langsmith 0.10.5 → 0.10.7

package/dist/run_trees.js

@@ -4,11 +4,12 @@ import { isConflictingEndpointsError, ConflictingEndpointsError, } from "./utils
 import { _LC_CONTEXT_VARIABLES_KEY, _REPLICA_TRACE_ROOTS_KEY, } from "./singletons/constants.js";
 import { getContextVar, setContextVar } from "./utils/context_vars.js";
 import { getEnvironmentVariable, getRuntimeEnvironment, } from "./utils/env.js";
-import { getDefaultProjectName } from "./utils/project.js";
 import { getLangSmithEnvironmentVariable } from "./utils/env.js";
 import { warnOnce } from "./utils/warn.js";
 import { uuid7FromTime, nonCryptographicUuid7Deterministic, } from "./utils/_uuid.js";
 import { v5 as uuidv5 } from "./utils/uuid/src/index.js";
+import { checkAddress, logUntraced, rejectConflicting, resolveFromEnv, } from "./utils/agent_addressing.js";
+import { EnvAddressError, fromWire, sameAddress, seed as addressSeed, toWire, wireKeys, } from "./address.js";
 const TIMESTAMP_LENGTH = 36;
 // DNS namespace for UUID v5 (same as Python's uuid.NAMESPACE_DNS)
 const UUID_NAMESPACE_DNS = "6ba7b810-9dad-11d1-80b4-00c04fd430c8";
@@ -43,7 +44,31 @@ const HEADER_SAFE_REPLICA_FIELDS = new Set([
     "primary",
     "updates",
     "reroot",
+    ...wireKeys(),
 ]);
+// URL-encoded JSON of the address's wire fields.
+const LANGSMITH_ADDRESS = "langsmith-address";
+/** Pops the address wire keys off untrusted `values`; never throws. */
+function takeHeaderAddress(values) {
+    const wire = {};
+    for (const key of wireKeys()) {
+        if (key in values) {
+            wire[key] = values[key];
+            delete values[key];
+        }
+    }
+    try {
+        return {
+            named: Object.keys(wire).length > 0,
+            address: fromWire(wire),
+        };
+    }
+    catch {
+        // Values are untrusted, so not logged.
+        console.warn("Ignoring an invalid address in a `baggage` header.");
+        return { named: true };
+    }
+}
 function filterReplicaForHeaders(replica) {
     const filtered = {};
     for (const key of Object.keys(replica)) {
@@ -60,7 +85,7 @@ function filterReplicaForHeaders(replica) {
  * Baggage header information
  */
 class Baggage {
-    constructor(metadata, tags, project_name, replicas) {
+    constructor(metadata, tags, project_name, replicas, address) {
         Object.defineProperty(this, "metadata", {
             enumerable: true,
             configurable: true,
@@ -85,10 +110,17 @@ class Baggage {
             writable: true,
             value: void 0
         });
+        Object.defineProperty(this, "address", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         this.metadata = metadata;
         this.tags = tags;
         this.project_name = project_name;
         this.replicas = replicas;
+        this.address = address;
     }
     static fromHeader(value) {
         const items = value.split(",");
@@ -96,6 +128,7 @@ class Baggage {
         let tags = [];
         let project_name;
         let replicas;
+        let address;
         for (const item of items) {
             const [key, uriValue] = item.split("=");
             const value = decodeURIComponent(uriValue);
@@ -108,17 +141,36 @@ class Baggage {
             else if (key === "langsmith-project") {
                 project_name = value;
             }
+            else if (key === LANGSMITH_ADDRESS) {
+                let parsed;
+                try {
+                    parsed = JSON.parse(value);
+                }
+                catch {
+                    parsed = undefined;
+                }
+                if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                    address = takeHeaderAddress({ ...parsed }).address;
+                }
+            }
             else if (key === "langsmith-replicas") {
                 const parsed = JSON.parse(value);
-                replicas = parsed.map((replica) => {
+                replicas = parsed.flatMap((replica) => {
                     if (Array.isArray(replica)) {
-                        return replica;
+                        return [replica];
                     }
-                    return filterReplicaForHeaders(replica);
+                    const filtered = filterReplicaForHeaders(replica);
+                    const { named, address } = takeHeaderAddress(filtered);
+                    // A project wins over an address; a replica with an invalid
+                    // address and no project is dropped.
