@zuplo/runtime 7.7.17 → 7.8.1

package/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{E as p,J as c,M as u}from"../chunk-6FDUVW7W.js";import"../chunk-B5DKYXCI.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import"../chunk-GCOWKKQW.js";import{$ as i}from"../chunk-HWNKBEMX.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
+import{E as p,J as c,M as u}from"../chunk-UZ6DQL7L.js";import"../chunk-B5DKYXCI.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import"../chunk-GCOWKKQW.js";import{$ as i}from"../chunk-HWNKBEMX.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
 //# sourceMappingURL=index.js.map

package/out/types/index.d.ts

@@ -505,6 +505,61 @@ export declare function aiGatewayHandlerV2(
   context: ZuploContext
 ): Promise<Response>;
 
+/**
+ * Accepts only requests that this gateway made itself with
+ * `context.invokeRoute`, and rejects every request that arrived over the
+ * network with `403 Forbidden`.
+ *
+ * Use it in place of AI Gateway Authentication on an application that is only
+ * ever called by other routes and policies on the same gateway, such as the
+ * classifier application behind the Smart Router or Prompt Injection
+ * Protection policies. Those calls never leave the gateway, so an API key on
+ * them protects nothing. This policy asserts the one thing that matters: the
+ * request originated inside the deployment.
+ *
+ * The check reads `context.parentContext`, which the runtime sets only on the
+ * child context that `context.invokeRoute` creates. A client cannot supply it
+ * through a header, the URL, or the body. The policy has no options, makes no
+ * network calls, reads no body, and leaves `request.user` unset.
+ *
+ * @title Ensure Gateway Internal Invocation Only
+ * @product ai-gateway
+ * @requiresAI
+ * @public
+ *
+ * @param request - The incoming ZuploRequest
+ * @param context - The ZuploContext
+ * @param _options - The policy options set in policies.json (this policy has none)
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns The request when the gateway made it with `context.invokeRoute`, otherwise a 403 response
+ *
+ * @example
+ * ```json
+ * // policies.json - Declare the policy so an application chain can select it
+ * {
+ *   "name": "ai-gateway-internal-only-inbound",
+ *   "policyType": "ai-gateway-internal-only",
+ *   "handler": {
+ *     "export": "AIGatewayInternalOnlyInboundPolicy",
+ *     "module": "$import(@zuplo/runtime)",
+ *     "options": {}
+ *   }
+ * }
+ * ```
+ */
+export declare function AIGatewayInternalOnlyInboundPolicy(
+  request: ZuploRequest,
+  context: ZuploContext,
+  _options: AIGatewayInternalOnlyInboundPolicyOptions,
+  policyName: string
+): Promise<ZuploRequest | Response>;
+
+/**
+ * The options for this policy. It has none.
+ * @public
+ */
+export declare interface AIGatewayInternalOnlyInboundPolicyOptions {}
+
 /* Excluded from this release type: AIGatewayMeterIncrements */
 
 /**
@@ -884,6 +939,93 @@ export declare const AIGatewayOpenAIToAnthropicOutboundPolicy: OutboundPolicyHan
  */
 export declare interface AIGatewayOpenAIToAnthropicOutboundPolicyOptions {}
 
