langsmith 0.8.12 → 0.10.0

package/dist/run_trees.js

@@ -134,6 +134,10 @@ class Baggage {
         return items.join(",");
     }
 }
+function getExcludeInputsOnPatch() {
+    const value = getLangSmithEnvironmentVariable("EXCLUDE_INPUTS_ON_PATCH");
+    return value === undefined || value.toLowerCase() === "true" || value === "1";
+}
 export class RunTree {
     constructor(originalConfig) {
         Object.defineProperty(this, "id", {
@@ -731,7 +735,20 @@ export class RunTree {
             console.error(`Error in postRun for run ${this.id}:`, error);
         }
     }
+    /**
+     * Patch the run tree to the API.
+     *
+     * @param options.excludeInputs - Whether to exclude inputs from the patch
+     * request. Defaults to the value of `LANGSMITH_EXCLUDE_INPUTS_ON_PATCH`
+     * (or its `LANGCHAIN_` equivalent), which itself defaults to `true`.
+     * An explicit value overrides the environment variable for this call.
+     *
+     * Unless the environment variable is disabled, inputs added after the
+     * initial `postRun()` are not persisted unless this option is explicitly set
+     * to `false`.
+     */
     async patchRun(options) {
+        const excludeInputs = options?.excludeInputs ?? getExcludeInputsOnPatch();
         if (this.replicas && this.replicas.length > 0) {
             for (const { projectName, primary, apiKey, apiUrl, workspaceId, updates, reroot, client: replicaClient, } of this.replicas) {
                 const runData = this._remapForProject({
@@ -767,7 +784,7 @@ export class RunTree {
                 // Important that inputs is not a key in the run update
                 // if excluded because it will overwrite the run create if the
                 // two operations are merged during batching
-                if (!options?.excludeInputs) {
+                if (!excludeInputs) {
                     updatePayload.inputs = runData.inputs;
                 }
                 const targetClient = replicaClient ?? this.client;
@@ -800,7 +817,7 @@ export class RunTree {
                 // Important that inputs is not a key in the run update
                 // if excluded because it will overwrite the run create if the
                 // two operations are merged during batching
-                if (!options?.excludeInputs) {
+                if (!excludeInputs) {
                     runUpdate.inputs = this.inputs;
                 }
                 await this.client.updateRun(this.id, runUpdate);

package/dist/schemas.d.ts

@@ -288,6 +288,8 @@ export interface FeedbackBase {
     created_at: string;
     modified_at: string;
     run_id: string;
+    /** The trace the run belongs to. Equals run_id for a root run. */
+    trace_id?: string;
     key: string;
     score: ScoreType;
     value: ValueType;

package/dist/singletons/constants.cjs

@@ -1,6 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports._REPLICA_TRACE_ROOTS_KEY = exports._LC_CHILD_RUN_END_PROMISES_KEY = exports._LC_CONTEXT_VARIABLES_KEY = void 0;
+exports._processingFailed = exports._PROCESSING_FAILED_PREFIX = exports._PROCESSING_FAILED_KEY = exports._REPLICA_TRACE_ROOTS_KEY = exports._LC_CHILD_RUN_END_PROMISES_KEY = exports._LC_CONTEXT_VARIABLES_KEY = void 0;
 exports._LC_CONTEXT_VARIABLES_KEY = Symbol.for("lc:context_variables");
 exports._LC_CHILD_RUN_END_PROMISES_KEY = Symbol.for("lc:child_run_end_promises");
 exports._REPLICA_TRACE_ROOTS_KEY = Symbol.for("langsmith:replica_trace_roots");
+// Marker for a payload whose redactor threw.
+// Takes the hook name, never the error: reading e.constructor runs user code.
+exports._PROCESSING_FAILED_KEY = "ls_error";
+exports._PROCESSING_FAILED_PREFIX = "Processing failed; ";
+const _processingFailed = (payload, hook) => `${exports._PROCESSING_FAILED_PREFIX}${payload} dropped (${hook})`;
+exports._processingFailed = _processingFailed;

