zuplo 7.8.24 → 7.9.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/docs/ai-gateway/azure-ai.mdx +6 -6
- package/docs/ai-gateway/bedrock-mantle.mdx +4 -4
- package/docs/ai-gateway/bedrock-runtime.mdx +9 -9
- package/docs/ai-gateway/cookbooks/sdk-path-shim.mdx +10 -5
- package/docs/ai-gateway/integrations/ai-sdk.mdx +2 -2
- package/docs/ai-gateway/integrations/claude-code.mdx +3 -3
- package/docs/ai-gateway/integrations/claude-desktop.mdx +2 -2
- package/docs/ai-gateway/integrations/codex.mdx +4 -4
- package/docs/ai-gateway/integrations/github-copilot.mdx +4 -4
- package/docs/ai-gateway/integrations/goose.mdx +3 -3
- package/docs/ai-gateway/integrations/langchain.mdx +3 -3
- package/docs/ai-gateway/integrations/openai.mdx +3 -3
- package/docs/ai-gateway/policy-chains.mdx +9 -5
- package/docs/ai-gateway/universal-api.mdx +3 -3
- package/docs/ai-gateway/usage-limits.mdx +1 -1
- package/docs/ai-gateway/vertex-ai.mdx +1 -1
- package/docs/dedicated/akamai/ai-powered-applications.mdx +3 -3
- package/docs/policies/_index.md +11 -10
- package/docs/policies/{akamai-ai-firewall-v2-inbound → ai-gateway-akamai-firewall-inbound}/doc.md +3 -3
- package/docs/policies/{akamai-ai-firewall-v2-inbound → ai-gateway-akamai-firewall-inbound}/schema.json +5 -6
- package/docs/policies/{ai-gateway-auth-v2-inbound → ai-gateway-auth-inbound}/doc.md +10 -10
- package/docs/policies/{ai-gateway-auth-v2-inbound → ai-gateway-auth-inbound}/schema.json +5 -6
- package/docs/policies/{ai-gateway-configuration-executor-v2-inbound → ai-gateway-configuration-executor-inbound}/doc.md +40 -40
- package/docs/policies/{ai-gateway-configuration-executor-v2-inbound → ai-gateway-configuration-executor-inbound}/intro.md +2 -2
- package/docs/policies/{ai-gateway-configuration-executor-v2-inbound → ai-gateway-configuration-executor-inbound}/schema.json +7 -8
- package/docs/policies/{ai-gateway-configuration-loader-v2-inbound → ai-gateway-configuration-loader-inbound}/doc.md +17 -17
- package/docs/policies/ai-gateway-configuration-loader-inbound/intro.md +6 -0
- package/docs/policies/{ai-gateway-configuration-loader-v2-inbound → ai-gateway-configuration-loader-inbound}/schema.json +7 -8
- package/docs/policies/ai-gateway-dlp-inbound/schema.json +0 -1
- package/docs/policies/{ai-gateway-fallback-model-v2-inbound → ai-gateway-fallback-model-inbound}/doc.md +3 -3
- package/docs/policies/{ai-gateway-fallback-model-v2-inbound → ai-gateway-fallback-model-inbound}/schema.json +5 -6
- package/docs/policies/{galileo-tracing-v2-inbound → ai-gateway-galileo-tracing-inbound}/doc.md +3 -3
- package/docs/policies/{galileo-tracing-v2-inbound → ai-gateway-galileo-tracing-inbound}/schema.json +5 -6
- package/docs/policies/ai-gateway-internal-only-inbound/doc.md +3 -3
- package/docs/policies/ai-gateway-internal-only-inbound/schema.json +0 -1
- package/docs/policies/{ai-gateway-metering-v2-inbound → ai-gateway-metering-inbound}/doc.md +1 -1
- package/docs/policies/{ai-gateway-metering-v2-inbound → ai-gateway-metering-inbound}/schema.json +5 -6
- package/docs/policies/{ai-gateway-model-filtering-v2-inbound → ai-gateway-model-filtering-inbound}/doc.md +7 -5
- package/docs/policies/{ai-gateway-model-filtering-v2-inbound → ai-gateway-model-filtering-inbound}/schema.json +5 -6
- package/docs/policies/ai-gateway-model-override-inbound/doc.md +154 -0
- package/docs/policies/ai-gateway-model-override-inbound/intro.md +5 -0
- package/docs/policies/ai-gateway-model-override-inbound/schema.json +126 -0
- package/docs/policies/{comet-opik-tracing-v2-inbound → ai-gateway-opik-tracing-inbound}/doc.md +3 -3
- package/docs/policies/{comet-opik-tracing-v2-inbound → ai-gateway-opik-tracing-inbound}/schema.json +5 -6
- package/docs/policies/{ai-gateway-semantic-cache-v2-inbound → ai-gateway-semantic-cache-inbound}/schema.json +4 -5
- package/docs/policies/ai-gateway-smart-router-inbound/doc.md +2 -2
- package/docs/policies/ai-gateway-smart-router-inbound/schema.json +0 -1
- package/package.json +5 -5
- package/docs/policies/ai-gateway-configuration-loader-v2-inbound/intro.md +0 -6
- /package/docs/policies/{akamai-ai-firewall-v2-inbound → ai-gateway-akamai-firewall-inbound}/intro.md +0 -0
- /package/docs/policies/{ai-gateway-auth-v2-inbound → ai-gateway-auth-inbound}/intro.md +0 -0
- /package/docs/policies/{ai-gateway-fallback-model-v2-inbound → ai-gateway-fallback-model-inbound}/intro.md +0 -0
- /package/docs/policies/{galileo-tracing-v2-inbound → ai-gateway-galileo-tracing-inbound}/intro.md +0 -0
- /package/docs/policies/{ai-gateway-metering-v2-inbound → ai-gateway-metering-inbound}/intro.md +0 -0
- /package/docs/policies/{ai-gateway-model-filtering-v2-inbound → ai-gateway-model-filtering-inbound}/intro.md +0 -0
- /package/docs/policies/{comet-opik-tracing-v2-inbound → ai-gateway-opik-tracing-inbound}/intro.md +0 -0
- /package/docs/policies/{ai-gateway-semantic-cache-v2-inbound → ai-gateway-semantic-cache-inbound}/doc.md +0 -0
- /package/docs/policies/{ai-gateway-semantic-cache-v2-inbound → ai-gateway-semantic-cache-inbound}/intro.md +0 -0
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
The AI Gateway Configuration Executor loads each application's configuration
|
|
2
|
-
(when auth or `ai-gateway-configuration-loader-
|
|
2
|
+
(when auth or `ai-gateway-configuration-loader-inbound` has not already) and
|
|
3
3
|
runs its ordered inbound policy chain. Configuration comes from route-level
|
|
4
|
-
`ai-gateway-auth-
|
|
5
|
-
|
|
4
|
+
`ai-gateway-auth-inbound` or the configuration loader when either already ran,
|
|
5
|
+
otherwise from the route's `app_id` path parameter via Gateway Service.
