fix(demand-control): don't multiply field-level @cost by list size

[carodewig]

What

ROUTER-1978: a @cost directive declared directly on a list-returning field was being multiplied by the field's estimated/actual list size instead of charged once per call.

• apollo-federation/src/link/cost_spec_definition.rs: CostDirective now carries a CostDirectiveOrigin (Field or Type) recording whether a resolved @cost weight was declared directly on the field/argument, or inherited by falling back to @cost on the referenced type.
• apollo-router/src/plugins/demand_control/cost_calculator/static_cost.rs: score_field (estimated cost) and score_response_field (actual cost) now charge a field-level @cost once per call. Type-level @cost and the default per-kind weights are unaffected and continue to scale with list size, as in the existing documented examples.
• Added a field_level_cost_with_list_size_tests module in static_cost.rs covering: field-level @cost + @listSize with a free scalar child, the same with a weighted child, and a type-level-only case that guards against inverting the fix. New schema fixtures for these live in custom_cost_schema.graphql.
• Updated docs/source/routing/security/demand-control.mdx with a "Field-level cost vs. type-level cost" section and worked example.

Verified

• cargo fmt --all --check -- --config "imports_granularity=Item,group_imports=StdExternalCrate" passed
• cargo clippy -p apollo-federation -p apollo-router --all-targets -- -D warnings passed
• CHANGELOG.md not modified
• The new tests fail against the pre-fix scoring logic and pass against the fix (verified locally by temporarily reverting the scoring change)
• The existing demand-control test suite (117 tests) passes unchanged, including backward_compatibility_tests

[github-actions]

@carodewig, please consider creating a changeset entry in /.changesets/. These instructions describe the process and tooling.

[apollo-librarian]

✅ Docs preview ready

The preview is ready to be viewed. View the preview

File Changes

0 new, 1 changed, 0 removed

* graphos/routing/(latest)/security/demand-control.mdx

Build ID: 2d40349464cc48c40e8bd9a3
Build Logs: View logs

URL: https://www.apollographql.com/docs/deploy-preview/2d40349464cc48c40e8bd9a3

---

⚠️ AI Style Review — 3 Issues Found

Summary

This pull request updates the documentation for consistency and clarity. In the 'word-and-symbol-usage' section, numbers in CLI or code contexts are now formatted as numerals with code font, and references to 'above' in body text have been replaced with 'preceding'. 'Framing' changes involve switching to reader-centric language such as 'your schema' instead of the definite article. 'Language' updates include removing the idiom 'carries its own weight' to improve accessibility for non-native speakers. Regarding 'products-and-features', articles are no longer used before standalone product names like 'Apollo Router'. Finally, 'text-formatting' improvements include replacing 'above' with descriptive noun phrases for links and removing unnecessary italics for emphasis on the word 'type'.

Duration: 2347ms
Review Log: View detailed log

This review is AI-generated. Please use common sense when accepting these suggestions, as they may not always be accurate or appropriate for your specific context.