langsmith 0.10.7 → 0.10.9

package/dist/_openapi_client/resources/sandboxes/boxes.d.ts

@@ -2,7 +2,7 @@ import { APIResource } from '../../core/resource.js';
 import * as SandboxesAPI from './sandboxes.js';
 import { SandboxResponsesItemsCursorGetPagination } from './sandboxes.js';
 import { APIPromise } from '../../core/api-promise.js';
-import { type ItemsCursorGetPaginationParams, PagePromise } from '../../core/pagination.js';
+import { ItemsCursorGetPagination, type ItemsCursorGetPaginationParams, PagePromise } from '../../core/pagination.js';
 import { RequestOptions } from '../../internal/request-options.js';
 export declare class Boxes extends APIResource {
     /**
@@ -40,26 +40,57 @@ export declare class Boxes extends APIResource {
      * existing checkpoint.
      */
     createSnapshot(name: string, body: BoxCreateSnapshotParams, options?: RequestOptions): APIPromise<SandboxesAPI.SnapshotResponse>;
+    /**
+     * Removes the sharing grant for one port, or for every port when port is omitted.
+     * A LangSmith login URL stops working immediately. A previously minted service
+     * token is not revoked and stays valid until it expires, but no new one can be
+     * issued from the removed grant.
+     */
+    deleteServiceURL(name: string, params?: BoxDeleteServiceURLParams | null | undefined, options?: RequestOptions): APIPromise<void>;
     /**
      * Generate a tokenized link that downloads a single file from a sandbox with no
      * further authentication. This mints a token rather than creating an addressable
      * resource, so it returns 200 with no Location header. The token pins the sandbox,
-     * the file path, and the response content type and disposition, so a link cannot
-     * be repointed at another file. Links never expire unless expires_in_seconds is
-     * set. The link is served from the sandbox service domain, not the API host.
+     * the file path, the response content type and disposition, and the sandbox flags,
+     * so a link cannot be repointed at another file or served under a weaker policy.
+     * The file is always served with a Content-Security-Policy: a sandbox directive,
+     * plus a default-src holding every fetch to the file's own download host and a set
+     * of pre-approved third-party origins. csp_sandbox_flags may loosen the sandbox
+     * with allow-downloads, allow-forms, allow-modals, allow-orientation-lock,
+     * allow-pointer-lock, allow-popups, allow-presentation, allow-same-origin,
+     * allow-scripts, or allow-top-navigation-by-user-activation. Every file is served
+     * from its own host, derived from the sandbox and the path, so allow-same-origin
+     * gives a page localStorage and IndexedDB that no other file can read, and
+     * re-minting a link for the same file keeps them. csp_sandbox set to false drops
+     * the sandbox directive altogether, and csp_sandbox_flags must then be omitted.
+     * csp_source_bundles selects the third-party origins: cdnjs, google-fonts,
+     * jsdelivr, and unpkg are all allowed when the field is omitted, 'none' holds the
+     * file to its own host, and 'any' sends no default-src at all. Links never expire
+     * unless expires_in_seconds is set. The link is served from the sandbox service
+     * domain, not the API host.
      */
     generateDownloadURL(name: string, body: BoxGenerateDownloadURLParams, options?: RequestOptions): APIPromise<SandboxesAPI.DownloadURLResponse>;
     /**
      * Create a short-lived JWT for accessing an HTTP service running on a specific
      * port inside a sandbox. Returns a browser_url (sets auth cookie via redirect), a
      * service_url (for use with the X-Langsmith-Sandbox-Service-Token header), the raw
-     * token, and its expiry.
+     * token, and its expiry. Set access=restricted|workspace to instead enable durable
+     * LangSmith login (no token; users authenticate with their normal LangSmith
+     * session), or access=off to disable it. LangSmith login and token access are
+     * mutually exclusive per service URL.
      */
     generateServiceURL(name: string, body: BoxGenerateServiceURLParams, options?: RequestOptions): APIPromise<SandboxesAPI.ServiceURLResponse>;
     /**
      * Retrieve the lightweight status of a sandbox for polling.
