langsmith 0.7.12 → 0.7.14

package/dist/_openapi_client/resources/{sessions/sessions.d.ts → sessions.d.ts}

@@ -1,35 +1,28 @@
-import { APIResource } from '../../core/resource.js';
-import * as InsightsAPI from './insights.js';
-import { CreateRunClusteringJobRequest, InsightCreateParams, InsightCreateResponse, InsightDeleteParams, InsightDeleteResponse, InsightListParams, InsightListResponse, InsightListResponsesOffsetPaginationInsightsClusteringJobs, InsightRetrieveJobParams, InsightRetrieveJobResponse, InsightRetrieveRunsParams, InsightRetrieveRunsResponse, InsightUpdateParams, InsightUpdateResponse, Insights } from './insights.js';
-import { APIPromise } from '../../core/api-promise.js';
-import { OffsetPaginationTopLevelArray, type OffsetPaginationTopLevelArrayParams, PagePromise } from '../../core/pagination.js';
-import { RequestOptions } from '../../internal/request-options.js';
+import { APIResource } from '../core/resource.js';
+import { APIPromise } from '../core/api-promise.js';
+import { OffsetPaginationTopLevelArray, type OffsetPaginationTopLevelArrayParams, PagePromise } from '../core/pagination.js';
+import { RequestOptions } from '../internal/request-options.js';
 export declare class Sessions extends APIResource {
-    insights: InsightsAPI.Insights;
     /**
-     * Create a new session.
+     * Create a new project.
      */
     create(params: SessionCreateParams, options?: RequestOptions): APIPromise<TracerSessionWithoutVirtualFields>;
     /**
-     * Get a specific session.
+     * Get a specific project.
      */
-    retrieve(sessionID: string, params?: SessionRetrieveParams | null | undefined, options?: RequestOptions): APIPromise<TracerSession>;
+    retrieve(project_id: string, params?: SessionRetrieveParams | null | undefined, options?: RequestOptions): APIPromise<TracerSession>;
     /**
-     * Update a session.
+     * Update a project.
      */
-    update(sessionID: string, body: SessionUpdateParams, options?: RequestOptions): APIPromise<TracerSessionWithoutVirtualFields>;
+    update(project_id: string, body: SessionUpdateParams, options?: RequestOptions): APIPromise<TracerSessionWithoutVirtualFields>;
     /**
-     * Get all sessions.
+     * List all projects.
      */
     list(params?: SessionListParams | null | undefined, options?: RequestOptions): PagePromise<TracerSessionsOffsetPaginationTopLevelArray, TracerSession>;
     /**
-     * Delete a specific session.
+     * Delete a specific project.
      */
-    delete(sessionID: string, options?: RequestOptions): APIPromise<unknown>;
-    /**
-     * Get a prebuilt dashboard for a tracing project.
-     */
-    dashboard(sessionID: string, params: SessionDashboardParams, options?: RequestOptions): APIPromise<CustomChartsSection>;
+    delete(project_id: string, options?: RequestOptions): APIPromise<unknown>;
 }
 export type TracerSessionsOffsetPaginationTopLevelArray = OffsetPaginationTopLevelArray<TracerSession>;
 export interface CustomChartsSection {
@@ -638,37 +631,6 @@ export interface SessionListParams extends OffsetPaginationTopLevelArrayParams {
      */
     accept?: string;
 }
-export interface SessionDashboardParams {
-    /**
-     * Body param
-     */
-    end_time?: string | null;
-    /**
-     * Body param: Group by param for run stats.
-     */
-    group_by?: RunStatsGroupBy | null;
-    /**
-     * Body param
-     */
-    omit_data?: boolean;
-    /**
-     * Body param
-     */
-    start_time?: string | null;
-    /**
-     * Body param: Timedelta input.
-     */
-    stride?: TimedeltaInput;
-    /**
-     * Body param
-     */
-    timezone?: string;
-    /**
-     * Header param
-     */
-    accept?: string;
-}
 export declare namespace Sessions {
-    export { type CustomChartsSection as CustomChartsSection, type CustomChartsSectionRequest as CustomChartsSectionRequest, type RunStatsGroupBy as RunStatsGroupBy, type SessionSortableColumns as SessionSortableColumns, type TimedeltaInput as TimedeltaInput, type TracerSession as TracerSession, type TracerSessionWithoutVirtualFields as TracerSessionWithoutVirtualFields, type SessionDeleteResponse as SessionDeleteResponse, type TracerSessionsOffsetPaginationTopLevelArray as TracerSessionsOffsetPaginationTopLevelArray, type SessionCreateParams as SessionCreateParams, type SessionRetrieveParams as SessionRetrieveParams, type SessionUpdateParams as SessionUpdateParams, type SessionListParams as SessionListParams, type SessionDashboardParams as SessionDashboardParams, };
-    export { Insights as Insights, type CreateRunClusteringJobRequest as CreateRunClusteringJobRequest, type InsightCreateResponse as InsightCreateResponse, type InsightUpdateResponse as InsightUpdateResponse, type InsightListResponse as InsightListResponse, type InsightDeleteResponse as InsightDeleteResponse, type InsightRetrieveJobResponse as InsightRetrieveJobResponse, type InsightRetrieveRunsResponse as InsightRetrieveRunsResponse, type InsightListResponsesOffsetPaginationInsightsClusteringJobs as InsightListResponsesOffsetPaginationInsightsClusteringJobs, type InsightCreateParams as InsightCreateParams, type InsightUpdateParams as InsightUpdateParams, type InsightListParams as InsightListParams, type InsightDeleteParams as InsightDeleteParams, type InsightRetrieveJobParams as InsightRetrieveJobParams, type InsightRetrieveRunsParams as InsightRetrieveRunsParams, };
+    export { type CustomChartsSection as CustomChartsSection, type CustomChartsSectionRequest as CustomChartsSectionRequest, type RunStatsGroupBy as RunStatsGroupBy, type SessionSortableColumns as SessionSortableColumns, type TimedeltaInput as TimedeltaInput, type TracerSession as TracerSession, type TracerSessionWithoutVirtualFields as TracerSessionWithoutVirtualFields, type SessionDeleteResponse as SessionDeleteResponse, type TracerSessionsOffsetPaginationTopLevelArray as TracerSessionsOffsetPaginationTopLevelArray, type SessionCreateParams as SessionCreateParams, type SessionRetrieveParams as SessionRetrieveParams, type SessionUpdateParams as SessionUpdateParams, type SessionListParams as SessionListParams, };
 }

