langgraph-api 0.9.0.dev6__tar.gz → 0.10.0rc1__tar.gz

{langgraph_api-0.9.0.dev6 → langgraph_api-0.10.0rc1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.9.0.dev6
+Version: 0.10.0rc1
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE
@@ -14,9 +14,9 @@ Requires-Dist: httptools>=0.5.0; platform_system != 'Windows'
 Requires-Dist: httpx>=0.25.0
 Requires-Dist: jsonschema-rs<0.45,>=0.20.0
 Requires-Dist: langchain-core>=0.3.64
-Requires-Dist: langchain-protocol<0.1,>=0.0.15
+Requires-Dist: langchain-protocol<0.1,>=0.0.16
 Requires-Dist: langgraph-checkpoint<5,>=3.0.1
-Requires-Dist: langgraph-runtime-inmem<0.29.0,>=0.28.0
+Requires-Dist: langgraph-runtime-inmem<0.31.0.dev0,>=0.30.0.dev0
 Requires-Dist: langgraph-sdk>=0.3.5
 Requires-Dist: langgraph<2,>=0.4.10
 Requires-Dist: langsmith[otel]>=0.6.3

langgraph_api-0.10.0rc1/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.10.0rc1"

{langgraph_api-0.9.0.dev6 → langgraph_api-0.10.0rc1}/langgraph_api/auth/custom.py

@@ -250,6 +250,12 @@ def _get_custom_auth_middleware(
             '    return "my-user-id"'
         )
 
+    # We are wiring custom auth into the server middleware stack — emit the
+    # missing-handler warning here (once at startup) rather than inside
+    # `_get_auth_instance`, which is also reached from per-request dispatch
+    # and from telemetry helpers that have no opinion about coverage.
+    _warn_on_missing_handlers(auth_instance)
+
     result = CustomAuthBackend(
         auth_instance._authenticate_handler,
         disable_studio_auth,
@@ -276,6 +282,115 @@ def _get_auth_instance(path: str | None = None) -> Auth | Literal["js"] | None:
     return auth_instance
 
