langgraph-api 0.14.0.dev4__py3-none-any.whl → 0.14.0.dev6__py3-none-any.whl

langgraph_api/__init__.py

@@ -1 +1 @@
-__version__ = "0.14.0.dev4"
+__version__ = "0.14.0.dev6"

langgraph_api/_checkpointer/_adapter.py

@@ -262,6 +262,17 @@ class _CustomCheckpointerAdapter(BaseCheckpointSaver):
         return f"{next_v:032}.{next_h:.16f}"
 
 
+def _encryption_context_provider() -> Callable[[], dict[str, Any]] | None:
+    """Supply request-scoped encryption context to the gRPC checkpointer."""
+    if not config.LANGGRAPH_ENCRYPTION:
+        return None
+    from langgraph_api.encryption.context import (  # noqa: PLC0415
+        get_encryption_context,
+    )
+
+    return get_encryption_context
+
+
 async def get_checkpointer(
     *,
     conn: Any | None = None,
@@ -331,6 +342,7 @@ async def get_checkpointer(
             GrpcCheckpointer(
                 get_stub=_get_shared_checkpointer_stub,
                 serializer=_ApiSerializer(),
+                encryption_context_provider=_encryption_context_provider(),
             ),
         )
 
@@ -345,6 +357,7 @@ async def get_checkpointer(
             GrpcCheckpointer(
                 get_stub=_get_shared_checkpointer_stub,
                 serializer=_ApiSerializer(),
+                encryption_context_provider=_encryption_context_provider(),
             ),
         )
 

langgraph_api/api/__init__.py

@@ -236,6 +236,11 @@ if HTTP_CONFIG:
                 user_router.router.lifespan_context,
             )
 
+# Keep the reference to user router's lifespan in case it gets combined with other lifespans.
+custom_app_lifespan = (
+    None if user_router is None else user_router.router.lifespan_context
+)
+
 
 if "__inmem" in MIGRATIONS_PATH:
     from langgraph_runtime_inmem.routes import get_internal_routes

langgraph_api/api/a2a.py

@@ -27,6 +27,7 @@ from starlette.responses import JSONResponse, Response
 from typing_extensions import TypedDict
 
 from langgraph_api import __version__
+from langgraph_api.config import A2A_ALLOWED_TOOL_CALL_RESULTS
 from langgraph_api.metadata import USER_API_URL
 from langgraph_api.route import ApiRequest, ApiRoute
 from langgraph_api.schema import RunCommand
@@ -893,6 +894,12 @@ def _tool_result_data(message: dict[str, Any]) -> dict[str, Any] | None:
     if not isinstance(tool_call_id, str) or not tool_call_id:
         return None
 
+    if (
+        A2A_ALLOWED_TOOL_CALL_RESULTS is not None
+        and message.get("name") not in A2A_ALLOWED_TOOL_CALL_RESULTS
+    ):
+        return None
+
     result: dict[str, Any] = {"toolCallId": tool_call_id}
     content = message.get("content")
     if content not in (None, ""):

langgraph_api/beacon_data_plane_jwt_auth.py

@@ -0,0 +1,71 @@
+"""Data-plane JWT authentication for Beacon OTLP exports."""
+
+import time
+from datetime import UTC, datetime, timedelta
+from typing import Any
+
+import jwt
+from requests.sessions import Session
+
+DATA_PLANE_AUTH_HEADER = "X-Data-Plane-Auth"
+BEACON_OTEL_COLLECTOR_PURPOSE = "beacon-otel-collector"
+
+_BEACON_OTEL_JWT_TTL_SECONDS = 60 * 60
+_BEACON_OTEL_JWT_REFRESH_BEFORE_SECONDS = 60
+
+
+def sign_data_plane_jwt(data_plane_id: str, organization_id: str, secret: str) -> str:
+    now = datetime.now(UTC)
+    return jwt.encode(
+        {
+            "data_plane_id": data_plane_id,
+            "organization_id": organization_id,
+            "purpose": BEACON_OTEL_COLLECTOR_PURPOSE,
+            "iat": now,
+            "exp": now + timedelta(seconds=_BEACON_OTEL_JWT_TTL_SECONDS),
+        },
+        secret,
+        algorithm="HS256",
+    )
+
+
+class _BeaconOtelJWTCache:
+    def __init__(self, data_plane_id: str, organization_id: str, secret: str) -> None:
+        self._data_plane_id = data_plane_id
+        self._organization_id = organization_id
+        self._secret = secret
+        self._cached_token: tuple[str, float] | None = None
+
+    def get(self) -> str:
+        cached_token = self._cached_token
+        if cached_token is not None:
+            token, refresh_at = cached_token
+            if time.monotonic() < refresh_at:
+                return token
+
+        token = sign_data_plane_jwt(
+            self._data_plane_id, self._organization_id, self._secret
+        )
+        refresh_at = time.monotonic() + (
+            _BEACON_OTEL_JWT_TTL_SECONDS - _BEACON_OTEL_JWT_REFRESH_BEFORE_SECONDS
+        )
+        self._cached_token = (token, refresh_at)
+        return token
+
+
+class _DataPlaneAuthSession(Session):
+    def __init__(self, cache: _BeaconOtelJWTCache) -> None:
+        super().__init__()
+        self._cache = cache
+
+    def request(self, method: str, url: str, **kwargs: Any):
+        headers = dict(kwargs.pop("headers", None) or {})
+        headers[DATA_PLANE_AUTH_HEADER] = self._cache.get()
+        return super().request(method, url, headers=headers, **kwargs)
+
+
+def beacon_otel_session(
+    data_plane_id: str, organization_id: str, secret: str
+) -> Session:
+    cache = _BeaconOtelJWTCache(data_plane_id, organization_id, secret)
+    return _DataPlaneAuthSession(cache)

langgraph_api/config/__init__.py

@@ -251,6 +251,17 @@ JSON_THREAD_POOL_MINIMUM_SIZE_BYTES = 100 * 1024  # 100 KB
 HTTP_CONFIG = env("LANGGRAPH_HTTP", cast=_parse.parse_schema(HttpConfig), default=None)
 MCP_ENABLED = HTTP_CONFIG is None or not HTTP_CONFIG.get("disable_mcp")
 A2A_ENABLED = HTTP_CONFIG is None or not HTTP_CONFIG.get("disable_a2a")
+
+
+def _parse_allowed_tool_call_results(value: str) -> frozenset[str]:
+    return frozenset(name.strip() for name in value.split(",") if name.strip())
+
+
+A2A_ALLOWED_TOOL_CALL_RESULTS = env(
+    "A2A_ALLOWED_TOOL_CALL_RESULTS",
+    cast=_parse_allowed_tool_call_results,
+    default=None,
+)
 WEBHOOKS_ENABLED = HTTP_CONFIG and HTTP_CONFIG.get("disable_webhooks")
 # Not in public docs: populated by langgraph.json config, not set as env var directly
 STORE_CONFIG = env(
@@ -603,6 +614,14 @@ DATADOG_METRICS_ENABLED = bool(LSD_DD_API_KEY)
 EXPOSE_INTERNAL_METRICS_PROMETHEUS = env(
     "EXPOSE_INTERNAL_METRICS_PROMETHEUS", cast=bool, default=False
 )
+
+# These are only set for internal agents (polly/insights/engine/etc..) deployed in byoc so we can fetch logs (see api/langgraph_api/self_hosted_logs.py)
+DATA_PLANE_ID: str | None = env("DATA_PLANE_ID", cast=str, default=None)
+DATA_PLANE_ORG_ID: str | None = env("DATA_PLANE_ORG_ID", cast=str, default=None)
+DATA_PLANE_JWT_SECRET: str | None = env("DATA_PLANE_JWT_SECRET", cast=str, default=None)
+BYOC_HOST = env("BYOC_HOST", cast=str, default="byoc")
+BYOC_ENV = env("BYOC_ENV", cast=str, default="byoc")
+
 LANGGRAPH_LOGS_ENDPOINT = env("LANGGRAPH_LOGS_ENDPOINT", cast=str, default=None)
 LANGGRAPH_LOGS_ENABLED = env("LANGGRAPH_LOGS_ENABLED", cast=bool, default=False)
 
@@ -649,6 +668,8 @@ __all__ = [
     "BG_JOB_MAX_RETRIES",
     "BG_JOB_SHUTDOWN_GRACE_PERIOD_SECS",
     "BG_JOB_TIMEOUT_SECS",
+    "BYOC_ENV",
+    "BYOC_HOST",
     "CHECKPOINTER_CONFIG",
     "CHECKPOINTER_POSTGRES_POOL_MIN_SIZE",
     "CHECKPOINTER_POSTGRES_POOL_TIMEOUT_SECONDS",
@@ -659,6 +680,9 @@ __all__ = [
     "CRON_SCHEDULER_SLEEP_TIME",
     "DATABASE_URI",
     "DATADOG_METRICS_ENABLED",
+    "DATA_PLANE_ID",
+    "DATA_PLANE_JWT_SECRET",
+    "DATA_PLANE_ORG_ID",
     "DB_MIGRATION_BY_CORE_API",
     "EXPOSE_INTERNAL_METRICS_PROMETHEUS",
     "FF_CRONS_ENABLED",

langgraph_api/grpc/servicers/encryption.py

@@ -19,6 +19,7 @@ from langgraph_grpc_common.proto.encryption_pb2 import (
 from langgraph_grpc_common.proto.encryption_pb2_grpc import EncryptionServicer
 from langgraph_sdk import EncryptionContext
 
+from langgraph_api.encryption.custom import get_custom_encryption_instance
 from langgraph_api.encryption.middleware import _extract_skip_fields
 from langgraph_api.encryption.shared import BLOB_ENCRYPTION_CONTEXT_KEY, get_encryption
 from langgraph_api.schema import NESTED_ENCRYPTED_SUBFIELDS
@@ -250,10 +251,11 @@ class EncryptionServicerImpl(EncryptionServicer):
 
             encryptor = encryption_instance.get_json_encryptor(model_type)
             if encryptor is None:
-                context.set_code(grpc.StatusCode.INVALID_ARGUMENT)
-                model_err = f"No encryptor configured for model type: {model_type}"
-                context.set_details(model_err)
-                raise RuntimeError(model_err)
+                metadata = _parse_metadata(dict(request.context.metadata))
+                if metadata:
+                    data[BLOB_ENCRYPTION_CONTEXT_KEY] = metadata
+                    return EncryptResponse(data=orjson.dumps(data))
+                return EncryptResponse(data=request.data)
 
             # Use recursive encryption that handles NESTED_ENCRYPTED_SUBFIELDS
             encrypted = await self._encrypt_field_recursive(
@@ -279,12 +281,7 @@ class EncryptionServicerImpl(EncryptionServicer):
         request,
         context: grpc_aio.ServicerContext,
     ) -> DecryptResponse:
-        """Decrypt JSON data using the configured encryption.
-
-        Uses the JsonEncryptionWrapper which routes to the appropriate decryptor
-        based on the encryption context marker (handles AES migration).
-        Handles nested subfields defined in NESTED_ENCRYPTED_SUBFIELDS recursively.
-        """
+        """Decrypt JSON data using the configured encryption."""
         try:
             encryption_instance = get_encryption()
             if encryption_instance is None:
@@ -300,12 +297,9 @@ class EncryptionServicerImpl(EncryptionServicer):
             # removes it, so we save and restore it after decryption.
             blob_enc_ctx = data.get(BLOB_ENCRYPTION_CONTEXT_KEY)
 