package/dist/singletons/constants.d.ts

@@ -1,3 +1,6 @@
 export declare const _LC_CONTEXT_VARIABLES_KEY: unique symbol;
 export declare const _LC_CHILD_RUN_END_PROMISES_KEY: unique symbol;
 export declare const _REPLICA_TRACE_ROOTS_KEY: unique symbol;
+export declare const _PROCESSING_FAILED_KEY = "ls_error";
+export declare const _PROCESSING_FAILED_PREFIX = "Processing failed; ";
+export declare const _processingFailed: (payload: "inputs" | "outputs", hook: string) => string;

package/dist/singletons/constants.js

@@ -1,3 +1,8 @@
 export const _LC_CONTEXT_VARIABLES_KEY = Symbol.for("lc:context_variables");
 export const _LC_CHILD_RUN_END_PROMISES_KEY = Symbol.for("lc:child_run_end_promises");
 export const _REPLICA_TRACE_ROOTS_KEY = Symbol.for("langsmith:replica_trace_roots");
+// Marker for a payload whose redactor threw.
+// Takes the hook name, never the error: reading e.constructor runs user code.
+export const _PROCESSING_FAILED_KEY = "ls_error";
+export const _PROCESSING_FAILED_PREFIX = "Processing failed; ";
+export const _processingFailed = (payload, hook) => `${_PROCESSING_FAILED_PREFIX}${payload} dropped (${hook})`;

package/dist/traceable.cjs

@@ -91,12 +91,26 @@ const runInputsToMap = (rawInputs) => {
 const handleRunInputs = (
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 inputs, processInputs) => {
+    // Fail closed: trace the run, but with a marker instead of raw inputs.
+    const dropped = (e) => {
+        if ((0, env_js_1.allowUnprocessedPayloads)()) {
+            console.warn("Error occurred during processInputs. Tracing unprocessed inputs " +
+                "because LANGSMITH_ALLOW_UNPROCESSED_PAYLOADS is set:", e);
+            return inputs;
+        }
+        console.warn("Error occurred during processInputs. Dropping inputs:", e);
+        return {
+            [constants_js_1._PROCESSING_FAILED_KEY]: (0, constants_js_1._processingFailed)("inputs", "processInputs"),
+        };
+    };
     try {
-        return processInputs(inputs);
+        const processed = processInputs(inputs);
+        return (0, asserts_js_1.isThenable)(processed)
+            ? Promise.resolve(processed).catch(dropped)
+            : processed;
     }
     catch (e) {
-        console.error("Error occurred during processInputs. Sending raw inputs:", e);
-        return inputs;
+        return dropped(e);
     }
 };
 const _extractUsage = (runData) => {
@@ -156,12 +170,36 @@ async function handleRunOutputs(params) {
     else {
         outputs = { outputs: rawOutputs };
     }
+    // `outputs` is overwritten by the redactor call below; keep the raw value.
+    const unprocessed = outputs;
     const childRunEndPromises = !skipChildPromiseDelay &&
         (0, run_trees_js_1.isRunTree)(runTree) &&
         constants_js_1._LC_CHILD_RUN_END_PROMISES_KEY in runTree &&
         Array.isArray(runTree[constants_js_1._LC_CHILD_RUN_END_PROMISES_KEY])