+                    if (filtered.projectName || !named) {
+                        return [filtered];
+                    }
+                    return address ? [{ ...filtered, address }] : [];
                 });
             }
         }
-        return new Baggage(metadata, tags, project_name, replicas);
+        return new Baggage(metadata, tags, project_name, replicas, address);
     }
     toHeader() {
         const items = [];
@@ -131,6 +183,9 @@ class Baggage {
         if (this.project_name) {
             items.push(`langsmith-project=${encodeURIComponent(this.project_name)}`);
         }
+        if (this.address) {
+            items.push(`${LANGSMITH_ADDRESS}=${encodeURIComponent(JSON.stringify(toWire(this.address)))}`);
+        }
         return items.join(",");
     }
 }
@@ -158,12 +213,20 @@ export class RunTree {
             writable: true,
             value: void 0
         });
+        /** Unset for a run sent to an `address`. */
         Object.defineProperty(this, "project_name", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
+        /** (beta) Set instead of `project_name` for an addressed run. */
+        Object.defineProperty(this, "address", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "parent_run", {
             enumerable: true,
             configurable: true,
@@ -338,6 +401,7 @@ export class RunTree {
             delete config.id;
         }
         Object.assign(this, { ...defaultConfig, ...config, client });
+        this._resolveAddressing(config);
         this.execution_order ??= 1;
         this.child_execution_order ??= 1;
         // Generate serialized start time for ID generation
@@ -368,6 +432,31 @@ export class RunTree {
             }
         }
     }
+    /** Falls back to the env; a bad env leaves the run untraced. */
+    _resolveAddressing(config) {
+        const address = checkAddress(config.address);
+        const project = config.project_name || undefined;
+        rejectConflicting(project, address);
+        if (project || address) {
+            this.project_name = project;
+            this.address = address;
+            return;
+        }
+        try {
+            [this.project_name, this.address] = resolveFromEnv();
+        }
+        catch (e) {
+            if (!(e instanceof EnvAddressError)) {
+                throw e;
+            }
+            if (isEnvTracingEnabled(this.tracingEnabled)) {
+                logUntraced(e);
+            }
+            this.project_name = undefined;
+            this.address = undefined;
+            this.tracingEnabled = false;
+        }
+    }
     set metadata(metadata) {
         this.extra = {
             ...this.extra,
@@ -384,7 +473,6 @@ export class RunTree {
         const start_time = Date.now();
         return {
             run_type: "chain",
-            project_name: getDefaultProjectName(),
             child_runs: [],
             api_url: getEnvironmentVariable("LANGCHAIN_ENDPOINT") ?? "http://localhost:1984",
             api_key: getEnvironmentVariable("LANGCHAIN_API_KEY"),
@@ -414,6 +502,7 @@ export class RunTree {
             ...config,
             parent_run: this,
             project_name: this.project_name,
+            address: this.address,
             replicas: childReplicas,
             client: this.client,
             tracingEnabled: this.tracingEnabled,
@@ -512,6 +601,7 @@ export class RunTree {
             inputs: run.inputs,
             outputs: run.outputs,
             session_name: run.project_name,
+            address: run.address,
             child_runs: child_runs,
             parent_run_id: parent_run_id,
             trace_id: run.trace_id,
@@ -568,16 +658,33 @@ export class RunTree {
             child._setReplicaTraceRoot(replicaKey, traceRootId);
         }
     }
+    /** A replica naming neither inherits the run tree's destination. */
+    _replicaAddressing(replica) {
+        const address = checkAddress(replica.address);
+        if (replica.projectName != null) {
+            rejectConflicting(replica.projectName, address);
+            return [replica.projectName, undefined];
+        }
+        if (address) {
+            return [undefined, address];
+        }
+        return [this.project_name, this.address];
+    }
     _remapForProject(params) {
-        const { projectName, primary, runtimeEnv, excludeChildRuns = true, reroot = false, distributedParentId, apiUrl, apiKey, workspaceId, } = params;
+        const { projectName, address, primary, runtimeEnv, excludeChildRuns = true, reroot = false, distributedParentId, apiUrl, apiKey, workspaceId, } = params;
         const baseRun = this._convertToCreate(this, runtimeEnv, excludeChildRuns);
-        // Preserve legacy behavior when `primary` is omitted.