      */
     getStatus(name: string, options?: RequestOptions): APIPromise<SandboxesAPI.SandboxStatusResponse>;
+    /**
+     * Returns one entry per port the sandbox is currently reachable on, so a caller
+     * can see what is shared before turning it off. Expired token grants are omitted.
+     * Cursors are opaque and only valid on this endpoint; do not parse or construct
+     * one.
+     */
+    listServiceURLs(name: string, query?: BoxListServiceURLsParams | null | undefined, options?: RequestOptions): PagePromise<BoxListServiceURLsResponsesItemsCursorGetPagination, BoxListServiceURLsResponse>;
     /**
      * Start a stopped or failed sandbox. This endpoint is not idempotent.
      */
@@ -70,7 +101,30 @@ export declare class Boxes extends APIResource {
      */
     stop(name: string, options?: RequestOptions): APIPromise<void>;
 }
+export type BoxListServiceURLsResponsesItemsCursorGetPagination = ItemsCursorGetPagination<BoxListServiceURLsResponse>;
+export interface BoxListServiceURLsResponse {
+    /**
+     * How the port is shared: "token" for a minted service token, or
+     * "restricted"/"workspace" for LangSmith login.
+     */
+    access: 'token' | 'restricted' | 'workspace';
+    created_at: string;
+    port: number;
+    /**
+     * The LangSmith user who first shared this port, when known.
+     */
+    created_by?: string;
+    /**
+     * When the share expires. Set only for "token"; a login grant does not expire.
+     */
+    expires_at?: string;
+}
 export interface BoxCreateParams {
+    /**
+     * AccessDelegation lets code inside the sandbox call the LangSmith API as you,
+     * with at most the permissions granted here. Omit for no access.
+     */
+    access_delegation?: BoxCreateParams.AccessDelegation;
     /**
      * CPUMillicores optionally requests CPU at millicore granularity (e.g. 500 = 0.5
      * vCPU); takes precedence over VCPUs. Fractional (sub-vCPU) values are not
@@ -118,6 +172,12 @@ export interface BoxCreateParams {
      * Applies to this request only.
      */
     restore_memory?: boolean;
+    /**
+     * RunConfig overrides the snapshot's run config for this sandbox: user and
+     * work_dir replace the snapshot's, env_vars merge over it. The result is what the
+     * sandbox boots with, and what a snapshot captured from it carries.
+     */
+    run_config?: BoxCreateParams.RunConfig;
     /**
      * Snapshot is a Docker-style name or name:tag reference to boot from. A bare name
      * resolves to name:latest.
@@ -133,21 +193,41 @@ export interface BoxCreateParams {
     vcpus?: number;
 }
 export declare namespace BoxCreateParams {
+    /**
+     * AccessDelegation lets code inside the sandbox call the LangSmith API as you,
+     * with at most the permissions granted here. Omit for no access.
+     */
+    interface AccessDelegation {
+        mode: 'INHERIT' | 'EXPLICIT';
+        permissions?: Array<string>;
+    }
     interface MountConfig {
         auth?: MountConfig.Auth;
         mounts?: Array<MountConfig.SandboxapiS3BucketMountSpec | MountConfig.SandboxapiGcsBucketMountSpec | MountConfig.SandboxapiGitRepoMountSpec | MountConfig.SandboxapiContextHubRepoMountSpec>;
     }
     namespace MountConfig {
         interface Auth {
-            aws?: Auth.Aws;
+            aws?: Auth.SandboxesSandboxAwsMountRoleAuthConfig | Auth.SandboxesSandboxAwsMountStaticAuthConfig;
             gcp?: Auth.Gcp;
         }
         namespace Auth {
-            interface Aws {
-                access_key_id: Aws.AccessKeyID;
-                secret_access_key: Aws.SecretAccessKey;
+            interface SandboxesSandboxAwsMountRoleAuthConfig {
+                /**
+                 * IAM role to assume with permissions scoped to the configured S3 mounts. Mutually
+                 * exclusive with static credentials. Configure only at creation.