-            # Model and field are optional, used for decryptor selection/routing
             model_type: ModelType | None = request.model or None
             field = request.field or None
 
-            # Get the decryptor from the wrapper (handles routing based on
-            # __encryption_context__ marker in the data)
             decryptor = encryption_instance.get_json_decryptor(model_type)
             if decryptor is None:
                 model_err = f"No decryptor configured for model type: {model_type}"
@@ -313,7 +307,6 @@ class EncryptionServicerImpl(EncryptionServicer):
                 context.set_details(model_err)
                 raise RuntimeError(model_err)
 
-            # Use recursive decryption that handles NESTED_ENCRYPTED_SUBFIELDS
             decrypted = await self._decrypt_field_recursive(
                 data, model_type, field or "", decryptor
             )
@@ -334,3 +327,63 @@ class EncryptionServicerImpl(EncryptionServicer):
                 context.set_code(grpc.StatusCode.INTERNAL)
                 context.set_details(f"Decryption failed: {e}")
             raise
+
+    async def EncryptBlob(
+        self,
+        request,
+        context: grpc_aio.ServicerContext,
+    ) -> EncryptResponse:
+        """Encrypt opaque bytes with the configured blob handler."""
+        try:
+            encryption_instance = get_custom_encryption_instance()
+            if (
+                encryption_instance is None
+                or encryption_instance._blob_encryptor is None
+            ):
+                context.set_code(grpc.StatusCode.FAILED_PRECONDITION)
+                context.set_details("No blob encryption configured")
+                raise RuntimeError("No blob encryption configured")
+
+            enc_ctx = _build_encryption_context(
+                request.context.model or None,
+                request.context.field or None,
+                dict(request.context.metadata),
+            )
+            encrypted = await encryption_instance._blob_encryptor(enc_ctx, request.data)
+            return EncryptResponse(data=encrypted)
+        except Exception as e:
+            await logger.aerror("EncryptBlob failed", error=str(e), exc_info=True)
+            if context.code() is None:
+                context.set_code(grpc.StatusCode.INTERNAL)
+                context.set_details(f"Blob encryption failed: {e}")
+            raise
+
+    async def DecryptBlob(
+        self,
+        request,
+        context: grpc_aio.ServicerContext,
+    ) -> DecryptResponse:
+        """Decrypt opaque bytes with the configured blob handler."""
+        try:
+            encryption_instance = get_custom_encryption_instance()
+            if (
+                encryption_instance is None
+                or encryption_instance._blob_decryptor is None
+            ):
+                context.set_code(grpc.StatusCode.FAILED_PRECONDITION)
+                context.set_details("No blob decryption configured")
+                raise RuntimeError("No blob decryption configured")
+
+            enc_ctx = _build_encryption_context(
+                request.context.model or None,
+                request.context.field or None,
+                dict(request.context.metadata),
+            )
+            decrypted = await encryption_instance._blob_decryptor(enc_ctx, request.data)
+            return DecryptResponse(data=decrypted)
+        except Exception as e:
+            await logger.aerror("DecryptBlob failed", error=str(e), exc_info=True)
+            if context.code() is None:
+                context.set_code(grpc.StatusCode.INTERNAL)
+                context.set_details(f"Blob decryption failed: {e}")
+            raise

langgraph_api/queue_entrypoint.py

@@ -180,12 +180,11 @@ async def entrypoint(
 ):
     from langgraph_api import logging as lg_logging  # noqa: PLC0415
     from langgraph_api import timing  # noqa: PLC0415
-    from langgraph_api.api import user_router  # noqa: PLC0415
+    from langgraph_api.api import custom_app_lifespan  # noqa: PLC0415
     from langgraph_api.server import app  # noqa: PLC0415
 
     lg_logging.set_logging_context({"entrypoint": entrypoint_name})
     tasks: set[asyncio.Task] = set()
-    user_lifespan = None if user_router is None else user_router.router.lifespan_context
     wrapped_lifespan = timing.combine_lifespans(
         functools.partial(
             lifespan.lifespan,
@@ -193,7 +192,7 @@ async def entrypoint(
             taskset=tasks,
             cancel_event=cancel_event,
         ),
-        user_lifespan,
+        custom_app_lifespan,
     )
 
     async with wrapped_lifespan(app):

langgraph_api/self_hosted_logs.py

@@ -10,6 +10,7 @@ from opentelemetry.sdk.resources import SERVICE_NAME, Resource
 from opentelemetry.util.types import Attributes
 
 from langgraph_api import config
+from langgraph_api.beacon_data_plane_jwt_auth import beacon_otel_session
 from langgraph_api.logging import OTLPFormatter
 
 logger = structlog.stdlib.get_logger(__name__)
@@ -45,10 +46,27 @@ def initialize_self_hosted_logs() -> None:
         raise RuntimeError(
             "LANGGRAPH_LOGS_ENABLED is true but no LANGGRAPH_LOGS_ENDPOINT is configured"
         )
+    log_endpoint = config.LANGGRAPH_LOGS_ENDPOINT
+
+    data_plane_settings = (
+        ("DATA_PLANE_ID", config.DATA_PLANE_ID),
+        ("DATA_PLANE_ORG_ID", config.DATA_PLANE_ORG_ID),
+        ("DATA_PLANE_JWT_SECRET", config.DATA_PLANE_JWT_SECRET),
+    )
+    has_data_plane_settings = any(value for _, value in data_plane_settings)
+    missing_data_plane_settings = [
+        name for name, value in data_plane_settings if not value
+    ]
+    if has_data_plane_settings and missing_data_plane_settings:
+        raise RuntimeError(
+            "LANGGRAPH_LOGS_ENABLED is true but required data plane settings are missing: "
+            + ", ".join(missing_data_plane_settings)
+        )
 
-    # For now, this is only enabled for fully self-hosted customers
-    # We will need to update the otel collector auth model to support hybrid customers
-    if not config.LANGGRAPH_CLOUD_LICENSE_KEY:
+    # "data-plane" here refers to a BYOC data plane
+    is_data_plane = has_data_plane_settings
+    # For now, the non-data-plane path is only enabled for fully self-hosted customers.
+    if not is_data_plane and not config.LANGGRAPH_CLOUD_LICENSE_KEY:
         logger.warning(
             "Self-hosted logs require a license key, and do not work with hybrid deployments yet."
         )
@@ -58,6 +76,13 @@ def initialize_self_hosted_logs() -> None:
         resource_attributes = {
             SERVICE_NAME: config.SELF_HOSTED_OBSERVABILITY_SERVICE_NAME,
         }
+        if is_data_plane:
+            resource_attributes["data_plane_id"] = cast("str", config.DATA_PLANE_ID)
+            resource_attributes["organization_id"] = cast(
+                "str", config.DATA_PLANE_ORG_ID
+            )
+            resource_attributes["host"] = config.BYOC_HOST
+            resource_attributes["env"] = config.BYOC_ENV
 
         if config.LANGGRAPH_CLOUD_LICENSE_KEY:
             try:
@@ -70,43 +95,47 @@ def initialize_self_hosted_logs() -> None:
                     _customer_attributes["customer_id"] = CUSTOMER_ID
                 if CUSTOMER_NAME:
                     _customer_attributes["customer_name"] = CUSTOMER_NAME
-
-                # resolves to pod name in k8s, or container id in docker
-                instance_id = os.environ.get("HOSTNAME")
-                if instance_id:
-                    _customer_attributes["instance_id"] = instance_id
             except ImportError:
                 pass
             except Exception as e:
                 logger.warning("Failed to get customer info from license", exc_info=e)
 
+        # Resolves to pod name in k8s, or container ID in Docker.
+        instance_id = os.environ.get("HOSTNAME")
+        if instance_id:
+            _customer_attributes["instance_id"] = instance_id
+
         if config.IS_QUEUE_ENTRYPOINT:
             _customer_attributes["entrypoint"] = "queue"
-        elif config.IS_EXECUTOR_ENTRYPOINT:
-            _customer_attributes["entrypoint"] = "executor"
         else:
             _customer_attributes["entrypoint"] = "api"
 
-        _logger_provider = LoggerProvider(
-            resource=Resource.create(resource_attributes),
-        )
-        _logger_provider.add_log_record_processor(
-            BatchLogRecordProcessor(
-                OTLPLogExporter(
-                    endpoint=config.LANGGRAPH_LOGS_ENDPOINT,
-                    headers={
-                        "X-Langchain-License-Key": config.LANGGRAPH_CLOUD_LICENSE_KEY,
-                    },
-                )
+        if is_data_plane:
+            exporter = OTLPLogExporter(
+                endpoint=log_endpoint,
+                session=beacon_otel_session(
+                    cast("str", config.DATA_PLANE_ID),
+                    cast("str", config.DATA_PLANE_ORG_ID),
+                    cast("str", config.DATA_PLANE_JWT_SECRET),
+                ),
             )
-        )
+        else:
+            exporter = OTLPLogExporter(
+                endpoint=log_endpoint,
+                headers={
+                    "X-Langchain-License-Key": config.LANGGRAPH_CLOUD_LICENSE_KEY,
+                },
+            )
+
+        _logger_provider = LoggerProvider(resource=Resource.create(resource_attributes))
+        _logger_provider.add_log_record_processor(BatchLogRecordProcessor(exporter))
         handler = AttrFilteredLoggingHandler(logger_provider=_logger_provider)
         handler.setFormatter(OTLPFormatter("%(message)s", None, "%"))
         logging.getLogger().addHandler(handler)
 
         logger.info(
             "Self-hosted logs initialized successfully",
-            endpoint=config.LANGGRAPH_LOGS_ENDPOINT,
+            endpoint=log_endpoint,
         )
     except Exception as e:
         logger.exception("Failed to initialize self-hosted logs", exc_info=e)

langgraph_api/server.py

@@ -30,6 +30,7 @@ from starlette.types import Receive, Scope, Send
 
 import langgraph_api.config as config
 from langgraph_api.api import (
+    custom_app_lifespan,
     middleware_for_protected_routes,
     protected_routes,
     shadowable_meta_routes,
@@ -234,9 +235,10 @@ if user_router:
     update_openapi_spec(app)
 
     # Merge lifespans (base + user)
-    user_lifespan = app.router.lifespan_context
     validate_router_lifespan_hooks(app.router)
-    app.router.lifespan_context = timing.combine_lifespans(lifespan, user_lifespan)
+    app.router.lifespan_context = timing.combine_lifespans(
+        lifespan, custom_app_lifespan
+    )
 
     # Merge exception handlers (base + user)
     for k, v in exception_handlers.items():

{langgraph_api-0.14.0.dev4.dist-info → langgraph_api-0.14.0.dev6.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.14.0.dev4
+Version: 0.14.0.dev6
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE

{langgraph_api-0.14.0.dev4.dist-info → langgraph_api-0.14.0.dev6.dist-info}/RECORD

@@ -1,7 +1,8 @@
-langgraph_api/__init__.py,sha256=TRbvHLqUmdbeUp8WLcQvUajr8378KygoWAAegER8gcU,28
+langgraph_api/__init__.py,sha256=5ZhhvR8DrRSoagQmnUmoCJhIF6VMGURhyWB6-ohDQmU,28
 langgraph_api/_factory_utils.py,sha256=_FqW0olMu2PGLsnRq0ylt3a4jDCe12YIFHExMXI6Nyo,5976
 langgraph_api/asgi_transport.py,sha256=XApY3lIWBZTMbbsl8dDJzl0cLGirmAGE0SifqZUnXvs,11896
 langgraph_api/asyncio.py,sha256=smqyAoO9nIyPPQRw1IVSCh85fwoZP4PEo-5dDhxGruc,10676
+langgraph_api/beacon_data_plane_jwt_auth.py,sha256=SoX2M-_u7oas6zWyss2LBs83E6ynBCFOoD5vVJEHRSU,2297
 langgraph_api/cache.py,sha256=LuB3Te0UdXC8a-uEJoRHoe5XsgXulXI59f_Q6DCJNKc,13005
 langgraph_api/cli.py,sha256=ATtS9s9Cx7QNiGPJceKnMCko29A25ZA-xz39fdxmgfg,22389
 langgraph_api/command.py,sha256=d-k8h6H4ix1n7fSZ-Zb01NbSkEyqrD6cMKfDFXEIYEw,821
@@ -18,14 +19,14 @@ langgraph_api/metrics_collector.py,sha256=gMLHL18rJyYl985AOmu9eH7W1ttdRdkPHzeycz
 langgraph_api/metrics_otlp.py,sha256=YppnNCHmQBj7wZbtKYLJS68_tbD6sGTJXGKIySqUTjU,29657
 langgraph_api/otel_context.py,sha256=DWFwW4Yu88QY4W2J0IRcURR450Th9J2DupvDDkSkMBA,7166
 langgraph_api/patch.py,sha256=ViUknYvyQWS6y0f5XuaEoci2qB_mQv8vZl-oaUxsI6M,1448
-langgraph_api/queue_entrypoint.py,sha256=1pb7kUWLbc1jIElZ2KTronREFXh3Vq0Sx4_feZX-YxE,11610
+langgraph_api/queue_entrypoint.py,sha256=Bh8YPWN_2Dj3hxnYE9T3w9Igc8bIq7UcT8dngOOX36k,11535
 langgraph_api/release_tags.py,sha256=Dd2L2Mdh7c5D7RhFvdGCXROLH3WI1QKXbEqgjITFFoQ,9437
 langgraph_api/route.py,sha256=_KE8A8Q-J-QfqjGlyM2Kc6n5cirmgt8xmI5-pI8kVEE,8837
 langgraph_api/schema.py,sha256=EkarLwAUKApevb03AmLRumrAVAc2EsG_SLhYFPncSzk,15318
-langgraph_api/self_hosted_logs.py,sha256=FoUkPdtpt-nuEhejne8o1Q2phE9CccoHdoR_PvXPcBU,4442
+langgraph_api/self_hosted_logs.py,sha256=rzzr9iVwJgNbDHjrxvuTODCtzpdr9-9X6UAB-3OaXU0,5742
 langgraph_api/self_hosted_metrics.py,sha256=pWsQQ-2ukoFIbmVfzNOSkwCqZ5Cnts6pRSWTII44Ll4,16844
 langgraph_api/serde.py,sha256=V3fO9bkUOlBX3okw5Qi31nlcr59fcuXMgL7DHNyarZY,8855
-langgraph_api/server.py,sha256=1eAZPim0Pkgh5oGS4EvW-_7Zh_82iGOZtR1rpX08FoA,11216
+langgraph_api/server.py,sha256=R0z4R6DjnRwsqjDOjWD-7R3nKoQcS6v7UriG1LuzA1o,11213
 langgraph_api/sse.py,sha256=cChZ7raQUHp8p5BreE_5wMBR8lFO0n7746sV8_HQOrc,4822
 langgraph_api/state.py,sha256=A6jx2OpcVmiFNBafjZ2tX1x6s_AhBk5EW2drd-vaqIc,4396
 langgraph_api/store.py,sha256=i-jVfWzDEmPESVofh1tNWbo0HMLiLz_BSKKV4QjN-dE,5027
@@ -37,10 +38,10 @@ langgraph_api/validation.py,sha256=4wBPaPbgZU3oysd5XSYi3RRQN7MXM_qIdiifSpnjl10,1
 langgraph_api/webhook.py,sha256=qXEtkE6orek2POeOQmPRsEarJgXIYp-LBrZB-OwITxc,9572
 langgraph_api/worker.py,sha256=zWd14iZ9m9TLb9yD_QwTMxHcfM8dd3bhKtM1lz86M80,21256
 langgraph_api/_checkpointer/__init__.py,sha256=ofJTJLGy7Hsuzhj-2dpfDvrDloM0BzlhTzvZOdR9K8U,2223
-langgraph_api/_checkpointer/_adapter.py,sha256=1jJi0vXoNKeCwNP26W8bmYrwe-fOWFqepnovYFt14W0,21782
+langgraph_api/_checkpointer/_adapter.py,sha256=idGYL-FwyVtUXcmhvfYboARfQAkoj0aFD40L5h9N7F8,22289
 langgraph_api/_checkpointer/protocol.py,sha256=udgYKMNtKWG_eLDwYkHXV3b2bZLZg8Rsfm3fjkhU-rU,3635
-langgraph_api/api/__init__.py,sha256=Zu1ew3dxYZu7cLRAjn-6HcYmtuQBdihlVFMKMJ77Y3c,9269
-langgraph_api/api/a2a.py,sha256=l2nAmN5qHuYhpyi4ecvvPQDeXgpL3UJkTNe6_7f975k,113469
+langgraph_api/api/__init__.py,sha256=88elgNmz6Y1tIi81dzhHa94KVhLvvIqyEJjcov4aH5U,9463
+langgraph_api/api/a2a.py,sha256=yfVWREWZZYLUUsOEuT8dnTIyQsNIa7CrNfIlGQqfBLQ,113688
 langgraph_api/api/assistants.py,sha256=YelrvQWKNLIoqJheQ1riK2dhCTH3GenbmWyD5fEp-ok,21936
 langgraph_api/api/event_streaming.py,sha256=jvoBp5qHI92JJHsx4f9LEpb0i0VE31G_qFhS5JQWtlA,17809
 langgraph_api/api/meta.py,sha256=5s017GfMs-Ghq6Z5K6yW4UjbVFzCsmeXKn4UEJmfs98,4757
@@ -65,7 +66,7 @@ langgraph_api/auth/studio_user.py,sha256=gNCicIo6cYaHmFj2sEdsvDYkKW7NWfGXGS2tTAM
 langgraph_api/auth/langsmith/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 langgraph_api/auth/langsmith/backend.py,sha256=Y6-VxD7zfV1jzGdjmQ66CgNa3SenLbo3d_375CcKZ9U,3770
 langgraph_api/auth/langsmith/client.py,sha256=79kwCVeHU64nsHsxWipfZhf44lM6vfs2nlfTxlJF6LU,4142
-langgraph_api/config/__init__.py,sha256=lAjul8uDI2uKU5RrxT_EGEoYS4SfGRYwb8G_3dR1MjA,26500
+langgraph_api/config/__init__.py,sha256=4hZs8qHDt5Yx9Pr8bvPCsnf5BjAokrD4BLCvtGNbwkM,27403
 langgraph_api/config/_parse.py,sha256=RpfZgFAPJlRMv13AzGr3kAYbIrqHcgjzO8IgeboTw4A,3922
 langgraph_api/config/schemas.py,sha256=cHzVvepthpD7DDeWE2ytkOHah-iDNH7xRx9dSWUatQI,20864
 langgraph_api/encryption/__init__.py,sha256=gaCZ00CocSbqSqrDn6XJHaSp2CZCnC8qnrD9G4fbzyI,363
@@ -95,7 +96,7 @@ langgraph_api/grpc/ops/runs.py,sha256=4-Mp-4MgDAn8uerLrOpmXuUqOdfcnzSmb3hSRlO8Hh
 langgraph_api/grpc/ops/threads.py,sha256=SJraV838nZ0m6wRrCia7sLYh8KK1WfY7x5xmcspZLek,48140
 langgraph_api/grpc/servicers/__init__.py,sha256=l8yqTA_gMbIj0xHw5-RZYo0JbjL-EpFD8RxPMgW_-bA,422
 langgraph_api/grpc/servicers/checkpointer.py,sha256=aeB2hzsDxbb9i-ildx-kylpDxaYtpAUSG6rphOzbDOs,10482
-langgraph_api/grpc/servicers/encryption.py,sha256=_qpcrjURpnm7PvdWOronNt3FtmqR1mjwxUb5bWMj32I,12962
+langgraph_api/grpc/servicers/encryption.py,sha256=UuBjpUK-tCbPXfx2-AFn0vbmeWw_UBe7xl8pMbwQdbA,15083
 langgraph_api/js/.gitignore,sha256=l5yI6G_V6F1600I1IjiUKn87f4uYIrBAYU1MOyBBhg4,59
 langgraph_api/js/.prettierrc,sha256=0es3ovvyNIqIw81rPQsdt1zCQcOdBqyR_DMbFE4Ifms,19
 langgraph_api/js/.yarnclean,sha256=a5Vf1gAk2gxjcNrGidXoA3URy1fI3Ow5F3zDuVQg5wQ,728
@@ -165,7 +166,7 @@ hatch_build.py,sha256=Nn9N-EFfVqmH5q3iCUrhqX6zc7qT1jLI3gWSBN2xgYQ,1738
 logging.json,sha256=sBy8HDDPuucpLbLUD6e8t5fsiQjJoklZsbVHi2qQ7aQ,367
 openapi.json,sha256=C009Hi2gZaUKU4OOf2P12Qdjodx1mxZd16RAm1lZiIw,219991
 langgraph_grpc_common/__init__.py,sha256=sO7jFHekQxt6zZPhTPZAWLYLB_S8w7-VuJ7NyWFlFNo,97
-langgraph_grpc_common/checkpointer.py,sha256=-rn9SwChijGHZQyWNHfK-WIMCqu3UCeo5ZKlOb6zAMg,14175
+langgraph_grpc_common/checkpointer.py,sha256=-F51xCHjP3A2gWfwVTTm7x7w9YsH78qJnZ57zTYAwdI,15344
 langgraph_grpc_common/serde.py,sha256=8q290nZ6TdxbEhCTzwEs44XGi2b-3pfrUeMYY5WGlTY,6179
 langgraph_grpc_common/store.py,sha256=YCO8oUssjnFq-n1syBsA_wxkwo8Sp0bgnDrpYjUxv40,4030
 langgraph_grpc_common/conversion/__init__.py,sha256=pLsOrRtmF9YkgmCPhcfym6lYOB7PCJTRItyo1YK_AT8,208
@@ -177,18 +178,18 @@ langgraph_grpc_common/conversion/store.py,sha256=eQQ7YHrMYRsd1jN9LbqvCxGQGErySV_
 langgraph_grpc_common/conversion/struct.py,sha256=yk4jpPdywzn8UosAohun21lU5D_IIglOY9rkBhiG-gA,2072
 langgraph_grpc_common/conversion/value.py,sha256=KW-z0gvpvCq8iWUjjtx8F3XQGM7XsL-D9GzPzdtuMsA,10206
 langgraph_grpc_common/proto/__init__.py,sha256=eBejrrULiDdasi3_Hga_AJW8ZPMkjKyyAeW9Ey640Ks,1375
-langgraph_grpc_common/proto/checkpointer_pb2.py,sha256=8tjrdaG1VCOZFOhoz3n29CAG5T-1YKGnxVgDjEHCgms,7915
-langgraph_grpc_common/proto/checkpointer_pb2.pyi,sha256=rGUxQyNFifmu8OPy0S418sCWSBQY_CVckobPXtFfZfs,20763
+langgraph_grpc_common/proto/checkpointer_pb2.py,sha256=dQMt9vNXqXDvTU6euvH52uliDsL44BSppJIsAySmPfc,9039
+langgraph_grpc_common/proto/checkpointer_pb2.pyi,sha256=Jjr9-oeKGk1wuIFf8m7zoCb9lHty1Bh9u-jxvRvqYLI,23319
 langgraph_grpc_common/proto/checkpointer_pb2_grpc.py,sha256=FQJK-lC8alOkLltA51aq1ABam62rVerTZRZccTFqUjw,20152
 langgraph_grpc_common/proto/checkpointer_pb2_grpc.pyi,sha256=8fPL90WjHnMaREG7l9qYt5fQePeT8YFWQ0qVy56QtYw,10210
 langgraph_grpc_common/proto/core_api_pb2.py,sha256=r5KLcYAtjqTiKzv671Vwa6teYdsV9gHFkorK5HOs6Aw,51151
 langgraph_grpc_common/proto/core_api_pb2.pyi,sha256=sulKXZ_SD94mQKkz7zKHum1XGo3KDfFSnR09vkV15A0,208955
 langgraph_grpc_common/proto/core_api_pb2_grpc.py,sha256=bONBb3GptNvrgOSI4accjE_f9IA8xxbfarDs1Knrosg,81198
 langgraph_grpc_common/proto/core_api_pb2_grpc.pyi,sha256=XLu2-5YZHm9QyZWjWsnUWe7uN6n1-avVvsyR6N5D3fs,29325
-langgraph_grpc_common/proto/encryption_pb2.py,sha256=CNR6gn2boBIXMbFyOwiA11Ss6kbldPkN1PGnZqTyrjo,3355
-langgraph_grpc_common/proto/encryption_pb2.pyi,sha256=5RL8DYNT4B1y30Oo5dt1kVvIULOlehXkNiYRmiPwAeY,8264
-langgraph_grpc_common/proto/encryption_pb2_grpc.py,sha256=fXed_A8Iwzk8vJl-22SdoUq1HHXpqqwRNsSmD3P_3BM,5213
-langgraph_grpc_common/proto/encryption_pb2_grpc.pyi,sha256=WtMy-dZA1KtMwltz_UP8MuKAxRX-tRwE8UuJouAUh7o,2902
+langgraph_grpc_common/proto/encryption_pb2.py,sha256=CEDsn3bJv2e_QzAFsvp2845Nac_lBRPGsb_9pFJthxE,4119
+langgraph_grpc_common/proto/encryption_pb2.pyi,sha256=YWilpCKKzV9u2BA8i-Pq4gStaxhBgqo_fAxTLnreG40,10647
+langgraph_grpc_common/proto/encryption_pb2_grpc.py,sha256=H05u5VP1bVgYCtiELRb44DOr0wlmA6w8WtMCuqAyYLk,8681
+langgraph_grpc_common/proto/encryption_pb2_grpc.pyi,sha256=KJzuCnp3xKuy-hAwRNHZEF75DQ6scmiq_QMTDY-BSbY,4428
 langgraph_grpc_common/proto/engine_common_pb2.py,sha256=CdNIXXE924mrseYyOcD6x0O5zLcNeU8ihdiCxlamHH8,29198
 langgraph_grpc_common/proto/engine_common_pb2.pyi,sha256=BM3-HPagho_LA74pg4SAX1FV_Lnn6jXut2CKArFBu88,115071
 langgraph_grpc_common/proto/engine_common_pb2_grpc.py,sha256=dqNIakFHauOuu0B6VK7z_VRb6yuY-jdA11glk0IgdkM,893
@@ -237,8 +238,8 @@ langgraph_grpc_common/proto/store_pb2.py,sha256=thQ5HBLblZ7Adayp1U8ty_lrpn-7XEHn
 langgraph_grpc_common/proto/store_pb2.pyi,sha256=_dcxyxV8moR6H67qU42r2h2p_Ub-PZSHs3OoS9KMdSY,27782
 langgraph_grpc_common/proto/store_pb2_grpc.py,sha256=Kyt8eV2NXkjh3be_BYytGdD19kNf74961cruonMvCrw,3300
 langgraph_grpc_common/proto/store_pb2_grpc.pyi,sha256=oS1h2cDoq2OjyM8xazcmc8LwRDC5oCAD0zto2QUmPQw,2027
-langgraph_api-0.14.0.dev4.dist-info/METADATA,sha256=PfmnlH5UDtzwQGa8uLrV7Y1mBQZTmHAIjSoU6QmdhBg,4630
-langgraph_api-0.14.0.dev4.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-langgraph_api-0.14.0.dev4.dist-info/entry_points.txt,sha256=hGedv8n7cgi41PypMfinwS_HfCwA7xJIfS0jAp8htV8,78
-langgraph_api-0.14.0.dev4.dist-info/licenses/LICENSE,sha256=ZPwVR73Biwm3sK6vR54djCrhaRiM4cAD2zvOQZV8Xis,3859
-langgraph_api-0.14.0.dev4.dist-info/RECORD,,
+langgraph_api-0.14.0.dev6.dist-info/METADATA,sha256=Y8KYhDNzjBif5sHNqYkfnqy9YrbQmUcKERm8yBnfYeQ,4630
+langgraph_api-0.14.0.dev6.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+langgraph_api-0.14.0.dev6.dist-info/entry_points.txt,sha256=hGedv8n7cgi41PypMfinwS_HfCwA7xJIfS0jAp8htV8,78
+langgraph_api-0.14.0.dev6.dist-info/licenses/LICENSE,sha256=ZPwVR73Biwm3sK6vR54djCrhaRiM4cAD2zvOQZV8Xis,3859
+langgraph_api-0.14.0.dev6.dist-info/RECORD,,

