zuplo 7.8.25 → 7.9.3

package/docs/ai-gateway/cookbooks/sdk-path-shim.mdx

@@ -46,7 +46,7 @@ import { ZuploRequest } from "@zuplo/runtime";
  *
  * Copy this module into your gateway, register it in `policies.json` as a
  * `custom-code-inbound` policy, and list it FIRST in the catch-all route's
- * inbound policies — before `ai-gateway-configuration-loader-v2-inbound`. The
+ * inbound policies — before `ai-gateway-configuration-loader-inbound`. The
  * loader answers 404 to any path whose segment after the app id is not `v1`
  * before it loads the app, so a shim placed in an app's stored chain would
  * never run for these paths. (This fixture mounts it on a sibling route,
@@ -74,7 +74,7 @@ import { ZuploRequest } from "@zuplo/runtime";
  *
  * Credential: an `api-key` header — what the Azure clients send — becomes
  * `Authorization: Bearer` when no Authorization header is present, which is
- * the header `ai-gateway-auth-v2-inbound` reads. Query strings such as
+ * the header `ai-gateway-auth-inbound` reads. Query strings such as
  * `api-version` are left alone; the gateway ignores them.
  *
  * Anything the shim does not recognize passes through with the path
@@ -295,18 +295,23 @@ Three steps, all in your gateway project:
 
    In `config/ai.oas.json`, list `sdk-path-shim-inbound` **first** in the
    inbound policies of the AI Gateway catch-all route `/:app_id/(.*)`, ahead of
-   `ai-gateway-configuration-loader-v2-inbound`:
+   `ai-gateway-configuration-loader-inbound`:
 
    ```json title="config/ai.oas.json (the catch-all route's policies)"
    "policies": {
      "inbound": [
        "sdk-path-shim-inbound",
-       "ai-gateway-configuration-loader-v2-inbound",
-       "ai-gateway-configuration-executor-v2-inbound"
+       "ai-gateway-configuration-loader-inbound",
+       "ai-gateway-configuration-executor-inbound"
      ]
    }
    ```
 
+   Older gateways list these two policies as
+   `ai-gateway-configuration-loader-v2-inbound` and
+   `ai-gateway-configuration-executor-v2-inbound`. Keep the names your route
+   already uses and add the shim ahead of them.
+
 </Stepper>
 
 The order isn't optional: the shim must run before the loader, for the reason

package/docs/ai-gateway/policy-chains.mdx

@@ -83,6 +83,10 @@ remove that entry.
   references a policy that isn't declared in the gateway's `policies.json`—the
   request fails with an error identifying the entry to fix, and no entries run.
   The gateway never guesses.
+- Older gateways and chains name built-in AI Gateway policies with a
+  `-v2-inbound` suffix, such as `ai-gateway-metering-v2-inbound`. Those names
+  keep working: an entry named either way matches a policy declared either way
+  in `policies.json`.
 
 ### Options and secrets
 
@@ -149,16 +153,16 @@ the Add Policy dialog alongside the built-in ones.
 
 ## Configuration Executor
 
-`ai-gateway-configuration-executor-v2-inbound` is the policy that makes the
+`ai-gateway-configuration-executor-inbound` is the policy that makes the
 two-layer model work. It loads the app's configuration and then runs the app's
 stored inbound chain, instantiating only policies already declared in
 `config/policies.json`. Every scaffolded gateway declares it and puts it on the
 AI Gateway route—that route entry is what gives an app's chain somewhere to run.
 
 The scaffolded route also carries a **Configuration Loader**
-(`ai-gateway-configuration-loader-v2-inbound`) ahead of the executor. The
-executor loads the app's configuration by default, so the loader changes nothing
-on its own—it's there for when you want to manipulate the loaded configuration
+(`ai-gateway-configuration-loader-inbound`) ahead of the executor. The executor
+loads the app's configuration by default, so the loader changes nothing on its
+own—it's there for when you want to manipulate the loaded configuration
 programmatically before the chain runs: place your own route policy between the
 loader and the executor.
 
