agentfootprint 9.10.0 → 9.12.0

package/dist/esm/adapters/hosting/agentcore.js

@@ -28,7 +28,10 @@
  * and the caller's conversation arrives in the
  * `X-Amzn-Bedrock-AgentCore-Runtime-Session-Id` header rather than in the body,
  * which is the one thing paths-and-bodies configuration alone could not
- * express before this release.
+ * express before this release. Its sibling
+ * `X-Amzn-Bedrock-AgentCore-Runtime-User-Id` carries WHO is calling (9.12.0) —
+ * two headers, two different facts, and the second is why a served run can name
+ * an actor in its audit trail without anybody configuring one.
  *
  * ── The second door ──────────────────────────────────────────────────────────
  * `/ws` is this runtime's answer for a caller that cannot host an inbound
@@ -83,6 +86,31 @@ const RUNTIME_PORT = 8080;
  * front of the container is free to re-case them.
  */
 const SESSION_HEADER = 'X-Amzn-Bedrock-AgentCore-Runtime-Session-Id';
+/**
+ * The header the runtime puts the caller's END USER in — the second half of
+ * "who is this request for", and the documented inbound source for per-user
+ * identity (9.12.0).
+ *
+ * **Both names are the SDK's, not a guess.** `InvokeAgentRuntimeRequest` binds
+ * `runtimeSessionId` to {@link SESSION_HEADER} and `runtimeUserId` to this one,
+ * and the SDK describes this one as "an identifier for the end user making the
+ * request… passed through to the runtime container" — which is what makes the
+ * container's side of it this adapter's business. Verified against a real
+ * install of `@aws-sdk/client-bedrock-agentcore` before this shipped.
+ *
+ * Matched case-insensitively, through the same `headerValue` the session uses,
+ * for the same reason: a proxy in front of the container re-cases freely, and
+ * two header readers that disagree about casing is how one door sees a user the
+ * other cannot.
+ *
+ * **What it is worth, plainly.** The runtime passes this through from its front
+ * door, so its trustworthiness is that door's inbound-auth configuration — with
+ * JWT auth in front, it is the authenticated caller; on a container somebody
+ * exposed directly, it is a string anyone can send. It is read HERE and nowhere
+ * else for exactly that reason: the generic JSON wire has no such door in front
+ * of it, so it reads no such header.
+ */
+const USER_HEADER = 'X-Amzn-Bedrock-AgentCore-Runtime-User-Id';
 /**
  * What the `/ws` door caps, as the runtime imposes it — **32KB per frame and a
  * 15-minute idle timeout.**
@@ -166,6 +194,12 @@ export function agentCoreRuntimeWire(busy) {
             // caller-adjacent data, not identity — the port says so and it is just as
             // true here.
             const sessionId = headerValue(facts, SESSION_HEADER);
+            // WHO the request is for — the other header the runtime forwards, and a
+            // different fact from the session beside it: a session is a thread, this
+            // is a person. Read as-is and absent when absent; the runtime sends it
+            // only when the caller supplied one, and deriving a user from a session
+            // id would put a thread's name in the actor's place.
+            const userId = headerValue(facts, USER_HEADER);
             // A person's answer to a run that stopped to ask. Read as-is: what a
             // decision looks like is the tool author's business, not this dialect's.
             // Without it a deployment here could start turns but never finish one
@@ -174,6 +208,7 @@ export function agentCoreRuntimeWire(busy) {
             return {
                 input,
                 ...(sessionId !== undefined && { sessionId }),
+                ...(userId !== undefined && { userId }),
                 ...(decision !== undefined && { decision }),
             };
         },

package/dist/esm/adapters/hosting/agentcore.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.js","sourceRoot":"","sources":["../../../../src/adapters/hosting/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AASlE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,wEAAwE;AAExE,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEzC,wFAAwF;AACxF,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B;;;;GAIG;AACH,MAAM,cAAc,GAAG,6CAA6C,CAAC;AACrE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,mBAAmB,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAW,CAAC;AAChF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAqF1D;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,OAAO;QACL,WAAW,CAAC,KAAuB;YACjC,qEAAqE;YACrE,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,yDAAyD;YACzD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACrD,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,oEAAoE;YACpE,0EAA0E;YAC1E,aAAa;YACb,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YACrD,qEAAqE;YACrE,yEAAyE;YACzE,sEAAsE;YACtE,yBAAyB;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,OAAO;gBACL,KAAK;gBACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC7C,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC5C,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACb,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACrD,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnD,CAAC;QACF,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvD,0EAA0E;QAC1E,gDAAgD;QAChD,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3F,sEAAsE;QACtE,qEAAqE;QACrE,8BAA8B;QAC9B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QAC7B,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAClE,gBAAgB,EAAE,yBAAyB;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAqB;IAC7D,MAAM,SAAS,GACb,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAChF,OAAO;QACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE;YACrD,yEAAyE;YACzE,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,gBAAgB;YAChB,QAAQ,EAAE,OAAO,CAAC,IAAI;SACvB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,KAAqB,EAAE,GAAG,KAAe;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAC7B,OAA2B;IAE3B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE3C,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,kFAAkF;IAClF,8EAA8E;IAC9E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IACrE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,MAAM,kBAAkB,gDAAgD;YACtE,IAAI,kBAAkB,8DAA8D;YACpF,mFAAmF;YACnF,uCAAuC,kBAAkB,uBAAuB;YAChF,IAAI,kBAAkB,IAAI,CAC7B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,KAAK,CACb,QAAQ,kBAAkB,sDAAsD;YAC9E,mCAAmC,GAAG,iDAAiD;YACvF,6EAA6E,CAChF,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,qCAAqC,CAAC,CAAC;IAErF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO;QAAE,MAAM,CAAC,mCAAmC,CAAC,CAAC;IAEzF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACxD,yEAAyE;IACzE,4EAA4E;IAC5E,gCAAgC;IAChC,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,iDAAiD,CAAC,CAAC;IAE7F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAuC,EAAE;IAC5E,OAAO,QAAQ,CAAC;QACd,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,WAAW;QACvB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,iBAAiB;QAC/D,kBAAkB,EAAE,mBAAmB;QACvC,wEAAwE;QACxE,sEAAsE;QACtE,2EAA2E;QAC3E,4EAA4E;QAC5E,uCAAuC;QACvC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAC9B,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;gBACzD,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aACtE;YACH,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