langgraph-api 0.18.0.dev7__py3-none-any.whl → 0.18.0.dev9__py3-none-any.whl

langgraph_api/__init__.py

@@ -1 +1 @@
-__version__ = "0.18.0.dev7"
+__version__ = "0.18.0.dev9"

langgraph_api/api/mcp/_origins.py

@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+from urllib.parse import urlsplit
+
+from langgraph_api.config import ANY_ORIGIN
+
+if TYPE_CHECKING:
+    from langgraph_api.config.schemas import CorsConfig
+
+LOOPBACK_HOSTS = frozenset({"localhost", "127.0.0.1", "::1"})
+WEB_SCHEMES = frozenset({"http", "https"})
+
+
+@dataclass(frozen=True, slots=True)
+class OriginPolicy:
+    listed: frozenset[str]
+    pattern: re.Pattern[str] | None
+
+    @classmethod
+    def of(cls, settings: CorsConfig) -> OriginPolicy:
+        regex = settings.get("allow_origin_regex")
+        return cls(
+            frozenset(settings.get("allow_origins", ())) - {ANY_ORIGIN},
+            re.compile(regex) if regex is not None else None,
+        )
+
+    def allows(self, origin: str | None) -> bool:
+        return (
+            origin is None
+            or origin in self.listed
+            or (self.pattern is not None and self.pattern.fullmatch(origin) is not None)
+            or _bare_origin_host(origin) in LOOPBACK_HOSTS
+        )
+
+
+def _bare_origin_host(origin: str) -> str | None:
+    try:
+        parsed = urlsplit(origin)
+    except ValueError:
+        return None
+    if (
+        parsed.scheme not in WEB_SCHEMES
+        or "@" in parsed.netloc
+        or parsed.path
+        or parsed.query
+        or parsed.fragment
+    ):
+        return None
+    return parsed.hostname or None

langgraph_api/api/mcp/_routes.py

@@ -1,22 +1,27 @@
 from __future__ import annotations
 
+from http import HTTPStatus
+
 from starlette.responses import Response
 
 from langgraph_api.api.mcp._handlers import (
+    create_error_response,
     handle_delete_request,
     handle_get_request,
     handle_post_request,
 )
+from langgraph_api.api.mcp._origins import OriginPolicy
+from langgraph_api.config import CORS_SETTINGS
 from langgraph_api.route import ApiRequest, ApiRoute
 
 __all__ = ["mcp_routes"]
 
+ORIGIN_POLICY = OriginPolicy.of(CORS_SETTINGS)
+
 
 async def handle_mcp_endpoint(request: ApiRequest) -> Response:
-    # MCP endpoint handler that implements the Streamable HTTP protocol.
-    # Supports POST (JSON-RPC request) and DELETE (terminate session).
-    # GET (streaming session resumption) and text/event-stream not yet supported.
-    # Route request based on HTTP method
+    if not ORIGIN_POLICY.allows(request.headers.get("origin")):
+        return create_error_response("Origin is not allowed", HTTPStatus.FORBIDDEN)
     if request.method == "DELETE":
         return handle_delete_request()
     elif request.method == "GET":
@@ -24,11 +29,9 @@ async def handle_mcp_endpoint(request: ApiRequest) -> Response:
     elif request.method == "POST":
         return await handle_post_request(request)
     else:
-        # Method not allowed
         return Response(status_code=405)
 
 
-# Define routes for the MCP endpoint
 mcp_routes = [
     ApiRoute("/mcp", handle_mcp_endpoint, methods=["GET", "POST", "DELETE"]),
 ]

langgraph_api/config/__init__.py

@@ -1,4 +1,5 @@
 import os
+from collections.abc import Sequence
 from enum import StrEnum
 from os import environ, getenv
 from typing import TYPE_CHECKING, Annotated, Literal, TypeVar, cast
@@ -363,7 +364,10 @@ MOUNT_PREFIX: str | None = _validate_mount_prefix(
     or (HTTP_CONFIG.get("mount_prefix") if HTTP_CONFIG else None)
 )
 
-CORS_ALLOW_ORIGINS = env("CORS_ALLOW_ORIGINS", cast=CommaSeparatedStrings, default="*")
+ANY_ORIGIN = "*"
+CORS_ALLOW_ORIGINS = env(
+    "CORS_ALLOW_ORIGINS", cast=CommaSeparatedStrings, default=ANY_ORIGIN
+)
 CORS_CONFIG = env(
     "CORS_CONFIG", cast=_parse.parse_schema(CorsConfig), default=None
 ) or (HTTP_CONFIG.get("cors") if HTTP_CONFIG else None)
@@ -406,12 +410,35 @@ CORS_CONFIG = env(
     }
 }
 """
-if (
-    CORS_CONFIG is not None
-    and CORS_ALLOW_ORIGINS != "*"
-    and CORS_CONFIG.get("allow_origins") is None
-):
-    CORS_CONFIG["allow_origins"] = CORS_ALLOW_ORIGINS
+
+
+def _cors_settings(
+    cors_config: CorsConfig | None, allow_origins: Sequence[str]
+) -> CorsConfig:
+    origins = list(allow_origins)
+    if cors_config is None:
+        return {
+            "allow_origins": origins,
+            "allow_credentials": ANY_ORIGIN not in origins,
+            "allow_methods": ["*"],
+            "allow_headers": ["*"],
+            "expose_headers": [
+                "x-pagination-total",
+                "x-pagination-next",
+                "content-location",
+                "location",
+            ],
+        }
+    keeps_its_own_origins = cors_config.get("allow_origins") is not None
+    wildcard_would_widen_regex = cors_config.get(
+        "allow_origin_regex"
+    ) is not None and origins == [ANY_ORIGIN]
+    if keeps_its_own_origins or wildcard_would_widen_regex:
+        return cors_config
+    return {**cors_config, "allow_origins": origins}
+
+
+CORS_SETTINGS = _cors_settings(CORS_CONFIG, CORS_ALLOW_ORIGINS)
 
