agentfootprint 9.3.0 → 9.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CLAUDE.md +3 -1
- package/dist/adapters/identity/agentcore.js +94 -26
- package/dist/adapters/identity/agentcore.js.map +1 -1
- package/dist/adapters/llm/BedrockProvider.js +34 -9
- package/dist/adapters/llm/BedrockProvider.js.map +1 -1
- package/dist/adapters/memory/s3Vectors.js +158 -6
- package/dist/adapters/memory/s3Vectors.js.map +1 -1
- package/dist/adapters/observability/cloudwatch.js +13 -8
- package/dist/adapters/observability/cloudwatch.js.map +1 -1
- package/dist/adapters/observability/xray.js +13 -8
- package/dist/adapters/observability/xray.js.map +1 -1
- package/dist/adapters/security/agentcore.js +0 -0
- package/dist/adapters/security/agentcore.js.map +1 -1
- package/dist/bridge/eventMeta.js +3 -0
- package/dist/bridge/eventMeta.js.map +1 -1
- package/dist/core/Agent.js +11 -0
- package/dist/core/Agent.js.map +1 -1
- package/dist/core/agent/stages/toolCalls.js +80 -7
- package/dist/core/agent/stages/toolCalls.js.map +1 -1
- package/dist/doors/security.js +3 -2
- package/dist/doors/security.js.map +1 -1
- package/dist/esm/adapters/identity/agentcore.d.ts +39 -9
- package/dist/esm/adapters/identity/agentcore.js +94 -26
- package/dist/esm/adapters/identity/agentcore.js.map +1 -1
- package/dist/esm/adapters/llm/BedrockProvider.d.ts +24 -0
- package/dist/esm/adapters/llm/BedrockProvider.js +34 -9
- package/dist/esm/adapters/llm/BedrockProvider.js.map +1 -1
- package/dist/esm/adapters/memory/s3Vectors.d.ts +36 -4
- package/dist/esm/adapters/memory/s3Vectors.js +158 -6
- package/dist/esm/adapters/memory/s3Vectors.js.map +1 -1
- package/dist/esm/adapters/observability/cloudwatch.d.ts +20 -0
- package/dist/esm/adapters/observability/cloudwatch.js +13 -8
- package/dist/esm/adapters/observability/cloudwatch.js.map +1 -1
- package/dist/esm/adapters/observability/xray.d.ts +18 -0
- package/dist/esm/adapters/observability/xray.js +13 -8
- package/dist/esm/adapters/observability/xray.js.map +1 -1
- package/dist/esm/adapters/security/agentcore.d.ts +81 -107
- package/dist/esm/adapters/security/agentcore.js +0 -0
- package/dist/esm/adapters/security/agentcore.js.map +1 -1
- package/dist/esm/bridge/eventMeta.d.ts +3 -0
- package/dist/esm/bridge/eventMeta.js +3 -0
- package/dist/esm/bridge/eventMeta.js.map +1 -1
- package/dist/esm/core/Agent.d.ts +16 -0
- package/dist/esm/core/Agent.js +11 -0
- package/dist/esm/core/Agent.js.map +1 -1
- package/dist/esm/core/agent/stages/toolCalls.js +80 -7
- package/dist/esm/core/agent/stages/toolCalls.js.map +1 -1
- package/dist/esm/doors/security.d.ts +3 -2
- package/dist/esm/doors/security.js +3 -2
- package/dist/esm/doors/security.js.map +1 -1
- package/dist/esm/events/dispatcher.d.ts +1 -1
- package/dist/esm/events/dispatcher.js.map +1 -1
- package/dist/esm/events/payloads.d.ts +23 -1
- package/dist/esm/events/types.d.ts +17 -0
- package/dist/esm/hosting/standingAgent.js +14 -1
- package/dist/esm/hosting/standingAgent.js.map +1 -1
- package/dist/esm/recorders/core/CredentialRecorder.d.ts +30 -0
- package/dist/esm/recorders/core/CredentialRecorder.js +35 -0
- package/dist/esm/recorders/core/CredentialRecorder.js.map +1 -0
- package/dist/esm/security/index.d.ts +7 -3
- package/dist/esm/security/index.js +12 -7
- package/dist/esm/security/index.js.map +1 -1
- package/dist/events/dispatcher.js.map +1 -1
- package/dist/hosting/standingAgent.js +14 -1
- package/dist/hosting/standingAgent.js.map +1 -1
- package/dist/recorders/core/CredentialRecorder.js +39 -0
