@tangle-network/agent-gateway 0.8.0 → 0.8.1

package/README.md

@@ -43,7 +43,8 @@ app.route('/v1/agents', createAgentGateway({
 }))
 ```
 
-`x402.verifySigner` is required for production.
+Production requires either `x402.verifySigner` or `verifyApiKey`.
+API-key-only apps can omit `x402` entirely.
 Set `x402.demoMode: true` only for local development and tests; that explicit mode also enables the built-in `sk_agent_*` demo key verifier.
 Keep `verifySigner` free of side effects.
 Use version 2's `authorizePayment` to reserve or claim funds after rate limits, content checks, and product authorization succeed.
@@ -109,6 +110,11 @@ The 0.7.1 `mpp.verifySigner` callback is also supported; the gateway derives a s
 The same authentication, authorization, rate-limit, filtering, sandbox, settlement, and usage-recording pipeline is used by the OpenAI-compatible and A2A endpoints.
 Wire protocol handlers only translate their request and response shapes.
 
+Set `conversationMode: 'thread'` when API calls must use the app's visible conversations.
+The gateway accepts an optional `X-Tangle-Thread-Id` and returns the resolved ID in the same response header.
+Its authenticated `getSandbox` context contains that thread ID, the API-key identity, and the filtered messages.
+An `agent-app` host can use this context to drive its normal persisted chat route instead of opening a second sandbox session.
+
 ## A2A protocol
 
 The gateway speaks Google's A2A protocol alongside its OpenAI-compatible surface: discovery via `.well-known/agent.json`, JSON-RPC 2.0 dispatch for `message/send`, `message/stream`, `tasks/get`, `tasks/cancel`, `tasks/resubscribe`, and the four `tasks/pushNotificationConfig/*` methods. Long-horizon agents — durable tasks across worker restarts, webhook delivery on terminal state, `input-required` pauses with multi-turn continuation — are documented in [`docs/a2a-long-horizon.md`](./docs/a2a-long-horizon.md).

package/dist/{chunk-MP6IIAIA.js → chunk-C7Z2BRYV.js}

@@ -357,6 +357,9 @@ function legacyMppPaymentIdentity(method, payload, credential) {
 function isApiKeyAuthEnabled(config) {
   return config.verifyApiKey !== void 0 || config.x402.demoMode === true;
 }
+function isX402AuthEnabled(config) {
+  return config.x402.verifySigner !== void 0 || config.x402.demoMode === true;
+}
 function isMppAuthEnabled(config) {
   const method = (config.mpp?.method ?? "blueprintevm").toLowerCase();
   if (!config.mpp) return false;
@@ -492,6 +495,17 @@ async function authenticateAndGuard(c, slug, messages, config, state, requestedM
   const requestId = generateRequestId();
   const ctx = { requestId, agentSlug: slug, startMs };
   await state.obs?.onRequestStart?.(ctx);
+  let threadId;
+  if (config.conversationMode === "thread") {
+    const requestedThreadId = c.req.header("X-Tangle-Thread-Id")?.trim();
+    if (requestedThreadId && !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(requestedThreadId)) {
+      return c.json(
+        { error: { message: "Invalid X-Tangle-Thread-Id", type: "invalid_request" } },
+        { status: 400, headers: { "X-Request-Id": requestId } }
+      );
+    }
+    threadId = requestedThreadId || requestId;
+  }
   const agent = await config.resolveAgent(slug);
   if (!agent || !agent.enabled) {
     return c.json({ error: { message: "Agent not found", type: "not_found" } }, 404);
@@ -519,7 +533,8 @@ async function authenticateAndGuard(c, slug, messages, config, state, requestedM
     messages,
     state.maxLen
   );
-  const userMessage = filtered.filter((m) => m.role === "user").map((m) => m.content).join("\n\n");
+  const userMessages = filtered.filter((m) => m.role === "user");
+  const userMessage = config.conversationMode === "thread" ? userMessages[userMessages.length - 1]?.content ?? "" : userMessages.map((m) => m.content).join("\n\n");
   if (!userMessage) {
     return c.json(
       { error: { message: "No user message provided", type: "invalid_request" } },
@@ -604,6 +619,12 @@ async function authenticateAndGuard(c, slug, messages, config, state, requestedM
   let mppCredential;
   let mppPaymentIdentity;
