langsmith 0.7.8 → 0.7.10

package/dist/sandbox/proxy_config.js

@@ -1,9 +1,34 @@
+const DEFAULT_GCP_AUTH_MATCH_HOSTS = [
+    "storage.googleapis.com",
+    "www.googleapis.com",
+];
+const PROVIDER_RULE_TYPES = new Set(["aws", "gcp"]);
 function requireNonEmptyString(value, field) {
     if (typeof value !== "string" || value.trim() === "") {
         throw new Error(`${field} must be a non-empty string`);
     }
     return value.trim();
 }
+function requireNonEmptyStringArray(values, field) {
+    if (!Array.isArray(values) || values.length === 0) {
+        throw new Error(`${field} must be a non-empty array of strings`);
+    }
+    return values.map((value) => requireNonEmptyString(value, field));
+}
+function requireProxyRules(rules) {
+    if (rules === undefined) {
+        return [];
+    }
+    if (!Array.isArray(rules)) {
+        throw new Error("rules must be an array of proxy rule objects");
+    }
+    return rules.map((rule) => {
+        if (rule === null || typeof rule !== "object" || Array.isArray(rule)) {
+            throw new Error("rules must be an array of proxy rule objects");
+        }
+        return rule;
+    });
+}
 /** Reference a LangSmith workspace secret in a sandbox proxy configuration. */
 export function workspaceSecret(name) {
     const normalized = requireNonEmptyString(name, "name");
@@ -27,9 +52,54 @@ export function opaqueSecret(value) {
         value: requireNonEmptyString(value, "value"),
     };
 }
-/** Build a sandbox proxy config that signs AWS HTTPS requests with SigV4. */
-export function awsAuthProxyConfig({ accessKeyId, secretAccessKey, name = "aws", enabled = true, }) {
-    const rule = {
+/** Build a sandbox proxy config from one or more proxy rules. */
+export function proxyConfig({ rules, noProxy, accessControl, } = {}) {
+    const config = {
+        rules: requireProxyRules(rules),
+    };
+    if (noProxy !== undefined) {
+        config.no_proxy = requireNonEmptyStringArray(noProxy, "noProxy");
+    }
+    if (accessControl !== undefined) {
+        config.access_control = { ...accessControl };
+    }
+    return config;
+}
+function providerRuleTypes(config) {
+    const providers = new Set();
+    for (const rule of config.rules ?? []) {
+        if (rule === null || typeof rule !== "object" || Array.isArray(rule)) {
+            continue;
+        }
+        const ruleType = rule.type;
+        if (typeof ruleType === "string" && PROVIDER_RULE_TYPES.has(ruleType)) {
+            providers.add(ruleType);
+        }
+    }
+    return providers;
+}
+export function mergeProxyConfigs(generatedConfig, explicitConfig) {
+    if (generatedConfig === undefined) {
+        return explicitConfig;
+    }
+    if (explicitConfig === undefined) {
+        return generatedConfig;
+    }
+    const generatedProviders = providerRuleTypes(generatedConfig);
+    for (const provider of providerRuleTypes(explicitConfig)) {
+        if (generatedProviders.has(provider)) {
+            throw new Error(`${provider} auth cannot be provided in both mountConfig and proxyConfig`);
+        }
+    }
+    return {
+        ...generatedConfig,
+        ...explicitConfig,
+        rules: [...(generatedConfig.rules ?? []), ...(explicitConfig.rules ?? [])],
+    };
+}
+/** Build a sandbox proxy rule that signs AWS HTTPS requests with SigV4. */
+export function awsAuth({ accessKeyId, secretAccessKey, name = "aws", enabled = true, }) {
+    return {
         name: requireNonEmptyString(name, "name"),
         type: "aws",
         enabled,
@@ -38,5 +108,17 @@ export function awsAuthProxyConfig({ accessKeyId, secretAccessKey, name = "aws",
             secret_access_key: secretAccessKey,
         },
     };
-    return { rules: [rule] };
+}
+/** Build a sandbox proxy rule that injects GCP OAuth bearer auth. */
+export function gcpAuth({ serviceAccountJson, scopes, matchHosts = DEFAULT_GCP_AUTH_MATCH_HOSTS, name = "gcp", enabled = true, }) {
+    return {
+        name: requireNonEmptyString(name, "name"),
+        type: "gcp",
+        enabled,
+        match_hosts: requireNonEmptyStringArray(matchHosts, "matchHosts"),
+        gcp: {
+            service_account_json: serviceAccountJson,
+            scopes: requireNonEmptyStringArray(scopes, "scopes"),
+        },
+    };
 }

