@zuplo/runtime 6.71.22 → 6.71.25

package/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{b as l}from"../chunk-54PA7VDV.js";import{a as o,da as n}from"../chunk-DSZS6PZJ.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function t(i){e.push(Promise.resolve(i))}return o(t,"waitUntil"),{context:new s({event:{waitUntil:t},route:u.route}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(g,"createMockContext");var p={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},s=class extends EventTarget{static{o(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=p,parentContext:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=r,this.#e=e,this.analyticsContext=new l(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,r){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,t,r){let d=o(i=>{try{typeof t=="function"?t(i):t.handleEvent(i)}catch(a){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),a}},"wrapped");super.addEventListener(e,d,r)}};export{s as MockZuploContext,g as createMockContext};
+import{b as l}from"../chunk-4QJJMELB.js";import{a as o,da as n}from"../chunk-DSZS6PZJ.js";function g(u={request:new Request("https://api.example.com")}){let e=[];function t(i){e.push(Promise.resolve(i))}return o(t,"waitUntil"),{context:new s({event:{waitUntil:t},route:u.route}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(g,"createMockContext");var p={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},s=class extends EventTarget{static{o(this,"MockZuploContext")}#e;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=p,parentContext:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:n.console.info,log:n.console.log,debug:n.console.debug,warn:n.console.warn,error:n.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=r,this.#e=e,this.analyticsContext=new l(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,r){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addEventListener(e,t,r){let d=o(i=>{try{typeof t=="function"?t(i):t.handleEvent(i)}catch(a){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),a}},"wrapped");super.addEventListener(e,d,r)}};export{s as MockZuploContext,g as createMockContext};
 //# sourceMappingURL=index.js.map

package/out/types/index.d.ts

@@ -1,6 +1,7 @@
 import { Attributes } from "@opentelemetry/api";
 import { CallToolRequest } from "@zuplo/mcp/types";
 import { CallToolResult } from "@zuplo/mcp/types";
+import { InboundPolicyHandler as InboundPolicyHandler_2 } from "../../policies.js";
 import { KeyLike } from "jose";
 import { RequestGeneric as RequestGeneric_2 } from "../../request.js";
 import type { ValidateFunction } from "ajv";
@@ -181,6 +182,7 @@ export declare function aiGatewayHandler(
  * @returns A Request or a Response
  */
 export declare class AIGatewayMeteringInboundPolicy extends InboundPolicy<AIGatewayMeteringInboundPolicyOptions> {
+  static readonly policyType = "ai-gateway-metering";
   /**
    * Set the meter increments for the current request.
    *
@@ -208,10 +210,6 @@ export declare class AIGatewayMeteringInboundPolicy extends InboundPolicy<AIGate
   static getQuotaFallback(
     context: ZuploContext
   ): QuotaFallbackModels | undefined;
-  constructor(
-    options: AIGatewayMeteringInboundPolicyOptions,
-    policyName: string
-  );
   handler(
     request: ZuploRequest,
     context: ZuploContext
@@ -897,6 +895,14 @@ declare interface AnthropicMessage {
       }>;
 }
 
+/**
+ * A request to the Anthropic Messages API (`/v1/messages`).
+ *
+ * The gateway forwards this body to Anthropic verbatim on the native passthrough
+ * path, so the shape mirrors Anthropic's API rather than an internal contract.
+ * The index signature carries evolving Anthropic fields (`thinking`,
+ * `tool_choice`, `top_k`, structured `system` blocks, …) through unchanged.
+ */
 declare interface AnthropicMessagesRequest {
   model: string;
   messages: AnthropicMessage[];
@@ -908,6 +914,7 @@ declare interface AnthropicMessagesRequest {
   stream?: boolean;
   metadata?: Record<string, unknown>;
   tools?: unknown[];
+  [key: string]: unknown;
 }
 
