@bymax-one/nest-ai-tokens 1.1.1 → 1.1.2

package/CHANGELOG.md

@@ -6,6 +6,35 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and
 
 ---
 
+## [Unreleased]
+
+## [1.1.2] - 2026-10-30
+
+### Fixed
+
+- **`PricingService.resolveRate` no longer serves one request's price to another.** The
+  resolution cache key joined provider, model, baseModel, operation, tier and time bucket
+  with `|`, which can also appear inside a model id. Two different requests could spell the
+  same key — `model: 'b|c'` with no `baseModel` against `model: 'b'` with `baseModel: 'c|'` —
+  and the second received the first's rate from the cache. The key is now a JSON array of
+  the fields, so no value can move the boundary between them. (#117)
+
+  **Apply:** no action required. Requests whose model names contain `|` now resolve their
+  own price instead of a colliding entry's.
+
+### Security
+
+- Advisories on transitive **dev** packages are cleared through `pnpm-workspace.yaml`
+  overrides: body-parser, multer, qs and zod (#115). deepmerge GHSA-gcqx-w48m-w2h4 has no
+  patched release and is reached only through `jest-config`, so it is ignored in
+  `osv-scanner.toml` until 2027-01-27. None of these reach a consumer install: the package
+  has no runtime dependencies.
+
+### Documentation
+
+- `SECURITY.md`: only the latest minor line (1.1.x) receives security fixes; 1.0.x is
+  unsupported and consumers should upgrade.
+
 ## [1.1.1] - 2026-10-23
 
 ### Fixed
@@ -62,7 +91,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and
 
 ## [1.0.4] - 2026-08-10
 
-Remediation of a local audit's settlement findings (merged in #65). No API changed.
+Remediation of a local audit's settlement findings (merged in #65). No API changes.
 
 ### Fixed
 
@@ -267,7 +296,8 @@ have regressed from. They are kept because the reasoning is worth having.
 [1.0.1]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.0...v1.0.1
 [1.0.2]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.1...v1.0.2
 [1.1.0]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.4...v1.1.0
+[1.1.2]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.1.1...v1.1.2
 [1.1.1]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.1.0...v1.1.1
 [1.0.4]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.3...v1.0.4
 [1.0.3]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.0.2...v1.0.3
-[Unreleased]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.1.1...HEAD
+[Unreleased]: https://github.com/bymaxone/nest-ai-tokens/compare/v1.1.2...HEAD

package/dist/server/index.cjs

@@ -1224,7 +1224,7 @@ exports.PricingService = class PricingService {
     const serviceTier = input.serviceTier ?? "standard";
     const operation = input.operation === "responses" ? "chat" : input.operation;
     const bucket = Math.floor(input.at.getTime() / this.options.pricing.cacheTtlMs);
-    const cacheKey = `${input.provider}|${input.model}|${input.baseModel ?? ""}|${operation}|${serviceTier}|${String(bucket)}`;
+    const cacheKey = JSON.stringify([input.provider, input.model, input.baseModel, operation, serviceTier, bucket]);
     let resolved;
     const cached = this.cache.get(cacheKey);
     if (cached !== void 0 && this.now() < cached.expiresAt) {
@@ -2775,10 +2775,10 @@ exports.WalletService = class WalletService {
   options;
   events;
   /**
-   * The current balance, excluding not-yet-effective and expired grants (§9.2).
-   * Reads the materialized balance; expiry is applied lazily on debit, so a grant
-   * that lapses purely with the passage of time is reflected at the next debit or
-   * `reconcile` (the documented §9.3 lazy-materialization trade-off).
+   * The current balance (§9.2). Reads the materialized balance; expiry is applied
+   * lazily on debit, so a grant that lapses purely with the passage of time is still
+   * counted until the next debit or `reconcile` (the documented §9.3
+   * lazy-materialization trade-off).
    *
    * @param ref The wallet owner (a `'tenant' | 'team' | 'user'`, never `'key'`).
    * @returns The nano-USD balance and its presentation credits.
@@ -2965,7 +2965,7 @@ exports.WalletService = class WalletService {
    * `ai_tokens.audit`.
    *
    * @param ref The wallet owner.
-   * @returns The reconciled wallet.
+   * @returns The reconciled nano-USD balance and its presentation credits.
    */
   async reconcile(ref) {
     this.assertOwner(ref);