+                 */
+                role_arn: string;
             }
-            namespace Aws {
+            interface SandboxesSandboxAwsMountStaticAuthConfig {
+                access_key_id: SandboxesSandboxAwsMountStaticAuthConfig.AccessKeyID;
+                secret_access_key: SandboxesSandboxAwsMountStaticAuthConfig.SecretAccessKey;
+                /**
+                 * IAM role to assume with permissions scoped to the configured S3 mounts. Mutually
+                 * exclusive with static credentials. Configure only at creation.
+                 */
+                role_arn?: '';
+            }
+            namespace SandboxesSandboxAwsMountStaticAuthConfig {
                 interface AccessKeyID {
                     type: 'plaintext' | 'opaque' | 'workspace_secret';
                     is_set?: boolean;
@@ -382,6 +462,11 @@ export declare namespace BoxCreateParams {
     interface ProxyConfig {
         access_control?: ProxyConfig.AccessControl;
         callbacks?: Array<ProxyConfig.Callback>;
+        /**
+         * Description says what this configuration as a whole lets the sandbox reach,
+         * complementing the per-rule descriptions. At most 1024 characters.
+         */
+        description?: string;
         no_proxy?: Array<string>;
         rules?: Array<ProxyConfig.Rule>;
     }
@@ -407,7 +492,12 @@ export declare namespace BoxCreateParams {
         }
         interface Rule {
             name: string;
-            aws?: Rule.Aws;
+            aws?: Rule.SandboxesProxyAwsRoleConfig | Rule.SandboxesProxyAwsStaticConfig;
+            /**
+             * Description says what this rule lets the sandbox reach, so an agent driving the
+             * sandbox can be told its capabilities. At most 1024 characters.
+             */
+            description?: string;
             enabled?: boolean;
             /**
              * EnvVars are plaintext env vars set for every command in the sandbox while this
@@ -422,6 +512,14 @@ export declare namespace BoxCreateParams {
             };
             gcp?: Rule.Gcp;
             headers?: Array<Rule.Header>;
+            /**
+             * MatchHeaders restricts a header injection rule to requests carrying every listed
+             * header, each written "name: value" with a lowercase name and an exact value.
+             * Pair with headers of the same name to swap a placeholder the sandbox sends (e.g.
+             * "authorization: Bearer account-b") for a real credential, so one host can serve
+             * several accounts. Rules are evaluated in order and the first match wins.
+             */
+            match_headers?: Array<string>;
             /**
              * MatchHosts is only accepted for header injection rules. Provider auth rules use
              * built-in host matching.
@@ -431,11 +529,25 @@ export declare namespace BoxCreateParams {
             type?: string;
         }
         namespace Rule {
-            interface Aws {
-                access_key_id: Aws.AccessKeyID;
-                secret_access_key: Aws.SecretAccessKey;
+            interface SandboxesProxyAwsRoleConfig {
+                /**
+                 * RoleARN selects automatically renewed IAM-role credentials instead of static
+                 * keys. Access follows the role's effective AWS permissions, not the sandbox's
+                 * mount scope. Configure at creation; the role cannot be changed afterward.
+                 */
+                role_arn: string;
             }
-            namespace Aws {
+            interface SandboxesProxyAwsStaticConfig {
+                access_key_id: SandboxesProxyAwsStaticConfig.AccessKeyID;
+                secret_access_key: SandboxesProxyAwsStaticConfig.SecretAccessKey;
+                /**
+                 * RoleARN selects automatically renewed IAM-role credentials instead of static
+                 * keys. Access follows the role's effective AWS permissions, not the sandbox's
+                 * mount scope. Configure at creation; the role cannot be changed afterward.
+                 */
+                role_arn?: '';
+            }
+            namespace SandboxesProxyAwsStaticConfig {
                 interface AccessKeyID {
                     type: 'plaintext' | 'opaque' | 'workspace_secret';
                     is_set?: boolean;
@@ -466,6 +578,18 @@ export declare namespace BoxCreateParams {
             }
         }
     }
+    /**
+     * RunConfig overrides the snapshot's run config for this sandbox: user and
+     * work_dir replace the snapshot's, env_vars merge over it. The result is what the
+     * sandbox boots with, and what a snapshot captured from it carries.
