zuplo 6.72.13 → 6.72.14

package/docs/policies/ai-gateway-model-routing-v2-inbound/schema.json

@@ -0,0 +1,263 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema",
+  "$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-model-routing-v2-inbound.json",
+  "type": "object",
+  "title": "AI Gateway Model Routing (v2)",
+  "isDeprecated": false,
+  "isPaidAddOn": false,
+  "isEnterprise": false,
+  "isInternal": false,
+  "isBeta": true,
+  "isHidden": false,
+  "requiresAI": true,
+  "products": ["ai-gateway"],
+  "description": "Matches AI Gateway requests against curated allow lists or open block lists, then stores the winning `AIGatewayRouteTarget` for the route handler.",
+  "deprecatedMessage": "",
+  "required": ["handler"],
+  "properties": {
+    "handler": {
+      "type": "object",
+      "default": {},
+      "required": ["export", "module", "options"],
+      "properties": {
+        "export": {
+          "const": "AIGatewayModelRoutingV2InboundPolicy",
+          "description": "The name of the exported type"
+        },
+        "module": {
+          "const": "$import(@zuplo/runtime)",
+          "description": "The module containing the policy"
+        },
+        "options": {
+          "type": "object",
+          "title": "AIGatewayModelRoutingV2InboundPolicyOptions",
+          "description": "Options for allowing or blocking provider/model routes for each AI Gateway capability.",
+          "additionalProperties": false,
+          "required": ["models"],
+          "properties": {
+            "models": {
+              "type": "object",
+              "title": "Models",
+              "description": "Declarative model-routing rules, grouped by AI Gateway capability.",
+              "additionalProperties": false,
+              "minProperties": 1,
+              "properties": {
+                "completions": {
+                  "title": "Completions Models",
+                  "description": "Rules for chat completions, Responses, and Anthropic Messages requests.",
+                  "allOf": [
+                    {
+                      "title": "Capability Model Rules",
+                      "description": "Choose curated allow-list mode or open-but-filtered block-list mode.",
+                      "oneOf": [
+                        {
+                          "type": "object",
+                          "title": "Curated Model Rules",
+                          "description": "Allow only listed targets and use entry zero as the default.",
+                          "additionalProperties": false,
+                          "required": ["allowList"],
+                          "not": {
+                            "required": ["blockList"]
+                          },
+                          "properties": {
+                            "allowList": {
+                              "type": "array",
+                              "title": "Allowed Models",
+                              "description": "Curated targets clients may select; the first entry is the default when model is omitted.",
+                              "minItems": 1,
+                              "items": {
+                                "title": "Route Target",
+                                "description": "A provider/model string shorthand or a full model route target.",
+                                "oneOf": [
+                                  {
+                                    "type": "string",
+                                    "title": "Provider and Model",
+                                    "description": "A model reference in provider/model form, split on the first slash.",
+                                    "pattern": "^[^/\\s]+/.+$"
+                                  },
+                                  {
+                                    "type": "object",
+                                    "title": "Model Route Target",
+                                    "description": "A primary model and optional failure or quota fallbacks.",
+                                    "additionalProperties": false,
+                                    "required": ["main"],
+                                    "properties": {
+                                      "main": {
+                                        "type": "string",
+                                        "title": "Provider and Model",
+                                        "description": "A model reference in provider/model form, split on the first slash.",
+                                        "pattern": "^[^/\\s]+/.+$"
+                                      },
+                                      "backup": {
+                                        "type": "string",
+                                        "title": "Provider and Model",
+                                        "description": "A model reference in provider/model form, split on the first slash.",
+                                        "pattern": "^[^/\\s]+/.+$"
+                                      },
+                                      "fallbackTimeoutSeconds": {
+                                        "type": "number",
+                                        "title": "Fallback Timeout Seconds",
+                                        "description": "How long the main model may take before the backup is attempted.",
+                                        "minimum": 1,
+                                        "maximum": 300,
+                                        "default": 60
+                                      },
+                                      "quotaFallback": {
+                                        "type": "string",
+                                        "title": "Provider and Model",
+                                        "description": "A model reference in provider/model form, split on the first slash.",
+                                        "pattern": "^[^/\\s]+/.+$"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "title": "Open-but-Filtered Model Rules",
+                          "description": "Allow any requested target except those explicitly blocked.",
+                          "additionalProperties": false,
+                          "required": ["blockList"],
+                          "not": {
+                            "required": ["allowList"]
+                          },
+                          "properties": {
