langsmith 0.10.4 → 0.10.6

package/dist/sandbox/index.cjs

@@ -29,7 +29,7 @@
  * @packageDocumentation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LangSmithDataplaneNotConfiguredError = exports.LangSmithCommandTimeoutError = exports.LangSmithSandboxOperationError = exports.LangSmithSandboxNotReadyError = exports.LangSmithSandboxCreationError = exports.LangSmithResourceCreationError = exports.LangSmithQuotaExceededError = exports.LangSmithValidationError = exports.LangSmithResourceNameConflictError = exports.LangSmithResourceAlreadyExistsError = exports.LangSmithResourceInUseError = exports.LangSmithResourceTimeoutError = exports.LangSmithResourceNotFoundError = exports.LangSmithSandboxServerReloadError = exports.LangSmithSandboxConnectTimeoutError = exports.LangSmithSandboxRetryableConnectionError = exports.LangSmithSandboxConnectionError = exports.LangSmithSandboxAuthenticationError = exports.LangSmithSandboxAPIError = exports.LangSmithSandboxError = exports.s3Mount = exports.mountConfig = exports.gitMount = exports.gcsMount = exports.contextHubMount = exports.workspaceSecret = exports.proxyConfig = exports.opaqueSecret = exports.gcpAuth = exports.awsAuth = exports.CommandHandle = exports.Sandbox = exports.SandboxClient = void 0;
+exports.LangSmithSandboxTokenVerificationError = exports.LangSmithDataplaneNotConfiguredError = exports.LangSmithCommandTimeoutError = exports.LangSmithSandboxOperationError = exports.LangSmithSandboxNotReadyError = exports.LangSmithSandboxCreationError = exports.LangSmithResourceCreationError = exports.LangSmithQuotaExceededError = exports.LangSmithValidationError = exports.LangSmithResourceNameConflictError = exports.LangSmithResourceAlreadyExistsError = exports.LangSmithResourceInUseError = exports.LangSmithResourceTimeoutError = exports.LangSmithResourceNotFoundError = exports.LangSmithSandboxServerReloadError = exports.LangSmithSandboxConnectTimeoutError = exports.LangSmithSandboxRetryableConnectionError = exports.LangSmithSandboxConnectionError = exports.LangSmithSandboxAuthenticationError = exports.LangSmithSandboxAPIError = exports.LangSmithSandboxError = exports.s3Mount = exports.mountConfig = exports.gitMount = exports.gcsMount = exports.contextHubMount = exports.CALLBACK_SIGNATURE_HEADER = exports.USER_TOKEN_HEADER = exports.SandboxTokenVerifier = exports.SERVICE_TOKEN_HEADER = exports.ServiceLoginUrl = exports.ServiceUrl = exports.validateAccessDelegation = exports.workspaceSecret = exports.proxyConfig = exports.opaqueSecret = exports.gcpAuth = exports.awsAuth = exports.CommandHandle = exports.Sandbox = exports.SandboxClient = void 0;
 // Main classes
 var client_js_1 = require("./client.cjs");
 Object.defineProperty(exports, "SandboxClient", { enumerable: true, get: function () { return client_js_1.SandboxClient; } });
@@ -43,6 +43,16 @@ Object.defineProperty(exports, "gcpAuth", { enumerable: true, get: function () {
 Object.defineProperty(exports, "opaqueSecret", { enumerable: true, get: function () { return proxy_config_js_1.opaqueSecret; } });
 Object.defineProperty(exports, "proxyConfig", { enumerable: true, get: function () { return proxy_config_js_1.proxyConfig; } });
 Object.defineProperty(exports, "workspaceSecret", { enumerable: true, get: function () { return proxy_config_js_1.workspaceSecret; } });
+var access_delegation_js_1 = require("./access_delegation.cjs");
+Object.defineProperty(exports, "validateAccessDelegation", { enumerable: true, get: function () { return access_delegation_js_1.validateAccessDelegation; } });
+var service_url_js_1 = require("./service_url.cjs");
+Object.defineProperty(exports, "ServiceUrl", { enumerable: true, get: function () { return service_url_js_1.ServiceUrl; } });
+Object.defineProperty(exports, "ServiceLoginUrl", { enumerable: true, get: function () { return service_url_js_1.ServiceLoginUrl; } });
+Object.defineProperty(exports, "SERVICE_TOKEN_HEADER", { enumerable: true, get: function () { return service_url_js_1.SERVICE_TOKEN_HEADER; } });
+var verify_js_1 = require("./verify.cjs");
+Object.defineProperty(exports, "SandboxTokenVerifier", { enumerable: true, get: function () { return verify_js_1.SandboxTokenVerifier; } });
+Object.defineProperty(exports, "USER_TOKEN_HEADER", { enumerable: true, get: function () { return verify_js_1.USER_TOKEN_HEADER; } });
+Object.defineProperty(exports, "CALLBACK_SIGNATURE_HEADER", { enumerable: true, get: function () { return verify_js_1.CALLBACK_SIGNATURE_HEADER; } });
 var mounts_js_1 = require("./mounts.cjs");
 Object.defineProperty(exports, "contextHubMount", { enumerable: true, get: function () { return mounts_js_1.contextHubMount; } });
 Object.defineProperty(exports, "gcsMount", { enumerable: true, get: function () { return mounts_js_1.gcsMount; } });
@@ -76,3 +86,4 @@ Object.defineProperty(exports, "LangSmithSandboxNotReadyError", { enumerable: tr
 Object.defineProperty(exports, "LangSmithSandboxOperationError", { enumerable: true, get: function () { return errors_js_1.LangSmithSandboxOperationError; } });
 Object.defineProperty(exports, "LangSmithCommandTimeoutError", { enumerable: true, get: function () { return errors_js_1.LangSmithCommandTimeoutError; } });
 Object.defineProperty(exports, "LangSmithDataplaneNotConfiguredError", { enumerable: true, get: function () { return errors_js_1.LangSmithDataplaneNotConfiguredError; } });
+Object.defineProperty(exports, "LangSmithSandboxTokenVerificationError", { enumerable: true, get: function () { return errors_js_1.LangSmithSandboxTokenVerificationError; } });

