langsmith 0.9.0 → 0.10.0

package/dist/traceable.cjs

@@ -91,12 +91,26 @@ const runInputsToMap = (rawInputs) => {
 const handleRunInputs = (
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 inputs, processInputs) => {
+    // Fail closed: trace the run, but with a marker instead of raw inputs.
+    const dropped = (e) => {
+        if ((0, env_js_1.allowUnprocessedPayloads)()) {
+            console.warn("Error occurred during processInputs. Tracing unprocessed inputs " +
+                "because LANGSMITH_ALLOW_UNPROCESSED_PAYLOADS is set:", e);
+            return inputs;
+        }
+        console.warn("Error occurred during processInputs. Dropping inputs:", e);
+        return {
+            [constants_js_1._PROCESSING_FAILED_KEY]: (0, constants_js_1._processingFailed)("inputs", "processInputs"),
+        };
+    };
     try {
-        return processInputs(inputs);
+        const processed = processInputs(inputs);
+        return (0, asserts_js_1.isThenable)(processed)
+            ? Promise.resolve(processed).catch(dropped)
+            : processed;
     }
     catch (e) {
-        console.error("Error occurred during processInputs. Sending raw inputs:", e);
-        return inputs;
+        return dropped(e);
     }
 };
 const _extractUsage = (runData) => {
@@ -156,12 +170,36 @@ async function handleRunOutputs(params) {
     else {
         outputs = { outputs: rawOutputs };
     }
+    // `outputs` is overwritten by the redactor call below; keep the raw value.
+    const unprocessed = outputs;
     const childRunEndPromises = !skipChildPromiseDelay &&
         (0, run_trees_js_1.isRunTree)(runTree) &&
         constants_js_1._LC_CHILD_RUN_END_PROMISES_KEY in runTree &&
         Array.isArray(runTree[constants_js_1._LC_CHILD_RUN_END_PROMISES_KEY])
         ? Promise.all(runTree[constants_js_1._LC_CHILD_RUN_END_PROMISES_KEY] ?? [])
         : Promise.resolve();
+    // Fail closed, as for inputs: a marker rather than the raw value.
+    const droppedOutputs = (e) => {
+        if ((0, env_js_1.allowUnprocessedPayloads)()) {
+            console.error("Error occurred during processOutputs. Tracing unprocessed outputs " +
+                "because LANGSMITH_ALLOW_UNPROCESSED_PAYLOADS is set:", e);
+            return unprocessed;
+        }
+        console.error("Error occurred during processOutputs. Dropping outputs:", e);
+        return {
+            [constants_js_1._PROCESSING_FAILED_KEY]: (0, constants_js_1._processingFailed)("outputs", "processOutputs"),
+        };
+    };
+    const endOutputsDropped = async (e) => {
+        const finalOutputs = droppedOutputs(e);
+        try {
+            await childRunEndPromises;
+            await runTree?.end(finalOutputs);
+        }
+        catch (endErr) {
+            console.error("Error occurred during runTree?.end.", endErr);
+        }
+    };
     try {
         outputs = processOutputsFn(outputs);
         // TODO: Investigate making this behavior for all returned promises
@@ -173,16 +211,7 @@ async function handleRunOutputs(params) {
                 await childRunEndPromises;
                 await runTree?.end(processedOutputs);
             })
-                .catch(async (e) => {
-                console.error("Error occurred during processOutputs. Sending unprocessed outputs:", e);
-                try {
-                    await childRunEndPromises;
-                    await runTree?.end(outputs);
-                }
-                catch (e) {
-                    console.error("Error occurred during runTree?.end.", e);
-                }
-            })
+                .catch(endOutputsDropped)
                 .finally(async () => {
                 try {
                     await handleEnd({
@@ -200,7 +229,7 @@ async function handleRunOutputs(params) {
         }
     }
     catch (e) {
-        console.error("Error occurred during processOutputs. Sending unprocessed outputs:", e);
+        outputs = droppedOutputs(e);
     }
     _populateUsageMetadataAndOutputs(outputs, runTree);
     void childRunEndPromises
@@ -238,7 +267,9 @@ const getTracingRunTree = (runTree, inputs, getInvocationParams, processInputs,
     const [attached, args] = handleRunAttachments(inputs, extractAttachments);
     runTree.attachments = attached;
     const processedInputs = handleRunInputs(args, processInputs);
-    if (isAsyncFn(processInputs)) {
+    // Off the value, not the fn shape: non-async redactors return promises too.
+    // Client.prepareRunCreateOrUpdateInputs also flattens it; don't rely on that.
+    if ((0, asserts_js_1.isThenable)(processedInputs)) {
         runTree._awaitInputsOnPost = true;
     }
     runTree.inputs = processedInputs;

