10xgraph-api 0.7.0__tar.gz → 0.9.0__tar.gz

{10xgraph_api-0.7.0 → 10xgraph_api-0.9.0}/10xgraph_api.egg-info/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: 10xgraph-api
-Version: 0.7.0
+Version: 0.9.0
 Summary: Production server for 10xGraph agents (formerly 10xscale-agentflow-cli). Serves a compiled graph over REST, SSE, WebSocket, realtime audio and AG-UI with JWT or custom auth, scoped authorization on every endpoint, owner-only threads and rate limiting, and generates Docker Compose and Kubernetes files. Includes the 10xgraph CLI. MIT licensed, self-hosted.
 Author-email: Shudipto Trafder <shudiptotrafder@gmail.com>
 Maintainer-email: Shudipto Trafder <shudiptotrafder@gmail.com>, 10xScale <contact@10xscale.ai>
-License: MIT
+License-Expression: MIT
 Project-URL: Homepage, https://10xgraph.com
 Project-URL: Repository, https://github.com/10xGraph/10xgraph-api
 Project-URL: Issues, https://github.com/10xGraph/10xgraph-api/issues
@@ -13,11 +13,12 @@ Project-URL: Changelog, https://github.com/10xGraph/10xgraph-api/blob/main/CHANG
 Keywords: 10xgraph,10xscale,agentflow,agents,ai-agents,multi-agent,agent-server,agent-deployment,llm,fastapi,api-server,rest-api,sse,websocket,realtime-audio,ag-ui,jwt,authentication,authorization,rbac,multi-tenant,rate-limiting,self-hosted,production,docker,kubernetes,cli
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
 Requires-Python: >=3.12
@@ -25,13 +26,10 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: 10xgraph<2.0,>=0.10.0
 Requires-Dist: fastapi<1.0,>=0.116
-Requires-Dist: gunicorn<24,>=23.0
-Requires-Dist: orjson<4,>=3.11
-Requires-Dist: platformdirs<5,>=4.0
 Requires-Dist: python-multipart<0.1,>=0.0.19
 Requires-Dist: pydantic<3,>=2.13
 Requires-Dist: pydantic-settings<3,>=2.3
-Requires-Dist: uvicorn<1.0,>=0.30
+Requires-Dist: uvicorn<1.0,>=0.36
 Requires-Dist: typer<1.0,>=0.17
 Requires-Dist: python-dotenv<2,>=1.0
 Requires-Dist: questionary<3,>=2.0
@@ -49,6 +47,8 @@ Provides-Extra: jwt
 Requires-Dist: PyJWT<3,>=2.8; extra == "jwt"
 Provides-Extra: media
 Requires-Dist: textxtract[docx,html,md,pdf,xml]>=0.2.0; extra == "media"
+Provides-Extra: images
+Requires-Dist: 10xgraph[images]<2.0,>=0.10.0; extra == "images"
 Provides-Extra: gcloud
 Requires-Dist: google-cloud-logging; extra == "gcloud"
 Provides-Extra: otel
@@ -58,6 +58,8 @@ Requires-Dist: opentelemetry-instrumentation-fastapi>=0.40b0; extra == "otel"
 Requires-Dist: opentelemetry-exporter-otlp>=1.20.0; extra == "otel"
 Provides-Extra: ag-ui
 Requires-Dist: ag-ui-protocol<2,>=1.0; extra == "ag-ui"
+Provides-Extra: websocket
+Requires-Dist: websockets<17,>=13.0; extra == "websocket"
 Dynamic: license-file
 
 # 10xGraph API
@@ -93,7 +95,7 @@ Not built in: automatic per-tool permissions (user A may call `refund`, user B m
 |---|---|---|
 | [`10xgraph`](https://github.com/10xGraph/10xGraph) | Core engine: graph, state, replay-safe tools, checkpointing, memory | `pip install 10xgraph` (pulled in by this package) |
 | `10xgraph-api` (this repository) | Production server and the `10xgraph` command | `pip install 10xgraph-api` |
-| [`10xgraph-client`](https://github.com/10xGraph/10xgraph-client) | Typed TypeScript client for every endpoint | `npm install 10xgraph-client` (until it is published, `@10xscale/agentflow-client`) |
+| [`10xgraph-client`](https://github.com/10xGraph/10xgraph-client) | Typed TypeScript client for every endpoint | `npm install 10xgraph-client` |
 
 Docs: [10xgraph.com](https://10xgraph.com).
 