@@ -171,7 +175,7 @@ also affect when a budget change takes effect.
 
 ## Authentication
 
-The `ai-gateway-auth-v2-inbound` policy—**API Key Authentication** in the
+The `ai-gateway-auth-inbound` policy—**API Key Authentication** in the
 portal—requires callers to present the app's API key, and it applies per app:
 add it to an app's chain to require a key for that app alone. A new top-level
 team's [policy template](./policy-templates.mdx) includes it as a locked

package/docs/policies/_index.md

@@ -5,8 +5,8 @@
 | set-query-params-inbound | Add or Set Query Parameters | Adds or sets query parameters on the incoming request. | api-gateway |
 | set-headers-inbound | Add or Set Request Headers | Adds or sets headers on the incoming request. | api-gateway |
 | ai-gateway-auth-inbound | AI Gateway Authentication | Authenticates requests to an AI Gateway endpoint with application API keys.  Add this policy to an application's `inboundPolicyChain` to require a key for that app only, or place it on the route before the configuration executor to require a key for every application on the route. The policies that follow can read the authenticated application from `request.user` (`sub` is the application name, `data` its metadata), and the application's AI Gateway configuration takes effect for the request. Use `authHeader` and `authScheme` when clients send their app key somewhere other than the default `Authorization: Bearer` header. Enable `credentialPassthrough`, with the application key in a separate header, to forward the caller's `Authorization` header to the primary provider as its credential.  When the matched route captures an `app_id` path parameter (platform catch-all `/:app_id/(.*)`), this policy also requires the stored configuration ID to match the URL (adding `config_` for `/a`). It returns 403 on mismatch.  On a User App route (`/u/{app_id}`), only a personal API key issued for that User App authenticates. `request.user.sub` is then the key owner's user ID. An application API key on a User App route, or a personal API key on any other route, returns 403. Validation results are cached for `cacheTtlSeconds`, so a revoked key stops working within that window. | ai-gateway |
-| ai-gateway-configuration-executor-inbound | AI Gateway Configuration Executor | Loads the app configuration for the request (when auth or the configuration loader has not already), runs the inbound policy chain from that configuration, and enforces limits inherited from parent teams or the gateway root.  Place this policy on AI Gateway routes after optional authentication and optional `ai-gateway-configuration-loader-v2-inbound`. When either of those already populated the app-configuration channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter. Applications select from policies pre-declared by the gateway. Applications without a `inboundPolicyChain`, or with an empty chain, run no application-selected policies. Entry options replace the declaration's options as a complete object; omit them to inherit the declaration, including environment-backed credentials. Each occurrence receives a private deep copy of its entry options, so a policy mutating its options cannot corrupt the cached app configuration. | ai-gateway |
-| ai-gateway-configuration-loader-inbound | AI Gateway Configuration Loader | Loads the AI Gateway app configuration for the request into the request-scoped channel and does nothing else.  Place this policy on AI Gateway routes before `ai-gateway-configuration-executor-v2-inbound` when you want configuration loading separated from chain execution. When `ai-gateway-auth-v2-inbound` already populated the channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter.  If this policy is omitted, the configuration executor still loads configuration itself before running the application chain. | ai-gateway |
+| ai-gateway-configuration-executor-inbound | AI Gateway Configuration Executor | Loads the app configuration for the request (when auth or the configuration loader has not already), runs the inbound policy chain from that configuration, and enforces limits inherited from parent teams or the gateway root.  Place this policy on AI Gateway routes after optional authentication and optional `ai-gateway-configuration-loader-inbound`. When either of those already populated the app-configuration channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter. Applications select from policies pre-declared by the gateway. Applications without a `inboundPolicyChain`, or with an empty chain, run no application-selected policies. Entry options replace the declaration's options as a complete object; omit them to inherit the declaration, including environment-backed credentials. Each occurrence receives a private deep copy of its entry options, so a policy mutating its options cannot corrupt the cached app configuration. | ai-gateway |
+| ai-gateway-configuration-loader-inbound | AI Gateway Configuration Loader | Loads the AI Gateway app configuration for the request into the request-scoped channel and does nothing else.  Place this policy on AI Gateway routes before `ai-gateway-configuration-executor-inbound` when you want configuration loading separated from chain execution. When `ai-gateway-auth-inbound` already populated the channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter.  If this policy is omitted, the configuration executor still loads configuration itself before running the application chain. | ai-gateway |
 | ai-gateway-fallback-model-inbound | AI Gateway Fallback Model | Adds failure and quota fallbacks to an existing AI Gateway model selection.  Place this policy after AI Gateway Model Filtering. It never creates a model selection, so a misplaced policy cannot bypass filtering. | ai-gateway |
 | ai-gateway-metering-inbound | AI Gateway Metering | Meters AI Gateway usage and enforces limits configured by the application.  The authentication policy must run before this policy so the app configuration id is available for meter storage and analytics. | ai-gateway |
 | ai-gateway-model-filtering-inbound | AI Gateway Model Filtering | Matches AI Gateway requests against curated allow lists or open block lists, then stores the winning model reference for the route handler. | ai-gateway |

