@maxceem/agw 0.8.2 → 0.9.0

package/dist/agw.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.8.2", wrangler: "4.96.0", upgradeFrom: ["0.8.2", "0.8.1", "0.8.0", "0.7.2", "0.7.1", "0.7.0", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.8.2/gateway-0.8.2.tar.gz", sha256: "5803faddaa1c7330e20f465f1b1eb3765dd47d9c38316a60dc75ea92940e6227", manifest: "e49440871e4f8ae1942c8c1f216b0ce8230a15a17bd5c87be0becb4af531eaeb" } };
+var define_AGW_MANIFEST_default = { version: "0.9.0", wrangler: "4.96.0", upgradeFrom: ["0.9.0", "0.8.3", "0.8.2", "0.8.1", "0.8.0", "0.7.2", "0.7.1", "0.7.0", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.9.0/gateway-0.9.0.tar.gz", sha256: "9080326d72cb3541bd3995058a9ce4c10753eb9fd8cf9e9404c5905bc57288ce", manifest: "b2684dd1c5528f707723d2383b641bb917baa84e2a2164b020fd99dc6c20a63b" } };
 
 // src/main.ts
 import { Writable as Writable2 } from "node:stream";
@@ -15678,6 +15678,15 @@ var OAuthConsentAllowRequestSchema = external_exports.object({
     description: "How much of the person's role the connection may use, whatever the client asked for."
   })
 }).strict();
+var ConsoleReturnPathSchema = external_exports.string().max(512).regex(/^\/(?![/\\])[^\\\s]*$/, "Must be a path on the console, beginning with a single /").meta({ description: "A path on the console to return to once the address is verified, such as an approval page." });
+var SendVerificationEmailRequestSchema = external_exports.object({
+  returnTo: ConsoleReturnPathSchema.optional()
+}).strict();
+var ConfirmEmailVerificationRequestSchema = external_exports.object({
+  token: external_exports.string().min(1).max(2048).meta({
+    description: "The `token` query parameter of the link in the verification email."
+  })
+}).strict();
 
 // src/common.ts
 import { randomBytes } from "node:crypto";
@@ -17122,7 +17131,7 @@ ${snippet}`;
         ...snippet ? { snippet } : {},
         app: app2,
         ...key ? { applicationKey: key } : {},
-        guidance: doc.config.authentication.type === "apple_app_attest" ? `Add https://github.com/maxceem/app-ai-gateway-swift from 1.4.1, enable App Attest, and test on a supported physical device. Run agw app snippet ${app2.id} --provider <slug> for integration code. Production releases should use production-only App Attest.` : `Store the generated key on your server; never embed it in a mobile application. Run agw app snippet ${app2.id} for this request again.`
+        guidance: doc.config.authentication.type === "apple_app_attest" ? `Add https://github.com/maxceem/app-ai-gateway-swift from 1.5.0, enable App Attest, and test on a supported physical device. Run agw app snippet ${app2.id} --provider <slug> for integration code. Production releases should use production-only App Attest.` : `Store the generated key on your server; never embed it in a mobile application. Run agw app snippet ${app2.id} for this request again.`
       };
     }
   }
@@ -17395,7 +17404,14 @@ var ErrorResponseSchema = external_exports.object({
 var HealthResponseSchema = external_exports.object({
   ok: external_exports.literal(true),
   service: external_exports.literal("app-ai-gateway"),
-  vault: external_exports.enum(["ok", "misconfigured"])
+  vault: external_exports.enum(["ok", "misconfigured"]),
+  /**
+   * Whether this deployment verifies email addresses: `off` with no way to
+   * send email configured, `ok` with Cloudflare Email Service or SMTP ready to
+   * send, `misconfigured` with one that cannot send yet (a setting missing or
+   * contradictory), where verification is required and no link can be sent.