- package/dist/recorders/core/CredentialRecorder.js.map +1 -0
- package/dist/security/index.js +13 -7
- package/dist/security/index.js.map +1 -1
- package/dist/types/adapters/identity/agentcore.d.ts +39 -9
- package/dist/types/adapters/identity/agentcore.d.ts.map +1 -1
- package/dist/types/adapters/llm/BedrockProvider.d.ts +24 -0
- package/dist/types/adapters/llm/BedrockProvider.d.ts.map +1 -1
- package/dist/types/adapters/memory/s3Vectors.d.ts +36 -4
- package/dist/types/adapters/memory/s3Vectors.d.ts.map +1 -1
- package/dist/types/adapters/observability/cloudwatch.d.ts +20 -0
- package/dist/types/adapters/observability/cloudwatch.d.ts.map +1 -1
- package/dist/types/adapters/observability/xray.d.ts +18 -0
- package/dist/types/adapters/observability/xray.d.ts.map +1 -1
- package/dist/types/adapters/security/agentcore.d.ts +81 -107
- package/dist/types/adapters/security/agentcore.d.ts.map +1 -1
- package/dist/types/bridge/eventMeta.d.ts +3 -0
- package/dist/types/bridge/eventMeta.d.ts.map +1 -1
- package/dist/types/core/Agent.d.ts +16 -0
- package/dist/types/core/Agent.d.ts.map +1 -1
- package/dist/types/core/agent/stages/toolCalls.d.ts.map +1 -1
- package/dist/types/doors/security.d.ts +3 -2
- package/dist/types/doors/security.d.ts.map +1 -1
- package/dist/types/events/dispatcher.d.ts +1 -1
- package/dist/types/events/dispatcher.d.ts.map +1 -1
- package/dist/types/events/payloads.d.ts +23 -1
- package/dist/types/events/payloads.d.ts.map +1 -1
- package/dist/types/events/types.d.ts +17 -0
- package/dist/types/events/types.d.ts.map +1 -1
- package/dist/types/hosting/standingAgent.d.ts.map +1 -1
- package/dist/types/recorders/core/CredentialRecorder.d.ts +31 -0
- package/dist/types/recorders/core/CredentialRecorder.d.ts.map +1 -0
- package/dist/types/security/index.d.ts +7 -3
- package/dist/types/security/index.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -68,6 +68,29 @@
|
|
|
68
68
|
* Only `ns` (the identity namespace) and `tier` are ever filtered on, and both
|
|
69
69
|
* are short strings.
|
|
70
70
|
*
|
|
71
|
+
* ── The preflight: this store now READS the index before trusting it (9.4.0) ─
|
|
72
|
+
* One `GetIndex`, lazily on first use and memoized for the life of the store.
|
|
73
|
+
* It checks the three things this adapter used to assume — and that a
|
|
74
|
+
* production deployment got wrong in all three ways at once:
|
|
75
|
+
*
|
|
76
|
+
* 1. the distance metric really is cosine (a euclidean index scored a
|
|
77
|
+
* self-query at 0.999…, where a true cosine is exactly 1.0);
|
|
78
|
+
* 2. `af` really is non-filterable, checked BEFORE the first write, so a
|
|
79
|
+
* misconfigured index fails at document 1 rather than at document 400
|
|
80
|
+
* with an AWS "Filterable metadata must have at most 2048 bytes";
|
|
81
|
+
* 3. the index dimension matches the vectors being written or searched.
|
|
82
|
+
*
|
|
83
|
+
* This is the discipline every sibling store already had at open —
|
|
84
|
+
* `sqliteVectorStore`'s schema identity, `pgVectorStore`'s schema check,
|
|
85
|
+
* `staticVectorStore`'s load-time fingerprint. This store had nothing to open,
|
|
86
|
+
* so it opened nothing.
|
|
87
|
+
*
|
|
88
|
+
* **IAM:** the caller now needs `s3vectors:GetIndex` alongside `PutVectors` /
|
|
89
|
+
* `QueryVectors` / `GetVectors` / `ListVectors` / `DeleteVectors`. A GetIndex
|
|
90
|
+
* that fails is refused by name, never passed through — an index this store
|
|
91
|
+
* cannot read is an index whose metric, layout and dimension it would be
|
|
92
|
+
* guessing at.