package/dist/sandbox/types.d.ts

@@ -276,6 +276,24 @@ export interface SandboxAwsAuthRule {
         secret_access_key: SandboxProxySecret;
     };
 }
+/** GCP auth rule for sandbox proxy OAuth bearer injection. */
+export interface SandboxGcpAuthRule {
+    /** Rule name. */
+    name: string;
+    /** GCP auth rules match explicit Google API host patterns. */
+    type: "gcp";
+    /** Whether the rule is enabled. */
+    enabled?: boolean;
+    /** Google API hosts covered by this rule, such as storage.googleapis.com. */
+    match_hosts: string[];
+    /** GCP service-account credential and OAuth scopes. */
+    gcp: {
+        service_account_json: SandboxProxySecret;
+        scopes: string[];
+    };
+}
+/** Proxy rule accepted by the sandbox proxy config. */
+export type SandboxProxyRule = SandboxAwsAuthRule | SandboxGcpAuthRule | Record<string, unknown>;
 /**
  * Full proxy configuration forwarded to the sandbox server as-is (snake_case
  * so it's wire-compatible with the backend). Mirrors the server's
@@ -283,12 +301,75 @@ export interface SandboxAwsAuthRule {
  */
 export interface SandboxProxyConfig {
     /** Header-injection rules keyed by host pattern. */
-    rules?: unknown[];
+    rules?: SandboxProxyRule[];
     /** Hosts that bypass the proxy entirely. */
     no_proxy?: string[];
     /** Allow/deny list enforced at the proxy sidecar. */
     access_control?: SandboxAccessControl;
 }
+/** Optional per-mount cache configuration supported by all mount providers. */
+export interface MountCacheConfig {
+    /** Maximum VFS cache size in bytes. */
+    max_size_bytes?: number;
+    /** Seconds rclone waits before writing cached changes back. */
+    writeback_seconds?: number;
+}
+interface SandboxMountBase {
+    /** Stable mount identifier. */
+    id: string;
+    /** Absolute path inside the sandbox where the mount appears. */
+    mount_path: string;
+    /** Whether the mount should be read-only. */
+    read_only?: boolean;
+    /** Optional per-mount VFS cache configuration. */
+    cache?: MountCacheConfig;
+}
+/**
+ * S3 configuration for a sandbox mount. Field names are snake_case so the
+ * object is wire-compatible with the backend `MountSpec` type.
+ */
+export interface S3MountConfig {
+    /** S3 or S3-compatible endpoint URL. */
+    endpoint_url: string;
+    /** AWS region for signing and bucket access. */
+    region: string;
+    /** Bucket name. */
+    bucket: string;
+    /** Optional key prefix inside the bucket. */
+    prefix?: string;
+    /** Whether to use path-style addressing for S3-compatible endpoints. */
+    path_style?: boolean;
+}
+/** S3-backed sandbox mount specification. */
+export interface S3MountSpec extends SandboxMountBase {
+    /** Mount type. */
+    type: "s3";
+    /** S3 mount configuration. */
+    s3: S3MountConfig;
+}
+/** GCS configuration for a sandbox mount. */
+export interface GCSMountConfig {
+    /** GCS bucket name. */
+    bucket: string;
+    /** Optional object prefix inside the bucket. */
+    prefix?: string;
+}
+/** GCS-backed sandbox mount specification. */
+export interface GCSMountSpec extends SandboxMountBase {
+    /** Mount type. */
+    type: "gcs";
+    /** GCS mount configuration. */
+    gcs: GCSMountConfig;
+}
+/** Sandbox mount specification. */
+export type SandboxMount = S3MountSpec | GCSMountSpec;
+/** SDK-level mount config expanded into backend mounts and proxyConfig. */
+export interface SandboxMountConfig {
+    /** Mounts attached to the sandbox. */
+    mounts: SandboxMount[];
+    /** Proxy auth config required by the mounts. */
+    proxyConfig: SandboxProxyConfig;
+}
 /**
  * Options for creating a sandbox.
  */
@@ -335,12 +416,19 @@ export interface CreateSandboxOptions {
     memBytes?: number;
     /** Root filesystem capacity in bytes. */
     fsCapacityBytes?: number;
+    /**
+     * High-level mount configuration. The SDK expands it into backend `mounts`
+     * and `proxy_config` fields. If `proxyConfig` is also provided, its rules are
+     * merged with the mount-generated proxy auth rules.
+     */
+    mountConfig?: SandboxMountConfig;
     /**
      * Per-sandbox proxy configuration. Use
      * `{ access_control: { allow_list: ["github.com", "*.example.com"] } }`
      * to restrict outbound HTTPS to a set of host patterns. Forwarded to the
-     * server as-is on the wire. Use `awsAuthProxyConfig` to let the proxy sign
-     * supported AWS HTTPS requests on the sandbox's behalf.
+     * server as-is on the wire. Use `proxyConfig` with provider rule helpers
+     * such as `awsAuth` for AWS SigV4 auth or `gcpAuth` for GCP OAuth bearer
+     * auth.
      */
     proxyConfig?: SandboxProxyConfig;
 }
@@ -485,3 +573,4 @@ export interface WaitForSandboxOptions {
     /** AbortSignal for cancellation. */
     signal?: AbortSignal;
 }
+export {};

