**
  * @deprecated Use RequestValidationInboundPolicy instead
  */
-export declare const SchemaBasedRequestValidation: InboundPolicyHandler<any>;
+export declare const SchemaBasedRequestValidation: InboundPolicyHandler<RequestValidationInboundPolicyOptions>;
 
 /* Excluded from this release type: serialize */
 
@@ -2659,40 +3301,149 @@ export declare interface ServiceProvider {
 
 /* Excluded from this release type: ServiceProviderImpl */
 
+/**
+ * Sets the body of the request in the inbound pipeline - make sure to convert a GET/HEAD request to another method when using this policy.
+ *
+ * @remarks
+ * The Set Body policy allows you to set or override the incoming request body.
+ * [GET or HEAD requests do not support bodies on Zuplo](/docs/articles/zp-body-removed),
+ * so be sure to use the [Change Method](/docs/policies/change-method-inbound)
+ * policy to update the method to a `POST` or whatever is appropriate. You might
+ * also need to use the [Set Header](/docs/policies/set-headers-inbound) policy to
+ * set a `content-type`.
+ *
+ * @title Set Body
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
 export declare const SetBodyInboundPolicy: InboundPolicyHandler<SetBodyInboundPolicyOptions>;
 
+/**
+ * The options for this policy
+ */
 export declare interface SetBodyInboundPolicyOptions {
+    /**
+     * The value to set for the body
+     */
     body: string;
 }
 
 /**
- * @beta
+ * Adds or sets headers on the incoming request.
+ *
+ * @remarks
+ * The set header policy adds a header to the request in the inbound pipeline. This
+ * can be used to set a security header required by the downstream service. For
+ * example, if your backend service uses basic authentication you might use this
+ * policy to attach the Basic auth header to the request:
+ *
+ * ```json
+ * {
+ *   "export": "SetHeadersInboundPolicy",
+ *   "module": "$import(@zuplo/runtime)",
+ *   "options": {
+ *     "headers": [
+ *       {
+ *         "name": "Authorization",
+ *         "value": "Basic DIGEST_HERE",
+ *         "overwrite": true
+ *       }
+ *     ]
+ *   }
+ * }
+ * ```
+ *
+ * When doing this, you most likely want to set the secret as an environment
+ * variable, which can be accessed in the policy as follows
+ *
+ * ```json
+ * {
+ *   "export": "SetHeadersInboundPolicy",
+ *   "module": "$import(@zuplo/runtime)",
+ *   "options": {
+ *     "headers": [
+ *       {
+ *         "name": "Authorization",
+ *         "value": "$env(BASIC_AUTHORIZATION_HEADER_VALUE)",
+ *         "overwrite": true
+ *       }
+ *     ]
+ *   }
+ * }
+ * ```
+ *
+ * And you would set the environment variable `BASIC_AUTHORIZATION_HEADER_VALUE` to
+ * `Basic DIGEST_HERE`.
+ *
+ * @title Add or Set Request Headers
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const SetHeadersInboundPolicy: InboundPolicyHandler<SetHeadersInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface SetHeadersInboundPolicyOptions {
+    /**
+     * An array of name and value objects (with an optional `overwrite` boolean)
+     */
     headers: {
+        /**
+         * The name of the header
+         */
         name: string;
+        /**
+         * The value of the header
+         */
         value: string;
+        /**
+         * Overwrite the value if the header is already present in the request
+         */
         overwrite?: boolean;
     }[];
 }
 
 /**
- * @beta
+ * Adds or sets headers on the on the outgoing.
+ *
+ * @title Set Status Code
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const SetHeadersOutboundPolicy: OutboundPolicyHandler<SetHeadersOutboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface SetHeadersOutboundPolicyOptions {
+    /**
+     * An array of name and value objects (with an optional `overwrite` boolean)
+     */
     headers: {
+        /**
+         * The name of the header
+         */
         name: string;
+        /**
+         * The value of the header
+         */
         value: string;
+        /**
+         * Overwrite the value if the header is already present in the request
+         */
         overwrite?: boolean;
     }[];
 }
@@ -2700,43 +3451,88 @@ export declare interface SetHeadersOutboundPolicyOptions {
 export declare function setMoesifContext(context: ZuploContext, moesifContext: MoesifContext): void;
 