+     */
+    interface RunConfig {
+        env_vars?: {
+            [key: string]: string;
+        };
+        user?: string;
+        work_dir?: string;
+    }
 }
 export interface BoxUpdateParams {
     cpu_millicores?: number;
@@ -479,6 +603,12 @@ export interface BoxUpdateParams {
     mem_bytes?: number;
     name?: string;
     proxy_config?: BoxUpdateParams.ProxyConfig;
+    /**
+     * RunConfig changes what subsequent commands run with: user and work_dir replace
+     * the current values, env_vars merge over them. Commands already running are
+     * unaffected.
+     */
+    run_config?: BoxUpdateParams.RunConfig;
     tag_value_ids?: Array<string>;
     vcpus?: number;
 }
@@ -486,6 +616,11 @@ export declare namespace BoxUpdateParams {
     interface ProxyConfig {
         access_control?: ProxyConfig.AccessControl;
         callbacks?: Array<ProxyConfig.Callback>;
+        /**
+         * Description says what this configuration as a whole lets the sandbox reach,
+         * complementing the per-rule descriptions. At most 1024 characters.
+         */
+        description?: string;
         no_proxy?: Array<string>;
         rules?: Array<ProxyConfig.Rule>;
     }
@@ -511,7 +646,12 @@ export declare namespace BoxUpdateParams {
         }
         interface Rule {
             name: string;
-            aws?: Rule.Aws;
+            aws?: Rule.SandboxesProxyAwsRoleConfig | Rule.SandboxesProxyAwsStaticConfig;
+            /**
+             * Description says what this rule lets the sandbox reach, so an agent driving the
+             * sandbox can be told its capabilities. At most 1024 characters.
+             */
+            description?: string;
             enabled?: boolean;
             /**
              * EnvVars are plaintext env vars set for every command in the sandbox while this
@@ -526,6 +666,14 @@ export declare namespace BoxUpdateParams {
             };
             gcp?: Rule.Gcp;
             headers?: Array<Rule.Header>;
+            /**
+             * MatchHeaders restricts a header injection rule to requests carrying every listed
+             * header, each written "name: value" with a lowercase name and an exact value.
+             * Pair with headers of the same name to swap a placeholder the sandbox sends (e.g.
+             * "authorization: Bearer account-b") for a real credential, so one host can serve
+             * several accounts. Rules are evaluated in order and the first match wins.
+             */
+            match_headers?: Array<string>;
             /**
              * MatchHosts is only accepted for header injection rules. Provider auth rules use
              * built-in host matching.
@@ -535,11 +683,25 @@ export declare namespace BoxUpdateParams {
             type?: string;
         }
         namespace Rule {
-            interface Aws {
-                access_key_id: Aws.AccessKeyID;
-                secret_access_key: Aws.SecretAccessKey;
+            interface SandboxesProxyAwsRoleConfig {
+                /**
+                 * RoleARN selects automatically renewed IAM-role credentials instead of static
+                 * keys. Access follows the role's effective AWS permissions, not the sandbox's
+                 * mount scope. Configure at creation; the role cannot be changed afterward.
+                 */
+                role_arn: string;
+            }
+            interface SandboxesProxyAwsStaticConfig {
+                access_key_id: SandboxesProxyAwsStaticConfig.AccessKeyID;
+                secret_access_key: SandboxesProxyAwsStaticConfig.SecretAccessKey;
+                /**
+                 * RoleARN selects automatically renewed IAM-role credentials instead of static
+                 * keys. Access follows the role's effective AWS permissions, not the sandbox's
+                 * mount scope. Configure at creation; the role cannot be changed afterward.
+                 */
+                role_arn?: '';
             }
-            namespace Aws {
+            namespace SandboxesProxyAwsStaticConfig {
                 interface AccessKeyID {
                     type: 'plaintext' | 'opaque' | 'workspace_secret';
                     is_set?: boolean;
@@ -570,6 +732,18 @@ export declare namespace BoxUpdateParams {
             }
         }
     }
+    /**
+     * RunConfig changes what subsequent commands run with: user and work_dir replace
+     * the current values, env_vars merge over them. Commands already running are
+     * unaffected.