 
+def _derive_known_resource_actions(auth: Auth) -> dict[str, frozenset[str]]:
+    """Walk an ``Auth.on`` namespace to discover every (resource, action) pair
+    the SDK supports for handler registration.
+
+    The SDK's ``_On`` class declares ``__slots__`` listing top-level resource
+    namespaces (``assistants``, ``threads``, ``crons``, ``store``). Inside
+    each namespace, the SDK installs one ``_ResourceActionOn`` /
+    ``_StoreActionOn`` instance per supported action, each carrying a
+    ``.action`` string attribute (and a ``.resource`` for the non-store ones).
+    Duck-typing on those attributes avoids a hand-maintained list and keeps
+    this in sync as the SDK adds resources/actions.
+    """
+    on = auth.on
+    matrix: dict[str, set[str]] = {}
+    for slot in getattr(type(on), "__slots__", ()) or ():
+        if slot.startswith("_") or slot == "value":
+            continue
+        namespace = getattr(on, slot, None)
+        if namespace is None:
+            continue
+        for attr_name in dir(namespace):
+            if attr_name.startswith("_"):
+                continue
+            attr = getattr(namespace, attr_name, None)
+            action = getattr(attr, "action", None)
+            if not isinstance(action, str):
+                continue
+            # `_StoreActionOn` doesn't carry `.resource` (it's always
+            # "store"); fall back to the outer namespace name.
+            resource = getattr(attr, "resource", slot)
+            if not isinstance(resource, str):
+                continue
+            matrix.setdefault(resource, set()).add(action)
+    return {resource: frozenset(actions) for resource, actions in matrix.items()}
+
+
+def _missing_handler_paths(auth: Auth) -> list[tuple[str, str]]:
+    """Return ``(resource, action)`` pairs with no matching authorization handler.
+
+    Mirrors the dispatch precedence in :func:`_get_handler`:
+    - specific ``(resource, action)``
+    - resource wildcard ``(resource, "*")``
+    - action wildcard ``("*", action)``
+    - full wildcard ``("*", "*")`` registered via ``auth.on(resources=["*"], actions=["*"])``
+    - global ``@auth.on``
+
+    Either of the last two covers everything, so an empty list is returned
+    in those cases. Otherwise the returned list enumerates every
+    resource/action pair the server may dispatch which would currently fall
+    through to "allow".
+    """
+    if auth._global_handlers:
+        return []
+    handlers = auth._handlers
+    # `auth.on(resources=["*"], actions=["*"])` stores under ("*", "*") in
+    # `_handlers` (not `_global_handlers`) and `_get_handler` matches it as
+    # the final fallback before `_global_handlers`. Treat it as full coverage.
+    if ("*", "*") in handlers:
+        return []
+    missing: list[tuple[str, str]] = []
+    for resource, actions in _derive_known_resource_actions(auth).items():
+        for action in actions:
+            if (resource, action) in handlers:
+                continue
+            if (resource, "*") in handlers:
+                continue
+            if ("*", action) in handlers:
+                continue
+            missing.append((resource, action))
+    return missing
+
+
+def _warn_on_missing_handlers(auth: Auth) -> None:
+    """Log a warning when the user has registered some auth handlers but
+    left other dispatch paths uncovered.
+
+    Custom auth currently fails open: a request whose ``(resource, action)``
+    has no matching handler is allowed without filtering. This is a common
+    source of cross-user authorization bugs (see GHSA-38q2-qc5v-fccw and
+    related issues), so we surface a warning at startup listing every
+    uncovered path and a suggested default-deny snippet.
+
+    """
+    if not auth._handlers and not auth._global_handlers:
+        # Auth instance with only an `@auth.authenticate` handler — the user
+        # hasn't opted into resource-level authorization at all, so warning
+        # about every path would be too noisy. The auth dispatch is a no-op
+        # in this case.
+        return
+    missing = _missing_handler_paths(auth)
+    if not missing:
+        return
+    paths = sorted(f"{resource}.{action}" for resource, action in missing)
+    logger.warning(
+        "Custom auth has no handler registered for some dispatch paths. "
+        "Authentication (@auth.authenticate) still applies, but requests "
+        "to these paths will be allowed without resource-level authorization "
+        "checks (a common source of cross-user data leaks).",
+        missing_paths=paths,
+        suggestion=(
+            "Add a default-deny global handler and override per-resource "
+            "as needed:\n"
+            "    @auth.on\n"
+            "    async def deny_all(ctx, value):\n"
+            "        return False"
+        ),
+    )
+
+
 def _extract_arguments_from_scope(
     scope: Mapping[str, Any],
     param_names: set[str],

{langgraph_api-0.9.0.dev6 → langgraph_api-0.10.0rc1}/langgraph_api/event_streaming/service.py

@@ -22,8 +22,8 @@ import asyncio
 import contextlib
 import inspect
 from collections.abc import Awaitable, Callable
-from typing import Any, cast
-from uuid import uuid4
+from typing import Any, cast, get_args
+from uuid import UUID, uuid4
 
 import orjson
 import structlog
@@ -43,6 +43,7 @@ from langgraph_api.event_streaming.session import (
 )
 from langgraph_api.event_streaming.types import Subscription
 from langgraph_api.feature_flags import FF_V2_EVENT_STREAMING
+from langgraph_api.schema import MultitaskStrategy
 
 logger = structlog.stdlib.get_logger(__name__)
 
@@ -51,6 +52,75 @@ def _is_record(value: Any) -> bool:
     return isinstance(value, dict)
 