 /**
- * @beta
+ * Adds or sets query parameters on the incoming request.
+ *
+ * @title Add or Set Query Parameters
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const SetQueryParamsInboundPolicy: InboundPolicyHandler<SetQueryParamsInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface SetQueryParamsInboundPolicyOptions {
+    /**
+     * An array of name and value objects (with an optional `overwrite` boolean)
+     */
     params: {
+        /**
+         * The name of the param
+         */
         name: string;
+        /**
+         * The value of the param
+         */
         value: string;
+        /**
+         * Overwrite the value if the param is already present in the request
+         */
         overwrite?: boolean;
     }[];
 }
 
 /**
- * @beta
+ * Sets the status code on the on the outgoing response.
+ *
+ * @title Set Status Code
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const SetStatusOutboundPolicy: OutboundPolicyHandler<SetStatusOutboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface SetStatusOutboundPolicyOptions {
+    /**
+     * The status code to be used in the response
+     */
     status?: number;
+    /**
+     * The statusText to be used in the response (optional)
+     */
     statusText?: string;
 }
 
 /**
- * @beta
+ * Add a delay to the incoming request. Useful for testing.
+ *
+ * @title Sleep / Delay
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const SleepInboundPolicy: InboundPolicyHandler<SleepInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface SleepInboundPolicyOptions {
+    /**
+     * The number of milliseconds to delay the request
+     */
     sleepInMs: number;
 }
 
@@ -2755,26 +3551,50 @@ export declare class SumoLogicLoggingPlugin extends LogPlugin {
 }
 
 /**
- * @beta
- * Validates a JWT issued by a Open Id service
+ * The Supabase JWT Authentication policy supports user JWT tokens created by Supabase.
+ *
+ * @remarks
+ * The Supabase JWT Authentication policy allows you to authenticate incoming
+ * requests using a token created by [supabase.com](https://supabase.com).
+ *
+ * When configured, you can have Zuplo check incoming requests for a JWT token and
+ * automatically populate the `ZuploRequest`'s `user` property with a user object.
+ *
+ * This `user` object will have a `sub` property - taking the `sub` id from the JWT
+ * token. It will also have a `data` property populated by other data returned in
+ * the JWT token - including all your claims, `user_metadata` and `app_metadata`.
+ *
+ * You can also require specific claims to have specific values to allow
+ * authentication to complete, providing a layer of authorization.
+ *
+ * @title Supabase JWT Auth
+ * @public
  * @param request - The ZuploRequest
  * @param context - The ZuploContext
- * @param options - The configuration options
- * @returns
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const SupabaseJwtInboundPolicy: InboundPolicyHandler<SupabaseJwtInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface SupabaseJwtInboundPolicyOptions {
+    /**
+     * The key used to verify the signature of the JWT token
+     */
     secret: string;
     /**
-     * If false, a 401 will be returned if a valid
-     * Authorization header is not present
+     * Indicates whether the request should continue if authentication fails. Default is `false` which means unauthenticated users will automatically receive a 401 response.
      */
     allowUnauthenticatedRequests?: boolean;
-    requiredClaims?: RequiredClaims;
+    /**
+     * Any claims that must be present for authentication to succeed - multiple valid values can be specified for each claim.
+     */
+    requiredClaims?: {
+        [k: string]: string[];
+    };
 }
 
 /* Excluded from this release type: SYSTEM_LOGGER */
@@ -2784,80 +3604,130 @@ export declare interface SupabaseJwtInboundPolicyOptions {
 /* Excluded from this release type: SystemRouteName */
 
