failproofai 1.0.7-beta.2 → 1.0.8-beta.0

package/.next/standalone/fp-cloud-cli/tests/test_keys_queries.py

@@ -34,6 +34,35 @@ def test_policy_permissions_are_assignable_and_in_presets():
     assert "policies:read" in PRESETS["standard"]
     assert "policies:pull" in PRESETS["admin"]
 
+
+def test_jev_permission_is_assignable_and_in_the_admin_preset_only():
+    from fp_cli.permissions import (
+        ALL_PERMISSIONS,
+        ASSIGNABLE_PERMISSIONS,
+        KEY_ASSIGNABLE_PERMISSIONS,
+        PRESETS,
+    )
+
+    assert "jev:evaluate" in ALL_PERMISSIONS
+    # In the server's declared order: after usage:read, and orgs:admin stays last.
+    assert ALL_PERMISSIONS.index("jev:evaluate") == ALL_PERMISSIONS.index("usage:read") + 1
+    assert ALL_PERMISSIONS[-1] == "orgs:admin"
+    # A machine key carries it, so it is grantable to a key as well as a member.
+    assert "jev:evaluate" in ASSIGNABLE_PERMISSIONS
+    assert "jev:evaluate" in KEY_ASSIGNABLE_PERMISSIONS
+    # The server's built-in admin set carries it; nothing narrower does.
+    assert "jev:evaluate" in PRESETS["admin"]
+    assert "jev:evaluate" not in PRESETS["read-only"]
+    assert "jev:evaluate" not in PRESETS["standard"]
+    # And the admin preset can be granted to a key: it carries both permissions
+    # the server requires beside jev:evaluate.
+    assert {"events:add", "policies:pull"} <= set(PRESETS["admin"])
+
+
+def test_parse_permissions_accepts_jev_evaluate():
+    assert _parse_permissions(["events:add policies:pull jev:evaluate"]) == [
+        "events:add", "policies:pull", "jev:evaluate"]
+
 BASE = "http://dash.test"
 
 
@@ -111,6 +140,42 @@ def test_keys_create_rejects_malformed_token(logged_in, runner):
     assert runner.invoke(app, ["keys", "create", "k", "--add", "events:"]).exit_code == 2
 
 
+@respx.mock
+def test_keys_create_machine_preset(logged_in, runner):
+    # The dashboard's key-only `machine` preset: collect, pull policy, Jev.
+    respx.get(f"{BASE}/api/keys").mock(return_value=httpx.Response(200, json=[]))
+    respx.get(f"{BASE}/api/permission-sets").mock(return_value=httpx.Response(200, json=[]))
+    route = respx.post(f"{BASE}/api/keys").mock(
+        return_value=httpx.Response(201, json={"id": "k9", "name": "m", "permissions": [], "created_at": "t"})
+    )
+    result = runner.invoke(app, ["--json", "keys", "create", "m", "--permission-set", "machine"])
+    assert result.exit_code == 0, result.output
+    assert json.loads(route.calls.last.request.content)["permissions"] == ["events:add", "jev:evaluate", "policies:pull"]
+
+
+@respx.mock
+def test_keys_create_refuses_jev_without_its_prerequisites(logged_in, runner):
+    # The server's 422 (JEV_REQUIRES), said before anything is sent.
+    respx.get(f"{BASE}/api/keys").mock(return_value=httpx.Response(200, json=[]))
+    route = respx.post(f"{BASE}/api/keys").mock(return_value=httpx.Response(201, json={}))
+    result = runner.invoke(app, ["--json", "keys", "create", "k", "--add", "jev:evaluate,events:add"])
+    assert result.exit_code == 2, result.output
+    assert "missing: policies:pull" in json.loads(result.stdout)["error"]
+    assert not route.called
+
+
+@respx.mock
+def test_keys_update_refuses_dropping_a_jev_prerequisite(logged_in, runner):
+    respx.get(f"{BASE}/api/keys").mock(return_value=httpx.Response(200, json=[
+        {"id": "k1", "name": "m", "permissions": ["events:add", "jev:evaluate", "policies:pull"],
+         "created_at": "t", "revoked_at": None}]))
+    route = respx.patch(f"{BASE}/api/keys/k1").mock(return_value=httpx.Response(200, json={}))
+    result = runner.invoke(app, ["--json", "keys", "update", "m", "--remove", "events:add", "--yes"])
+    assert result.exit_code == 2, result.output
+    assert "missing: events:add" in json.loads(result.stdout)["error"]
+    assert not route.called
+
+
 @respx.mock
 def test_keys_create_name_collision(logged_in, runner):
     respx.get(f"{BASE}/api/keys").mock(return_value=httpx.Response(200, json=[