package/dist/traceable.cjs

@@ -232,7 +232,7 @@ const handleRunAttachments = (rawInputs, extractAttachments) => {
     }
 };
 const getTracingRunTree = (runTree, inputs, getInvocationParams, processInputs, extractAttachments) => {
-    if (!(0, env_js_1.isTracingEnabled)(runTree.tracingEnabled)) {
+    if (!(0, env_js_1.isEnvTracingEnabled)(runTree.tracingEnabled)) {
         return { tracingEnabled: runTree.tracingEnabled };
     }
     const [attached, args] = handleRunAttachments(inputs, extractAttachments);

package/dist/traceable.js

@@ -1,6 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { RunTree, isRunTree, isRunnableConfigLike, } from "./run_trees.js";
-import { isTracingEnabled } from "./env.js";
+import { isEnvTracingEnabled } from "./env.js";
 import { ROOT, AsyncLocalStorageProviderSingleton, getCurrentRunTree, } from "./singletons/traceable.js";
 import { _LC_CHILD_RUN_END_PROMISES_KEY, _LC_CONTEXT_VARIABLES_KEY, } from "./singletons/constants.js";
 import { isKVMap, isReadableStream, isAsyncIterable, isIteratorLike, isThenable, isGenerator, isPromiseMethod, } from "./utils/asserts.js";
@@ -228,7 +228,7 @@ const handleRunAttachments = (rawInputs, extractAttachments) => {
     }
 };
 const getTracingRunTree = (runTree, inputs, getInvocationParams, processInputs, extractAttachments) => {
-    if (!isTracingEnabled(runTree.tracingEnabled)) {
+    if (!isEnvTracingEnabled(runTree.tracingEnabled)) {
         return { tracingEnabled: runTree.tracingEnabled };
     }
     const [attached, args] = handleRunAttachments(inputs, extractAttachments);

package/dist/utils/guard.cjs

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTracingEnabled = isTracingEnabled;
+const env_js_1 = require("../env.cjs");
+const traceable_js_1 = require("../singletons/traceable.cjs");
+/**
+ * Check if tracing is enabled for the current run tree or environment.
+ *
+ * @returns `true` if tracing is enabled, `false` otherwise.
+ */
+function isTracingEnabled() {
+    return (0, traceable_js_1.getCurrentRunTree)(true)?.tracingEnabled ?? (0, env_js_1.isEnvTracingEnabled)();
+}

package/dist/utils/guard.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Check if tracing is enabled for the current run tree or environment.
+ *
+ * @returns `true` if tracing is enabled, `false` otherwise.
+ */
+export declare function isTracingEnabled(): boolean;

package/dist/utils/guard.js

@@ -0,0 +1,10 @@
+import { isEnvTracingEnabled } from "../env.js";
+import { getCurrentRunTree } from "../singletons/traceable.js";
+/**
+ * Check if tracing is enabled for the current run tree or environment.
+ *
+ * @returns `true` if tracing is enabled, `false` otherwise.
+ */
+export function isTracingEnabled() {
+    return getCurrentRunTree(true)?.tracingEnabled ?? isEnvTracingEnabled();
+}

package/dist/utils/jestlike/globals.cjs

@@ -16,7 +16,7 @@ function trackingEnabled(context) {
     if ((0, env_js_1.getEnvironmentVariable)("LANGSMITH_TEST_TRACKING") === "false") {
         return false;
     }
-    return (0, env_js_2.isTracingEnabled)();
+    return (0, env_js_2.isEnvTracingEnabled)();
 }
 exports.evaluatorLogFeedbackPromises = new Set();
 exports.syncExamplePromises = new Map();

package/dist/utils/jestlike/globals.js

@@ -1,7 +1,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Client } from "../../client.js";
 import { getEnvironmentVariable } from "../env.js";
-import { isTracingEnabled } from "../../env.js";
+import { isEnvTracingEnabled } from "../../env.js";
 export const DEFAULT_TEST_CLIENT = new Client();
 export const testWrapperAsyncLocalStorageInstance = new AsyncLocalStorage();
 export function trackingEnabled(context) {
@@ -11,7 +11,7 @@ export function trackingEnabled(context) {
     if (getEnvironmentVariable("LANGSMITH_TEST_TRACKING") === "false") {
         return false;
     }
-    return isTracingEnabled();
+    return isEnvTracingEnabled();
 }
 export const evaluatorLogFeedbackPromises = new Set();
 export const syncExamplePromises = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "langsmith",
-  "version": "0.7.8",
+  "version": "0.7.10",
   "description": "Client library to connect to the LangSmith Observability and Evaluation Platform.",
   "packageManager": "pnpm@10.33.0",
   "files": [
@@ -114,7 +114,7 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "scripts": {
-    "build": "pnpm clean && pnpm build:esm && pnpm build:cjs && node scripts/create-entrypoints.js",
+    "build": "pnpm clean && pnpm build:esm && pnpm build:cjs && node scripts/create-entrypoints.js && node scripts/fix-openapi-client-declarations.js",
     "build:typedoc": "pnpm build && rm -rf ./_build/api_refs && npx typedoc",
     "bump-version": "node scripts/bump-version.js",
     "check-version": "node scripts/check-version.js",