langgraph-api 0.18.0.dev7__py3-none-any.whl → 0.18.0.dev8__py3-none-any.whl

langgraph_api/__init__.py

@@ -1 +1 @@
-__version__ = "0.18.0.dev7"
+__version__ = "0.18.0.dev8"

langgraph_api/api/mcp/_origins.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+from urllib.parse import urlsplit
+
+from langgraph_api.config import ANY_ORIGIN
+
+if TYPE_CHECKING:
+    from langgraph_api.config.schemas import CorsConfig
+
+LOOPBACK_HOSTS = frozenset({"localhost", "127.0.0.1", "::1"})
+WEB_SCHEMES = frozenset({"http", "https"})
+
+
+@dataclass(frozen=True, slots=True)
+class OriginPolicy:
+    listed: frozenset[str]
+    pattern: re.Pattern[str] | None
+
+    @classmethod
+    def of(cls, settings: CorsConfig) -> OriginPolicy:
+        regex = settings.get("allow_origin_regex")
+        return cls(
+            frozenset(settings.get("allow_origins", ())) - {ANY_ORIGIN},
+            re.compile(regex) if regex is not None else None,
+        )
+
+    def allows(self, origin: str | None) -> bool:
+        return (
+            origin is None
+            or origin in self.listed
+            or (self.pattern is not None and self.pattern.fullmatch(origin) is not None)
+            or _bare_origin_host(origin) in LOOPBACK_HOSTS
+        )
+
+
+def _bare_origin_host(origin: str) -> str | None:
+    try:
+        parsed = urlsplit(origin)
+    except ValueError:
+        return None
+    if (
+        parsed.scheme not in WEB_SCHEMES
+        or "@" in parsed.netloc
+        or parsed.path
+        or parsed.query
+        or parsed.fragment
+    ):
+        return None
+    return parsed.hostname or None

langgraph_api/api/mcp/_routes.py

@@ -1,22 +1,27 @@
 from __future__ import annotations
 
+from http import HTTPStatus
+
 from starlette.responses import Response
 
 from langgraph_api.api.mcp._handlers import (
+    create_error_response,
     handle_delete_request,
     handle_get_request,
     handle_post_request,
 )
+from langgraph_api.api.mcp._origins import OriginPolicy
+from langgraph_api.config import CORS_SETTINGS
 from langgraph_api.route import ApiRequest, ApiRoute
 
 __all__ = ["mcp_routes"]
 
+ORIGIN_POLICY = OriginPolicy.of(CORS_SETTINGS)
+
 
 async def handle_mcp_endpoint(request: ApiRequest) -> Response:
-    # MCP endpoint handler that implements the Streamable HTTP protocol.
-    # Supports POST (JSON-RPC request) and DELETE (terminate session).
-    # GET (streaming session resumption) and text/event-stream not yet supported.
-    # Route request based on HTTP method
+    if not ORIGIN_POLICY.allows(request.headers.get("origin")):
+        return create_error_response("Origin is not allowed", HTTPStatus.FORBIDDEN)
     if request.method == "DELETE":
         return handle_delete_request()
     elif request.method == "GET":
@@ -24,11 +29,9 @@ async def handle_mcp_endpoint(request: ApiRequest) -> Response:
     elif request.method == "POST":
         return await handle_post_request(request)
     else:
-        # Method not allowed
         return Response(status_code=405)
 
 
-# Define routes for the MCP endpoint
 mcp_routes = [
     ApiRoute("/mcp", handle_mcp_endpoint, methods=["GET", "POST", "DELETE"]),
 ]

langgraph_api/config/__init__.py

@@ -1,4 +1,5 @@
 import os
+from collections.abc import Sequence
 from enum import StrEnum
 from os import environ, getenv
 from typing import TYPE_CHECKING, Annotated, Literal, TypeVar, cast
@@ -363,7 +364,10 @@ MOUNT_PREFIX: str | None = _validate_mount_prefix(
     or (HTTP_CONFIG.get("mount_prefix") if HTTP_CONFIG else None)
 )
 