package/.next/standalone/fp-cloud-cli/tests/test_policy_check.py

@@ -189,3 +189,64 @@ def test_parsing_and_executing_have_separate_budgets():
 
     assert policy_check._TIMEOUT_SECS == 5
     assert policy_check._SYNTAX_TIMEOUT_SECS > policy_check._TIMEOUT_SECS
+
+
+# ── Jev fields a cloud policy never reads ────────────────────────────────────
+#
+# `semanticPolicies.add` is read only from a pack built by `failproofai publish`,
+# and a cloud policy's authority comes from its deployment record, which never
+# sets it — so both publish as a version that reads Jev-aware and is not. The
+# dashboard refuses them (agenteye `dashboard/lib/policies/policyMeta.ts`,
+# `cloudPublishProblem`); the server never reads the source. These cases are the
+# dashboard's own, so the two surfaces agree on what counts.
+
+JEV_BASE = '''import { customPolicies, allow } from "failproofai";
+
+customPolicies.add({
+  name: "block-wrong-jira-project",
+  description: "Deny Jira writes outside the configured project",
+  match: { events: ["PreToolUse"] },
+  fn: async (ctx) => allow(),
+});
+'''
+_SECOND = JEV_BASE.split("\n", 1)[1].replace("match:", 'authority: "reviewable",\n  match:')
+
+
+@pytest.mark.parametrize("src,needle", [
+    (JEV_BASE, None),
+    (JEV_BASE + '\nsemanticPolicies.add({ name: "db-migration-on-production" });\n', "failproofai pack"),
+    (JEV_BASE.replace("match:", 'authority: "reviewable", reviewedBy: ["destructive-deletion"],\n  match:'),
+     "always hard"),
+    ('// semanticPolicies.add({ name: "later" })\n' + JEV_BASE, None),
+    ('/* customPolicies.add({ authority: "reviewable" }) */\n' + JEV_BASE, None),
+    ('const s = "semanticPolicies.add(";\n' + JEV_BASE, None),
+    (JEV_BASE.replace("allow()", 'allow("authority: reviewable")'), None),
+    (JEV_BASE + '\nsemanticPolicies\n  .add ({ name: "db-migration-on-production" });\n', "failproofai pack"),
+    (JEV_BASE + "\n" + _SECOND, "always hard"),
+], ids=["plain", "semantic", "reviewable", "commented-semantic", "commented-reviewable",
+        "string-literal", "nested-text", "split-spelling", "later-registration"])
+def test_jev_fields_are_refused_the_way_the_dashboard_refuses_them(src, needle):
+    from fp_cli.policy_check import cloud_publish_problem
+
+    problem = cloud_publish_problem(src)
+    if needle is None:
+        assert problem is None
+    else:
+        assert problem and needle in problem
+
+
+def test_publish_refuses_jev_fields_before_anything_is_sent(monkeypatch):
+    """Both `policies publish` and `policies compose --publish` route through
+    `client.publish_policy`, so the refusal lives there — and must fire before
+    the POST, whatever `--no-verify` said about the syntax check."""
+    from fp_cli import client
+    from fp_cli.errors import ApiError
+
+    def _no_post(*a, **kw):
+        raise AssertionError("a refused source reached the server")
+
+    monkeypatch.setattr(client, "_post_json", _no_post)
+    src = JEV_BASE + '\nsemanticPolicies.add({ name: "db-migration-on-production" });\n'
+    with pytest.raises(ApiError) as exc:
+        client.publish_policy(None, "p", src)
+    assert "failproofai publish" in str(exc.value) + (exc.value.hint or "")