@@ -151,11 +153,17 @@ Optional extras; install only what you configure:
 pip install "10xgraph-api[redis]"   # Redis rate-limit / cache backend
 pip install "10xgraph-api[jwt]"     # JWT authentication
 pip install "10xgraph-api[media]"   # Document text extraction (multimodal)
+pip install "10xgraph-api[images]"  # Image resize / EXIF / format conversion (Pillow)
+pip install "10xgraph-api[ag-ui]"   # AG-UI endpoint
+pip install "10xgraph-api[websocket]"  # WebSocket streaming + realtime audio
 pip install "10xgraph-api[otel]"    # OpenTelemetry tracing
 pip install "10xgraph-api[snowflakekit]"  # Snowflake ID generation
+pip install "10xgraph-api[sentry]"  # Sentry error reporting
+pip install "10xgraph-api[firebase]"  # Firebase Admin SDK
+pip install "10xgraph-api[gcloud]"  # Google Cloud Logging
 ```
 
-Requires Python 3.12 or newer. Installs the core `10xgraph` framework as a dependency.
+Requires Python 3.12 or newer. Tested on 3.12, 3.13, 3.14 and 3.15. Installs the core `10xgraph` framework as a dependency.
 
 ---
 
@@ -175,9 +183,6 @@ Requires Python 3.12 or newer. Installs the core `10xgraph` framework as a depen
 10xgraph build --docker-compose
 ```
 
-`10xgraph api` (server only) and `10xgraph play` (server + playground) remain
-available; `dev` is the goal-oriented wrapper around them.
-
 ---
 
 ## CLI commands
@@ -195,9 +200,17 @@ Initialize a new project with configuration and a sample graph.
 10xgraph init --path ./my-app --name MyAgent --template quick-start \
   --non-interactive            # reproducible CI/agent workflow
 10xgraph init --path ./my-app --template production --auth jwt \
-  --rate-limit redis --yes --dry-run
+  --rate-limit redis --provider openai --yes --dry-run
 ```
 
+`init` asks which AI provider to use (`--provider google|openai|anthropic`, default `google`)
+and writes the matching model and API key variable. It also asks whether to enable WebSocket
+streaming and realtime audio (`--websocket`, default off); off leaves `/v1/graph/ws` and
+`/v1/graph/live` unmounted and installs no WebSocket library. A production project's `pyproject.toml`
+lists only what your answers need, for example `10xgraph[openai]` and
+`10xgraph-api[jwt,redis]`, and `10xgraph build` installs exactly that list, so no separate
+`requirements.txt` is needed.
+
 ### `10xgraph dev`
 
 Start the development API server and open the hosted playground when it is ready.
@@ -209,16 +222,18 @@ Start the development API server and open the hosted playground when it is ready
 10xgraph dev --no-open --no-reload        # API only, without auto-reload
 ```
 
-`10xgraph api` and `10xgraph play` remain available as compatibility commands.
+`dev` is the only server command: the old `api` and `play` commands were removed
+(use `10xgraph dev --no-open` and `10xgraph dev`). It runs Uvicorn with reload for local
+work; production runs Gunicorn in the image from `10xgraph build`.
 
 ### Adaptive and structured output
 
 ```bash
-10xgraph play                         # branded intro, then output in your scrollback
+10xgraph dev                          # branded intro, then output in your scrollback
 10xgraph demo                         # preview every animation theme safely
 10xgraph demo --style build           # one theme: typing, network, init, build, or eval
-10xgraph --fullscreen play            # opt-in pinned header/footer surface
-10xgraph --no-animation play          # accessible/static workflow
+10xgraph --fullscreen dev             # opt-in pinned header/footer surface
+10xgraph --no-animation dev           # accessible/static workflow
 10xgraph --format plain --no-color audit
 10xgraph --format jsonl eval --parallel
 10xgraph --quiet build
@@ -577,7 +592,7 @@ sdist + wheel, checks the distribution metadata, and creates a GitHub Release wi
 notes and the artifacts attached. PyPI publishing is manual (`make publish`).
 