   if (spendAuthHeader) {
+    if (!isX402AuthEnabled(config)) {
+      return c.json(
+        { error: { message: "x402 authentication is not configured", type: "authentication_error" } },
+        { status: 401, headers: { "X-Request-Id": requestId } }
+      );
+    }
     const signer = await verifyX402(
       spendAuthHeader,
       config.x402,
@@ -729,7 +750,8 @@ async function authenticateAndGuard(c, slug, messages, config, state, requestedM
       code: "payment_required",
       httpStatus: 402
     });
-    const methods = ["x402"];
+    const methods = [];
+    if (isX402AuthEnabled(config)) methods.push("x402");
     if (isMppAuthEnabled(config)) methods.push("mpp");
     if (isApiKeyAuthEnabled(config)) methods.push("api_key");
     const headers = {
@@ -745,14 +767,16 @@ async function authenticateAndGuard(c, slug, messages, config, state, requestedM
           message: "Payment required",
           type: "payment_required",
           payment_methods: methods,
-          x402: {
-            operator: config.x402.operatorAddress,
-            chain_id: config.x402.chainId,
-            credits_address: config.x402.creditsAddress,
-            required_amount: requiredPaymentAmount.toString(),
-            currency_decimals: config.x402.currencyDecimals ?? 6,
-            max_output_tokens: maxOutputTokens
-          },
+          ...isX402AuthEnabled(config) ? {
+            x402: {
+              operator: config.x402.operatorAddress,
+              chain_id: config.x402.chainId,
+              credits_address: config.x402.creditsAddress,
+              required_amount: requiredPaymentAmount.toString(),
+              currency_decimals: config.x402.currencyDecimals ?? 6,
+              max_output_tokens: maxOutputTokens
+            }
+          } : {},
           ...isMppAuthEnabled(config) && config.mpp ? { mpp: { realm: config.mpp.realm, method: config.mpp.method ?? "blueprintevm" } } : {},
           ...isApiKeyAuthEnabled(config) ? {
             api_key: {
@@ -811,7 +835,8 @@ async function authenticateAndGuard(c, slug, messages, config, state, requestedM
       method: paymentMethod,
       consumerId,
       keyId: keyInfo?.keyId,
-      requestId
+      requestId,
+      ...threadId ? { threadId } : {}
     });
     if (!authz.allow) {
       return c.json(
@@ -834,6 +859,8 @@ async function authenticateAndGuard(c, slug, messages, config, state, requestedM
     userMessage,
     rateLimitRemaining: rl.remaining,
     requestId,
+    messages: filtered,
+    ...threadId ? { threadId } : {},
     startMs,
     maxOutputTokens,
     executionBudget,
@@ -1821,9 +1848,9 @@ function durableMppPaymentPayload(payload) {
 }
 
 // src/dispatch-sandbox.ts
-async function* dispatchSandboxStreamRich(agent, userMessage, consumerId, config, signal, sessionId, maxOutputTokens, onExecutionStart, requiresReceipt = config.x402.paymentOperations !== void 0, onSandboxStart, maxInputTokens, onExecutionHeartbeat) {
+async function* dispatchSandboxStreamRich(agent, userMessage, consumerId, config, signal, sessionId, maxOutputTokens, onExecutionStart, requiresReceipt = config.x402.paymentOperations !== void 0, onSandboxStart, maxInputTokens, onExecutionHeartbeat, sandboxContext) {
   if (signal?.aborted) return;
-  const box = await config.getSandbox(agent);
+  const box = await config.getSandbox(agent, sandboxContext);
   if (signal?.aborted) return;
   const outputLimit = maxOutputTokens ?? config.defaultOutputTokens ?? 1024;
   if (!Number.isSafeInteger(outputLimit) || outputLimit <= 0) {
@@ -5230,10 +5257,13 @@ function clone2(value) {
 
 // src/middleware.ts
 function createAgentGateway(inputConfig) {
-  let config = inputConfig;
-  if (!config.x402.verifySigner && !config.x402.demoMode) {
+  let config = inputConfig.x402 ? inputConfig : {
+    ...inputConfig,
+    x402: { operatorAddress: "", chainId: 0 }
+  };
+  if (!isX402AuthEnabled(config) && !config.verifyApiKey) {
     throw new Error(
-      "createAgentGateway: x402.verifySigner is required in production. For tests, set x402.demoMode: true explicitly."