 /**
@@ -1343,6 +1350,150 @@ declare interface AuditLogEntry {
   };
 }
 
+/**
+ * A CloudEvent 1.0 audit log entry. Most fields are auto-populated by the
+ * runtime; user code only supplies the type/subject/resources/data fields when
+ * calling `AuditLogInboundPolicy.log()`.
+ *
+ * @public
+ */
+export declare interface AuditLogEvent {
+  specversion: "1.0";
+  id: string;
+  source: string;
+  type: string;
+  time: string;
+  datacontenttype?: "application/json";
+  subject?: string;
+  bucketid: string;
+  actorsub?: string;
+  actortype?: "user" | "service" | "apikey" | "anonymous";
+  actoremail?: string;
+  actorconnection?: string;
+  resources?: AuditLogResource[];
+  requestid?: string;
+  success?: boolean;
+  httpmethod?: string;
+  httpurl?: string;
+  httpstatus?: number;
+  ipaddress?: string;
+  useragent?: string;
+  country?: string;
+  region?: string;
+  city?: string;
+  mcpserver?: string;
+  mcpvirtualserver?: string;
+  mcptool?: string;
+  data?: Record<string, unknown>;
+  extensions?: Record<string, unknown>;
+}
+
+/**
+ * Fields a caller may supply when emitting a custom audit event via
+ * `AuditLogInboundPolicy.log()`. Everything else is filled in by the runtime
+ * from the request context.
+ *
+ * @public
+ */
+export declare interface AuditLogEventInput {
+  type: string;
+  subject?: string;
+  resources?: AuditLogResource[];
+  success?: boolean;
+  data?: Record<string, unknown>;
+  /**
+   * Geolocation of the caller. When omitted, these default to the current
+   * request's geo data (from the request context), so custom events carry the
+   * same location information as the auto-emitted per-request event.
+   */
+  country?: string;
+  region?: string;
+  city?: string;
+  /** Override the auto-derived actor (rare). */
+  actor?: {
+    sub?: string;
+    type?: "user" | "service" | "apikey" | "anonymous";
+    email?: string;
+    connection?: string;
+  };
+  /** MCP-specific helpers. */
+  mcp?: {
+    server?: string;
+    virtualServer?: string;
+    tool?: string;
+  };
+}
+
+/**
+ * Capture detailed logs of requests for auditing purposes. The policy emits
+ * one structured CloudEvent per request, and user code can emit additional
+ * events via the static `log()` method.
+ *
+ * @title Audit Logs
+ * @product api-gateway
+ * @public
+ * @enterprise
+ */
+export declare class AuditLogInboundPolicy extends InboundPolicy<AuditLogInboundPolicyOptions> {
+  #private;
+  static readonly policyType = "audit-logs";
+  /**
+   * Emit an audit event for the current request.
+   *
+   * Fields not provided are filled in from the request context (bucket id,
+   * request id, time, actor, IP, user agent, etc).
+   *
+   * @param context - The current ZuploContext.
+   * @param event - The event details to record.
+   */
+  static log(context: ZuploContext, event: AuditLogEventInput): void;
+  constructor(options: AuditLogInboundPolicyOptions, policyName: string);
+  handler(
+    request: ZuploRequest,
+    context: ZuploContext
+  ): Promise<ZuploRequest | Response>;
+}
+
+/**
+ * The options for the Audit Log Inbound policy.
+ * @public
+ */
+export declare interface AuditLogInboundPolicyOptions {
+  /**
+   * Reverse-DNS prefix used for the auto-emitted request event type. Defaults to 'com.zuplo.api'.
+   */
+  eventTypeBase?: string;
+  /**
+   * Override the bucket id this policy emits events for. Defaults to the bucket id from the runtime environment.
+   */
+  bucketId?: string;
+  /**
+   * Fraction of requests to capture, between 0 (none) and 1 (all). Defaults to 1.
+   */
+  samplingRate?: number;
+  /**
+   * Controls which potentially-sensitive parts of each request are captured in the auto-emitted audit event. Disable fields to satisfy your own data-handling and PII policies. All are enabled by default.
+   */
+  include?: {
+    /**
+     * Include the request's query-string parameters in the logged URL. Disable if query strings may contain sensitive data.
+     */
+    queryParams?: boolean;
+    /**
+     * Include the authenticated user / actor identity (subject, email, connection).
+     */
+    user?: boolean;
+    /**
+     * Include the caller's IP address.
+     */
+    ipAddress?: boolean;
+    /**
+     * Include the caller's geolocation (country, region, city).
+     */
+    geolocation?: boolean;
+  };
+}
+
 /**
  * Configuration options for audit logging
  * @public
@@ -1387,6 +1538,16 @@ declare interface AuditLogRequestFilter {
   (request: ZuploRequest, context: ZuploContext): Promise<boolean>;
 }
 