 /**
- * Uses Azure Active Directory to add an Authorization header to the request
- * in order to authenticate requests using Azure identity.
- *
+ * Uses Azure Active Directory to add an Authorization header to the request in order to authenticate requests using Azure identity.
  * @see {@link https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad|Configure your App Service or Azure Functions app to use Azure AD login}
- * @beta
+ *
+ * @remarks
+ * This policy adds a `Authorization` header to the upstream request that allows
+ * using Azure AD to authenticate requests to your origin server. This is a useful
+ * means of securing your origin server so that only your Zuplo gateway can make
+ * requests against it.
+ *
+ * Using this policy allows you to delegate authentication and authorization to
+ * your gateway without writing any code on your origin service. For instructions
+ * on how to configure Azure AD authentication see
+ * [Azure's documentation](https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad).
+ *
+ * @title Upstream Azure AD Service Auth
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const UpstreamAzureAdServiceAuthInboundPolicy: InboundPolicyHandler<UpstreamAzureAdServiceAuthInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface UpstreamAzureAdServiceAuthInboundPolicyOptions {
     /**
-     * Azure Active Directory Tenant ID
+     * Azure Active Directory Tenant ID.
      */
     activeDirectoryTenantId: string;
     /**
-     * The Application (client) ID of the Azure AD App Registration
+     * The Application (client) ID of the Azure AD App Registration.
      */
     activeDirectoryClientId: string;
     /**
-     * The client secret of the Azure AD App Registration
+     * The client secret of the Azure AD App Registration.
      */
     activeDirectoryClientSecret: string;
     /**
-     * The number of times to retry fetching the token in the event of a failure.
-     * Defaults to 3.
+     * The number of times to retry fetching the token in the event of a failure. Defaults to 3.
      */
     tokenRetries?: number;
     /**
-     * The number of seconds less than the token expiration to cache the token
-     * Defaults to 300 seconds.
+     * The number of seconds less than the token expiration to cache the token. Defaults to 300 seconds.
      */
     expirationOffsetSeconds?: number;
 }
 
 /**
- * @beta
+ * Creates a Firebase Admin token and attaches it to the outgoing request. Useful when calling Firebase services as an administrator.
+ *
+ * @remarks
+ * This policy adds a Firebase Admin token to the outgoing `Authentication` header
+ * allowing requests to Firebase using Service Account admin permissions. This can
+ * be useful for calling Firebase services such as Firestore through a Zuplo
+ * endpoint that is secured with other means of Authentication such as API keys.
+ * Additionally, this policy can be useful for service content to all API users
+ * (for example serving a specific Firestore document containing configuration
+ * data)
+ *
+ * We recommend reading the `serviceAccountJson` from environment variables (so it
+ * is not checked in to source control) using the `$env(ENV_VAR)` syntax.
+ *
+ * @title Upstream Firebase Admin Auth
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const UpstreamFirebaseAdminAuthInboundPolicy: InboundPolicyHandler<UpstreamFirebaseAdminAuthInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface UpstreamFirebaseAdminAuthInboundPolicyOptions {
     /**
-     * The JSON key of your GCP Service Account
-     * @see {@link https://developers.google.com/workspace/guides/create-credentials|Create access credentials}
+     * The Google Service Account key in JSON format. Note you can load this from environment variables using the $env(ENV_VAR) syntax.
      */
     serviceAccountJson: string;
     /**
-     * The number of times to retry fetching the token in the event of a failure.
-     * Defaults to 3.
+     * The number of times to retry fetching the token in the event of a failure. Defaults to 3.
      */
     tokenRetries?: number;
     /**
-     * The number of seconds less than the token expiration to cache the token
-     * Defaults to 300 seconds.
+     * The number of seconds less than the token expiration to cache the token. Defaults to 300 seconds.
      */
     expirationOffsetSeconds?: number;
 }
 
