langsmith 0.7.10 → 0.7.12

package/dist/_openapi_client/resources/runs/runs.js

@@ -3,6 +3,8 @@
 import { APIResource } from '../../core/resource.js';
 import * as RulesAPI from './rules.js';
 import { Rules } from './rules.js';
+import { ItemsCursorPostPagination, } from '../../core/pagination.js';
+import { buildHeaders } from '../../internal/headers.js';
 import { path } from '../../internal/utils/path.js';
 export class Runs extends APIResource {
     constructor() {
@@ -13,53 +15,64 @@ export class Runs extends APIResource {
             writable: true,
             value: new RulesAPI.Rules(this._client)
         });
+        Object.defineProperty(this, "retrieve", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: this.retrieveV2
+        });
+        Object.defineProperty(this, "query", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: this.queryV2
+        });
     }
     /**
-     * Queues a single run for ingestion. The request body must be a JSON-encoded run
-     * object that follows the Run schema.
-     */
-    create(body, options) {
-        return this._client.post('/runs', { body, ...options });
-    }
-    /**
-     * Get a specific run.
-     */
-    retrieve(runID, query = {}, options) {
-        return this._client.get(path `/api/v1/runs/${runID}`, { query, ...options });
-    }
-    /**
-     * Updates a run identified by its ID. The body should contain only the fields to
-     * be changed; unknown fields are ignored.
-     */
-    update(runID, body, options) {
-        return this._client.patch(path `/runs/${runID}`, { body, ...options });
-    }
-    /**
-     * Ingests a batch of runs in a single JSON payload. The payload must have `post`
-     * and/or `patch` arrays containing run objects. Prefer this endpoint over
-     * single‑run ingestion when submitting hundreds of runs, but `/runs/multipart`
-     * offers better handling for very large fields and attachments.
-     */
-    ingestBatch(body, options) {
-        return this._client.post('/runs/batch', { body, ...options });
-    }
-    /**
-     * Query Runs
-     */
-    query(body, options) {
-        return this._client.post('/api/v1/runs/query', { body, ...options });
-    }
-    /**
-     * Get all runs by query in body payload.
+     * **Alpha:** The request and response contract may change; Returns a paginated
+     * list of runs for the given projects within min/max start_time. Supports filters,
+     * cursor pagination, and `selects` to select fields to return.
+     *
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const queryRunResponse of client.runs.queryV2()) {
+     *   // ...
+     * }
+     * ```
      */
-    stats(body, options) {
-        return this._client.post('/api/v1/runs/stats', { body, ...options });
+    queryV2(params, options) {
+        const { Accept, ...body } = params;
+        return this._client.getAPIList('/v2/runs/query', (ItemsCursorPostPagination), {
+            body,
+            method: 'post',
+            ...options,
+            headers: buildHeaders([{ ...(Accept != null ? { Accept: Accept } : undefined) }, options?.headers]),
+        });
     }
     /**
-     * Update a run.
+     * **Alpha:** The request and response contract may change; Returns one run by ID
+     * for the given session and start_time. Use the `selects` query parameter
+     * (repeatable) to select fields to return.
+     *
+     * @example
+     * ```ts
+     * const queryRunResponse = await client.runs.retrieveV2(
+     *   '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e',
+     *   {
+     *     project_id: '182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e',
+     *     start_time: '2019-12-27T18:11:19.117Z',
+     *   },
+     * );
+     * ```
      */
-    update2(runID, options) {
-        return this._client.patch(path `/api/v1/runs/${runID}`, options);
+    retrieveV2(runID, params, options) {
+        const { Accept, ...query } = params;
+        return this._client.get(path `/v2/runs/${runID}`, {
+            query,
+            ...options,
+            headers: buildHeaders([{ ...(Accept != null ? { Accept: Accept } : undefined) }, options?.headers]),
+        });
     }
 }
 Runs.Rules = Rules;

package/dist/_openapi_client/resources/runs.cjs

@@ -0,0 +1,19 @@
+"use strict";
+// @ts-nocheck
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./runs/index.cjs"), exports);

package/dist/_openapi_client/resources/runs.d.ts

@@ -0,0 +1 @@
+export * from './runs/index.js';

package/dist/_openapi_client/resources/runs.js

@@ -0,0 +1,3 @@
+// @ts-nocheck
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+export * from './runs/index.js';