langgraph_grpc_common/checkpointer.py

@@ -16,6 +16,7 @@ from typing import TYPE_CHECKING, Any, TypeVar, cast
 
 import grpc
 import grpc.aio
+import orjson
 from langgraph.checkpoint.base import (
     BaseCheckpointSaver,
     ChannelVersions,
@@ -43,6 +44,7 @@ if TYPE_CHECKING:
 T = TypeVar("T")
 RetryFn = Callable[[Callable[[], Awaitable[Any]], str], Awaitable[Any]]
 StubProvider = Callable[[], Awaitable["CheckpointerStub"]]
+EncryptionContextProvider = Callable[[], Mapping[str, Any]]
 
 
 class GrpcCheckpointer(BaseCheckpointSaver):
@@ -57,6 +59,7 @@ class GrpcCheckpointer(BaseCheckpointSaver):
         retry: RetryFn | None = None,
         retry_context_prefix: str | None = None,
         serializer: SerializerProtocol | None = None,
+        encryption_context_provider: EncryptionContextProvider | None = None,
     ) -> None:
         """Construct a gRPC checkpointer client.
 
@@ -74,18 +77,34 @@ class GrpcCheckpointer(BaseCheckpointSaver):
                 so unrelated gRPC ops sharing
                 ``langgraph_grpc_common.conversion.*`` keep using the
                 process-wide default
+            encryption_context_provider: Optional callable returning the
+                request-scoped encryption context, sent with writes so the
+                server can encrypt blobs with the caller's context. Injected
+                rather than read directly because the context lives in a
+                ``ContextVar`` owned by ``langgraph_api``, which this package
+                does not depend on.
         """
         super().__init__(serde=None)
         self._get_stub = get_stub
         self._retry = retry
         self._retry_context_prefix = retry_context_prefix or type(self).__name__
         self._serializer = serializer
+        self._encryption_context_provider = encryption_context_provider
         self.latest_iter = None
         try:
             self._loop: asyncio.AbstractEventLoop | None = asyncio.get_running_loop()
         except RuntimeError:
             self._loop = None
 
+    def _encryption_context_json(self) -> dict[str, bytes]:
+        """Return encryption context as JSON-encoded proto map values."""
+        if self._encryption_context_provider is None:
+            return {}
+        context = self._encryption_context_provider()
+        if not context:
+            return {}
+        return {key: orjson.dumps(value) for key, value in context.items()}
+
     def _scoped(self) -> AbstractContextManager[None]:
         """Bind ``self._serializer`` for the duration of a conversion call."""
         if self._serializer is None:
@@ -168,6 +187,7 @@ class GrpcCheckpointer(BaseCheckpointSaver):
                 checkpoint=ckpt_conv.checkpoint_to_proto(checkpoint),
                 metadata=ckpt_conv.checkpoint_metadata_to_proto(metadata),
                 new_versions={k: str(v) for k, v in new_versions.items()},
+                encryption_context_json=self._encryption_context_json(),
             )
 
         async def _request() -> RunnableConfig:
@@ -202,6 +222,7 @@ class GrpcCheckpointer(BaseCheckpointSaver):
                 writes=ckpt_conv.writes_to_proto(writes),
                 task_id=task_id,
                 task_path=task_path,
+                encryption_context_json=self._encryption_context_json(),
             )
 
         async def _request() -> None:

langgraph_grpc_common/proto/checkpointer_pb2.py

@@ -26,7 +26,7 @@ from google.protobuf import empty_pb2 as google_dot_protobuf_dot_empty__pb2
 from . import engine_common_pb2 as engine__common__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x12\x63heckpointer.proto\x12\x0c\x63heckpointer\x1a\x1bgoogle/protobuf/empty.proto\x1a\x13\x65ngine-common.proto\"\x97\x02\n\nPutRequest\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\x12,\n\ncheckpoint\x18\x02 \x01(\x0b\x32\x18.engineCommon.Checkpoint\x12\x32\n\x08metadata\x18\x03 \x01(\x0b\x32 .engineCommon.CheckpointMetadata\x12?\n\x0cnew_versions\x18\x04 \x03(\x0b\x32).checkpointer.PutRequest.NewVersionsEntry\x1a\x32\n\x10NewVersionsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x8f\x01\n\x10PutWritesRequest\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\x12#\n\x06writes\x18\x02 \x03(\x0b\x32\x13.engineCommon.Write\x12\x0f\n\x07task_id\x18\x03 \x01(\t\x12\x11\n\ttask_path\x18\x04 \x01(\t\"\x86\x01\n\x0c\x43\x61pabilities\x12\x1e\n\x16supports_delete_thread\x18\x01 \x01(\x08\x12\x16\n\x0esupports_prune\x18\x02 \x01(\x08\x12 \n\x18supports_delete_for_runs\x18\x03 \x01(\x08\x12\x1c\n\x14supports_copy_thread\x18\x04 \x01(\x08\"\xa8\x01\n\x0bListRequest\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\x12\x13\n\x0b\x66ilter_json\x18\x02 \x01(\x0c\x12\x32\n\x06\x62\x65\x66ore\x18\x03 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\x12\x12\n\x05limit\x18\x04 \x01(\x03H\x00\x88\x01\x01\x42\x08\n\x06_limit\"(\n\x13\x44\x65leteThreadRequest\x12\x11\n\tthread_id\x18\x01 \x01(\t\"\'\n\x14\x44\x65leteForRunsRequest\x12\x0f\n\x07run_ids\x18\x01 \x03(\t\"A\n\x11\x43opyThreadRequest\x12\x16\n\x0e\x66rom_thread_id\x18\x01 \x01(\t\x12\x14\n\x0cto_thread_id\x18\x02 \x01(\t\"\xa1\x01\n\x0cPruneRequest\x12\x12\n\nthread_ids\x18\x01 \x03(\t\x12:\n\x08strategy\x18\x02 \x01(\x0e\x32(.checkpointer.PruneRequest.PruneStrategy\"A\n\rPruneStrategy\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x0f\n\x0bKEEP_LATEST\x10\x01\x12\x0e\n\nDELETE_ALL\x10\x02\"E\n\x0fGetTupleRequest\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\"F\n\x0bPutResponse\x12\x37\n\x0bnext_config\x18\x01 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\"H\n\x0cListResponse\x12\x38\n\x11\x63heckpoint_tuples\x18\x01 \x03(\x0b\x32\x1d.engineCommon.CheckpointTuple\"e\n\x10GetTupleResponse\x12<\n\x10\x63heckpoint_tuple\x18\x01 \x01(\x0b\x32\x1d.engineCommon.CheckpointTupleH\x00\x88\x01\x01\x42\x13\n\x11_checkpoint_tuple\"~\n\x18\x44\x65ltaChannelHistoryEntry\x12-\n\x04seed\x18\x01 \x01(\x0b\x32\x1a.engineCommon.ChannelValueH\x00\x88\x01\x01\x12*\n\x06writes\x18\x02 \x03(\x0b\x32\x1a.engineCommon.PendingWriteB\x07\n\x05_seed\"r\n\x1dGetDeltaChannelHistoryRequest\x12\x11\n\tthread_id\x18\x01 \x01(\t\x12\x15\n\rcheckpoint_ns\x18\x02 \x01(\t\x12\x15\n\rcheckpoint_id\x18\x03 \x01(\t\x12\x10\n\x08\x63hannels\x18\x04 \x03(\t\"\xc4\x01\n\x1eGetDeltaChannelHistoryResponse\x12J\n\x07\x65ntries\x18\x01 \x03(\x0b\x32\x39.checkpointer.GetDeltaChannelHistoryResponse.EntriesEntry\x1aV\n\x0c\x45ntriesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x35\n\x05value\x18\x02 \x01(\x0b\x32&.checkpointer.DeltaChannelHistoryEntry:\x02\x38\x01\x32\xf1\x05\n\x0c\x43heckpointer\x12:\n\x03Put\x12\x18.checkpointer.PutRequest\x1a\x19.checkpointer.PutResponse\x12\x43\n\tPutWrites\x12\x1e.checkpointer.PutWritesRequest\x1a\x16.google.protobuf.Empty\x12\x45\n\x0fGetCapabilities\x12\x16.google.protobuf.Empty\x1a\x1a.checkpointer.Capabilities\x12=\n\x04List\x12\x19.checkpointer.ListRequest\x1a\x1a.checkpointer.ListResponse\x12I\n\x08GetTuple\x12\x1d.checkpointer.GetTupleRequest\x1a\x1e.checkpointer.GetTupleResponse\x12I\n\x0c\x44\x65leteThread\x12!.checkpointer.DeleteThreadRequest\x1a\x16.google.protobuf.Empty\x12K\n\rDeleteForRuns\x12\".checkpointer.DeleteForRunsRequest\x1a\x16.google.protobuf.Empty\x12\x45\n\nCopyThread\x12\x1f.checkpointer.CopyThreadRequest\x1a\x16.google.protobuf.Empty\x12;\n\x05Prune\x12\x1a.checkpointer.PruneRequest\x1a\x16.google.protobuf.Empty\x12s\n\x16GetDeltaChannelHistory\x12+.checkpointer.GetDeltaChannelHistoryRequest\x1a,.checkpointer.GetDeltaChannelHistoryResponseB?Z=github.com/langchain-ai/langgraph-api/core/internal/engine/pbb\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x12\x63heckpointer.proto\x12\x0c\x63heckpointer\x1a\x1bgoogle/protobuf/empty.proto\x1a\x13\x65ngine-common.proto\"\xab\x03\n\nPutRequest\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\x12,\n\ncheckpoint\x18\x02 \x01(\x0b\x32\x18.engineCommon.Checkpoint\x12\x32\n\x08metadata\x18\x03 \x01(\x0b\x32 .engineCommon.CheckpointMetadata\x12?\n\x0cnew_versions\x18\x04 \x03(\x0b\x32).checkpointer.PutRequest.NewVersionsEntry\x12T\n\x17\x65ncryption_context_json\x18\x05 \x03(\x0b\x32\x33.checkpointer.PutRequest.EncryptionContextJsonEntry\x1a\x32\n\x10NewVersionsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\x1a<\n\x1a\x45ncryptionContextJsonEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\x0c:\x02\x38\x01\"\xa9\x02\n\x10PutWritesRequest\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\x12#\n\x06writes\x18\x02 \x03(\x0b\x32\x13.engineCommon.Write\x12\x0f\n\x07task_id\x18\x03 \x01(\t\x12\x11\n\ttask_path\x18\x04 \x01(\t\x12Z\n\x17\x65ncryption_context_json\x18\x05 \x03(\x0b\x32\x39.checkpointer.PutWritesRequest.EncryptionContextJsonEntry\x1a<\n\x1a\x45ncryptionContextJsonEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\x0c:\x02\x38\x01\"\x86\x01\n\x0c\x43\x61pabilities\x12\x1e\n\x16supports_delete_thread\x18\x01 \x01(\x08\x12\x16\n\x0esupports_prune\x18\x02 \x01(\x08\x12 \n\x18supports_delete_for_runs\x18\x03 \x01(\x08\x12\x1c\n\x14supports_copy_thread\x18\x04 \x01(\x08\"\xa8\x01\n\x0bListRequest\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\x12\x13\n\x0b\x66ilter_json\x18\x02 \x01(\x0c\x12\x32\n\x06\x62\x65\x66ore\x18\x03 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\x12\x12\n\x05limit\x18\x04 \x01(\x03H\x00\x88\x01\x01\x42\x08\n\x06_limit\"(\n\x13\x44\x65leteThreadRequest\x12\x11\n\tthread_id\x18\x01 \x01(\t\"\'\n\x14\x44\x65leteForRunsRequest\x12\x0f\n\x07run_ids\x18\x01 \x03(\t\"A\n\x11\x43opyThreadRequest\x12\x16\n\x0e\x66rom_thread_id\x18\x01 \x01(\t\x12\x14\n\x0cto_thread_id\x18\x02 \x01(\t\"\xa1\x01\n\x0cPruneRequest\x12\x12\n\nthread_ids\x18\x01 \x03(\t\x12:\n\x08strategy\x18\x02 \x01(\x0e\x32(.checkpointer.PruneRequest.PruneStrategy\"A\n\rPruneStrategy\x12\x0f\n\x0bUNSPECIFIED\x10\x00\x12\x0f\n\x0bKEEP_LATEST\x10\x01\x12\x0e\n\nDELETE_ALL\x10\x02\"E\n\x0fGetTupleRequest\x12\x32\n\x06\x63onfig\x18\x01 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\"F\n\x0bPutResponse\x12\x37\n\x0bnext_config\x18\x01 \x01(\x0b\x32\".engineCommon.EngineRunnableConfig\"H\n\x0cListResponse\x12\x38\n\x11\x63heckpoint_tuples\x18\x01 \x03(\x0b\x32\x1d.engineCommon.CheckpointTuple\"e\n\x10GetTupleResponse\x12<\n\x10\x63heckpoint_tuple\x18\x01 \x01(\x0b\x32\x1d.engineCommon.CheckpointTupleH\x00\x88\x01\x01\x42\x13\n\x11_checkpoint_tuple\"~\n\x18\x44\x65ltaChannelHistoryEntry\x12-\n\x04seed\x18\x01 \x01(\x0b\x32\x1a.engineCommon.ChannelValueH\x00\x88\x01\x01\x12*\n\x06writes\x18\x02 \x03(\x0b\x32\x1a.engineCommon.PendingWriteB\x07\n\x05_seed\"r\n\x1dGetDeltaChannelHistoryRequest\x12\x11\n\tthread_id\x18\x01 \x01(\t\x12\x15\n\rcheckpoint_ns\x18\x02 \x01(\t\x12\x15\n\rcheckpoint_id\x18\x03 \x01(\t\x12\x10\n\x08\x63hannels\x18\x04 \x03(\t\"\xc4\x01\n\x1eGetDeltaChannelHistoryResponse\x12J\n\x07\x65ntries\x18\x01 \x03(\x0b\x32\x39.checkpointer.GetDeltaChannelHistoryResponse.EntriesEntry\x1aV\n\x0c\x45ntriesEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\x35\n\x05value\x18\x02 \x01(\x0b\x32&.checkpointer.DeltaChannelHistoryEntry:\x02\x38\x01\x32\xf1\x05\n\x0c\x43heckpointer\x12:\n\x03Put\x12\x18.checkpointer.PutRequest\x1a\x19.checkpointer.PutResponse\x12\x43\n\tPutWrites\x12\x1e.checkpointer.PutWritesRequest\x1a\x16.google.protobuf.Empty\x12\x45\n\x0fGetCapabilities\x12\x16.google.protobuf.Empty\x1a\x1a.checkpointer.Capabilities\x12=\n\x04List\x12\x19.checkpointer.ListRequest\x1a\x1a.checkpointer.ListResponse\x12I\n\x08GetTuple\x12\x1d.checkpointer.GetTupleRequest\x1a\x1e.checkpointer.GetTupleResponse\x12I\n\x0c\x44\x65leteThread\x12!.checkpointer.DeleteThreadRequest\x1a\x16.google.protobuf.Empty\x12K\n\rDeleteForRuns\x12\".checkpointer.DeleteForRunsRequest\x1a\x16.google.protobuf.Empty\x12\x45\n\nCopyThread\x12\x1f.checkpointer.CopyThreadRequest\x1a\x16.google.protobuf.Empty\x12;\n\x05Prune\x12\x1a.checkpointer.PruneRequest\x1a\x16.google.protobuf.Empty\x12s\n\x16GetDeltaChannelHistory\x12+.checkpointer.GetDeltaChannelHistoryRequest\x1a,.checkpointer.GetDeltaChannelHistoryResponseB?Z=github.com/langchain-ai/langgraph-api/core/internal/engine/pbb\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -36,44 +36,52 @@ if not _descriptor._USE_C_DESCRIPTORS:
   _globals['DESCRIPTOR']._serialized_options = b'Z=github.com/langchain-ai/langgraph-api/core/internal/engine/pb'
   _globals['_PUTREQUEST_NEWVERSIONSENTRY']._loaded_options = None
   _globals['_PUTREQUEST_NEWVERSIONSENTRY']._serialized_options = b'8\001'
+  _globals['_PUTREQUEST_ENCRYPTIONCONTEXTJSONENTRY']._loaded_options = None
+  _globals['_PUTREQUEST_ENCRYPTIONCONTEXTJSONENTRY']._serialized_options = b'8\001'
+  _globals['_PUTWRITESREQUEST_ENCRYPTIONCONTEXTJSONENTRY']._loaded_options = None
+  _globals['_PUTWRITESREQUEST_ENCRYPTIONCONTEXTJSONENTRY']._serialized_options = b'8\001'
   _globals['_GETDELTACHANNELHISTORYRESPONSE_ENTRIESENTRY']._loaded_options = None
   _globals['_GETDELTACHANNELHISTORYRESPONSE_ENTRIESENTRY']._serialized_options = b'8\001'
   _globals['_PUTREQUEST']._serialized_start=87
-  _globals['_PUTREQUEST']._serialized_end=366
-  _globals['_PUTREQUEST_NEWVERSIONSENTRY']._serialized_start=316
-  _globals['_PUTREQUEST_NEWVERSIONSENTRY']._serialized_end=366
-  _globals['_PUTWRITESREQUEST']._serialized_start=369
-  _globals['_PUTWRITESREQUEST']._serialized_end=512
-  _globals['_CAPABILITIES']._serialized_start=515
-  _globals['_CAPABILITIES']._serialized_end=649
-  _globals['_LISTREQUEST']._serialized_start=652
-  _globals['_LISTREQUEST']._serialized_end=820
-  _globals['_DELETETHREADREQUEST']._serialized_start=822
-  _globals['_DELETETHREADREQUEST']._serialized_end=862
-  _globals['_DELETEFORRUNSREQUEST']._serialized_start=864
-  _globals['_DELETEFORRUNSREQUEST']._serialized_end=903
-  _globals['_COPYTHREADREQUEST']._serialized_start=905
-  _globals['_COPYTHREADREQUEST']._serialized_end=970
-  _globals['_PRUNEREQUEST']._serialized_start=973
-  _globals['_PRUNEREQUEST']._serialized_end=1134
-  _globals['_PRUNEREQUEST_PRUNESTRATEGY']._serialized_start=1069
-  _globals['_PRUNEREQUEST_PRUNESTRATEGY']._serialized_end=1134
-  _globals['_GETTUPLEREQUEST']._serialized_start=1136
-  _globals['_GETTUPLEREQUEST']._serialized_end=1205
-  _globals['_PUTRESPONSE']._serialized_start=1207
-  _globals['_PUTRESPONSE']._serialized_end=1277
-  _globals['_LISTRESPONSE']._serialized_start=1279
-  _globals['_LISTRESPONSE']._serialized_end=1351
-  _globals['_GETTUPLERESPONSE']._serialized_start=1353
-  _globals['_GETTUPLERESPONSE']._serialized_end=1454
-  _globals['_DELTACHANNELHISTORYENTRY']._serialized_start=1456
-  _globals['_DELTACHANNELHISTORYENTRY']._serialized_end=1582
-  _globals['_GETDELTACHANNELHISTORYREQUEST']._serialized_start=1584
-  _globals['_GETDELTACHANNELHISTORYREQUEST']._serialized_end=1698
-  _globals['_GETDELTACHANNELHISTORYRESPONSE']._serialized_start=1701
-  _globals['_GETDELTACHANNELHISTORYRESPONSE']._serialized_end=1897
-  _globals['_GETDELTACHANNELHISTORYRESPONSE_ENTRIESENTRY']._serialized_start=1811
-  _globals['_GETDELTACHANNELHISTORYRESPONSE_ENTRIESENTRY']._serialized_end=1897
-  _globals['_CHECKPOINTER']._serialized_start=1900
-  _globals['_CHECKPOINTER']._serialized_end=2653
+  _globals['_PUTREQUEST']._serialized_end=514
+  _globals['_PUTREQUEST_NEWVERSIONSENTRY']._serialized_start=402
+  _globals['_PUTREQUEST_NEWVERSIONSENTRY']._serialized_end=452
+  _globals['_PUTREQUEST_ENCRYPTIONCONTEXTJSONENTRY']._serialized_start=454
+  _globals['_PUTREQUEST_ENCRYPTIONCONTEXTJSONENTRY']._serialized_end=514
+  _globals['_PUTWRITESREQUEST']._serialized_start=517
+  _globals['_PUTWRITESREQUEST']._serialized_end=814
+  _globals['_PUTWRITESREQUEST_ENCRYPTIONCONTEXTJSONENTRY']._serialized_start=454
+  _globals['_PUTWRITESREQUEST_ENCRYPTIONCONTEXTJSONENTRY']._serialized_end=514
+  _globals['_CAPABILITIES']._serialized_start=817
+  _globals['_CAPABILITIES']._serialized_end=951
+  _globals['_LISTREQUEST']._serialized_start=954
+  _globals['_LISTREQUEST']._serialized_end=1122
+  _globals['_DELETETHREADREQUEST']._serialized_start=1124
+  _globals['_DELETETHREADREQUEST']._serialized_end=1164
+  _globals['_DELETEFORRUNSREQUEST']._serialized_start=1166
+  _globals['_DELETEFORRUNSREQUEST']._serialized_end=1205
+  _globals['_COPYTHREADREQUEST']._serialized_start=1207
+  _globals['_COPYTHREADREQUEST']._serialized_end=1272
+  _globals['_PRUNEREQUEST']._serialized_start=1275
+  _globals['_PRUNEREQUEST']._serialized_end=1436
+  _globals['_PRUNEREQUEST_PRUNESTRATEGY']._serialized_start=1371
+  _globals['_PRUNEREQUEST_PRUNESTRATEGY']._serialized_end=1436
+  _globals['_GETTUPLEREQUEST']._serialized_start=1438
+  _globals['_GETTUPLEREQUEST']._serialized_end=1507
+  _globals['_PUTRESPONSE']._serialized_start=1509
+  _globals['_PUTRESPONSE']._serialized_end=1579
+  _globals['_LISTRESPONSE']._serialized_start=1581
+  _globals['_LISTRESPONSE']._serialized_end=1653
+  _globals['_GETTUPLERESPONSE']._serialized_start=1655
+  _globals['_GETTUPLERESPONSE']._serialized_end=1756
+  _globals['_DELTACHANNELHISTORYENTRY']._serialized_start=1758
+  _globals['_DELTACHANNELHISTORYENTRY']._serialized_end=1884
+  _globals['_GETDELTACHANNELHISTORYREQUEST']._serialized_start=1886
+  _globals['_GETDELTACHANNELHISTORYREQUEST']._serialized_end=2000
+  _globals['_GETDELTACHANNELHISTORYRESPONSE']._serialized_start=2003
+  _globals['_GETDELTACHANNELHISTORYRESPONSE']._serialized_end=2199
+  _globals['_GETDELTACHANNELHISTORYRESPONSE_ENTRIESENTRY']._serialized_start=2113
+  _globals['_GETDELTACHANNELHISTORYRESPONSE_ENTRIESENTRY']._serialized_end=2199
+  _globals['_CHECKPOINTER']._serialized_start=2202
+  _globals['_CHECKPOINTER']._serialized_end=2955
 # @@protoc_insertion_point(module_scope)