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "failproofai",
-  "version": "1.0.7-beta.2",
+  "version": "1.0.8-beta.0",
   "description": "Observability and enforcement for AI agent harnesses. 40 built-in policies hooked into 12 of them — Claude Code, Codex, Cursor, Hermes, OpenClaw and more — blocking the tool call before it runs. Local dashboard included, no account needed.",
   "bin": {
     "failproofai": "./dist/cli.mjs",
@@ -122,15 +122,15 @@
     "browserslist": "4.28.8"
   },
   "optionalDependencies": {
-    "@failproofai/failproofaid-linux-x64": "1.0.7-beta.2",
-    "@failproofai/failproofaid-linux-arm64": "1.0.7-beta.2",
-    "@failproofai/failproofaid-darwin-x64": "1.0.7-beta.2",
-    "@failproofai/failproofaid-darwin-arm64": "1.0.7-beta.2"
+    "@failproofai/failproofaid-linux-x64": "1.0.8-beta.0",
+    "@failproofai/failproofaid-linux-arm64": "1.0.8-beta.0",
+    "@failproofai/failproofaid-darwin-x64": "1.0.8-beta.0",
+    "@failproofai/failproofaid-darwin-arm64": "1.0.8-beta.0"
   },
   "failproofaidBinaries": {
-    "linux-x64": "5362ab6a4cfb23d1eee598aac67aedd9e43351e62724ee1c6b40c4fc8021c08f",
-    "linux-arm64": "f14a2548b41e14ad32b7fdd03a27ffe7160da1046e422e1f651099371b0d27e5",
-    "darwin-x64": "14189cade04f17cf5278bd8061a5ec0c2a2381aa21944ae0d05e8c35b98c2816",
-    "darwin-arm64": "4ba9f5c321894d953407efa3404f0deec07dccfd7db7bc2511bb35226816b583"
+    "linux-x64": "35b641f60e1724513fbb760db382123dad2b5fcdd67dda6373bda80651bd36bb",
+    "linux-arm64": "a058288f5d08f99612f053793e5c7f59264d3da97f3dbe769e401b0f8536702d",
+    "darwin-x64": "b4f3dbe4aea44e77cc10839647c0dc03a1b8b797dfb27e1d89a6a96554ef27b8",
+    "darwin-arm64": "fd42f28bf92001d39117b488a215578b966f07d316214744aca64a1888f2aed2"
   }
 }

package/.next/standalone/sdk/python/CHANGELOG.md

@@ -9,6 +9,13 @@ in `failproofai_sdk/_version.py` becomes that release's GitHub Release body. A
 release whose section is missing or empty is refused before anything is built —
 see `scripts/changelog-section.py`.
 
+## 0.0.1b6 — 2026-09-26
+
+Open for the next release. `0.0.1b5` published on 2026-09-26 and the `bump` job
+moved the version here automatically; nothing has landed against `0.0.1b6` yet.
+Add entries as changes merge — this section becomes the GitHub Release body when
+it ships.
+
 ## 0.0.1b5 — 2026-09-22
 
 Open for the next release. `0.0.1b4` published on 2026-09-22 and the `bump` job

package/.next/standalone/sdk/python/failproofai_sdk/_version.py

@@ -1 +1 @@
-__version__ = "0.0.1b5"
+__version__ = "0.0.1b6"

package/.next/standalone/sdk/typescript/CHANGELOG.md

@@ -12,7 +12,21 @@ section is missing or empty is refused before anything is built.
 
 ### Fixes
 
-- _Nothing yet._
+- **The integration fixtures stop carrying 32 open security advisories.** Nothing
+  the published package ships changed — every fixture under `integration/fixtures/`
+  is `"private": true` and exists only to run the adapters against real framework
+  releases — but their committed lockfiles are read by GitHub's dependency graph,
+  and the old majors those fixtures deliberately pin (`ai@4.3.19`,
+  `@langchain/core@0.3.80`, `@mastra/core@0.24.9`) pin *their* transitive deps
+  exactly, so nothing moved in range. Five fixtures now carry a minimal `overrides`
+  entry — `undici`, `langsmith`, `uuid`, `jsondiffpatch` and five OpenTelemetry
+  packages — clearing 32 of them with every framework pin, and
+  `langchain-dup-core`'s two-copies-of-`@langchain/core` shape, unchanged.
+  Four alerts remain, from two low-severity advisories: one against `ai@4.3.19`
+  (GHSA-rwvc-j5jr-mgvh) and one against the `@ai-sdk/provider-utils@2.2.8` that
+  ships inside it (GHSA-866g-f22w-33x8). Both are fixed only in the major these
+  fixtures exist to stay below, so `SECURITY.md` records them and the rule for
+  the next one. (`nextjs`'s `postcss` is handled in #836.) (#837)
 
 ## 0.0.1-beta.0 — 2026-09-23
 

package/.next/standalone/sdk/typescript/integration/fixtures/ai-4/package-lock.json