+/**
+ * Prompt Injection Protection Policy
+ * @title Prompt Injection Protection
+ * @product ai-gateway
+ * @requiresAI
+ *
+ * Uses a small tool-calling LLM to detect prompt injection attempts in AI
+ * Gateway requests and blocks them before they reach the upstream model. The
+ * classifier runs on any OpenAI-compatible API and is forced (via
+ * `tool_choice`) to answer through a single SAFE/UNSAFE function call, so one
+ * bounded, non-streaming completion at temperature 0 yields a deterministic
+ * verdict. Requests whose inspected messages carry no text skip the classifier
+ * entirely.
+ *
+ * This policy inspects the request only, so it adds no time-to-first-token
+ * cost on responses and works with streaming untouched.
+ *
+ * By default only the newest message of the conversation is inspected
+ * (`recentMessageCount: 1`): earlier turns were screened when they were the
+ * newest, so a chat session pays for one classification per turn rather than
+ * for its whole transcript on every turn. System and developer messages,
+ * Anthropic's top-level `system` and the Responses `instructions` field are
+ * never inspected — they are the application's own instructions, not where an
+ * injection arrives — while tool results are, because retrieved documents and
+ * tool output are the main indirect-injection vector. `classifierPrompt`
+ * replaces the built-in system prompt; the inspected text always travels as a
+ * separate user message and the verdict always comes back through the fixed
+ * SAFE/UNSAFE tool call, so a custom prompt changes what is flagged, never how
+ * the verdict is read.
+ *
+ * With `appId`, the classifier runs on another AI Gateway app instead of an
+ * external API. The gateway invokes that app in-process through
+ * `context.invokeRoute`, so there is no outbound HTTP hop and the
+ * classification inherits that app's provider credentials, model routing,
+ * fallbacks and quotas. The target app must not run this policy itself: being
+ * asked to classify a classification request is rejected as a configuration
+ * error rather than silently skipped, so a guardrail never looks configured
+ * while inspecting nothing.
+ *
+ * With `execution: "parallel"`, the classifier is registered as a pre-request
+ * handler and runs concurrently with the remaining inbound policies instead of
+ * blocking the chain. The runtime enforces the verdict before the request is
+ * dispatched upstream, so a prompt is never forwarded unchecked; what changes
+ * is that a safe prompt no longer pays for the classifier serially. A verdict
+ * that stops mattering (another response is already being served) aborts the
+ * in-flight classifier call and is neither logged as a failure nor counted.
+ * Omitting `execution` means `"sequential"`, while the generated example sets
+ * `"parallel"` — an existing configuration never changes behaviour under it.
+ *
+ * Options are validated at request time and invalid options fail closed with a
+ * ConfigurationError.
+ * Classifier-call failures (invalid credentials, rate limits, timeouts,
+ * outages) also fail closed by default, returning a 502 in the route's native
+ * error format; set `onError: "allow"` to fail open and prioritize
+ * availability over inspection.
+ *
+ * @param request - The ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns A Request or a Response
+ */
+export declare function AIGatewayPromptInjectionPolicy(
+  request: ZuploRequest,
+  context: ZuploContext,
+  unparsedOptions: unknown,
+  policyName: string
+): Promise<ZuploRequest | Response>;
+
+/**
+ * The options for the Prompt Injection Protection policy.
+ * @public
+ */
+export declare interface AIGatewayPromptInjectionPolicyOptions {
+  apiKey: APIKey;
+  appId?: ClassifierAppID;
+  execution?: Execution;
+  recentMessageCount?: RecentMessageCount;
+  model?: ClassifierModel;
+  classifierPrompt?: ClassifierPrompt;
+  baseUrl?: BaseURL;
+  timeoutMs?: ClassifierTimeoutMs;
+  endpoints?: ApplicableEndpoints_2;
+  onUnknownShape?: OnUnknownShape_2;
+  onError?: OnClassifierError;
+}
+
 /**
  * Public metadata for an AI Gateway provider name and its models.
  *
@@ -1069,10 +1211,10 @@ export declare interface AIGatewaySemanticCacheV2InboundPolicyOptions {
   semanticTolerance?: SemanticTolerance;
   expirationSecondsTtl?: CacheTTLSeconds;
   namespace?: CacheNamespace;
-  recentMessageCount?: RecentMessageCount;
+  recentMessageCount?: RecentMessageCount_2;
   maxConversationLength?: MaxConversationLength;
-  endpoints?: ApplicableEndpoints_2;
-  onUnknownShape?: OnUnknownShape_2;
+  endpoints?: ApplicableEndpoints_3;
+  onUnknownShape?: OnUnknownShape_3;
 }
 
 /**
@@ -1135,15 +1277,15 @@ export declare function AIGatewaySmartRouterInboundPolicy(
  * @public
  */
 export declare interface AIGatewaySmartRouterInboundPolicyOptions {
-  classifierAppID: ClassifierAppID;
+  classifierAppID: ClassifierAppID_2;
   classifierAppApiKey: ClassifierAppAPIKey;
-  classifierModel: ClassifierModel;
+  classifierModel: ClassifierModel_2;
   smartRoutingEnabled?: SmartRoutingEnabled;
   modelsByComplexity: ModelsByComplexity;
   intents?: Intents;
-  classifierPrompt?: ClassifierPrompt;
+  classifierPrompt?: ClassifierPrompt_2;
   minConfidenceForRouting?: MinimumConfidenceForRouting;
-  classifierTimeoutMs?: ClassifierTimeoutMs;
+  classifierTimeoutMs?: ClassifierTimeoutMs_2;
   maxPromptChars?: MaxPromptCharacters;
 }
 