+     */
+    interface RunConfig {
+        env_vars?: {
+            [key: string]: string;
+        };
+        user?: string;
+        work_dir?: string;
+    }
 }
 export interface BoxListParams extends ItemsCursorGetPaginationParams {
     /**
@@ -610,6 +784,10 @@ export interface BoxListParams extends ItemsCursorGetPaginationParams {
      * Filter by status (provisioning, ready, failed, stopped, deleting)
      */
     status?: string;
+    /**
+     * Filter by workspace resource tag value IDs; all must match
+     */
+    tag_value_id?: Array<string>;
 }
 export interface BoxCreateSnapshotParams {
     name: string;
@@ -617,6 +795,11 @@ export interface BoxCreateSnapshotParams {
      * if omitted, creates a fresh checkpoint from the running VM
      */
     checkpoint?: string;
+    /**
+     * Description says what this snapshot's image can do, so a caller can hand it to
+     * an agent as a capability summary. At most 1024 characters.
+     */
+    description?: string;
     /**
      * sandbox-local Docker image to export
      */
@@ -638,25 +821,77 @@ export interface BoxCreateSnapshotParams {
     labels?: {
         [key: string]: string;
     };
+    /**
+     * RunConfig overrides the runtime configuration the snapshot carries: for a
+     * docker_image export, the image's USER, WORKDIR and ENV; for a capture of the
+     * running VM, the sandbox's own. user and work_dir replace, env_vars merge.
+     */
+    run_config?: BoxCreateSnapshotParams.RunConfig;
     /**
      * mutable Docker-style tag; defaults to "latest"
      */
     tag?: string;
 }
+export declare namespace BoxCreateSnapshotParams {
+    /**
+     * RunConfig overrides the runtime configuration the snapshot carries: for a
+     * docker_image export, the image's USER, WORKDIR and ENV; for a capture of the
+     * running VM, the sandbox's own. user and work_dir replace, env_vars merge.
+     */
+    interface RunConfig {
+        env_vars?: {
+            [key: string]: string;
+        };
+        user?: string;
+        work_dir?: string;
+    }
+}
+export interface BoxDeleteServiceURLParams {
+    /**
+     * Port to stop sharing. Omit to stop sharing every port.
+     */
+    port?: number;
+}
 export interface BoxGenerateDownloadURLParams {
     path: string;
     content_disposition?: string;
     content_type?: string;
+    /**
+     * CSPSandbox false serves the file with no CSP sandbox directive; omit to keep it.
+     */
+    csp_sandbox?: boolean;
+    /**
+     * CSPSandboxFlags loosen the CSP sandbox the file is served under; omit for the
+     * most restrictive policy.
+     */
+    csp_sandbox_flags?: Array<'allow-downloads' | 'allow-forms' | 'allow-modals' | 'allow-orientation-lock' | 'allow-pointer-lock' | 'allow-popups' | 'allow-presentation' | 'allow-scripts' | 'allow-top-navigation-by-user-activation' | 'allow-same-origin'>;
+    /**
+     * CSPSourceBundles allow the served file to fetch from named third-party origins;
+     * omit to send no fetch directive.
+     */
+    csp_source_bundles?: Array<'cdnjs' | 'google-fonts' | 'jsdelivr' | 'unpkg' | 'none' | 'any'>;
     /**
      * ExpiresInSeconds is optional; a link with no expiry never expires.
      */
     expires_in_seconds?: number;
 }
 export interface BoxGenerateServiceURLParams {
+    /**
+     * Access selects the login mode, mutually exclusive with the minted token. Omit
+     * the field for token mode: mint a short-lived service token (default).
+     * "restricted" — LangSmith login: the sandbox's creator, or any user with
+     * SandboxesExec on it (admins by default). "workspace" — LangSmith login: any
+     * member of the owning workspace. "off" — remove an existing LangSmith login grant
+     * and mint a token. A LangSmith login grant is durable; token mode is refused
+     * (409) while one exists.