|
|
93
|
+
*
|
|
71
94
|
* ── Cosine only, said out loud ──────────────────────────────────────────────
|
|
72
95
|
* The port's score is a cosine similarity, and every threshold in this library
|
|
73
96
|
* — starting with `defineRAG`'s 0.7 default — is calibrated on that range. A
|
|
@@ -93,10 +116,16 @@
|
|
|
93
116
|
* one is what survives a restart: the first query after an embedder swap
|
|
94
117
|
* sees documents stamped by the old embedder and refuses by name, instead
|
|
95
118
|
* of returning a confident ranking of two incompatible spaces.
|
|
96
|
-
* -
|
|
97
|
-
*
|
|
98
|
-
*
|
|
99
|
-
*
|
|
119
|
+
* - Since 9.4.0 the index's OWN dimension is checked too, at the preflight —
|
|
120
|
+
* so a wrong-size embedder is caught on the first write and the first
|
|
121
|
+
* search of a fresh process, which the per-process fingerprint could not do
|
|
122
|
+
* (it has nothing to disagree with at boot).
|
|
123
|
+
* - What is still NOT caught: the first write of a fresh process into a
|
|
124
|
+
* namespace built by a different embedder OF THE SAME SIZE. Only the model
|
|
125
|
+
* id separates those, and it lives in the vectors rather than on the index.
|
|
126
|
+
* There is no cheap read that would catch it, and a full index scan on
|
|
127
|
+
* every boot is not one either. It is caught at the next search, before a
|
|
128
|
+
* single wrong answer is returned.
|
|
100
129
|
*
|
|
101
130
|
* ── Lazy peer dependency ────────────────────────────────────────────────────
|
|
102
131
|
* `@aws-sdk/client-s3vectors` is an OPTIONAL peer dependency, required at
|
|
@@ -126,6 +155,9 @@ export interface S3VectorsSdkModule {
|
|
|
126
155
|
readonly S3VectorsClient?: new (config: {
|
|
127
156
|
region?: string;
|
|
128
157
|
}) => S3VectorsLikeClient;
|
|
158
|
+
/** The PREFLIGHT (9.4.0) — the one call that reads the index rather than its
|
|
159
|
+
* vectors. See `verifyIndex` for what it checks and why each one is fatal. */
|
|
160
|
+
readonly GetIndexCommand?: new (input: unknown) => unknown;
|
|
129
161
|
readonly PutVectorsCommand?: new (input: unknown) => unknown;
|
|
130
162
|
readonly QueryVectorsCommand?: new (input: unknown) => unknown;
|
|
131
163
|
readonly GetVectorsCommand?: new (input: unknown) => unknown;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"s3Vectors.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/s3Vectors.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"s3Vectors.d.ts","sourceRoot":"","sources":["../../../../src/adapters/memory/s3Vectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsIG;AAWH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAErE,OAAO,KAAK,EAGV,WAAW,EAIZ,MAAM,6BAA6B,CAAC;AAIrC;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,6EAA6E;IAC7E,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,4FAA4F;IAC5F,OAAO,CAAC,IAAI,IAAI,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,mBAAmB,CAAC;IACpF;mFAC+E;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC3D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC7D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC/D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC7D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC9D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CACjE;AAID,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,iEAAiE;IACjE,QAAQ,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IACvC,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;CACpC;AAED,yFAAyF;AACzF,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,aAAa,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,GAAG,SAAS,CAAC;IAC5D;;;OAGG;IACH,KAAK,IAAI,IAAI,CAAC;CACf;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,cAAc,CAsoB7E"}
|
|
@@ -90,6 +90,10 @@ export interface CloudwatchObservabilityOptions {
|
|
|
90
90
|
/** Test injection — bypasses SDK lazy-require entirely. When set,
|
|
91
91
|
* `region` / IAM are ignored. */
|
|
92
92
|
readonly _client?: CloudWatchLikeClient;
|
|
93
|
+
/** @internal Test injection (9.4.0) — the AWS SDK module, so the real shim
|
|
94
|
+
* (`send(new Command(...))`) runs against a fake SDK and the command names
|
|
95
|
+
* it dispatches can be asserted. Ignored when `_client` is set. */
|
|
96
|
+
readonly _sdk?: CloudWatchSdkModule;
|
|
93
97
|
}
|
|
94
98
|
export interface CloudWatchLikeClient {
|
|
95
99
|
putLogEvents(input: {
|
|
@@ -112,6 +116,22 @@ export interface CloudWatchLikeClient {
|
|
|
112
116
|
logStreamName: string;
|
|
113
117
|
}): Promise<unknown>;
|
|
114
118
|
}
|
|
119
|
+
/**
|
|
120
|
+
* The slice of `@aws-sdk/client-cloudwatch-logs` this shim touches.