@@ -1407,7 +1549,7 @@ export declare function AkamaiAIFirewallInboundPolicy(
  */
 export declare interface AkamaiAIFirewallPolicyOptions {
   configurationId: ConfigurationID;
-  "api-key": APIKey;
+  "api-key": APIKey_2;
   applicationId?: ApplicationID;
   streamingAccumulation?: StreamingAccumulationSettings;
   onError?: OnFirewallError;
@@ -1452,11 +1594,11 @@ export declare function AkamaiAIFirewallV2InboundPolicy(
  */
 export declare interface AkamaiAIFirewallV2PolicyOptions {
   configurationId: ConfigurationID_2;
-  "api-key": APIKey_2;
+  "api-key": APIKey_3;
   applicationId?: ApplicationID_2;
   streamingAccumulation?: StreamingAccumulationSettings_2;
-  endpoints?: ApplicableEndpoints_3;
-  onUnknownShape?: OnUnknownShape_3;
+  endpoints?: ApplicableEndpoints_4;
+  onUnknownShape?: OnUnknownShape_4;
   onError?: OnFirewallError_2;
 }
 
@@ -1839,7 +1981,7 @@ export declare interface ApiAuthKeyInboundPolicyOptions {
 }
 
 /**
- * The API key for the AI Firewall.
+ * Credential used to run the classifier. Without `appId` this is the API key for the OpenAI-compatible service at `baseUrl`. With `appId` it is an API key accepted by that AI Gateway app, sent as `Authorization: Bearer` on the in-process invocation.
  * @public
  */
 declare type APIKey = string;
@@ -1850,6 +1992,12 @@ declare type APIKey = string;
  */
 declare type APIKey_2 = string;
 
+/**
+ * The API key for the AI Firewall.
+ * @public
+ */
+declare type APIKey_3 = string;
+
 /**
  * Represents a consumer in the API Key service.
  * @public
@@ -2087,11 +2235,22 @@ declare type ApplicableEndpoints = (
   | "anthropic-messages"
 )[];
 
+/**
+ * The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
+ *
+ * @minItems 1
+ * @public
+ */
+declare type ApplicableEndpoints_2 = [
+  "openai-chat" | "openai-responses" | "anthropic-messages",
+  ...("openai-chat" | "openai-responses" | "anthropic-messages")[],
+];
+
 /**
  * The endpoint shapes to cache. Defaults to all shapes: ['openai-chat', 'anthropic-messages', 'openai-responses'].
  * @public
  */
-declare type ApplicableEndpoints_2 = (
+declare type ApplicableEndpoints_3 = (
   | "openai-chat"
   | "openai-responses"
   | "anthropic-messages"
@@ -2101,7 +2260,7 @@ declare type ApplicableEndpoints_2 = (
  * The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
  * @public
  */
-declare type ApplicableEndpoints_3 = (
+declare type ApplicableEndpoints_4 = (
   | "openai-chat"
   | "openai-responses"
   | "anthropic-messages"
@@ -2111,7 +2270,7 @@ declare type ApplicableEndpoints_3 = (
  * The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
  * @public
  */
-declare type ApplicableEndpoints_4 = (
+declare type ApplicableEndpoints_5 = (
   | "openai-chat"
   | "openai-responses"
   | "anthropic-messages"
@@ -2121,7 +2280,7 @@ declare type ApplicableEndpoints_4 = (
  * The endpoint shapes this policy applies to. Omit to apply to all (openai-chat, openai-responses, anthropic-messages).
  * @public
  */
-declare type ApplicableEndpoints_5 = (
+declare type ApplicableEndpoints_6 = (
   | "openai-chat"
   | "openai-responses"
   | "anthropic-messages"
@@ -3150,6 +3309,12 @@ declare class BaseOpenFGAAuthZInboundPolicy extends InboundPolicy<OpenFGAAuthZIn
   private getAuthorizer;
 }
 