langgraph_grpc_common/proto/checkpointer_pb2.pyi

@@ -22,6 +22,12 @@ DESCRIPTOR: _descriptor.FileDescriptor
 
 @_typing.final
 class PutRequest(_message.Message):
+    """encryption_context_json: request-scoped encryption context, keyed by name
+    with JSON-encoded values (e.g. {"tenant_id": "\\"acme\\""}). Writes must pass
+    it because it lives in a Python ContextVar the core server cannot observe;
+    reads recover it from the stored blob wrapper.
+    """
+
     DESCRIPTOR: _descriptor.Descriptor
 
     @_typing.final
@@ -44,10 +50,31 @@ class PutRequest(_message.Message):
         def ClearField(self, field_name: _ClearFieldArgType) -> None: ...
         def WhichOneof(self, oneof_group: _Never) -> None: ...
 
+    @_typing.final
+    class EncryptionContextJsonEntry(_message.Message):
+        DESCRIPTOR: _descriptor.Descriptor
+
+        KEY_FIELD_NUMBER: _builtins.int
+        VALUE_FIELD_NUMBER: _builtins.int
+        key: _builtins.str
+        value: _builtins.bytes
+        def __init__(
+            self,
+            *,
+            key: _builtins.str = ...,
+            value: _builtins.bytes = ...,
+        ) -> None: ...
+        _HasFieldArgType: _TypeAlias = _Never  # noqa: Y015
+        def HasField(self, field_name: _HasFieldArgType) -> _builtins.bool: ...
+        _ClearFieldArgType: _TypeAlias = _typing.Literal["key", b"key", "value", b"value"]  # noqa: Y015
+        def ClearField(self, field_name: _ClearFieldArgType) -> None: ...
+        def WhichOneof(self, oneof_group: _Never) -> None: ...
+
     CONFIG_FIELD_NUMBER: _builtins.int
     CHECKPOINT_FIELD_NUMBER: _builtins.int
     METADATA_FIELD_NUMBER: _builtins.int
     NEW_VERSIONS_FIELD_NUMBER: _builtins.int
+    ENCRYPTION_CONTEXT_JSON_FIELD_NUMBER: _builtins.int
     @_builtins.property
     def config(self) -> _engine_common_pb2.EngineRunnableConfig: ...
     @_builtins.property
@@ -56,6 +83,8 @@ class PutRequest(_message.Message):
     def metadata(self) -> _engine_common_pb2.CheckpointMetadata: ...
     @_builtins.property
     def new_versions(self) -> _containers.ScalarMap[_builtins.str, _builtins.str]: ...
+    @_builtins.property
+    def encryption_context_json(self) -> _containers.ScalarMap[_builtins.str, _builtins.bytes]: ...
     def __init__(
         self,
         *,
@@ -63,10 +92,11 @@ class PutRequest(_message.Message):
         checkpoint: _engine_common_pb2.Checkpoint | None = ...,
         metadata: _engine_common_pb2.CheckpointMetadata | None = ...,
         new_versions: _abc.Mapping[_builtins.str, _builtins.str] | None = ...,
+        encryption_context_json: _abc.Mapping[_builtins.str, _builtins.bytes] | None = ...,
     ) -> None: ...
     _HasFieldArgType: _TypeAlias = _typing.Literal["checkpoint", b"checkpoint", "config", b"config", "metadata", b"metadata"]  # noqa: Y015
     def HasField(self, field_name: _HasFieldArgType) -> _builtins.bool: ...
-    _ClearFieldArgType: _TypeAlias = _typing.Literal["checkpoint", b"checkpoint", "config", b"config", "metadata", b"metadata", "new_versions", b"new_versions"]  # noqa: Y015
+    _ClearFieldArgType: _TypeAlias = _typing.Literal["checkpoint", b"checkpoint", "config", b"config", "encryption_context_json", b"encryption_context_json", "metadata", b"metadata", "new_versions", b"new_versions"]  # noqa: Y015
     def ClearField(self, field_name: _ClearFieldArgType) -> None: ...
     def WhichOneof(self, oneof_group: _Never) -> None: ...
 
