@ziggs-ai/api-client 0.16.0 → 0.17.0

package/dist/http/AgreementClient.js

@@ -2,22 +2,15 @@ import { runtimeLog } from '../shared/runtimeLog.js';
 import { getBackendUrl } from '../utils/urlUtils.js';
 import { OPEN_AGREEMENT_TARGET, ORG_AGREEMENT_TARGET, isBroadcastTarget, partySideIds } from '../types.js';
 import { throwApiError } from '../shared/apiError.js';
+import { buildCredsHeaders } from './operatorHeaders.js';
 // Lazy: read at call time so a `configureApiClient` call that lands after this
 // module is imported still takes effect. Baking it at module-load time would
 // freeze the URL before the host has configured one.
 function getAgreementBaseUrl() {
     return `${getBackendUrl()}/agreements`;
 }
-function buildHeaders(creds) {
-    return {
-        'content-type': 'application/json',
-        Authorization: `Bearer ${creds.operatorKey}`,
-        'X-Agent-Id': creds.agentId,
-        // the wake's lane, so the backend can fence this call to the
-        // engagement it belongs to rather than the agent's whole authority.
-        ...(creds.laneId ? { 'X-Ziggs-Lane': creds.laneId } : {}),
-    };
-}
+// Auth, agent and the wake's lane, from the one helper — see operatorHeaders.
+const buildHeaders = buildCredsHeaders;
 function assertCreds(creds, op) {
     if (!creds?.operatorKey)
         throw new Error(`operatorKey is required for ${op}`);

package/dist/http/ChatClient.js

@@ -1,16 +1,9 @@
 import { runtimeLog } from '../shared/runtimeLog.js';
 import { getBackendUrl } from '../utils/urlUtils.js';
 import { throwApiError } from '../shared/apiError.js';
-function buildHeaders(creds) {
-    return {
-        'content-type': 'application/json',
-        Authorization: `Bearer ${creds.operatorKey}`,
-        'X-Agent-Id': creds.agentId,
-        // the wake's lane, so the backend can fence this call to the
-        // engagement it belongs to rather than the agent's whole authority.
-        ...(creds.laneId ? { 'X-Ziggs-Lane': creds.laneId } : {}),
-    };
-}
+import { buildCredsHeaders } from './operatorHeaders.js';
+// Auth, agent and the wake's lane, from the one helper — see operatorHeaders.
+const buildHeaders = buildCredsHeaders;
 function assertCreds(creds, op) {
     if (!creds?.operatorKey)
         throw new Error(`operatorKey is required for ${op}`);

package/dist/http/ContextReadClient.js

@@ -1,5 +1,6 @@
 import { getBackendUrl } from '../utils/urlUtils.js';
 import { pollSurfaceError } from '../shared/rateLimit.js';
+import { buildOperatorHeaders } from './operatorHeaders.js';
 export const CONTEXT_READ_TYPES = [
     'messages',
     'artifacts',
@@ -92,13 +93,7 @@ export class ContextReadClient {
         if (query.contextGrantId) {
             url.searchParams.set('contextGrantId', query.contextGrantId);
         }
-        const headers = {
-            Authorization: `Bearer ${this.operatorKey}`,
-        };
-        if (this.agentId)
-            headers['X-Agent-Id'] = this.agentId;
-        if (this.laneId)
-            headers['X-Ziggs-Lane'] = this.laneId;
+        const headers = buildOperatorHeaders(this.operatorKey, this.agentId, undefined, this.laneId);
         if (query.contextGrantId) {
             headers['X-Context-Grant-Id'] = query.contextGrantId;
         }
@@ -131,13 +126,7 @@ export class ContextReadClient {
         if (opts.contextGrantId) {
             url.searchParams.set('contextGrantId', opts.contextGrantId);
         }
-        const headers = {
-            Authorization: `Bearer ${this.operatorKey}`,
-        };
-        if (this.agentId)
-            headers['X-Agent-Id'] = this.agentId;
-        if (this.laneId)
-            headers['X-Ziggs-Lane'] = this.laneId;
+        const headers = buildOperatorHeaders(this.operatorKey, this.agentId, undefined, this.laneId);
         if (opts.contextGrantId) {
             headers['X-Context-Grant-Id'] = opts.contextGrantId;
         }