package/dist/_openapi_client/resources/sessions.js

@@ -0,0 +1,49 @@
+// @ts-nocheck
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+import { APIResource } from '../core/resource.js';
+import { OffsetPaginationTopLevelArray, } from '../core/pagination.js';
+import { buildHeaders } from '../internal/headers.js';
+import { path } from '../internal/utils/path.js';
+export class Sessions extends APIResource {
+    /**
+     * Create a new project.
+     */
+    create(params, options) {
+        const { upsert, ...body } = params;
+        return this._client.post('/api/v1/sessions', { query: { upsert }, body, ...options });
+    }
+    /**
+     * Get a specific project.
+     */
+    retrieve(project_id, params = {}, options) {
+        const { accept, ...query } = params ?? {};
+        return this._client.get(path `/api/v1/sessions/${project_id}`, {
+            query,
+            ...options,
+            headers: buildHeaders([{ ...(accept != null ? { accept: accept } : undefined) }, options?.headers]),
+        });
+    }
+    /**
+     * Update a project.
+     */
+    update(project_id, body, options) {
+        return this._client.patch(path `/api/v1/sessions/${project_id}`, { body, ...options });
+    }
+    /**
+     * List all projects.
+     */
+    list(params = {}, options) {
+        const { accept, ...query } = params ?? {};
+        return this._client.getAPIList('/api/v1/sessions', (OffsetPaginationTopLevelArray), {
+            query,
+            ...options,
+            headers: buildHeaders([{ ...(accept != null ? { accept: accept } : undefined) }, options?.headers]),
+        });
+    }
+    /**
+     * Delete a specific project.
+     */
+    delete(project_id, options) {
+        return this._client.delete(path `/api/v1/sessions/${project_id}`, options);
+    }
+}