 
+def _checkpoint_id_from_run_start_config(params: dict[str, Any]) -> str | None:
+    """Extract ``config.configurable.checkpoint_id`` from ``run.start`` params.
+
+    Protocol v2 clients pass fork/time-travel targets via RunnableConfig::
+
+        {
+            "input": null,
+            "config": { "configurable": { "checkpoint_id": "<uuid>" } },
+        }
+
+    Returns the checkpoint id (validated as a non-empty string) or ``None``
+    when no fork target is present.
+    """
+    config = params.get("config")
+    if not _is_record(config):
+        return None
+    configurable = config.get("configurable")
+    if not _is_record(configurable):
+        return None
+    checkpoint_id = configurable.get("checkpoint_id")
+    if checkpoint_id is None:
+        return None
+    if not isinstance(checkpoint_id, str) or not checkpoint_id.strip():
+        raise ValueError(
+            "config.configurable.checkpoint_id must be a non-empty string."
+        )
+    return checkpoint_id
+
+
+def validate_checkpoint_id_from_runnable_config(params: dict[str, Any]) -> str | None:
+    """Return a client-facing validation message, or ``None`` if valid/absent."""
+    try:
+        checkpoint_id = _checkpoint_id_from_run_start_config(params)
+    except ValueError as exc:
+        return str(exc)
+    if checkpoint_id is None:
+        return None
+    try:
+        UUID(checkpoint_id)
+    except ValueError:
+        return f"Invalid config.configurable.checkpoint_id: {checkpoint_id!r}."
+    return None
+
+
+# Concurrency strategies accepted on ``run.start`` — the four values the
+# SDK's ``multitaskStrategy`` option can take, derived from the canonical
+# ``MultitaskStrategy`` literal so the two never drift.
+VALID_MULTITASK_STRATEGIES: tuple[str, ...] = get_args(MultitaskStrategy)
+# Legacy stream-endpoint default: queue new runs behind active ones instead
+# of interrupting. Used when the caller omits ``multitaskStrategy``.
+DEFAULT_MULTITASK_STRATEGY = "enqueue"
+
+
+def _multitask_strategy_from_run_start(params: dict[str, Any]) -> str:
+    """Resolve the per-run ``multitaskStrategy`` from ``run.start`` params.
+
+    The SDK forwards the caller's ``multitaskStrategy`` on every
+    ``run.start`` (one of ``reject`` | ``rollback`` | ``interrupt`` |
+    ``enqueue``). Honor it when it is one of the recognized strategies,
+    otherwise fall back to ``DEFAULT_MULTITASK_STRATEGY`` (the legacy
+    stream-endpoint default). This mirrors the JS reference server's
+    lenient normalization so both behave identically.
+    """
+    strategy = params.get("multitaskStrategy")
+    if isinstance(strategy, str) and strategy in VALID_MULTITASK_STRATEGIES:
+        return strategy
+    return DEFAULT_MULTITASK_STRATEGY
+
+
 EventSink = Callable[[dict[str, Any]], Awaitable[None] | None]
 
 
@@ -401,6 +471,10 @@ class ThreadRunManager:
                 "run.start requires an assistant_id.",
             )
 
+        checkpoint_error = validate_checkpoint_id_from_runnable_config(params)
+        if checkpoint_error is not None:
+            return self._error(command.get("id"), "invalid_argument", checkpoint_error)
+
         try:
             run = await self._create_or_resume_run(assistant_id, params)
         except ProtocolV2UnsupportedError as exc:
@@ -419,69 +493,150 @@ class ThreadRunManager:
             "meta": self._meta(),
         }
 
