@maxceem/agw 0.15.1 → 0.16.0

package/dist/agw.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.15.1", wrangler: "4.96.0", upgradeFrom: ["0.15.1", "0.15.0", "0.14.0", "0.13.1", "0.13.0", "0.12.1", "0.12.0", "0.11.2", "0.11.1", "0.11.0", "0.10.11", "0.10.10", "0.10.9", "0.10.8", "0.10.7", "0.10.6", "0.10.5", "0.10.4", "0.10.3", "0.10.2", "0.10.1", "0.10.0", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.3", "0.8.2", "0.8.1", "0.8.0", "0.7.2", "0.7.1", "0.7.0", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.15.1/gateway-0.15.1.tar.gz", sha256: "b5938517a50f09ea3ce3f966efd949dde8e9f0f2c195d47bb0dfdcbc7ec8eda0", manifest: "888f171f040d7547b37c40b41c01a53d1f284c9671e0bdc98083e9474c4ecdab" } };
+var define_AGW_MANIFEST_default = { version: "0.16.0", wrangler: "4.96.0", upgradeFrom: ["0.16.0", "0.15.1", "0.15.0", "0.14.0", "0.13.1", "0.13.0", "0.12.1", "0.12.0", "0.11.2", "0.11.1", "0.11.0", "0.10.11", "0.10.10", "0.10.9", "0.10.8", "0.10.7", "0.10.6", "0.10.5", "0.10.4", "0.10.3", "0.10.2", "0.10.1", "0.10.0", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.3", "0.8.2", "0.8.1", "0.8.0", "0.7.2", "0.7.1", "0.7.0", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.16.0/gateway-0.16.0.tar.gz", sha256: "222ce0c030268e5b1468c5d1755d8ea7d6da0ce86d9a0229e0adf5eb5eab4850", manifest: "1ecdc82e5705b259f5eed20bc58348fa9bcd36686f177d5040b3544ea09ba920" } };
 
 // src/main.ts
 import { Writable as Writable2 } from "node:stream";
@@ -20585,6 +20585,7 @@ var ISSUER_PROVIDERS = ["firebase", "supabase", "auth0", "clerk", "custom"];
 var ENTITLEMENT_CHECKS = ["revenuecat", "custom"];
 var APP_ATTEST_ENVIRONMENTS = ["production", "development"];
 var APP_ATTEST_VERIFY_ON = ["every_request", "token_exchange"];
+var MAX_APP_TRANSACTION_LENGTH = 16384;
 var ENDPOINT_SLUG = /^[a-z0-9-]{1,64}$/;
 var PROVIDER_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
 var HTTP_FIELD_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
@@ -20818,11 +20819,11 @@ var LimitScopeSchema = external_exports.object({
   }).strict(),
   spending: external_exports.object({ monthly_usd: NullableSpendLimit }).strict()
 }).strict();
-var BUDGET_SCOPES = ["install", "user"];
+var BUDGET_SCOPES = ["install", "user", "apple_account"];
 var PerUserLimitScopeSchema = LimitScopeSchema.extend({
   spending: LimitScopeSchema.shape.spending.extend({
     scope: external_exports.enum(BUDGET_SCOPES).optional().meta({
-      description: "Whose month monthly_usd is measured over: install (the default on App Attest applications) or user (the default, and the only value, on server applications). user on an App Attest application needs authentication.end_user.source issuer. Filled in on every parsed configuration."
+      description: "Whose month monthly_usd is measured over: apple_account (the default on App Attest applications), install, or user (the default, and the only value, on server applications). apple_account counts every install of one Apple Account together, across devices and reinstalls; an install whose client sent no verifiable App Store transaction is counted on its own, as under install. user on an App Attest application needs authentication.end_user.source issuer. Filled in on every parsed configuration."
     })
   }).strict()
 }).strict();
@@ -20901,25 +20902,25 @@ var AppConfigSchema = external_exports.object({
   }
   const budgetScope = perUser?.spending.scope;
   if (authentication !== void 0 && budgetScope !== void 0) {
-    if (authentication.type === "api_key" && budgetScope === "install") {
+    if (authentication.type === "api_key" && budgetScope !== "user") {
       context.addIssue({
         code: "custom",
         path: ["limits", "per_user", "spending", "scope"],
-        message: "cannot be install: server applications have no install; the budget is per user"
+        message: `cannot be ${budgetScope}: server applications have no install or Apple Account; the budget is per user`
       });
     }
     if (authentication.type === "apple_app_attest" && budgetScope === "user" && authentication.end_user.source !== "issuer") {
       context.addIssue({
         code: "custom",
         path: ["limits", "per_user", "spending", "scope"],
-        message: "can be user only when authentication.end_user.source is issuer: under app_install every install is its own user, so use install"
+        message: "can be user only when authentication.end_user.source is issuer: under app_install every install is its own user, so use apple_account to count one person's installs together, or install"
       });
     }
   }
 }).overwrite((config2) => {
   const spending = config2.limits.per_user.spending;
   if (spending.scope === void 0) {
-    spending.scope = config2.authentication.type === "apple_app_attest" ? "install" : "user";
+    spending.scope = config2.authentication.type === "apple_app_attest" ? "apple_account" : "user";
   }
   return config2;
 }).meta({ id: "AppConfig" });
@@ -20961,7 +20962,10 @@ var AppAttestTokenRequestSchema = external_exports.object({
   issuer_token: external_exports.string().min(1).optional(),
   key_id: AppAttestKeyIdSchema,
   assertion: external_exports.string().min(1),
-  challenge: ChallengeSchema
+  challenge: ChallengeSchema,
+  app_transaction: external_exports.string().min(1).max(MAX_APP_TRANSACTION_LENGTH).optional().meta({
+    description: "The App Store's signed AppTransaction (its JWS), which names the Apple Account the install belongs to. When present, the assertion signs client data that also carries app_transaction: the unpadded base64url SHA-256 of this string. One that does not verify against Apple's root names no account, and the install is counted on its own."
+  })
 }).meta({ id: "AppAttestTokenRequest" });
 var ApiKeyTokenRequestSchema = external_exports.object({
   issuer_token: external_exports.string().min(1),
@@ -22823,7 +22827,7 @@ var REJECTION_REASONS = [
   /** An App Attest assertion whose counter the install had already used. */
   "blocked_replay"
 ];
-var REJECTION_SCOPES = ["user", "install", "app", "account"];
+var REJECTION_SCOPES = ["user", "install", "apple_account", "app", "account"];
 