package/dist/sandbox/index.d.ts

@@ -31,6 +31,12 @@ export { SandboxClient } from "./client.js";
 export { Sandbox } from "./sandbox.js";
 export { CommandHandle } from "./command_handle.js";
 export { awsAuth, gcpAuth, opaqueSecret, proxyConfig, workspaceSecret, } from "./proxy_config.js";
+export { validateAccessDelegation } from "./access_delegation.js";
+export { ServiceUrl, ServiceLoginUrl, SERVICE_TOKEN_HEADER, } from "./service_url.js";
+export { SandboxTokenVerifier, USER_TOKEN_HEADER, CALLBACK_SIGNATURE_HEADER, } from "./verify.js";
+export type { AudienceMatcher, SandboxCallback, SandboxCallbackIdentity, SandboxCallbackRequest, SandboxTokenVerifierConfig, SandboxUser, VerifyCallbackOptions, VerifyUserTokenOptions, } from "./verify.js";
 export { contextHubMount, gcsMount, gitMount, mountConfig, s3Mount, } from "./mounts.js";
-export type { ExecutionResult, OutputChunk, WsMessage, WsRunOptions, ResourceStatus, Snapshot, SandboxData, SandboxClientConfig, RunOptions, CreateSandboxOptions, SandboxAccessControl, SandboxAwsAuthRule, SandboxAwsMountAuthConfig, SandboxGcpAuthRule, SandboxGcpMountAuthConfig, SandboxMountAuth, SandboxMountAuthConfig, SandboxMountConfig, SandboxProxyConfig, SandboxProxyRule, SandboxProxySecret, SandboxMount, MountCacheConfig, ContextHubMountConfig, ContextHubMountSpec, GCSMountConfig, GCSMountSpec, GitMountConfig, GitMountRefSpec, GitMountSpec, S3MountConfig, S3MountSpec, CreateSnapshotOptions, CreateDockerfileSnapshotOptions, CaptureSnapshotOptions, DownloadContentDisposition, DownloadURL, GenerateDownloadURLOptions, ListSnapshotsOptions, WaitForSnapshotOptions, StartSandboxOptions, UpdateSandboxOptions, WaitForSandboxOptions, } from "./types.js";
-export { LangSmithSandboxError, LangSmithSandboxAPIError, LangSmithSandboxAuthenticationError, LangSmithSandboxConnectionError, LangSmithSandboxRetryableConnectionError, LangSmithSandboxConnectTimeoutError, LangSmithSandboxServerReloadError, LangSmithResourceNotFoundError, LangSmithResourceTimeoutError, LangSmithResourceInUseError, LangSmithResourceAlreadyExistsError, LangSmithResourceNameConflictError, LangSmithValidationError, LangSmithQuotaExceededError, LangSmithResourceCreationError, LangSmithSandboxCreationError, LangSmithSandboxNotReadyError, LangSmithSandboxOperationError, LangSmithCommandTimeoutError, LangSmithDataplaneNotConfiguredError, } from "./errors.js";
+export type { AccessDelegation, AccessDelegationMode, } from "./access_delegation.js";
+export type { ServiceAccess, ServiceUrlData } from "./service_url.js";
+export type { ExecutionResult, FileChunk, FileInfo, FileStat, GlobOptions, GlobResult, GrepMatch, GrepOptions, GrepResult, ReadRangeOptions, RunConfig, OutputChunk, WsMessage, WsRunOptions, ResourceStatus, Snapshot, SandboxData, SandboxClientConfig, RunOptions, CreateSandboxOptions, SandboxAccessControl, SandboxAwsAuthRule, SandboxAwsMountAuthConfig, SandboxGcpAuthRule, SandboxGcpMountAuthConfig, SandboxMountAuth, SandboxMountAuthConfig, SandboxMountConfig, SandboxProxyConfig, SandboxProxyRule, SandboxProxySecret, SandboxMount, MountCacheConfig, ContextHubMountConfig, ContextHubMountSpec, GCSMountConfig, GCSMountSpec, GitMountConfig, GitMountRefSpec, GitMountSpec, S3MountConfig, S3MountSpec, CreateSnapshotOptions, CreateDockerfileSnapshotOptions, CaptureSnapshotOptions, DownloadContentDisposition, DownloadURL, GenerateDownloadURLOptions, ListSnapshotsOptions, WaitForSnapshotOptions, StartSandboxOptions, UpdateSandboxOptions, WaitForSandboxOptions, } from "./types.js";
+export { LangSmithSandboxError, LangSmithSandboxAPIError, LangSmithSandboxAuthenticationError, LangSmithSandboxConnectionError, LangSmithSandboxRetryableConnectionError, LangSmithSandboxConnectTimeoutError, LangSmithSandboxServerReloadError, LangSmithResourceNotFoundError, LangSmithResourceTimeoutError, LangSmithResourceInUseError, LangSmithResourceAlreadyExistsError, LangSmithResourceNameConflictError, LangSmithValidationError, LangSmithQuotaExceededError, LangSmithResourceCreationError, LangSmithSandboxCreationError, LangSmithSandboxNotReadyError, LangSmithSandboxOperationError, LangSmithCommandTimeoutError, LangSmithDataplaneNotConfiguredError, LangSmithSandboxTokenVerificationError, } from "./errors.js";

package/dist/sandbox/index.js

@@ -32,6 +32,9 @@ export { SandboxClient } from "./client.js";
 export { Sandbox } from "./sandbox.js";
 export { CommandHandle } from "./command_handle.js";
 export { awsAuth, gcpAuth, opaqueSecret, proxyConfig, workspaceSecret, } from "./proxy_config.js";
+export { validateAccessDelegation } from "./access_delegation.js";
+export { ServiceUrl, ServiceLoginUrl, SERVICE_TOKEN_HEADER, } from "./service_url.js";
+export { SandboxTokenVerifier, USER_TOKEN_HEADER, CALLBACK_SIGNATURE_HEADER, } from "./verify.js";
 export { contextHubMount, gcsMount, gitMount, mountConfig, s3Mount, } from "./mounts.js";
 // Errors
 export { 
@@ -44,4 +47,4 @@ LangSmithValidationError, LangSmithQuotaExceededError,
 // Resource creation errors
 LangSmithResourceCreationError, 
 // Sandbox-specific errors
-LangSmithSandboxCreationError, LangSmithSandboxNotReadyError, LangSmithSandboxOperationError, LangSmithCommandTimeoutError, LangSmithDataplaneNotConfiguredError, } from "./errors.js";
+LangSmithSandboxCreationError, LangSmithSandboxNotReadyError, LangSmithSandboxOperationError, LangSmithCommandTimeoutError, LangSmithDataplaneNotConfiguredError, LangSmithSandboxTokenVerificationError, } from "./errors.js";