package/dist/server/index.d.cts

@@ -2224,10 +2224,10 @@ declare class WalletService {
      */
     constructor(store: IWalletStore, options: WalletServiceOptions, events?: WalletEventHooks);
     /**
-     * The current balance, excluding not-yet-effective and expired grants (§9.2).
-     * Reads the materialized balance; expiry is applied lazily on debit, so a grant
-     * that lapses purely with the passage of time is reflected at the next debit or
-     * `reconcile` (the documented §9.3 lazy-materialization trade-off).
+     * The current balance (§9.2). Reads the materialized balance; expiry is applied
+     * lazily on debit, so a grant that lapses purely with the passage of time is still
+     * counted until the next debit or `reconcile` (the documented §9.3
+     * lazy-materialization trade-off).
      *
      * @param ref The wallet owner (a `'tenant' | 'team' | 'user'`, never `'key'`).
      * @returns The nano-USD balance and its presentation credits.
@@ -2306,7 +2306,7 @@ declare class WalletService {
      * `ai_tokens.audit`.
      *
      * @param ref The wallet owner.
-     * @returns The reconciled wallet.
+     * @returns The reconciled nano-USD balance and its presentation credits.
      */
     reconcile(ref: WalletRef): Promise<WalletBalance>;
     /** Append a non-debit entry, mapping a store idempotency/missing-wallet signal to the catalog. */
@@ -3119,7 +3119,7 @@ declare class MeteringInterceptor implements NestInterceptor {
  * @fileoverview The controller-level metering/enforcement decorators (spec §11.4).
  * `@Meter` marks a handler for the `MeteringInterceptor` and is metadata-only
  * here; `@RequireBudget` marks it for the `BudgetGuard`; `@AiFeature`
- * is a lightweight feature tag. Each stores its config under an exported symbol key
+ * is a lightweight feature tag. Each stores its config under an exported string key
  * that the guard/interceptor read via the NestJS `Reflector`. Feature precedence is
  * `@RequireBudget.feature` > `@Meter.feature` > `@AiFeature` (§11.4). These are pure
  * metadata; they never touch a wallet, budget, or the request.

package/dist/server/index.d.ts

@@ -2224,10 +2224,10 @@ declare class WalletService {
      */
     constructor(store: IWalletStore, options: WalletServiceOptions, events?: WalletEventHooks);
     /**
-     * The current balance, excluding not-yet-effective and expired grants (§9.2).
-     * Reads the materialized balance; expiry is applied lazily on debit, so a grant
-     * that lapses purely with the passage of time is reflected at the next debit or
-     * `reconcile` (the documented §9.3 lazy-materialization trade-off).
+     * The current balance (§9.2). Reads the materialized balance; expiry is applied
+     * lazily on debit, so a grant that lapses purely with the passage of time is still
+     * counted until the next debit or `reconcile` (the documented §9.3
+     * lazy-materialization trade-off).
      *
      * @param ref The wallet owner (a `'tenant' | 'team' | 'user'`, never `'key'`).
      * @returns The nano-USD balance and its presentation credits.
@@ -2306,7 +2306,7 @@ declare class WalletService {
      * `ai_tokens.audit`.
      *
      * @param ref The wallet owner.
-     * @returns The reconciled wallet.
+     * @returns The reconciled nano-USD balance and its presentation credits.
      */
     reconcile(ref: WalletRef): Promise<WalletBalance>;
     /** Append a non-debit entry, mapping a store idempotency/missing-wallet signal to the catalog. */
@@ -3119,7 +3119,7 @@ declare class MeteringInterceptor implements NestInterceptor {
  * @fileoverview The controller-level metering/enforcement decorators (spec §11.4).
  * `@Meter` marks a handler for the `MeteringInterceptor` and is metadata-only
  * here; `@RequireBudget` marks it for the `BudgetGuard`; `@AiFeature`
- * is a lightweight feature tag. Each stores its config under an exported symbol key
+ * is a lightweight feature tag. Each stores its config under an exported string key
  * that the guard/interceptor read via the NestJS `Reflector`. Feature precedence is
  * `@RequireBudget.feature` > `@Meter.feature` > `@AiFeature` (§11.4). These are pure
  * metadata; they never touch a wallet, budget, or the request.

package/dist/server/index.mjs

@@ -1222,7 +1222,7 @@ var PricingService = class {
     const serviceTier = input.serviceTier ?? "standard";
     const operation = input.operation === "responses" ? "chat" : input.operation;
     const bucket = Math.floor(input.at.getTime() / this.options.pricing.cacheTtlMs);
-    const cacheKey = `${input.provider}|${input.model}|${input.baseModel ?? ""}|${operation}|${serviceTier}|${String(bucket)}`;
+    const cacheKey = JSON.stringify([input.provider, input.model, input.baseModel, operation, serviceTier, bucket]);
     let resolved;
     const cached = this.cache.get(cacheKey);
     if (cached !== void 0 && this.now() < cached.expiresAt) {
@@ -2773,10 +2773,10 @@ var WalletService = class {
   options;
   events;
   /**
-   * The current balance, excluding not-yet-effective and expired grants (§9.2).
-   * Reads the materialized balance; expiry is applied lazily on debit, so a grant
-   * that lapses purely with the passage of time is reflected at the next debit or
-   * `reconcile` (the documented §9.3 lazy-materialization trade-off).
+   * The current balance (§9.2). Reads the materialized balance; expiry is applied
+   * lazily on debit, so a grant that lapses purely with the passage of time is still
+   * counted until the next debit or `reconcile` (the documented §9.3
+   * lazy-materialization trade-off).
    *
    * @param ref The wallet owner (a `'tenant' | 'team' | 'user'`, never `'key'`).
    * @returns The nano-USD balance and its presentation credits.
@@ -2963,7 +2963,7 @@ var WalletService = class {
    * `ai_tokens.audit`.
    *
    * @param ref The wallet owner.
-   * @returns The reconciled wallet.
+   * @returns The reconciled nano-USD balance and its presentation credits.
    */
   async reconcile(ref) {
     this.assertOwner(ref);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-ai-tokens",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "AI token metering & usage-based billing for NestJS 11: provider usage normalizer (×9), versioned effective-dated pricing, immutable append-only ledger, prepaid wallets, multi-dimension budgets, and markup/margin. Zero runtime dependencies.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",