-        if (primary === undefined && projectName === this.project_name) {
+        // Preserve legacy behavior when `primary` is omitted, unless another replica is primary.
+        if (primary === undefined &&
+            !this.replicas?.some((r) => r.primary === true) &&
+            projectName === this.project_name &&
+            sameAddress(address, this.address)) {
             return {
                 ...baseRun,
                 session_name: projectName,
+                address,
             };
         }
+        const seed = projectName ?? (address ? addressSeed(address) : undefined) ?? "agent//";
         // Apply reroot logic before ID remapping
         if (reroot) {
             if (distributedParentId) {
@@ -601,7 +708,7 @@ export class RunTree {
             // Store this run's original ID in context vars so descendants know the new trace root
             // We store the original ID (before remapping) so it can be found in dotted_order
             const replicaKey = getReplicaKey({
-                projectName,
+                projectName: seed,
                 apiUrl,
                 apiKey,
                 workspaceId,
@@ -614,7 +721,7 @@ export class RunTree {
         if (!reroot) {
             const replicaTraceRoots = getContextVar(this, _REPLICA_TRACE_ROOTS_KEY) ?? {};
             const replicaKey = getReplicaKey({
-                projectName,
+                projectName: seed,
                 apiUrl,
                 apiKey,
                 workspaceId,
@@ -649,17 +756,18 @@ export class RunTree {
             return {
                 ...baseRun,
                 session_name: projectName,
+                address,
             };
         }
         // Remap IDs for the replica using nonCryptographicUuid7Deterministic
         // This ensures consistency across runs in the same replica while
         // preserving UUID7 properties (time-ordering, monotonicity)
         const oldId = baseRun.id;
-        const newId = nonCryptographicUuid7Deterministic(oldId, projectName);
+        const newId = nonCryptographicUuid7Deterministic(oldId, seed);
         // Remap trace_id
         let newTraceId;
         if (baseRun.trace_id) {
-            newTraceId = nonCryptographicUuid7Deterministic(baseRun.trace_id, projectName);
+            newTraceId = nonCryptographicUuid7Deterministic(baseRun.trace_id, seed);
         }
         else {
             newTraceId = newId;
@@ -667,7 +775,7 @@ export class RunTree {
         // Remap parent_run_id
         let newParentId;
         if (baseRun.parent_run_id) {
-            newParentId = nonCryptographicUuid7Deterministic(baseRun.parent_run_id, projectName);
+            newParentId = nonCryptographicUuid7Deterministic(baseRun.parent_run_id, seed);
         }
         // Remap dotted_order segments
         let newDottedOrder;
@@ -676,7 +784,7 @@ export class RunTree {
             const remappedSegs = segs.map((seg) => {
                 // Extract the UUID from the segment (last TIMESTAMP_LENGTH characters)
                 const segId = seg.slice(-TIMESTAMP_LENGTH);
-                const remappedId = nonCryptographicUuid7Deterministic(segId, projectName);
+                const remappedId = nonCryptographicUuid7Deterministic(segId, seed);
                 // Replace the UUID part while keeping the timestamp prefix
                 return seg.slice(0, -TIMESTAMP_LENGTH) + remappedId;
             });
@@ -689,6 +797,7 @@ export class RunTree {
             parent_run_id: newParentId,
             dotted_order: newDottedOrder,
             session_name: projectName,