package/dist/traceable.js

@@ -1,8 +1,8 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { RunTree, isRunTree, isRunnableConfigLike, } from "./run_trees.js";
-import { isEnvTracingEnabled } from "./env.js";
+import { allowUnprocessedPayloads, isEnvTracingEnabled } from "./env.js";
 import { ROOT, AsyncLocalStorageProviderSingleton, getCurrentRunTree, } from "./singletons/traceable.js";
-import { _LC_CHILD_RUN_END_PROMISES_KEY, _LC_CONTEXT_VARIABLES_KEY, } from "./singletons/constants.js";
+import { _LC_CHILD_RUN_END_PROMISES_KEY, _LC_CONTEXT_VARIABLES_KEY, _PROCESSING_FAILED_KEY, _processingFailed, } from "./singletons/constants.js";
 import { isKVMap, isReadableStream, isAsyncIterable, isIteratorLike, isThenable, isGenerator, isPromiseMethod, } from "./utils/asserts.js";
 import { __version__ } from "./index.js";
 import { getOTELTrace, getOTELContext } from "./singletons/otel.js";
@@ -87,12 +87,26 @@ const runInputsToMap = (rawInputs) => {
 const handleRunInputs = (
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 inputs, processInputs) => {
+    // Fail closed: trace the run, but with a marker instead of raw inputs.
+    const dropped = (e) => {
+        if (allowUnprocessedPayloads()) {
+            console.warn("Error occurred during processInputs. Tracing unprocessed inputs " +
+                "because LANGSMITH_ALLOW_UNPROCESSED_PAYLOADS is set:", e);
+            return inputs;
+        }
+        console.warn("Error occurred during processInputs. Dropping inputs:", e);
+        return {
+            [_PROCESSING_FAILED_KEY]: _processingFailed("inputs", "processInputs"),
+        };
+    };
     try {
-        return processInputs(inputs);
+        const processed = processInputs(inputs);
+        return isThenable(processed)
+            ? Promise.resolve(processed).catch(dropped)
+            : processed;
     }
     catch (e) {
-        console.error("Error occurred during processInputs. Sending raw inputs:", e);
-        return inputs;
+        return dropped(e);
     }
 };
 const _extractUsage = (runData) => {
@@ -152,12 +166,36 @@ async function handleRunOutputs(params) {
     else {
         outputs = { outputs: rawOutputs };
     }
+    // `outputs` is overwritten by the redactor call below; keep the raw value.
+    const unprocessed = outputs;
     const childRunEndPromises = !skipChildPromiseDelay &&
         isRunTree(runTree) &&
         _LC_CHILD_RUN_END_PROMISES_KEY in runTree &&
         Array.isArray(runTree[_LC_CHILD_RUN_END_PROMISES_KEY])
         ? Promise.all(runTree[_LC_CHILD_RUN_END_PROMISES_KEY] ?? [])
         : Promise.resolve();
+    // Fail closed, as for inputs: a marker rather than the raw value.
+    const droppedOutputs = (e) => {
+        if (allowUnprocessedPayloads()) {
+            console.error("Error occurred during processOutputs. Tracing unprocessed outputs " +
+                "because LANGSMITH_ALLOW_UNPROCESSED_PAYLOADS is set:", e);
+            return unprocessed;
+        }
+        console.error("Error occurred during processOutputs. Dropping outputs:", e);
+        return {
+            [_PROCESSING_FAILED_KEY]: _processingFailed("outputs", "processOutputs"),
+        };
+    };
+    const endOutputsDropped = async (e) => {
+        const finalOutputs = droppedOutputs(e);
+        try {
+            await childRunEndPromises;
+            await runTree?.end(finalOutputs);
+        }
+        catch (endErr) {
+            console.error("Error occurred during runTree?.end.", endErr);
+        }
+    };
     try {
         outputs = processOutputsFn(outputs);
         // TODO: Investigate making this behavior for all returned promises
@@ -169,16 +207,7 @@ async function handleRunOutputs(params) {
                 await childRunEndPromises;
                 await runTree?.end(processedOutputs);
             })
-                .catch(async (e) => {
-                console.error("Error occurred during processOutputs. Sending unprocessed outputs:", e);
-                try {
-                    await childRunEndPromises;
-                    await runTree?.end(outputs);
-                }
-                catch (e) {
-                    console.error("Error occurred during runTree?.end.", e);
-                }
-            })
+                .catch(endOutputsDropped)
                 .finally(async () => {
                 try {
                     await handleEnd({
@@ -196,7 +225,7 @@ async function handleRunOutputs(params) {
         }
     }
     catch (e) {
-        console.error("Error occurred during processOutputs. Sending unprocessed outputs:", e);
+        outputs = droppedOutputs(e);
     }
     _populateUsageMetadataAndOutputs(outputs, runTree);
     void childRunEndPromises
@@ -234,7 +263,9 @@ const getTracingRunTree = (runTree, inputs, getInvocationParams, processInputs,
     const [attached, args] = handleRunAttachments(inputs, extractAttachments);
     runTree.attachments = attached;
     const processedInputs = handleRunInputs(args, processInputs);
-    if (isAsyncFn(processInputs)) {
+    // Off the value, not the fn shape: non-async redactors return promises too.
+    // Client.prepareRunCreateOrUpdateInputs also flattens it; don't rely on that.
+    if (isThenable(processedInputs)) {
         runTree._awaitInputsOnPost = true;
     }
     runTree.inputs = processedInputs;