+     */
+    access?: 'restricted' | 'workspace' | 'off';
     expires_in_seconds?: number;
     port?: number;
 }
+export interface BoxListServiceURLsParams extends ItemsCursorGetPaginationParams {
+}
 export declare namespace Boxes {
-    export { type BoxCreateParams as BoxCreateParams, type BoxUpdateParams as BoxUpdateParams, type BoxListParams as BoxListParams, type BoxCreateSnapshotParams as BoxCreateSnapshotParams, type BoxGenerateDownloadURLParams as BoxGenerateDownloadURLParams, type BoxGenerateServiceURLParams as BoxGenerateServiceURLParams, };
+    export { type BoxListServiceURLsResponse as BoxListServiceURLsResponse, type BoxListServiceURLsResponsesItemsCursorGetPagination as BoxListServiceURLsResponsesItemsCursorGetPagination, type BoxCreateParams as BoxCreateParams, type BoxUpdateParams as BoxUpdateParams, type BoxListParams as BoxListParams, type BoxCreateSnapshotParams as BoxCreateSnapshotParams, type BoxDeleteServiceURLParams as BoxDeleteServiceURLParams, type BoxGenerateDownloadURLParams as BoxGenerateDownloadURLParams, type BoxGenerateServiceURLParams as BoxGenerateServiceURLParams, type BoxListServiceURLsParams as BoxListServiceURLsParams, };
 }
 export { type SandboxResponsesItemsCursorGetPagination };

package/dist/_openapi_client/resources/sandboxes/boxes.js

@@ -55,13 +55,41 @@ export class Boxes extends APIResource {
     createSnapshot(name, body, options) {
         return this._client.post(path `/api/v2/sandboxes/boxes/${name}/snapshot`, { body, ...options });
     }
+    /**
+     * Removes the sharing grant for one port, or for every port when port is omitted.
+     * A LangSmith login URL stops working immediately. A previously minted service
+     * token is not revoked and stays valid until it expires, but no new one can be
+     * issued from the removed grant.
+     */
+    deleteServiceURL(name, params = {}, options) {
+        const { port } = params ?? {};
+        return this._client.delete(path `/api/v2/sandboxes/boxes/${name}/service-urls`, {
+            query: { port },
+            ...options,
+            headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
+        });
+    }
     /**
      * Generate a tokenized link that downloads a single file from a sandbox with no
      * further authentication. This mints a token rather than creating an addressable
      * resource, so it returns 200 with no Location header. The token pins the sandbox,
-     * the file path, and the response content type and disposition, so a link cannot
-     * be repointed at another file. Links never expire unless expires_in_seconds is
-     * set. The link is served from the sandbox service domain, not the API host.
+     * the file path, the response content type and disposition, and the sandbox flags,
+     * so a link cannot be repointed at another file or served under a weaker policy.
+     * The file is always served with a Content-Security-Policy: a sandbox directive,
+     * plus a default-src holding every fetch to the file's own download host and a set
+     * of pre-approved third-party origins. csp_sandbox_flags may loosen the sandbox
+     * with allow-downloads, allow-forms, allow-modals, allow-orientation-lock,
+     * allow-pointer-lock, allow-popups, allow-presentation, allow-same-origin,
+     * allow-scripts, or allow-top-navigation-by-user-activation. Every file is served
+     * from its own host, derived from the sandbox and the path, so allow-same-origin
+     * gives a page localStorage and IndexedDB that no other file can read, and
+     * re-minting a link for the same file keeps them. csp_sandbox set to false drops
+     * the sandbox directive altogether, and csp_sandbox_flags must then be omitted.
+     * csp_source_bundles selects the third-party origins: cdnjs, google-fonts,
+     * jsdelivr, and unpkg are all allowed when the field is omitted, 'none' holds the
+     * file to its own host, and 'any' sends no default-src at all. Links never expire
+     * unless expires_in_seconds is set. The link is served from the sandbox service
+     * domain, not the API host.
      */
     generateDownloadURL(name, body, options) {
         return this._client.post(path `/api/v2/sandboxes/boxes/${name}/download-url`, { body, ...options });
@@ -70,7 +98,10 @@ export class Boxes extends APIResource {
      * Create a short-lived JWT for accessing an HTTP service running on a specific
      * port inside a sandbox. Returns a browser_url (sets auth cookie via redirect), a
      * service_url (for use with the X-Langsmith-Sandbox-Service-Token header), the raw
-     * token, and its expiry.