+            address,
         };
     }
     async postRun(excludeChildRuns = true) {
@@ -699,9 +808,12 @@ export class RunTree {
         try {
             const runtimeEnv = getRuntimeEnvironment();
             if (this.replicas && this.replicas.length > 0) {
-                for (const { projectName, primary, apiKey, apiUrl, workspaceId, reroot, client: replicaClient, } of this.replicas) {
+                for (const replica of this.replicas) {
+                    const { primary, apiKey, apiUrl, workspaceId, reroot, client: replicaClient, } = replica;
+                    const [projectName, address] = this._replicaAddressing(replica);
                     const runCreate = this._remapForProject({
-                        projectName: projectName ?? this.project_name,
+                        projectName,
+                        address,
                         primary,
                         runtimeEnv,
                         excludeChildRuns: true,
@@ -750,9 +862,12 @@ export class RunTree {
     async patchRun(options) {
         const excludeInputs = options?.excludeInputs ?? getExcludeInputsOnPatch();
         if (this.replicas && this.replicas.length > 0) {
-            for (const { projectName, primary, apiKey, apiUrl, workspaceId, updates, reroot, client: replicaClient, } of this.replicas) {
+            for (const replica of this.replicas) {
+                const { primary, apiKey, apiUrl, workspaceId, updates, reroot, client: replicaClient, } = replica;
+                const [projectName, address] = this._replicaAddressing(replica);
                 const runData = this._remapForProject({
-                    projectName: projectName ?? this.project_name,
+                    projectName,
+                    address,
                     primary,
                     runtimeEnv: undefined,
                     excludeChildRuns: true,
@@ -771,6 +886,7 @@ export class RunTree {
                     error: runData.error,
                     parent_run_id: runData.parent_run_id,
                     session_name: runData.session_name,
+                    address: runData.address,
                     reference_example_id: runData.reference_example_id,
                     end_time: runData.end_time,
                     dotted_order: runData.dotted_order,
@@ -813,6 +929,7 @@ export class RunTree {
                     tags: this.tags,
                     attachments: this.attachments,
                     session_name: this.project_name,
+                    address: this.address,
                 };
                 // Important that inputs is not a key in the run update
                 // if excluded because it will overwrite the run create if the
@@ -873,7 +990,7 @@ export class RunTree {
                 ...props,
                 client,
                 tracingEnabled,
-                project_name: projectName,
+                project_name: props.address ? undefined : projectName,
             });
         }
         const parentRunTree = new RunTree({
@@ -928,7 +1045,19 @@ export class RunTree {
             const baggage = Baggage.fromHeader(rawHeaders["baggage"]);
             config.metadata = baggage.metadata;
             config.tags = baggage.tags;
-            config.project_name = baggage.project_name;
+            if (baggage.project_name && baggage.address) {
+                console.warn("Ignoring a `baggage` header that names both a project and an address.");
+                return undefined;
+            }
+            // The header's destination outranks the caller's.