package/docs/policies/ai-gateway-akamai-firewall-inbound/doc.md

@@ -17,7 +17,7 @@ by default, include it in the team's policy template.
 
 ```json
 {
-  "name": "akamai-ai-firewall-v2-inbound",
+  "name": "ai-gateway-akamai-firewall-inbound",
   "policyType": "ai-gateway-akamai-firewall",
   "handler": {
     "export": "AIGatewayAkamaiFirewallInboundPolicy",

package/docs/policies/ai-gateway-auth-inbound/doc.md

@@ -24,7 +24,7 @@ Declare the policy in `config/policies.json`:
 {
   "policies": [
     {
-      "name": "ai-gateway-auth-v2-inbound",
+      "name": "ai-gateway-auth-inbound",
       "policyType": "ai-gateway-auth",
       "handler": {
         "export": "AIGatewayAuthInboundPolicy",
@@ -52,7 +52,7 @@ the `app_id` path parameter before the app chain runs:
 {
   "inboundPolicyChain": [
     {
-      "name": "ai-gateway-auth-v2-inbound"
+      "name": "ai-gateway-auth-inbound"
     }
   ]
 }
@@ -75,9 +75,9 @@ application that hits the route:
     },
     "policies": {
       "inbound": [
-        "ai-gateway-auth-v2-inbound",
-        "ai-gateway-configuration-loader-v2-inbound",
-        "ai-gateway-configuration-executor-v2-inbound"
+        "ai-gateway-auth-inbound",
+        "ai-gateway-configuration-loader-inbound",
+        "ai-gateway-configuration-executor-inbound"
       ]
     }
   }
@@ -127,7 +127,7 @@ empty string when the header contains only the key:
 
 ```json
 {
-  "name": "ai-gateway-auth-v2-inbound",
+  "name": "ai-gateway-auth-inbound",
   "policyType": "ai-gateway-auth",
   "handler": {
     "export": "AIGatewayAuthInboundPolicy",

package/docs/policies/ai-gateway-configuration-executor-inbound/doc.md

@@ -1,10 +1,10 @@
 The AI Gateway Configuration Executor loads each application's configuration
-(when auth or `ai-gateway-configuration-loader-v2-inbound` has not already) and
+(when auth or `ai-gateway-configuration-loader-inbound` has not already) and
 runs its ordered inbound policy chain. Configuration comes from route-level
-`ai-gateway-auth-v2-inbound` or the configuration loader when either already
-ran, otherwise from the route's `app_id` path parameter via Gateway Service.
+`ai-gateway-auth-inbound` or the configuration loader when either already ran,
+otherwise from the route's `app_id` path parameter via Gateway Service.
 Applications can still require API keys later by including
-`ai-gateway-auth-v2-inbound` in their own `inboundPolicyChain`.
+`ai-gateway-auth-inbound` in their own `inboundPolicyChain`.
 