         ? Promise.all(runTree[constants_js_1._LC_CHILD_RUN_END_PROMISES_KEY] ?? [])
         : Promise.resolve();
+    // Fail closed, as for inputs: a marker rather than the raw value.
+    const droppedOutputs = (e) => {
+        if ((0, env_js_1.allowUnprocessedPayloads)()) {
+            console.error("Error occurred during processOutputs. Tracing unprocessed outputs " +
+                "because LANGSMITH_ALLOW_UNPROCESSED_PAYLOADS is set:", e);
+            return unprocessed;
+        }
+        console.error("Error occurred during processOutputs. Dropping outputs:", e);
+        return {
+            [constants_js_1._PROCESSING_FAILED_KEY]: (0, constants_js_1._processingFailed)("outputs", "processOutputs"),
+        };
+    };
+    const endOutputsDropped = async (e) => {
+        const finalOutputs = droppedOutputs(e);
+        try {
+            await childRunEndPromises;
+            await runTree?.end(finalOutputs);
+        }
+        catch (endErr) {
+            console.error("Error occurred during runTree?.end.", endErr);
+        }
+    };
     try {
         outputs = processOutputsFn(outputs);
         // TODO: Investigate making this behavior for all returned promises
@@ -173,16 +211,7 @@ async function handleRunOutputs(params) {
                 await childRunEndPromises;
                 await runTree?.end(processedOutputs);
             })
-                .catch(async (e) => {
-                console.error("Error occurred during processOutputs. Sending unprocessed outputs:", e);
-                try {
-                    await childRunEndPromises;
-                    await runTree?.end(outputs);
-                }
-                catch (e) {
-                    console.error("Error occurred during runTree?.end.", e);
-                }
-            })
+                .catch(endOutputsDropped)
                 .finally(async () => {
                 try {
                     await handleEnd({
@@ -200,7 +229,7 @@ async function handleRunOutputs(params) {
         }
     }
     catch (e) {
-        console.error("Error occurred during processOutputs. Sending unprocessed outputs:", e);
+        outputs = droppedOutputs(e);
     }
     _populateUsageMetadataAndOutputs(outputs, runTree);
     void childRunEndPromises
@@ -238,7 +267,9 @@ const getTracingRunTree = (runTree, inputs, getInvocationParams, processInputs,
     const [attached, args] = handleRunAttachments(inputs, extractAttachments);
     runTree.attachments = attached;
     const processedInputs = handleRunInputs(args, processInputs);
-    if (isAsyncFn(processInputs)) {
+    // Off the value, not the fn shape: non-async redactors return promises too.
+    // Client.prepareRunCreateOrUpdateInputs also flattens it; don't rely on that.
+    if ((0, asserts_js_1.isThenable)(processedInputs)) {
         runTree._awaitInputsOnPost = true;
     }
     runTree.inputs = processedInputs;