QACpF,4EAA4E;QAC5E,2EAA2E;QAC3E,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC;AAoBD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAC;AAuFrE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AASD,SAAS,YAAY,CAAC,OAAqC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,4BAA4B,CAAC;IAE1D,KAAK,UAAU,QAAQ;QACrB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACjB,kCAAkC,IAAI,kBAAmB,GAAa,CAAC,OAAO,KAAK;gBACjF,mFAAmF;gBACnF,iDAAiD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAI,MAAsC,EAAE,QAAQ,CAAC;QACnE,OAAO,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAC7C,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,QAA8C,EAAE;YAC1E,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,mEAAmE;YACnE,iDAAiD;YACjD,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAA4B;YAC3D,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAgB;gBACxB,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE;aACtD,CAAC;YACF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YAC/C,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,SAAS,mBAAmB,CAAC,OAAuC;IAClE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;gBACnC,QAAQ;gBACR,OAAO;gBACP,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;gBACnC,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9B,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,uEAAuE;YACvE,2DAA2D;YAC3D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3F,yEAAyE;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,uEAAuE;YACvE,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAA4B;YAC3D,MAAM,MAAM,CAAC,WAAW,CAAC;gBACvB,QAAQ;gBACR,OAAO;gBACP,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;gBACnC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,sFAAsF;AACtF,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,IAAI,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,yEAAyE;IACzE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAWD;;;;;;;;;;;;;GAaG;AACH,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,yEAAyE;QACzE,6DAA6D;QAC7D,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;YAAE,SAAS;QACrE,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;QAC/C,oEAAoE;QACpE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QAClD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,MAA0B,EAC1B,QAA2C;IAE3C,IAAI,GAAqC,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,GAAG,GAAG,WAAW,CAAmC,mCAAmC,CAAC,CAAC;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACpD,wDAAwD;gBACxD,6DAA6D;gBAC7D,mEAAmE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAE1E,MAAM,IAAI,GAAG,KAAK,EAChB,IAAmD,EACnD,IAAY,EACZ,KAAc,EACI,EAAE;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,uEAAuE,IAAI,oBAAoB,CAChG,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC1D,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,EAAE;gBACvD,QAAQ;gBACR,OAAO;gBACP,SAAS;gBACT,cAAc,EAAE,IAAI,IAAI,EAAE;gBAC1B,qEAAqE;gBACrE,iEAAiE;gBACjE,oEAAoE;gBACpE,sEAAsE;gBACtE,wEAAwE;gBACxE,uEAAuE;gBACvE,yEAAyE;gBACzE,8DAA8D;gBAC9D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE;YAC3D,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,EAAE;gBACrE,QAAQ;gBACR,OAAO;gBACP,SAAS;gBACT,eAAe,EAAE,IAAI;gBACrB,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;aAChD,CAAC,CAA+E,CAAC;YAClF,MAAM,MAAM,GAA4B,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC7E,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;gBAC5B,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;aAC7C,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"agentcore.js","sourceRoot":"","sources":["../../../../src/adapters/hosting/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AASlE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,wEAAwE;AAExE,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEzC,wFAAwF;AACxF,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B;;;;GAIG;AACH,MAAM,cAAc,GAAG,6CAA6C,CAAC;AACrE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,GAAG,0CAA0C,CAAC;AAC/D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,mBAAmB,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAW,CAAC;AAChF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAqF1D;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,OAAO;QACL,WAAW,CAAC,KAAuB;YACjC,qEAAqE;YACrE,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,yDAAyD;YACzD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YACrD,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,oEAAoE;YACpE,0EAA0E;YAC1E,aAAa;YACb,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YACrD,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,qDAAqD;YACrD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC/C,qEAAqE;YACrE,yEAAyE;YACzE,sEAAsE;YACtE,yBAAyB;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,OAAO;gBACL,KAAK;gBACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;aAC5C,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACb,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACrD,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;SACnD,CAAC;QACF,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACvD,0EAA0E;QAC1E,gDAAgD;QAChD,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3F,sEAAsE;QACtE,qEAAqE;QACrE,8BAA8B;QAC9B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QAC7B,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAClE,gBAAgB,EAAE,yBAAyB;KAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAqB;IAC7D,MAAM,SAAS,GACb,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAChF,OAAO;QACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI;YAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE;YACrD,yEAAyE;YACzE,yEAAyE;YACzE,oEAAoE;YACpE,yEAAyE;YACzE,gBAAgB;YAChB,QAAQ,EAAE,OAAO,CAAC,IAAI;SACvB,CAAC;KACH,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,UAAU,CAAC,KAAqB,EAAE,GAAG,KAAe;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAC7B,OAA2B;IAE3B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG,kBAAkB,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE3C,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,kFAAkF;IAClF,8EAA8E;IAC9E,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IACrE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,MAAM,kBAAkB,gDAAgD;YACtE,IAAI,kBAAkB,8DAA8D;YACpF,mFAAmF;YACnF,uCAAuC,kBAAkB,uBAAuB;YAChF,IAAI,kBAAkB,IAAI,CAC7B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,CAAC,GAAW,EAAS,EAAE;QACpC,MAAM,IAAI,KAAK,CACb,QAAQ,kBAAkB,sDAAsD;YAC9E,mCAAmC,GAAG,iDAAiD;YACvF,6EAA6E,CAChF,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAChD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,CAAC,qCAAqC,CAAC,CAAC;IAErF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO;QAAE,MAAM,CAAC,mCAAmC,CAAC,CAAC;IAEzF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACxD,yEAAyE;IACzE,4EAA4E;IAC5E,gCAAgC;IAChC,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,iDAAiD,CAAC,CAAC;IAE7F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAuC,EAAE;IAC5E,OAAO,QAAQ,CAAC;QACd,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,UAAU,EAAE,WAAW;QACvB,UAAU,EAAE,WAAW;QACvB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,iBAAiB;QAC/D,kBAAkB,EAAE,mBAAmB;QACvC,wEAAwE;QACxE,sEAAsE;QACtE,2EAA2E;QAC3E,4EAA4E;QAC5E,uCAAuC;QACvC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAC9B,CAAC,CAAC;gBACE,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;gBACzD,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;aACtE;YACH,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,YAAY,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QACpF,4EAA4E;QAC5E,2EAA2E;QAC3E,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;KAC/E,CAAC,CAAC;AACL,CAAC;AAoBD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAC;AAuFrE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AASD,SAAS,YAAY,CAAC,OAAqC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,4BAA4B,CAAC;IAE1D,KAAK,UAAU,QAAQ;QACrB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC5D,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,SAAS,CACjB,kCAAkC,IAAI,kBAAmB,GAAa,CAAC,OAAO,KAAK;gBACjF,mFAAmF;gBACnF,iDAAiD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAI,MAAsC,EAAE,QAAQ,CAAC;QACnE,OAAO,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAC7C,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,QAA8C,EAAE;YAC1E,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,mEAAmE;YACnE,iDAAiD;YACjD,OAAO,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAA4B;YAC3D,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAgB;gBACxB,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE;aACtD,CAAC;YACF,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;YAC/C,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wEAAwE;AAExE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,SAAS,mBAAmB,CAAC,OAAuC;IAClE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,SAAiB;YAC7B,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;gBACnC,QAAQ;gBACR,OAAO;gBACP,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;gBACnC,UAAU,EAAE,CAAC;aACd,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9B,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,uEAAuE;YACvE,2DAA2D;YAC3D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3F,yEAAyE;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,uEAAuE;YACvE,OAAO,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAA4B;YAC3D,MAAM,MAAM,CAAC,WAAW,CAAC;gBACvB,QAAQ;gBACR,OAAO;gBACP,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC;gBACnC,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,sFAAsF;AACtF,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,IAAI,cAAc;QAAE,OAAO,IAAI,CAAC;IAC/C,yEAAyE;IACzE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,KAAK,CAAC,CAAS;IACtB,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAWD;;;;;;;;;;;;;GAaG;AACH,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,yEAAyE;QACzE,6DAA6D;QAC7D,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC;YAAE,SAAS;QACrE,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;QAC/C,oEAAoE;QACpE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QAClD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC1B,MAA0B,EAC1B,QAA2C;IAE3C,IAAI,GAAqC,CAAC;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,GAAG,QAAQ,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,GAAG,GAAG,WAAW,CAAmC,mCAAmC,CAAC,CAAC;QAC3F,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,sDAAsD;gBACpD,wDAAwD;gBACxD,6DAA6D;gBAC7D,mEAAmE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAE1E,MAAM,IAAI,GAAG,KAAK,EAChB,IAAmD,EACnD,IAAY,EACZ,KAAc,EACI,EAAE;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,uEAAuE,IAAI,oBAAoB,CAChG,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC1D,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,EAAE;gBACvD,QAAQ;gBACR,OAAO;gBACP,SAAS;gBACT,cAAc,EAAE,IAAI,IAAI,EAAE;gBAC1B,qEAAqE;gBACrE,iEAAiE;gBACjE,oEAAoE;gBACpE,sEAAsE;gBACtE,wEAAwE;gBACxE,uEAAuE;gBACvE,yEAAyE;gBACzE,8DAA8D;gBAC9D,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE;YAC3D,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,EAAE;gBACrE,QAAQ;gBACR,OAAO;gBACP,SAAS;gBACT,eAAe,EAAE,IAAI;gBACrB,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;aAChD,CAAC,CAA+E,CAAC;YAClF,MAAM,MAAM,GAA4B,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC7E,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;gBAC5B,QAAQ,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;aAC7C,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/adapters/identity/agentcore.d.ts

@@ -10,6 +10,8 @@
  *   - request.mode 'machine' → `M2M`; 'user' → `USER_FEDERATION`
  *   - request.service        → the configured OAuth2 credential-provider name
  *   - request.identity       → (per-request workload identity scoping; see below)
+ *   - request.userToken      → the user's own JWT, exchanged for a user-scoped
+ *                              workload token before vending (9.12.0; see below)
  *   - a returned access token → `{ status: 'issued', credential: bearer(token) }`
  *   - a returned auth URL     → `{ status: 'authorization-required' }` (3LO consent)
  *
@@ -18,21 +20,50 @@
  *
  * **Per-request identity forwarding (workload identity scoping).**
  * `GetResourceOauth2Token` carries NO user/tenant field — in AgentCore the
- * user identity is bound EARLIER, at workload-token acquisition:
- * `GetWorkloadAccessTokenForUserId(workloadName, userId)` returns a workload
- * access token scoped to that user, and AgentCore keys its token vault + 3LO
- * grants per (workload, user). So this adapter forwards `req.identity` (the
- * `runIdentity` that the agent threads through `getCredential`) by resolving a
- * per-user workload token first, then vending with it. Engages only when ALL of:
- *   - `req.mode === 'user'` (USER_FEDERATION — M2M is the workload's own identity),
- *   - a userId derives from `req.identity` (default `identity.principal`;
- *     override via `userIdFor`), and
- *   - `options.workloadName` is configured (the opt-in).
- * Otherwise the static `options.workloadIdentityToken` flows exactly as before.
+ * user identity is bound EARLIER, at workload-token acquisition. There are two
+ * ways to bind it, and this adapter dispatches both:
+ *
+ *   `GetWorkloadAccessTokenForUserId(workloadName, userId)` — the ASSERTION.
+ *     The agent says who the user is; AWS takes its word for it and returns a
+ *     workload token keyed to that (workload, user).
+ *   `GetWorkloadAccessTokenForJWT(workloadName, userToken)` — the PROOF (9.12.0).
+ *     The agent hands over the token the user's own identity provider signed,
+ *     and gets back "an opaque token representing the identity of both the
+ *     workload and the user" (the service's own words for the response).
+ *
+ * Either way the answer is a `workloadAccessToken`, and it flows into
+ * `GetResourceOauth2Token`'s `workloadIdentityToken` unchanged — which is why
+ * the second one needed no new credential path, no new result branch and no
+ * change to `toHeaders()`. AgentCore keys its token vault + 3LO grants per
+ * (workload, user), so the whole point of resolving either is that the vault
+ * entry belongs to the person rather than to the agent.
+ *
+ * **The JWT rides the REQUEST.** `req.userToken` is per call, because the
+ * person calling is per call; a JWT in this provider's construction options
+ * would be one user's session serving everybody. Presence is what selects the
+ * exchange — a proof that arrived is never downgraded to an assertion — and
+ * `requireUserToken` turns "no JWT on a `mode: 'user'` request" from a quiet
+ * fallback into a refusal, for a deployment where every user IS authenticated.
+ *
+ * The ladder, in order, for one `getCredential(req)`:
+ *   1. `req.userToken` present → exchange it (needs `workloadName`; `mode: 'user'`).
