@maxceem/agw 0.10.2 → 0.10.3

package/dist/agw.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.10.2", wrangler: "4.96.0", upgradeFrom: ["0.10.2", "0.10.1", "0.10.0", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.3", "0.8.2", "0.8.1", "0.8.0", "0.7.2", "0.7.1", "0.7.0", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.10.2/gateway-0.10.2.tar.gz", sha256: "0bc86a42bb5848b2448125fff408823a29bd0bd437a99dbe5cda4e101bd8f1df", manifest: "c1080e9a4f4f8abdb7a9df13b54c0bb245b7da9154127ebee755635d161da5b5" } };
+var define_AGW_MANIFEST_default = { version: "0.10.3", wrangler: "4.96.0", upgradeFrom: ["0.10.3", "0.10.2", "0.10.1", "0.10.0", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.3", "0.8.2", "0.8.1", "0.8.0", "0.7.2", "0.7.1", "0.7.0", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.10.3/gateway-0.10.3.tar.gz", sha256: "b8e9bb10961adf632a91673184d735d96c4b3d38a3922dba9d40f4cf52498064", manifest: "c3bda774e4de9ea4accbd7a9734fd77ef40e7730fa77b758d75ea9dfe10a05e2" } };
 
 // src/main.ts
 import { Writable as Writable2 } from "node:stream";
@@ -15383,7 +15383,7 @@ var IssuerAuthenticationSchema = external_exports.object({
   audience: IssuerClaimValuesSchema,
   user_id_claim: external_exports.string().min(1),
   /** Lowercased, because header lookups ignore case. */
-  token_header: external_exports.string().min(1).toLowerCase().optional(),
+  token_header: external_exports.string().min(1).toLowerCase().superRefine(refuseReservedHeader).optional(),
   required_claims: external_exports.array(ClaimRequirementSchema),
   max_token_lifetime_seconds: external_exports.number().int().positive(),
   /**
@@ -15399,22 +15399,25 @@ var IssuerAuthenticationSchema = external_exports.object({
   provider: external_exports.enum(ISSUER_PROVIDERS).optional(),
   entitlement: external_exports.enum(ENTITLEMENT_CHECKS).optional()
 }).strict();
-var RESERVED_END_USER_HEADERS = /* @__PURE__ */ new Set([
+var RESERVED_APP_HEADERS = /* @__PURE__ */ new Set([
   "authorization",
+  "cookie",
+  "x-appattest-proof",
   ...PROVIDER_CREDENTIAL_HEADERS,
   "x-app-version",
   "content-type",
   "content-length",
   "host"
 ]);
-var EndUserHeaderSchema = external_exports.string().trim().toLowerCase().min(1).max(64).regex(HTTP_FIELD_NAME, { error: "must be a valid HTTP header name" }).superRefine((header, context) => {
-  if (RESERVED_END_USER_HEADERS.has(header)) {
+function refuseReservedHeader(header, context) {
+  if (RESERVED_APP_HEADERS.has(header)) {
     context.addIssue({
       code: "custom",
       message: `cannot be ${header}: the gateway already uses that header`
     });
   }
-});
+}
+var EndUserHeaderSchema = external_exports.string().trim().toLowerCase().min(1).max(64).regex(HTTP_FIELD_NAME, { error: "must be a valid HTTP header name" }).superRefine(refuseReservedHeader);
 var HeaderEndUserSchema = external_exports.object({
   source: external_exports.literal("header"),
   header: EndUserHeaderSchema
@@ -18585,6 +18588,7 @@ var ISSUER_ERRORS = {
   403: "`issuer_token_rejected` \u2014 the token did not verify; get a fresh one, retry once, then fail. `issuer_claims_missing` \u2014 the token is valid but a required entitlement claim has not propagated yet; do not re-authenticate, wait and retry. `auth_required` \u2014 the key was refused or the user is blocked. `attest_failed` \u2014 the App Attest proof did not hold.",
   503: "`issuer_verification_unavailable` \u2014 the gateway could not reach or read the issuer's keys, so the token was never judged. Retry with backoff."
 };
+var SERVICE_UNAVAILABLE = "`service_unavailable` \u2014 the gateway's database or one of its Durable Objects failed or was overloaded, or the call ran past its ten-second deadline. Nothing about the request is known to be wrong. Carries Retry-After; retry after it with backoff.";
 var CLI_ERRORS = {
   409: "A conflicting transition or setup cap prevents this operation.",
   410: "The protected credential exchange has expired; no replacement is minted.",
@@ -18723,7 +18727,7 @@ var CATALOG = {
     params: APP_PARAM,
     response: AppAttestChallengeResponseSchema,
     responseDescription: "A five-minute, single-use challenge.",
-    errors: { 402: NO_PLAN, 429: APP_AUTH_RATE_LIMITED, 404: NO_END_USERS }
+    errors: { 402: NO_PLAN, 429: APP_AUTH_RATE_LIMITED, 404: NO_END_USERS, 503: SERVICE_UNAVAILABLE }
   },
   registerAppAttestKey: {
     method: "POST",
@@ -18735,7 +18739,12 @@ var CATALOG = {
     request: AppAttestRegisterRequestSchema,
     response: AppAttestRegisterResponseSchema,
     responseDescription: "The key was registered for the verified issuer identity.",
-    errors: { ...ISSUER_ERRORS, 402: NO_PLAN, 429: APP_AUTH_RATE_LIMITED }
+    errors: {
+      ...ISSUER_ERRORS,
+      402: NO_PLAN,
+      429: APP_AUTH_RATE_LIMITED,
+      503: `${ISSUER_ERRORS[503]} ${SERVICE_UNAVAILABLE}`
+    }
   },
   exchangeGatewayToken: {
     method: "POST",
@@ -18748,7 +18757,12 @@ var CATALOG = {
     request: external_exports.union([AppAttestTokenRequestSchema, ApiKeyTokenRequestSchema]),
     response: GatewayTokenResponseSchema,
     responseDescription: "A short-lived gateway access token.",
-    errors: { ...ISSUER_ERRORS, 402: NO_PLAN, 429: APP_AUTH_RATE_LIMITED }
+    errors: {
+      ...ISSUER_ERRORS,
+      402: NO_PLAN,
+      429: APP_AUTH_RATE_LIMITED,
+      503: `${ISSUER_ERRORS[503]} ${SERVICE_UNAVAILABLE}`
+    }
   },
   getCurrentUser: {
     method: "GET",
@@ -18761,7 +18775,7 @@ var CATALOG = {
     headers: GatewayClientHeadersSchema,
     response: CurrentUserResponseSchema,
     responseDescription: "Current user state.",
-    errors: { 402: NO_PLAN, 404: NO_END_USERS }
+    errors: { 402: NO_PLAN, 404: NO_END_USERS, 503: SERVICE_UNAVAILABLE }
   },
   proxyProviderRequest: {
     method: "POST",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxceem/agw",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "type": "module",
   "description": "Manage App AI Gateway from a terminal or coding agent: providers, iOS and server apps, usage, and self-hosted deployment on Cloudflare",
   "keywords": [
@@ -26,6 +26,7 @@
   },
   "bugs": "https://github.com/maxceem/app-ai-gateway/issues",
   "upgradeFrom": [
+    "0.10.2",
     "0.10.1",
     "0.10.0",
     "0.9.3",