package/dist/utils/_uuid.cjs

@@ -113,14 +113,14 @@ function _fastHash128(str) {
 /**
  * Generate a deterministic UUID v7 derived from an original UUID and a key.
  *
- * This function creates a new UUID that:
- * - Preserves the timestamp from the original UUID if it's UUID v7
- * - Uses current time if the original is not UUID v7
- * - Uses deterministic "random" bits derived from hashing the original + key
- * - Is valid UUID v7 format
+ * A pure function of `originalId` and `key`: it reads no ambient state, so the
+ * same pair always yields the same UUID, in any process, at any time. This is
+ * used for creating replica ids that are reproducible across distributed
+ * systems, including across SDK implementations.
  *
- * This is used for creating replica IDs that maintain time-ordering properties
- * while being deterministic across distributed systems.
+ * A UUID v7 original keeps its timestamp, so derived ids stay ordered by run
+ * start time. Any other original has none to keep, and the field is
+ * hash-derived: stable, but not chronological.
  *
  * @param originalId - The source UUID string (ideally UUID v7 to preserve timestamp)
  * @param key - A string key used for deterministic derivation (e.g., project name)
@@ -147,8 +147,6 @@ function nonCryptographicUuid7Deterministic(originalId, key) {
     // [8]    2 bits: variant (10) + 6 bits rand_b
     // [9-15] 56 bits: rand_b (continued)
     const b = new Uint8Array(16);
-    // Check if original is UUID v7 - if so, preserve its timestamp
-    // If not, use current time to ensure the derived UUID has a valid timestamp
     const version = getUuidVersion(originalId);
     if (version === 7) {
         // Preserve timestamp from original UUID7 (bytes 0-5)
@@ -156,16 +154,10 @@ function nonCryptographicUuid7Deterministic(originalId, key) {
         b.set(originalBytes.slice(0, 6), 0);
     }
     else {
-        // Generate fresh timestamp for non-UUID7 inputs
-        // This matches the uuid npm package's v7 implementation:
-        // https://github.com/uuidjs/uuid/blob/main/src/v7.ts
-        const msecs = Date.now();
-        b[0] = (msecs / 0x10000000000) & 0xff;
-        b[1] = (msecs / 0x100000000) & 0xff;
-        b[2] = (msecs / 0x1000000) & 0xff;
-        b[3] = (msecs / 0x10000) & 0xff;
-        b[4] = (msecs / 0x100) & 0xff;
-        b[5] = msecs & 0xff;
+        // No timestamp to preserve. Use the six hash bytes left unused below: a
+        // clock read here would make this impure, and the same id is derived
+        // from several runs, all of which must agree.
+        b.set(h.slice(10, 16), 0);
     }
     // Set version 7 (0111) in high nibble + 4 bits from hash
     b[6] = 0x70 | (h[0] & 0x0f);