+   */
+  email: external_exports.enum(["off", "ok", "misconfigured"])
 });
 var ConsoleCapabilitiesResponseSchema = external_exports.object({
   billing: external_exports.boolean(),
@@ -17403,7 +17419,13 @@ var ConsoleCapabilitiesResponseSchema = external_exports.object({
   googleAuth: external_exports.boolean(),
   termsOfServiceUrl: external_exports.string().url().optional(),
   privacyPolicyUrl: external_exports.string().url().optional(),
-  apiBaseUrl: external_exports.string().url().optional()
+  apiBaseUrl: external_exports.string().url().optional(),
+  /**
+   * Whether this deployment verifies email addresses. Where it does, an
+   * account's apps serve requests only once its owner has verified theirs, and
+   * the console offers the link to do it.
+   */
+  emailVerification: external_exports.boolean()
 });
 var GoogleSignInResponseSchema = external_exports.object({
   url: external_exports.url().meta({ description: "Provider authorization URL for the browser to navigate to." }),
@@ -17823,7 +17845,14 @@ var IdentitySessionSchema = external_exports.object({
       kind: external_exports.enum(["human", "service"]),
       credentialId: external_exports.string().nullable(),
       actionSource: external_exports.string()
-    }).nullable()
+    }).nullable(),
+    /**
+     * Whether this account's apps refuse requests with `email_unverified`
+     * right now: the deployment verifies addresses, the account is not
+     * activated, and no owner of it has verified theirs. False wherever
+     * traffic is served, an unverified owner of an activated account included.
+     */
+    verificationPending: external_exports.boolean()
   })
 });
 var OAuthConsentDetailsResponseSchema = external_exports.object({
@@ -17878,6 +17907,18 @@ var OAuthConsentRedirectResponseSchema = external_exports.object({
     description: "The client's redirect URI with `code`, `state` and `iss`, or with `error=access_denied` after a denial. Navigate the browser there."
   })
 });
+var SendVerificationEmailResponseSchema = external_exports.object({
+  status: external_exports.enum(["sent", "already_verified"]).meta({
+    description: "`sent` when a link went out now; `already_verified` when the address needs none."
+  }),
+  email: external_exports.string().meta({ description: "The address the link was sent to, or that is already verified." })
+});
+var ConfirmEmailVerificationResponseSchema = external_exports.object({
+  email: external_exports.string().meta({ description: "The address now verified." }),
+  returnTo: external_exports.string().nullable().meta({
+    description: "The console path the link was asked for from, to continue there; null for none."
+  })
+});
 var OrganizationListResponseSchema = external_exports.object({
   organizations: external_exports.array(OrganizationMembershipSchema)
 });
@@ -17938,7 +17979,10 @@ var AppCheckResponseSchema = external_exports.object({
     description: "Every provider instance the application's routing names, a disabled one included so that it shows as disabled rather than missing."
   }),
   ready: external_exports.boolean().meta({
-    description: "Whether the application is active and at least one provider it names is active."
+    description: "Whether the application is active, at least one provider it names is active, and the account may serve requests (`accountRefusal` is null)."
+  }),
+  accountRefusal: external_exports.enum(["email_unverified", "unclaimed_access_expired", "account_expired"]).nullable().meta({
+    description: "Why the account would refuse this application's requests, as the error code its clients would get, or null when it would serve them. `email_unverified`: the account's owner has not verified their email address yet, on a deployment that verifies them; it clears once they open the link in the verification email."
   }),
   limitations: external_exports.array(external_exports.string()).meta({
     description: "What this check did not exercise, one sentence each."
@@ -18198,7 +18242,13 @@ var CliApprovalRefusalSchema = external_exports.enum([
    * this deployment does not give a person one of their own. Nothing on the
    * page can fix that; an owner has to add them to an account first.
    */
-  "no_eligible_organization"
+  "no_eligible_organization",
+  /**
+   * A claim's approver has not verified their email address, on a deployment
+   * that verifies them. The page offers to send the link; the claim can be
+   * approved once it is opened.