+      "createAgentGateway: verifySigner is required in production unless verifyApiKey is configured; configure x402.verifySigner or verifyApiKey. For tests, set x402.demoMode: true explicitly."
     );
   }
   const maxOutputTokens = config.maxOutputTokens ?? 4096;
@@ -5334,14 +5364,15 @@ function createAgentGateway(inputConfig) {
     const slug = c.req.param("slug");
     const agent = await config.resolveAgent(slug);
     if (!agent || !agent.enabled) return c.json({ error: "Agent not found or not published" }, 404);
-    const paymentMethods = [
-      {
+    const paymentMethods = [];
+    if (isX402AuthEnabled(config)) {
+      paymentMethods.push({
         type: "x402",
         operator: config.x402.operatorAddress,
         chain_id: config.x402.chainId,
         credits_contract: config.x402.creditsAddress
-      }
-    ];
+      });
+    }
     if (isMppAuthEnabled(config)) {
       paymentMethods.push({
         type: "mpp",
@@ -5349,7 +5380,9 @@ function createAgentGateway(inputConfig) {
         method: config.mpp.method ?? "blueprintevm"
       });
     }
-    if (isApiKeyAuthEnabled(config)) paymentMethods.push({ type: "api_key", prefix: "sk_agent_" });
+    if (isApiKeyAuthEnabled(config)) {
+      paymentMethods.push({ type: "api_key", prefix: config.apiKeyPrefix ?? "sk_agent_" });
+    }
     return c.json({
       slug: agent.slug,
       pricing: {
@@ -5522,7 +5555,7 @@ function streamChatCompletions(c, authz, config, obs) {
           consumerId,
           config,
           abortController.signal,
-          void 0,
+          authz.threadId,
           maxOutputTokens,
           () => beginPaymentExecution(authz, config),
           authz.paymentOperation !== void 0 || authz.mppChargeOperation !== void 0,
@@ -5531,7 +5564,15 @@ function streamChatCompletions(c, authz, config, obs) {
             await markPaymentExecutionStarted(authz, config);
           },
           authz.executionBudget.maxInputTokens,
-          () => renewPaymentExecution(authz, config)
+          () => renewPaymentExecution(authz, config),
+          {
+            consumerId,
+            paymentMethod,
+            keyInfo: authz.keyInfo,
+            requestId,
+            messages: authz.messages ?? [],
+            ...authz.threadId ? { threadId: authz.threadId } : {}
+          }
         )) {
           if (event.kind === "text") {
             sendChunk(event.delta);
@@ -5605,6 +5646,7 @@ function streamChatCompletions(c, authz, config, obs) {
       "X-Request-Id": requestId,
       "X-Agent-Slug": agent.slug,
       "X-Agent-Hosting": agent.sandboxEndpoint ? "sovereign" : "centralized",
+      ...authz.threadId ? { "X-Tangle-Thread-Id": authz.threadId } : {},
       "X-Payment-Method": paymentMethod,
       "X-Payment-Settled": paymentMethod === "x402" || authz.paymentOperation ? "pending" : "true",
       ...authz.mppChargeOperation ? { "Payment-Receipt": authz.mppChargeOperation.receipt } : {},
@@ -5648,4 +5690,4 @@ export {
   InMemoryTaskStore,
   createAgentGateway
 };
-//# sourceMappingURL=chunk-MP6IIAIA.js.map
+//# sourceMappingURL=chunk-C7Z2BRYV.js.map