|
|
6
6
|
Applications can still require API keys later by including
|
|
7
|
-
`ai-gateway-auth-
|
|
7
|
+
`ai-gateway-auth-inbound` in their own `inboundPolicyChain`.
|
|
8
8
|
|
|
9
9
|
Prefer placing the dedicated configuration loader before this executor on the
|
|
10
10
|
route. When the loader is omitted, this executor still loads configuration
|
|
@@ -74,10 +74,10 @@ chooses the policies it needs in its `inboundPolicyChain`:
|
|
|
74
74
|
{
|
|
75
75
|
"policies": [
|
|
76
76
|
{
|
|
77
|
-
"name": "ai-gateway-auth-
|
|
78
|
-
"policyType": "ai-gateway-auth
|
|
77
|
+
"name": "ai-gateway-auth-inbound",
|
|
78
|
+
"policyType": "ai-gateway-auth",
|
|
79
79
|
"handler": {
|
|
80
|
-
"export": "
|
|
80
|
+
"export": "AIGatewayAuthInboundPolicy",
|
|
81
81
|
"module": "$import(@zuplo/runtime)",
|
|
82
82
|
"options": {
|
|
83
83
|
"cacheTtlSeconds": 60
|
|
@@ -85,10 +85,10 @@ chooses the policies it needs in its `inboundPolicyChain`:
|
|
|
85
85
|
}
|
|
86
86
|
},
|
|
87
87
|
{
|
|
88
|
-
"name": "ai-gateway-configuration-loader-
|
|
89
|
-
"policyType": "ai-gateway-configuration-loader
|
|
88
|
+
"name": "ai-gateway-configuration-loader-inbound",
|
|
89
|
+
"policyType": "ai-gateway-configuration-loader",
|
|
90
90
|
"handler": {
|
|
91
|
-
"export": "
|
|
91
|
+
"export": "AIGatewayConfigurationLoaderInboundPolicy",
|
|
92
92
|
"module": "$import(@zuplo/runtime)",
|
|
93
93
|
"options": {
|
|
94
94
|
"cacheTtlSeconds": 60
|
|
@@ -96,10 +96,10 @@ chooses the policies it needs in its `inboundPolicyChain`:
|
|
|
96
96
|
}
|
|
97
97
|
},
|
|
98
98
|
{
|
|
99
|
-
"name": "ai-gateway-configuration-executor-
|
|
100
|
-
"policyType": "ai-gateway-configuration-executor
|
|
99
|
+
"name": "ai-gateway-configuration-executor-inbound",
|
|
100
|
+
"policyType": "ai-gateway-configuration-executor",
|
|
101
101
|
"handler": {
|
|
102
|
-
"export": "
|
|
102
|
+
"export": "AIGatewayConfigurationExecutorInboundPolicy",
|
|
103
103
|
"module": "$import(@zuplo/runtime)",
|
|
104
104
|
"options": {
|
|
105
105
|
"cacheTtlSeconds": 60
|
|
@@ -107,19 +107,19 @@ chooses the policies it needs in its `inboundPolicyChain`:
|
|
|
107
107
|
}
|
|
108
108
|
},
|
|
109
109
|
{
|
|
110
|
-
"name": "ai-gateway-metering-
|
|
111
|
-
"policyType": "ai-gateway-metering
|
|
110
|
+
"name": "ai-gateway-metering-inbound",
|
|
111
|
+
"policyType": "ai-gateway-metering",
|
|
112
112
|
"handler": {
|
|
113
|
-
"export": "
|
|
113
|
+
"export": "AIGatewayMeteringInboundPolicy",
|
|
114
114
|
"module": "$import(@zuplo/runtime)",
|
|
115
115
|
"options": {}
|
|
116
116
|
}
|
|
117
117
|
},
|
|
118
118
|
{
|
|
119
|
-
"name": "ai-gateway-model-filtering-
|
|
120
|
-
"policyType": "ai-gateway-model-filtering
|
|
119
|
+
"name": "ai-gateway-model-filtering-inbound",
|
|
120
|
+
"policyType": "ai-gateway-model-filtering",
|
|
121
121
|
"handler": {
|
|
122
|
-
"export": "
|
|
122
|
+
"export": "AIGatewayModelFilteringInboundPolicy",
|
|
123
123
|
"module": "$import(@zuplo/runtime)",
|
|
124
124
|
"options": {
|
|
125
125
|
"models": {
|
|
@@ -131,10 +131,10 @@ chooses the policies it needs in its `inboundPolicyChain`:
|
|
|
131
131
|
}
|
|
132
132
|
},
|
|
133
133
|
{
|
|
134
|
-
"name": "ai-gateway-fallback-model-
|
|
135
|
-
"policyType": "ai-gateway-fallback-model
|
|
134
|
+
"name": "ai-gateway-fallback-model-inbound",
|
|
135
|
+
"policyType": "ai-gateway-fallback-model",
|
|
136
136
|
"handler": {
|
|
137
|
-
"export": "
|
|
137
|
+
"export": "AIGatewayFallbackModelInboundPolicy",
|
|
138
138
|
"module": "$import(@zuplo/runtime)",
|
|
139
139
|
"options": {
|
|
140
140
|
"models": {
|
|
@@ -147,10 +147,10 @@ chooses the policies it needs in its `inboundPolicyChain`:
|
|
|
147
147
|
}
|
|
148
148
|
},
|
|
149
149
|
{
|
|
150
|
-
"name": "ai-gateway-semantic-cache-
|
|
151
|
-
"policyType": "ai-gateway-semantic-cache
|
|
150
|
+
"name": "ai-gateway-semantic-cache-inbound",
|
|
151
|
+
"policyType": "ai-gateway-semantic-cache",
|
|
152
152
|
"handler": {
|
|
153
|
-
"export": "
|
|
153
|
+
"export": "AIGatewaySemanticCacheInboundPolicy",
|
|
154
154
|
"module": "$import(@zuplo/runtime)",
|
|
155
155
|
"options": {
|
|
156
156
|
"semanticTolerance": 0.4,
|
|
@@ -186,8 +186,8 @@ chain:
|
|
|
186
186
|
},
|
|
187
187
|
"policies": {
|
|
188
188
|
"inbound": [
|
|
189
|
-
"ai-gateway-configuration-loader-
|
|
190
|
-
"ai-gateway-configuration-executor-
|
|
189
|
+
"ai-gateway-configuration-loader-inbound",
|
|
190
|
+
"ai-gateway-configuration-executor-inbound"
|
|
191
191
|
]
|
|
192
192
|
}
|
|
193
193
|
}
|
|
@@ -198,9 +198,9 @@ If you omit the loader, the executor loads the application configuration.
|
|
|
198
198
|
|
|
199
199
|
Authentication is optional and placement controls its scope:
|
|
200
200
|
|
|
201
|
-
- **App-level** — add `ai-gateway-auth-
|
|
201
|
+
- **App-level** — add `ai-gateway-auth-inbound` to an application's
|
|
202
202
|
`inboundPolicyChain`. Only that application requires an API key.
|
|
203
|
-
- **Route-level** — add `ai-gateway-auth-
|
|
203
|
+
- **Route-level** — add `ai-gateway-auth-inbound` on the route **before** the
|
|
204
204
|
loader (or before the executor on executor-only routes). That requires an API
|
|
205
205
|
key for every application on the route.
|
|
206
206
|
- **Internal applications** — for an application that is only called from inside
|
|
@@ -215,22 +215,22 @@ application-selected chains.
|
|
|
215
215
|
### 3. Set an application's policy chain
|
|
216
216
|
|
|
217
217
|
An application can inherit the options from `policies.json`. Include
|
|
218
|
-
`ai-gateway-auth-
|
|
218
|
+
`ai-gateway-auth-inbound` when this application should require an API key:
|
|
219
219
|
|
|
220
220
|
```json
|
|
221
221
|
{
|
|
222
222
|
"inboundPolicyChain": [
|
|
223
223
|
{
|
|
224
|
-
"name": "ai-gateway-auth-
|
|
224
|
+
"name": "ai-gateway-auth-inbound"
|
|
225
225
|
},
|
|
226
226
|
{
|
|
227
|
-
"name": "ai-gateway-model-filtering-
|
|
227
|
+
"name": "ai-gateway-model-filtering-inbound"
|
|
228
228
|
},
|
|
229
229
|
{
|
|
230
|
-
"name": "ai-gateway-fallback-model-
|
|
230
|
+
"name": "ai-gateway-fallback-model-inbound"
|
|
231
231
|
},
|
|
232
232
|
{
|
|
233
|
-
"name": "ai-gateway-metering-
|
|
233
|
+
"name": "ai-gateway-metering-inbound",
|
|
234
234
|
"options": {
|
|
235
235
|
"budgetRules": [
|
|
236
236
|
{
|
|
@@ -248,7 +248,7 @@ An application can inherit the options from `policies.json`. Include
|
|
|
248
248
|
}
|
|
249
249
|
},
|
|
250
250
|
{
|
|
251
|
-
"name": "ai-gateway-semantic-cache-
|
|
251
|
+
"name": "ai-gateway-semantic-cache-inbound"
|
|
252
252
|
}
|
|
253
253
|
]
|
|
254
254
|
}
|
|
@@ -265,7 +265,7 @@ An application can also provide a complete options object for an entry:
|
|
|
265
265
|
{
|
|
266
266
|
"inboundPolicyChain": [
|
|
267
267
|
{
|
|
268
|
-
"name": "ai-gateway-model-filtering-
|
|
268
|
+
"name": "ai-gateway-model-filtering-inbound",
|
|
269
269
|
"options": {
|
|
270
270
|
"models": {
|
|
271
271
|
"completions": {
|
|
@@ -290,7 +290,7 @@ under `permissions` fail closed:
|
|
|
290
290
|
{
|
|
291
291
|
"inboundPolicyChain": [
|
|
292
292
|
{
|
|
293
|
-
"name": "ai-gateway-model-filtering-
|
|
293
|
+
"name": "ai-gateway-model-filtering-inbound",
|
|
294
294
|
"permissions": {
|
|
295
295
|
"canEdit": true,
|
|
296
296
|
"canRemove": false
|
|
@@ -366,8 +366,8 @@ distinct value gets its own budget.