|
|
121
|
+
*
|
|
122
|
+
* Exported since 9.4.0 so `opts._sdk` can name it — which is what lets the
|
|
123
|
+
* shared command-name pin (test/adapters/aws/) assert the OPERATIONS this
|
|
124
|
+
* adapter dispatches without an AWS account or the peer dep installed. A
|
|
125
|
+
* `_client` double proves the batching; only an `_sdk` double can prove the
|
|
126
|
+
* adapter reaches for `PutLogEvents` and not something that does not exist.
|
|
127
|
+
*/
|
|
128
|
+
export interface CloudWatchSdkModule {
|
|
129
|
+
readonly CloudWatchLogsClient?: new (config: {
|
|
130
|
+
region?: string;
|
|
131
|
+
}) => unknown;
|
|
132
|
+
readonly PutLogEventsCommand?: new (input: unknown) => unknown;
|
|
133
|
+
readonly CreateLogStreamCommand?: new (input: unknown) => unknown;
|
|
134
|
+
}
|
|
115
135
|
/**
|
|
116
136
|
* Internal: shared CloudWatch Logs base used by every adapter that
|
|
117
137
|
* ships to CWL. `cloudwatchObservability` is the public generic
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cloudwatch.d.ts","sourceRoot":"","sources":["../../../../src/adapters/observability/cloudwatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAMvE,MAAM,WAAW,8BAA8B;IAC7C,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;0DAOsD;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;4BAKwB;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;oDAEgD;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;mEAC+D;IAC/D,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACvE;sCACkC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;
|
|
1
|
+
{"version":3,"file":"cloudwatch.d.ts","sourceRoot":"","sources":["../../../../src/adapters/observability/cloudwatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAMvE,MAAM,WAAW,8BAA8B;IAC7C,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;0DAOsD;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;4BAKwB;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;oDAEgD;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;mEAC+D;IAC/D,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACvE;sCACkC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC;IACxC;;wEAEoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAID,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,KAAK,EAAE;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,aAAa,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAClE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrB;;;;;;OAMG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5F;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,KAAK,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;IAC7E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC/D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CACnE;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,8BAA8B,EACpC,YAAY,EAAE,MAAM,GACnB,qBAAqB,CAsOvB;AA4BD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,8BAA8B,GACnC,qBAAqB,CAEvB"}
|
|
@@ -94,11 +94,29 @@ export interface XrayObservabilityOptions {
|
|
|
94
94
|
readonly onError?: (error: Error, event?: AgentfootprintEvent) => void;
|
|
95
95
|
/** Test injection — bypasses SDK lazy-require entirely. */
|
|
96
96
|
readonly _client?: XRayLikeClient;
|
|
97
|
+
/** @internal Test injection (9.4.0) — the AWS SDK module, so the real shim
|
|
98
|
+
* (`send(new Command(...))`) runs against a fake SDK and the command name it
|
|
99
|
+
* dispatches can be asserted. Ignored when `_client` is set. */
|
|
100
|
+
readonly _sdk?: XRaySdkModule;
|
|
97
101
|
}
|
|
98
102
|
export interface XRayLikeClient {
|
|
99
103
|
putTraceSegments(input: {
|
|
100
104
|
TraceSegmentDocuments: ReadonlyArray<string>;
|
|
101
105
|
}): Promise<unknown>;
|
|
102
106
|
}
|
|
107
|
+
/**
|
|
108
|
+
* The slice of `@aws-sdk/client-xray` this shim touches.
|
|
109
|
+
*
|
|
110
|
+
* Exported since 9.4.0 so `opts._sdk` can name it — which is what lets the
|
|
111
|
+
* shared command-name pin (test/adapters/aws/) assert that this adapter
|
|
112
|
+
* dispatches `PutTraceSegments` and nothing invented, without an AWS account
|
|
113
|
+
* or the peer dep installed.