package/dist/sandbox/mounts.cjs

@@ -6,6 +6,7 @@ exports.gcsMount = gcsMount;
 exports.contextHubMount = contextHubMount;
 exports.mountConfig = mountConfig;
 exports.validateMountConfigProxyConfig = validateMountConfigProxyConfig;
+const proxy_config_js_1 = require("./proxy_config.cjs");
 function requireNonEmptyString(value, field) {
     if (typeof value !== "string" || value.trim() === "") {
         throw new Error(`${field} must be a non-empty string`);
@@ -217,6 +218,11 @@ function normalizeMountAuth(auth) {
             if (aws === undefined) {
                 throw new Error("aws mount auth must include an aws block");
             }
+            const roleArn = (0, proxy_config_js_1.getAwsRoleArn)(aws);
+            if (roleArn !== undefined) {
+                byProvider.aws = { role_arn: roleArn };
+                continue;
+            }
             byProvider.aws = {
                 access_key_id: copyMountSecret(aws.access_key_id, "accessKeyId"),
                 secret_access_key: copyMountSecret(aws.secret_access_key, "secretAccessKey"),
@@ -234,11 +240,21 @@ function normalizeMountAuth(auth) {
     }
     return byProvider;
 }
-function mountConfig({ auth = [], mounts, }) {
+/**
+ * Build mount-scoped auth, or use an enabled AWS rule from proxyConfig for S3.
+ * Pass the same proxyConfig to sandbox creation; its general IAM permissions
+ * remain unchanged. GCS mounts still require explicit GCP auth in this config.
+ */
+function mountConfig({ auth = [], mounts, proxyConfig, }) {
     const normalizedMounts = normalizeMounts(mounts);
     const authByProvider = normalizeMountAuth(auth);
     const mountProviders = new Set(normalizedMounts.map((mount) => mount.type));
-    if (mountProviders.has("s3") && authByProvider.aws === undefined) {
+    const proxyProviders = new Set((proxyConfig?.rules ?? [])
+        .filter((rule) => rule?.enabled === true)
+        .map((rule) => rule.type));
+    if (mountProviders.has("s3") &&
+        authByProvider.aws === undefined &&
+        !proxyProviders.has("aws")) {
         throw new Error("s3 mounts require aws auth in mountConfig");
     }
     if (mountProviders.has("gcs") && authByProvider.gcp === undefined) {
@@ -250,10 +266,12 @@ function mountConfig({ auth = [], mounts, }) {
     if (authByProvider.gcp !== undefined && !mountProviders.has("gcs")) {
         throw new Error("gcp auth requires at least one gcs mount in mountConfig");
     }
-    return {
+    const config = {
         auth: authByProvider,
         mounts: normalizedMounts,
     };
+    validateMountConfigProxyConfig(config, proxyConfig);
+    return config;
 }
 function validateMountConfigProxyConfig(mountConfig, proxyConfig) {
     if (proxyConfig === undefined) {

package/dist/sandbox/mounts.d.ts

@@ -36,8 +36,14 @@ export declare function contextHubMount({ id, mountPath, repo, initialPullOnly,
     repo: string;
     initialPullOnly?: boolean;
 }): ContextHubMountSpec;
-export declare function mountConfig({ auth, mounts, }: {
+/**
+ * Build mount-scoped auth, or use an enabled AWS rule from proxyConfig for S3.
+ * Pass the same proxyConfig to sandbox creation; its general IAM permissions
+ * remain unchanged. GCS mounts still require explicit GCP auth in this config.
+ */
+export declare function mountConfig({ auth, mounts, proxyConfig, }: {
     auth?: SandboxMountAuth[];
     mounts: SandboxMount[];
+    proxyConfig?: SandboxProxyConfig;
 }): SandboxMountConfig;
 export declare function validateMountConfigProxyConfig(mountConfig: SandboxMountConfig, proxyConfig: SandboxProxyConfig | undefined): void;