package/dist/http/MarketplaceClient.js

@@ -2,17 +2,10 @@
 import { shapeAgreement } from './AgreementClient.js';
 import { getBackendUrl } from '../utils/urlUtils.js';
 import { throwApiError } from '../shared/apiError.js';
+import { buildCredsHeaders } from './operatorHeaders.js';
 function getMarketplaceBaseUrl() { return `${getBackendUrl()}/marketplace`; }
-function buildHeaders(creds) {
-    return {
-        'content-type': 'application/json',
-        Authorization: `Bearer ${creds.operatorKey}`,
-        'X-Agent-Id': creds.agentId,
-        // the wake's lane, so the backend can fence this call to the
-        // engagement it belongs to rather than the agent's whole authority.
-        ...(creds.laneId ? { 'X-Ziggs-Lane': creds.laneId } : {}),
-    };
-}
+// Auth, agent and the wake's lane, from the one helper — see operatorHeaders.
+const buildHeaders = buildCredsHeaders;
 function assertCreds(creds, op) {
     if (!creds?.operatorKey)
         throw new Error(`operatorKey is required for ${op}`);

package/dist/http/TaskClient.js

@@ -1,17 +1,10 @@
 import { getBackendUrl } from '../utils/urlUtils.js';
 import { partyActorIds } from '../types.js';
 import { throwApiError } from '../shared/apiError.js';
+import { buildCredsHeaders } from './operatorHeaders.js';
 function getTaskBaseUrl() { return `${getBackendUrl()}/tasks`; }
-function buildHeaders(creds) {
-    return {
-        'content-type': 'application/json',
-        Authorization: `Bearer ${creds.operatorKey}`,
-        'X-Agent-Id': creds.agentId,
-        // the wake's lane, so the backend can fence this call to the
-        // engagement it belongs to rather than the agent's whole authority.
-        ...(creds.laneId ? { 'X-Ziggs-Lane': creds.laneId } : {}),
-    };
-}
+// Auth, agent and the wake's lane, from the one helper — see operatorHeaders.
+const buildHeaders = buildCredsHeaders;
 function assertCreds(creds, op) {
     if (!creds?.operatorKey)
         throw new Error(`operatorKey is required for ${op}`);

package/dist/http/index.d.ts

@@ -28,3 +28,4 @@ export type { MyOrg, OrgResolution } from './OrgsClient.js';
 export { AgentSearchClient } from './AgentSearchClient.js';
 export { TelemetryClient } from './TelemetryClient.js';
 export { InboxClient } from './InboxClient.js';
+export { WAKE_LANE_HEADER, laneHeader, buildOperatorHeaders, buildCredsHeaders, } from './operatorHeaders.js';

package/dist/http/index.js

@@ -19,3 +19,7 @@ export { fetchMyOrgs, resolveOrgSelector, fetchDelegateAccess, fetchHostedAgentA
 export { AgentSearchClient } from './AgentSearchClient.js';
 export { TelemetryClient } from './TelemetryClient.js';
 export { InboxClient } from './InboxClient.js';
+// The lane header, built in one place — see operatorHeaders.ts. Exported
+// because the MCP transports in agent-sdk and ziggs-mcp send it too, and a
+// copy of a header nobody notices missing goes stale unseen.
+export { WAKE_LANE_HEADER, laneHeader, buildOperatorHeaders, buildCredsHeaders, } from './operatorHeaders.js';

