agentfootprint 9.2.0 → 9.4.0

package/dist/types/recorders/core/CredentialRecorder.d.ts

@@ -0,0 +1,31 @@
+/**
+ * CredentialRecorder — forwards `agentfootprint.credential.*` emits to the
+ * dispatcher.
+ *
+ * Pattern: Factory over EmitBridge.
+ * Role:    Bridges the declare-and-push credential lifecycle — requested,
+ *          acquired, authorization_required, failed — so consumers observe it
+ *          via `agent.on('agentfootprint.credential.failed', …)` and
+ *          `agent.on('agentfootprint.credential.*', …)`.
+ * Emits:   agentfootprint.credential.{requested,acquired,authorization_required,failed}
+ *
+ * ── Why this did not exist until 9.4.0, and what it cost ────────────────────
+ * The credential domain has had payload types, registry entries and real
+ * `typedEmit` call sites since 6.11.0 — and NO BRIDGE. Every one of those
+ * events was raised onto footprintjs's emit channel and stopped there: a raw
+ * `agent.attach()` recorder saw them, and `agent.on(...)` never did. So the
+ * documented way to watch for credential failures observed nothing, and an AWS
+ * identity adapter that failed 100% of its calls for two minor versions did so
+ * in a silence that read exactly like health.
+ *
+ * This is the law CLAUDE.md states for a new event DOMAIN — payload + registry
+ * entry + `DomainWildcard` arm + a bridge attach — with the fourth part
+ * missing. Zero-cost when nothing fires: `EmitBridge` drops an event with no
+ * listener before building any meta.
+ */
+import { EmitBridge, type EmitBridgeOptions } from './EmitBridge.js';
+export type CredentialRecorderOptions = Omit<EmitBridgeOptions, 'id' | 'prefix'> & {
+    readonly id?: string;
+};
+export declare function credentialRecorder(options: CredentialRecorderOptions): EmitBridge;
+//# sourceMappingURL=CredentialRecorder.d.ts.map

package/dist/types/recorders/core/CredentialRecorder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialRecorder.d.ts","sourceRoot":"","sources":["../../../../src/recorders/core/CredentialRecorder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAErE,MAAM,MAAM,yBAAyB,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,GAAG,QAAQ,CAAC,GAAG;IACjF,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,UAAU,CAOjF"}

package/dist/types/security/index.d.ts

@@ -10,8 +10,12 @@
  * Today's surface is small and data-driven on purpose: one role
  * allowlist primitive that satisfies BOTH the v2.4 `PermissionChecker`
  * interface AND a sync `isAllowed(toolId)` predicate for use with
- * `gatedTools` from `agentfootprint/providers` — plus
- * `agentCorePolicy()`, the same port answered by a remote policy store.
+ * `gatedTools` from `agentfootprint/providers`.
+ *
+ * There is no shipped REMOTE policy engine. `agentCorePolicy()` was one
+ * through 9.3.0 and is retired in 9.4.0 — see the note beside its export
+ * below. The port stays open: a remote checker is an object with a
+ * `check()` method, and anybody can write one.
  *
  * A local allowlist and a remote policy engine differ in one way that
  * matters here: the local one can answer synchronously, so it doubles
@@ -49,6 +53,6 @@ export type { PolicyHaltContext } from './PolicyHaltError.js';
 export { extractSequence, SYNTHETIC_DENY_PREFIX } from './extractSequence.js';
 export type { ExtractSequenceOptions } from './extractSequence.js';
 export { redactThinkingBlocks, REDACTED_PLACEHOLDER } from './thinkingRedaction.js';
-export { agentCorePolicy, type AgentCorePolicyOptions, type AgentCorePolicyClientLike, type AgentCorePolicyEvaluation, type AgentCorePolicyUnavailable, type BedrockAgentCorePolicySdkModule, } from '../adapters/security/agentcore.js';
+export { agentCorePolicy, AgentCorePolicyRetiredError, type AgentCorePolicyOptions, type AgentCorePolicyClientLike, type AgentCorePolicyEvaluation, type AgentCorePolicyUnavailable, type BedrockAgentCorePolicySdkModule, } from '../adapters/security/agentcore.js';
 export type { PermissionChecker, PermissionRequest, PermissionDecision, ToolCallEntry, ToolResultContent, } from '../adapters/types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEpF,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAMpF,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,GACrC,MAAM,mCAAmC,CAAC;AAM3C,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEpF,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAOpF,OAAO,EACL,eAAe,EACf,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,GACrC,MAAM,mCAAmC,CAAC;AAM3C,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,GAClB,MAAM,sBAAsB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentfootprint",
-  "version": "9.2.0",
+  "version": "9.4.0",
   "description": "The explainable agent framework — backtrack a wrong answer to the exact context that caused it (evidence, not guesses). Built on footprintjs.",
   "license": "MIT",
   "type": "commonjs",
@@ -269,6 +269,7 @@
     "@aws-sdk/client-bedrock-agentcore": "*",
     "@aws-sdk/client-bedrock-runtime": "*",
     "@aws-sdk/client-cloudwatch-logs": "*",
+    "@aws-sdk/client-s3vectors": "*",
     "@aws-sdk/client-xray": "*",
     "@huggingface/transformers": "*",
     "@modelcontextprotocol/sdk": "*",
@@ -277,6 +278,7 @@
     "footprintjs": "^9.15.0",
     "ioredis": "*",
     "openai": "*",
+    "pg": "*",
     "unpdf": "*",
     "zod": "*"
   },
@@ -299,9 +301,15 @@
     "@aws-sdk/client-cloudwatch-logs": {
       "optional": true
     },
+    "@aws-sdk/client-s3vectors": {
+      "optional": true
+    },
     "@aws-sdk/client-xray": {
       "optional": true
     },
+    "pg": {
+      "optional": true
+    },
     "@modelcontextprotocol/sdk": {
       "optional": true
     },