package/dist/sandbox/mounts.js

@@ -1,3 +1,4 @@
+import { getAwsRoleArn } from "./proxy_config.js";
 function requireNonEmptyString(value, field) {
     if (typeof value !== "string" || value.trim() === "") {
         throw new Error(`${field} must be a non-empty string`);
@@ -209,6 +210,11 @@ function normalizeMountAuth(auth) {
             if (aws === undefined) {
                 throw new Error("aws mount auth must include an aws block");
             }
+            const roleArn = getAwsRoleArn(aws);
+            if (roleArn !== undefined) {
+                byProvider.aws = { role_arn: roleArn };
+                continue;
+            }
             byProvider.aws = {
                 access_key_id: copyMountSecret(aws.access_key_id, "accessKeyId"),
                 secret_access_key: copyMountSecret(aws.secret_access_key, "secretAccessKey"),
@@ -226,11 +232,21 @@ function normalizeMountAuth(auth) {
     }
     return byProvider;
 }
-export function mountConfig({ auth = [], mounts, }) {
+/**
+ * Build mount-scoped auth, or use an enabled AWS rule from proxyConfig for S3.
+ * Pass the same proxyConfig to sandbox creation; its general IAM permissions
+ * remain unchanged. GCS mounts still require explicit GCP auth in this config.
+ */
+export function mountConfig({ auth = [], mounts, proxyConfig, }) {
     const normalizedMounts = normalizeMounts(mounts);
     const authByProvider = normalizeMountAuth(auth);
     const mountProviders = new Set(normalizedMounts.map((mount) => mount.type));
-    if (mountProviders.has("s3") && authByProvider.aws === undefined) {
+    const proxyProviders = new Set((proxyConfig?.rules ?? [])
+        .filter((rule) => rule?.enabled === true)
+        .map((rule) => rule.type));
+    if (mountProviders.has("s3") &&
+        authByProvider.aws === undefined &&
+        !proxyProviders.has("aws")) {
         throw new Error("s3 mounts require aws auth in mountConfig");
     }
     if (mountProviders.has("gcs") && authByProvider.gcp === undefined) {
@@ -242,10 +258,12 @@ export function mountConfig({ auth = [], mounts, }) {
     if (authByProvider.gcp !== undefined && !mountProviders.has("gcs")) {
         throw new Error("gcp auth requires at least one gcs mount in mountConfig");
     }
-    return {
+    const config = {
         auth: authByProvider,
         mounts: normalizedMounts,
     };
+    validateMountConfigProxyConfig(config, proxyConfig);
+    return config;
 }
 export function validateMountConfigProxyConfig(mountConfig, proxyConfig) {
     if (proxyConfig === undefined) {