 Prefer placing the dedicated configuration loader before this executor on the
 route. When the loader is omitted, this executor still loads configuration
@@ -74,7 +74,7 @@ chooses the policies it needs in its `inboundPolicyChain`:
 {
   "policies": [
     {
-      "name": "ai-gateway-auth-v2-inbound",
+      "name": "ai-gateway-auth-inbound",
       "policyType": "ai-gateway-auth",
       "handler": {
         "export": "AIGatewayAuthInboundPolicy",
@@ -85,7 +85,7 @@ chooses the policies it needs in its `inboundPolicyChain`:
       }
     },
     {
-      "name": "ai-gateway-configuration-loader-v2-inbound",
+      "name": "ai-gateway-configuration-loader-inbound",
       "policyType": "ai-gateway-configuration-loader",
       "handler": {
         "export": "AIGatewayConfigurationLoaderInboundPolicy",
@@ -96,7 +96,7 @@ chooses the policies it needs in its `inboundPolicyChain`:
       }
     },
     {
-      "name": "ai-gateway-configuration-executor-v2-inbound",
+      "name": "ai-gateway-configuration-executor-inbound",
       "policyType": "ai-gateway-configuration-executor",
       "handler": {
         "export": "AIGatewayConfigurationExecutorInboundPolicy",
@@ -107,7 +107,7 @@ chooses the policies it needs in its `inboundPolicyChain`:
       }
     },
     {
-      "name": "ai-gateway-metering-v2-inbound",
+      "name": "ai-gateway-metering-inbound",
       "policyType": "ai-gateway-metering",
       "handler": {
         "export": "AIGatewayMeteringInboundPolicy",
@@ -116,7 +116,7 @@ chooses the policies it needs in its `inboundPolicyChain`:
       }
     },
     {
-      "name": "ai-gateway-model-filtering-v2-inbound",
+      "name": "ai-gateway-model-filtering-inbound",
       "policyType": "ai-gateway-model-filtering",
       "handler": {
         "export": "AIGatewayModelFilteringInboundPolicy",
@@ -131,7 +131,7 @@ chooses the policies it needs in its `inboundPolicyChain`:
       }
     },
     {
-      "name": "ai-gateway-fallback-model-v2-inbound",
+      "name": "ai-gateway-fallback-model-inbound",
       "policyType": "ai-gateway-fallback-model",
       "handler": {
         "export": "AIGatewayFallbackModelInboundPolicy",
@@ -147,7 +147,7 @@ chooses the policies it needs in its `inboundPolicyChain`:
       }
     },
     {
-      "name": "ai-gateway-semantic-cache-v2-inbound",
+      "name": "ai-gateway-semantic-cache-inbound",
       "policyType": "ai-gateway-semantic-cache",
       "handler": {
         "export": "AIGatewaySemanticCacheInboundPolicy",
@@ -186,8 +186,8 @@ chain:
     },
     "policies": {
       "inbound": [
-        "ai-gateway-configuration-loader-v2-inbound",
-        "ai-gateway-configuration-executor-v2-inbound"
+        "ai-gateway-configuration-loader-inbound",
+        "ai-gateway-configuration-executor-inbound"
       ]
     }
   }
@@ -198,9 +198,9 @@ If you omit the loader, the executor loads the application configuration.
 