package/dist/anonymizer/index.cjs

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SECRET_RULES = exports.SECRET_PLACEHOLDER = void 0;
 exports.createAnonymizer = createAnonymizer;
+exports.createSecretAnonymizer = createSecretAnonymizer;
 function extractStringNodes(data, options) {
     const parsedOptions = { ...options, maxDepth: options.maxDepth ?? 10 };
     const queue = [[data, 0, "", null, ""]];
@@ -125,3 +127,143 @@ function createAnonymizer(replacer, options) {
         return mutateValue;
     };
 }
+/**
+ * Replacement token written in place of detected secrets by
+ * {@link DEFAULT_SECRET_RULES} / {@link createSecretAnonymizer}.
+ */
+exports.SECRET_PLACEHOLDER = "[SECRET_DETECTED]";
+/**
+ * A curated, high-precision rule set for detecting common credentials in
+ * traced data (prompts, tool inputs/outputs, file contents, shell commands).
+ *
+ * Designed to favor *low false positives* over exhaustive coverage:
+ *  - Provider rules are anchored to well-known key prefixes.
+ *  - Structural rules only fire when a sensitive *name* (api_key, token,
+ *    password, …) is paired with an assignment/separator, so ordinary code,
+ *    UUIDs, and hashes are left intact.
+ *
+ * This is NOT a port of gitleaks/secretlint; pattern shapes are drawn from
+ * those projects (and provider docs) as a reference only. Every rule sets an
+ * explicit `replace` because {@link createAnonymizer}'s default is
+ * `[redacted]`, whereas the shared token here is {@link SECRET_PLACEHOLDER}.
+ *
+ * Patterns are written to port 1:1 to the Python SDK preset (no lookbehind).
+ */
+exports.DEFAULT_SECRET_RULES = [
+    // ── Provider API keys (prefix-anchored) ─────────────────────────────────
+    // Anthropic
+    { pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g, replace: exports.SECRET_PLACEHOLDER },
+    // OpenAI: project / service-account / admin keys, then legacy `sk-...`
+    {
+        pattern: /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    { pattern: /sk-[A-Za-z0-9]{32,}/g, replace: exports.SECRET_PLACEHOLDER },
+    // LangSmith (keys are multi-segment: lsv2_pt_<key>_<tail> — match the
+    // full underscore-delimited tail so none of it leaks past the placeholder)
+    {
+        pattern: /lsv2_(?:pt|sk)_[A-Za-z0-9]{32,}(?:_[A-Za-z0-9]+)*/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    { pattern: /ls__[A-Za-z0-9]{16,}/g, replace: exports.SECRET_PLACEHOLDER },
+    // GitHub personal access / app tokens
+    { pattern: /gh[pousr]_[A-Za-z0-9]{36,}/g, replace: exports.SECRET_PLACEHOLDER },
+    { pattern: /github_pat_[A-Za-z0-9_]{82}/g, replace: exports.SECRET_PLACEHOLDER },
+    // GitLab personal access token
+    { pattern: /glpat-[A-Za-z0-9_-]{20,}/g, replace: exports.SECRET_PLACEHOLDER },
+    // AWS access key id (covers AKIA/ASIA/ABIA/ACCA/A3T* prefixes)
+    {
+        pattern: /\b(?:AKIA|ASIA|ABIA|ACCA|A3T[A-Z0-9])[0-9A-Z]{16}\b/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // Google API key + OAuth access token
+    { pattern: /AIza[0-9A-Za-z_-]{35}/g, replace: exports.SECRET_PLACEHOLDER },
+    { pattern: /ya29\.[0-9A-Za-z_-]+/g, replace: exports.SECRET_PLACEHOLDER },
+    // Slack tokens (bot/user + app-level) + incoming webhooks
+    { pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: exports.SECRET_PLACEHOLDER },
+    { pattern: /xapp-\d-[A-Za-z0-9-]{10,}/g, replace: exports.SECRET_PLACEHOLDER },
+    {
+        pattern: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // Stripe
+    {
+        pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}\b/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // npm