package/dist/sandbox/proxy_config.cjs

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAwsRoleArn = getAwsRoleArn;
 exports.workspaceSecret = workspaceSecret;
 exports.opaqueSecret = opaqueSecret;
 exports.proxyConfig = proxyConfig;
@@ -49,6 +50,10 @@ function requireProxyRules(rules) {
     });
 }
 function validateProxyProviderRule(rule) {
+    if (rule.type === "aws") {
+        getAwsRoleArn(rule.aws);
+        return;
+    }
     if (rule.type !== "gcp") {
         return;
     }
@@ -58,6 +63,21 @@ function validateProxyProviderRule(rule) {
     }
     requireNonEmptyStringArray(gcp.scopes, "scopes");
 }
+/** Validate role-only descriptors without tightening legacy static inputs. */
+function getAwsRoleArn(aws) {
+    if (aws === null || typeof aws !== "object" || Array.isArray(aws)) {
+        return undefined;
+    }
+    const config = aws;
+    if (!("role_arn" in config) || config.role_arn === "") {
+        return undefined;
+    }
+    const roleArn = requireNonEmptyString(config.role_arn, "roleArn");
+    if (Object.keys(config).some((key) => key !== "role_arn")) {
+        throw new Error("AWS role auth must contain only role_arn");
+    }
+    return roleArn;
+}
 /** Reference a LangSmith workspace secret in a sandbox proxy configuration. */
 function workspaceSecret(name) {
     const normalized = requireNonEmptyString(name, "name");
@@ -82,28 +102,39 @@ function opaqueSecret(value) {
     };
 }
 /** Build a sandbox proxy config from one or more proxy rules. */
-function proxyConfig({ rules, noProxy, accessControl, } = {}) {
+function proxyConfig({ rules, accessControl, } = {}) {
     const config = {
         rules: requireProxyRules(rules),
     };
-    if (noProxy !== undefined) {
-        config.no_proxy = requireNonEmptyStringArray(noProxy, "noProxy");
-    }
     if (accessControl !== undefined) {
         config.access_control = { ...accessControl };
     }
     return config;
 }
-/** Build a sandbox proxy rule that signs AWS HTTPS requests with SigV4. */
-function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, envVars, }) {
+function awsAuth({ accessKeyId, secretAccessKey, roleArn, name = "aws", enabled = true, envVars, }) {
+    const candidate = {};
+    if (roleArn !== undefined)
+        candidate.role_arn = roleArn;
+    if (accessKeyId !== undefined)
+        candidate.access_key_id = accessKeyId;
+    if (secretAccessKey !== undefined)
+        candidate.secret_access_key = secretAccessKey;
+    const normalizedRole = getAwsRoleArn(candidate);
+    let aws;
+    if (normalizedRole !== undefined) {
+        aws = { role_arn: normalizedRole };
+    }
+    else {
+        if (accessKeyId === undefined || secretAccessKey === undefined) {
+            throw new Error("AWS auth requires roleArn or both static credentials");
+        }
+        aws = { access_key_id: accessKeyId, secret_access_key: secretAccessKey };
+    }
     const rule = {
         name: requireNonEmptyString(name, "name"),
         type: "aws",
         enabled,
-        aws: {
-            access_key_id: accessKeyId,
-            secret_access_key: secretAccessKey,
-        },
+        aws,
     };