|
|
|
366
366
|
|
|
367
367
|
The expression grammar, the selectable properties, what a value must be, and
|
|
368
368
|
what happens when an expression does not resolve are documented once, on the
|
|
369
|
-
[AI Gateway Metering](/docs/policies/ai-gateway-metering-
|
|
370
|
-
|
|
369
|
+
[AI Gateway Metering](/docs/policies/ai-gateway-metering-inbound) policy page.
|
|
370
|
+
The same grammar applies here.
|
|
371
371
|
|
|
372
372
|
Two things are specific to application configuration. A policy that sets a value
|
|
373
373
|
an expression reads must run before Semantic Cache, which can answer without
|
|
@@ -426,7 +426,7 @@ every request. Add a `remove-headers-inbound` entry after the metering entry:
|
|
|
426
426
|
```json
|
|
427
427
|
[
|
|
428
428
|
{ "name": "set-budget-dimension" },
|
|
429
|
-
{ "name": "ai-gateway-metering-
|
|
429
|
+
{ "name": "ai-gateway-metering-inbound" },
|
|
430
430
|
{
|
|
431
431
|
"name": "remove-headers-inbound",
|
|
432
432
|
"options": { "headers": ["x-budget-customer"] }
|
|
@@ -5,8 +5,8 @@ Applications may also include authentication in their own chain. This makes it
|
|
|
5
5
|
possible to offer different routing, caching, guardrail, metering, and tracing
|
|
6
6
|
behavior from one AI Gateway deployment.
|
|
7
7
|
|
|
8
|
-
Prefer placing `ai-gateway-configuration-loader-
|
|
9
|
-
|
|
8
|
+
Prefer placing `ai-gateway-configuration-loader-inbound` before this executor on
|
|
9
|
+
the route so loading and chain execution stay separate. When the loader is
|
|
10
10
|
omitted, this executor still loads configuration itself.
|
|
11
11
|
|
|
12
12
|
The gateway owner decides which policy declarations are available, while
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://json-schema.org/draft-07/schema",
|
|
3
|
-
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-configuration-executor-
|
|
3
|
+
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-configuration-executor-inbound.json",
|
|
4
4
|
"type": "object",
|
|
5
5
|
"title": "AI Gateway Configuration Executor",
|
|
6
6
|
"isDeprecated": false,
|
|
@@ -10,9 +10,9 @@
|
|
|
10
10
|
"isBeta": false,
|
|
11
11
|
"isHidden": false,
|
|
12
12
|
"requiresAI": true,
|
|
13
|
-
"policyType": "ai-gateway-configuration-executor
|
|
13
|
+
"policyType": "ai-gateway-configuration-executor",
|
|
14
14
|
"products": ["ai-gateway"],
|
|
15
|
-
"description": "Loads the app configuration for the request (when auth or the configuration loader has not already), runs the inbound policy chain from that configuration, and enforces limits inherited from parent teams or the gateway root.\n\nPlace this policy on AI Gateway routes after optional authentication and optional `ai-gateway-configuration-loader-
|
|
15
|
+
"description": "Loads the app configuration for the request (when auth or the configuration loader has not already), runs the inbound policy chain from that configuration, and enforces limits inherited from parent teams or the gateway root.\n\nPlace this policy on AI Gateway routes after optional authentication and optional `ai-gateway-configuration-loader-inbound`. When either of those already populated the app-configuration channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter. Applications select from policies pre-declared by the gateway. Applications without a `inboundPolicyChain`, or with an empty chain, run no application-selected policies. Entry options replace the declaration's options as a complete object; omit them to inherit the declaration, including environment-backed credentials. Each occurrence receives a private deep copy of its entry options, so a policy mutating its options cannot corrupt the cached app configuration.",
|
|
16
16
|
"deprecatedMessage": "",
|
|
17
17
|
"required": ["handler"],
|
|
18
18
|
"properties": {
|
|
@@ -22,7 +22,7 @@
|
|
|
22
22
|
"required": ["export", "module", "options"],
|
|
23
23
|
"properties": {
|
|
24
24
|
"export": {
|
|
25
|
-
"const": "
|
|
25
|
+
"const": "AIGatewayConfigurationExecutorInboundPolicy",
|
|
26
26
|
"description": "The name of the exported type"
|
|
27
27
|
},
|
|
28
28
|
"module": {
|
|
@@ -30,8 +30,7 @@
|
|
|
30
30
|
"description": "The module containing the policy"
|
|
31
31
|
},
|
|
32
32
|
"options": {
|
|
33
|
-
"
|
|
34
|
-
"title": "AIGatewayConfigurationExecutorV2InboundPolicyOptions",
|
|
33
|
+
"title": "AIGatewayConfigurationExecutorInboundPolicyOptions",
|
|
35
34
|
"type": "object",
|
|
36
35
|
"description": "Options for loading each application's AI Gateway configuration and running its inbound policy chain.",
|
|
37
36
|
"additionalProperties": false,
|
|
@@ -41,14 +40,14 @@
|
|
|
41
40
|
"type": "number",
|
|
42
41
|
"default": 10,
|
|
43
42
|
"minimum": 2,
|
|
44
|
-
"description": "The time in seconds to cache app configurations loaded by app\\_id. Defaults to 10 seconds when omitted. Higher values decrease latency; lower values pick up portal changes sooner. Cached results remain valid until the cache expires even if the configuration changes in the portal. This cache is only used when neither ai-gateway-auth-
|
|
43
|
+
"description": "The time in seconds to cache app configurations loaded by app\\_id. Defaults to 10 seconds when omitted. Higher values decrease latency; lower values pick up portal changes sooner. Cached results remain valid until the cache expires even if the configuration changes in the portal. This cache is only used when neither ai-gateway-auth-inbound nor ai-gateway-configuration-loader-inbound already loaded the configuration for the request."