+                            "blockList": {
+                              "type": "array",
+                              "title": "Blocked Models",
+                              "description": "Configured provider/model targets rejected in open-but-filtered mode; requests may use a bare model name or provider/model.",
+                              "minItems": 1,
+                              "items": {
+                                "type": "string",
+                                "title": "Provider and Model",
+                                "description": "A model reference in provider/model form, split on the first slash.",
+                                "pattern": "^[^/\\s]+/.+$"
+                              }
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  ]
+                },
+                "embeddings": {
+                  "title": "Embeddings Models",
+                  "description": "Rules for embedding requests.",
+                  "allOf": [
+                    {
+                      "title": "Capability Model Rules",
+                      "description": "Choose curated allow-list mode or open-but-filtered block-list mode.",
+                      "oneOf": [
+                        {
+                          "type": "object",
+                          "title": "Curated Model Rules",
+                          "description": "Allow only listed targets and use entry zero as the default.",
+                          "additionalProperties": false,
+                          "required": ["allowList"],
+                          "not": {
+                            "required": ["blockList"]
+                          },
+                          "properties": {
+                            "allowList": {
+                              "type": "array",
+                              "title": "Allowed Models",
+                              "description": "Curated targets clients may select; the first entry is the default when model is omitted.",
+                              "minItems": 1,
+                              "items": {
+                                "title": "Route Target",
+                                "description": "A provider/model string shorthand or a full model route target.",
+                                "oneOf": [
+                                  {
+                                    "type": "string",
+                                    "title": "Provider and Model",
+                                    "description": "A model reference in provider/model form, split on the first slash.",
+                                    "pattern": "^[^/\\s]+/.+$"
+                                  },
+                                  {
+                                    "type": "object",
+                                    "title": "Model Route Target",
+                                    "description": "A primary model and optional failure or quota fallbacks.",
+                                    "additionalProperties": false,
+                                    "required": ["main"],
+                                    "properties": {
+                                      "main": {
+                                        "type": "string",
+                                        "title": "Provider and Model",
+                                        "description": "A model reference in provider/model form, split on the first slash.",
+                                        "pattern": "^[^/\\s]+/.+$"
+                                      },
+                                      "backup": {
+                                        "type": "string",
+                                        "title": "Provider and Model",
+                                        "description": "A model reference in provider/model form, split on the first slash.",
+                                        "pattern": "^[^/\\s]+/.+$"
+                                      },
+                                      "fallbackTimeoutSeconds": {
+                                        "type": "number",
+                                        "title": "Fallback Timeout Seconds",
+                                        "description": "How long the main model may take before the backup is attempted.",
+                                        "minimum": 1,
+                                        "maximum": 300,
+                                        "default": 60
+                                      },
+                                      "quotaFallback": {
+                                        "type": "string",
+                                        "title": "Provider and Model",
+                                        "description": "A model reference in provider/model form, split on the first slash.",
+                                        "pattern": "^[^/\\s]+/.+$"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "title": "Open-but-Filtered Model Rules",
+                          "description": "Allow any requested target except those explicitly blocked.",
+                          "additionalProperties": false,
+                          "required": ["blockList"],
+                          "not": {
+                            "required": ["allowList"]
+                          },
+                          "properties": {
+                            "blockList": {
+                              "type": "array",
+                              "title": "Blocked Models",
+                              "description": "Configured provider/model targets rejected in open-but-filtered mode; requests may use a bare model name or provider/model.",
+                              "minItems": 1,
+                              "items": {
+                                "type": "string",
+                                "title": "Provider and Model",
+                                "description": "A model reference in provider/model form, split on the first slash.",
+                                "pattern": "^[^/\\s]+/.+$"
+                              }
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        }
+      },
+      "examples": [
+        {
+          "export": "AIGatewayModelRoutingV2InboundPolicy",
+          "module": "$import(@zuplo/runtime)",
+          "options": {
+            "models": {}
+          }
+        }
+      ]
+    }
+  }
+}

package/docs/policies/graphql-cache-inbound/doc.md

@@ -1,5 +1,5 @@
 The GraphQL Cache policy stores successful GraphQL query responses in a
-[ZoneCache](https://zuplo.com/docs/articles/zonecache) and serves later,
+[ZoneCache](https://zuplo.com/docs/programmable-api/zone-cache) and serves later,
 identical queries directly from the edge.
 
 ### How caching works

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zuplo",
-  "version": "6.72.13",
+  "version": "6.72.14",
   "type": "module",
   "description": "The programmable API Gateway",
   "author": "Zuplo, Inc.",
@@ -19,9 +19,9 @@
     "zuplo": "zuplo.js"
   },
   "dependencies": {
-    "@zuplo/cli": "6.72.13",
-    "@zuplo/core": "6.72.13",
-    "@zuplo/runtime": "6.72.13",
+    "@zuplo/cli": "6.72.14",
+    "@zuplo/core": "6.72.14",
+    "@zuplo/runtime": "6.72.14",
     "@zuplo/test": "1.4.0"
   }
 }

package/docs/policies/ab-test-inbound/intro.md

@@ -1,8 +0,0 @@
-This example shows how to perform an action on incoming requests based on the
-result of a randomly generated number. A/B tests could also be performed on
-properties such as the `request.user`.
-
-A/B tests can also be combined with other policies by passing data to downstream
-policies. For example, you could save a value in `ContextData` based on the
-results of the A/B test and use that value in a later policy to modify the
-request.

package/docs/policies/ab-test-inbound/policy.ts

@@ -1,14 +0,0 @@
-import { ZuploContext, ZuploRequest } from "@zuplo/runtime";
-
-export default async function (request: ZuploRequest, context: ZuploContext) {
-  // Generate a random number to segment the test groups
-  const score = Math.random();
-
-  if (score < 0.5) {
-    // Do something for half the requests
-  } else {
-    // Do something else for the other half
-  }
-
-  return request;
-}

package/docs/policies/ab-test-inbound/schema.json

@@ -1,27 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/ab-test-inbound.json",
-  "type": "object",
-  "title": "A/B Test Inbound",
-  "isCustom": true,
-  "products": ["api-gateway"],
-  "description": "An A/B test policy is used to handle requests differently based on parameters such as user, ip, etc.",
-  "required": ["handler"],
-  "properties": {
-    "handler": {
-      "type": "object",
-      "default": {},
-      "required": ["export", "module"],
-      "properties": {
-        "export": {
-          "const": "default",
-          "description": "The export from the custom policy"
-        },
-        "module": {
-          "const": "$import(./modules/YOUR_MODULE)",
-          "description": "The module containing the policy"
-        }
-      }
-    }
-  }
-}

package/docs/policies/ab-test-outbound/intro.md

@@ -1,8 +0,0 @@
-This example shows how to perform an action on incoming requests based on the
-result of a randomly generated number. A/B tests could also be performed on
-properties such as the `request.user`.
-
-A/B tests can also be combined with other policies by passing data to downstream
-policies. For example, you could save a value in `ContextData` based on the
-results of the A/B test and use that value in a later policy to modify the
-request.

package/docs/policies/ab-test-outbound/policy.ts

@@ -1,26 +0,0 @@
-import { ZuploContext, ZuploRequest } from "@zuplo/runtime";
-
-export default async function (
-  response: Response,
-  request: ZuploRequest,
-  context: ZuploContext,
-) {
-  // Generate a random number to segment the test groups
-  const score = Math.random();
-
-  // Get the outgoing response body
-  const data = await response.json();
-
-  // Modify the body based on the random value
-  if (score < 0.5) {
-    data.testEnabled = true;
-  } else {
-    data.testEnabled = false;
-  }
-
-  // Stringify the data object
-  const body = JSON.stringify(data);
-
-  // Return a new response with the updated body
-  return new Response(body, response);
-}

package/docs/policies/ab-test-outbound/schema.json

@@ -1,27 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/ab-test-outbound.json",
-  "type": "object",
-  "title": "A/B Test Outbound",
-  "isCustom": true,
-  "products": ["api-gateway"],
-  "description": "An A/B test policy is used to handle responses differently based on parameters such as user, ip, etc.",
-  "required": ["handler"],
-  "properties": {
-    "handler": {
-      "type": "object",
-      "default": {},
-      "required": ["export", "module"],
-      "properties": {
-        "export": {
-          "const": "default",
-          "description": "The export from the custom policy"
-        },
-        "module": {
-          "const": "$import(./modules/YOUR_MODULE)",
-          "description": "The module containing the policy"
-        }
-      }
-    }
-  }
-}

package/docs/policies/acl-policy-inbound/intro.md

@@ -1,5 +0,0 @@
-ACL policies can be built many ways depending on your requirements. This example
-shows how to perform an authorization check on a hard-coded list of users.
-
-This policy could be extended to fetch data from external sources or even use an
-authorization service such as [OpenFGA](https://openfga.dev/).

package/docs/policies/acl-policy-inbound/policy.ts

@@ -1,32 +0,0 @@
-import { HttpProblems, ZuploContext, ZuploRequest } from "@zuplo/runtime";
-
-interface PolicyOptions {
-  users: string[];
-}
-
-export default async function (
-  request: ZuploRequest,
-  context: ZuploContext,
-  options: PolicyOptions,
-  policyName: string,
-) {
-  // Check that an authenticated user is set
-  // NOTE: This policy requires an authentication policy to run before
-  if (!request.user) {
-    context.log.error(
-      "User isn't authenticated. A authorization policy must come before the ACL policy.",
-    );
-    return HttpProblems.unauthorized(request, context);
-  }
-
-  // Check that the user has one of the allowed roles
-  if (!options.users.includes(request.user.sub)) {
-    context.log.error(
-      `The user '${request.user.sub}' isn't authorized to perform this action.`,
-    );
-    return HttpProblems.forbidden(request, context);
-  }
-
-  // If they made it here, they are authorized
-  return request;
-}

package/docs/policies/acl-policy-inbound/schema.json

@@ -1,52 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/acl-policy-inbound.json",
-  "type": "object",
-  "title": "Access Control List",
-  "isCustom": true,
-  "products": ["api-gateway"],
-  "description": "The access control list inbound policy limits access to resources based on parameters on the authenticated user.",
-  "required": ["handler"],
-  "properties": {
-    "handler": {
-      "type": "object",
-      "default": {},
-      "required": ["export", "module", "options"],
-      "properties": {
-        "export": {
-          "const": "default",
-          "description": "The name of the exported type"
-        },
-        "module": {
-          "const": "$import(./modules/YOUR_MODULE)",
-          "description": "The module containing the policy"
-        },
-        "options": {
-          "type": "object",
-          "description": "The options for this policy",
-          "required": ["users"],
-          "properties": {
-            "users": {
-              "type": "array",
-              "description": "The list of users authorized to access the resource",
-              "items": {
-                "type": "string",
-                "description": "The user's sub"
-              }
-            }
-          }
-        }
-      },
-      "examples": [
-        {
-          "_name": "basic",
-          "export": "default",
-          "module": "$import(./modules/YOUR_MODULE)",
-          "options": {
-            "users": ["google|12345", "google|23456"]
-          }
-        }
-      ]
-    }
-  }
-}

package/docs/policies/archive-request-aws-s3-inbound/intro.md

@@ -1,4 +0,0 @@
-In this example shows how you can archive the body of incoming requests to AWS
-S3 Storage. This can be useful for auditing, logging, or archival scenarios.
-Additionally, you could use this policy to save the body of a request and then
-enqueue some asynchronous work that uses this body.

package/docs/policies/archive-request-aws-s3-inbound/policy.ts

@@ -1,58 +0,0 @@
-import { PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
-import { ZuploContext, ZuploRequest } from "@zuplo/runtime";
-
-type PolicyOptions = {
-  region: string;
-  bucketName: string;
-  path: string;
-  accessKeyId: string;
-  accessKeySecret: string;
-};
-export default async function (
-  request: ZuploRequest,
-  context: ZuploContext,
-  options: PolicyOptions,
-  policyName: string,
-) {
-  // NOTE: policy options should be validated, but to keep the sample short,
-  // we are skipping that here.
-
-  // Initialize the S3 client
-  const s3Client = new S3Client({
-    region: options.region,
-    credentials: {
-      accessKeyId: options.accessKeyId,
-      secretAccessKey: options.accessKeySecret,
-    },
-  });
-
-  // Create the file
-  const file = `${options.path}/${Date.now()}-${crypto.randomUUID()}.req.txt`;
-
-  // because we will read the body, we need to
-  // create a clone of this request first, otherwise
-  // there may be two attempts to read the body
-  // causing a runtime error
-  const clone = request.clone();
-
-  // In this example we assume the body could be text, but you could also
-  // request the blob() to handle binary data types like images.
-  //
-  // This example loads the entire body into memory. This is fine for
-  // small payloads, but if you have a large payload you should instead
-  // save the body via streaming.
-  const body = await clone.text();
-
-  // Create the S3 command
-  const command = new PutObjectCommand({
-    Bucket: options.bucketName,
-    Key: file,
-    Body: body,
-  });
-
-  // Use the S3 client to save the object
-  await s3Client.send(command);
-
-  // Continue the request
-  return request;
-}

package/docs/policies/archive-request-aws-s3-inbound/schema.json

@@ -1,68 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft-07/schema",
-  "$id": "http://zuplo.com/schemas/policies/archive-request-aws-s3-inbound.json",
-  "type": "object",
-  "title": "Archive Request to AWS S3",
-  "isCustom": true,
-  "products": ["api-gateway"],
-  "description": "Archive the incoming request body to AWS S3 storage",
-  "required": ["handler"],
-  "properties": {
-    "handler": {
-      "type": "object",
-      "default": {},
-      "required": ["export", "module", "options"],
-      "properties": {
-        "export": {
-          "const": "default",
-          "description": "The name of the exported type"
-        },
-        "module": {
-          "const": "$import(./modules/YOUR_MODULE)",
-          "description": "The module containing the policy"
-        },
-        "options": {
-          "type": "object",
-          "description": "The options for this policy",
-          "required": [],
-          "properties": {
-            "region": {
-              "type": "string",
-              "description": "The AWS region where the bucket is located"
-            },
-            "bucketName": {
-              "type": "string",
-              "description": "The name of the storage bucket"
-            },
-            "path": {
-              "type": "string",
-              "description": "The path where requests are stored"
-            },
-            "accessKeyId": {
-              "type": "string",
-              "description": "The Access Key ID of the account authorized to write to the bucket"
-            },
-            "accessKeySecret": {
-              "type": "string",
-              "description": "The Access Key Secret of the account authorized to write to the bucket"
-            }
-          }
-        }
-      },
-      "examples": [
-        {
-          "_name": "basic",
-          "export": "ArchiveResponseOutbound",
-          "module": "$import(@zuplo/runtime)",
-          "options": {
-            "region": "us-east-1",
-            "bucketName": "test-bucket-123.s3.amazonaws.com",
-            "path": "responses/",
-            "accessKeyId": "$env(AWS_ACCESS_KEY_ID)",
-            "accessKeySecret": "$env(AWS_ACCESS_KEY_SECRET)"
-          }
-        }
-      ]
-    }
-  }
-}