+ *   2. else a userId derives from `req.identity` (default `identity.principal`;
+ *      override via `userIdFor`) on a `mode: 'user'` request, and
+ *      `options.workloadName` is configured → the by-userId exchange.
+ *   3. else the static `options.workloadIdentityToken` flows exactly as before.
+ *
  * `tenant` has no native AgentCore field and is NOT forwarded by default —
  * tenant isolation derives from the workload identity itself (per-tenant
  * workloads), or encode it via `userIdFor` (e.g. `${tenant}:${principal}`).
  *
+ * **Secrecy.** The inbound JWT and the exchanged workload token are secrets of
+ * equal weight, and neither appears in anything this file throws. A failed
+ * exchange is described by the SHAPE of the response — how many fields it
+ * carried and what they are called — never by its content, because every field
+ * of a token-exchange response is a token. A thrown message reaches the LLM as
+ * a tool result AND rides `agentfootprint.credential.failed`, so an error that
+ * quotes the response has published the user's session to both at once.
+ *
  * ── How this talks to the SDK (9.4.0 — read this before editing) ────────────
  * Through **`client.send(new SomeCommand(input))`**, never through a method on
  * the client. A bare `@aws-sdk/client-*` **Client** is command-based: its
@@ -85,6 +116,16 @@ export interface AgentCoreIdentityClientLike {
     }): Promise<{
         readonly workloadAccessToken?: string;
     }>;
+    /** Optional — required only when a request carries `userToken`. Exchanges the
+     *  user's OWN IdP-issued JWT for a workload access token representing both the
+     *  workload and the user. Same answer shape as the by-userId exchange, which
+     *  is why both feed the same `workloadIdentityToken`. */
+    getWorkloadAccessTokenForJWT?(input: {
+        readonly workloadName: string;
+        readonly userToken: string;
+    }): Promise<{
+        readonly workloadAccessToken?: string;
+    }>;
 }
 export interface AgentCoreIdentityOptions {
     readonly region?: string;
@@ -93,11 +134,28 @@ export interface AgentCoreIdentityOptions {
      *  workload token is resolved (see `workloadName`). */
     readonly workloadIdentityToken?: string;
     /** The AgentCore workload identity name — the OPT-IN for per-request identity
-     *  scoping. When set, `mode: 'user'` requests carrying `req.identity` resolve a
-     *  per-user workload access token via `GetWorkloadAccessTokenForUserId(workloadName,
-     *  userId)` before vending, so AgentCore's token vault + 3LO grants are keyed per
-     *  (workload, user) instead of per workload. Omit → today's static-token behavior. */
+     *  scoping, and the one option BOTH exchanges need. When set, a `mode: 'user'`
+     *  request resolves a per-user workload access token before vending — from
+     *  `req.userToken` via `GetWorkloadAccessTokenForJWT` when the user's own JWT
+     *  arrived, otherwise from `req.identity` via `GetWorkloadAccessTokenForUserId`
+     *  — so AgentCore's token vault + 3LO grants are keyed per (workload, user)
+     *  instead of per workload. Omit → today's static-token behavior. */
     readonly workloadName?: string;
+    /**
+     * Refuse a `mode: 'user'` request that carries no `req.userToken` (9.12.0),
+     * instead of falling back to the by-userId exchange or the static token.
+     *
+     * The opt-in for a deployment where the front door really does authenticate
+     * every person — an AgentCore Runtime behind JWT inbound auth, an API gateway
+     * that validates a bearer token. There, a delegated request with no proof
+     * attached is a wiring bug, and the failure it causes without this flag is the
+     * quiet kind: a token gets vended, the call succeeds, and it was scoped to the
+     * agent (or to a user id the agent asserted) rather than to the person.
+     *
+     * `mode: 'machine'` is never affected — M2M is the workload's own identity and
+     * has no user to prove.
+     */
+    readonly requireUserToken?: boolean;
     /** Map `req.identity` → the AgentCore `userId`. Default: `identity.principal`.
      *  `tenant` has no native AgentCore field — encode it here if you need
      *  tenant-scoped vault entries (e.g. ``({ tenant, principal }) =>
@@ -125,6 +183,7 @@ export interface BedrockAgentCoreIdentitySdkModule {
     };
     readonly GetResourceOauth2TokenCommand?: new (input: unknown) => unknown;
     readonly GetWorkloadAccessTokenForUserIdCommand?: new (input: unknown) => unknown;
+    readonly GetWorkloadAccessTokenForJWTCommand?: new (input: unknown) => unknown;
 }
 /** Build a {@link CredentialProvider} backed by AWS Bedrock AgentCore Identity. */
 export declare function agentCoreIdentity(options?: AgentCoreIdentityOptions): CredentialProvider;

package/dist/esm/adapters/identity/agentcore.js

@@ -10,6 +10,8 @@
  *   - request.mode 'machine' → `M2M`; 'user' → `USER_FEDERATION`
  *   - request.service        → the configured OAuth2 credential-provider name
  *   - request.identity       → (per-request workload identity scoping; see below)
+ *   - request.userToken      → the user's own JWT, exchanged for a user-scoped
+ *                              workload token before vending (9.12.0; see below)
  *   - a returned access token → `{ status: 'issued', credential: bearer(token) }`
  *   - a returned auth URL     → `{ status: 'authorization-required' }` (3LO consent)
  *
@@ -18,21 +20,50 @@
  *
  * **Per-request identity forwarding (workload identity scoping).**
  * `GetResourceOauth2Token` carries NO user/tenant field — in AgentCore the
- * user identity is bound EARLIER, at workload-token acquisition:
- * `GetWorkloadAccessTokenForUserId(workloadName, userId)` returns a workload
- * access token scoped to that user, and AgentCore keys its token vault + 3LO
- * grants per (workload, user). So this adapter forwards `req.identity` (the
- * `runIdentity` that the agent threads through `getCredential`) by resolving a
- * per-user workload token first, then vending with it. Engages only when ALL of:
- *   - `req.mode === 'user'` (USER_FEDERATION — M2M is the workload's own identity),
- *   - a userId derives from `req.identity` (default `identity.principal`;
- *     override via `userIdFor`), and
- *   - `options.workloadName` is configured (the opt-in).
- * Otherwise the static `options.workloadIdentityToken` flows exactly as before.
+ * user identity is bound EARLIER, at workload-token acquisition. There are two
+ * ways to bind it, and this adapter dispatches both:
+ *
+ *   `GetWorkloadAccessTokenForUserId(workloadName, userId)` — the ASSERTION.