@@ -76,16 +106,39 @@ Global___PutRequest: _TypeAlias = PutRequest  # noqa: Y015
 class PutWritesRequest(_message.Message):
     DESCRIPTOR: _descriptor.Descriptor
 
+    @_typing.final
+    class EncryptionContextJsonEntry(_message.Message):
+        DESCRIPTOR: _descriptor.Descriptor
+
+        KEY_FIELD_NUMBER: _builtins.int
+        VALUE_FIELD_NUMBER: _builtins.int
+        key: _builtins.str
+        value: _builtins.bytes
+        def __init__(
+            self,
+            *,
+            key: _builtins.str = ...,
+            value: _builtins.bytes = ...,
+        ) -> None: ...
+        _HasFieldArgType: _TypeAlias = _Never  # noqa: Y015
+        def HasField(self, field_name: _HasFieldArgType) -> _builtins.bool: ...
+        _ClearFieldArgType: _TypeAlias = _typing.Literal["key", b"key", "value", b"value"]  # noqa: Y015
+        def ClearField(self, field_name: _ClearFieldArgType) -> None: ...
+        def WhichOneof(self, oneof_group: _Never) -> None: ...
+
     CONFIG_FIELD_NUMBER: _builtins.int
     WRITES_FIELD_NUMBER: _builtins.int
     TASK_ID_FIELD_NUMBER: _builtins.int
     TASK_PATH_FIELD_NUMBER: _builtins.int
+    ENCRYPTION_CONTEXT_JSON_FIELD_NUMBER: _builtins.int
     task_id: _builtins.str
     task_path: _builtins.str
     @_builtins.property
     def config(self) -> _engine_common_pb2.EngineRunnableConfig: ...
     @_builtins.property
     def writes(self) -> _containers.RepeatedCompositeFieldContainer[_engine_common_pb2.Write]: ...
+    @_builtins.property
+    def encryption_context_json(self) -> _containers.ScalarMap[_builtins.str, _builtins.bytes]: ...
     def __init__(
         self,
         *,
@@ -93,10 +146,11 @@ class PutWritesRequest(_message.Message):
         writes: _abc.Iterable[_engine_common_pb2.Write] | None = ...,
         task_id: _builtins.str = ...,
         task_path: _builtins.str = ...,
+        encryption_context_json: _abc.Mapping[_builtins.str, _builtins.bytes] | None = ...,
     ) -> None: ...
     _HasFieldArgType: _TypeAlias = _typing.Literal["config", b"config"]  # noqa: Y015
     def HasField(self, field_name: _HasFieldArgType) -> _builtins.bool: ...
-    _ClearFieldArgType: _TypeAlias = _typing.Literal["config", b"config", "task_id", b"task_id", "task_path", b"task_path", "writes", b"writes"]  # noqa: Y015
+    _ClearFieldArgType: _TypeAlias = _typing.Literal["config", b"config", "encryption_context_json", b"encryption_context_json", "task_id", b"task_id", "task_path", b"task_path", "writes", b"writes"]  # noqa: Y015
     def ClearField(self, field_name: _ClearFieldArgType) -> None: ...
     def WhichOneof(self, oneof_group: _Never) -> None: ...
 

langgraph_grpc_common/proto/encryption_pb2.py

@@ -24,7 +24,7 @@ _sym_db = _symbol_database.Default()
 
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x10\x65ncryption.proto\x12\nencryption\"\xbf\x01\n\x11\x45ncryptionContext\x12\x12\n\x05model\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05\x66ield\x18\x02 \x01(\tH\x01\x88\x01\x01\x12=\n\x08metadata\x18\x03 \x03(\x0b\x32+.encryption.EncryptionContext.MetadataEntry\x1a/\n\rMetadataEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\x0c:\x02\x38\x01\x42\x08\n\x06_modelB\x08\n\x06_field\"R\n\x12\x45ncryptJSONRequest\x12\x0c\n\x04\x64\x61ta\x18\x01 \x01(\x0c\x12.\n\x07\x63ontext\x18\x02 \x01(\x0b\x32\x1d.encryption.EncryptionContext\"^\n\x12\x44\x65\x63ryptJSONRequest\x12\x0c\n\x04\x64\x61ta\x18\x01 \x01(\x0c\x12\x12\n\x05\x66ield\x18\x02 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05model\x18\x03 \x01(\tH\x01\x88\x01\x01\x42\x08\n\x06_fieldB\x08\n\x06_model\"\x1f\n\x0f\x45ncryptResponse\x12\x0c\n\x04\x64\x61ta\x18\x01 \x01(\x0c\"\x1f\n\x0f\x44\x65\x63ryptResponse\x12\x0c\n\x04\x64\x61ta\x18\x01 \x01(\x0c\x32\xa4\x01\n\nEncryption\x12J\n\x0b\x45ncryptJSON\x12\x1e.encryption.EncryptJSONRequest\x1a\x1b.encryption.EncryptResponse\x12J\n\x0b\x44\x65\x63ryptJSON\x12\x1e.encryption.DecryptJSONRequest\x1a\x1b.encryption.DecryptResponseBAZ?github.com/langchain-ai/langgraph-api/core/internal/core-api/pbb\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x10\x65ncryption.proto\x12\nencryption\"\xbf\x01\n\x11\x45ncryptionContext\x12\x12\n\x05model\x18\x01 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05\x66ield\x18\x02 \x01(\tH\x01\x88\x01\x01\x12=\n\x08metadata\x18\x03 \x03(\x0b\x32+.encryption.EncryptionContext.MetadataEntry\x1a/\n\rMetadataEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\x0c:\x02\x38\x01\x42\x08\n\x06_modelB\x08\n\x06_field\"R\n\x12\x45ncryptJSONRequest\x12\x0c\n\x04\x64\x61ta\x18\x01 \x01(\x0c\x12.\n\x07\x63ontext\x18\x02 \x01(\x0b\x32\x1d.encryption.EncryptionContext\"^\n\x12\x44\x65\x63ryptJSONRequest\x12\x0c\n\x04\x64\x61ta\x18\x01 \x01(\x0c\x12\x12\n\x05\x66ield\x18\x02 \x01(\tH\x00\x88\x01\x01\x12\x12\n\x05model\x18\x03 \x01(\tH\x01\x88\x01\x01\x42\x08\n\x06_fieldB\x08\n\x06_model\"R\n\x12\x45ncryptBlobRequest\x12\x0c\n\x04\x64\x61ta\x18\x01 \x01(\x0c\x12.\n\x07\x63ontext\x18\x02 \x01(\x0b\x32\x1d.encryption.EncryptionContext\"R\n\x12\x44\x65\x63ryptBlobRequest\x12\x0c\n\x04\x64\x61ta\x18\x01 \x01(\x0c\x12.\n\x07\x63ontext\x18\x02 \x01(\x0b\x32\x1d.encryption.EncryptionContext\"\x1f\n\x0f\x45ncryptResponse\x12\x0c\n\x04\x64\x61ta\x18\x01 \x01(\x0c\"4\n\x0f\x44\x65\x63ryptResponse\x12\x0c\n\x04\x64\x61ta\x18\x01 \x01(\x0c\x12\x13\n\x0breplacement\x18\x02 \x01(\x0c\x32\xbc\x02\n\nEncryption\x12J\n\x0b\x45ncryptJSON\x12\x1e.encryption.EncryptJSONRequest\x1a\x1b.encryption.EncryptResponse\x12J\n\x0b\x44\x65\x63ryptJSON\x12\x1e.encryption.DecryptJSONRequest\x1a\x1b.encryption.DecryptResponse\x12J\n\x0b\x45ncryptBlob\x12\x1e.encryption.EncryptBlobRequest\x1a\x1b.encryption.EncryptResponse\x12J\n\x0b\x44\x65\x63ryptBlob\x12\x1e.encryption.DecryptBlobRequest\x1a\x1b.encryption.DecryptResponseBAZ?github.com/langchain-ai/langgraph-api/core/internal/core-api/pbb\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -42,10 +42,14 @@ if not _descriptor._USE_C_DESCRIPTORS:
   _globals['_ENCRYPTJSONREQUEST']._serialized_end=308
   _globals['_DECRYPTJSONREQUEST']._serialized_start=310
   _globals['_DECRYPTJSONREQUEST']._serialized_end=404
-  _globals['_ENCRYPTRESPONSE']._serialized_start=406
-  _globals['_ENCRYPTRESPONSE']._serialized_end=437
-  _globals['_DECRYPTRESPONSE']._serialized_start=439
-  _globals['_DECRYPTRESPONSE']._serialized_end=470
-  _globals['_ENCRYPTION']._serialized_start=473
-  _globals['_ENCRYPTION']._serialized_end=637
+  _globals['_ENCRYPTBLOBREQUEST']._serialized_start=406
+  _globals['_ENCRYPTBLOBREQUEST']._serialized_end=488
+  _globals['_DECRYPTBLOBREQUEST']._serialized_start=490
+  _globals['_DECRYPTBLOBREQUEST']._serialized_end=572
+  _globals['_ENCRYPTRESPONSE']._serialized_start=574
+  _globals['_ENCRYPTRESPONSE']._serialized_end=605
+  _globals['_DECRYPTRESPONSE']._serialized_start=607
+  _globals['_DECRYPTRESPONSE']._serialized_end=659
+  _globals['_ENCRYPTION']._serialized_start=662
+  _globals['_ENCRYPTION']._serialized_end=978
 # @@protoc_insertion_point(module_scope)

langgraph_grpc_common/proto/encryption_pb2.pyi

@@ -148,6 +148,62 @@ class DecryptJSONRequest(_message.Message):
 