package/dist/client.cjs

@@ -543,6 +543,12 @@ class Client {
             writable: true,
             value: void 0
         });
+        Object.defineProperty(this, "anonymizer", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "omitTracedRuntimeInfo", {
             enumerable: true,
             configurable: true,
@@ -794,6 +800,7 @@ class Client {
         this.hideOutputs =
             config.hideOutputs ?? config.anonymizer ?? defaultConfig.hideOutputs;
         this.hideMetadata = config.hideMetadata ?? defaultConfig.hideMetadata;
+        this.anonymizer = config.anonymizer;
         this.omitTracedRuntimeInfo = config.omitTracedRuntimeInfo ?? false;
         this.autoBatchTracing = config.autoBatchTracing ?? this.autoBatchTracing;
         this.autoBatchQueue = new AutoBatchQueue(maxMemory);
@@ -971,6 +978,18 @@ class Client {
     get runs() {
         return this.openAPIClient.runs;
     }
+    /** Access the v2 sandboxes resource (registries, snapshots, boxes). */
+    get sandboxes() {
+        return this.openAPIClient.sandboxes;
+    }
+    /** Access the projects resource. */
+    get projects() {
+        return this.openAPIClient.sessions;
+    }
+    /** Access the v2 datasets resource (experimentRuns, etc.). */
+    get datasets() {
+        return this.openAPIClient.datasets;
+    }
     async processInputs(inputs) {
         if (this.hideInputs === false) {
             return inputs;
@@ -1007,6 +1026,25 @@ class Client {
         }
         return metadata;
     }
+    /**
+     * Apply the configured anonymizer to a run's error string.
+     *
+     * Unlike inputs/outputs, `error` is a plain string (an exception message or
+     * traceback) that can carry credentials the user never explicitly logged --
+     * e.g. an HTTP-client error whose message embeds an `Authorization` header.
+     * The anonymizer is typed `(KVMap) => KVMap`, so the string is wrapped as
+     * `{ error }`, scrubbed, and unwrapped. Mirrors the Python SDK's
+     * `Client._hide_run_error`.
+     *
+     * TODO: Update anonymizer to always nest inputs/outputs/error for consistency
+     */
+    async processError(error) {
+        if (this.anonymizer == null) {
+            return error;
+        }
+        const result = await this.anonymizer({ error });
+        return typeof result?.error === "string" ? result.error : error;
+    }
     /**
      * Filter content from new_token events to prevent streaming LLM output
      * from being uploaded via events.
@@ -1033,6 +1071,9 @@ class Client {
         if (runParams.outputs !== undefined) {
             runParams.outputs = await this.processOutputs(runParams.outputs);
         }
+        if (runParams.error !== undefined) {
+            runParams.error = await this.processError(runParams.error);
+        }
         if (runParams.extra != null && "metadata" in runParams.extra) {
             runParams.extra = {
                 ...runParams.extra,
@@ -1889,6 +1930,9 @@ class Client {
         if (run.outputs) {
             run.outputs = await this.processOutputs(run.outputs);
         }
+        if (run.error) {
+            run.error = await this.processError(run.error);
+        }
         if (run.extra != null && "metadata" in run.extra) {
             run.extra = {
                 ...run.extra,