+/**
+ * Base URL of the OpenAI-compatible API that runs the classifier model. Mutually exclusive with `appId`, which routes the classifier through an AI Gateway app instead.
+ * @public
+ */
+declare type BaseURL = string;
+
 /**
  * An account object.
  * @public
@@ -3801,29 +3966,53 @@ declare type ClaimCheck = EqualsRule | InRule | StartsWithRule;
 declare type ClassifierAppAPIKey = string;
 
 /**
- * The AI Gateway application id used to run the classifier prompt and evaluate the user's request.
+ * Run the classifier on another AI Gateway app instead of calling an external API directly. The gateway invokes that app in-process — no outbound HTTP hop — so the classifier inherits its provider credentials, model routing, fallbacks and quotas, and provider keys stay on one app. When set, `model` must name a routed model as `provider/model` and `baseUrl` must not be set. The target app must not itself run this policy: it would be asked to classify its own classification request, which is rejected as a configuration error rather than silently skipped. Omit to call `baseUrl` directly.
  * @public
  */
 declare type ClassifierAppID = string;
 
 /**
- * The model (`providerName/model`) the classifier uses to evaluate the user's request. E.g. `openai/gpt-4o-mini`.
+ * The AI Gateway application id used to run the classifier prompt and evaluate the user's request.
+ * @public
+ */
+declare type ClassifierAppID_2 = string;
+
+/**
+ * Tool-calling capable model used to classify prompts. Prefer a small, fast model; the classification runs before every inspected request reaches the upstream model. With `appId` set this must name a model the classifier app routes, written as `provider/model` (for example `openai/gpt-4o-mini`), and has no default.
  * @public
  */
 declare type ClassifierModel = string;
 
 /**
- * Prompt used to analyze and classify the user message. Omit to use the built-in classifier prompt.
+ * The model (`providerName/model`) the classifier uses to evaluate the user's request. E.g. `openai/gpt-4o-mini`.
+ * @public
+ */
+declare type ClassifierModel_2 = string;
+
+/**
+ * Replaces the built-in system prompt that tells the classifier what counts as a prompt injection. A string, or an array of lines joined with newlines. The inspected text is always sent as a separate user message and the verdict always comes back through the fixed SAFE/UNSAFE tool call, so a custom prompt changes what is flagged, never how the verdict is read. Omit to use the built-in prompt, which the policy documentation shows in full.
  * @public
  */
 declare type ClassifierPrompt = string | [string, ...string[]];
 
 /**
- * Timeout configured for the classifier task. When exceeded, the request is forwarded without classification to the original model.
+ * Prompt used to analyze and classify the user message. Omit to use the built-in classifier prompt.
+ * @public
+ */
+declare type ClassifierPrompt_2 = string | [string, ...string[]];
+
+/**
+ * Maximum time in milliseconds to wait for the classifier before applying the onError action.
  * @public
  */
 declare type ClassifierTimeoutMs = number;
 
+/**
+ * Timeout configured for the classifier task. When exceeded, the request is forwarded without classification to the original model.
+ * @public
+ */
+declare type ClassifierTimeoutMs_2 = number;
+
 /**
  * Removes all headers from the incoming request except for those in the exclude list.
  *
@@ -4092,8 +4281,8 @@ export declare interface CometOpikTracingV2PolicyOptions {
    * The base URL for the Comet Opik API (optional, defaults to https://www.comet.com/opik/api).
    */
   baseUrl?: string;
-  endpoints?: ApplicableEndpoints_4;
-  onUnknownShape?: OnUnknownShape_4;
+  endpoints?: ApplicableEndpoints_5;
+  onUnknownShape?: OnUnknownShape_5;
 }
 
 /**
@@ -5409,12 +5598,23 @@ declare const EventType: {
 
 declare type EventType = (typeof EventType)[keyof typeof EventType];
 