|
|
45
44
|
}
|
|
46
45
|
}
|
|
47
46
|
}
|
|
48
47
|
},
|
|
49
48
|
"examples": [
|
|
50
49
|
{
|
|
51
|
-
"export": "
|
|
50
|
+
"export": "AIGatewayConfigurationExecutorInboundPolicy",
|
|
52
51
|
"module": "$import(@zuplo/runtime)",
|
|
53
52
|
"options": {
|
|
54
53
|
"cacheTtlSeconds": 10
|
|
@@ -1,15 +1,15 @@
|
|
|
1
1
|
The AI Gateway Configuration Loader loads each application's configuration into
|
|
2
2
|
the request-scoped app-configuration channel. Configuration comes from
|
|
3
|
-
route-level `ai-gateway-auth-
|
|
3
|
+
route-level `ai-gateway-auth-inbound` when that policy already ran, otherwise
|
|
4
4
|
from the route's `app_id` path parameter via Gateway Service.
|
|
5
5
|
|
|
6
6
|
This policy does **not** run `inboundPolicyChain`. Pair it with
|
|
7
|
-
`ai-gateway-configuration-executor-
|
|
7
|
+
`ai-gateway-configuration-executor-inbound` when applications select policies
|
|
8
8
|
dynamically. If you omit this loader, the executor still loads configuration
|
|
9
9
|
before running the chain.
|
|
10
10
|
|
|
11
11
|
Applications can still require API keys later by including
|
|
12
|
-
`ai-gateway-auth-
|
|
12
|
+
`ai-gateway-auth-inbound` in their own `inboundPolicyChain`.
|
|
13
13
|
|
|
14
14
|
## Build an AI Gateway from scratch
|
|
15
15
|
|
|
@@ -22,10 +22,10 @@ Add the loader, the executor, and every policy an application may select to
|
|
|
22
22
|
{
|
|
23
23
|
"policies": [
|
|
24
24
|
{
|
|
25
|
-
"name": "ai-gateway-configuration-loader-
|
|
26
|
-
"policyType": "ai-gateway-configuration-loader
|
|
25
|
+
"name": "ai-gateway-configuration-loader-inbound",
|
|
26
|
+
"policyType": "ai-gateway-configuration-loader",
|
|
27
27
|
"handler": {
|
|
28
|
-
"export": "
|
|
28
|
+
"export": "AIGatewayConfigurationLoaderInboundPolicy",
|
|
29
29
|
"module": "$import(@zuplo/runtime)",
|
|
30
30
|
"options": {
|
|
31
31
|
"cacheTtlSeconds": 60
|
|
@@ -33,10 +33,10 @@ Add the loader, the executor, and every policy an application may select to
|
|
|
33
33
|
}
|
|
34
34
|
},
|
|
35
35
|
{
|
|
36
|
-
"name": "ai-gateway-configuration-executor-
|
|
37
|
-
"policyType": "ai-gateway-configuration-executor
|
|
36
|
+
"name": "ai-gateway-configuration-executor-inbound",
|
|
37
|
+
"policyType": "ai-gateway-configuration-executor",
|
|
38
38
|
"handler": {
|
|
39
|
-
"export": "
|
|
39
|
+
"export": "AIGatewayConfigurationExecutorInboundPolicy",
|
|
40
40
|
"module": "$import(@zuplo/runtime)",
|
|
41
41
|
"options": {
|
|
42
42
|
"cacheTtlSeconds": 60
|
|
@@ -70,8 +70,8 @@ Place the loader before the executor on each AI Gateway route:
|
|
|
70
70
|
},
|
|
71
71
|
"policies": {
|
|
72
72
|
"inbound": [
|
|
73
|
-
"ai-gateway-configuration-loader-
|
|
74
|
-
"ai-gateway-configuration-executor-
|
|
73
|
+
"ai-gateway-configuration-loader-inbound",
|
|
74
|
+
"ai-gateway-configuration-executor-inbound"
|
|
75
75
|
]
|
|
76
76
|
}
|
|
77
77
|
}
|
|
@@ -80,17 +80,17 @@ Place the loader before the executor on each AI Gateway route:
|
|
|
80
80
|
|
|
81
81
|
Authentication is optional and placement controls its scope:
|
|
82
82
|
|
|
83
|
-
- **App-level** — add `ai-gateway-auth-
|
|
83
|
+
- **App-level** — add `ai-gateway-auth-inbound` to an application's
|
|
84
84
|
`inboundPolicyChain`. Only that application requires an API key.
|
|
85
|
-
- **Route-level** — add `ai-gateway-auth-
|
|
85
|
+
- **Route-level** — add `ai-gateway-auth-inbound` on the route **before** the
|
|
86
86
|
loader. That requires an API key for every application on the route.