+/**
+ * A resource affected by an audit event.
+ * @public
+ */
+export declare interface AuditLogResource {
+  type: string;
+  id: string;
+  metadata?: Record<string, unknown>;
+}
+
 /**
  * Authenticate users using Auth0 issued JWT tokens.
  *
@@ -1439,6 +1600,7 @@ export declare interface Auth0JwtInboundPolicyOptions {
  */
 export declare class AuthZenInboundPolicy extends InboundPolicy<AuthZenInboundPolicyOptions> {
   #private;
+  static readonly policyType = "authzen";
   constructor(options: AuthZenInboundPolicyOptions, policyName: string);
   /**
    * The handler that is called each time this policy is invoked
@@ -1759,6 +1921,7 @@ export declare class AWSLoggingPlugin extends LogPlugin {
  */
 export declare class AxiomaticsAuthZInboundPolicy extends InboundPolicy<AxiomaticsAuthZInboundPolicyOptions> {
   #private;
+  static readonly policyType = "axiomatics-authz";
   private pdpService;
   static setAuthAttributes(
     context: ZuploContext,
@@ -2126,6 +2289,7 @@ declare interface BatchDispatcherOptions {
  * @returns A Request or a Response
  */
 export declare class BrownoutInboundPolicy extends InboundPolicy<BrownoutInboundPolicyOptions> {
+  static readonly policyType = "brownout";
   crons: Cron[];
   constructor(options: BrownoutInboundPolicyOptions, policyName: string);
   handler(
@@ -2856,6 +3020,7 @@ export declare type ComplexRateLimitFunction =
  * @returns A Request or a Response
  */
 export declare class ComplexRateLimitInboundPolicy extends InboundPolicy<ComplexRateLimitInboundPolicyOptions> {
+  static readonly policyType = "complex-rate-limit";
   /**
    * Override the increments for a limit in the current request.
    *
@@ -3863,6 +4028,20 @@ export declare function extractGraphqlErrors(
   bodyText: string
 ): GraphqlResponseError[] | null;
 
+/**
+ * Pull the incremental ASSISTANT TEXT from a parsed stream event per shape. The
+ * single source of truth for "is this delta assistant text" — chat
+ * `choices[].delta.content`, Responses `response.output_text.delta` only (NOT
+ * tool-args / audio / refusal / code deltas), Anthropic `content_block_delta`.
+ * Stream-scanning policies (e.g. the firewall accumulator) should call this
+ * rather than re-deriving the per-shape extraction.
+ * @public
+ */
+export declare function extractStreamTextDelta(
+  parsed: unknown,
+  format: AiFormat
+): string | undefined;
+
 declare interface FetchOptions<T> {
   method?: HttpMethod_2;
   data?: T;
@@ -4305,6 +4484,21 @@ export declare interface GraphqlAnalyticsOutboundPolicyOptions {
   maxScanBytes?: number;
 }
 