package/dist/client.d.ts

@@ -5,6 +5,9 @@ import { type TracingMode } from "./utils/env.js";
 import { EvaluationResult, EvaluationResults } from "./evaluation/evaluator.js";
 import { OnlineEvaluators } from "./_openapi_client/resources/online-evaluators.js";
 import { Runs as OpenAPIRuns } from "./_openapi_client/resources/runs.js";
+import { Sandboxes } from "./_openapi_client/resources/sandboxes/sandboxes.js";
+import { Datasets } from "./_openapi_client/resources/datasets/datasets.js";
+import { Sessions } from "./_openapi_client/resources/sessions.js";
 import { PromptCache } from "./utils/prompt_cache/index.js";
 import { ProfileAuth } from "./utils/profiles.js";
 export interface ClientConfig {
@@ -13,6 +16,14 @@ export interface ClientConfig {
     callerOptions?: AsyncCallerParams;
     timeout_ms?: number;
     webUrl?: string;
+    /**
+     * A function applied for masking serialized run inputs and outputs,
+     * before sending to the API. Can be called with raw inputs, raw
+     * outputs, or a nested `{ error: string }` object for errors.
+     *
+     * If a `hideInputs` or `hideOutputs` function is present,
+     * the client will call it instead of the anonymizer as appropriate.
+     */
     anonymizer?: (values: KVMap) => KVMap | Promise<KVMap>;
     hideInputs?: boolean | ((inputs: KVMap) => KVMap | Promise<KVMap>);
     hideOutputs?: boolean | ((outputs: KVMap) => KVMap | Promise<KVMap>);
@@ -429,6 +440,7 @@ export declare class Client implements LangSmithTracingClientInterface {
     private hideInputs?;
     private hideOutputs?;
     private hideMetadata?;
+    private anonymizer?;
     private omitTracedRuntimeInfo?;
     private tracingSampleRate?;
     private filteredPostUuids;
@@ -504,9 +516,28 @@ export declare class Client implements LangSmithTracingClientInterface {
     private _getPlatformEndpointPath;
     get onlineEvaluators(): OnlineEvaluators;
     get runs(): OpenAPIRuns;
+    /** Access the v2 sandboxes resource (registries, snapshots, boxes). */
+    get sandboxes(): Sandboxes;
+    /** Access the projects resource. */
+    get projects(): Sessions;
+    /** Access the v2 datasets resource (experimentRuns, etc.). */
+    get datasets(): Datasets;
     private processInputs;
     private processOutputs;
     private processMetadata;
+    /**
+     * Apply the configured anonymizer to a run's error string.
+     *
+     * Unlike inputs/outputs, `error` is a plain string (an exception message or
+     * traceback) that can carry credentials the user never explicitly logged --
+     * e.g. an HTTP-client error whose message embeds an `Authorization` header.
+     * The anonymizer is typed `(KVMap) => KVMap`, so the string is wrapped as
+     * `{ error }`, scrubbed, and unwrapped. Mirrors the Python SDK's
+     * `Client._hide_run_error`.
+     *
+     * TODO: Update anonymizer to always nest inputs/outputs/error for consistency
+     */
+    private processError;
     /**
      * Filter content from new_token events to prevent streaming LLM output
      * from being uploaded via events.

package/dist/client.js

@@ -504,6 +504,12 @@ export class Client {
             writable: true,
             value: void 0
         });
+        Object.defineProperty(this, "anonymizer", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "omitTracedRuntimeInfo", {
             enumerable: true,
             configurable: true,
@@ -755,6 +761,7 @@ export class Client {
         this.hideOutputs =
             config.hideOutputs ?? config.anonymizer ?? defaultConfig.hideOutputs;
         this.hideMetadata = config.hideMetadata ?? defaultConfig.hideMetadata;
+        this.anonymizer = config.anonymizer;
         this.omitTracedRuntimeInfo = config.omitTracedRuntimeInfo ?? false;
         this.autoBatchTracing = config.autoBatchTracing ?? this.autoBatchTracing;
         this.autoBatchQueue = new AutoBatchQueue(maxMemory);
@@ -932,6 +939,18 @@ export class Client {
     get runs() {
         return this.openAPIClient.runs;
     }
+    /** Access the v2 sandboxes resource (registries, snapshots, boxes). */
+    get sandboxes() {
+        return this.openAPIClient.sandboxes;
+    }
+    /** Access the projects resource. */
+    get projects() {
+        return this.openAPIClient.sessions;
+    }
+    /** Access the v2 datasets resource (experimentRuns, etc.). */
+    get datasets() {
+        return this.openAPIClient.datasets;
+    }
     async processInputs(inputs) {
         if (this.hideInputs === false) {
             return inputs;
@@ -968,6 +987,25 @@ export class Client {
         }
         return metadata;
     }
+    /**
+     * Apply the configured anonymizer to a run's error string.
+     *
+     * Unlike inputs/outputs, `error` is a plain string (an exception message or
+     * traceback) that can carry credentials the user never explicitly logged --
+     * e.g. an HTTP-client error whose message embeds an `Authorization` header.
+     * The anonymizer is typed `(KVMap) => KVMap`, so the string is wrapped as
+     * `{ error }`, scrubbed, and unwrapped. Mirrors the Python SDK's
+     * `Client._hide_run_error`.
+     *
+     * TODO: Update anonymizer to always nest inputs/outputs/error for consistency
+     */
+    async processError(error) {
+        if (this.anonymizer == null) {
+            return error;
+        }
+        const result = await this.anonymizer({ error });
+        return typeof result?.error === "string" ? result.error : error;
+    }
     /**
      * Filter content from new_token events to prevent streaming LLM output
      * from being uploaded via events.
@@ -994,6 +1032,9 @@ export class Client {
         if (runParams.outputs !== undefined) {
             runParams.outputs = await this.processOutputs(runParams.outputs);
         }
+        if (runParams.error !== undefined) {
+            runParams.error = await this.processError(runParams.error);
+        }
         if (runParams.extra != null && "metadata" in runParams.extra) {
             runParams.extra = {
                 ...runParams.extra,
@@ -1850,6 +1891,9 @@ export class Client {
         if (run.outputs) {
             run.outputs = await this.processOutputs(run.outputs);
         }
+        if (run.error) {
+            run.error = await this.processError(run.error);
+        }
         if (run.extra != null && "metadata" in run.extra) {
             run.extra = {
                 ...run.extra,