+            if (baggage.project_name) {
+                config.project_name = baggage.project_name;
+                delete config.address;
+            }
+            else if (baggage.address) {
+                config.address = baggage.address;
+                delete config.project_name;
+            }
             config.replicas = baggage.replicas;
         }
         const runTree = new RunTree(config);
@@ -939,7 +1068,7 @@ export class RunTree {
     toHeaders(headers) {
         const result = {
             "langsmith-trace": this.dotted_order,
-            baggage: new Baggage(this.extra?.metadata, this.tags, this.project_name, this.replicas).toHeader(),
+            baggage: new Baggage(this.extra?.metadata, this.tags, this.project_name, this.replicas, this.address).toHeader(),
         };
         if (headers) {
             for (const [key, value] of Object.entries(result)) {
@@ -1075,7 +1204,8 @@ function _ensureWriteReplicas(replicas) {
                     updates: replica[1],
                 };
             }
-            return replica;
+            const address = checkAddress(replica.address);
+            return address ? { ...replica, address } : replica;
         })
         : _getWriteReplicasFromEnv();
     if (ensured.filter((replica) => replica.primary === true).length > 1) {

package/dist/sandbox/errors.cjs

@@ -7,7 +7,7 @@
  * properties for specific handling when needed.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LangSmithSandboxServerReloadError = exports.LangSmithSandboxConnectTimeoutError = exports.LangSmithStreamEndedBeforeStartedError = exports.LangSmithCommandTimeoutError = exports.LangSmithSandboxOperationError = exports.LangSmithSandboxNotReadyError = exports.LangSmithDataplaneNotConfiguredError = exports.LangSmithSandboxCreationError = exports.LangSmithResourceCreationError = exports.LangSmithQuotaExceededError = exports.LangSmithValidationError = exports.LangSmithResourceNameConflictError = exports.LangSmithResourceAlreadyExistsError = exports.LangSmithResourceInUseError = exports.LangSmithResourceTimeoutError = exports.LangSmithResourceNotFoundError = exports.LangSmithSandboxRetryableConnectionError = exports.LangSmithSandboxConnectionError = exports.LangSmithSandboxAuthenticationError = exports.LangSmithSandboxAPIError = exports.LangSmithSandboxError = void 0;
+exports.LangSmithSandboxTokenVerificationError = exports.LangSmithSandboxServerReloadError = exports.LangSmithSandboxConnectTimeoutError = exports.LangSmithStreamEndedBeforeStartedError = exports.LangSmithCommandTimeoutError = exports.LangSmithSandboxOperationError = exports.LangSmithSandboxNotReadyError = exports.LangSmithDataplaneNotConfiguredError = exports.LangSmithSandboxCreationError = exports.LangSmithResourceCreationError = exports.LangSmithQuotaExceededError = exports.LangSmithValidationError = exports.LangSmithResourceNameConflictError = exports.LangSmithResourceAlreadyExistsError = exports.LangSmithResourceInUseError = exports.LangSmithResourceTimeoutError = exports.LangSmithResourceNotFoundError = exports.LangSmithSandboxRetryableConnectionError = exports.LangSmithSandboxConnectionError = exports.LangSmithSandboxAuthenticationError = exports.LangSmithSandboxAPIError = exports.LangSmithSandboxError = void 0;
 /**
  * Base exception for sandbox client errors.
  */
@@ -417,3 +417,14 @@ class LangSmithSandboxServerReloadError extends LangSmithSandboxConnectionError
     }
 }
 exports.LangSmithSandboxServerReloadError = LangSmithSandboxServerReloadError;
+/**
+ * Raised when a sandbox user token or proxy callback signature fails
+ * verification.
+ */
+class LangSmithSandboxTokenVerificationError extends LangSmithSandboxError {
+    constructor(message) {
+        super(message);
+        this.name = "LangSmithSandboxTokenVerificationError";
+    }
+}
+exports.LangSmithSandboxTokenVerificationError = LangSmithSandboxTokenVerificationError;

package/dist/sandbox/errors.d.ts

@@ -192,3 +192,10 @@ export declare class LangSmithSandboxConnectTimeoutError extends LangSmithSandbo
 export declare class LangSmithSandboxServerReloadError extends LangSmithSandboxConnectionError {
     constructor(message: string);
 }
+/**
+ * Raised when a sandbox user token or proxy callback signature fails
+ * verification.