package/dist/traceable.js

@@ -1,8 +1,8 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { RunTree, isRunTree, isRunnableConfigLike, } from "./run_trees.js";
-import { isEnvTracingEnabled } from "./env.js";
+import { allowUnprocessedPayloads, isEnvTracingEnabled } from "./env.js";
 import { ROOT, AsyncLocalStorageProviderSingleton, getCurrentRunTree, } from "./singletons/traceable.js";
-import { _LC_CHILD_RUN_END_PROMISES_KEY, _LC_CONTEXT_VARIABLES_KEY, } from "./singletons/constants.js";
+import { _LC_CHILD_RUN_END_PROMISES_KEY, _LC_CONTEXT_VARIABLES_KEY, _PROCESSING_FAILED_KEY, _processingFailed, } from "./singletons/constants.js";
 import { isKVMap, isReadableStream, isAsyncIterable, isIteratorLike, isThenable, isGenerator, isPromiseMethod, } from "./utils/asserts.js";
 import { __version__ } from "./index.js";
 import { getOTELTrace, getOTELContext } from "./singletons/otel.js";
@@ -87,12 +87,26 @@ const runInputsToMap = (rawInputs) => {
 const handleRunInputs = (
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 inputs, processInputs) => {
+    // Fail closed: trace the run, but with a marker instead of raw inputs.
+    const dropped = (e) => {
+        if (allowUnprocessedPayloads()) {
+            console.warn("Error occurred during processInputs. Tracing unprocessed inputs " +
+                "because LANGSMITH_ALLOW_UNPROCESSED_PAYLOADS is set:", e);
+            return inputs;
+        }
+        console.warn("Error occurred during processInputs. Dropping inputs:", e);
+        return {
+            [_PROCESSING_FAILED_KEY]: _processingFailed("inputs", "processInputs"),
+        };
+    };
     try {
-        return processInputs(inputs);
+        const processed = processInputs(inputs);
+        return isThenable(processed)
+            ? Promise.resolve(processed).catch(dropped)
+            : processed;
     }
     catch (e) {
-        console.error("Error occurred during processInputs. Sending raw inputs:", e);
-        return inputs;
+        return dropped(e);
     }
 };
 const _extractUsage = (runData) => {
@@ -152,12 +166,36 @@ async function handleRunOutputs(params) {
     else {
         outputs = { outputs: rawOutputs };
     }
+    // `outputs` is overwritten by the redactor call below; keep the raw value.
+    const unprocessed = outputs;
     const childRunEndPromises = !skipChildPromiseDelay &&
         isRunTree(runTree) &&
         _LC_CHILD_RUN_END_PROMISES_KEY in runTree &&
         Array.isArray(runTree[_LC_CHILD_RUN_END_PROMISES_KEY])
         ? Promise.all(runTree[_LC_CHILD_RUN_END_PROMISES_KEY] ?? [])
         : Promise.resolve();
+    // Fail closed, as for inputs: a marker rather than the raw value.
+    const droppedOutputs = (e) => {
+        if (allowUnprocessedPayloads()) {
+            console.error("Error occurred during processOutputs. Tracing unprocessed outputs " +
+                "because LANGSMITH_ALLOW_UNPROCESSED_PAYLOADS is set:", e);
+            return unprocessed;
+        }
+        console.error("Error occurred during processOutputs. Dropping outputs:", e);
+        return {
+            [_PROCESSING_FAILED_KEY]: _processingFailed("outputs", "processOutputs"),
+        };
+    };
+    const endOutputsDropped = async (e) => {
+        const finalOutputs = droppedOutputs(e);
+        try {
+            await childRunEndPromises;
+            await runTree?.end(finalOutputs);
+        }
+        catch (endErr) {
+            console.error("Error occurred during runTree?.end.", endErr);
+        }
+    };
     try {
         outputs = processOutputsFn(outputs);
         // TODO: Investigate making this behavior for all returned promises
@@ -169,16 +207,7 @@ async function handleRunOutputs(params) {
                 await childRunEndPromises;
                 await runTree?.end(processedOutputs);
             })
-                .catch(async (e) => {
-                console.error("Error occurred during processOutputs. Sending unprocessed outputs:", e);
-                try {
-                    await childRunEndPromises;
-                    await runTree?.end(outputs);
-                }
-                catch (e) {
-                    console.error("Error occurred during runTree?.end.", e);
-                }
-            })
+                .catch(endOutputsDropped)
                 .finally(async () => {
                 try {
                     await handleEnd({
@@ -196,7 +225,7 @@ async function handleRunOutputs(params) {
         }
     }
     catch (e) {
-        console.error("Error occurred during processOutputs. Sending unprocessed outputs:", e);
+        outputs = droppedOutputs(e);
     }
     _populateUsageMetadataAndOutputs(outputs, runTree);
     void childRunEndPromises
@@ -234,7 +263,9 @@ const getTracingRunTree = (runTree, inputs, getInvocationParams, processInputs,
     const [attached, args] = handleRunAttachments(inputs, extractAttachments);
     runTree.attachments = attached;
     const processedInputs = handleRunInputs(args, processInputs);
-    if (isAsyncFn(processInputs)) {
+    // Off the value, not the fn shape: non-async redactors return promises too.
+    // Client.prepareRunCreateOrUpdateInputs also flattens it; don't rely on that.
+    if (isThenable(processedInputs)) {
         runTree._awaitInputsOnPost = true;
     }
     runTree.inputs = processedInputs;