+     * token, and its expiry. Set access=restricted|workspace to instead enable durable
+     * LangSmith login (no token; users authenticate with their normal LangSmith
+     * session), or access=off to disable it. LangSmith login and token access are
+     * mutually exclusive per service URL.
      */
     generateServiceURL(name, body, options) {
         return this._client.post(path `/api/v2/sandboxes/boxes/${name}/service-url`, { body, ...options });
@@ -81,6 +112,15 @@ export class Boxes extends APIResource {
     getStatus(name, options) {
         return this._client.get(path `/api/v2/sandboxes/boxes/${name}/status`, options);
     }
+    /**
+     * Returns one entry per port the sandbox is currently reachable on, so a caller
+     * can see what is shared before turning it off. Expired token grants are omitted.
+     * Cursors are opaque and only valid on this endpoint; do not parse or construct
+     * one.
+     */
+    listServiceURLs(name, query = {}, options) {
+        return this._client.getAPIList(path `/api/v2/sandboxes/boxes/${name}/service-urls`, (ItemsCursorGetPagination), { query, ...options });
+    }
     /**
      * Start a stopped or failed sandbox. This endpoint is not idempotent.
      */

package/dist/_openapi_client/resources/sandboxes/registries.d.ts

@@ -29,20 +29,28 @@ export interface RegistryListResponse {
 }
 export interface RegistryResponse {
     id?: string;
+    auth_type?: 'DOCKER_CONFIG' | 'AWS_ROLE';
+    aws_role_arn?: string;
     created_at?: string;
     created_by?: string;
     name?: string;
+    provider?: 'DOCKER_REGISTRY' | 'HARBOR' | 'GHCR' | 'ECR' | 'GAR' | 'DOCKER_HUB';
+    repository_search_mode?: 'GLOBAL' | 'SCOPED' | 'NONE';
     updated_at?: string;
     updated_by?: string;
     url?: string;
 }
 export interface RegistryCreateParams {
     name: string;
-    password: string;
     url: string;
-    username: string;
+    auth_type?: 'DOCKER_CONFIG' | 'AWS_ROLE';
+    aws_role_arn?: string;
+    password?: string;
+    username?: string;
 }
 export interface RegistryUpdateParams {
+    auth_type?: 'DOCKER_CONFIG' | 'AWS_ROLE';
+    aws_role_arn?: string;
     name?: string;
     password?: string;
     url?: string;

package/dist/_openapi_client/resources/sandboxes/sandboxes.cjs

@@ -43,6 +43,7 @@ const RegistriesAPI = __importStar(require("./registries.cjs"));
 const registries_js_1 = require("./registries.cjs");
 const SnapshotsAPI = __importStar(require("./snapshots.cjs"));
 const snapshots_js_1 = require("./snapshots.cjs");
+const pagination_js_1 = require("../../core/pagination.cjs");
 class Sandboxes extends resource_js_1.APIResource {
     constructor() {
         super(...arguments);
@@ -65,6 +66,18 @@ class Sandboxes extends resource_js_1.APIResource {
             value: new SnapshotsAPI.Snapshots(this._client)
         });
     }
+    /**
+     * Returns priced usage per sandbox or snapshot and UTC hour in the half-open
+     * requested interval. LCU uses the recorded compute amount for sandboxes;
+     * snapshots have zero LCU. LSU allocates the recorded workspace storage amount
+     * proportionally to attributed bytes, including checkpoints on their sandbox and
+     * snapshots as separate resources. Resource filters preserve each resource's
+     * share. Rate changes do not reprice recorded amounts. An access-filtered page can
+     * have no items and a non-null next_cursor; continue until next_cursor is null.
+     */
+    listUsageCosts(query, options) {
+        return this._client.getAPIList('/api/v2/sandboxes/usage/costs', (pagination_js_1.ItemsCursorGetPagination), { query, ...options });
+    }
 }
 exports.Sandboxes = Sandboxes;
 Sandboxes.Boxes = boxes_js_1.Boxes;