-CORS_ALLOW_ORIGINS = env("CORS_ALLOW_ORIGINS", cast=CommaSeparatedStrings, default="*")
+ANY_ORIGIN = "*"
+CORS_ALLOW_ORIGINS = env(
+    "CORS_ALLOW_ORIGINS", cast=CommaSeparatedStrings, default=ANY_ORIGIN
+)
 CORS_CONFIG = env(
     "CORS_CONFIG", cast=_parse.parse_schema(CorsConfig), default=None
 ) or (HTTP_CONFIG.get("cors") if HTTP_CONFIG else None)
@@ -406,12 +410,35 @@ CORS_CONFIG = env(
     }
 }
 """
-if (
-    CORS_CONFIG is not None
-    and CORS_ALLOW_ORIGINS != "*"
-    and CORS_CONFIG.get("allow_origins") is None
-):
-    CORS_CONFIG["allow_origins"] = CORS_ALLOW_ORIGINS
+
+
+def _cors_settings(
+    cors_config: CorsConfig | None, allow_origins: Sequence[str]
+) -> CorsConfig:
+    origins = list(allow_origins)
+    if cors_config is None:
+        return {
+            "allow_origins": origins,
+            "allow_credentials": ANY_ORIGIN not in origins,
+            "allow_methods": ["*"],
+            "allow_headers": ["*"],
+            "expose_headers": [
+                "x-pagination-total",
+                "x-pagination-next",
+                "content-location",
+                "location",
+            ],
+        }
+    keeps_its_own_origins = cors_config.get("allow_origins") is not None
+    wildcard_would_widen_regex = cors_config.get(
+        "allow_origin_regex"
+    ) is not None and origins == [ANY_ORIGIN]
+    if keeps_its_own_origins or wildcard_would_widen_regex:
+        return cors_config
+    return {**cors_config, "allow_origins": origins}
+
+
+CORS_SETTINGS = _cors_settings(CORS_CONFIG, CORS_ALLOW_ORIGINS)
 
 # queue
 
@@ -794,6 +821,7 @@ traceblock.patch_requests()
 __all__ = [
     "AES_JSON_DISALLOWED_KEYS",
     "ALLOW_PRIVATE_NETWORK",
+    "ANY_ORIGIN",
     "API_VARIANT",
     "BG_JOB_HEARTBEAT",
     "BG_JOB_ISOLATED_LOOPS",
@@ -810,6 +838,7 @@ __all__ = [
     "CHECKPOINT_MAX_BATCH_SIZE",
     "CORS_ALLOW_ORIGINS",
     "CORS_CONFIG",
+    "CORS_SETTINGS",
     "CRON_SCHEDULER_BATCH_SIZE",
     "CRON_SCHEDULER_SLEEP_TIME",
     "DATABASE_URI",

langgraph_api/js/client.mts

@@ -670,6 +670,7 @@ const StreamEventsPayload = z.object({
   // keeps the legacy ``on_chain_stream`` behavior used by the older
   // streaming endpoints.
   stream_protocol: z.enum(["v2", "v3"]).nullish(),
+  output_keys: z.union([z.string(), z.array(z.string())]).nullish(),
 });
 
 function reviveCommand(
@@ -798,6 +799,10 @@ async function* streamEventsRequest(
         ...config,
         signal,
         version: "v3",
+        outputKeys:
+          payload.output_keys === undefined
+            ? graph.outputChannels
+            : (payload.output_keys ?? undefined),
         interruptBefore,
         interruptAfter,
         ...(callbacks ? { callbacks } : {}),

langgraph_api/server.py

@@ -66,25 +66,7 @@ if JS_PROXY_MIDDLEWARE_ENABLED:
 