+ */
+export declare class LangSmithSandboxTokenVerificationError extends LangSmithSandboxError {
+    constructor(message: string);
+}

package/dist/sandbox/errors.js

@@ -393,3 +393,13 @@ export class LangSmithSandboxServerReloadError extends LangSmithSandboxConnectio
         this.name = "LangSmithSandboxServerReloadError";
     }
 }
+/**
+ * Raised when a sandbox user token or proxy callback signature fails
+ * verification.
+ */
+export class LangSmithSandboxTokenVerificationError extends LangSmithSandboxError {
+    constructor(message) {
+        super(message);
+        this.name = "LangSmithSandboxTokenVerificationError";
+    }
+}

package/dist/sandbox/index.cjs

@@ -29,7 +29,7 @@
  * @packageDocumentation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LangSmithDataplaneNotConfiguredError = exports.LangSmithCommandTimeoutError = exports.LangSmithSandboxOperationError = exports.LangSmithSandboxNotReadyError = exports.LangSmithSandboxCreationError = exports.LangSmithResourceCreationError = exports.LangSmithQuotaExceededError = exports.LangSmithValidationError = exports.LangSmithResourceNameConflictError = exports.LangSmithResourceAlreadyExistsError = exports.LangSmithResourceInUseError = exports.LangSmithResourceTimeoutError = exports.LangSmithResourceNotFoundError = exports.LangSmithSandboxServerReloadError = exports.LangSmithSandboxConnectTimeoutError = exports.LangSmithSandboxRetryableConnectionError = exports.LangSmithSandboxConnectionError = exports.LangSmithSandboxAuthenticationError = exports.LangSmithSandboxAPIError = exports.LangSmithSandboxError = exports.s3Mount = exports.mountConfig = exports.gitMount = exports.gcsMount = exports.contextHubMount = exports.SERVICE_TOKEN_HEADER = exports.ServiceLoginUrl = exports.ServiceUrl = exports.validateAccessDelegation = exports.workspaceSecret = exports.proxyConfig = exports.opaqueSecret = exports.gcpAuth = exports.awsAuth = exports.CommandHandle = exports.Sandbox = exports.SandboxClient = void 0;
+exports.LangSmithSandboxTokenVerificationError = exports.LangSmithDataplaneNotConfiguredError = exports.LangSmithCommandTimeoutError = exports.LangSmithSandboxOperationError = exports.LangSmithSandboxNotReadyError = exports.LangSmithSandboxCreationError = exports.LangSmithResourceCreationError = exports.LangSmithQuotaExceededError = exports.LangSmithValidationError = exports.LangSmithResourceNameConflictError = exports.LangSmithResourceAlreadyExistsError = exports.LangSmithResourceInUseError = exports.LangSmithResourceTimeoutError = exports.LangSmithResourceNotFoundError = exports.LangSmithSandboxServerReloadError = exports.LangSmithSandboxConnectTimeoutError = exports.LangSmithSandboxRetryableConnectionError = exports.LangSmithSandboxConnectionError = exports.LangSmithSandboxAuthenticationError = exports.LangSmithSandboxAPIError = exports.LangSmithSandboxError = exports.s3Mount = exports.mountConfig = exports.gitMount = exports.gcsMount = exports.contextHubMount = exports.CALLBACK_SIGNATURE_HEADER = exports.USER_TOKEN_HEADER = exports.SandboxTokenVerifier = exports.SERVICE_TOKEN_HEADER = exports.ServiceLoginUrl = exports.ServiceUrl = exports.validateAccessDelegation = exports.workspaceSecret = exports.proxyConfig = exports.opaqueSecret = exports.gcpAuth = exports.awsAuth = exports.CommandHandle = exports.Sandbox = exports.SandboxClient = void 0;