+/**
+ * GraphQL response-cache outcome, as decided by the Zuplo-provided GraphQL
+ * Cache policy (`graphql-cache-inbound`) and reported on its `x-cache`
+ * response header:
+ *  - `"hit"`  — the response was served from cache.
+ *  - `"miss"` — a cache-eligible query that was not in cache (forwarded to
+ *               the origin).
+ *
+ * Operations that are not cache-eligible (mutations, subscriptions,
+ * uncacheable/credentialed requests) — or that ran on a route without the
+ * GraphQL Cache policy — carry no cache state (`null`), and are excluded
+ * from the cache-hit-rate denominator.
+ */
+export declare type GraphqlCacheState = "hit" | "miss";
+
 /**
  * One GraphQL error extracted from a response body, reduced to the
  * fields the GraphQL Analytics outbound policy consumes for
@@ -6031,6 +6225,7 @@ declare interface ImageGenerationTool {
 export declare abstract class InboundPolicy<
   TOptions = any,
 > extends PolicyBase<TOptions> {
+  readonly direction: PolicyDirection;
   /**
    * The handler that is called each time this policy is invoked
    *
@@ -6789,6 +6984,7 @@ declare type LokiTransportVersion = 1 | 2;
  */
 export declare class McpAuth0OAuthInboundPolicy extends InboundPolicy<ValidatedAuth0OAuthOptions> {
   #private;
+  static readonly policyType = "mcp-auth0-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -6967,6 +7163,7 @@ declare const mcpAuth0OAuthOptionsSchema: z.ZodObject<
  */
 export declare class McpClerkOAuthInboundPolicy extends InboundPolicy<McpClerkOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-clerk-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7037,6 +7234,7 @@ export declare interface McpClerkOAuthInboundPolicyOptions {
  */
 export declare class McpCognitoOAuthInboundPolicy extends InboundPolicy<McpCognitoOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-cognito-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7118,6 +7316,7 @@ export declare interface McpCognitoOAuthInboundPolicyOptions {
  */
 export declare class McpEntraOAuthInboundPolicy extends InboundPolicy<McpEntraOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-entra-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7194,6 +7393,7 @@ export declare interface McpEntraOAuthInboundPolicyOptions {
  */
 export declare class McpGoogleOAuthInboundPolicy extends InboundPolicy<McpGoogleOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-google-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7264,6 +7464,7 @@ export declare interface McpGoogleOAuthInboundPolicyOptions {
  */
 export declare class McpKeycloakOAuthInboundPolicy extends InboundPolicy<McpKeycloakOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-keycloak-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7341,6 +7542,7 @@ export declare interface McpKeycloakOAuthInboundPolicyOptions {
  */
 export declare class McpLogtoOAuthInboundPolicy extends InboundPolicy<McpLogtoOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-logto-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7419,6 +7621,7 @@ export declare interface McpLogtoOAuthInboundPolicyOptions {
  * @product mcp-gateway
  */
 export declare class McpOAuthInboundPolicy extends InboundPolicy<McpOAuthRuntimeConfig> {
+  static readonly policyType = "mcp-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7695,6 +7898,7 @@ declare const mcpOAuthRuntimeConfigSchema: z.ZodObject<
  */
 export declare class McpOktaOAuthInboundPolicy extends InboundPolicy<McpOktaOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-okta-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7772,6 +7976,7 @@ export declare interface McpOktaOAuthInboundPolicyOptions {
  */
 export declare class McpOneLoginOAuthInboundPolicy extends InboundPolicy<McpOneLoginOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-onelogin-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7842,6 +8047,7 @@ export declare interface McpOneLoginOAuthInboundPolicyOptions {
  */
 export declare class McpPingOAuthInboundPolicy extends InboundPolicy<McpPingOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-ping-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -7967,6 +8173,7 @@ declare interface McpTool {
  */
 export declare class McpWorkosOAuthInboundPolicy extends InboundPolicy<McpWorkosOAuthInboundPolicyOptions> {
   #private;
+  static readonly policyType = "mcp-workos-oauth";
   constructor(rawOptions: unknown, policyName: string);
   handler(
     request: ZuploRequest,
@@ -8310,6 +8517,7 @@ export declare interface MoesifInboundPolicyOptions {
  */
 export declare class MonetizationInboundPolicy extends InboundPolicy<MonetizationInboundPolicyOptions> {
   #private;
+  static readonly policyType = "monetization";
   /**
    * Set the monetization subscription data for the current request.
    *
@@ -8632,6 +8840,7 @@ export declare interface OAuthProtectedResourcePluginOptions {
  * @returns A Request or a Response
  */
 export declare class OktaFGAAuthZInboundPolicy extends BaseOpenFGAAuthZInboundPolicy {
+  static readonly policyType = "oktafga-authz";
   constructor(options: OktaFGAAuthZInboundPolicyOptions, policyName: string);
 }
 