 ```bash
-git tag v0.7.0 && git push origin v0.7.0
+git tag v0.9.0 && git push origin v0.9.0
 ```
 
 ---
@@ -601,9 +616,33 @@ git tag v0.7.0 && git push origin v0.7.0
 
 ## Contributing
 
-Contributions are welcome. Fork the repo, create a feature branch, run tests and linting, and open a
-Pull Request. See the [repository](https://github.com/10xGraph/10xgraph-api) for issue reporting and
-guidelines.
+**Your avatar belongs on this wall.**
+
+<a href="https://github.com/10xGraph/10xgraph-api/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=10xGraph/10xgraph-api" alt="People who have contributed to 10xgraph-api" />
+</a>
+
+Every person above shipped code that serves real agents in production. Merge one pull request and you join them, here and on the contributor page at [10xgraph.com/maintainers](https://10xgraph.com/maintainers).
+
+Your first pull request can be small. These are real, self-contained, and useful today:
+
+- **Type one module.** `pyproject.toml` lists the modules `mypy` still skips, each with its error count. Start with a one-error module, fix it, delete its line.
+- **Add a test for an edge case you hit.** A request that should be rejected, a config that should fail at startup, a header that should be set.
+- **Write the deployment recipe you needed.** Behind a reverse proxy, on a specific cloud, with your auth provider. Recipes go on [10xgraph.com](https://10xgraph.com), where every page has an "Edit this page" link.
+- **Turn a bug into a failing test.** Open it as a draft pull request; the fix can come later.
+
+From clone to a passing check:
+
+```bash
+git clone https://github.com/10xGraph/10xgraph-api.git
+cd 10xgraph-api
+uv sync --dev
+uv run pytest
+uv run pre-commit run --all-files   # ruff, bandit and hygiene checks, as in CI
+uv run mypy
+```
+
+Draft pull requests are welcome, so open early and ask questions in the PR. For bigger changes, start a thread in the core repository's [Discussions](https://github.com/10xGraph/10xGraph/discussions) first so the work does not overlap.
 
 ---
 

{10xgraph_api-0.7.0 → 10xgraph_api-0.9.0}/10xgraph_api.egg-info/SOURCES.txt

@@ -17,6 +17,7 @@ pyproject.toml
 10xgraph_api.egg-info/top_level.txt
 agentflow_cli/__init__.py
 tenxgraph_api/__init__.py
+tenxgraph_api/_slim_image.py
 tenxgraph_api/py.typed
 tenxgraph_api/cli/__init__.py
 tenxgraph_api/cli/capabilities.py
@@ -126,14 +127,17 @@ tenxgraph_api/src/app/loader.py
 tenxgraph_api/src/app/main.py
 tenxgraph_api/src/app/worker.py
 tenxgraph_api/src/app/core/__init__.py
+tenxgraph_api/src/app/core/concurrency.py
 tenxgraph_api/src/app/core/auth/__init__.py
 tenxgraph_api/src/app/core/auth/auth_backend.py
 tenxgraph_api/src/app/core/auth/authorization.py
 tenxgraph_api/src/app/core/auth/base_auth.py
+tenxgraph_api/src/app/core/auth/identity_cache.py
 tenxgraph_api/src/app/core/auth/jwt_auth.py
 tenxgraph_api/src/app/core/auth/ownership_resolver.py
 tenxgraph_api/src/app/core/auth/permissions.py
 tenxgraph_api/src/app/core/auth/request_config.py
+tenxgraph_api/src/app/core/auth/revocation.py
 tenxgraph_api/src/app/core/auth/route_guard.py
 tenxgraph_api/src/app/core/config/__init__.py
 tenxgraph_api/src/app/core/config/graph_config.py
@@ -159,6 +163,7 @@ tenxgraph_api/src/app/core/middleware/rate_limit/memory.py
 tenxgraph_api/src/app/core/middleware/rate_limit/middleware.py
 tenxgraph_api/src/app/core/middleware/rate_limit/redis.py
 tenxgraph_api/src/app/core/utils/__init__.py
+tenxgraph_api/src/app/core/utils/container.py
 tenxgraph_api/src/app/core/utils/log_sanitizer.py
 tenxgraph_api/src/app/routers/__init__.py
 tenxgraph_api/src/app/routers/setup_router.py
@@ -180,6 +185,7 @@ tenxgraph_api/src/app/routers/evals/services/eval_report_service.py
 tenxgraph_api/src/app/routers/graph/__init__.py
 tenxgraph_api/src/app/routers/graph/realtime_guard.py
 tenxgraph_api/src/app/routers/graph/router.py
+tenxgraph_api/src/app/routers/graph/run_limits.py
 tenxgraph_api/src/app/routers/graph/schemas/__init__.py
 tenxgraph_api/src/app/routers/graph/schemas/graph_schemas.py
 tenxgraph_api/src/app/routers/graph/services/__init__.py
@@ -189,6 +195,7 @@ tenxgraph_api/src/app/routers/media/__init__.py