-    async def _handle_input_respond(self, command: dict[str, Any]) -> dict[str, Any]:
-        params = command.get("params", {}) if _is_record(command.get("params")) else {}
+    @staticmethod
+    def _coerce_respond_namespace(raw: Any) -> list[str] | None:
+        """Validate an ``input.respond`` namespace.
+
+        CDDL ``InputRespondParams`` marks ``namespace`` as required, but an
+        omitted value is treated as the root namespace (``[]``). Returns the
+        coerced list, or ``None`` when the value is not a list of strings.
+        """
+        if not isinstance(raw, list) or not all(isinstance(seg, str) for seg in raw):
+            return None
+        return list(raw)
+
+    def _normalize_respond_entries(
+        self, cmd_id: int | None, params: dict[str, Any]
+    ) -> tuple[list[tuple[str, list[str], Any]] | None, dict[str, Any] | None]:
+        """Normalize ``input.respond`` params into resume entries.
+
+        Clients send either a single ``interrupt_id`` / ``response`` (with an
+        optional ``namespace``) or a ``responses`` batch — a list of
+        ``{interrupt_id, response, namespace?}`` objects. The batch form
+        resumes several interrupts pending at the same checkpoint (e.g.
+        parallel tool-authorization prompts) in one command; sequential
+        single resumes cannot, since the first resume starts a run, leaving
+        the rest with no interrupted run to respond to. Both forms are part
+        of the streaming protocol (``InputRespondParams`` =
+        ``InputRespondOne / InputRespondMany``); the batch entries are read
+        leniently to tolerate clients pinned to older bindings.
+
+        Returns ``(entries, None)`` on success or ``(None, error)`` with a
+        protocol error envelope. Each entry is
+        ``(interrupt_id, namespace, response)``.
+        """
+        raw_responses = params.get("responses")
+        if isinstance(raw_responses, list):
+            if not raw_responses:
+                return None, self._error(
+                    cmd_id,
+                    "invalid_argument",
+                    "input.respond requires at least one response.",
+                )
+            entries: list[tuple[str, list[str], Any]] = []
+            for entry in raw_responses:
+                if not _is_record(entry):
+                    return None, self._error(
+                        cmd_id,
+                        "invalid_argument",
+                        "input.respond responses entries must be objects.",
+                    )
+                entry_id = entry.get("interrupt_id")
+                if not isinstance(entry_id, str):
+                    return None, self._error(
+                        cmd_id,
+                        "invalid_argument",
+                        "input.respond responses entries require an interrupt_id.",
+                    )
+                namespace = self._coerce_respond_namespace(entry.get("namespace", []))
+                if namespace is None:
+                    return None, self._error(
+                        cmd_id,
+                        "invalid_argument",
+                        "input.respond requires namespace to be a list of strings.",
+                    )
+                entries.append((entry_id, namespace, entry.get("response")))
+            return entries, None
+
         interrupt_id = params.get("interrupt_id")
         if not isinstance(interrupt_id, str):
-            return self._error(
-                command.get("id"),
+            return None, self._error(
+                cmd_id,
                 "invalid_argument",
                 "input.respond requires an interrupt_id.",
             )
-
-        # CDDL InputRespondParams marks ``namespace`` as required. Accept an
-        # empty list (root) but reject anything that is not a list of strings.
-        raw_namespace = params.get("namespace", [])
-        if not isinstance(raw_namespace, list) or not all(
-            isinstance(seg, str) for seg in raw_namespace
-        ):
-            return self._error(
-                command.get("id"),
+        namespace = self._coerce_respond_namespace(params.get("namespace", []))
+        if namespace is None:
+            return None, self._error(
+                cmd_id,
                 "invalid_argument",
                 "input.respond requires namespace to be a list of strings.",
             )
-        claimed_namespace: list[str] = list(raw_namespace)
-
-        # Cross-check against the session's pending interrupts so we can
-        # return ``no_such_interrupt`` for unknown/mismatched pairs.
-        # When the session was attached fresh by this HTTP request (the
-        # stateless ``POST /commands`` transport) its source task hasn't
-        # had a chance to emit ``input.requested`` yet — ``_pending_interrupts``
-        # is still empty. In that case, fall back to the thread-state
-        # check so we don't reject legitimate resumes with a fresh
-        # handle. The WebSocket path (long-lived session) hits the
-        # in-memory check and skips the DB round-trip.
-        pending_namespace = (
-            self._session.lookup_pending_interrupt(interrupt_id)
-            if self._session is not None
-            else None
+        return [(interrupt_id, namespace, params.get("response"))], None
+
+    async def _handle_input_respond(self, command: dict[str, Any]) -> dict[str, Any]:
+        params = command.get("params", {}) if _is_record(command.get("params")) else {}
+
+        entries, normalize_error = self._normalize_respond_entries(
+            command.get("id"), params
         )
-        if pending_namespace is not None:
-            # Authoritative: the session observed the ``input.requested``
-            # event and recorded the exact subgraph namespace. Enforce
-            # strict comparison.
-            if pending_namespace != claimed_namespace:
-                return self._error(
-                    command.get("id"),
-                    "no_such_interrupt",
-                    "Interrupt namespace does not match the pending interrupt.",
-                )
-        else:
-            # HTTP fallback: ``_lookup_interrupt_in_thread_state`` only
-            # walks root tasks and returns ``[]`` for any match, so it
+        if normalize_error is not None:
+            return normalize_error
+        if entries is None:  # narrowed by the error branch above
+            return self._error(
+                command.get("id"), "unknown_error", "No entries to respond to."
+            )
+
+        # Cross-check every targeted interrupt against the session's pending
+        # interrupts so we can return ``no_such_interrupt`` for
+        # unknown/mismatched pairs. When the session was attached fresh by
+        # this HTTP request (the stateless ``POST /commands`` transport) its
+        # source task hasn't had a chance to emit ``input.requested`` yet —
+        # ``_pending_interrupts`` is still empty. In that case, fall back to
+        # the thread-state check so we don't reject legitimate resumes with a
+        # fresh handle. The WebSocket path (long-lived session) hits the
+        # in-memory check and skips the DB round-trip.
+        #
+        # The thread-state fallback is fetched at most once per batch and
+        # cached in ``thread_state_ids``: a batch of N entries that all miss
+        # the session would otherwise issue N identical ``State.get`` calls.
+        thread_state_ids: set[str] | None = None
+        thread_state_fetched = False
+        for interrupt_id, claimed_namespace, _ in entries:
+            pending_namespace = (
+                self._session.lookup_pending_interrupt(interrupt_id)
+                if self._session is not None
+                else None
+            )
+            if pending_namespace is not None:
+                # Authoritative: the session observed the ``input.requested``
+                # event and recorded the exact subgraph namespace. Enforce
+                # strict comparison.
+                if pending_namespace != claimed_namespace:
+                    return self._error(
+                        command.get("id"),
+                        "no_such_interrupt",
+                        "Interrupt namespace does not match the pending interrupt.",
+                    )
+                continue
+            # HTTP fallback: the bulk thread-state lookup only walks root
+            # tasks and surfaces interrupts by id (not namespace), so it
             # cannot validate subgraph namespaces. Verify the interrupt
             # exists on persisted state and trust the client-claimed
-            # namespace — the interrupt_id is a UUID, so the existence
-            # check alone is sufficient. (Without this, every HTTP
-            # ``input.respond`` for a subgraph interrupt would 404.)
-            if await self._lookup_interrupt_in_thread_state(interrupt_id) is None:
+            # namespace — the interrupt_id is a UUID, so the existence check
+            # alone is sufficient. (Without this, every HTTP ``input.respond``
+            # for a subgraph interrupt would 404.)
+            if not thread_state_fetched:
+                thread_state_ids = await self._collect_thread_state_interrupt_ids()
+                thread_state_fetched = True
+            if thread_state_ids is None or interrupt_id not in thread_state_ids:
                 return self._error(
                     command.get("id"),
                     "no_such_interrupt",
                     f"Unknown or already-consumed interrupt: {interrupt_id}",
                 )
 