@@ -9371,7 +9580,7 @@ declare namespace OpenAPIV3_1 {
  * @returns A Request or a Response
  */
 export declare class OpenFGAAuthZInboundPolicy extends BaseOpenFGAAuthZInboundPolicy {
-  constructor(options: OpenFGAAuthZInboundPolicyOptions, policyName: string);
+  static readonly policyType = "openfga-authz";
 }
 
 /**
@@ -9507,6 +9716,7 @@ export declare interface OpenIdJwtInboundPolicyOptions {
  */
 export declare class OpenMeterInboundPolicy extends InboundPolicy<OpenMeterInboundPolicyOptions> {
   #private;
+  static readonly policyType = "openmeter-metering";
   constructor(options: OpenMeterInboundPolicyOptions, policyName: string);
   handler(
     request: ZuploRequest<RequestGeneric>,
@@ -9692,6 +9902,7 @@ export declare class OTelMetricsPlugin extends MetricsPlugin {
 export declare abstract class OutboundPolicy<
   TOptions = any,
 > extends PolicyBase<TOptions> {
+  readonly direction: PolicyDirection;
   /**
    * The handler that is called each time this policy is invoked
    *
@@ -9818,16 +10029,11 @@ declare interface ParsedRouteData extends Omit<RouteData, "corsPolicies"> {
   /* Excluded from this release type: getInboundPolicyInstance */
 }
 
-/**
- * The base class for inbound and outbound policies.
- * Provides common functionality for all policy types.
- *
- * @public
- */
 declare abstract class PolicyBase<TOptions = any> {
   options: TOptions;
   policyName: string;
-  policyType: string;
+  /* Excluded from this release type: policyType */
+  /* Excluded from this release type: direction */
   /* Excluded from this release type: __constructor */
 }
 
@@ -9841,6 +10047,22 @@ export declare interface PolicyConfiguration {
   options?: unknown;
 }
 
+/**
+ * The base class for inbound and outbound policies.
+ * Provides common functionality for all policy types.
+ *
+ * @public
+ */
+/**
+ * The pipeline phase a policy runs in. Inbound policies run on the request
+ * before the handler; outbound policies run on the response after it. This is
+ * determined structurally by whether a policy extends {@link InboundPolicy} or
+ * {@link OutboundPolicy}, so it can never drift from the policy's real phase.
+ *
+ * @public
+ */
+declare type PolicyDirection = "inbound" | "outbound";
+
 /**
  * @public
  */
@@ -10118,7 +10340,7 @@ declare interface QuotaFallbackModels {
  */
 export declare class QuotaInboundPolicy extends InboundPolicy<QuotaInboundPolicyOptions> {
   #private;
-  constructor(options: QuotaInboundPolicyOptions, policyName: string);
+  static readonly policyType = "quota";
   handler(
     request: ZuploRequest<RequestGeneric>,
     context: ZuploContext
@@ -10416,6 +10638,28 @@ export declare function ReadmeMetricsInboundPolicy(
   policyName: string
 ): Promise<ZuploRequest<RequestGeneric_2>>;
 