+/**
+ * How the classifier runs relative to the rest of the inbound policy chain. 'sequential' classifies inline, so later policies wait for the verdict; this is the behaviour when the option is omitted. 'parallel' classifies while the remaining inbound policies run — the verdict is still enforced before the request reaches the model, so no prompt is forwarded unchecked, but on a safe prompt the classifier's latency overlaps the rest of the chain instead of adding to it.
+ * @public
+ */
+declare type Execution = "sequential" | "parallel";
+
 /**
  * Best-effort flatten of ALL human/assistant text in a request OR response body,
  * across every shape — the one sanctioned cross-shape helper. Intended for
  * guardrails that just need "all the text to scan/moderate"; it is deliberately
  * lossy (drops roles, structure, tool calls). Everything else should read the
  * typed body via {@link getRequestBody} / {@link getResponseBody}.
+ *
+ * For "the most recent messages" rather than all of the text, use
+ * `conversation-window.ts` (`getConversationItems` + `selectRecentTurns`):
+ * the one definition of a message window that the semantic cache and the
+ * prompt injection guardrail share.
  * @public
  */
 export declare function extractAllText(body: unknown): string;
@@ -5678,8 +5878,8 @@ export declare interface GalileoTracingV2PolicyOptions {
    * The base URL for the Galileo API (optional, defaults to https://api.galileo.ai).
    */
   baseUrl?: string;
-  endpoints?: ApplicableEndpoints_5;
-  onUnknownShape?: OnUnknownShape_5;
+  endpoints?: ApplicableEndpoints_6;
+  onUnknownShape?: OnUnknownShape_6;
 }
 
 /**
@@ -11196,6 +11396,12 @@ export declare interface OktaJwtInboundPolicyOptions {
   oAuthResourceMetadataEnabled?: boolean;
 }
 
+/**
+ * What to do when the classifier call itself fails (invalid API key, rate limit, timeout, outage). 'block' (the default) fails closed and returns a 502 so unverified prompts are never forwarded; 'allow' fails open and lets the request through without inspection.
+ * @public
+ */
+declare type OnClassifierError = "block" | "allow";
+
 /**
  * What to do if the scanner itself throws. The engine is a local in-gateway scanner, so this is effectively unreachable outside of a runtime defect — but a guardrail must declare its failure posture. `block` (the default) fails closed with a 500 in the route's native error format; `allow` fails open and serves the content uninspected.
  * @public
@@ -11266,19 +11472,19 @@ declare interface OnSendingAwsLambdaEventHook {
 declare type OnUnknownShape = "deny" | "skip";
 
 /**
- * Unused by the cache (a cache miss is never unsafe, so it always fails open). Present for interface consistency.
+ * What to do when the request shape cannot be inspected. As a guardrail, this policy defaults to 'deny' (fail closed) so uninspectable content is never forwarded.
  * @public
  */
 declare type OnUnknownShape_2 = "deny" | "skip";
 
 /**
- * What to do when the request shape cannot be inspected. As a guardrail, this policy defaults to 'deny' (fail closed) so uninspectable content is never served.
+ * Unused by the cache (a cache miss is never unsafe, so it always fails open). Present for interface consistency.
  * @public
  */
 declare type OnUnknownShape_3 = "deny" | "skip";
 
 /**
- * What to do on a shape the policy cannot read. As an observer this defaults to 'skip' (fail open — pass through untraced).
+ * What to do when the request shape cannot be inspected. As a guardrail, this policy defaults to 'deny' (fail closed) so uninspectable content is never served.
  * @public
  */
 declare type OnUnknownShape_4 = "deny" | "skip";
@@ -11289,6 +11495,12 @@ declare type OnUnknownShape_4 = "deny" | "skip";
  */
 declare type OnUnknownShape_5 = "deny" | "skip";
 
+/**
+ * What to do on a shape the policy cannot read. As an observer this defaults to 'skip' (fail open — pass through untraced).
+ * @public
+ */
+declare type OnUnknownShape_6 = "deny" | "skip";
+
 /**
  * Handler that serves OpenAPI specification files.
  * Use this to expose your API documentation in a standard format that can be
@@ -13018,11 +13230,17 @@ export declare function ReadmeMetricsInboundPolicy(
 ): Promise<ZuploRequest<RequestGeneric>>;
 