package/dist/utils/_uuid.d.ts

@@ -22,14 +22,14 @@ export declare function warnIfNotUuidV7(uuidStr: string, _idType: string): void;
 /**
  * Generate a deterministic UUID v7 derived from an original UUID and a key.
  *
- * This function creates a new UUID that:
- * - Preserves the timestamp from the original UUID if it's UUID v7
- * - Uses current time if the original is not UUID v7
- * - Uses deterministic "random" bits derived from hashing the original + key
- * - Is valid UUID v7 format
+ * A pure function of `originalId` and `key`: it reads no ambient state, so the
+ * same pair always yields the same UUID, in any process, at any time. This is
+ * used for creating replica ids that are reproducible across distributed
+ * systems, including across SDK implementations.
  *
- * This is used for creating replica IDs that maintain time-ordering properties
- * while being deterministic across distributed systems.
+ * A UUID v7 original keeps its timestamp, so derived ids stay ordered by run
+ * start time. Any other original has none to keep, and the field is
+ * hash-derived: stable, but not chronological.
  *
  * @param originalId - The source UUID string (ideally UUID v7 to preserve timestamp)
  * @param key - A string key used for deterministic derivation (e.g., project name)

package/dist/utils/_uuid.js

@@ -106,14 +106,14 @@ function _fastHash128(str) {
 /**
  * Generate a deterministic UUID v7 derived from an original UUID and a key.
  *
- * This function creates a new UUID that:
- * - Preserves the timestamp from the original UUID if it's UUID v7
- * - Uses current time if the original is not UUID v7
- * - Uses deterministic "random" bits derived from hashing the original + key
- * - Is valid UUID v7 format
+ * A pure function of `originalId` and `key`: it reads no ambient state, so the
+ * same pair always yields the same UUID, in any process, at any time. This is
+ * used for creating replica ids that are reproducible across distributed
+ * systems, including across SDK implementations.
  *
- * This is used for creating replica IDs that maintain time-ordering properties
- * while being deterministic across distributed systems.
+ * A UUID v7 original keeps its timestamp, so derived ids stay ordered by run
+ * start time. Any other original has none to keep, and the field is
+ * hash-derived: stable, but not chronological.
  *
  * @param originalId - The source UUID string (ideally UUID v7 to preserve timestamp)
  * @param key - A string key used for deterministic derivation (e.g., project name)
@@ -140,8 +140,6 @@ export function nonCryptographicUuid7Deterministic(originalId, key) {
     // [8]    2 bits: variant (10) + 6 bits rand_b
     // [9-15] 56 bits: rand_b (continued)
     const b = new Uint8Array(16);
-    // Check if original is UUID v7 - if so, preserve its timestamp
-    // If not, use current time to ensure the derived UUID has a valid timestamp
     const version = getUuidVersion(originalId);
     if (version === 7) {