+ *     The agent says who the user is; AWS takes its word for it and returns a
+ *     workload token keyed to that (workload, user).
+ *   `GetWorkloadAccessTokenForJWT(workloadName, userToken)` — the PROOF (9.12.0).
+ *     The agent hands over the token the user's own identity provider signed,
+ *     and gets back "an opaque token representing the identity of both the
+ *     workload and the user" (the service's own words for the response).
+ *
+ * Either way the answer is a `workloadAccessToken`, and it flows into
+ * `GetResourceOauth2Token`'s `workloadIdentityToken` unchanged — which is why
+ * the second one needed no new credential path, no new result branch and no
+ * change to `toHeaders()`. AgentCore keys its token vault + 3LO grants per
+ * (workload, user), so the whole point of resolving either is that the vault
+ * entry belongs to the person rather than to the agent.
+ *
+ * **The JWT rides the REQUEST.** `req.userToken` is per call, because the
+ * person calling is per call; a JWT in this provider's construction options
+ * would be one user's session serving everybody. Presence is what selects the
+ * exchange — a proof that arrived is never downgraded to an assertion — and
+ * `requireUserToken` turns "no JWT on a `mode: 'user'` request" from a quiet
+ * fallback into a refusal, for a deployment where every user IS authenticated.
+ *
+ * The ladder, in order, for one `getCredential(req)`:
+ *   1. `req.userToken` present → exchange it (needs `workloadName`; `mode: 'user'`).
+ *   2. else a userId derives from `req.identity` (default `identity.principal`;
+ *      override via `userIdFor`) on a `mode: 'user'` request, and
+ *      `options.workloadName` is configured → the by-userId exchange.
+ *   3. else the static `options.workloadIdentityToken` flows exactly as before.
+ *
  * `tenant` has no native AgentCore field and is NOT forwarded by default —
  * tenant isolation derives from the workload identity itself (per-tenant
  * workloads), or encode it via `userIdFor` (e.g. `${tenant}:${principal}`).
  *
+ * **Secrecy.** The inbound JWT and the exchanged workload token are secrets of
+ * equal weight, and neither appears in anything this file throws. A failed
+ * exchange is described by the SHAPE of the response — how many fields it
+ * carried and what they are called — never by its content, because every field
+ * of a token-exchange response is a token. A thrown message reaches the LLM as
+ * a tool result AND rides `agentfootprint.credential.failed`, so an error that
+ * quotes the response has published the user's session to both at once.
+ *
  * ── How this talks to the SDK (9.4.0 — read this before editing) ────────────
  * Through **`client.send(new SomeCommand(input))`**, never through a method on
  * the client. A bare `@aws-sdk/client-*` **Client** is command-based: its
@@ -53,6 +84,62 @@
  */
 import { lazyRequire } from '../../lib/lazyRequire.js';
 import { bearer } from '../../identity/kinds.js';
+/**
+ * Re-raise a failed SDK call **without its text** (9.12.0).
+ *
+ * Every input this adapter sends is a secret: the user's JWT goes into
+ * `GetWorkloadAccessTokenForJWT`, a workload access token goes into
+ * `GetResourceOauth2Token`. AWS clients report transport and validation
+ * failures by echoing request detail into the message — which is how a live
+ * user session ends up in a string that this library then hands to the LLM as
+ * a tool result and emits on `agentfootprint.credential.failed`. One echo, and
+ * it is in the conversation, the commit log, the narrative and every sink.
+ *
+ * So the text does not come through. What does is the part that is both safe
+ * and actionable: which operation failed, the exception's NAME (AWS models
+ * them — `AccessDeniedException`, `ResourceNotFoundException`,
+ * `ThrottlingException`, `UnauthorizedException`, `ValidationException`) and
+ * the HTTP status. That is the same trade the Vault adapter makes, and it is
+ * the same reason.
+ *
+ * **The original is deliberately not attached as `cause`.** A cause travels
+ * with the error into every serializer that walks own properties, which would
+ * undo the whole of this in one `JSON.stringify`.
+ *
+ * An injected `_client` never reaches here: it owns its own mapping, and its
+ * own secrecy with it — the same law this file already states for field names.
+ */
+function sdkFailure(command, err) {
+    const e = err;
+    const name = typeof e?.name === 'string' && e.name.length > 0 ? e.name : 'an unnamed failure';
+    const status = e?.$metadata?.httpStatusCode;
+    return new Error(`agentCoreIdentity: ${command} failed — ${name}` +
+        (typeof status === 'number' ? ` (HTTP ${status})` : '') +
+        ".\n  The SDK's own message is withheld: this request carried a token, and AWS clients " +
+        'echo request detail into failure text. Check CloudWatch for the full exception.');
+}
+/**
+ * Read the exchanged workload token, or refuse **by shape**.
+ *
+ * Shared by both exchanges so there is one refusal to read and one rule about
+ * what may be said: field NAMES and a count, never a value. Every field of a
+ * token-exchange response is a token, and this message travels to the model, to
+ * `agentfootprint.credential.failed` and to every log sink attached to it. An
+ * operator debugging a malformed answer needs to know which fields came back,
+ * which is exactly the part that is safe to print.
+ */
+function requireWorkloadAccessToken(response, operation) {
+    const token = response?.workloadAccessToken;
+    if (typeof token === 'string' && token.length > 0)
+        return token;
+    const fields = response && typeof response === 'object' ? Object.keys(response) : [];
+    throw new Error(`agentCoreIdentity: ${operation} returned no usable workloadAccessToken, so there is no ` +
+        'user-scoped workload token to vend with — refusing rather than falling back to a ' +
+        'workload-level one.\n' +
+        `  The response carried ${fields.length} field(s)` +
+        (fields.length > 0 ? `: ${fields.join(', ')}.` : '.') +
+        '\n  Values are withheld on purpose: every field of a token-exchange response is a secret.');
+}
 /**
  * Map {@link AgentCoreIdentityClientLike} onto the real SDK commands.