package/dist/experimental/anthropic/context.cjs

@@ -136,7 +136,11 @@ class StreamManager {
             }
             this.namespaces["root"].extra ??= {};
             this.namespaces["root"].extra.metadata ??= {};
-            this.namespaces["root"].extra.metadata.usage_metadata = usage;
+            // Keep the SDK's final aggregate usage available for inspection, but do not
+            // store it as `usage_metadata` on the parent chain. LangSmith rollups
+            // already aggregate child LLM usage, so parent `usage_metadata` would be
+            // counted again (notably doubling Anthropic cache-read/cache-write tokens).
+            this.namespaces["root"].extra.metadata.ls_aggregated_usage = usage;
             this.namespaces["root"].extra.metadata.is_error = message.is_error;
             this.namespaces["root"].extra.metadata.num_turns = message.num_turns;
             this.namespaces["root"].extra.metadata.session_id = message.session_id;

package/dist/experimental/anthropic/context.js

@@ -133,7 +133,11 @@ export class StreamManager {
             }
             this.namespaces["root"].extra ??= {};
             this.namespaces["root"].extra.metadata ??= {};
-            this.namespaces["root"].extra.metadata.usage_metadata = usage;
+            // Keep the SDK's final aggregate usage available for inspection, but do not
+            // store it as `usage_metadata` on the parent chain. LangSmith rollups
+            // already aggregate child LLM usage, so parent `usage_metadata` would be
+            // counted again (notably doubling Anthropic cache-read/cache-write tokens).
+            this.namespaces["root"].extra.metadata.ls_aggregated_usage = usage;
             this.namespaces["root"].extra.metadata.is_error = message.is_error;
             this.namespaces["root"].extra.metadata.num_turns = message.num_turns;
             this.namespaces["root"].extra.metadata.session_id = message.session_id;

package/dist/index.cjs

@@ -20,6 +20,6 @@ Object.defineProperty(exports, "PromptCache", { enumerable: true, get: function
 Object.defineProperty(exports, "configureGlobalPromptCache", { enumerable: true, get: function () { return index_js_1.configureGlobalPromptCache; } });
 Object.defineProperty(exports, "promptCacheSingleton", { enumerable: true, get: function () { return index_js_1.promptCacheSingleton; } });
 // Update using pnpm bump-version
-exports.__version__ = "0.7.12";
+exports.__version__ = "0.7.14";
 // Metadata key to hide a traced run from LangSmith's Messages View.
 exports.LS_MESSAGE_VIEW_EXCLUDE = "ls_message_view_exclude";

package/dist/index.d.ts

@@ -6,5 +6,5 @@ export { getDefaultProjectName } from "./utils/project.js";
 export { uuid7, uuid7FromTime } from "./uuid.js";
 export { isTracingEnabled } from "./utils/guard.js";
 export { Cache, PromptCache, type CacheConfig, type CacheMetrics, configureGlobalPromptCache, promptCacheSingleton, } from "./utils/prompt_cache/index.js";
-export declare const __version__ = "0.7.12";
+export declare const __version__ = "0.7.14";
 export declare const LS_MESSAGE_VIEW_EXCLUDE: "ls_message_view_exclude";

package/dist/index.js

@@ -6,6 +6,6 @@ export { uuid7, uuid7FromTime } from "./uuid.js";
 export { isTracingEnabled } from "./utils/guard.js";
 export { Cache, PromptCache, configureGlobalPromptCache, promptCacheSingleton, } from "./utils/prompt_cache/index.js";
 // Update using pnpm bump-version
-export const __version__ = "0.7.12";
+export const __version__ = "0.7.14";
 // Metadata key to hide a traced run from LangSmith's Messages View.
 export const LS_MESSAGE_VIEW_EXCLUDE = "ls_message_view_exclude";