 tenxgraph_api/src/app/routers/media/router.py
 tenxgraph_api/src/app/routers/media/schemas.py
 tenxgraph_api/src/app/routers/ping/__init__.py
+tenxgraph_api/src/app/routers/ping/readiness.py
 tenxgraph_api/src/app/routers/ping/router.py
 tenxgraph_api/src/app/routers/store/__init__.py
 tenxgraph_api/src/app/routers/store/router.py

{10xgraph_api-0.7.0 → 10xgraph_api-0.9.0}/10xgraph_api.egg-info/requires.txt

@@ -1,12 +1,9 @@
 10xgraph<2.0,>=0.10.0
 fastapi<1.0,>=0.116
-gunicorn<24,>=23.0
-orjson<4,>=3.11
-platformdirs<5,>=4.0
 python-multipart<0.1,>=0.0.19
 pydantic<3,>=2.13
 pydantic-settings<3,>=2.3
-uvicorn<1.0,>=0.30
+uvicorn<1.0,>=0.36
 typer<1.0,>=0.17
 python-dotenv<2,>=1.0
 questionary<3,>=2.0
@@ -22,6 +19,9 @@ oauth2client>=4.1.3
 [gcloud]
 google-cloud-logging
 
+[images]
+10xgraph[images]<2.0,>=0.10.0
+
 [jwt]
 PyJWT<3,>=2.8
 
@@ -42,3 +42,6 @@ sentry-sdk>=2.10.0
 
 [snowflakekit]
 snowflakekit<1.0,>=0.1.1
+
+[websocket]
+websockets<17,>=13.0

{10xgraph_api-0.7.0 → 10xgraph_api-0.9.0}/CHANGELOG.md

@@ -20,6 +20,173 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
 
+## [Unreleased]
+
+## [0.9.0] - 2026-10-22
+
+One server command, a guided `10xgraph init`, leaner production images and Python 3.14 and
+3.15 support. This release has a breaking change: read the **Breaking** list before upgrading.
+
+### Breaking
+
+- **`10xgraph api` and `10xgraph play` are removed; `10xgraph dev` is the only server command.**
+  All three ran the same local Uvicorn dev server. Migration: `10xgraph api` ->
+  `10xgraph dev --no-open`, `10xgraph play` -> `10xgraph dev`. Options are unchanged
+  (`--config`, `--host`, `--port`, `--reload/--no-reload`). `10xgraph demo --style` no longer
+  accepts the `play` / `api` aliases. Production is unaffected: the image from `10xgraph build`
+  runs Gunicorn directly.
+
+### Added
+
+- **Python 3.14 and 3.15 are officially supported.** The test suite runs on 3.12, 3.13, 3.14
+  and 3.15 in CI, and the package classifiers list all four.
+- **`websocket.enabled` in `10xgraph.json`** turns the WebSocket routes on or off. `false` leaves
+  out `/v1/graph/ws` and `/v1/graph/live`, so the server needs no WebSocket library. `true`
+  without one refuses to boot with the install hint. Unset keeps them mounted, as before, but
+  now logs a warning when no library is installed (previously a non-Google project silently
+  answered 404 on both routes, because only `google-genai` brought in `websockets`).
+- **`10xgraph-api[websocket]` extra** (`websockets`) for those routes.
+- **`10xgraph init` asks whether to enable WebSocket streaming and realtime audio**
+  (`--websocket/--no-websocket`, default off). Yes adds the `websocket` extra to a production
+  `pyproject.toml` and writes `"websocket": {"enabled": true}`; no writes `false`.
+- **`10xgraph init` asks for the AI provider** (Google Gemini, OpenAI or Anthropic Claude;
+  `--provider` for non-interactive runs, default `google`). The scaffold's model, provider,
+  `.env.example` API key, test conftest and eval simulator model follow the answer.
+- **`10xgraph-api[images]` extra.** Pillow is optional in core `10xgraph`; this extra installs it
+  for image resize, EXIF orientation and format conversion.
+
+### Changed
+
+- Replaced `asyncio.iscoroutinefunction`, which is removed in Python 3.16, with
+  `inspect.iscoroutinefunction`. No behaviour change.
+- **Production scaffolds list only the dependencies the answers need.** `pyproject.toml` now
+  depends on `10xgraph[<provider>]` and `10xgraph-api[jwt,redis]` as chosen (no extras when
+  neither is picked), and drops the hardcoded `google-genai`. The generated Dockerfile installs
+  this list, so JWT and Redis work in the image without a separate `requirements.txt`.
+- **The generated Dockerfile removes pip and the CLI's own libraries from the image.** typer,
+  rich, questionary and what only they pull in (pygments, markdown-it-py, mdurl, prompt-toolkit,
+  wcwidth, shellingham) are uninstalled in the builder stage by `tenxgraph_api/_slim_image.py`,
+  unless another installed package still needs them. With pip, about 38 MB smaller.