  *
@@ -92,7 +179,12 @@ function createIdentityClient(options) {
             throw new Error(`agentCoreIdentity: \`@aws-sdk/client-bedrock-agentcore\` is missing ${name}. ` +
                 'Upgrade the SDK, or pass `_client` with your own mapping.');
         }
-        return sdk.send(new Ctor(input));
+        try {
+            return await sdk.send(new Ctor(input));
+        }
+        catch (err) {
+            throw sdkFailure(name, err);
+        }
     };
     return {
         async getResourceOauth2Token(input) {
@@ -115,13 +207,27 @@ function createIdentityClient(options) {
                 ...(r?.sessionUri !== undefined && { sessionId: r.sessionUri }),
             };
         },
+        // ── The two workload-token exchanges ──────────────────────────────
+        //
+        // Both answer `{ workloadAccessToken }` and nothing else, so unlike
+        // `getResourceOauth2Token` above there is no field to rename — and both
+        // hand the response back AS RECEIVED rather than narrowed to that one
+        // field. That is deliberate: when the field is missing,
+        // `requireWorkloadAccessToken` refuses by describing the response's SHAPE,
+        // and a shim that had already thrown the other field names away would leave
+        // it describing an empty object — the least useful message available, on
+        // the one path where the operator has nothing else to go on.
         async getWorkloadAccessTokenForUserId(input) {
-            const r = (await send(mod.GetWorkloadAccessTokenForUserIdCommand, 'GetWorkloadAccessTokenForUserIdCommand', input));
-            return {
-                ...(r?.workloadAccessToken !== undefined && {
-                    workloadAccessToken: r.workloadAccessToken,
-                }),
-            };
+            return ((await send(mod.GetWorkloadAccessTokenForUserIdCommand, 'GetWorkloadAccessTokenForUserIdCommand', input)) ?? {});
+        },
+        async getWorkloadAccessTokenForJWT(input) {
+            // `GetWorkloadAccessTokenForJWTRequest` is `{ workloadName, userToken }`,
+            // both required, and the response is `{ workloadAccessToken }` — verified
+            // against a real install of @aws-sdk/client-bedrock-agentcore before this
+            // shipped, the same way the code-interpreter shapes were. `userToken` is
+            // the SDK's own name for the user's IdP-issued OAuth2 token, so the
+            // adapter and the wire agree without a rename.
+            return ((await send(mod.GetWorkloadAccessTokenForJWTCommand, 'GetWorkloadAccessTokenForJWTCommand', input)) ?? {});
         },
     };
 }
@@ -139,13 +245,55 @@ export function agentCoreIdentity(options = {}) {
     const getClient = () => (client ??= resolveClient(options));
     const userIdFor = options.userIdFor ?? defaultUserIdFor;
     // Per-request identity forwarding (workload identity scoping) — see module
-    // header. `GetResourceOauth2Token` has no user field; the user is bound at
-    // workload-token acquisition, so a `mode: 'user'` request carrying an
-    // identity exchanges (workloadName, userId) for a USER-SCOPED workload token
-    // and vends with that. Requires `workloadName` (the opt-in); without it the
-    // static `workloadIdentityToken` flows unchanged (pre-forwarding behavior).
+    // header for the ladder and why both exchanges answer the same question.
+    // `GetResourceOauth2Token` has no user field; the user is bound at
+    // workload-token acquisition, so a `mode: 'user'` request resolves a
+    // USER-SCOPED workload token first and vends with that. Both exchanges
+    // require `workloadName` (the opt-in); with neither engaged the static
+    // `workloadIdentityToken` flows unchanged (pre-forwarding behavior).
     const resolveWorkloadToken = async (req) => {
-        const userId = req.mode === 'user' && req.identity !== undefined ? userIdFor(req.identity) : undefined;
+        const delegated = req.mode === 'user';
+        if (req.userToken !== undefined) {
+            if (!delegated) {
+                // A user's signed token on a request that asks for the WORKLOAD's own
+                // identity. Vending M2M while holding somebody's proof is the exact
+                // silent downgrade this whole path exists to close, so it is named
+                // rather than resolved one way or the other.
+                throw new Error("agentCoreIdentity: a `userToken` arrived on a `mode: 'machine'` request. M2M is the " +
+                    "workload's own identity — there is no user to act on behalf of, and the token " +
+                    "would be ignored.\n  Declare `mode: 'user'` to exchange it, or drop the token.");
+            }
+            if (!options.workloadName) {
+                throw new Error('agentCoreIdentity: a `userToken` arrived but no `workloadName` is configured, so ' +
+                    'there is nothing to exchange it against — and vending at workload level would ' +
+                    "hand back a token scoped to the AGENT while holding the user's proof.\n" +
+                    '  Configure `workloadName` (your AgentCore workload identity), or stop sending ' +
+                    '`userToken`.');
+            }
+            const c = getClient();
+            if (typeof c.getWorkloadAccessTokenForJWT !== 'function') {
+                // The SDK-backed client always implements this, so reaching here means
+                // an injected `_client` that does not.
+                throw new Error('agentCoreIdentity: a `userToken` arrived, but the injected `_client` has no ' +
+                    'getWorkloadAccessTokenForJWT. Implement it, or stop sending `userToken`.');
+            }
+            return requireWorkloadAccessToken(await c.getWorkloadAccessTokenForJWT({
+                workloadName: options.workloadName,
+                userToken: req.userToken,
+            }), 'GetWorkloadAccessTokenForJWT');
+        }
+        if (options.requireUserToken === true && delegated) {
+            // The deployment said every delegated request is authenticated. One that
+            // is not is a wiring bug, and the only alternative to saying so is to
+            // vend something weaker and let it succeed.