package/dist/sandbox/client.cjs

@@ -7,11 +7,12 @@ exports.SandboxClient = void 0;
 const env_js_1 = require("../utils/env.cjs");
 const fetch_js_1 = require("../singletons/fetch.cjs");
 const async_caller_js_1 = require("../utils/async_caller.cjs");
+const index_js_1 = require("../_openapi_client/index.cjs");
 const sandbox_js_1 = require("./sandbox.cjs");
 const errors_js_1 = require("./errors.cjs");
 const helpers_js_1 = require("./helpers.cjs");
 const mounts_js_1 = require("./mounts.cjs");
-const index_js_1 = require("../utils/uuid/src/index.cjs");
+const index_js_2 = require("../utils/uuid/src/index.cjs");
 /**
  * Sleep that can be interrupted by an AbortSignal.
  * Resolves after `ms` milliseconds or rejects immediately if the signal fires.
@@ -296,6 +297,12 @@ class SandboxClient {
             writable: true,
             value: void 0
         });
+        Object.defineProperty(this, "_registriesClient", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         this._baseUrl = (config.apiEndpoint ?? getDefaultApiEndpoint()).replace(/\/$/, "");
         this._apiKey = config.apiKey ?? getDefaultApiKey();
         this._defaultHeaders = { ...(config.headers ?? {}) };
@@ -305,6 +312,51 @@ class SandboxClient {
             maxConcurrency: config.maxConcurrency ?? Infinity,
         });
     }
+    _apiRoot() {
+        const suffix = "/v2/sandboxes";
+        return this._baseUrl.endsWith(suffix)
+            ? this._baseUrl.slice(0, -suffix.length)
+            : this._baseUrl;
+    }
+    /**
+     * Manage sandbox image registries: create, list, retrieve, update, delete.
+     *
+     * A registry stores credentials for pulling private images. Create one, then
+     * pass its `id` as `registryId` when building a snapshot.
+     *
+     * @example
+     * ```typescript
+     * const registry = await client.registries.create({
+     *   name: "internal",
+     *   url: "registry.example.com",
+     *   username: "robot",
+     *   password: process.env.REGISTRY_PASSWORD,
+     * });
+     * const snapshot = await client.createSnapshot(
+     *   "internal-python",
+     *   "registry.example.com/internal/python:3.12",
+     *   2_147_483_648,
+     *   { registryId: registry.id },
+     * );
+     * ```
+     */
+    get registries() {
+        if (!this._registriesClient) {
+            const defaultHeaders = {
+                ...this._defaultHeaders,
+            };
+            if (this._apiKey === undefined) {
+                defaultHeaders["X-API-Key"] = null;
+            }
+            this._registriesClient = new index_js_1.Langsmith({
+                apiKey: this._apiKey,
+                baseURL: this._apiRoot(),
+                defaultHeaders,
+                fetch: this._fetchImpl,
+            });
+        }
+        return this._registriesClient.sandboxes.registries;
+    }
     /**
      * Internal fetch method that adds authentication headers.
      *
@@ -619,11 +671,11 @@ class SandboxClient {
      * @param name - Snapshot name.
      * @param dockerImage - Docker image to build from (e.g., "python:3.12-slim").
      * @param fsCapacityBytes - Filesystem capacity in bytes.
-     * @param options - Additional options (registry credentials, timeout).
+     * @param options - Additional options (registry ID, timeout).
      * @returns Snapshot in "ready" status.
      */
     async createSnapshot(name, dockerImage, fsCapacityBytes, options = {}) {
-        const { registryId, registryUrl, registryUsername, registryPassword, timeout = 60, signal, } = options;
+        const { registryId, timeout = 60, signal } = options;
         const url = `${this._baseUrl}/snapshots`;
         const payload = {
             name,
@@ -633,15 +685,6 @@ class SandboxClient {
         if (registryId !== undefined) {
             payload.registry_id = registryId;
         }
-        if (registryUrl !== undefined) {
-            payload.registry_url = registryUrl;
-        }
-        if (registryUsername !== undefined) {
-            payload.registry_username = registryUsername;
-        }
-        if (registryPassword !== undefined) {
-            payload.registry_password = registryPassword;
-        }
         const response = await this._postJson(url, payload, { signal });
         const snapshot = (await response.json());
         return this.waitForSnapshot(snapshot.id, { timeout, signal });
@@ -663,18 +706,18 @@ class SandboxClient {
     async createSnapshotFromDockerfile(name, dockerfile, fsCapacityBytes, options = {}) {
         const { context = ".", buildArgs, target, onBuildLog, vCpus, memBytes, timeout = 60, } = options;
         const { contextPath, dockerfileRel } = await resolveDockerfileContext(dockerfile, context);
-        const builderName = `snapshot-builder-${(0, index_js_1.v4)().replace(/-/g, "").slice(0, 12)}`;
+        const builderName = `snapshot-builder-${(0, index_js_2.v4)().replace(/-/g, "").slice(0, 12)}`;
         // Stage the build on the capacity-backed root filesystem, not /tmp.
         // Inside the sandbox /tmp is a RAM-backed tmpfs that fsCapacityBytes does
         // not size, and BuildKit's native snapshotter writes a full copy of every
         // layer under its root, so a /tmp build exhausts guest RAM and fails with
         // "No space left on device".
-        const buildRoot = `/var/lib/langsmith-build/${(0, index_js_1.v4)()
+        const buildRoot = `/var/lib/langsmith-build/${(0, index_js_2.v4)()
             .replace(/-/g, "")
             .slice(0, 12)}`;
         const remoteContext = `${buildRoot}/context`;
         const remoteTar = `${buildRoot}/context.tar`;
-        const imageRef = `langsmith-snapshot-build:${(0, index_js_1.v4)().replace(/-/g, "")}`;
+        const imageRef = `langsmith-snapshot-build:${(0, index_js_2.v4)().replace(/-/g, "")}`;
         const buildkitRoot = `${buildRoot}/buildkit-root`;
         const buildkitRun = `${buildRoot}/buildkit-run`;
         const builder = await this.createSandbox({