package/dist/utils/_uuid.cjs

@@ -113,14 +113,14 @@ function _fastHash128(str) {
 /**
  * Generate a deterministic UUID v7 derived from an original UUID and a key.
  *
- * This function creates a new UUID that:
- * - Preserves the timestamp from the original UUID if it's UUID v7
- * - Uses current time if the original is not UUID v7
- * - Uses deterministic "random" bits derived from hashing the original + key
- * - Is valid UUID v7 format
+ * A pure function of `originalId` and `key`: it reads no ambient state, so the
+ * same pair always yields the same UUID, in any process, at any time. This is
+ * used for creating replica ids that are reproducible across distributed
+ * systems, including across SDK implementations.
  *
- * This is used for creating replica IDs that maintain time-ordering properties
- * while being deterministic across distributed systems.
+ * A UUID v7 original keeps its timestamp, so derived ids stay ordered by run
+ * start time. Any other original has none to keep, and the field is
+ * hash-derived: stable, but not chronological.
  *
  * @param originalId - The source UUID string (ideally UUID v7 to preserve timestamp)
  * @param key - A string key used for deterministic derivation (e.g., project name)
@@ -147,8 +147,6 @@ function nonCryptographicUuid7Deterministic(originalId, key) {
     // [8]    2 bits: variant (10) + 6 bits rand_b
     // [9-15] 56 bits: rand_b (continued)
     const b = new Uint8Array(16);
-    // Check if original is UUID v7 - if so, preserve its timestamp
-    // If not, use current time to ensure the derived UUID has a valid timestamp
     const version = getUuidVersion(originalId);
     if (version === 7) {
         // Preserve timestamp from original UUID7 (bytes 0-5)
@@ -156,16 +154,10 @@ function nonCryptographicUuid7Deterministic(originalId, key) {
         b.set(originalBytes.slice(0, 6), 0);
     }
     else {
-        // Generate fresh timestamp for non-UUID7 inputs
-        // This matches the uuid npm package's v7 implementation:
-        // https://github.com/uuidjs/uuid/blob/main/src/v7.ts
-        const msecs = Date.now();
-        b[0] = (msecs / 0x10000000000) & 0xff;
-        b[1] = (msecs / 0x100000000) & 0xff;
-        b[2] = (msecs / 0x1000000) & 0xff;
-        b[3] = (msecs / 0x10000) & 0xff;
-        b[4] = (msecs / 0x100) & 0xff;
-        b[5] = msecs & 0xff;
+        // No timestamp to preserve. Use the six hash bytes left unused below: a
+        // clock read here would make this impure, and the same id is derived
+        // from several runs, all of which must agree.
+        b.set(h.slice(10, 16), 0);
     }
     // Set version 7 (0111) in high nibble + 4 bits from hash
     b[6] = 0x70 | (h[0] & 0x0f);

package/dist/utils/_uuid.d.ts

@@ -22,14 +22,14 @@ export declare function warnIfNotUuidV7(uuidStr: string, _idType: string): void;
 /**
  * Generate a deterministic UUID v7 derived from an original UUID and a key.
  *
- * This function creates a new UUID that:
- * - Preserves the timestamp from the original UUID if it's UUID v7
- * - Uses current time if the original is not UUID v7
- * - Uses deterministic "random" bits derived from hashing the original + key
- * - Is valid UUID v7 format
+ * A pure function of `originalId` and `key`: it reads no ambient state, so the
+ * same pair always yields the same UUID, in any process, at any time. This is
+ * used for creating replica ids that are reproducible across distributed
+ * systems, including across SDK implementations.
  *
- * This is used for creating replica IDs that maintain time-ordering properties
- * while being deterministic across distributed systems.
+ * A UUID v7 original keeps its timestamp, so derived ids stay ordered by run
+ * start time. Any other original has none to keep, and the field is
+ * hash-derived: stable, but not chronological.
  *
  * @param originalId - The source UUID string (ideally UUID v7 to preserve timestamp)
  * @param key - A string key used for deterministic derivation (e.g., project name)