-        # At this point we've confirmed the interrupt exists on the
+        # At this point we've confirmed every interrupt exists on the
         # thread state (or was surfaced via the session). No need for a
         # second ``_has_pending_interrupts`` round-trip.
 
@@ -496,12 +651,17 @@ class ThreadRunManager:
                 "No interrupted run is bound to this thread.",
             )
 
+        # Merge every entry into a single ``{interrupt_id: response}`` resume
+        # map. ``_create_or_resume_run`` forwards it verbatim as
+        # ``Command(resume=...)``, which resumes all targeted interrupts in
+        # one run.
+        resume_input = {interrupt_id: response for interrupt_id, _, response in entries}
         try:
             await self._create_or_resume_run(
                 assistant_id,
                 {
                     "assistant_id": assistant_id,
-                    "input": {interrupt_id: params.get("response")},
+                    "input": resume_input,
                     "config": params.get("config"),
                     "metadata": params.get("metadata"),
                 },
@@ -512,7 +672,8 @@ class ThreadRunManager:
             return self._error(command.get("id"), "unknown_error", str(exc))
 
         if self._session is not None:
-            self._session.clear_pending_interrupt(interrupt_id)
+            for interrupt_id, _, _ in entries:
+                self._session.clear_pending_interrupt(interrupt_id)
 
         return {
             "type": "success",
@@ -575,13 +736,26 @@ class ThreadRunManager:
             },
         }
 