package/dist/sandbox/client.d.ts

@@ -1,6 +1,7 @@
 /**
  * Main SandboxClient class for interacting with the sandbox server API.
  */
+import { Registries } from "../_openapi_client/resources/sandboxes/registries.js";
 import type { CaptureSnapshotOptions, CreateDockerfileSnapshotOptions, CreateSandboxOptions, CreateSnapshotOptions, ListSnapshotsOptions, ResourceStatus, SandboxClientConfig, Snapshot, StartSandboxOptions, UpdateSandboxOptions, WaitForSandboxOptions, WaitForSnapshotOptions } from "./types.js";
 import { Sandbox } from "./sandbox.js";
 /**
@@ -37,7 +38,32 @@ export declare class SandboxClient {
     private _defaultHeaders;
     private _fetchImpl;
     private _caller;
+    private _registriesClient?;
     constructor(config?: SandboxClientConfig);
+    private _apiRoot;
+    /**
+     * Manage sandbox image registries: create, list, retrieve, update, delete.
+     *
+     * A registry stores credentials for pulling private images. Create one, then
+     * pass its `id` as `registryId` when building a snapshot.
+     *
+     * @example
+     * ```typescript
+     * const registry = await client.registries.create({
+     *   name: "internal",
+     *   url: "registry.example.com",
+     *   username: "robot",
+     *   password: process.env.REGISTRY_PASSWORD,
+     * });
+     * const snapshot = await client.createSnapshot(
+     *   "internal-python",
+     *   "registry.example.com/internal/python:3.12",
+     *   2_147_483_648,
+     *   { registryId: registry.id },
+     * );
+     * ```
+     */
+    get registries(): Registries;
     /**
      * Create a new Sandbox.
      *
@@ -169,7 +195,7 @@ export declare class SandboxClient {
      * @param name - Snapshot name.
      * @param dockerImage - Docker image to build from (e.g., "python:3.12-slim").
      * @param fsCapacityBytes - Filesystem capacity in bytes.
-     * @param options - Additional options (registry credentials, timeout).
+     * @param options - Additional options (registry ID, timeout).
      * @returns Snapshot in "ready" status.
      */
     createSnapshot(name: string, dockerImage: string, fsCapacityBytes: number, options?: CreateSnapshotOptions): Promise<Snapshot>;