 // Main classes
 var client_js_1 = require("./client.cjs");
 Object.defineProperty(exports, "SandboxClient", { enumerable: true, get: function () { return client_js_1.SandboxClient; } });
@@ -49,6 +49,10 @@ var service_url_js_1 = require("./service_url.cjs");
 Object.defineProperty(exports, "ServiceUrl", { enumerable: true, get: function () { return service_url_js_1.ServiceUrl; } });
 Object.defineProperty(exports, "ServiceLoginUrl", { enumerable: true, get: function () { return service_url_js_1.ServiceLoginUrl; } });
 Object.defineProperty(exports, "SERVICE_TOKEN_HEADER", { enumerable: true, get: function () { return service_url_js_1.SERVICE_TOKEN_HEADER; } });
+var verify_js_1 = require("./verify.cjs");
+Object.defineProperty(exports, "SandboxTokenVerifier", { enumerable: true, get: function () { return verify_js_1.SandboxTokenVerifier; } });
+Object.defineProperty(exports, "USER_TOKEN_HEADER", { enumerable: true, get: function () { return verify_js_1.USER_TOKEN_HEADER; } });
+Object.defineProperty(exports, "CALLBACK_SIGNATURE_HEADER", { enumerable: true, get: function () { return verify_js_1.CALLBACK_SIGNATURE_HEADER; } });
 var mounts_js_1 = require("./mounts.cjs");
 Object.defineProperty(exports, "contextHubMount", { enumerable: true, get: function () { return mounts_js_1.contextHubMount; } });
 Object.defineProperty(exports, "gcsMount", { enumerable: true, get: function () { return mounts_js_1.gcsMount; } });
@@ -82,3 +86,4 @@ Object.defineProperty(exports, "LangSmithSandboxNotReadyError", { enumerable: tr
 Object.defineProperty(exports, "LangSmithSandboxOperationError", { enumerable: true, get: function () { return errors_js_1.LangSmithSandboxOperationError; } });
 Object.defineProperty(exports, "LangSmithCommandTimeoutError", { enumerable: true, get: function () { return errors_js_1.LangSmithCommandTimeoutError; } });
 Object.defineProperty(exports, "LangSmithDataplaneNotConfiguredError", { enumerable: true, get: function () { return errors_js_1.LangSmithDataplaneNotConfiguredError; } });
+Object.defineProperty(exports, "LangSmithSandboxTokenVerificationError", { enumerable: true, get: function () { return errors_js_1.LangSmithSandboxTokenVerificationError; } });

package/dist/sandbox/index.d.ts

@@ -33,8 +33,10 @@ export { CommandHandle } from "./command_handle.js";
 export { awsAuth, gcpAuth, opaqueSecret, proxyConfig, workspaceSecret, } from "./proxy_config.js";
 export { validateAccessDelegation } from "./access_delegation.js";
 export { ServiceUrl, ServiceLoginUrl, SERVICE_TOKEN_HEADER, } from "./service_url.js";
+export { SandboxTokenVerifier, USER_TOKEN_HEADER, CALLBACK_SIGNATURE_HEADER, } from "./verify.js";
+export type { AudienceMatcher, SandboxCallback, SandboxCallbackIdentity, SandboxCallbackRequest, SandboxTokenVerifierConfig, SandboxUser, VerifyCallbackOptions, VerifyUserTokenOptions, } from "./verify.js";
 export { contextHubMount, gcsMount, gitMount, mountConfig, s3Mount, } from "./mounts.js";
 export type { AccessDelegation, AccessDelegationMode, } from "./access_delegation.js";
 export type { ServiceAccess, ServiceUrlData } from "./service_url.js";