 /**
- * How many of the conversation's most recent messages (input items on the Responses endpoint) form the cache key, both when storing a response and when matching later requests. Earlier messages are ignored, so a multi-turn conversation can hit an entry cached from a shorter one; system messages are always included. Requests whose keyed window contains no user message (for example a conversation ending in an assistant prefill) are not cached. Defaults to 1 (match on the newest message only).
+ * How many of the conversation's most recent messages the classifier inspects (input items on the Responses endpoint). Earlier messages are not re-inspected: each was screened when it was the newest, so a chat session pays for one classification per turn instead of one per transcript. System and developer messages, Anthropic's top-level `system` and the Responses `instructions` field never count and are never inspected — they are your application's own instructions, not where an injection arrives. Tool results count as messages and are inspected. Raise this when clients send conversation history that was assembled outside the gateway. Defaults to 1 (the newest message only).
  * @public
  */
 declare type RecentMessageCount = number;
 
+/**
+ * How many of the conversation's most recent messages (input items on the Responses endpoint) form the cache key, both when storing a response and when matching later requests. Earlier messages are ignored, so a multi-turn conversation can hit an entry cached from a shorter one; system messages are always included. Requests whose keyed window contains no user message (for example a conversation ending in an assistant prefill) are not cached. Defaults to 1 (match on the newest message only).
+ * @public
+ */
+declare type RecentMessageCount_2 = number;
+
 /**
  * Record the GraphQL response-cache outcome for the in-flight operation so
  * the analytics middleware can emit it as the `cacheState` dimension on the

package/out/types/mcp-gateway/index.d.ts

@@ -2963,9 +2963,13 @@ export declare interface McpTokenExchangeInboundPolicyOptions {
    */
   prompt?: ("none" | "login" | "consent" | "select_account") | false;
   /**
-   * Skips the RFC 8414 section 3.3 issuer-echo check when discovering the upstream authorization server. That check requires the `issuer` in the authorization server's metadata to equal the `authorization_servers` entry the protected-resource metadata advertised. Some providers publish a path-scoped authorization server whose metadata reports the root origin instead — for example ServiceNow advertises `https://<instance>.service-now.com/sncapps/...` but its metadata reports `https://<instance>.service-now.com` — so discovery hard-fails without this option. Warning: enabling this puts the connection out of spec. The check is an unqualified MUST in both RFC 8414 section 3.3 and the MCP authorization spec, which require rejecting a metadata document whose `issuer` differs from the identifier the well-known URL was built from; the spec's own example is a document served from `https://attacker.example/.well-known/oauth-authorization-server` claiming `"issuer": "https://honest.example"`. The echo check binds the metadata to the TLS-authenticated host it came from, and with it off the gateway trusts the authorization, token and JWKS endpoints from a document that never proved it speaks for that issuer. Only enable it for a specific upstream known to publish a mismatched issuer, and only when the metadata URL's host is itself trusted. It relaxes the discovery-time check only — the RFC 9207 authorization-response check and the callback-leg authorization-server binding still apply.
+   * Allows the authorization server metadata's `issuer` to differ from the server URL used for discovery. Defaults to `false`. Enable only for a confirmed provider metadata mismatch after verifying that its metadata and OAuth endpoints are trusted. This disables the RFC 8414 section 3.3 issuer check; authorization-response and callback checks still apply. Available only with `user-oauth` and `shared-oauth`.
    */
   skipIssuerMetadataValidation?: boolean;
+  /**
+   * Allows the upstream metadata's `resource` URL to have a different origin or path from the configured upstream URL. Defaults to `false`. The gateway still sends the advertised `resource` on OAuth requests. Enable only for a confirmed provider metadata mismatch: a token intended for another service could otherwise be sent to this upstream. Available only with `user-oauth` and `shared-oauth`.
+   */
+  skipResourceIndicatorValidation?: boolean;
   /**
    * OAuth client registration mode. Defaults to `auto`, which uses Client ID Metadata Documents when the upstream advertises support and falls back to Dynamic Client Registration otherwise.
    */
@@ -4331,6 +4335,7 @@ declare interface UpstreamOAuthConfig {
   scopeDelimiter: string;
   prompt?: UpstreamOAuthPromptOverride;
   skipIssuerMetadataValidation?: boolean;
+  skipResourceIndicatorValidation?: boolean;
   clientRegistration: UpstreamOAuthClientRegistrationConfig;
   redirectPath: string;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.7.17",
+  "version": "7.8.1",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {