zuplo 7.1.6 → 7.1.8

package/docs/ai-gateway/getting-started.mdx

@@ -159,10 +159,10 @@ connecting a Git repository to making your first LLM request through Zuplo.
    :::note
 
    The gateway checks the key only after you add the
-   [authentication policy](./policy-chains.mdx#authentication) to the route or
-   to the app's chain. Until then the gateway identifies the app from the
-   `{app_id}` segment of the URL and accepts the request without a key. The
-   examples below send the key so they keep working once you add the policy.
+   [authentication policy](./policy-chains.mdx#authentication) to the app's
+   chain. Until then the gateway identifies the app from the `{app_id}` segment
+   of the URL and accepts the request without a key. The examples below send the
+   key so they keep working once you add the policy.
 
    :::
 

package/docs/ai-gateway/policies/authentication.mdx

@@ -12,10 +12,9 @@ calling app from the key. A missing or invalid key returns `401`. A valid key
 whose app doesn't match the `{app_id}` in the URL returns `403`.
 
 The policy applies per app: in an app's chain, it requires a key for that app
-alone. A new team's [policy template](../policy-templates.mdx) includes it as a
-locked entry, so apps created in the team require keys from the start. Placed on
-the gateway's route instead—before the Configuration Executor, in the gateway's
-repository—one entry requires a key for every app on that route.
+alone. A new top-level team's [policy template](../policy-templates.mdx)
+includes it as a locked entry—and sub-teams inherit that template by default—so
+apps created in the team require keys from the start.
 
 ## Options
 
@@ -33,11 +32,11 @@ expires.
 
 :::caution{title="A gateway without this policy is open"}
 
-When the policy sits neither on the route nor in an app's chain, the gateway
-resolves the app from the `{app_id}` segment of the URL and serves the request
-with no key at all. Anyone who knows the URL can spend against the app's
-providers and budget. Only run an open gateway when something else, such as
-network isolation, controls who can reach it.
+When an app's chain doesn't include the policy, the gateway resolves the app
+from the `{app_id}` segment of the URL and serves the request with no key at
+all. Anyone who knows the URL can spend against the app's providers and budget.
+Only run an open gateway when something else, such as network isolation,
+controls who can reach it.
 
 :::
 

package/docs/ai-gateway/policies/overview.mdx

@@ -21,8 +21,8 @@ and secrets are inherited.
 | [Galileo tracing](./galileo-tracing.mdx)                              | Sends a trace of each request and response to Galileo                                                |
 | [Configuration Executor](../policy-chains.mdx#configuration-executor) | Loads the app's configuration and runs its chain—this is what makes app chains work                  |
 
-The Configuration Executor sits on the gateway's route rather than in an app's
-chain. API key authentication works in either spot: in an app's chain it
-protects that app alone, and on the route it covers every app. Any
+The Configuration Executor and its companion Configuration Loader sit on the
+gateway's route rather than in an app's chain. API key authentication runs in an
+app's chain and protects that app alone. Any
 [custom policy](../custom-policies.mdx) you declare joins the menu alongside
 these.

package/docs/ai-gateway/policy-chains.mdx

@@ -67,16 +67,14 @@ remove that entry.
   policy that's no longer declared.
 - An app with an empty chain runs no app-selected policies; requests go straight
   to the AI Gateway handler.
-- The chain is inbound-only. An app can't select an outbound policy, and the
-  gateway rejects a chain entry whose declaration is outbound-only. Policies
-  that need the response—Semantic Cache and the Akamai AI Firewall—register a
-  response hook from their inbound position, so one entry covers both
-  directions.
+- The chain runs on the request path. Policies that need the response—Semantic
+  Cache and the Akamai AI Firewall—register a response hook from their position
+  in the chain, so one entry covers both directions.
 - There's no allow-list of policy types. Any policy declared in `policies.json`
-  that works as an inbound policy is a valid chain entry, including a
+  is a valid chain entry, including a
   [custom code policy](./custom-policies.mdx). The only exclusions are the
-  [Configuration Executor](#configuration-executor) itself and outbound-only
-  policies.
+  [Configuration Executor](#configuration-executor) and its companion
+  Configuration Loader.
 - Chain validation is all-or-nothing: if any entry is invalid—for example, it
   references a policy that isn't declared in the gateway's `policies.json`—the
   request fails with an error identifying the entry to fix, and no entries run.
@@ -130,24 +128,26 @@ stored inbound chain, instantiating only policies already declared in
 `config/policies.json`. Every scaffolded gateway declares it and puts it on the
 AI Gateway route—that route entry is what gives an app's chain somewhere to run.
 
-Keep it on the **route**, not in an app's chain: it refuses to run itself
-recursively.
+The scaffolded route also carries a **Configuration Loader**
+(`ai-gateway-configuration-loader-v2-inbound`) ahead of the executor. The
+executor loads the app's configuration by default, so the loader changes nothing
+on its own—it's there for when you want to manipulate the loaded configuration
+programmatically before the chain runs: place your own route policy between the
+loader and the executor.
 
-Its only option is `cacheTtlSeconds`, which sets how long the gateway caches a
-loaded app configuration. The default is `10` seconds, `10` is also the minimum,
-and a lower value throws a configuration error—as does any other option key. The
-cache is skipped when the [authentication policy](#authentication) already
-loaded the configuration for the request.
+Both take a single option, `cacheTtlSeconds`, which sets how long the gateway
+caches a loaded app configuration. The default is `10` seconds, `10` is also the
+minimum, and a lower value throws a configuration error—as does any other option
+key.
 
 ## Authentication
 
 The `ai-gateway-auth-v2-inbound` policy—**API Key Authentication** in the
 portal—requires callers to present the app's API key, and it applies per app:
-add it to an app's chain to require a key for that app alone. A new team's
-[policy template](./policy-templates.mdx) includes it as a locked entry, so apps
-created in the team require keys from the start. To require keys for every app
-on a route regardless of what each app's chain selects, put the policy on the
-route in the gateway's repository, before the Configuration Executor.
+add it to an app's chain to require a key for that app alone. A new top-level
+team's [policy template](./policy-templates.mdx) includes it as a locked
+entry—and sub-teams inherit that template by default—so apps created in the team
+require keys from the start.
 
 Where the policy applies, clients send the app's API key as a bearer token and
 the gateway resolves the calling app from the key; for a missing or invalid key
@@ -160,11 +160,11 @@ working until the cache expires. Each app's key appears on its app page—see
 
 :::caution{title="A gateway without the authentication policy is open"}
 
-When the policy sits neither on the route nor in the app's chain, the gateway
-resolves the app from the `{app_id}` segment of the request URL and serves the
-request with no key of any kind. Anyone who knows the URL can spend against the
-app's providers and budget. Only run an open gateway when something else, such
-as network isolation, controls who can reach it.
+When an app's chain doesn't include the policy, the gateway resolves the app
+from the `{app_id}` segment of the request URL and serves the request with no
+key of any kind. Anyone who knows the URL can spend against the app's providers
+and budget. Only run an open gateway when something else, such as network
+isolation, controls who can reach it.
 
 :::
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zuplo",
-  "version": "7.1.6",
+  "version": "7.1.8",
   "type": "module",
   "description": "The programmable API Gateway",
   "author": "Zuplo, Inc.",
@@ -19,9 +19,9 @@
     "zuplo": "zuplo.js"
   },
   "dependencies": {
-    "@zuplo/cli": "7.1.6",
-    "@zuplo/core": "7.1.6",
-    "@zuplo/runtime": "7.1.6",
-    "@zuplo/test": "7.1.6"
+    "@zuplo/cli": "7.1.8",
+    "@zuplo/core": "7.1.8",
+    "@zuplo/runtime": "7.1.8",
+    "@zuplo/test": "7.1.8"
   }
 }