+- Dropped unused dev dependencies (`mkdocs-gen-files`, `mkdocstrings`, `mypy-extensions`,
+  `lib`, `markdown-it-py`).
+
+### Fixed
+
+- **`10xgraph init` generated a `pyproject.toml` claiming Python 3.10.** The template said
+  `requires-python = ">=3.10"`, but `10xgraph` needs 3.12, so installing a generated project
+  on 3.10 or 3.11 failed. It now says `>=3.12`.
+- **Redis rate limiting from a URL crashed at startup** with `NameError: Redis`: the class was
+  imported only for type checking but used at runtime to bind the client.
+- **A production scaffold with the Redis rate limiter did not start:** `10xgraph.json` had no
+  Redis URL. It now reads `"redis": {"url": "${REDIS_URL}"}` from `.env`.
+- **A production scaffold did not start at all:** `10xgraph.json` points at
+  `graph.agent:container`, which the template never defined. `graph/agent.py` now exports it.
+- **The production scaffold's `tests/test_graph_nodes.py` failed on collection** (it imported
+  `graph.nodes` and `graph.utils`, which the template does not create). It now tests the agent
+  in `graph/agent.py`.
+
+## [0.8.0] - 2026-10-16
+
+Security and scalability pass over the API, following an external review. Every item below
+has tests; see the review notes for the full list. This release has breaking changes: read
+the **Breaking** list before upgrading.
+
+### Breaking
+
+- **Ownership checks fail closed.** With auth on, an ownership or `rbac` authorization
+  backend now refuses to start on a checkpointer that cannot resolve thread owners
+  (`aget_thread_owner` not implemented), and denies thread requests if none is available at
+  runtime. Implement `aget_thread_owner`, or set `"authorization": "allow_all"` or a custom
+  backend.
+- **An unowned thread only allows actions that create it** (`graph:invoke`, `graph:stream`,
+  `checkpointer:write`). Reading, deleting, stopping or fixing a thread that does not exist
+  (or has no owner) now answers 403 instead of an empty result.
+- **Authorization defaults to `ownership` whenever auth is configured**, in every mode. It
+  used to be `allow_all` unless `MODE=production`. Set `"authorization": "allow_all"` to keep
+  the old development behaviour.
+- **Realtime init frames can no longer replace the system prompt by default.** Add
+  `"system_prompt"` to `websocket.realtime_client_overrides` to allow it.
+- **`trusted_proxy_headers: true` without `trusted_proxies` trusts only loopback and private
+  networks**, not every peer. List your proxy networks (or `0.0.0.0/0` and `::/0`).
+- **Production defaults:** `MEDIA_REQUIRE_OWNER` is on, `graph_introspection` is `scoped`
+  (graph structure, tools and state schema need the `graph:read` scope), and `IS_DEBUG` is
+  forced off.
+- **`/v1/graph/invoke` no longer returns `meta.thread_name`**; the name is generated in the
+  background and appears on the thread (`GET /v1/threads`).
+- **Production 4xx responses keep their message**; only 5xx are made generic. A 422 built
+  from an unexpected `ValueError` is still made generic.
+- **`gunicorn` is no longer a dependency.** The generated Dockerfile installs it, so
+  `10xgraph build` images are unaffected. If you run `gunicorn` yourself outside that image,
+  install it alongside the API: `pip install gunicorn uvicorn-worker`.
+- **Gunicorn's worker class is now `uvicorn_worker.UvicornWorker`** (from the `uvicorn-worker`
+  package). `uvicorn.workers.UvicornWorker` is deprecated in uvicorn. Regenerate the
+  Dockerfile and compose file with `10xgraph build --force`, or change `-k` in your own
+  command.
+- **`POST /v1/graph/fix` returns `state` as a JSON object.** It used to be a JSON-encoded
+  string. Drop any `JSON.parse` / `json.loads` on that field; the TS client already types it
+  as an object.
+- **Generated Dockerfiles install only the dependencies you list.** The `pyproject.toml` path
+  no longer adds `10xgraph-api` on top of your list. `10xgraph build` warns when the requirements file or `pyproject.toml` does not list
+  `10xgraph-api`.
+
+### Added
+
+- `runs` key in `10xgraph.json`: `thread_ids` (`client` | `server`), `config_keys` and
+  `state_keys` allow-lists, `max_concurrent_per_user` (default 10) and `timeout`.