         // Preserve timestamp from original UUID7 (bytes 0-5)
@@ -149,16 +147,10 @@ export function nonCryptographicUuid7Deterministic(originalId, key) {
         b.set(originalBytes.slice(0, 6), 0);
     }
     else {
-        // Generate fresh timestamp for non-UUID7 inputs
-        // This matches the uuid npm package's v7 implementation:
-        // https://github.com/uuidjs/uuid/blob/main/src/v7.ts
-        const msecs = Date.now();
-        b[0] = (msecs / 0x10000000000) & 0xff;
-        b[1] = (msecs / 0x100000000) & 0xff;
-        b[2] = (msecs / 0x1000000) & 0xff;
-        b[3] = (msecs / 0x10000) & 0xff;
-        b[4] = (msecs / 0x100) & 0xff;
-        b[5] = msecs & 0xff;
+        // No timestamp to preserve. Use the six hash bytes left unused below: a
+        // clock read here would make this impure, and the same id is derived
+        // from several runs, all of which must agree.
+        b.set(h.slice(10, 16), 0);
     }
     // Set version 7 (0111) in high nibble + 4 bits from hash
     b[6] = 0x70 | (h[0] & 0x0f);

package/dist/utils/redaction.cjs

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mask = mask;
+exports.redactOutside = redactOutside;
+exports.overParams = overParams;
+const index_js_1 = require("../anonymizer/index.cjs");
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Mask a value, keeping object key names so a trace shows what was set. */
+function mask(value) {
+    if (isPlainObject(value)) {
+        return Object.fromEntries(Object.keys(value).map((key) => [key, index_js_1.SECRET_PLACEHOLDER]));
+    }
+    return index_js_1.SECRET_PLACEHOLDER;
+}
+/** Copy `entry`, masking values outside `safeKeys`, so unknown keys fail closed. */
+function redactOutside(entry, safeKeys) {
+    if (!isPlainObject(entry))
+        return entry;
+    return Object.fromEntries(Object.entries(entry).map(([key, value]) => [
+        key,
+        safeKeys.has(key) ? value : index_js_1.SECRET_PLACEHOLDER,
+    ]));
+}
+/**
+ * Apply `redact` to every object argument, since `traceable` shapes a
+ * multi-argument call as `{ args: [params, requestOptions] }`.
+ */
+function overParams(inputs, redact) {
+    if (Array.isArray(inputs?.args)) {
+        return {
+            ...inputs,
+            args: inputs.args.map((arg) => isPlainObject(arg) ? redact(arg) : arg),
+        };
+    }
+    return redact(inputs);
+}

package/dist/utils/redaction.d.ts

@@ -0,0 +1,10 @@
+import type { KVMap } from "../schemas.js";
+/** Mask a value, keeping object key names so a trace shows what was set. */
+export declare function mask(value: unknown): unknown;
+/** Copy `entry`, masking values outside `safeKeys`, so unknown keys fail closed. */
+export declare function redactOutside(entry: unknown, safeKeys: ReadonlySet<string>): unknown;
+/**
+ * Apply `redact` to every object argument, since `traceable` shapes a
+ * multi-argument call as `{ args: [params, requestOptions] }`.
+ */
+export declare function overParams(inputs: KVMap, redact: (params: KVMap) => KVMap): KVMap;