 Authentication is optional and placement controls its scope:
 
-- **App-level** — add `ai-gateway-auth-v2-inbound` to an application's
+- **App-level** — add `ai-gateway-auth-inbound` to an application's
   `inboundPolicyChain`. Only that application requires an API key.
-- **Route-level** — add `ai-gateway-auth-v2-inbound` on the route **before** the
+- **Route-level** — add `ai-gateway-auth-inbound` on the route **before** the
   loader (or before the executor on executor-only routes). That requires an API
   key for every application on the route.
 - **Internal applications** — for an application that is only called from inside
@@ -215,22 +215,22 @@ application-selected chains.
 ### 3. Set an application's policy chain
 
 An application can inherit the options from `policies.json`. Include
-`ai-gateway-auth-v2-inbound` when this application should require an API key:
+`ai-gateway-auth-inbound` when this application should require an API key:
 
 ```json
 {
   "inboundPolicyChain": [
     {
-      "name": "ai-gateway-auth-v2-inbound"
+      "name": "ai-gateway-auth-inbound"
     },
     {
-      "name": "ai-gateway-model-filtering-v2-inbound"
+      "name": "ai-gateway-model-filtering-inbound"
     },
     {
-      "name": "ai-gateway-fallback-model-v2-inbound"
+      "name": "ai-gateway-fallback-model-inbound"
     },
     {
-      "name": "ai-gateway-metering-v2-inbound",
+      "name": "ai-gateway-metering-inbound",
       "options": {
         "budgetRules": [
           {
@@ -248,7 +248,7 @@ An application can inherit the options from `policies.json`. Include
       }
     },
     {
-      "name": "ai-gateway-semantic-cache-v2-inbound"
+      "name": "ai-gateway-semantic-cache-inbound"
     }
   ]
 }
@@ -265,7 +265,7 @@ An application can also provide a complete options object for an entry:
 {
   "inboundPolicyChain": [
     {
-      "name": "ai-gateway-model-filtering-v2-inbound",
+      "name": "ai-gateway-model-filtering-inbound",
       "options": {
         "models": {
           "completions": {
@@ -290,7 +290,7 @@ under `permissions` fail closed:
 {
   "inboundPolicyChain": [
     {
-      "name": "ai-gateway-model-filtering-v2-inbound",
+      "name": "ai-gateway-model-filtering-inbound",
       "permissions": {
         "canEdit": true,
         "canRemove": false
@@ -426,7 +426,7 @@ every request. Add a `remove-headers-inbound` entry after the metering entry:
 ```json
 [
   { "name": "set-budget-dimension" },
-  { "name": "ai-gateway-metering-v2-inbound" },
+  { "name": "ai-gateway-metering-inbound" },
   {
     "name": "remove-headers-inbound",
     "options": { "headers": ["x-budget-customer"] }

package/docs/policies/ai-gateway-configuration-executor-inbound/intro.md

@@ -5,8 +5,8 @@ Applications may also include authentication in their own chain. This makes it
 possible to offer different routing, caching, guardrail, metering, and tracing
 behavior from one AI Gateway deployment.
 
-Prefer placing `ai-gateway-configuration-loader-v2-inbound` before this executor
-on the route so loading and chain execution stay separate. When the loader is
+Prefer placing `ai-gateway-configuration-loader-inbound` before this executor on
+the route so loading and chain execution stay separate. When the loader is
 omitted, this executor still loads configuration itself.
 