|
|
87
87
|
|
|
88
88
|
### Executor-only routes
|
|
89
89
|
|
|
90
|
-
Routes that list only `ai-gateway-configuration-executor-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
90
|
+
Routes that list only `ai-gateway-configuration-executor-inbound` keep working.
|
|
91
|
+
The executor loads configuration when the channel is empty, then runs the chain.
|
|
92
|
+
Use the dedicated loader when you want other route policies between load and
|
|
93
|
+
chain execution, or a clearer separation of concerns.
|
|
94
94
|
|
|
95
95
|
## Configuration checklist
|
|
96
96
|
|
|
@@ -0,0 +1,6 @@
|
|
|
1
|
+
The AI Gateway Configuration Loader loads each application's configuration into
|
|
2
|
+
the request-scoped channel — reusing the channel from route-level
|
|
3
|
+
`ai-gateway-auth-inbound` when present, otherwise fetching by path `app_id`. It
|
|
4
|
+
does not run the application's policy chain; place
|
|
5
|
+
`ai-gateway-configuration-executor-inbound` after it for that. When this loader
|
|
6
|
+
is omitted, the executor still loads configuration itself.
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://json-schema.org/draft-07/schema",
|
|
3
|
-
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-configuration-loader-
|
|
3
|
+
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-configuration-loader-inbound.json",
|
|
4
4
|
"type": "object",
|
|
5
5
|
"title": "AI Gateway Configuration Loader",
|
|
6
6
|
"isDeprecated": false,
|
|
@@ -10,9 +10,9 @@
|
|
|
10
10
|
"isBeta": false,
|
|
11
11
|
"isHidden": false,
|
|
12
12
|
"requiresAI": true,
|
|
13
|
-
"policyType": "ai-gateway-configuration-loader
|
|
13
|
+
"policyType": "ai-gateway-configuration-loader",
|
|
14
14
|
"products": ["ai-gateway"],
|
|
15
|
-
"description": "Loads the AI Gateway app configuration for the request into the request-scoped channel and does nothing else.\n\nPlace this policy on AI Gateway routes before `ai-gateway-configuration-executor-
|
|
15
|
+
"description": "Loads the AI Gateway app configuration for the request into the request-scoped channel and does nothing else.\n\nPlace this policy on AI Gateway routes before `ai-gateway-configuration-executor-inbound` when you want configuration loading separated from chain execution. When `ai-gateway-auth-inbound` already populated the channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter.\n\nIf this policy is omitted, the configuration executor still loads configuration itself before running the application chain.",
|
|
16
16
|
"deprecatedMessage": "",
|
|
17
17
|
"required": ["handler"],
|
|
18
18
|
"properties": {
|
|
@@ -22,7 +22,7 @@
|
|
|
22
22
|
"required": ["export", "module", "options"],
|
|
23
23
|
"properties": {
|
|
24
24
|
"export": {
|
|
25
|
-
"const": "
|
|
25
|
+
"const": "AIGatewayConfigurationLoaderInboundPolicy",
|
|
26
26
|
"description": "The name of the exported type"
|
|
27
27
|
},
|
|
28
28
|
"module": {
|
|
@@ -30,8 +30,7 @@
|
|
|
30
30
|
"description": "The module containing the policy"
|
|
31
31
|
},
|
|
32
32
|
"options": {
|
|
33
|
-
"
|
|
34
|
-
"title": "AIGatewayConfigurationLoaderV2InboundPolicyOptions",
|
|
33
|
+
"title": "AIGatewayConfigurationLoaderInboundPolicyOptions",
|
|
35
34
|
"type": "object",
|
|
36
35
|
"description": "Options for loading each application's AI Gateway configuration into the request-scoped channel.",
|
|
37
36
|
"additionalProperties": false,
|
|
@@ -41,14 +40,14 @@
|
|
|
41
40
|
"type": "number",
|
|
42
41
|
"default": 10,
|
|
43
42
|
"minimum": 2,
|
|
44
|
-
"description": "The time in seconds to cache app configurations loaded by app\\_id. Defaults to 10 seconds when omitted. Higher values decrease latency; lower values pick up portal changes sooner. Cached results remain valid until the cache expires even if the configuration changes in the portal. When ai-gateway-auth-
|
|
43
|
+
"description": "The time in seconds to cache app configurations loaded by app\\_id. Defaults to 10 seconds when omitted. Higher values decrease latency; lower values pick up portal changes sooner. Cached results remain valid until the cache expires even if the configuration changes in the portal. When ai-gateway-auth-inbound already loaded the configuration for the request, this cache is not used."
|
|
45
44
|
}
|
|
46
45
|
}
|
|
47
46
|
}
|
|
48
47
|
},
|
|
49
48
|
"examples": [
|
|
50
49
|
{
|
|
51
|
-
"export": "
|
|
50
|
+
"export": "AIGatewayConfigurationLoaderInboundPolicy",
|
|
52
51
|
"module": "$import(@zuplo/runtime)",
|
|
53
52
|
"options": {
|
|
54
53
|
"cacheTtlSeconds": 10
|
|
@@ -30,7 +30,6 @@
|
|
|
30
30
|
"description": "The module containing the policy"
|
|
31
31
|
},
|
|
32
32
|
"options": {
|
|
33
|
-
"x-zuplo-policy-type": "ai-gateway-dlp",
|
|
34
33
|
"type": "object",
|
|
35
34
|
"title": "AIGatewayDlpInboundPolicyOptions",
|
|
36
35
|
"description": "The options for the Data Loss Prevention (DLP) policy. Scans the content of AI requests and responses — system prompts, messages, and tool-call arguments — for sensitive data such as credit cards, national identifiers, and API keys, applying a per-rule action (mask, block, or log). Detection runs entirely inside the gateway; streaming responses are scanned as they stream (or collected and scanned whole with `streaming.mode: \"buffer\"`).",
|
|
@@ -34,10 +34,10 @@ A fallback that names the same model as the primary selection is skipped.