+- `token_revocation` key (`redis`, `memory` or `module:attr`) and the
+  `TokenRevocationBackend` hook: revoked tokens are refused before they expire, on HTTP and
+  on every WebSocket run.
+- `graph_introspection` key (`open` | `scoped`).
+- `websocket.realtime_client_overrides` allow-list.
+- `STRICT_PRODUCTION_CHECKS=true`: production refuses to start on wildcard `ALLOWED_HOST` or
+  `ORIGINS`, or enabled API docs.
+- `GET /health/ready` readiness probe (checkpointer, Redis, store); the k8s manifest uses it.
+- Run and WebSocket connection caps are shared across workers through Redis when it is
+  configured.
+
+### Changed
+
+- `10xgraph play` and `10xgraph dev` open the hosted playground at its new address,
+  `https://play.10xgraph.com`. The previous address, `playground-463bd.web.app`, still
+  serves the same app for older releases.
+- Thread delete leaves a short tombstone so a deleted id cannot be handed to another user
+  while other workers still cache the old owner.
+- Every thread the API saves records its owner, which fixes owner lookups on the in-memory
+  and SQLite checkpointers.
+- WebSocket JSON frames over `MAX_REQUEST_SIZE` are refused (close 1009); `10xgraph api`
+  passes the same limit to uvicorn as `ws_max_size`.
+- Request ID, security headers and rate limiting are pure ASGI middleware; CORS is now the
+  outermost layer, so 429, 413 and Host rejections are readable by browsers.
+- Route-set security headers (such as the download sandbox CSP) are no longer overwritten.
+- The JWT is verified once per request when rate limiting by user.
+- Local-store downloads stream from disk; uploads are read into memory once.
+- JSON responses are serialized by pydantic-core (`model_dump_json`) instead of orjson.
+  FastAPI deprecated `ORJSONResponse` in 0.131; the FastAPI floor stays at 0.116.
+- Dependencies: dropped `orjson` and the unused `platformdirs`; the `uvicorn` floor is now
+  0.36 (required by `uvicorn-worker`).
+- Generated Dockerfiles build in two stages: dependencies go into a virtualenv in a builder
+  stage, and only that virtualenv and your code reach the runtime image. The runtime image
+  has no compiler or curl, copies code with `COPY --chown` instead of a second `chown -R`
+  layer, and its healthcheck uses the Python standard library.
+- A requirements file in a subfolder (for example `requirements/base.txt`) keeps its path in
+  the generated Dockerfile.
+- Packaging: `license` is an SPDX expression (`MIT`), so builds no longer warn about the
+  deprecated table form; the build needs setuptools 77 or later.
+
+### Security
+
+- **Log injection.** Values a client controls (user and thread ids, file ids, rate-limit
+  keys, request paths, run config and messages) are written to logs through `log_safe()`,
+  which escapes CR and LF, so a request cannot forge extra log lines. This covers the graph,
+  checkpointer and media services, the rate-limit middleware, the WebSocket guard and the
+  run limits.
+- **ReDoS in the log sanitizer.** The JWT detection pattern backtracked polynomially on
+  crafted input (about 585 ms for a 16,000-character string). It now matches in linear time.
+- **Security examples.** `examples/security/` no longer prints any part of an API key or of
+  the JWT secret. The API key example hashes keys with HMAC-SHA-256 and a server-side
+  `API_KEY_PEPPER`; hashes made with the previous example's plain SHA-256 must be
+  regenerated.
+
 ## [0.7.0] - 2026-10-10
 
 **First release as `10xgraph-api`.** 10xScale Agentflow is now 10xGraph. This package
@@ -351,6 +518,8 @@ can be pinned.
 Initial entry in this changelog. Releases before `0.5.0` were not tracked here; see the
 GitHub release history for their notes.
 
+[Unreleased]: https://github.com/10xGraph/10xgraph-api/compare/v0.8.0...HEAD
+[0.8.0]: https://github.com/10xGraph/10xgraph-api/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/10xGraph/10xgraph-api/compare/v0.6.0...v0.7.0
 [0.6.0]: https://github.com/10xHub/agentflow-cli/compare/v0.5.1...v0.6.0
 [0.5.1]: https://github.com/10xHub/agentflow-cli/compare/v0.5.0...v0.5.1

{10xgraph_api-0.7.0 → 10xgraph_api-0.9.0}/PKG-INFO

@@ -1,10 +1,10 @@