+    { pattern: /npm_[A-Za-z0-9]{36}/g, replace: exports.SECRET_PLACEHOLDER },
+    // PyPI upload token
+    {
+        pattern: /pypi-AgEIcHlwaS[A-Za-z0-9_-]{50,}/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // SendGrid
+    {
+        pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // ── Structured tokens ────────────────────────────────────────────────────
+    // JWT (header.payload.signature)
+    {
+        pattern: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // PEM private key blocks (RSA/EC/OPENSSH/DSA/plain + PGP "...KEY BLOCK")
+    {
+        pattern: /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY(?: BLOCK)?-----[\s\S]+?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY(?: BLOCK)?-----/g,
+        replace: exports.SECRET_PLACEHOLDER,
+    },
+    // ── Structural / contextual (sensitive NAME + assignment) ─────────────────
+    // KEY=value or "key": "value" where the name looks sensitive. Keep the name
+    // and separator ($1), redact the value. Notes:
+    //  - (?![A-Za-z0-9]) after the keyword requires a component boundary, so
+    //    `token` matches `api_token`/`mytoken` but NOT `tokenizer`/`tokens`.
+    //  - the value may start with an auth scheme word (Bearer/Token/Basic) so a
+    //    `X-Api-Key: Bearer <tok>` shape redacts the credential, not just "Bearer".
+    //  - value excludes & and ; so query-string params past the secret survive.
+    //  - requires a 6+ char value so short non-secret values are not touched.
+    {
+        pattern: /\b([A-Za-z0-9_.-]*(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|ACCESS[_-]?KEY|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET)(?![A-Za-z0-9])(?:[_.-][A-Za-z0-9]+)*["']?\s*[:=]\s*["']?)(?:(?:bearer|token|basic)\s+)?[^\s"'&;]{6,}/gi,
+        replace: `$1${exports.SECRET_PLACEHOLDER}`,
+    },
+    // Authorization / API-key headers. Keep the header name + separator ($1$2)
+    // and an optional scheme ($3); redact the credential.
+    {
+        pattern: /\b(authorization|x-api-key|x-auth-token)(["']?\s*[:=]\s*["']?)(bearer\s+|token\s+|basic\s+)?[A-Za-z0-9._~+/-]{8,}=*/gi,
+        replace: `$1$2$3${exports.SECRET_PLACEHOLDER}`,
+    },
+    // Bare "Bearer <token>" (any case; the scheme word is preserved via $1).
+    {
+        pattern: /\b(Bearer\s+)[A-Za-z0-9._~+/-]{10,}=*/gi,
+        replace: `$1${exports.SECRET_PLACEHOLDER}`,
+    },
+    // Credentials embedded in URLs: proto://user:PASS@host -> redact PASS only.
+    // Username is optional so proto://:PASS@host (empty user) is still covered.
+    {
+        pattern: /\b([a-z][a-z0-9+.-]*:\/\/[^:@/\s]*:)[^@/\s]+(@)/gi,
+        replace: `$1${exports.SECRET_PLACEHOLDER}$2`,
+    },
+];
+/**
+ * Build an anonymizer pre-loaded with {@link DEFAULT_SECRET_RULES} suitable for
+ * passing to `new Client({ anonymizer })`. It redacts detected secrets from run
+ * inputs, outputs, and metadata client-side, before they are uploaded.
+ *
+ * @param options.extraRules - Additional rules appended after the defaults.
+ * @param options.maxDepth - Max recursion depth (default 24; higher than
+ *   `createAnonymizer`'s default of 10 because traced payloads nest deeply,
+ *   e.g. `messages[].content[].args`).
+ *
+ * @example
+ * ```ts
+ * import { Client } from "langsmith";
+ * import { createSecretAnonymizer } from "langsmith/anonymizer";
+ *
+ * const client = new Client({ anonymizer: createSecretAnonymizer() });
+ * ```
+ */
+function createSecretAnonymizer(options) {
+    const rules = [...exports.DEFAULT_SECRET_RULES, ...(options?.extraRules ?? [])];
+    return createAnonymizer(rules, { maxDepth: options?.maxDepth ?? 24 });
+}