|
|
|
34
34
|
|
|
35
35
|
```json
|
|
36
36
|
{
|
|
37
|
-
"name": "ai-gateway-fallback-model-
|
|
38
|
-
"policyType": "ai-gateway-fallback-model
|
|
37
|
+
"name": "ai-gateway-fallback-model-inbound",
|
|
38
|
+
"policyType": "ai-gateway-fallback-model",
|
|
39
39
|
"handler": {
|
|
40
|
-
"export": "
|
|
40
|
+
"export": "AIGatewayFallbackModelInboundPolicy",
|
|
41
41
|
"module": "$import(@zuplo/runtime)",
|
|
42
42
|
"options": {
|
|
43
43
|
"models": {
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://json-schema.org/draft-07/schema",
|
|
3
|
-
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-fallback-model-
|
|
3
|
+
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-fallback-model-inbound.json",
|
|
4
4
|
"type": "object",
|
|
5
5
|
"title": "AI Gateway Fallback Model",
|
|
6
6
|
"isDeprecated": false,
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
"isBeta": false,
|
|
11
11
|
"isHidden": false,
|
|
12
12
|
"requiresAI": true,
|
|
13
|
-
"policyType": "ai-gateway-fallback-model
|
|
13
|
+
"policyType": "ai-gateway-fallback-model",
|
|
14
14
|
"products": ["ai-gateway"],
|
|
15
15
|
"description": "Adds failure and quota fallbacks to an existing AI Gateway model selection.\n\nPlace this policy after AI Gateway Model Filtering. It never creates a model selection, so a misplaced policy cannot bypass filtering.",
|
|
16
16
|
"deprecatedMessage": "",
|
|
@@ -22,7 +22,7 @@
|
|
|
22
22
|
"required": ["export", "module", "options"],
|
|
23
23
|
"properties": {
|
|
24
24
|
"export": {
|
|
25
|
-
"const": "
|
|
25
|
+
"const": "AIGatewayFallbackModelInboundPolicy",
|
|
26
26
|
"description": "The name of the exported type"
|
|
27
27
|
},
|
|
28
28
|
"module": {
|
|
@@ -30,9 +30,8 @@
|
|
|
30
30
|
"description": "The module containing the policy"
|
|
31
31
|
},
|
|
32
32
|
"options": {
|
|
33
|
-
"x-zuplo-policy-type": "ai-gateway-fallback-model-v2",
|
|
34
33
|
"type": "object",
|
|
35
|
-
"title": "
|
|
34
|
+
"title": "AIGatewayFallbackModelInboundPolicyOptions",
|
|
36
35
|
"description": "Options for adding failure and quota fallbacks to an existing AI Gateway model selection.",
|
|
37
36
|
"additionalProperties": false,
|
|
38
37
|
"required": ["models"],
|
|
@@ -110,7 +109,7 @@
|
|
|
110
109
|
},
|
|
111
110
|
"examples": [
|
|
112
111
|
{
|
|
113
|
-
"export": "
|
|
112
|
+
"export": "AIGatewayFallbackModelInboundPolicy",
|
|
114
113
|
"module": "$import(@zuplo/runtime)",
|
|
115
114
|
"options": {
|
|
116
115
|
"models": {
|
package/docs/policies/{galileo-tracing-v2-inbound → ai-gateway-galileo-tracing-inbound}/doc.md
RENAMED
|
@@ -18,10 +18,10 @@ traces:
|
|
|
18
18
|
|
|
19
19
|
```json
|
|
20
20
|
{
|
|
21
|
-
"name": "galileo-tracing-
|
|
22
|
-
"policyType": "galileo-tracing
|
|
21
|
+
"name": "ai-gateway-galileo-tracing-inbound",
|
|
22
|
+
"policyType": "ai-gateway-galileo-tracing",
|
|
23
23
|
"handler": {
|
|
24
|
-
"export": "
|
|
24
|
+
"export": "AIGatewayGalileoTracingInboundPolicy",
|
|
25
25
|
"module": "$import(@zuplo/runtime)",
|
|
26
26
|
"options": {
|
|
27
27
|
"apiKey": "$env(GALILEO_API_KEY)",
|
package/docs/policies/{galileo-tracing-v2-inbound → ai-gateway-galileo-tracing-inbound}/schema.json
RENAMED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://json-schema.org/draft-07/schema",
|
|
3
|
-
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/galileo-tracing-
|
|
3
|
+
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-galileo-tracing-inbound.json",
|
|
4
4
|
"type": "object",
|
|
5
5
|
"title": "Galileo Tracing",
|
|
6
6
|
"isDeprecated": false,
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
"isBeta": false,
|
|
11
11
|
"isHidden": false,
|
|
12
12
|
"requiresAI": true,
|
|
13
|
-
"policyType": "galileo-tracing
|
|
13
|
+
"policyType": "ai-gateway-galileo-tracing",
|
|
14
14
|
"products": ["ai-gateway"],
|
|
15
15
|
"description": "Galileo Tracing Inbound Policy",
|
|
16
16
|
"deprecatedMessage": "",
|
|
@@ -22,7 +22,7 @@
|
|
|
22
22
|
"required": ["export", "module", "options"],
|
|
23
23
|