 The gateway owner decides which policy declarations are available, while

package/docs/policies/ai-gateway-configuration-executor-inbound/schema.json

@@ -12,7 +12,7 @@
   "requiresAI": true,
   "policyType": "ai-gateway-configuration-executor",
   "products": ["ai-gateway"],
-  "description": "Loads the app configuration for the request (when auth or the configuration loader has not already), runs the inbound policy chain from that configuration, and enforces limits inherited from parent teams or the gateway root.\n\nPlace this policy on AI Gateway routes after optional authentication and optional `ai-gateway-configuration-loader-v2-inbound`. When either of those already populated the app-configuration channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter. Applications select from policies pre-declared by the gateway. Applications without a `inboundPolicyChain`, or with an empty chain, run no application-selected policies. Entry options replace the declaration's options as a complete object; omit them to inherit the declaration, including environment-backed credentials. Each occurrence receives a private deep copy of its entry options, so a policy mutating its options cannot corrupt the cached app configuration.",
+  "description": "Loads the app configuration for the request (when auth or the configuration loader has not already), runs the inbound policy chain from that configuration, and enforces limits inherited from parent teams or the gateway root.\n\nPlace this policy on AI Gateway routes after optional authentication and optional `ai-gateway-configuration-loader-inbound`. When either of those already populated the app-configuration channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter. Applications select from policies pre-declared by the gateway. Applications without a `inboundPolicyChain`, or with an empty chain, run no application-selected policies. Entry options replace the declaration's options as a complete object; omit them to inherit the declaration, including environment-backed credentials. Each occurrence receives a private deep copy of its entry options, so a policy mutating its options cannot corrupt the cached app configuration.",
   "deprecatedMessage": "",
   "required": ["handler"],
   "properties": {
@@ -40,7 +40,7 @@
               "type": "number",
               "default": 10,
               "minimum": 2,
-              "description": "The time in seconds to cache app configurations loaded by app\\_id. Defaults to 10 seconds when omitted. Higher values decrease latency; lower values pick up portal changes sooner. Cached results remain valid until the cache expires even if the configuration changes in the portal. This cache is only used when neither ai-gateway-auth-v2-inbound nor ai-gateway-configuration-loader-v2-inbound already loaded the configuration for the request."
+              "description": "The time in seconds to cache app configurations loaded by app\\_id. Defaults to 10 seconds when omitted. Higher values decrease latency; lower values pick up portal changes sooner. Cached results remain valid until the cache expires even if the configuration changes in the portal. This cache is only used when neither ai-gateway-auth-inbound nor ai-gateway-configuration-loader-inbound already loaded the configuration for the request."
             }
           }
         }

package/docs/policies/ai-gateway-configuration-loader-inbound/doc.md

@@ -1,15 +1,15 @@
 The AI Gateway Configuration Loader loads each application's configuration into
 the request-scoped app-configuration channel. Configuration comes from
-route-level `ai-gateway-auth-v2-inbound` when that policy already ran, otherwise
+route-level `ai-gateway-auth-inbound` when that policy already ran, otherwise
 from the route's `app_id` path parameter via Gateway Service.
 
 This policy does **not** run `inboundPolicyChain`. Pair it with
-`ai-gateway-configuration-executor-v2-inbound` when applications select policies
+`ai-gateway-configuration-executor-inbound` when applications select policies
 dynamically. If you omit this loader, the executor still loads configuration
 before running the chain.
 
 Applications can still require API keys later by including
-`ai-gateway-auth-v2-inbound` in their own `inboundPolicyChain`.
+`ai-gateway-auth-inbound` in their own `inboundPolicyChain`.
 
 ## Build an AI Gateway from scratch
 
@@ -22,7 +22,7 @@ Add the loader, the executor, and every policy an application may select to
 {
   "policies": [
     {
-      "name": "ai-gateway-configuration-loader-v2-inbound",
+      "name": "ai-gateway-configuration-loader-inbound",
       "policyType": "ai-gateway-configuration-loader",
       "handler": {
         "export": "AIGatewayConfigurationLoaderInboundPolicy",
@@ -33,7 +33,7 @@ Add the loader, the executor, and every policy an application may select to
       }
     },
     {
-      "name": "ai-gateway-configuration-executor-v2-inbound",
+      "name": "ai-gateway-configuration-executor-inbound",
       "policyType": "ai-gateway-configuration-executor",
       "handler": {
         "export": "AIGatewayConfigurationExecutorInboundPolicy",
@@ -70,8 +70,8 @@ Place the loader before the executor on each AI Gateway route:
     },
     "policies": {
       "inbound": [
-        "ai-gateway-configuration-loader-v2-inbound",
-        "ai-gateway-configuration-executor-v2-inbound"
+        "ai-gateway-configuration-loader-inbound",
+        "ai-gateway-configuration-executor-inbound"
       ]
     }
   }
@@ -80,17 +80,17 @@ Place the loader before the executor on each AI Gateway route:
 