package/dist/anonymizer/index.d.ts

@@ -14,3 +14,48 @@ export type ReplacerType = ((value: string, path?: string) => string) | StringNo
 export declare function createAnonymizer(replacer: ReplacerType, options?: {
     maxDepth?: number;
 }): <T>(data: T) => T;
+/**
+ * Replacement token written in place of detected secrets by
+ * {@link DEFAULT_SECRET_RULES} / {@link createSecretAnonymizer}.
+ */
+export declare const SECRET_PLACEHOLDER = "[SECRET_DETECTED]";
+/**
+ * A curated, high-precision rule set for detecting common credentials in
+ * traced data (prompts, tool inputs/outputs, file contents, shell commands).
+ *
+ * Designed to favor *low false positives* over exhaustive coverage:
+ *  - Provider rules are anchored to well-known key prefixes.
+ *  - Structural rules only fire when a sensitive *name* (api_key, token,
+ *    password, …) is paired with an assignment/separator, so ordinary code,
+ *    UUIDs, and hashes are left intact.
+ *
+ * This is NOT a port of gitleaks/secretlint; pattern shapes are drawn from
+ * those projects (and provider docs) as a reference only. Every rule sets an
+ * explicit `replace` because {@link createAnonymizer}'s default is
+ * `[redacted]`, whereas the shared token here is {@link SECRET_PLACEHOLDER}.
+ *
+ * Patterns are written to port 1:1 to the Python SDK preset (no lookbehind).
+ */
+export declare const DEFAULT_SECRET_RULES: StringNodeRule[];
+/**
+ * Build an anonymizer pre-loaded with {@link DEFAULT_SECRET_RULES} suitable for
+ * passing to `new Client({ anonymizer })`. It redacts detected secrets from run
+ * inputs, outputs, and metadata client-side, before they are uploaded.
+ *
+ * @param options.extraRules - Additional rules appended after the defaults.
+ * @param options.maxDepth - Max recursion depth (default 24; higher than
+ *   `createAnonymizer`'s default of 10 because traced payloads nest deeply,
+ *   e.g. `messages[].content[].args`).
+ *
+ * @example
+ * ```ts
+ * import { Client } from "langsmith";
+ * import { createSecretAnonymizer } from "langsmith/anonymizer";
+ *
+ * const client = new Client({ anonymizer: createSecretAnonymizer() });
+ * ```
+ */
+export declare function createSecretAnonymizer(options?: {
+    extraRules?: StringNodeRule[];
+    maxDepth?: number;
+}): <T>(data: T) => T;