 export type { ExecutionResult, FileChunk, FileInfo, FileStat, GlobOptions, GlobResult, GrepMatch, GrepOptions, GrepResult, ReadRangeOptions, RunConfig, OutputChunk, WsMessage, WsRunOptions, ResourceStatus, Snapshot, SandboxData, SandboxClientConfig, RunOptions, CreateSandboxOptions, SandboxAccessControl, SandboxAwsAuthRule, SandboxAwsMountAuthConfig, SandboxGcpAuthRule, SandboxGcpMountAuthConfig, SandboxMountAuth, SandboxMountAuthConfig, SandboxMountConfig, SandboxProxyConfig, SandboxProxyRule, SandboxProxySecret, SandboxMount, MountCacheConfig, ContextHubMountConfig, ContextHubMountSpec, GCSMountConfig, GCSMountSpec, GitMountConfig, GitMountRefSpec, GitMountSpec, S3MountConfig, S3MountSpec, CreateSnapshotOptions, CreateDockerfileSnapshotOptions, CaptureSnapshotOptions, DownloadContentDisposition, DownloadURL, GenerateDownloadURLOptions, ListSnapshotsOptions, WaitForSnapshotOptions, StartSandboxOptions, UpdateSandboxOptions, WaitForSandboxOptions, } from "./types.js";
-export { LangSmithSandboxError, LangSmithSandboxAPIError, LangSmithSandboxAuthenticationError, LangSmithSandboxConnectionError, LangSmithSandboxRetryableConnectionError, LangSmithSandboxConnectTimeoutError, LangSmithSandboxServerReloadError, LangSmithResourceNotFoundError, LangSmithResourceTimeoutError, LangSmithResourceInUseError, LangSmithResourceAlreadyExistsError, LangSmithResourceNameConflictError, LangSmithValidationError, LangSmithQuotaExceededError, LangSmithResourceCreationError, LangSmithSandboxCreationError, LangSmithSandboxNotReadyError, LangSmithSandboxOperationError, LangSmithCommandTimeoutError, LangSmithDataplaneNotConfiguredError, } from "./errors.js";
+export { LangSmithSandboxError, LangSmithSandboxAPIError, LangSmithSandboxAuthenticationError, LangSmithSandboxConnectionError, LangSmithSandboxRetryableConnectionError, LangSmithSandboxConnectTimeoutError, LangSmithSandboxServerReloadError, LangSmithResourceNotFoundError, LangSmithResourceTimeoutError, LangSmithResourceInUseError, LangSmithResourceAlreadyExistsError, LangSmithResourceNameConflictError, LangSmithValidationError, LangSmithQuotaExceededError, LangSmithResourceCreationError, LangSmithSandboxCreationError, LangSmithSandboxNotReadyError, LangSmithSandboxOperationError, LangSmithCommandTimeoutError, LangSmithDataplaneNotConfiguredError, LangSmithSandboxTokenVerificationError, } from "./errors.js";

package/dist/sandbox/index.js

@@ -34,6 +34,7 @@ export { CommandHandle } from "./command_handle.js";
 export { awsAuth, gcpAuth, opaqueSecret, proxyConfig, workspaceSecret, } from "./proxy_config.js";
 export { validateAccessDelegation } from "./access_delegation.js";
 export { ServiceUrl, ServiceLoginUrl, SERVICE_TOKEN_HEADER, } from "./service_url.js";
+export { SandboxTokenVerifier, USER_TOKEN_HEADER, CALLBACK_SIGNATURE_HEADER, } from "./verify.js";
 export { contextHubMount, gcsMount, gitMount, mountConfig, s3Mount, } from "./mounts.js";
 // Errors
 export { 
@@ -46,4 +47,4 @@ LangSmithValidationError, LangSmithQuotaExceededError,
 // Resource creation errors
 LangSmithResourceCreationError, 
 // Sandbox-specific errors
-LangSmithSandboxCreationError, LangSmithSandboxNotReadyError, LangSmithSandboxOperationError, LangSmithCommandTimeoutError, LangSmithDataplaneNotConfiguredError, } from "./errors.js";
+LangSmithSandboxCreationError, LangSmithSandboxNotReadyError, LangSmithSandboxOperationError, LangSmithCommandTimeoutError, LangSmithDataplaneNotConfiguredError, LangSmithSandboxTokenVerificationError, } from "./errors.js";