 Metadata-Version: 2.4
 Name: 10xgraph-api
-Version: 0.7.0
+Version: 0.9.0
 Summary: Production server for 10xGraph agents (formerly 10xscale-agentflow-cli). Serves a compiled graph over REST, SSE, WebSocket, realtime audio and AG-UI with JWT or custom auth, scoped authorization on every endpoint, owner-only threads and rate limiting, and generates Docker Compose and Kubernetes files. Includes the 10xgraph CLI. MIT licensed, self-hosted.
 Author-email: Shudipto Trafder <shudiptotrafder@gmail.com>
 Maintainer-email: Shudipto Trafder <shudiptotrafder@gmail.com>, 10xScale <contact@10xscale.ai>
-License: MIT
+License-Expression: MIT
 Project-URL: Homepage, https://10xgraph.com
 Project-URL: Repository, https://github.com/10xGraph/10xgraph-api
 Project-URL: Issues, https://github.com/10xGraph/10xgraph-api/issues
@@ -13,11 +13,12 @@ Project-URL: Changelog, https://github.com/10xGraph/10xgraph-api/blob/main/CHANG
 Keywords: 10xgraph,10xscale,agentflow,agents,ai-agents,multi-agent,agent-server,agent-deployment,llm,fastapi,api-server,rest-api,sse,websocket,realtime-audio,ag-ui,jwt,authentication,authorization,rbac,multi-tenant,rate-limiting,self-hosted,production,docker,kubernetes,cli
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
 Requires-Python: >=3.12
@@ -25,13 +26,10 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: 10xgraph<2.0,>=0.10.0
 Requires-Dist: fastapi<1.0,>=0.116
-Requires-Dist: gunicorn<24,>=23.0
-Requires-Dist: orjson<4,>=3.11
-Requires-Dist: platformdirs<5,>=4.0
 Requires-Dist: python-multipart<0.1,>=0.0.19
 Requires-Dist: pydantic<3,>=2.13
 Requires-Dist: pydantic-settings<3,>=2.3
-Requires-Dist: uvicorn<1.0,>=0.30
+Requires-Dist: uvicorn<1.0,>=0.36
 Requires-Dist: typer<1.0,>=0.17
 Requires-Dist: python-dotenv<2,>=1.0
 Requires-Dist: questionary<3,>=2.0
@@ -49,6 +47,8 @@ Provides-Extra: jwt
 Requires-Dist: PyJWT<3,>=2.8; extra == "jwt"
 Provides-Extra: media
 Requires-Dist: textxtract[docx,html,md,pdf,xml]>=0.2.0; extra == "media"
+Provides-Extra: images
+Requires-Dist: 10xgraph[images]<2.0,>=0.10.0; extra == "images"
 Provides-Extra: gcloud
 Requires-Dist: google-cloud-logging; extra == "gcloud"
 Provides-Extra: otel
@@ -58,6 +58,8 @@ Requires-Dist: opentelemetry-instrumentation-fastapi>=0.40b0; extra == "otel"
 Requires-Dist: opentelemetry-exporter-otlp>=1.20.0; extra == "otel"
 Provides-Extra: ag-ui
 Requires-Dist: ag-ui-protocol<2,>=1.0; extra == "ag-ui"
+Provides-Extra: websocket
+Requires-Dist: websockets<17,>=13.0; extra == "websocket"
 Dynamic: license-file
 
 # 10xGraph API
@@ -93,7 +95,7 @@ Not built in: automatic per-tool permissions (user A may call `refund`, user B m
 |---|---|---|
 | [`10xgraph`](https://github.com/10xGraph/10xGraph) | Core engine: graph, state, replay-safe tools, checkpointing, memory | `pip install 10xgraph` (pulled in by this package) |
 | `10xgraph-api` (this repository) | Production server and the `10xgraph` command | `pip install 10xgraph-api` |
-| [`10xgraph-client`](https://github.com/10xGraph/10xgraph-client) | Typed TypeScript client for every endpoint | `npm install 10xgraph-client` (until it is published, `@10xscale/agentflow-client`) |
+| [`10xgraph-client`](https://github.com/10xGraph/10xgraph-client) | Typed TypeScript client for every endpoint | `npm install 10xgraph-client` |
 
 Docs: [10xgraph.com](https://10xgraph.com).
 
@@ -151,11 +153,17 @@ Optional extras; install only what you configure:
 pip install "10xgraph-api[redis]"   # Redis rate-limit / cache backend
 pip install "10xgraph-api[jwt]"     # JWT authentication
 pip install "10xgraph-api[media]"   # Document text extraction (multimodal)
+pip install "10xgraph-api[images]"  # Image resize / EXIF / format conversion (Pillow)
+pip install "10xgraph-api[ag-ui]"   # AG-UI endpoint
+pip install "10xgraph-api[websocket]"  # WebSocket streaming + realtime audio
 pip install "10xgraph-api[otel]"    # OpenTelemetry tracing
 pip install "10xgraph-api[snowflakekit]"  # Snowflake ID generation
+pip install "10xgraph-api[sentry]"  # Sentry error reporting
+pip install "10xgraph-api[firebase]"  # Firebase Admin SDK
+pip install "10xgraph-api[gcloud]"  # Google Cloud Logging
 ```
 