 global_middleware.extend(
     [
-        (
-            Middleware(
-                CORSMiddleware,
-                allow_origins=config.CORS_ALLOW_ORIGINS,
-                allow_credentials="*" not in config.CORS_ALLOW_ORIGINS,
-                allow_methods=["*"],
-                allow_headers=["*"],
-                expose_headers=[
-                    "x-pagination-total",
-                    "x-pagination-next",
-                    "content-location",
-                ],
-            )
-            if config.CORS_CONFIG is None
-            else Middleware(
-                CORSMiddleware,
-                **config.CORS_CONFIG,
-            )
-        ),
+        Middleware(CORSMiddleware, **config.CORS_SETTINGS),
         Middleware(AccessLoggerMiddleware, logger=logger),
         Middleware(RequestIdMiddleware, mount_prefix=config.MOUNT_PREFIX),
     ]

langgraph_api/stream_v2.py

@@ -226,6 +226,7 @@ async def astream_state_v2(
     # langgraph >=1.2.0a6. ``stream_mode`` was already popped by the
     # caller.
     kwargs.pop("subgraphs", None)
+    kwargs.setdefault("output_keys", graph.output_channels)
     # ``version="v3"`` and the awaitable return are alpha-only;
     # ``capabilities.py`` gates the v3 path at runtime so older
     # langgraph never reaches this call.

{langgraph_api-0.18.0.dev7.dist-info → langgraph_api-0.18.0.dev8.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.18.0.dev7
+Version: 0.18.0.dev8
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE

{langgraph_api-0.18.0.dev7.dist-info → langgraph_api-0.18.0.dev8.dist-info}/RECORD