package/dist/http/operatorHeaders.d.ts

@@ -1,8 +1,21 @@
 /**
- * Auth headers for operator-key HTTP clients. `X-Agent-Id` is only sent when
- * an agentId is present — agent-scoped keys identify the agent themselves;
- * fleet keys must pass one.
+ * Auth headers for operator-key HTTP clients.
+ *
+ * ONE place builds them, because the lane is the header a caller cannot be
+ * trusted to remember. Omitting `X-Ziggs-Lane` never fails: the server fences
+ * the wake to the agent's own org instead, so a door that forgets it answers
+ * short lists and refuses grants the agent's customer gave it — silently, and
+ * only for the agents that serve someone other than their owner. A header
+ * whose absence is indistinguishable from a legitimate answer has to be built
+ * in one place, not copied into each caller.
  */
+/** The header the backend's wake fence reads (`access/wake-fence.ts`). */
+export declare const WAKE_LANE_HEADER = "X-Ziggs-Lane";
+/**
+ * The lane header, or nothing. `laneId` is a chat id, or `agrn-<agreementId>`
+ * for a task with no origin chat.
+ */
+export declare function laneHeader(laneId?: string): Record<string, string>;
 export declare function buildOperatorHeaders(operatorKey: string, agentId?: string, extra?: Record<string, string>, 
 /**
  * the lane this call belongs to, sent as `X-Ziggs-Lane`. The
@@ -10,3 +23,9 @@ export declare function buildOperatorHeaders(operatorKey: string, agentId?: stri
  * narrows to the agent's own org, so it can never widen reach.
  */
 laneId?: string): Record<string, string>;
+/** What a `Creds`-shaped client sends on a JSON call: auth, agent, lane. */
+export declare function buildCredsHeaders(creds: {
+    operatorKey: string;
+    agentId: string;
+    laneId?: string;
+}): Record<string, string>;

package/dist/http/operatorHeaders.js

@@ -1,8 +1,23 @@
 /**
- * Auth headers for operator-key HTTP clients. `X-Agent-Id` is only sent when
- * an agentId is present — agent-scoped keys identify the agent themselves;
- * fleet keys must pass one.
+ * Auth headers for operator-key HTTP clients.
+ *
+ * ONE place builds them, because the lane is the header a caller cannot be
+ * trusted to remember. Omitting `X-Ziggs-Lane` never fails: the server fences
+ * the wake to the agent's own org instead, so a door that forgets it answers
+ * short lists and refuses grants the agent's customer gave it — silently, and
+ * only for the agents that serve someone other than their owner. A header
+ * whose absence is indistinguishable from a legitimate answer has to be built
+ * in one place, not copied into each caller.
  */
+/** The header the backend's wake fence reads (`access/wake-fence.ts`). */
+export const WAKE_LANE_HEADER = 'X-Ziggs-Lane';
+/**
+ * The lane header, or nothing. `laneId` is a chat id, or `agrn-<agreementId>`
+ * for a task with no origin chat.
+ */
+export function laneHeader(laneId) {
+    return laneId ? { [WAKE_LANE_HEADER]: laneId } : {};
+}
 export function buildOperatorHeaders(operatorKey, agentId, extra, 
 /**
  * the lane this call belongs to, sent as `X-Ziggs-Lane`. The
@@ -12,8 +27,17 @@ export function buildOperatorHeaders(operatorKey, agentId, extra,
 laneId) {
     return {
         Authorization: `Bearer ${operatorKey}`,
+        // `X-Agent-Id` is only sent when an agentId is present — agent-scoped keys
+        // identify the agent themselves; fleet keys must pass one.
         ...(agentId ? { 'X-Agent-Id': agentId } : {}),
-        ...(laneId ? { 'X-Ziggs-Lane': laneId } : {}),
+        ...laneHeader(laneId),
         ...extra,
     };
 }
+/** What a `Creds`-shaped client sends on a JSON call: auth, agent, lane. */
+export function buildCredsHeaders(creds) {
+    return {
+        'content-type': 'application/json',
+        ...buildOperatorHeaders(creds.operatorKey, creds.agentId, undefined, creds.laneId),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ziggs-ai/api-client",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "HTTP and WebSocket client for the Ziggs backend API",
   "type": "module",
   "main": "dist/index.js",