     if (envVars !== undefined) {
         rule.env_vars = requireEnvVars(envVars);

package/dist/sandbox/proxy_config.d.ts

@@ -1,22 +1,48 @@
 import type { SandboxAccessControl, SandboxAwsAuthRule, SandboxGcpAuthRule, SandboxProxyConfig, SandboxProxyRule, SandboxProxySecret } from "./types.js";
+/** Validate role-only descriptors without tightening legacy static inputs. */
+export declare function getAwsRoleArn(aws: unknown): string | undefined;
 /** Reference a LangSmith workspace secret in a sandbox proxy configuration. */
 export declare function workspaceSecret(name: string): SandboxProxySecret;
 /** Provide a write-only secret value for a sandbox proxy configuration. */
 export declare function opaqueSecret(value: string): SandboxProxySecret;
 /** Build a sandbox proxy config from one or more proxy rules. */
-export declare function proxyConfig({ rules, noProxy, accessControl, }?: {
+export declare function proxyConfig({ rules, accessControl, }?: {
     rules?: SandboxProxyRule[];
+    /** @deprecated Ignored. The sandbox runtime has no proxy bypass list. */
     noProxy?: string[];
     accessControl?: SandboxAccessControl;
 }): SandboxProxyConfig;
-/** Build a sandbox proxy rule that signs AWS HTTPS requests with SigV4. */
-export declare function awsAuth({ accessKeyId, secretAccessKey, name, enabled, envVars, }: {
-    accessKeyId: SandboxProxySecret;
-    secretAccessKey: SandboxProxySecret;
+interface AwsAuthCommonOptions {
     name?: string;
     enabled?: boolean;
     envVars?: Record<string, string>;
-}): SandboxAwsAuthRule;
+}
+type AwsStaticAuthConfig = Extract<SandboxAwsAuthRule["aws"], {
+    access_key_id: SandboxProxySecret;
+}>;
+type AwsRoleAuthConfig = Extract<SandboxAwsAuthRule["aws"], {
+    role_arn: string;
+}>;
+type AwsStaticAuthOptions = AwsAuthCommonOptions & {
+    accessKeyId: SandboxProxySecret;
+    secretAccessKey: SandboxProxySecret;
+    roleArn?: "";
+};
+type AwsRoleAuthOptions = AwsAuthCommonOptions & {
+    roleArn: string;
+    accessKeyId?: never;
+    secretAccessKey?: never;
+};
+/**
+ * Sign supported AWS HTTPS requests using static keys or an IAM role.
+ * Role auth requires backend support and is configured at sandbox creation.
+ * LangSmith supplies the workspace External ID and renews credentials.
+ * A role in proxyConfig uses its effective IAM permissions; the same helper
+ * in mountConfig.auth uses the backend's mount-scoped S3 permissions.
+ */
+export declare function awsAuth(options: AwsStaticAuthOptions): SandboxAwsAuthRule<AwsStaticAuthConfig>;
+export declare function awsAuth(options: AwsRoleAuthOptions): SandboxAwsAuthRule<AwsRoleAuthConfig>;
+export declare function awsAuth(options: AwsStaticAuthOptions | AwsRoleAuthOptions): SandboxAwsAuthRule;
 /** Build a sandbox proxy rule that injects GCP OAuth bearer auth. */
 export declare function gcpAuth({ serviceAccountJson, scopes, name, enabled, envVars, }: {
     serviceAccountJson: SandboxProxySecret;
@@ -25,3 +51,4 @@ export declare function gcpAuth({ serviceAccountJson, scopes, name, enabled, env
     enabled?: boolean;
     envVars?: Record<string, string>;
 }): SandboxGcpAuthRule;
+export {};