 // ../src/contracts/billing.ts
 var BillingSubscriptionStatusSchema = external_exports.enum([
@@ -23044,7 +23048,10 @@ var GoogleSignInResponseSchema = external_exports.object({
 });
 var AppAttestChallengeResponseSchema = external_exports.object({
   challenge: external_exports.string(),
-  expires_in: external_exports.number()
+  expires_in: external_exports.number(),
+  accepts_app_transaction: external_exports.boolean().optional().meta({
+    description: "True when the token exchange accepts app_transaction, the App Store's signed AppTransaction. A client sends one, and signs over its hash, only when this says so: a gateway that predates it would ignore the field and then refuse the assertion."
+  })
 });
 var AppAttestRegisterResponseSchema = external_exports.object({ user_id: external_exports.string() });
 var GatewayTokenResponseSchema = external_exports.object({
@@ -23064,8 +23071,9 @@ var CurrentUserResponseSchema = external_exports.object({
     requests_remaining: external_exports.number().int().nullable().meta({ description: "What is left of requests_per_day. Null when no daily limit is set." }),
     requests_per_minute: external_exports.number().nullable().meta({ description: "The per-minute limit this app sets on each install (App Attest) or user (server). Null means unlimited." }),
     requests_per_day: external_exports.number().nullable().meta({ description: "The per-day limit this app sets on each install (App Attest) or user (server). Null means unlimited." }),
-    monthly_cost_usd: external_exports.number().meta({ description: "What has been spent so far in the current UTC calendar month against the budget below: by this install, or by this user when the budget's scope is user." }),
-    monthly_budget_usd: external_exports.number().nullable().meta({ description: "The monthly spending budget this app sets on each install or user, per limits.per_user.spending.scope. Null means unlimited." }),
+    monthly_cost_usd: external_exports.number().meta({ description: "What has been spent so far in the current UTC calendar month against the budget below, by whoever budget_scope names." }),
+    monthly_budget_usd: external_exports.number().nullable().meta({ description: "The monthly spending budget this app sets on each Apple Account, install or user, per limits.per_user.spending.scope. Null means unlimited." }),
+    budget_scope: external_exports.enum(BUDGET_SCOPES).meta({ description: "Whose month monthly_cost_usd is: apple_account (every install of this person's Apple Account together), install (this install alone), or user (this signed-in or backend-named user). Usually the app's limits.per_user.spending.scope; install where that is apple_account but this install's client sent no verifiable App Store transaction." }),
     blocked: external_exports.boolean().meta({ description: "Whether this user has been blocked in the console." })
   }).meta({
     description: "The limits the app sets on this user, and where the user stands against them. The account's request allowance is not reported here: it is shared by all apps, and is reported on the rejection that spends it."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxceem/agw",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "type": "module",
   "description": "Manage App AI Gateway from a terminal or coding agent: providers, iOS and server apps, usage, and self-hosted deployment on Cloudflare",
   "keywords": [
@@ -26,6 +26,7 @@
   },
   "bugs": "https://github.com/maxceem/app-ai-gateway/issues",
   "upgradeFrom": [
+    "0.15.1",
     "0.15.0",
     "0.14.0",
     "0.13.1",