package/dist/anonymizer/index.js

@@ -122,3 +122,143 @@ export function createAnonymizer(replacer, options) {
         return mutateValue;
     };
 }
+/**
+ * Replacement token written in place of detected secrets by
+ * {@link DEFAULT_SECRET_RULES} / {@link createSecretAnonymizer}.
+ */
+export const SECRET_PLACEHOLDER = "[SECRET_DETECTED]";
+/**
+ * A curated, high-precision rule set for detecting common credentials in
+ * traced data (prompts, tool inputs/outputs, file contents, shell commands).
+ *
+ * Designed to favor *low false positives* over exhaustive coverage:
+ *  - Provider rules are anchored to well-known key prefixes.
+ *  - Structural rules only fire when a sensitive *name* (api_key, token,
+ *    password, …) is paired with an assignment/separator, so ordinary code,
+ *    UUIDs, and hashes are left intact.
+ *
+ * This is NOT a port of gitleaks/secretlint; pattern shapes are drawn from
+ * those projects (and provider docs) as a reference only. Every rule sets an
+ * explicit `replace` because {@link createAnonymizer}'s default is
+ * `[redacted]`, whereas the shared token here is {@link SECRET_PLACEHOLDER}.
+ *
+ * Patterns are written to port 1:1 to the Python SDK preset (no lookbehind).
+ */
+export const DEFAULT_SECRET_RULES = [
+    // ── Provider API keys (prefix-anchored) ─────────────────────────────────
+    // Anthropic
+    { pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g, replace: SECRET_PLACEHOLDER },
+    // OpenAI: project / service-account / admin keys, then legacy `sk-...`
+    {
+        pattern: /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    { pattern: /sk-[A-Za-z0-9]{32,}/g, replace: SECRET_PLACEHOLDER },
+    // LangSmith (keys are multi-segment: lsv2_pt_<key>_<tail> — match the
+    // full underscore-delimited tail so none of it leaks past the placeholder)
+    {
+        pattern: /lsv2_(?:pt|sk)_[A-Za-z0-9]{32,}(?:_[A-Za-z0-9]+)*/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    { pattern: /ls__[A-Za-z0-9]{16,}/g, replace: SECRET_PLACEHOLDER },
+    // GitHub personal access / app tokens
+    { pattern: /gh[pousr]_[A-Za-z0-9]{36,}/g, replace: SECRET_PLACEHOLDER },
+    { pattern: /github_pat_[A-Za-z0-9_]{82}/g, replace: SECRET_PLACEHOLDER },
+    // GitLab personal access token
+    { pattern: /glpat-[A-Za-z0-9_-]{20,}/g, replace: SECRET_PLACEHOLDER },
+    // AWS access key id (covers AKIA/ASIA/ABIA/ACCA/A3T* prefixes)
+    {
+        pattern: /\b(?:AKIA|ASIA|ABIA|ACCA|A3T[A-Z0-9])[0-9A-Z]{16}\b/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // Google API key + OAuth access token
+    { pattern: /AIza[0-9A-Za-z_-]{35}/g, replace: SECRET_PLACEHOLDER },
+    { pattern: /ya29\.[0-9A-Za-z_-]+/g, replace: SECRET_PLACEHOLDER },
+    // Slack tokens (bot/user + app-level) + incoming webhooks
+    { pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/g, replace: SECRET_PLACEHOLDER },
+    { pattern: /xapp-\d-[A-Za-z0-9-]{10,}/g, replace: SECRET_PLACEHOLDER },
+    {
+        pattern: /https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]+/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // Stripe
+    {
+        pattern: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}\b/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // npm
+    { pattern: /npm_[A-Za-z0-9]{36}/g, replace: SECRET_PLACEHOLDER },
+    // PyPI upload token
+    {
+        pattern: /pypi-AgEIcHlwaS[A-Za-z0-9_-]{50,}/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // SendGrid
+    {
+        pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // ── Structured tokens ────────────────────────────────────────────────────
+    // JWT (header.payload.signature)
+    {
+        pattern: /eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // PEM private key blocks (RSA/EC/OPENSSH/DSA/plain + PGP "...KEY BLOCK")
+    {
+        pattern: /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY(?: BLOCK)?-----[\s\S]+?-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY(?: BLOCK)?-----/g,
+        replace: SECRET_PLACEHOLDER,
+    },
+    // ── Structural / contextual (sensitive NAME + assignment) ─────────────────
+    // KEY=value or "key": "value" where the name looks sensitive. Keep the name
+    // and separator ($1), redact the value. Notes:
+    //  - (?![A-Za-z0-9]) after the keyword requires a component boundary, so
+    //    `token` matches `api_token`/`mytoken` but NOT `tokenizer`/`tokens`.
+    //  - the value may start with an auth scheme word (Bearer/Token/Basic) so a
+    //    `X-Api-Key: Bearer <tok>` shape redacts the credential, not just "Bearer".
+    //  - value excludes & and ; so query-string params past the secret survive.
+    //  - requires a 6+ char value so short non-secret values are not touched.
+    {
+        pattern: /\b([A-Za-z0-9_.-]*(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE[_-]?KEY|ACCESS[_-]?KEY|AUTH[_-]?TOKEN|CLIENT[_-]?SECRET)(?![A-Za-z0-9])(?:[_.-][A-Za-z0-9]+)*["']?\s*[:=]\s*["']?)(?:(?:bearer|token|basic)\s+)?[^\s"'&;]{6,}/gi,
+        replace: `$1${SECRET_PLACEHOLDER}`,
+    },
+    // Authorization / API-key headers. Keep the header name + separator ($1$2)
+    // and an optional scheme ($3); redact the credential.
+    {
+        pattern: /\b(authorization|x-api-key|x-auth-token)(["']?\s*[:=]\s*["']?)(bearer\s+|token\s+|basic\s+)?[A-Za-z0-9._~+/-]{8,}=*/gi,
+        replace: `$1$2$3${SECRET_PLACEHOLDER}`,
+    },
+    // Bare "Bearer <token>" (any case; the scheme word is preserved via $1).
+    {
+        pattern: /\b(Bearer\s+)[A-Za-z0-9._~+/-]{10,}=*/gi,
+        replace: `$1${SECRET_PLACEHOLDER}`,
+    },
+    // Credentials embedded in URLs: proto://user:PASS@host -> redact PASS only.
+    // Username is optional so proto://:PASS@host (empty user) is still covered.
+    {
+        pattern: /\b([a-z][a-z0-9+.-]*:\/\/[^:@/\s]*:)[^@/\s]+(@)/gi,
+        replace: `$1${SECRET_PLACEHOLDER}$2`,
+    },
+];
+/**
+ * Build an anonymizer pre-loaded with {@link DEFAULT_SECRET_RULES} suitable for
+ * passing to `new Client({ anonymizer })`. It redacts detected secrets from run
+ * inputs, outputs, and metadata client-side, before they are uploaded.
+ *
+ * @param options.extraRules - Additional rules appended after the defaults.
+ * @param options.maxDepth - Max recursion depth (default 24; higher than
+ *   `createAnonymizer`'s default of 10 because traced payloads nest deeply,
+ *   e.g. `messages[].content[].args`).
+ *
+ * @example
+ * ```ts
+ * import { Client } from "langsmith";
+ * import { createSecretAnonymizer } from "langsmith/anonymizer";
+ *
+ * const client = new Client({ anonymizer: createSecretAnonymizer() });
+ * ```
+ */
+export function createSecretAnonymizer(options) {
+    const rules = [...DEFAULT_SECRET_RULES, ...(options?.extraRules ?? [])];
+    return createAnonymizer(rules, { maxDepth: options?.maxDepth ?? 24 });
+}