@@ -83,6 +83,12 @@
         "zod": "^3.23.8"
       }
     },
+    "node_modules/@dmsnell/diff-match-patch": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@dmsnell/diff-match-patch/-/diff-match-patch-1.1.0.tgz",
+      "integrity": "sha512-yejLPmM5pjsGvxS9gXablUSbInW7H976c/FJ4iQxWIm7/38xBySRemTPDe34lhg1gVLbJntX0+sH0jYfU+PN9A==",
+      "license": "Apache-2.0"
+    },
     "node_modules/@opentelemetry/api": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
@@ -92,12 +98,6 @@
         "node": ">=8.0.0"
       }
     },
-    "node_modules/@types/diff-match-patch": {
-      "version": "1.0.36",
-      "resolved": "https://registry.npmjs.org/@types/diff-match-patch/-/diff-match-patch-1.0.36.tgz",
-      "integrity": "sha512-xFdR6tkm0MWvBfO8xXCSsinYxHcqkQUlcHeSpMC2ukzOb6lwQAfDmW+Qt0AvlGd8HpsS28qKsB+oPeJn9I39jg==",
-      "license": "MIT"
-    },
     "node_modules/@types/node": {
       "version": "22.20.4",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.4.tgz",
@@ -134,18 +134,6 @@
         }
       }
     },
-    "node_modules/chalk": {
-      "version": "5.6.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz",
-      "integrity": "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==",
-      "license": "MIT",
-      "engines": {
-        "node": "^12.17.0 || ^14.13 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
     "node_modules/dequal": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz",
@@ -155,12 +143,6 @@
         "node": ">=6"
       }
     },
-    "node_modules/diff-match-patch": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/diff-match-patch/-/diff-match-patch-1.0.5.tgz",
-      "integrity": "sha512-IayShXAgj/QMXgB0IWmKx+rOPuGMhqm5w6jvFxmVenXKIzRqTAAsbBPT3kWQeGANj3jGgvcvv4yK6SxqYmikgw==",
-      "license": "Apache-2.0"
-    },
     "node_modules/json-schema": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/json-schema/-/json-schema-0.4.0.tgz",
@@ -168,14 +150,12 @@
       "license": "(AFL-2.1 OR BSD-3-Clause)"
     },
     "node_modules/jsondiffpatch": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/jsondiffpatch/-/jsondiffpatch-0.6.0.tgz",
-      "integrity": "sha512-3QItJOXp2AP1uv7waBkao5nCvhEv+QmJAd38Ybq7wNI74Q+BBmnLn4EDKz6yI9xGAIQoUF87qHt+kc1IVxB4zQ==",
+      "version": "0.7.6",
+      "resolved": "https://registry.npmjs.org/jsondiffpatch/-/jsondiffpatch-0.7.6.tgz",
+      "integrity": "sha512-zE9+AXFq+MkTolDor2Cw1nJzLC0aleqPkYf52Kb4Kn4mJcka/gFHpGI2JBVEJCfWOvBl0OoxZS+wuLdislQcqg==",
       "license": "MIT",
       "dependencies": {
-        "@types/diff-match-patch": "^1.0.36",
-        "chalk": "^5.3.0",
-        "diff-match-patch": "^1.0.5"
+        "@dmsnell/diff-match-patch": "^1.1.0"
       },
       "bin": {
         "jsondiffpatch": "bin/jsondiffpatch.js"

package/.next/standalone/sdk/typescript/integration/fixtures/ai-4/package.json

@@ -9,5 +9,8 @@
   },
   "devDependencies": {
     "@types/node": "22.20.4"
+  },
+  "overrides": {
+    "jsondiffpatch": "0.7.6"
   }
 }

package/.next/standalone/sdk/typescript/integration/fixtures/ai-5/package-lock.json

@@ -60,15 +60,6 @@
         "zod": "^3.25.76 || ^4.1.8"
       }
     },
-    "node_modules/@fastify/busboy": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
-      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=14"
-      }
-    },
     "node_modules/@opentelemetry/api": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
@@ -137,15 +128,12 @@
       "license": "(AFL-2.1 OR BSD-3-Clause)"
     },
     "node_modules/undici": {
-      "version": "5.29.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
-      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
+      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
       "license": "MIT",
-      "dependencies": {
-        "@fastify/busboy": "^2.0.0"
-      },
       "engines": {
-        "node": ">=14.0"
+        "node": ">=20.18.1"
       }
     },
     "node_modules/undici-types": {

package/.next/standalone/sdk/typescript/integration/fixtures/ai-5/package.json

@@ -9,5 +9,8 @@
   },
   "devDependencies": {
     "@types/node": "22.20.4"
+  },
+  "overrides": {
+    "undici": "7.29.0"
   }
 }

package/.next/standalone/sdk/typescript/integration/fixtures/langchain-0.3/package-lock.json