 Global___DecryptJSONRequest: _TypeAlias = DecryptJSONRequest  # noqa: Y015
 
+@_typing.final
+class EncryptBlobRequest(_message.Message):
+    """Request to encrypt binary data (e.g., checkpoint channel values and writes)."""
+
+    DESCRIPTOR: _descriptor.Descriptor
+
+    DATA_FIELD_NUMBER: _builtins.int
+    CONTEXT_FIELD_NUMBER: _builtins.int
+    data: _builtins.bytes
+    """The plaintext blob bytes"""
+    @_builtins.property
+    def context(self) -> Global___EncryptionContext:
+        """Encryption context for key derivation"""
+
+    def __init__(
+        self,
+        *,
+        data: _builtins.bytes = ...,
+        context: Global___EncryptionContext | None = ...,
+    ) -> None: ...
+    _HasFieldArgType: _TypeAlias = _typing.Literal["context", b"context"]  # noqa: Y015
+    def HasField(self, field_name: _HasFieldArgType) -> _builtins.bool: ...
+    _ClearFieldArgType: _TypeAlias = _typing.Literal["context", b"context", "data", b"data"]  # noqa: Y015
+    def ClearField(self, field_name: _ClearFieldArgType) -> None: ...
+    def WhichOneof(self, oneof_group: _Never) -> None: ...
+
+Global___EncryptBlobRequest: _TypeAlias = EncryptBlobRequest  # noqa: Y015
+
+@_typing.final
+class DecryptBlobRequest(_message.Message):
+    """Request to decrypt binary data."""
+
+    DESCRIPTOR: _descriptor.Descriptor
+
+    DATA_FIELD_NUMBER: _builtins.int
+    CONTEXT_FIELD_NUMBER: _builtins.int
+    data: _builtins.bytes
+    """The encrypted blob bytes"""
+    @_builtins.property
+    def context(self) -> Global___EncryptionContext:
+        """Encryption context, recovered from the stored blob wrapper"""
+
+    def __init__(
+        self,
+        *,
+        data: _builtins.bytes = ...,
+        context: Global___EncryptionContext | None = ...,
+    ) -> None: ...
+    _HasFieldArgType: _TypeAlias = _typing.Literal["context", b"context"]  # noqa: Y015
+    def HasField(self, field_name: _HasFieldArgType) -> _builtins.bool: ...
+    _ClearFieldArgType: _TypeAlias = _typing.Literal["context", b"context", "data", b"data"]  # noqa: Y015
+    def ClearField(self, field_name: _ClearFieldArgType) -> None: ...
+    def WhichOneof(self, oneof_group: _Never) -> None: ...
+
+Global___DecryptBlobRequest: _TypeAlias = DecryptBlobRequest  # noqa: Y015
+
 @_typing.final
 class EncryptResponse(_message.Message):
     """Response from encryption operations."""
@@ -177,16 +233,20 @@ class DecryptResponse(_message.Message):
     DESCRIPTOR: _descriptor.Descriptor
 
     DATA_FIELD_NUMBER: _builtins.int
+    REPLACEMENT_FIELD_NUMBER: _builtins.int
     data: _builtins.bytes
     """The decrypted plaintext data as bytes"""
+    replacement: _builtins.bytes
+    """Optional replacement ciphertext for the original storage location."""
     def __init__(
         self,
         *,
         data: _builtins.bytes = ...,
+        replacement: _builtins.bytes = ...,
     ) -> None: ...
     _HasFieldArgType: _TypeAlias = _Never  # noqa: Y015
     def HasField(self, field_name: _HasFieldArgType) -> _builtins.bool: ...
-    _ClearFieldArgType: _TypeAlias = _typing.Literal["data", b"data"]  # noqa: Y015
+    _ClearFieldArgType: _TypeAlias = _typing.Literal["data", b"data", "replacement", b"replacement"]  # noqa: Y015
     def ClearField(self, field_name: _ClearFieldArgType) -> None: ...
     def WhichOneof(self, oneof_group: _Never) -> None: ...
 

langgraph_grpc_common/proto/encryption_pb2_grpc.py

@@ -45,6 +45,16 @@ class EncryptionStub:
                 request_serializer=encryption__pb2.DecryptJSONRequest.SerializeToString,
                 response_deserializer=encryption__pb2.DecryptResponse.FromString,
                 _registered_method=True)
+        self.EncryptBlob = channel.unary_unary(
+                '/encryption.Encryption/EncryptBlob',
+                request_serializer=encryption__pb2.EncryptBlobRequest.SerializeToString,
+                response_deserializer=encryption__pb2.EncryptResponse.FromString,
+                _registered_method=True)
+        self.DecryptBlob = channel.unary_unary(
+                '/encryption.Encryption/DecryptBlob',
+                request_serializer=encryption__pb2.DecryptBlobRequest.SerializeToString,
+                response_deserializer=encryption__pb2.DecryptResponse.FromString,
+                _registered_method=True)
 
 
 class EncryptionServicer:
@@ -65,6 +75,20 @@ class EncryptionServicer:
         context.set_details('Method not implemented!')
         raise NotImplementedError('Method not implemented!')
 
+    def EncryptBlob(self, request, context):
+        """Encrypt blob data (checkpoint channel values and pending writes).
+        """
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
+    def DecryptBlob(self, request, context):
+        """Decrypt blob data. Context is supplied by the caller from the blob wrapper.
+        """
+        context.set_code(grpc.StatusCode.UNIMPLEMENTED)
+        context.set_details('Method not implemented!')
+        raise NotImplementedError('Method not implemented!')
+
 
 def add_EncryptionServicer_to_server(servicer, server):
     rpc_method_handlers = {
@@ -78,6 +102,16 @@ def add_EncryptionServicer_to_server(servicer, server):
                     request_deserializer=encryption__pb2.DecryptJSONRequest.FromString,
                     response_serializer=encryption__pb2.DecryptResponse.SerializeToString,
             ),
+            'EncryptBlob': grpc.unary_unary_rpc_method_handler(
+                    servicer.EncryptBlob,
+                    request_deserializer=encryption__pb2.EncryptBlobRequest.FromString,
+                    response_serializer=encryption__pb2.EncryptResponse.SerializeToString,
+            ),
+            'DecryptBlob': grpc.unary_unary_rpc_method_handler(
+                    servicer.DecryptBlob,
+                    request_deserializer=encryption__pb2.DecryptBlobRequest.FromString,
+                    response_serializer=encryption__pb2.DecryptResponse.SerializeToString,
+            ),
     }
     generic_handler = grpc.method_handlers_generic_handler(
             'encryption.Encryption', rpc_method_handlers)
@@ -143,3 +177,57 @@ class Encryption:
             timeout,
             metadata,
             _registered_method=True)
+
+    @staticmethod
+    def EncryptBlob(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(
+            request,
+            target,
+            '/encryption.Encryption/EncryptBlob',
+            encryption__pb2.EncryptBlobRequest.SerializeToString,
+            encryption__pb2.EncryptResponse.FromString,
+            options,
+            channel_credentials,
+            insecure,
+            call_credentials,
+            compression,
+            wait_for_ready,
+            timeout,
+            metadata,
+            _registered_method=True)
+
+    @staticmethod
+    def DecryptBlob(request,
+            target,
+            options=(),
+            channel_credentials=None,
+            call_credentials=None,
+            insecure=False,
+            compression=None,
+            wait_for_ready=None,
+            timeout=None,
+            metadata=None):
+        return grpc.experimental.unary_unary(
+            request,
+            target,
+            '/encryption.Encryption/DecryptBlob',
+            encryption__pb2.DecryptBlobRequest.SerializeToString,
+            encryption__pb2.DecryptResponse.FromString,
+            options,
+            channel_credentials,
+            insecure,
+            call_credentials,
+            compression,
+            wait_for_ready,
+            timeout,
+            metadata,
+            _registered_method=True)

langgraph_grpc_common/proto/encryption_pb2_grpc.pyi

@@ -37,6 +37,10 @@ class EncryptionStub:
     """Encrypt JSON data (e.g., thread metadata, run kwargs)."""
     DecryptJSON: _grpc.UnaryUnaryMultiCallable[_encryption_pb2.DecryptJSONRequest, _encryption_pb2.DecryptResponse]
     """Decrypt JSON data. Context is extracted from __encryption_context__ in the data."""
+    EncryptBlob: _grpc.UnaryUnaryMultiCallable[_encryption_pb2.EncryptBlobRequest, _encryption_pb2.EncryptResponse]
+    """Encrypt blob data (checkpoint channel values and pending writes)."""
+    DecryptBlob: _grpc.UnaryUnaryMultiCallable[_encryption_pb2.DecryptBlobRequest, _encryption_pb2.DecryptResponse]
+    """Decrypt blob data. Context is supplied by the caller from the blob wrapper."""
 
 @_typing.type_check_only
 class EncryptionAsyncStub(EncryptionStub):
@@ -47,6 +51,10 @@ class EncryptionAsyncStub(EncryptionStub):
     """Encrypt JSON data (e.g., thread metadata, run kwargs)."""
     DecryptJSON: _aio.UnaryUnaryMultiCallable[_encryption_pb2.DecryptJSONRequest, _encryption_pb2.DecryptResponse]  # type: ignore[assignment]
     """Decrypt JSON data. Context is extracted from __encryption_context__ in the data."""
+    EncryptBlob: _aio.UnaryUnaryMultiCallable[_encryption_pb2.EncryptBlobRequest, _encryption_pb2.EncryptResponse]  # type: ignore[assignment]
+    """Encrypt blob data (checkpoint channel values and pending writes)."""
+    DecryptBlob: _aio.UnaryUnaryMultiCallable[_encryption_pb2.DecryptBlobRequest, _encryption_pb2.DecryptResponse]  # type: ignore[assignment]
+    """Decrypt blob data. Context is supplied by the caller from the blob wrapper."""
 
 class EncryptionServicer(metaclass=_abc_1.ABCMeta):
     """Encryption service for custom encryption implementations."""
@@ -67,4 +75,20 @@ class EncryptionServicer(metaclass=_abc_1.ABCMeta):
     ) -> _typing.Union[_encryption_pb2.DecryptResponse, _abc.Awaitable[_encryption_pb2.DecryptResponse]]:
         """Decrypt JSON data. Context is extracted from __encryption_context__ in the data."""
 
+    @_abc_1.abstractmethod
+    def EncryptBlob(
+        self,
+        request: _encryption_pb2.EncryptBlobRequest,
+        context: _ServicerContext,
+    ) -> _typing.Union[_encryption_pb2.EncryptResponse, _abc.Awaitable[_encryption_pb2.EncryptResponse]]:
+        """Encrypt blob data (checkpoint channel values and pending writes)."""
+
+    @_abc_1.abstractmethod
+    def DecryptBlob(
+        self,
+        request: _encryption_pb2.DecryptBlobRequest,
+        context: _ServicerContext,
+    ) -> _typing.Union[_encryption_pb2.DecryptResponse, _abc.Awaitable[_encryption_pb2.DecryptResponse]]:
+        """Decrypt blob data. Context is supplied by the caller from the blob wrapper."""
+
 def add_EncryptionServicer_to_server(servicer: EncryptionServicer, server: _typing.Union[_grpc.Server, _aio.Server]) -> None: ...