@@ -1,4 +1,4 @@
-langgraph_api/__init__.py,sha256=f2wN1tmyQm9TIb2ahNCBhJpCy_sGqbls-x1eji-fGtM,28
+langgraph_api/__init__.py,sha256=xDWSz-IdnwPg2_CLKonqvJoez_uokIczJ46zgJXmT9s,28
 langgraph_api/_factory_utils.py,sha256=_FqW0olMu2PGLsnRq0ylt3a4jDCe12YIFHExMXI6Nyo,5976
 langgraph_api/asgi_transport.py,sha256=XApY3lIWBZTMbbsl8dDJzl0cLGirmAGE0SifqZUnXvs,11896
 langgraph_api/asyncio.py,sha256=-p-Vx89TnErypdPcWb-2EdbsSvhdIdHfriCFG7UP7ls,12444
@@ -28,12 +28,12 @@ langgraph_api/schema.py,sha256=_Eh_P87jSvH-Ec23wIDTEageeEwXNK3Dck53ykvXpAU,11101
 langgraph_api/self_hosted_logs.py,sha256=CSWJH-Qrt99AFQw1-8u78wgKDkbyByQ-0tXfP2PDzGs,6096
 langgraph_api/self_hosted_metrics.py,sha256=pv2E70kWxShO90N5fsIPOg28HGiOD7_zlvVV9FmZ7eY,16806
 langgraph_api/serde.py,sha256=sMjrORY2WCNmZEXDaE3lydi1un686qR1E_Wxw4mFgjU,9144
-langgraph_api/server.py,sha256=ryMqYF12iur4cThgjQQHnqEHdTcN08Ui_MQ8PGY2i0M,10869
+langgraph_api/server.py,sha256=_DG7dCL2wtlaXdppTce2e0k8PunCcSRj79ncQfqmK_Q,10305
 langgraph_api/sse.py,sha256=cChZ7raQUHp8p5BreE_5wMBR8lFO0n7746sV8_HQOrc,4822
 langgraph_api/state.py,sha256=GbehlusbwoOAOHp630mXxwLP7Kh-UxJA7xaZ6EgYaRE,6239
 langgraph_api/store.py,sha256=OXcdQSVCDKOzfS8S2aJHXbfuI5iYRoQBiW9WYKnCyx8,7122
 langgraph_api/stream.py,sha256=SMrditrbTJ7QtKW-ThpYAPiVsQD-ot_tQeGJIp9PKGI,36519
-langgraph_api/stream_v2.py,sha256=cmbE566boEgKkjcqqf8OvDqjWh8VzvCCsTTlvUF5Drg,10762
+langgraph_api/stream_v2.py,sha256=AieeCAXQsthy9n6crCibMB7unbN1W_o1xkpJ2v11RSY,10822
 langgraph_api/traceblock.py,sha256=GhgAtLhAQ8Z8LHtRQq3par-rfPpRBQp2Q7WBACJq1NI,677
 langgraph_api/tracing_session.py,sha256=gmfv-BW1XRar6suVur1P4rTVKWkjElDEb2hhkBduWOs,728
 langgraph_api/validation.py,sha256=_fmqjbETfsrc4KKJLtfhVjELD-1WzEVrK6G1pfDrmtk,14930
@@ -65,9 +65,10 @@ langgraph_api/api/mcp/_calls.py,sha256=v1sjij5TjKHNHfZq5Rulah71MQhw6dJNs46eUb74E
 langgraph_api/api/mcp/_constants.py,sha256=O2-6zsmlzJ3y5ytEp_QiZ5JrmWoQXfIQLdUSTbLFH2Y,795
 langgraph_api/api/mcp/_handlers.py,sha256=fkVtUvs6Kc48lTgnsugMMQquMPMcnq0y6ilq1mW_uYs,11625
 langgraph_api/api/mcp/_models.py,sha256=uVzpGetNAHGFP3PaZdMYbuqO2x3-2del67CHwXPLaGU,618
+langgraph_api/api/mcp/_origins.py,sha256=EmYgeG1mKC-mpK8W6mfnK7TIbn92JIsrTFswHE_81Hs,1429
 langgraph_api/api/mcp/_outcome.py,sha256=rRcvAbULo-w6c6OW60ZqK71Oqi2EpjdnI9ebe6267Ck,1089
 langgraph_api/api/mcp/_protocol.py,sha256=DdmOAjwj7t-3iP7S5hGm9Ib1WE7LBxJsNEbSDCAMv74,7495
-langgraph_api/api/mcp/_routes.py,sha256=y8gCPZAJc3YrjHA0a6PtqHKJ17HeN9oGKAYqC4ZBqaA,1057
+langgraph_api/api/mcp/_routes.py,sha256=7-jOhV6XtPK0iWeV6R0_duRXlXSfvw_qd1YUV62mULY,1079
 langgraph_api/api/mcp/_sanitizers.py,sha256=CmfM3cHtzSbrnZeYf4GcTqVPgZV99Y0kZ7mAzDCART8,2403
 langgraph_api/auth/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 langgraph_api/auth/custom.py,sha256=g0YP1UQESV9c4zKfKDGTz1R7xHqew5AKUL43YlNKJsU,31085
@@ -78,7 +79,7 @@ langgraph_api/auth/studio_user.py,sha256=Lx3eMsRA8gxZ3--ApL09hDW84A6qIncaZoBZjSg