 Authentication is optional and placement controls its scope:
 
-- **App-level** — add `ai-gateway-auth-v2-inbound` to an application's
+- **App-level** — add `ai-gateway-auth-inbound` to an application's
   `inboundPolicyChain`. Only that application requires an API key.
-- **Route-level** — add `ai-gateway-auth-v2-inbound` on the route **before** the
+- **Route-level** — add `ai-gateway-auth-inbound` on the route **before** the
   loader. That requires an API key for every application on the route.
 
 ### Executor-only routes
 
-Routes that list only `ai-gateway-configuration-executor-v2-inbound` keep
-working. The executor loads configuration when the channel is empty, then runs
-the chain. Use the dedicated loader when you want other route policies between
-load and chain execution, or a clearer separation of concerns.
+Routes that list only `ai-gateway-configuration-executor-inbound` keep working.
+The executor loads configuration when the channel is empty, then runs the chain.
+Use the dedicated loader when you want other route policies between load and
+chain execution, or a clearer separation of concerns.
 
 ## Configuration checklist
 

package/docs/policies/ai-gateway-configuration-loader-inbound/intro.md

@@ -1,6 +1,6 @@
 The AI Gateway Configuration Loader loads each application's configuration into
 the request-scoped channel — reusing the channel from route-level
-`ai-gateway-auth-v2-inbound` when present, otherwise fetching by path `app_id`.
-It does not run the application's policy chain; place
-`ai-gateway-configuration-executor-v2-inbound` after it for that. When this
-loader is omitted, the executor still loads configuration itself.
+`ai-gateway-auth-inbound` when present, otherwise fetching by path `app_id`. It
+does not run the application's policy chain; place
+`ai-gateway-configuration-executor-inbound` after it for that. When this loader
+is omitted, the executor still loads configuration itself.

package/docs/policies/ai-gateway-configuration-loader-inbound/schema.json

@@ -12,7 +12,7 @@
   "requiresAI": true,
   "policyType": "ai-gateway-configuration-loader",
   "products": ["ai-gateway"],
-  "description": "Loads the AI Gateway app configuration for the request into the request-scoped channel and does nothing else.\n\nPlace this policy on AI Gateway routes before `ai-gateway-configuration-executor-v2-inbound` when you want configuration loading separated from chain execution. When `ai-gateway-auth-v2-inbound` already populated the channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter.\n\nIf this policy is omitted, the configuration executor still loads configuration itself before running the application chain.",
+  "description": "Loads the AI Gateway app configuration for the request into the request-scoped channel and does nothing else.\n\nPlace this policy on AI Gateway routes before `ai-gateway-configuration-executor-inbound` when you want configuration loading separated from chain execution. When `ai-gateway-auth-inbound` already populated the channel, this policy reuses it. Otherwise it loads the configuration with the route's `app_id` path parameter.\n\nIf this policy is omitted, the configuration executor still loads configuration itself before running the application chain.",
   "deprecatedMessage": "",
   "required": ["handler"],
   "properties": {
@@ -40,7 +40,7 @@
               "type": "number",
               "default": 10,
               "minimum": 2,
-              "description": "The time in seconds to cache app configurations loaded by app\\_id. Defaults to 10 seconds when omitted. Higher values decrease latency; lower values pick up portal changes sooner. Cached results remain valid until the cache expires even if the configuration changes in the portal. When ai-gateway-auth-v2-inbound already loaded the configuration for the request, this cache is not used."
+              "description": "The time in seconds to cache app configurations loaded by app\\_id. Defaults to 10 seconds when omitted. Higher values decrease latency; lower values pick up portal changes sooner. Cached results remain valid until the cache expires even if the configuration changes in the portal. When ai-gateway-auth-inbound already loaded the configuration for the request, this cache is not used."
             }
           }
         }