 /**
- * @beta
+ * Creates a Firebase custom user token and attaches it to the outgoing request. Useful when calling Firebase services as user.
+ *
+ * @remarks
+ * This policy adds a Firebase Admin token to the outgoing `Authentication` header
+ * allowing requests to Firebase using Service Account admin permissions. This can
+ * be useful for calling Firebase services such as Firestore through a Zuplo
+ * endpoint that is secured with other means of Authentication such as API keys.
+ * Additionally, this policy can be useful for service content to all API users
+ * (for example serving a specific Firestore document containing configuration
+ * data)
+ *
+ * We recommend reading the `serviceAccountJson` from environment variables (so it
+ * is not checked in to source control) using the `$env(ENV_VAR)` syntax.
+ *
+ * @title Upstream Firebase User Auth
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const UpstreamFirebaseUserAuthInboundPolicy: InboundPolicyHandler<UpstreamFirebaseUserAuthInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface UpstreamFirebaseUserAuthInboundPolicyOptions {
     /**
-     * The JSON key of your GCP Service Account
-     * @see {@link https://developers.google.com/workspace/guides/create-credentials|Create access credentials}
+     * The Google Service Account key in JSON format. Note you can load this from environment variables using the $env(ENV_VAR) syntax.
      */
     serviceAccountJson: string;
     /**
@@ -2871,67 +3741,109 @@ export declare interface UpstreamFirebaseUserAuthInboundPolicyOptions {
     /**
      * Optional additional claims to include in the custom token's payload.
      */
-    developerClaims?: Record<string, boolean | string | number | null>;
+    developerClaims?: Record<string, string | number | boolean | null>;
     /**
      * The Firebase Web API Key (found in project settings)
      * @see {@link https://firebase.google.com/docs/projects/api-keys|Firebase API Keys}
      */
     webApiKey: string;
     /**
-     * The number of times to retry fetching the token in the event of a failure.
-     * Defaults to 3.
+     * The number of times to retry fetching the token in the event of a failure. Defaults to 3.
      */
     tokenRetries?: number;
     /**
-     * The number of seconds less than the token expiration to cache the token
-     * Defaults to 300 seconds.
+     * The number of seconds less than the token expiration to cache the token. Defaults to 300 seconds.
      */
     expirationOffsetSeconds?: number;
 }
 
 /**
- * @beta
+ * Creates a self-signed JWT token (generated using a Google Service Account JSON) and attaches it to the outgoing request. Useful when calling GCP services like Cloud Endpoints / ESPv2
+ *
+ * @remarks
+ * **CAUTION: This policy only works with
+ * [certain Google APIs](https://developers.google.com/identity/protocols/oauth2/service-account#jwt-auth).
+ * In most cases, the
+ * [Upstream GCP Service Auth](/docs/policies/upstream-gcp-service-auth-inbound)
+ * should be used.**
+ *
+ * This policy adds a JWT token to the headers, ready for us in an outgoing request
+ * when calling a GCP service (e.g. Cloud Endpoints / ESPv2). We recommend reading
+ * the `serviceAccountJson` from environment variables (so it is not checked in to
+ * source control) using the `$env(ENV_VAR)` syntax.
+ *
+ * @title Upstream GCP Self-Signed JWT
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const UpstreamGcpJwtInboundPolicy: InboundPolicyHandler<UpstreamGcpJwtInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface UpstreamGcpJwtInboundPolicyOptions {
+    /**
+     * The audience for the minted JWT. Refer to https://cloud.google.com/endpoints/docs/grpc-service-config/reference/rpc/google.api#google.api.AuthRequirement.
+     */
     audience: string;
+    /**
+     * The Google Service Account key in JSON format. Note you can load this from environment variables using the $env(ENV_VAR) syntax.
+     */
     serviceAccountJson: string;
 }
 
 /**
- * Uses a GCP IAM Service Account to add an Authorization header to the request
- * in order to authenticate requests to Google Services using ID Tokens
- *
+ * Creates an ID Token from Google's OAuth service and attaches it to the outgoing request. Useful when calling GCP services that are secured with GCP IAM.
  * @see {@link https://cloud.google.com/functions/docs/securing/authenticating|Authenticating for invocation}
- * @beta
+ *
+ * @remarks
+ * This policy allows you to delegate authentication and authorization to your
+ * gateway without writing any code on your origin service by adding a GCP Issued
+ * ID Token to outgoing header allowing the service to be secured with GCP IAM.
+ * This is a useful means of securing your origin server so that only your Zuplo
+ * gateway can make requests against it.
+ *
+ * This policy works with
+ * [GCP Identity Aware Proxy](https://zuplo.com/docs/articles/gke-with-upstream-auth-policy)
+ * or services like [Cloud Run](https://cloud.google.com/iap/docs/managing-access)
+ * that natively support IAM authorization.
+ *
+ * We recommend reading the `serviceAccountJson` from environment variables (so it
+ * is not checked in to source control) using the `$env(ENV_VAR)` syntax.
+ *
+ * @title Upstream GCP Service Auth
+ * @public
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
 export declare const UpstreamGcpServiceAuthInboundPolicy: InboundPolicyHandler<UpstreamGcpServiceAuthInboundPolicyOptions>;
 