package/dist/client.cjs

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Client = exports.AutoBatchQueue = exports.DEFAULT_MAX_SIZE_BYTES = exports.DEFAULT_UNCOMPRESSED_BATCH_SIZE_LIMIT_BYTES = void 0;
 exports.mergeRuntimeEnvIntoRun = mergeRuntimeEnvIntoRun;
+exports._checkBackendVersion = _checkBackendVersion;
 const uuid = __importStar(require("./utils/uuid/src/index.cjs"));
 const translator_js_1 = require("./experimental/otel/translator.cjs");
 const otel_js_1 = require("./singletons/otel.cjs");
@@ -45,6 +46,7 @@ const index_js_1 = require("./index.cjs");
 const index_js_2 = require("./_openapi_client/index.cjs");
 const _uuid_js_1 = require("./utils/_uuid.cjs");
 const warn_js_1 = require("./utils/warn.cjs");
+const constants_js_1 = require("./utils/constants.cjs");
 const prompts_js_1 = require("./utils/prompts.cjs");
 const error_js_1 = require("./utils/error.cjs");
 const index_js_3 = require("./utils/prompt_cache/index.cjs");
@@ -159,6 +161,25 @@ function _formatFeedbackScore(score) {
     }
     return score;
 }
+function _checkBackendVersion(version, minVersion = constants_js_1._MIN_BACKEND_VERSION) {
+    const parse = (v) => v.split(".").map((s) => parseInt(s, 10));
+    const [maj, min, pat] = parse(version);
+    const [rMaj, rMin, rPat] = parse(minVersion);
+    if (isNaN(maj) ||
+        isNaN(min) ||
+        isNaN(pat) ||
+        isNaN(rMaj) ||
+        isNaN(rMin) ||
+        isNaN(rPat)) {
+        console.warn(`[LANGSMITH]: Could not parse backend version ${JSON.stringify(version)} for compatibility check.`);
+        return;
+    }
+    if (maj < rMaj ||
+        (maj === rMaj && min < rMin) ||
+        (maj === rMaj && min === rMin && pat < rPat)) {
+        console.warn(`[LANGSMITH]: Backend version ${JSON.stringify(version)} is older than the minimum version required by this SDK (${JSON.stringify(minVersion)}). Some features may not work as expected.`);
+    }
+}
 exports.DEFAULT_UNCOMPRESSED_BATCH_SIZE_LIMIT_BYTES = 24 * 1024 * 1024;
 /** Default maximum memory (1GB) for queue size limits. */
 exports.DEFAULT_MAX_SIZE_BYTES = 1024 * 1024 * 1024; // 1GB
@@ -947,6 +968,9 @@ class Client {
     get onlineEvaluators() {
         return this.openAPIClient.onlineEvaluators;
     }
+    get runs() {
+        return this.openAPIClient.runs;
+    }
     async processInputs(inputs) {
         if (this.hideInputs === false) {
             return inputs;
@@ -1408,6 +1432,9 @@ class Client {
                 if (this._serverInfo === undefined) {
                     try {
                         this._serverInfo = await this._getServerInfo();
+                        if (this._serverInfo?.version) {
+                            _checkBackendVersion(this._serverInfo.version);
+                        }
                     }
                     catch (e) {
                         console.warn(`[LANGSMITH]: Failed to fetch info on supported operations. Falling back to batch operations and default limits. Info: ${e.status ?? "Unspecified status code"} ${e.message}`);
@@ -3502,7 +3529,7 @@ class Client {
             return res;
         });
     }
-    async createFeedback(runId, key, { score, value, correction, comment, sourceInfo, feedbackSourceType = "api", sourceRunId, feedbackId, feedbackConfig, projectId, comparativeExperimentId, sessionId, startTime, }) {
+    async createFeedback(runId, key, { score, value, correction, comment, sourceInfo, feedbackSourceType = "api", sourceRunId, feedbackId, feedbackConfig, projectId, comparativeExperimentId, sessionId, startTime, extendTraceRetention, }) {
         if (!runId && !projectId) {
             throw new Error("One of runId or projectId must be provided");
         }
@@ -3535,6 +3562,7 @@ class Client {
             feedbackConfig,
             session_id: sessionId ?? projectId,
             start_time: startTime,
+            extend_trace_retention: extendTraceRetention,
         };
         const body = JSON.stringify(feedback);
         const url = `${this.apiUrl}/feedback`;