package/docs/policies/ai-gateway-fallback-model-inbound/doc.md

@@ -34,7 +34,7 @@ A fallback that names the same model as the primary selection is skipped.
 
 ```json
 {
-  "name": "ai-gateway-fallback-model-v2-inbound",
+  "name": "ai-gateway-fallback-model-inbound",
   "policyType": "ai-gateway-fallback-model",
   "handler": {
     "export": "AIGatewayFallbackModelInboundPolicy",

package/docs/policies/ai-gateway-galileo-tracing-inbound/doc.md

@@ -18,7 +18,7 @@ traces:
 
 ```json
 {
-  "name": "galileo-tracing-v2-inbound",
+  "name": "ai-gateway-galileo-tracing-inbound",
   "policyType": "ai-gateway-galileo-tracing",
   "handler": {
     "export": "AIGatewayGalileoTracingInboundPolicy",

package/docs/policies/ai-gateway-internal-only-inbound/doc.md

@@ -44,15 +44,15 @@ Declare the policy in `config/policies.json`:
 ```
 
 Then select it in the application's `inboundPolicyChain` in place of
-`ai-gateway-auth-v2-inbound`. Put it first so nothing else runs for a rejected
+`ai-gateway-auth-inbound`. Put it first so nothing else runs for a rejected
 request:
 
 ```json
 {
   "inboundPolicyChain": [
     { "name": "ai-gateway-internal-only-inbound" },
-    { "name": "ai-gateway-model-filtering-v2-inbound" },
-    { "name": "ai-gateway-metering-v2-inbound" }
+    { "name": "ai-gateway-model-filtering-inbound" },
+    { "name": "ai-gateway-metering-inbound" }
   ]
 }
 ```

package/docs/policies/ai-gateway-metering-inbound/doc.md

@@ -21,7 +21,7 @@ Semantic Cache so cache hits count toward request limits.
 
 ```json
 {
-  "name": "ai-gateway-metering-v2-inbound",
+  "name": "ai-gateway-metering-inbound",
   "options": {
     "throwOnFailure": false,
     "budgetRules": [

package/docs/policies/ai-gateway-model-filtering-inbound/doc.md

@@ -107,7 +107,7 @@ capability to add.
 
 ```json
 {
-  "name": "ai-gateway-model-filtering-v2-inbound",
+  "name": "ai-gateway-model-filtering-inbound",
   "policyType": "ai-gateway-model-filtering",
   "handler": {
     "export": "AIGatewayModelFilteringInboundPolicy",

package/docs/policies/ai-gateway-opik-tracing-inbound/doc.md

@@ -21,7 +21,7 @@ chain that should emit traces:
 
 ```json
 {
-  "name": "comet-opik-tracing-v2-inbound",
+  "name": "ai-gateway-opik-tracing-inbound",
   "policyType": "ai-gateway-opik-tracing",
   "handler": {
     "export": "AIGatewayOpikTracingInboundPolicy",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zuplo",
-  "version": "7.8.25",
+  "version": "7.9.3",
   "type": "module",
   "description": "The official Zuplo CLI for local development and platform management",
   "homepage": "https://zuplo.com/docs/cli/overview",
@@ -32,9 +32,9 @@
     "zuplo": "zuplo.js"
   },
   "dependencies": {
-    "@zuplo/cli": "7.8.25",
-    "@zuplo/core": "7.8.25",
-    "@zuplo/runtime": "7.8.25",
-    "@zuplo/test": "7.8.25"
+    "@zuplo/cli": "7.9.3",
+    "@zuplo/core": "7.9.3",
+    "@zuplo/runtime": "7.9.3",
+    "@zuplo/test": "7.9.3"
   }
 }