"properties": {
|
|
24
24
|
"export": {
|
|
25
|
-
"const": "
|
|
25
|
+
"const": "AIGatewayGalileoTracingInboundPolicy",
|
|
26
26
|
"description": "The name of the exported type"
|
|
27
27
|
},
|
|
28
28
|
"module": {
|
|
@@ -30,8 +30,7 @@
|
|
|
30
30
|
"description": "The module containing the policy"
|
|
31
31
|
},
|
|
32
32
|
"options": {
|
|
33
|
-
"
|
|
34
|
-
"title": "Galileo Tracing",
|
|
33
|
+
"title": "AIGatewayGalileoTracingInboundPolicyOptions",
|
|
35
34
|
"description": "Track AI Gateway requests and responses using Galileo's LLM observability platform.",
|
|
36
35
|
"type": "object",
|
|
37
36
|
"examples": [
|
|
@@ -88,7 +87,7 @@
|
|
|
88
87
|
},
|
|
89
88
|
"examples": [
|
|
90
89
|
{
|
|
91
|
-
"export": "
|
|
90
|
+
"export": "AIGatewayGalileoTracingInboundPolicy",
|
|
92
91
|
"module": "$import(@zuplo/runtime)",
|
|
93
92
|
"options": {
|
|
94
93
|
"apiKey": "$env(GALILEO_API_KEY)",
|
|
@@ -44,15 +44,15 @@ Declare the policy in `config/policies.json`:
|
|
|
44
44
|
```
|
|
45
45
|
|
|
46
46
|
Then select it in the application's `inboundPolicyChain` in place of
|
|
47
|
-
`ai-gateway-auth-
|
|
47
|
+
`ai-gateway-auth-inbound`. Put it first so nothing else runs for a rejected
|
|
48
48
|
request:
|
|
49
49
|
|
|
50
50
|
```json
|
|
51
51
|
{
|
|
52
52
|
"inboundPolicyChain": [
|
|
53
53
|
{ "name": "ai-gateway-internal-only-inbound" },
|
|
54
|
-
{ "name": "ai-gateway-model-filtering-
|
|
55
|
-
{ "name": "ai-gateway-metering-
|
|
54
|
+
{ "name": "ai-gateway-model-filtering-inbound" },
|
|
55
|
+
{ "name": "ai-gateway-metering-inbound" }
|
|
56
56
|
]
|
|
57
57
|
}
|
|
58
58
|
```
|
|
@@ -30,7 +30,6 @@
|
|
|
30
30
|
"description": "The module containing the policy"
|
|
31
31
|
},
|
|
32
32
|
"options": {
|
|
33
|
-
"x-zuplo-policy-type": "ai-gateway-internal-only",
|
|
34
33
|
"title": "AIGatewayInternalOnlyInboundPolicyOptions",
|
|
35
34
|
"type": "object",
|
|
36
35
|
"description": "The options for this policy. It has none.",
|
package/docs/policies/{ai-gateway-metering-v2-inbound → ai-gateway-metering-inbound}/schema.json
RENAMED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"$schema": "https://json-schema.org/draft-07/schema",
|
|
3
|
-
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-metering-
|
|
3
|
+
"$id": "https://cdn.zuplo.com/policies/runtime/schemas/ai-gateway-metering-inbound.json",
|
|
4
4
|
"type": "object",
|
|
5
5
|
"title": "AI Gateway Metering",
|
|
6
6
|
"isDeprecated": false,
|
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
"isBeta": false,
|
|
11
11
|
"isHidden": false,
|
|
12
12
|
"requiresAI": true,
|
|
13
|
-
"policyType": "ai-gateway-metering
|
|
13
|
+
"policyType": "ai-gateway-metering",
|
|
14
14
|
"products": ["ai-gateway"],
|
|
15
15
|
"description": "Meters AI Gateway usage and enforces limits configured by the application.\n\nThe authentication policy must run before this policy so the app configuration id is available for meter storage and analytics.",
|
|
16
16
|
"deprecatedMessage": "",
|
|
@@ -22,7 +22,7 @@
|
|
|
22
22
|
"required": ["export", "module", "options"],
|
|
23
23
|
"properties": {
|
|
24
24
|
"export": {
|
|
25
|
-
"const": "
|
|
25
|
+
"const": "AIGatewayMeteringInboundPolicy",
|
|
26
26
|
"description": "The name of the exported type"
|
|
27
27
|
},
|
|
28
28
|
"module": {
|
|
@@ -30,8 +30,7 @@
|
|
|
30
30
|
"description": "The module containing the policy"
|
|
31
31
|
},
|
|
32
32
|
"options": {
|
|
33
|
-
"
|
|
34
|
-
"title": "AIGatewayMeteringV2InboundPolicyOptions",
|
|
33
|
+
"title": "AIGatewayMeteringInboundPolicyOptions",
|
|
35
34
|
"type": "object",
|
|
36
35
|
"description": "Options for metering AI Gateway usage and enforcing request-time limits.",
|
|
37
36
|
"additionalProperties": false,
|
|
@@ -338,7 +337,7 @@
|
|
|
338
337
|
},
|
|
339
338
|
"examples": [
|
|
340
339
|
{
|
|
341
|
-
"export": "
|
|
340
|
+
"export": "AIGatewayMeteringInboundPolicy",
|
|
342
341
|
"module": "$import(@zuplo/runtime)",
|
|
343
342
|
"options": {
|
|
344
343
|
"budgetRules": [
|