package/dist/sandbox/proxy_config.js

@@ -42,6 +42,10 @@ function requireProxyRules(rules) {
     });
 }
 function validateProxyProviderRule(rule) {
+    if (rule.type === "aws") {
+        getAwsRoleArn(rule.aws);
+        return;
+    }
     if (rule.type !== "gcp") {
         return;
     }
@@ -51,6 +55,21 @@ function validateProxyProviderRule(rule) {
     }
     requireNonEmptyStringArray(gcp.scopes, "scopes");
 }
+/** Validate role-only descriptors without tightening legacy static inputs. */
+export function getAwsRoleArn(aws) {
+    if (aws === null || typeof aws !== "object" || Array.isArray(aws)) {
+        return undefined;
+    }
+    const config = aws;
+    if (!("role_arn" in config) || config.role_arn === "") {
+        return undefined;
+    }
+    const roleArn = requireNonEmptyString(config.role_arn, "roleArn");
+    if (Object.keys(config).some((key) => key !== "role_arn")) {
+        throw new Error("AWS role auth must contain only role_arn");
+    }
+    return roleArn;
+}
 /** Reference a LangSmith workspace secret in a sandbox proxy configuration. */
 export function workspaceSecret(name) {
     const normalized = requireNonEmptyString(name, "name");
@@ -75,28 +94,39 @@ export function opaqueSecret(value) {
     };
 }
 /** Build a sandbox proxy config from one or more proxy rules. */
-export function proxyConfig({ rules, noProxy, accessControl, } = {}) {
+export function proxyConfig({ rules, accessControl, } = {}) {
     const config = {
         rules: requireProxyRules(rules),
     };
-    if (noProxy !== undefined) {
-        config.no_proxy = requireNonEmptyStringArray(noProxy, "noProxy");
-    }
     if (accessControl !== undefined) {
         config.access_control = { ...accessControl };
     }
     return config;
 }
-/** Build a sandbox proxy rule that signs AWS HTTPS requests with SigV4. */
-export function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, envVars, }) {
+export function awsAuth({ accessKeyId, secretAccessKey, roleArn, name = "aws", enabled = true, envVars, }) {
+    const candidate = {};
+    if (roleArn !== undefined)
+        candidate.role_arn = roleArn;
+    if (accessKeyId !== undefined)
+        candidate.access_key_id = accessKeyId;
+    if (secretAccessKey !== undefined)
+        candidate.secret_access_key = secretAccessKey;
+    const normalizedRole = getAwsRoleArn(candidate);
+    let aws;
+    if (normalizedRole !== undefined) {
+        aws = { role_arn: normalizedRole };
+    }
+    else {
+        if (accessKeyId === undefined || secretAccessKey === undefined) {
+            throw new Error("AWS auth requires roleArn or both static credentials");
+        }
+        aws = { access_key_id: accessKeyId, secret_access_key: secretAccessKey };
+    }
     const rule = {
         name: requireNonEmptyString(name, "name"),
         type: "aws",
         enabled,
-        aws: {
-            access_key_id: accessKeyId,
-            secret_access_key: secretAccessKey,
-        },
+        aws,
     };
     if (envVars !== undefined) {
         rule.env_vars = requireEnvVars(envVars);