package/dist/utils/_uuid.js

@@ -106,14 +106,14 @@ function _fastHash128(str) {
 /**
  * Generate a deterministic UUID v7 derived from an original UUID and a key.
  *
- * This function creates a new UUID that:
- * - Preserves the timestamp from the original UUID if it's UUID v7
- * - Uses current time if the original is not UUID v7
- * - Uses deterministic "random" bits derived from hashing the original + key
- * - Is valid UUID v7 format
+ * A pure function of `originalId` and `key`: it reads no ambient state, so the
+ * same pair always yields the same UUID, in any process, at any time. This is
+ * used for creating replica ids that are reproducible across distributed
+ * systems, including across SDK implementations.
  *
- * This is used for creating replica IDs that maintain time-ordering properties
- * while being deterministic across distributed systems.
+ * A UUID v7 original keeps its timestamp, so derived ids stay ordered by run
+ * start time. Any other original has none to keep, and the field is
+ * hash-derived: stable, but not chronological.
  *
  * @param originalId - The source UUID string (ideally UUID v7 to preserve timestamp)
  * @param key - A string key used for deterministic derivation (e.g., project name)
@@ -140,8 +140,6 @@ export function nonCryptographicUuid7Deterministic(originalId, key) {
     // [8]    2 bits: variant (10) + 6 bits rand_b
     // [9-15] 56 bits: rand_b (continued)
     const b = new Uint8Array(16);
-    // Check if original is UUID v7 - if so, preserve its timestamp
-    // If not, use current time to ensure the derived UUID has a valid timestamp
     const version = getUuidVersion(originalId);
     if (version === 7) {
         // Preserve timestamp from original UUID7 (bytes 0-5)
@@ -149,16 +147,10 @@ export function nonCryptographicUuid7Deterministic(originalId, key) {
         b.set(originalBytes.slice(0, 6), 0);
     }
     else {
-        // Generate fresh timestamp for non-UUID7 inputs
-        // This matches the uuid npm package's v7 implementation:
-        // https://github.com/uuidjs/uuid/blob/main/src/v7.ts
-        const msecs = Date.now();
-        b[0] = (msecs / 0x10000000000) & 0xff;
-        b[1] = (msecs / 0x100000000) & 0xff;
-        b[2] = (msecs / 0x1000000) & 0xff;
-        b[3] = (msecs / 0x10000) & 0xff;
-        b[4] = (msecs / 0x100) & 0xff;
-        b[5] = msecs & 0xff;
+        // No timestamp to preserve. Use the six hash bytes left unused below: a
+        // clock read here would make this impure, and the same id is derived
+        // from several runs, all of which must agree.
+        b.set(h.slice(10, 16), 0);
     }
     // Set version 7 (0111) in high nibble + 4 bits from hash
     b[6] = 0x70 | (h[0] & 0x0f);