+        # The fork target arrives only via ``config.configurable.checkpoint_id``
+        # (the SDK folds its ergonomic ``forkFrom`` option into this field
+        # client-side, so there is a single way to provide it). Extract it
+        # here and map it onto the top-level ``checkpoint_id`` / ``checkpoint``
+        # fields of ``run_payload`` below: ``create_valid_run`` — the shared
+        # run-creation path also used by the legacy REST run-create endpoints —
+        # reads the fork target from those fields (UUID-validating it and
+        # injecting it back into ``config.configurable``), so populating them is
+        # what makes the run replay from the requested checkpoint rather than
+        # the thread's latest state.
+        checkpoint_id = _checkpoint_id_from_run_start_config(params)
+
         run_payload: dict[str, Any] = {
             "assistant_id": assistant_id,
             "input": None if is_resume else params.get("input"),
             "command": {"resume": params["input"]} if is_resume else None,
             "config": run_config,
             "metadata": params.get("metadata"),
-            "checkpoint_id": None,
+            "checkpoint_id": checkpoint_id,
+            "checkpoint": {"checkpoint_id": checkpoint_id} if checkpoint_id else None,
             "context": None,
             "webhook": None,
             "stream_mode": list(DEFAULT_RUN_STREAM_MODES),
@@ -596,11 +770,10 @@ class ThreadRunManager:
             # chokes on None. Zero means "start immediately".
             "after_seconds": 0,
             "if_not_exists": "create",
-            # Match legacy stream endpoint default: queue new runs behind active
-            # ones instead of interrupting. The protocol spec describes this
-            # case as "inject into running graph", which Python LangGraph does
-            # not yet support; enqueue is the least surprising approximation.
-            "multitask_strategy": "enqueue",
+            # Honor the caller's ``multitaskStrategy`` (the SDK sends it on
+            # every run.start), falling back to ``enqueue`` — the legacy
+            # stream-endpoint default — when omitted.
+            "multitask_strategy": _multitask_strategy_from_run_start(params),
             "langsmith_tracer": None,
             "durability": None,
         }
@@ -862,6 +1035,24 @@ class ThreadRunManager:
         treat ``[]`` as "interrupt found, namespace unknown" and trust
         the client-claimed namespace.
         """
+        found = await self._collect_thread_state_interrupt_ids()
+        if found is None:
+            return None
+        return [] if interrupt_id in found else None
+
+    async def _collect_thread_state_interrupt_ids(self) -> set[str] | None:
+        """Fetch persisted thread state once and collect all interrupt ids.
+
+        Bulk counterpart to ``_lookup_interrupt_in_thread_state`` for the
+        ``input.respond`` batch path: a single ``State.get`` round-trip is
+        shared across every entry in the batch instead of one DB call per
+        interrupt. Returns the set of interrupt ids present on the thread's
+        root tasks, or ``None`` if the state fetch failed (callers treat a
+        ``None`` result as "lookup unavailable", not "no interrupts").
+
+        Like the single lookup, this only walks root-level tasks — subgraph
+        interrupts surface by id but not by namespace.
+        """
         from langgraph_runtime.database import connect  # noqa: PLC0415
 
         # ``supports_core_api=False`` so the postgres backend yields a
@@ -879,7 +1070,6 @@ class ThreadRunManager:
             logger.warning(
                 "interrupt_lookup_failed",
                 thread_id=self._thread_id,
-                interrupt_id=interrupt_id,
                 error=str(exc),
                 error_type=type(exc).__name__,
             )
@@ -888,6 +1078,7 @@ class ThreadRunManager:
         tasks = (
             state.get("tasks") if _is_record(state) else getattr(state, "tasks", None)
         ) or ()
+        found: set[str] = set()
         for task in tasks:
             interrupts = (
                 task.get("interrupts")
@@ -900,15 +1091,9 @@ class ThreadRunManager:
                 entry_id = (
                     entry.get("id") if _is_record(entry) else getattr(entry, "id", None)
                 )
-                if entry_id == interrupt_id:
-                    # Existence-only signal. We can't reliably derive
-                    # the subgraph namespace from this state shape
-                    # (subgraph tasks aren't always materialized in
-                    # ``state.tasks``), so we return ``[]`` as an
-                    # "interrupt found" sentinel. The caller knows not
-                    # to use this for namespace comparison.
-                    return []
-        return None
+                if isinstance(entry_id, str):
+                    found.add(entry_id)
+        return found
 
     async def _has_pending_interrupts(self) -> bool:
         # Prefer the session's locally-tracked pending interrupts when

{langgraph_api-0.9.0.dev6 → langgraph_api-0.10.0rc1}/langgraph_api/event_streaming/types.py