-Requires Python 3.12 or newer. Installs the core `10xgraph` framework as a dependency.
+Requires Python 3.12 or newer. Tested on 3.12, 3.13, 3.14 and 3.15. Installs the core `10xgraph` framework as a dependency.
 
 ---
 
@@ -175,9 +183,6 @@ Requires Python 3.12 or newer. Installs the core `10xgraph` framework as a depen
 10xgraph build --docker-compose
 ```
 
-`10xgraph api` (server only) and `10xgraph play` (server + playground) remain
-available; `dev` is the goal-oriented wrapper around them.
-
 ---
 
 ## CLI commands
@@ -195,9 +200,17 @@ Initialize a new project with configuration and a sample graph.
 10xgraph init --path ./my-app --name MyAgent --template quick-start \
   --non-interactive            # reproducible CI/agent workflow
 10xgraph init --path ./my-app --template production --auth jwt \
-  --rate-limit redis --yes --dry-run
+  --rate-limit redis --provider openai --yes --dry-run
 ```
 
+`init` asks which AI provider to use (`--provider google|openai|anthropic`, default `google`)
+and writes the matching model and API key variable. It also asks whether to enable WebSocket
+streaming and realtime audio (`--websocket`, default off); off leaves `/v1/graph/ws` and
+`/v1/graph/live` unmounted and installs no WebSocket library. A production project's `pyproject.toml`
+lists only what your answers need, for example `10xgraph[openai]` and
+`10xgraph-api[jwt,redis]`, and `10xgraph build` installs exactly that list, so no separate
+`requirements.txt` is needed.
+
 ### `10xgraph dev`
 
 Start the development API server and open the hosted playground when it is ready.
@@ -209,16 +222,18 @@ Start the development API server and open the hosted playground when it is ready
 10xgraph dev --no-open --no-reload        # API only, without auto-reload
 ```
 
-`10xgraph api` and `10xgraph play` remain available as compatibility commands.
+`dev` is the only server command: the old `api` and `play` commands were removed
+(use `10xgraph dev --no-open` and `10xgraph dev`). It runs Uvicorn with reload for local
+work; production runs Gunicorn in the image from `10xgraph build`.
 
 ### Adaptive and structured output
 
 ```bash
-10xgraph play                         # branded intro, then output in your scrollback
+10xgraph dev                          # branded intro, then output in your scrollback
 10xgraph demo                         # preview every animation theme safely
 10xgraph demo --style build           # one theme: typing, network, init, build, or eval
-10xgraph --fullscreen play            # opt-in pinned header/footer surface
-10xgraph --no-animation play          # accessible/static workflow
+10xgraph --fullscreen dev             # opt-in pinned header/footer surface
+10xgraph --no-animation dev           # accessible/static workflow
 10xgraph --format plain --no-color audit
 10xgraph --format jsonl eval --parallel
 10xgraph --quiet build
@@ -577,7 +592,7 @@ sdist + wheel, checks the distribution metadata, and creates a GitHub Release wi
 notes and the artifacts attached. PyPI publishing is manual (`make publish`).
 
 ```bash
-git tag v0.7.0 && git push origin v0.7.0
+git tag v0.9.0 && git push origin v0.9.0
 ```
 
 ---
@@ -601,9 +616,33 @@ git tag v0.7.0 && git push origin v0.7.0
 
 ## Contributing
 
-Contributions are welcome. Fork the repo, create a feature branch, run tests and linting, and open a
-Pull Request. See the [repository](https://github.com/10xGraph/10xgraph-api) for issue reporting and
-guidelines.
+**Your avatar belongs on this wall.**
+
+<a href="https://github.com/10xGraph/10xgraph-api/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=10xGraph/10xgraph-api" alt="People who have contributed to 10xgraph-api" />
+</a>
+
+Every person above shipped code that serves real agents in production. Merge one pull request and you join them, here and on the contributor page at [10xgraph.com/maintainers](https://10xgraph.com/maintainers).
+
+Your first pull request can be small. These are real, self-contained, and useful today:
+
+- **Type one module.** `pyproject.toml` lists the modules `mypy` still skips, each with its error count. Start with a one-error module, fix it, delete its line.
+- **Add a test for an edge case you hit.** A request that should be rejected, a config that should fail at startup, a header that should be set.
+- **Write the deployment recipe you needed.** Behind a reverse proxy, on a specific cloud, with your auth provider. Recipes go on [10xgraph.com](https://10xgraph.com), where every page has an "Edit this page" link.
+- **Turn a bug into a failing test.** Open it as a draft pull request; the fix can come later.
+
+From clone to a passing check:
+
+```bash
+git clone https://github.com/10xGraph/10xgraph-api.git
+cd 10xgraph-api
+uv sync --dev
+uv run pytest
+uv run pre-commit run --all-files   # ruff, bandit and hygiene checks, as in CI
+uv run mypy
+```
+
+Draft pull requests are welcome, so open early and ask questions in the PR. For bigger changes, start a thread in the core repository's [Discussions](https://github.com/10xGraph/10xGraph/discussions) first so the work does not overlap.
 
 ---