package/dist/client.d.ts

@@ -4,6 +4,7 @@ import { ComparativeExperiment, DataType, Dataset, DatasetDiffInfo, DatasetShare
 import { type TracingMode } from "./utils/env.js";
 import { EvaluationResult, EvaluationResults } from "./evaluation/evaluator.js";
 import { OnlineEvaluators } from "./_openapi_client/resources/online-evaluators.js";
+import { Runs as OpenAPIRuns } from "./_openapi_client/resources/runs.js";
 import { PromptCache } from "./utils/prompt_cache/index.js";
 import { ProfileAuth } from "./utils/profiles.js";
 export interface ClientConfig {
@@ -382,6 +383,7 @@ export interface ListThreadsItem extends Thread {
     runs: Run[];
 }
 export declare function mergeRuntimeEnvIntoRun<T extends RunCreate | RunUpdate>(run: T, cachedEnvVars?: Record<string, string>, omitTracedRuntimeInfo?: boolean): T;
+export declare function _checkBackendVersion(version: string, minVersion?: string): void;
 export declare const DEFAULT_UNCOMPRESSED_BATCH_SIZE_LIMIT_BYTES: number;
 /** Default maximum memory (1GB) for queue size limits. */
 export declare const DEFAULT_MAX_SIZE_BYTES: number;
@@ -501,6 +503,7 @@ export declare class Client implements LangSmithTracingClientInterface {
     private _newOpenAPIClient;
     private _getPlatformEndpointPath;
     get onlineEvaluators(): OnlineEvaluators;
+    get runs(): OpenAPIRuns;
     private processInputs;
     private processOutputs;
     private processMetadata;
@@ -915,7 +918,7 @@ export declare class Client implements LangSmithTracingClientInterface {
         exampleIds: string[];
         remove?: boolean;
     }): Promise<void>;
-    createFeedback(runId: string | null, key: string, { score, value, correction, comment, sourceInfo, feedbackSourceType, sourceRunId, feedbackId, feedbackConfig, projectId, comparativeExperimentId, sessionId, startTime, }: {
+    createFeedback(runId: string | null, key: string, { score, value, correction, comment, sourceInfo, feedbackSourceType, sourceRunId, feedbackId, feedbackConfig, projectId, comparativeExperimentId, sessionId, startTime, extendTraceRetention, }: {
         score?: ScoreType;
         value?: ValueType;
         correction?: object;
@@ -932,6 +935,8 @@ export declare class Client implements LangSmithTracingClientInterface {
         sessionId?: string;
         /** The start time of the run this feedback is for. Accepts ISO string or epoch ms. */
         startTime?: number | string;
+        /** If false, create feedback without extending the trace's retention tier. */
+        extendTraceRetention?: boolean;
     }): Promise<Feedback>;
     updateFeedback(feedbackId: string, { score, value, correction, comment, }: {
         score?: number | boolean | null;