+/**
+ * Record the GraphQL response-cache outcome for the in-flight operation so
+ * the analytics middleware can emit it as the `cacheState` dimension on the
+ * `graphql_operation` event.
+ *
+ * Called by the Zuplo-provided GraphQL Cache policy (`graphql-cache-inbound`,
+ * in the `@zuplo/graphql` package) the moment it resolves a cache hit or
+ * miss — synchronously during inbound processing, before the analytics
+ * middleware finalizes the event. Mirrors how the GraphQL Analytics outbound
+ * policy feeds errors through {@link getOperationContext}.
+ *
+ * No-op when the request isn't running the GraphQL analytics middleware (the
+ * route lacks the `x-graphql: true` marker, so there's no operation context to
+ * write to), so it's always safe to call.
+ *
+ * @public
+ */
+export declare function recordGraphqlCacheState(
+  context: ZuploContext,
+  cacheState: GraphqlCacheState
+): void;
+
 /**
  * Handler that returns HTTP redirects.
  * Useful for URL shortening, legacy URL handling, or routing to external services.
@@ -11367,7 +11611,7 @@ export declare type SemanticCacheInboundPolicyOptions = {
 };
 
 /**
- * Similarity threshold (0-1) for a cache hit. Higher values require closer semantic matches. Defaults to 0.8.
+ * The semantic similarity threshold for semantic cache matches. Values closer to 0 require closer similarity, while larger values allow more flexible matching. Default is 0.2.
  * @public
  */
 declare type SemanticTolerance = number;
@@ -11422,7 +11666,7 @@ export declare interface SetBodyInboundPolicyOptions {
  * @param policyName - The name of the policy as set in policies.json
  * @returns A Request or a Response
  */
-export declare const SetHeadersInboundPolicy: InboundPolicyHandler<SetHeadersInboundPolicyOptions>;
+export declare const SetHeadersInboundPolicy: InboundPolicyHandler_2<SetHeadersInboundPolicyOptions>;
 
 /**
  * The options for this policy.
@@ -11810,10 +12054,7 @@ export declare class StreamingZoneCache {
  * @returns A Request or a Response
  */
 export declare class StripeWebhookVerificationInboundPolicy extends InboundPolicy<StripeWebhookVerificationInboundPolicyOptions> {
-  constructor(
-    options: StripeWebhookVerificationInboundPolicyOptions,
-    policyName: string
-  );
+  static readonly policyType = "stripe-webhook-verification";
   handler(
     request: ZuploRequest,
     context: ZuploContext
@@ -12177,6 +12418,7 @@ export declare interface UpstreamFirebaseUserAuthInboundPolicyOptions {
  * @returns A Request or a Response
  */
 export declare class UpstreamGcpFederatedAuthInboundPolicy extends InboundPolicy<UpstreamGcpFederatedAuthInboundPolicyOptions> {
+  static readonly policyType = "upstream-gcp-federated-auth";
   private cacheName;
   private normalizedWorkloadIdentityProvider;
   constructor(
@@ -12332,6 +12574,7 @@ export declare interface UpstreamGcpServiceAuthInboundPolicyOptions {
  * @returns A ZuploRequest
  */
 export declare class UpstreamZuploJwtAuthInboundPolicy extends InboundPolicy<UpstreamZuploJwtAuthInboundPolicyOptions> {
+  static readonly policyType = "upstream-zuplo-jwt";
   constructor(
     options: UpstreamZuploJwtAuthInboundPolicyOptions,
     policyName: string
@@ -12833,6 +13076,7 @@ declare interface XacmlRequest {
  * @returns A Request or a Response
  */
 export declare class XmlToJsonOutboundPolicy extends OutboundPolicy<XmlToJsonPolicyOptions> {
+  static readonly policyType = "xml-to-json";
   private parser;
   private parseOnStatusCodes;
   constructor(options: XmlToJsonPolicyOptions, policyName: string);