@@ -111,20 +111,6 @@
         }
       }
     },
-    "node_modules/@langchain/langgraph-sdk/node_modules/uuid": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz",
-      "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
     "node_modules/@types/json-schema": {
       "version": "7.0.15",
       "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
@@ -147,12 +133,6 @@
       "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA==",
       "license": "MIT"
     },
-    "node_modules/@types/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-7gqG38EyHgyP1S+7+xomFtL+ZNHcKv6DwNaCZmJmo1vgMugyF3TCnXVg4t1uk89mLNwnLtnY3TpOpCOyp1/xHQ==",
-      "license": "MIT"
-    },
     "node_modules/ansi-styles": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
@@ -197,64 +177,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
-      }
-    },
-    "node_modules/chalk/node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "license": "MIT",
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "license": "MIT",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "license": "MIT"
-    },
-    "node_modules/console-table-printer": {
-      "version": "2.16.1",
-      "resolved": "https://registry.npmjs.org/console-table-printer/-/console-table-printer-2.16.1.tgz",
-      "integrity": "sha512-Sc9FRJ4O9xKGNrvulNdPfK5SyBcZ6lcaRnDE4AQ/uw6IDtjHhsqyzzqcnMikjyGaiOOF2tNOKoBhbVjRvFy9Lw==",
-      "license": "MIT",
-      "dependencies": {
-        "simple-wcswidth": "^1.1.2"
-      }
-    },
     "node_modules/decamelize": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz",
@@ -270,15 +192,6 @@
       "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==",
       "license": "MIT"
     },
-    "node_modules/has-flag": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/js-tiktoken": {
       "version": "1.0.21",
       "resolved": "https://registry.npmjs.org/js-tiktoken/-/js-tiktoken-1.0.21.tgz",
@@ -289,23 +202,19 @@
       }
     },
     "node_modules/langsmith": {
-      "version": "0.3.87",
-      "resolved": "https://registry.npmjs.org/langsmith/-/langsmith-0.3.87.tgz",
-      "integrity": "sha512-XXR1+9INH8YX96FKWc5tie0QixWz6tOqAsAKfcJyPkE0xPep+NDz0IQLR32q4bn10QK3LqD2HN6T3n6z1YLW7Q==",
+      "version": "0.10.5",
+      "resolved": "https://registry.npmjs.org/langsmith/-/langsmith-0.10.5.tgz",
+      "integrity": "sha512-VUh6LQYGb+wjmMz5Ulazqx1rUHLbWi2XZvVkSHfxDjz6V7u9TJOB6jW5CC84xcpffu7Jr1MZpBbEz3gg972HbA==",
       "license": "MIT",
       "dependencies": {
-        "@types/uuid": "^10.0.0",
-        "chalk": "^4.1.2",
-        "console-table-printer": "^2.12.1",
-        "p-queue": "^6.6.2",
-        "semver": "^7.6.3",
-        "uuid": "^10.0.0"
+        "p-queue": "6.6.2"
       },
       "peerDependencies": {
         "@opentelemetry/api": "*",
         "@opentelemetry/exporter-trace-otlp-proto": "*",
         "@opentelemetry/sdk-trace-base": "*",
-        "openai": "*"
+        "openai": "*",
+        "ws": ">=7"
       },
       "peerDependenciesMeta": {
         "@opentelemetry/api": {
@@ -319,6 +228,9 @@
         },
         "openai": {
           "optional": true
+        },
+        "ws": {
+          "optional": true
         }
       }
     },
@@ -390,36 +302,6 @@
         "node": ">= 4"
       }
     },
-    "node_modules/semver": {
-      "version": "7.8.5",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
-      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/simple-wcswidth": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/simple-wcswidth/-/simple-wcswidth-1.1.2.tgz",
-      "integrity": "sha512-j7piyCjAeTDSjzTSQ7DokZtMNwNlEAyxqSZeCS+CXH7fJ4jx3FuJ/mTW3mE+6JLs4VJBbcll0Kjn+KXI5t21Iw==",
-      "license": "MIT"
-    },
-    "node_modules/supports-color": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "license": "MIT",
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/undici-types": {
       "version": "6.21.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
@@ -428,17 +310,16 @@
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
+      "version": "11.1.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.1.tgz",
+      "integrity": "sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==",
       "funding": [
         "https://github.com/sponsors/broofa",
         "https://github.com/sponsors/ctavan"
       ],
       "license": "MIT",
       "bin": {
-        "uuid": "dist/bin/uuid"
+        "uuid": "dist/esm/bin/uuid"
       }
     },
     "node_modules/zod": {

package/.next/standalone/sdk/typescript/integration/fixtures/langchain-0.3/package.json

@@ -11,5 +11,9 @@
   },
   "devDependencies": {
     "@types/node": "22.20.4"
+  },
+  "overrides": {
+    "langsmith": "0.10.5",
+    "uuid": "11.1.1"
   }
 }