package/dist/utils/redaction.js

@@ -0,0 +1,33 @@
+import { SECRET_PLACEHOLDER } from "../anonymizer/index.js";
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Mask a value, keeping object key names so a trace shows what was set. */
+export function mask(value) {
+    if (isPlainObject(value)) {
+        return Object.fromEntries(Object.keys(value).map((key) => [key, SECRET_PLACEHOLDER]));
+    }
+    return SECRET_PLACEHOLDER;
+}
+/** Copy `entry`, masking values outside `safeKeys`, so unknown keys fail closed. */
+export function redactOutside(entry, safeKeys) {
+    if (!isPlainObject(entry))
+        return entry;
+    return Object.fromEntries(Object.entries(entry).map(([key, value]) => [
+        key,
+        safeKeys.has(key) ? value : SECRET_PLACEHOLDER,
+    ]));
+}
+/**
+ * Apply `redact` to every object argument, since `traceable` shapes a
+ * multi-argument call as `{ args: [params, requestOptions] }`.
+ */
+export function overParams(inputs, redact) {
+    if (Array.isArray(inputs?.args)) {
+        return {
+            ...inputs,
+            args: inputs.args.map((arg) => isPlainObject(arg) ? redact(arg) : arg),
+        };
+    }
+    return redact(inputs);
+}

package/dist/utils/sampling.cjs

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Deterministic trace sampling, kept consistent across LangSmith SDKs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSampledById = void 0;
+const xxhash_js_1 = require("./xxhash/xxhash.cjs");
+const SAMPLING_HASH_MODULUS = 1000000n;
+// Reused across calls: constructing a TextEncoder per hash costs more than the
+// hash itself.
+const encoder = new TextEncoder();
+/**
+ * Decide whether `identifier` is sampled in at `samplingRate`.
+ *
+ * The decision is a pure function of the identifier, so every process and
+ * every SDK agrees on it, and a run's create and patch never disagree.
+ */
+const isSampledById = (identifier, samplingRate) => {
+    if (samplingRate === undefined || samplingRate >= 1) {
+        return true;
+    }
+    if (samplingRate <= 0) {
+        return false;
+    }
+    if (identifier == null) {
+        return true;
+    }
+    // XXH3-128 over the UTF-8 bytes, matching the Python SDK's `xxhash.xxh3_128`.
+    // The identifier is sampled in when its fraction of the modulus falls below
+    // the rate, which is also expressed in [0, 1).
+    const bucket = (0, xxhash_js_1.XXH3_128)(encoder.encode(identifier.toLowerCase())) % SAMPLING_HASH_MODULUS;
+    return Number(bucket) / Number(SAMPLING_HASH_MODULUS) < samplingRate;
+};
+exports.isSampledById = isSampledById;

package/dist/utils/sampling.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Deterministic trace sampling, kept consistent across LangSmith SDKs.
+ */
+/**
+ * Decide whether `identifier` is sampled in at `samplingRate`.
+ *
+ * The decision is a pure function of the identifier, so every process and
+ * every SDK agrees on it, and a run's create and patch never disagree.
+ */
+export declare const isSampledById: (identifier: string | null | undefined, samplingRate: number | undefined) => boolean;

package/dist/utils/sampling.js

@@ -0,0 +1,30 @@
+/**
+ * Deterministic trace sampling, kept consistent across LangSmith SDKs.
+ */
+import { XXH3_128 } from "./xxhash/xxhash.js";
+const SAMPLING_HASH_MODULUS = 1000000n;
+// Reused across calls: constructing a TextEncoder per hash costs more than the
+// hash itself.
+const encoder = new TextEncoder();
+/**
+ * Decide whether `identifier` is sampled in at `samplingRate`.
+ *
+ * The decision is a pure function of the identifier, so every process and
+ * every SDK agrees on it, and a run's create and patch never disagree.
+ */
+export const isSampledById = (identifier, samplingRate) => {
+    if (samplingRate === undefined || samplingRate >= 1) {
+        return true;
+    }
+    if (samplingRate <= 0) {
+        return false;
+    }
+    if (identifier == null) {
+        return true;
+    }
+    // XXH3-128 over the UTF-8 bytes, matching the Python SDK's `xxhash.xxh3_128`.
+    // The identifier is sampled in when its fraction of the modulus falls below
+    // the rate, which is also expressed in [0, 1).
+    const bucket = XXH3_128(encoder.encode(identifier.toLowerCase())) % SAMPLING_HASH_MODULUS;
+    return Number(bucket) / Number(SAMPLING_HASH_MODULUS) < samplingRate;
+};