+            throw new Error("agentCoreIdentity: `requireUserToken` is set, but this `mode: 'user'` request for " +
+                `'${req.service}' carried no \`userToken\`.\n` +
+                "  Pass the caller's own IdP token as `getCredential({ …, userToken })` — inside " +
+                'AgentCore Runtime behind JWT inbound auth it is the bearer token the front door ' +
+                'validated.\n' +
+                '  Or drop `requireUserToken` to fall back to the by-userId exchange.');
+        }
+        const userId = delegated && req.identity !== undefined ? userIdFor(req.identity) : undefined;
         if (userId === undefined || !options.workloadName)
             return options.workloadIdentityToken;
         const c = getClient();
@@ -157,15 +305,7 @@ export function agentCoreIdentity(options = {}) {
                 'but the injected `_client` has no getWorkloadAccessTokenForUserId. Implement it, ' +
                 'or drop `workloadName` to vend with the static `workloadIdentityToken`.');
         }
-        const res = await c.getWorkloadAccessTokenForUserId({
-            workloadName: options.workloadName,
-            userId,
-        });
-        if (!res.workloadAccessToken) {
-            throw new Error('agentCoreIdentity: GetWorkloadAccessTokenForUserId returned no workloadAccessToken ' +
-                'for per-user scoped vending.');
-        }
-        return res.workloadAccessToken;
+        return requireWorkloadAccessToken(await c.getWorkloadAccessTokenForUserId({ workloadName: options.workloadName, userId }), 'GetWorkloadAccessTokenForUserId');
     };
     return {
         id: options.id ?? 'agentcore-identity',

package/dist/esm/adapters/identity/agentcore.js.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.js","sourceRoot":"","sources":["../../../../src/adapters/identity/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAMvD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AA4EjD;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,OAAiC;IAC7D,IAAI,GAAsC,CAAC;IAC3C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,sFAAsF;YACtF,GAAG,GAAG,WAAW,CAAoC,mCAAmC,CAAC,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,uFAAuF;gBACrF,6DAA6D;gBAC7D,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAElG,MAAM,IAAI,GAAG,KAAK,EAChB,IAA+C,EAC/C,IAAY,EACZ,KAAc,EACI,EAAE;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,uEAAuE,IAAI,IAAI;gBAC7E,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,sBAAsB,CAAC,KAAK;YAChC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;gBACjC,wEAAwE;gBACxE,uEAAuE;gBACvE,+DAA+D;gBAC/D,MAAM,IAAI,KAAK,CACb,oFAAoF;oBAClF,wCAAwC;oBACxC,iFAAiF;oBACjF,4BAA4B;oBAC5B,4EAA4E;oBAC5E,4EAA4E,CAC/E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CACnB,GAAG,CAAC,6BAA6B,EACjC,+BAA+B,EAC/B,KAAK,CACN,CAIO,CAAC;YACT,OAAO;gBACL,GAAG,CAAC,CAAC,EAAE,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnE,GAAG,CAAC,CAAC,EAAE,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;gBAClF,yEAAyE;gBACzE,GAAG,CAAC,CAAC,EAAE,UAAU,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,+BAA+B,CAAC,KAAK;YACzC,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CACnB,GAAG,CAAC,sCAAsC,EAC1C,wCAAwC,EACxC,KAAK,CACN,CAA4C,CAAC;YAC9C,OAAO;gBACL,GAAG,CAAC,CAAC,EAAE,mBAAmB,KAAK,SAAS,IAAI;oBAC1C,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;iBAC3C,CAAC;aACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAiC;IACtD,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC5C,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,QAAyC,EAAsB,EAAE,CACzF,QAAQ,CAAC,SAAS,CAAC;AAErB,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,UAAoC,EAAE;IACtE,IAAI,MAA+C,CAAC;IACpD,MAAM,SAAS,GAAG,GAAgC,EAAE,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAExD,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAsB,EAA+B,EAAE;QACzF,MAAM,MAAM,GACV,GAAG,CAAC,IAAI,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC;QAExF,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;YAC5D,sEAAsE;YACtE,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,IAAI,KAAK,CACb,iFAAiF;gBAC/E,mFAAmF;gBACnF,yEAAyE,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,+BAA+B,CAAC;YAClD,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,qFAAqF;gBACnF,8BAA8B,CACjC,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,mBAAmB,CAAC;IACjC,CAAC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,oBAAoB;QACtC,KAAK,CAAC,aAAa,CAAC,GAAsB;YACxC,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,sBAAsB,CAAC;gBACnD,8BAA8B,EAAE,GAAG,CAAC,OAAO;gBAC3C,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;gBACxB,UAAU,EAAE,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK;gBAC3D,mBAAmB,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;gBAC7C,GAAG,CAAC,qBAAqB,IAAI,EAAE,qBAAqB,EAAE,CAAC;aACxD,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,sEAAsE;gBACtE,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;oBACnC,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;iBACjE,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACzB,OAAO;oBACL,MAAM,EAAE,wBAAwB;oBAChC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;oBACtC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;iBAC/B,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,CAAC,OAAO,qBAAqB;gBAChF,2CAA2C,CAC9C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"agentcore.js","sourceRoot":"","sources":["../../../../src/adapters/identity/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAMvD,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAsGjD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,GAAY;IAC/C,MAAM,CAAC,GAAG,GAA0E,CAAC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC9F,MAAM,MAAM,GAAG,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC;IAC5C,OAAO,IAAI,KAAK,CACd,sBAAsB,OAAO,aAAa,IAAI,EAAE;QAC9C,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,wFAAwF;QACxF,iFAAiF,CACpF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,0BAA0B,CACjC,QAAsE,EACtE,SAAiB;IAEjB,MAAM,KAAK,GAAG,QAAQ,EAAE,mBAAmB,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,MAAM,GAAG,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,0DAA0D;QACvF,mFAAmF;QACnF,uBAAuB;QACvB,0BAA0B,MAAM,CAAC,MAAM,WAAW;QAClD,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACrD,2FAA2F,CAC9F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,oBAAoB,CAAC,OAAiC;IAC7D,IAAI,GAAsC,CAAC;IAC3C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,sFAAsF;YACtF,GAAG,GAAG,WAAW,CAAoC,mCAAmC,CAAC,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,uFAAuF;gBACrF,6DAA6D;gBAC7D,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAElG,MAAM,IAAI,GAAG,KAAK,EAChB,IAA+C,EAC/C,IAAY,EACZ,KAAc,EACI,EAAE;QACpB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,uEAAuE,IAAI,IAAI;gBAC7E,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,sBAAsB,CAAC,KAAK;YAChC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;gBACjC,wEAAwE;gBACxE,uEAAuE;gBACvE,+DAA+D;gBAC/D,MAAM,IAAI,KAAK,CACb,oFAAoF;oBAClF,wCAAwC;oBACxC,iFAAiF;oBACjF,4BAA4B;oBAC5B,4EAA4E;oBAC5E,4EAA4E,CAC/E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CACnB,GAAG,CAAC,6BAA6B,EACjC,+BAA+B,EAC/B,KAAK,CACN,CAIO,CAAC;YACT,OAAO;gBACL,GAAG,CAAC,CAAC,EAAE,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnE,GAAG,CAAC,CAAC,EAAE,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;gBAClF,yEAAyE;gBACzE,GAAG,CAAC,CAAC,EAAE,UAAU,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;aAChE,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,EAAE;QACF,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,wDAAwD;QACxD,2EAA2E;QAC3E,4EAA4E;QAC5E,yEAAyE;QACzE,6DAA6D;QAC7D,KAAK,CAAC,+BAA+B,CAAC,KAAK;YACzC,OAAO,CACJ,CAAC,MAAM,IAAI,CACV,GAAG,CAAC,sCAAsC,EAC1C,wCAAwC,EACxC,KAAK,CACN,CAA6C,IAAI,EAAE,CACrD,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,4BAA4B,CAAC,KAAK;YACtC,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,yEAAyE;YACzE,oEAAoE;YACpE,+CAA+C;YAC/C,OAAO,CACJ,CAAC,MAAM,IAAI,CACV,GAAG,CAAC,mCAAmC,EACvC,qCAAqC,EACrC,KAAK,CACN,CAA6C,IAAI,EAAE,CACrD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAiC;IACtD,2EAA2E;IAC3E,iDAAiD;IACjD,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IAC5C,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,QAAyC,EAAsB,EAAE,CACzF,QAAQ,CAAC,SAAS,CAAC;AAErB,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,UAAoC,EAAE;IACtE,IAAI,MAA+C,CAAC;IACpD,MAAM,SAAS,GAAG,GAAgC,EAAE,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAExD,2EAA2E;IAC3E,yEAAyE;IACzE,mEAAmE;IACnE,qEAAqE;IACrE,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAsB,EAA+B,EAAE;QACzF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC;QAEtC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,sEAAsE;gBACtE,oEAAoE;gBACpE,mEAAmE;gBACnE,6CAA6C;gBAC7C,MAAM,IAAI,KAAK,CACb,sFAAsF;oBACpF,gFAAgF;oBAChF,gFAAgF,CACnF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,mFAAmF;oBACjF,gFAAgF;oBAChF,yEAAyE;oBACzE,iFAAiF;oBACjF,cAAc,CACjB,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,CAAC,4BAA4B,KAAK,UAAU,EAAE,CAAC;gBACzD,uEAAuE;gBACvE,uCAAuC;gBACvC,MAAM,IAAI,KAAK,CACb,8EAA8E;oBAC5E,0EAA0E,CAC7E,CAAC;YACJ,CAAC;YACD,OAAO,0BAA0B,CAC/B,MAAM,CAAC,CAAC,4BAA4B,CAAC;gBACnC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS;aACzB,CAAC,EACF,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,gBAAgB,KAAK,IAAI,IAAI,SAAS,EAAE,CAAC;YACnD,yEAAyE;YACzE,sEAAsE;YACtE,4CAA4C;YAC5C,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,IAAI,GAAG,CAAC,OAAO,+BAA+B;gBAC9C,kFAAkF;gBAClF,kFAAkF;gBAClF,cAAc;gBACd,sEAAsE,CACzE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,YAAY;YAAE,OAAO,OAAO,CAAC,qBAAqB,CAAC;QAExF,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,+BAA+B,KAAK,UAAU,EAAE,CAAC;YAC5D,sEAAsE;YACtE,0EAA0E;YAC1E,oCAAoC;YACpC,MAAM,IAAI,KAAK,CACb,iFAAiF;gBAC/E,mFAAmF;gBACnF,yEAAyE,CAC5E,CAAC;QACJ,CAAC;QACD,OAAO,0BAA0B,CAC/B,MAAM,CAAC,CAAC,+BAA+B,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC,EACvF,iCAAiC,CAClC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,oBAAoB;QACtC,KAAK,CAAC,aAAa,CAAC,GAAsB;YACxC,MAAM,qBAAqB,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,MAAM,SAAS,EAAE,CAAC,sBAAsB,CAAC;gBACnD,8BAA8B,EAAE,GAAG,CAAC,OAAO;gBAC3C,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;gBACxB,UAAU,EAAE,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK;gBAC3D,mBAAmB,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;gBAC7C,GAAG,CAAC,qBAAqB,IAAI,EAAE,qBAAqB,EAAE,CAAC;aACxD,CAAC,CAAC;YAEH,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACpB,sEAAsE;gBACtE,OAAO;oBACL,MAAM,EAAE,QAAQ;oBAChB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;oBACnC,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;iBACjE,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;gBACzB,OAAO;oBACL,MAAM,EAAE,wBAAwB;oBAChC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;oBACtC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;iBAC/B,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kDAAkD,GAAG,CAAC,OAAO,qBAAqB;gBAChF,2CAA2C,CAC9C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/adapters/memory/sqliteVector.d.ts

@@ -42,6 +42,16 @@
  * intuition: 50,000 chunks at ~1,000 characters is roughly 50 MB of text, on
  * the order of 25,000 pages.
  *
+ * **It is a RECOMMENDATION, not an enforced limit, and the difference matters
+ * when you are planning.** Nothing in this store counts chunks, refuses a write
+ * at 50,000, or degrades on purpose past it: chunk 50,001 is stored and searched
+ * exactly like chunk 3. The number is the point on the measured curve where this
+ * implementation stops being obviously the right tool — published so the
+ * decision is yours and dated, rather than discovered in production. The refusals
+ * this store DOES enforce are named on the constructor: a missing `node:sqlite`,
+ * an unreadable file, a schema-identity or schema-version mismatch, `':memory:'`,
+ * and an embedder-fingerprint conflict.
+ *
  * **Hydration is the number to plan around, not the query.** Steady-state
  * search is fast everywhere in that table; reading the vectors off disk the
  * FIRST time is what costs, and at 50,000 × 1536 it is 5.7 seconds. Paid

package/dist/esm/adapters/memory/sqliteVector.js

@@ -42,6 +42,16 @@
  * intuition: 50,000 chunks at ~1,000 characters is roughly 50 MB of text, on
  * the order of 25,000 pages.
  *
+ * **It is a RECOMMENDATION, not an enforced limit, and the difference matters
+ * when you are planning.** Nothing in this store counts chunks, refuses a write
+ * at 50,000, or degrades on purpose past it: chunk 50,001 is stored and searched
+ * exactly like chunk 3. The number is the point on the measured curve where this
+ * implementation stops being obviously the right tool — published so the
+ * decision is yours and dated, rather than discovered in production. The refusals
+ * this store DOES enforce are named on the constructor: a missing `node:sqlite`,
+ * an unreadable file, a schema-identity or schema-version mismatch, `':memory:'`,
+ * and an embedder-fingerprint conflict.
+ *
  * **Hydration is the number to plan around, not the query.** Steady-state
  * search is fast everywhere in that table; reading the vectors off disk the
  * FIRST time is what costs, and at 50,000 × 1536 it is 5.7 seconds. Paid