+   */
+  "verification_required"
 ]);
 var CliViewerSchema = external_exports.object({
   name: external_exports.string().nullable(),
@@ -19525,6 +19575,43 @@ var CATALOG = {
     responseDescription: "The client's redirect URI with `error=access_denied`.",
     errors: CONSENT_ERRORS
   },
+  /*
+   * Email verification, on a deployment that sends email. Both are the
+   * console's own and run on its origin alone. Neither needs an account: the
+   * person approving a claim has none yet, and has to verify before the claim
+   * can complete.
+   */
+  sendVerificationEmail: {
+    method: "POST",
+    path: "/v1/console/email-verification/send",
+    tags: ["Console email verification"],
+    summary: "Email verification: send a link",
+    description: "Sends a verification link to the address of the person signed in to this browser, for their console session only. Where the deployment verifies email addresses, an account's apps serve requests only once its owner has verified theirs, and a claim completes only for a person who has; nothing else waits for it. A link lasts 24 hours, and a sign-up with a password sends the first one itself. Counted per person.",
+    security: "public",
+    request: SendVerificationEmailRequestSchema,
+    response: SendVerificationEmailResponseSchema,
+    responseDescription: "Whether a link went out, and to which address.",
+    errors: {
+      401: "No person is signed in to this browser (`session_required`).",
+      409: "This deployment does not verify email addresses, or the sign-in has no address of its own (`conflict`).",
+      429: "Too many links were sent for this sign-in. Carries Retry-After.",
+      503: "The deployment could not send the email (`email_unavailable`)."
+    }
+  },
+  confirmEmailVerification: {
+    method: "POST",
+    path: "/v1/console/email-verification/confirm",
+    tags: ["Console email verification"],
+    summary: "Email verification: confirm a link",
+    description: "Verifies the address a verification link was sent to. The link alone is the proof, so no sign-in is needed; it is bound to the sign-in and the address it was sent for, and stops working once it expires or the address changes. Confirming a link again answers the same.",
+    security: "public",
+    request: ConfirmEmailVerificationRequestSchema,
+    response: ConfirmEmailVerificationResponseSchema,
+    responseDescription: "The address verified, and where to continue.",
+    errors: {
+      400: "The link is malformed, has expired, or no longer matches the sign-in's address (`invalid_request`)."
+    }
+  },
   cliBrowserGoogle: {
     method: "POST",
     path: "/v1/cli/browser/{id}/google",
@@ -21958,6 +22045,11 @@ function operation(result, style2) {
     style2
   );
 }
+var ACCOUNT_REFUSALS = {
+  email_unverified: "refuses requests until its owner verifies their email (email_unverified)",
+  unclaimed_access_expired: "refuses requests until a person claims it (unclaimed_access_expired)",
+  account_expired: "refuses requests: its recovery deadline has passed (account_expired)"
+};
 function app(command, result, context, style2) {
   if ("output" in result) return [style2.headline(`Saved: ${result.output}`)];
   if ("ready" in result)
@@ -21969,7 +22061,9 @@ function app(command, result, context, style2) {
         [
           ["Status", result.status],
           ["Providers", result.providers.length],
-          ["Active providers", result.providers.filter((p) => p.status === "active").length]
+          ["Active providers", result.providers.filter((p) => p.status === "active").length],
+          // Absent from a gateway older than the field, which reports none.
+          ...result.accountRefusal ? [["Account", ACCOUNT_REFUSALS[result.accountRefusal]]] : []
         ],
         style2
       ),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxceem/agw",
-  "version": "0.8.2",
+  "version": "0.9.0",
   "type": "module",
   "description": "Manage App AI Gateway from a terminal or coding agent: providers, iOS and server apps, usage, and self-hosted deployment on Cloudflare",
   "keywords": [
@@ -26,6 +26,8 @@
   },
   "bugs": "https://github.com/maxceem/app-ai-gateway/issues",
   "upgradeFrom": [
+    "0.8.3",
+    "0.8.2",
     "0.8.1",
     "0.8.0",
     "0.7.2",