@@ -28,6 +28,9 @@ from langchain_protocol import (
     FinalizedContentBlock,
     ImageContentBlock,
     InputRequestedData,
+    InputRespondEntry,
+    InputRespondMany,
+    InputRespondOne,
     InputRespondParams,
     LifecycleCause,
     LifecycleCauseEdge,
@@ -90,6 +93,9 @@ __all__ = [
     "FinalizedContentBlock",
     "ImageContentBlock",
     "InputRequestedData",
+    "InputRespondEntry",
+    "InputRespondMany",
+    "InputRespondOne",
     "InputRespondParams",
     "LifecycleCause",
     "LifecycleCauseEdge",

{langgraph_api-0.9.0.dev6 → langgraph_api-0.10.0rc1}/pyproject.toml

@@ -39,7 +39,7 @@ dependencies = [
     "cryptography>=42.0.0",
     "langgraph-sdk>=0.3.5",
     "cloudpickle>=3.0.0",
-    "langgraph-runtime-inmem>=0.28.0,<0.29.0",
+    "langgraph-runtime-inmem>=0.30.0.dev0,<0.31.0.dev0",
     "truststore>=0.1",
     "protobuf>=6.32.1,<7.0.0",
     "grpcio>=1.80.0,<1.81.0",
@@ -50,7 +50,7 @@ dependencies = [
     "opentelemetry-exporter-otlp-proto-http>=0.0.1",
     "uuid-utils>=0.12.0",
     "zstandard>=0.23.0",
-    "langchain-protocol>=0.0.15,<0.1",
+    "langchain-protocol>=0.0.16,<0.1",
 ]
 
 [project.scripts]

{langgraph_api-0.9.0.dev6 → langgraph_api-0.10.0rc1}/uv.lock

@@ -684,14 +684,14 @@ wheels = [
 
 [[package]]
 name = "langchain-protocol"
-version = "0.0.15"
+version = "0.0.16"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/4f/24/9777489d6fbbee64af0c8f96d4f840239c408cf694f3394672807dafc490/langchain_protocol-0.0.15.tar.gz", hash = "sha256:9ab2d11ee73944754f10e037e717098d3a6796f0e58afa9cadda6154e7655ade", size = 5862, upload-time = "2026-05-01T22:30:04.748Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/36/e7/8300ba22d968653051fd06e3117d783872dddf3dcebdd6b1d386836eb43c/langchain_protocol-0.0.16.tar.gz", hash = "sha256:806c7cdd951b1c4f692fa40fce60821ff0f221d4360e27673ddf2c2b99c2b7ff", size = 5969, upload-time = "2026-05-28T23:05:11.121Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1d/7a/9c97a7b9cbe4c5dc6a44cdb1545450c28f0c8ce89b9c1f0ee7fbad896263/langchain_protocol-0.0.15-py3-none-any.whl", hash = "sha256:461eb794358f83d5e42635a5797799ffec7b4702314e34edf73ac21e75d3ef79", size = 6982, upload-time = "2026-05-01T22:30:03.877Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/9c/06dfcc88d02a6364e8d864c421ddd3736305cb0a6c853f75c302c80fe17c/langchain_protocol-0.0.16-py3-none-any.whl", hash = "sha256:3658c142c5d0fb3a023a4be442ce4c15c6d626aab6135eb79a76dc64ad19c3c3", size = 7037, upload-time = "2026-05-28T23:05:10.163Z" },
 ]
 
 [[package]]
@@ -785,7 +785,7 @@ requires-dist = [
     { name = "httpx", specifier = ">=0.25.0" },
     { name = "jsonschema-rs", specifier = ">=0.20.0,<0.45" },
     { name = "langchain-core", specifier = ">=0.3.64" },
-    { name = "langchain-protocol", specifier = ">=0.0.15,<0.1" },
+    { name = "langchain-protocol", specifier = ">=0.0.16,<0.1" },
     { name = "langgraph", specifier = ">=0.4.10,<2" },
     { name = "langgraph-checkpoint", specifier = ">=3.0.1,<5" },
     { name = "langgraph-runtime-inmem", editable = "../runtime_inmem" },

langgraph_api-0.9.0.dev6/langgraph_api/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.9.0.dev6"