package/dist/utils/env.cjs

@@ -76,6 +76,22 @@ function getRuntimeEnvironment() {
     }
     return runtimeEnvironment;
 }
+// Substrings marking a variable as secret-bearing or personal; matched
+// case-insensitively against the variable name.
+const EXCLUDED_SUBSTRINGS = [
+    "key",
+    "secret",
+    "token",
+    "password",
+    "passwd",
+    "pwd",
+    "credential",
+    "email",
+];
+function isSensitiveEnvVarName(key) {
+    const lowered = key.toLowerCase();
+    return EXCLUDED_SUBSTRINGS.some((sub) => lowered.includes(sub));
+}
 /**
  * Retrieves the LangSmith-specific metadata from the current runtime environment.
  *
@@ -101,9 +117,7 @@ function getLangSmithEnvVarsMetadata() {
     for (const [key, value] of Object.entries(allEnvVars)) {
         if (typeof value === "string" &&
             !excluded.includes(key) &&
-            !key.toLowerCase().includes("key") &&
-            !key.toLowerCase().includes("secret") &&
-            !key.toLowerCase().includes("token")) {
+            !isSensitiveEnvVarName(key)) {
             if (key === "LANGCHAIN_REVISION_ID") {
                 envVars["revision_id"] = value;
             }
@@ -131,10 +145,7 @@ function getLangSmithEnvironmentVariables() {
             for (const [key, value] of Object.entries(process.env)) {
                 if ((key.startsWith("LANGCHAIN_") || key.startsWith("LANGSMITH_")) &&
                     value != null) {
-                    if ((key.toLowerCase().includes("key") ||
-                        key.toLowerCase().includes("secret") ||
-                        key.toLowerCase().includes("token")) &&
-                        typeof value === "string") {
+                    if (isSensitiveEnvVarName(key) && typeof value === "string") {
                         envVars[key] =
                             value.slice(0, 2) +
                                 "*".repeat(value.length - 4) +

package/dist/utils/env.js

@@ -58,6 +58,22 @@ export function getRuntimeEnvironment() {
     }
     return runtimeEnvironment;
 }
+// Substrings marking a variable as secret-bearing or personal; matched
+// case-insensitively against the variable name.
+const EXCLUDED_SUBSTRINGS = [
+    "key",
+    "secret",
+    "token",
+    "password",
+    "passwd",
+    "pwd",
+    "credential",
+    "email",
+];
+function isSensitiveEnvVarName(key) {
+    const lowered = key.toLowerCase();
+    return EXCLUDED_SUBSTRINGS.some((sub) => lowered.includes(sub));
+}
 /**
  * Retrieves the LangSmith-specific metadata from the current runtime environment.
  *
@@ -83,9 +99,7 @@ export function getLangSmithEnvVarsMetadata() {
     for (const [key, value] of Object.entries(allEnvVars)) {
         if (typeof value === "string" &&
             !excluded.includes(key) &&
-            !key.toLowerCase().includes("key") &&
-            !key.toLowerCase().includes("secret") &&
-            !key.toLowerCase().includes("token")) {
+            !isSensitiveEnvVarName(key)) {
             if (key === "LANGCHAIN_REVISION_ID") {
                 envVars["revision_id"] = value;
             }
@@ -113,10 +127,7 @@ export function getLangSmithEnvironmentVariables() {
             for (const [key, value] of Object.entries(process.env)) {
                 if ((key.startsWith("LANGCHAIN_") || key.startsWith("LANGSMITH_")) &&
                     value != null) {
-                    if ((key.toLowerCase().includes("key") ||
-                        key.toLowerCase().includes("secret") ||
-                        key.toLowerCase().includes("token")) &&
-                        typeof value === "string") {
+                    if (isSensitiveEnvVarName(key) && typeof value === "string") {
                         envVars[key] =
                             value.slice(0, 2) +
                                 "*".repeat(value.length - 4) +

package/dist/utils/redaction.cjs

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mask = mask;
+exports.redactOutside = redactOutside;
+exports.overParams = overParams;
+const index_js_1 = require("../anonymizer/index.cjs");
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Mask a value, keeping object key names so a trace shows what was set. */
+function mask(value) {
+    if (isPlainObject(value)) {
+        return Object.fromEntries(Object.keys(value).map((key) => [key, index_js_1.SECRET_PLACEHOLDER]));
+    }
+    return index_js_1.SECRET_PLACEHOLDER;
+}
+/** Copy `entry`, masking values outside `safeKeys`, so unknown keys fail closed. */
+function redactOutside(entry, safeKeys) {
+    if (!isPlainObject(entry))
+        return entry;
+    return Object.fromEntries(Object.entries(entry).map(([key, value]) => [
+        key,
+        safeKeys.has(key) ? value : index_js_1.SECRET_PLACEHOLDER,
+    ]));
+}
+/**
+ * Apply `redact` to every object argument, since `traceable` shapes a
+ * multi-argument call as `{ args: [params, requestOptions] }`.
+ */
+function overParams(inputs, redact) {
+    if (Array.isArray(inputs?.args)) {
+        return {
+            ...inputs,
+            args: inputs.args.map((arg) => isPlainObject(arg) ? redact(arg) : arg),
+        };
+    }
+    return redact(inputs);
+}