 langgraph_api/auth/langsmith/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 langgraph_api/auth/langsmith/backend.py,sha256=gaSuZC8JO32XHe8IdqttNpBGO6PCVrtXaq1Negc7vX0,3857
 langgraph_api/auth/langsmith/client.py,sha256=79kwCVeHU64nsHsxWipfZhf44lM6vfs2nlfTxlJF6LU,4142
-langgraph_api/config/__init__.py,sha256=NEpY6lhuZs26DHS_lrRhV5CF1dlrXOs0RgFrEBsmWvE,32465
+langgraph_api/config/__init__.py,sha256=5VGNpSl0FjWLJaO8a-WxDgu0IIneOypuBj_Q1YVktYA,33351
 langgraph_api/config/_parse.py,sha256=RpfZgFAPJlRMv13AzGr3kAYbIrqHcgjzO8IgeboTw4A,3922
 langgraph_api/config/schemas.py,sha256=RaV-huiOALaJDsGi-wVp7Ghz8aE7UDXgL9YB2TYvQKA,21439
 langgraph_api/encryption/__init__.py,sha256=gaCZ00CocSbqSqrDn6XJHaSp2CZCnC8qnrD9G4fbzyI,363
@@ -118,7 +119,7 @@ langgraph_api/js/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,
 langgraph_api/js/base.py,sha256=CJihwc51MwOVkis80f8zudRa1fQz_5jrom4rY8trww8,1133
 langgraph_api/js/build.mts,sha256=--Kfm4NKDhMljmv8fVvRR0VeUsBKiWch6qXpBoKmrvU,3445
 langgraph_api/js/client.http.mts,sha256=ARlTJURLJamgvyaPlBCYEAHFnXQnPpzzUXWKwXiebnw,6011
-langgraph_api/js/client.mts,sha256=UwUK7MVT8gE-kG2seq--rhKALFifcNqY6cIYv0lXmxI,40098
+langgraph_api/js/client.mts,sha256=vEXetaza6XmCH2lFyXueb-iYbrHhWrETf8UpZp5vdwM,40316
 langgraph_api/js/errors.py,sha256=Cm1TKWlUCwZReDC5AQ6SgNIVGD27Qov2xcgHyf8-GXo,361
 langgraph_api/js/global.d.ts,sha256=j4GhgtQSZ5_cHzjSPcHgMJ8tfBThxrH-pUOrrJGteOU,196
 langgraph_api/js/package.json,sha256=3Li36Qe_oCR85ppPDj0i86ZfhBxDWms35Izy8F73XdY,1362
@@ -259,8 +260,8 @@ langgraph_grpc_common/proto/store_pb2.py,sha256=VWJ7wtzL9pVmZZKbxMzOzCoiFn58bB2g
 langgraph_grpc_common/proto/store_pb2.pyi,sha256=atXejijuYEb9tE0stGQdZcfA9ucMFj-ytTMwvkxwviM,29322
 langgraph_grpc_common/proto/store_pb2_grpc.py,sha256=Kyt8eV2NXkjh3be_BYytGdD19kNf74961cruonMvCrw,3300
 langgraph_grpc_common/proto/store_pb2_grpc.pyi,sha256=oS1h2cDoq2OjyM8xazcmc8LwRDC5oCAD0zto2QUmPQw,2027
-langgraph_api-0.18.0.dev7.dist-info/METADATA,sha256=vVfew1JjgVNz9qz7DovPryT59-5NK321Oo_FNaMImwA,5879
-langgraph_api-0.18.0.dev7.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-langgraph_api-0.18.0.dev7.dist-info/entry_points.txt,sha256=hGedv8n7cgi41PypMfinwS_HfCwA7xJIfS0jAp8htV8,78
-langgraph_api-0.18.0.dev7.dist-info/licenses/LICENSE,sha256=SCVQGLQfwOllsRFa9-Z3m8IYu4pnR9Vh2oANUCJiKqI,3860
-langgraph_api-0.18.0.dev7.dist-info/RECORD,,
+langgraph_api-0.18.0.dev8.dist-info/METADATA,sha256=FSvjKL-CVqhapSc-r3R-uBZXt3zJgOTQLCjg_gyNIII,5879
+langgraph_api-0.18.0.dev8.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+langgraph_api-0.18.0.dev8.dist-info/entry_points.txt,sha256=hGedv8n7cgi41PypMfinwS_HfCwA7xJIfS0jAp8htV8,78
+langgraph_api-0.18.0.dev8.dist-info/licenses/LICENSE,sha256=SCVQGLQfwOllsRFa9-Z3m8IYu4pnR9Vh2oANUCJiKqI,3860
+langgraph_api-0.18.0.dev8.dist-info/RECORD,,