package/dist/wrappers/anthropic.cjs

@@ -5,7 +5,7 @@ exports.createUsageMetadata = createUsageMetadata;
 const anthropic_managed_js_1 = require("./utils/anthropic_managed.cjs");
 const traceable_js_1 = require("../traceable.cjs");
 const usage_js_1 = require("../utils/usage.cjs");
-const index_js_1 = require("../anonymizer/index.cjs");
+const redaction_js_1 = require("../utils/redaction.cjs");
 const TRACED_INVOCATION_KEYS = ["top_k", "top_p", "stream", "thinking"];
 /** Keys of an MCP server definition that are safe to trace. */
 const MCP_SERVER_SAFE_KEYS = new Set([
@@ -14,27 +14,20 @@ const MCP_SERVER_SAFE_KEYS = new Set([
     "url",
     "tool_configuration",
 ]);
-/**
- * Mask credentials in `mcp_servers` before tracing. Anything outside
- * {@link MCP_SERVER_SAFE_KEYS} keeps its name but gets
- * {@link SECRET_PLACEHOLDER} as its value, so the trace shows the field was set
- * without exposing it, and fields the API adds later are masked by default.
- *
- * Returns new objects; the caller's are also sent to Anthropic.
- */
+/** Mask `mcp_servers` credentials outside {@link MCP_SERVER_SAFE_KEYS}. */
 function redactMcpServers(servers) {
     if (!Array.isArray(servers))
         return servers;
-    return servers.map((server) => {
-        if (typeof server !== "object" || server == null || Array.isArray(server)) {
-            return server;
-        }
-        return Object.fromEntries(Object.entries(server).map(([key, value]) => [
-            key,
-            MCP_SERVER_SAFE_KEYS.has(key) ? value : index_js_1.SECRET_PLACEHOLDER,
-        ]));
-    });
+    return servers.map((server) => (0, redaction_js_1.redactOutside)(server, MCP_SERVER_SAFE_KEYS));
 }
+/** Request-transport keys that are credentials by construction. */
+const TRANSPORT_SECRET_KEYS = new Set([
+    "headers",
+    "query",
+    "extra_headers",
+    "extra_body",
+    "extra_query",
+]);
 /**
  * Create usage metadata from Anthropic's token usage format.
  */
@@ -246,17 +239,18 @@ const wrapAnthropic = (anthropic, options) => {
         ...options,
         metadata: restMetadata,
     };
-    /**
-     * Transform system parameter into visible message for playground editability.
-     * This provides parity with the Python SDK behavior and enables system prompts
-     * to be viewed and edited in the LangSmith playground.
-     */
-    function processTracedInputs(params) {
+    /** Mask credentials and surface `system` as a message the playground can edit. */
+    function redactAnthropicParams(params) {
         // Copy first: `params` also goes to the API and must keep its real values.
         const processed = { ...params };
         if (processed.mcp_servers != null) {
             processed.mcp_servers = redactMcpServers(processed.mcp_servers);
         }
+        for (const key of TRANSPORT_SECRET_KEYS) {
+            if (processed[key] != null) {
+                processed[key] = (0, redaction_js_1.mask)(processed[key]);
+            }
+        }
         if (!params.system) {
             return processed;
         }
@@ -275,6 +269,9 @@ const wrapAnthropic = (anthropic, options) => {
         delete processed.system;
         return processed;
     }
+    function processTracedInputs(inputs) {
+        return (0, redaction_js_1.overParams)(inputs, redactAnthropicParams);
+    }
     // Common configuration for messages.create
     const messagesCreateConfig = {
         name: "ChatAnthropic",