 # queue
 
@@ -794,6 +821,7 @@ traceblock.patch_requests()
 __all__ = [
     "AES_JSON_DISALLOWED_KEYS",
     "ALLOW_PRIVATE_NETWORK",
+    "ANY_ORIGIN",
     "API_VARIANT",
     "BG_JOB_HEARTBEAT",
     "BG_JOB_ISOLATED_LOOPS",
@@ -810,6 +838,7 @@ __all__ = [
     "CHECKPOINT_MAX_BATCH_SIZE",
     "CORS_ALLOW_ORIGINS",
     "CORS_CONFIG",
+    "CORS_SETTINGS",
     "CRON_SCHEDULER_BATCH_SIZE",
     "CRON_SCHEDULER_SLEEP_TIME",
     "DATABASE_URI",

langgraph_api/feature_flags.py

@@ -19,6 +19,7 @@ USE_DURABILITY = LANGGRAPH_PY_MINOR >= (0, 6)
 # Not in public docs: LANGGRAPH_RUNTIME_EDITION is internal, set by packaging/entrypoint
 _RUNTIME_EDITION = os.getenv("LANGGRAPH_RUNTIME_EDITION", "inmem")
 IS_POSTGRES_BACKEND = _RUNTIME_EDITION == "postgres"
+IS_INMEM_BACKEND = _RUNTIME_EDITION == "inmem"
 IS_POSTGRES_OR_GRPC_BACKEND = IS_POSTGRES_BACKEND
 # Server-side kill switch for the Protocol v2 event-streaming surface
 # (#3296). When false, the v2 routes are not registered (clients hit a

langgraph_api/js/client.mts

@@ -670,6 +670,7 @@ const StreamEventsPayload = z.object({
   // keeps the legacy ``on_chain_stream`` behavior used by the older
   // streaming endpoints.
   stream_protocol: z.enum(["v2", "v3"]).nullish(),
+  output_keys: z.union([z.string(), z.array(z.string())]).nullish(),
 });
 
 function reviveCommand(
@@ -798,6 +799,10 @@ async function* streamEventsRequest(
         ...config,
         signal,
         version: "v3",
+        outputKeys:
+          payload.output_keys === undefined
+            ? graph.outputChannels
+            : (payload.output_keys ?? undefined),
         interruptBefore,
         interruptAfter,
         ...(callbacks ? { callbacks } : {}),

langgraph_api/js/package.json

@@ -7,42 +7,42 @@
     "format": "prettier --write ."
   },
   "dependencies": {
-    "@hono/node-server": "^2.1.0",
-    "@hono/zod-validator": "^0.9.0",
-    "@langchain/core": "^1.2.3",
-    "@langchain/langgraph": "^1.4.12",
+    "@hono/node-server": "^2.1.5",
+    "@hono/zod-validator": "^0.9.1",
+    "@langchain/core": "^1.2.18",
+    "@langchain/langgraph": "^1.5.0",
     "@langchain/langgraph-api": "^1.0.3",
     "@langchain/langgraph-checkpoint": "^1.1.5",
-    "@langchain/langgraph-ui": "^1.4.3",
+    "@langchain/langgraph-ui": "^1.5.3",
     "@types/json-schema": "^7.0.15",
     "dedent": "^1.7.2",
     "exit-hook": "^5.1.0",
-    "hono": "^4.13.7",
+    "hono": "^4.13.13",
     "p-queue": "^9.3.1",
     "p-retry": "^7.1.1",
     "typescript": "^6.0.3",
     "undici": "^7.29.1",
-    "uuid": "^14.0.1",
+    "uuid": "^14.0.3",
     "winston": "^3.19.0",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "resolutions": {
     "@hono/node-server": ">=2.0.5",
-    "esbuild": "^0.28.1",
-    "langsmith": ">=0.4.6",
+    "esbuild": "^0.28.2",
+    "langsmith": ">=0.11.0 <1.0.0",
     "vite": "^6.4.3"
   },
   "devDependencies": {
     "@langchain/langgraph-sdk": "^1.5.4",
-    "@types/node": "^26.1.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "esbuild": "^0.28.1",
-    "jose": "^6.2.3",
+    "@types/node": "^26.6.5",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "esbuild": "^0.28.2",
+    "jose": "^6.2.12",
     "postgres": "^3.4.9",
-    "prettier": "^3.9.5",
-    "vite": "^8.1.4",
-    "vitest": "^5.0.0"
+    "prettier": "^3.9.10",
+    "vite": "^8.3.4",
+    "vitest": "^5.0.5"
   },
   "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
 }