package/dist/utils/redaction.d.ts

@@ -0,0 +1,10 @@
+import type { KVMap } from "../schemas.js";
+/** Mask a value, keeping object key names so a trace shows what was set. */
+export declare function mask(value: unknown): unknown;
+/** Copy `entry`, masking values outside `safeKeys`, so unknown keys fail closed. */
+export declare function redactOutside(entry: unknown, safeKeys: ReadonlySet<string>): unknown;
+/**
+ * Apply `redact` to every object argument, since `traceable` shapes a
+ * multi-argument call as `{ args: [params, requestOptions] }`.
+ */
+export declare function overParams(inputs: KVMap, redact: (params: KVMap) => KVMap): KVMap;

package/dist/utils/redaction.js

@@ -0,0 +1,33 @@
+import { SECRET_PLACEHOLDER } from "../anonymizer/index.js";
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Mask a value, keeping object key names so a trace shows what was set. */
+export function mask(value) {
+    if (isPlainObject(value)) {
+        return Object.fromEntries(Object.keys(value).map((key) => [key, SECRET_PLACEHOLDER]));
+    }
+    return SECRET_PLACEHOLDER;
+}
+/** Copy `entry`, masking values outside `safeKeys`, so unknown keys fail closed. */
+export function redactOutside(entry, safeKeys) {
+    if (!isPlainObject(entry))
+        return entry;
+    return Object.fromEntries(Object.entries(entry).map(([key, value]) => [
+        key,
+        safeKeys.has(key) ? value : SECRET_PLACEHOLDER,
+    ]));
+}
+/**
+ * Apply `redact` to every object argument, since `traceable` shapes a
+ * multi-argument call as `{ args: [params, requestOptions] }`.
+ */
+export function overParams(inputs, redact) {
+    if (Array.isArray(inputs?.args)) {
+        return {
+            ...inputs,
+            args: inputs.args.map((arg) => isPlainObject(arg) ? redact(arg) : arg),
+        };
+    }
+    return redact(inputs);
+}

package/dist/utils/sampling.cjs

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Deterministic trace sampling, kept consistent across LangSmith SDKs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSampledById = void 0;
+const xxhash_js_1 = require("./xxhash/xxhash.cjs");
+const SAMPLING_HASH_MODULUS = 1000000n;
+// Reused across calls: constructing a TextEncoder per hash costs more than the
+// hash itself.
+const encoder = new TextEncoder();
+/**
+ * Decide whether `identifier` is sampled in at `samplingRate`.
+ *
+ * The decision is a pure function of the identifier, so every process and
+ * every SDK agrees on it, and a run's create and patch never disagree.
+ */
+const isSampledById = (identifier, samplingRate) => {
+    if (samplingRate === undefined || samplingRate >= 1) {
+        return true;
+    }
+    if (samplingRate <= 0) {
+        return false;
+    }
+    if (identifier == null) {
+        return true;
+    }
+    // XXH3-128 over the UTF-8 bytes, matching the Python SDK's `xxhash.xxh3_128`.
+    // The identifier is sampled in when its fraction of the modulus falls below
+    // the rate, which is also expressed in [0, 1).
+    const bucket = (0, xxhash_js_1.XXH3_128)(encoder.encode(identifier.toLowerCase())) % SAMPLING_HASH_MODULUS;
+    return Number(bucket) / Number(SAMPLING_HASH_MODULUS) < samplingRate;
+};
+exports.isSampledById = isSampledById;