 /**
- * @beta
+ * The options for this policy
  */
 export declare interface UpstreamGcpServiceAuthInboundPolicyOptions {
     /**
-     * The audience for the service to be called (i.e. the URI of the API)
+     * The audience for the service to be called. This is typically the URL of your service endpoint like 'https://my-service-a2ev-uc.a.run.app'
      */
     audience: string;
     /**
-     * The JSON key of your GCP Service Account
+     * The Google Service Account key in JSON format. Note you can load this from environment variables using the $env(ENV_VAR) syntax.
      * @see {@link https://developers.google.com/workspace/guides/create-credentials|Create access credentials}
      */
     serviceAccountJson: string;
     /**
-     * The number of times to retry fetching the token in the event of a failure.
-     * Defaults to 3.
+     * The number of times to retry fetching the token in the event of a failure. Defaults to 3.
      */
     tokenRetries?: number;
     /**
-     * The number of seconds less than the token expiration to cache the token
-     * Defaults to 300 seconds.
+     * The number of seconds less than the token expiration to cache the token. Defaults to 300 seconds.
      */
     expirationOffsetSeconds?: number;
     /**
@@ -2962,27 +3874,70 @@ export declare const VALID_COMPATIBILITY_DATES: readonly CompatibilityDate[];
 /* Excluded from this release type: ValidateFunction */
 
 /**
- * @beta
- * @param request - The incoming request
- * @param options - The validation options
- * @returns
+ * Validates the body of an incoming request based on a JSON schema.
+ *
+ * @remarks
+ * **This policy is deprecated. Use the new
+ * [Request Validation Policy](https://zuplo.com/docs/policies/request-validation-inbound).
+ * The new policy validates JSON bodies like this policy, but also supports
+ * validation of parameters, query strings, etc.**
+ *
+ * The Validate JSON Schema policy is used to validate the body of incoming
+ * requests. It works using JSON Schemas defined in the `Schemas` folder of your
+ * project.
+ *
+ * When configured, any requests that do not have a body conforming to your JSON
+ * schema will be rejected with a `400: Bad Request` response containing a detailed
+ * error message (in JSON) explaining why the body was not accepted.
+ *
+ * @title JSON Body Validation
+ * @public
+ * @deprecated Use the Request Validation policy (RequestValidationInboundPolicy) instead.
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
  */
-export declare const ValidateJsonSchemaInbound: InboundPolicyHandler<ValidateJsonSchemaInboundOptions>;
+export declare const ValidateJsonSchemaInbound: InboundPolicyHandler<ValidateJsonSchemaInboundInternalOptions>;
 
 /**
  * @beta
  */
-export declare interface ValidateJsonSchemaInboundOptions {
+declare interface ValidateJsonSchemaInboundInternalOptions extends Omit<ValidateJsonSchemaInboundOptions, "validator"> {
     /* Excluded from this release type: validator */
 }
 
-declare enum ValidationOptions {
-    none = "none",
-    logOnly = "log-only",
-    rejectAndLog = "reject-and-log",
-    rejectOnly = "reject-only"
+/**
+ * The options for this policy
+ */
+export declare interface ValidateJsonSchemaInboundOptions {
+    /**
+     * The JSON schema to validate against.
+     */
+    validator: string;
 }
 
+/**
+ * Optional. Specify one of the options: 'none, log-only, reject-and-log, reject-only'. Default: none
+ */
+declare type ValidationOptions = "none" | "log-only" | "reject-and-log" | "reject-only";
+
+/**
+ * Optional. Specify one of the options: 'none, log-only, reject-and-log, reject-only'. Default: none
+ */
+declare type ValidationOptions1 = "none" | "log-only" | "reject-and-log" | "reject-only";
+
+/**
+ * Optional. Specify one of the options: 'none, log-only, reject-and-log, reject-only'. Default: none
+ */
+declare type ValidationOptions2 = "none" | "log-only" | "reject-and-log" | "reject-only";
+
+/**
+ * Optional. Specify one of the options: 'none, log-only, reject-and-log, reject-only'. Default: none
+ */
+declare type ValidationOptions3 = "none" | "log-only" | "reject-and-log" | "reject-only";
+
 export declare interface VersionData {
     name: string;
     pathPrefix: string;