|
|
114
|
+
*/
|
|
115
|
+
export interface XRaySdkModule {
|
|
116
|
+
readonly XRayClient?: new (config: {
|
|
117
|
+
region?: string;
|
|
118
|
+
}) => unknown;
|
|
119
|
+
readonly PutTraceSegmentsCommand?: new (input: unknown) => unknown;
|
|
120
|
+
}
|
|
103
121
|
export declare function xrayObservability(opts: XrayObservabilityOptions): ObservabilityStrategy;
|
|
104
122
|
//# sourceMappingURL=xray.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"xray.d.ts","sourceRoot":"","sources":["../../../../src/adapters/observability/xray.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAMvE,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;iCAC6B;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;oDAEgD;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;0CAEsC;IACtC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;yCACqC;IACrC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACvE,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"xray.d.ts","sourceRoot":"","sources":["../../../../src/adapters/observability/xray.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAMvE,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;iCAC6B;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;oDAEgD;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;0CAEsC;IACtC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;yCACqC;IACrC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACvE,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC;;qEAEiE;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;CAC/B;AAID,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CAAC,KAAK,EAAE;QAAE,qBAAqB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;IACnE,QAAQ,CAAC,uBAAuB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CACpE;AAwBD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,qBAAqB,CA4ZvF"}
|
|
@@ -1,152 +1,106 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* agentCorePolicy —
|
|
3
|
-
*
|
|
2
|
+
* agentCorePolicy — **RETIRED in 9.4.0.** The factory still exists and still
|
|
3
|
+
* type-checks; calling it now refuses, by name, with the reason and the
|
|
4
|
+
* alternatives. Nothing was removed from the public surface.
|
|
4
5
|
*
|
|
5
|
-
*
|
|
6
|
+
* ── What was wrong ──────────────────────────────────────────────────────────
|
|
7
|
+
* This adapter dispatched `EvaluatePolicyCommand` against
|
|
8
|
+
* `@aws-sdk/client-bedrock-agentcore`. **That command does not exist** — not in
|
|
9
|
+
* 3.1066.0, not in any version, not under any other name. The AgentCore
|
|
10
|
+
* data-plane client has no authorization-evaluation operation at all
|
|
11
|
+
* (`EvaluateCommand` is there, but it scores agent transcripts against an
|
|
12
|
+
* evaluator; it decides nothing about permissions). The policy surface is
|
|
13
|
+
* **control-plane only**: you author and attach policies, and **AgentCore
|
|
14
|
+
* enforces them AT THE GATEWAY**, in front of the tool, before any request
|
|
15
|
+
* reaches your process.
|
|
6
16
|
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
* }).build();
|
|
17
|
+
* So every `check()` this adapter ever ran ended in the `catch` — and the
|
|
18
|
+
* default is fail-closed, which means it denied every tool call and said the
|
|
19
|
+
* policy engine was unreachable. It compiled, it passed its tests (all of which
|
|
20
|
+
* injected `_client` past the SDK), and it could never have worked.
|
|
12
21
|
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
22
|
+
* ── Why a refusal rather than a deletion ────────────────────────────────────
|
|
23
|
+
* Deleting an export breaks a build with a module-resolution error that
|
|
24
|
+
* explains nothing. A factory that refuses breaks the same build with a
|
|
25
|
+
* paragraph that names the mistake, the alternative, and where denials really
|
|
26
|
+
* come from. The removal decision belongs to the next major.
|
|
16
27
|
*
|
|
17
|
-
* ──
|
|
28
|
+
* ── What to use instead ─────────────────────────────────────────────────────
|
|
29
|
+
* • **Local, in-process rules** — `PermissionPolicy.fromRoles(...)` behind
|
|
30
|
+
* the same `permissionChecker` port. Synchronous, so it doubles as a
|
|
31
|
+
* `gatedTools` predicate.
|
|
32
|
+
* • **Anything richer** — the `.toolMiddleware()` chain: allow / deny / ask /
|
|
33
|
+
* transform per call, with the run's own history in hand.
|
|
34
|
+
* • **AgentCore Gateway policy** — already enforced, without this library's
|
|
35
|
+
* help. A denial arrives as an **MCP error** on the tool call made through
|
|
36
|
+
* `mcpClient(...)`, and lands in the loop as the tool's result, which the
|
|
37
|
+
* model reads and adapts to. The library's job there is to surface that
|
|
38
|
+
* denial honestly, not to pre-evaluate a copy of the rule.
|
|
18
39
|
*
|
|
19
|
-
*
|
|
20
|
-
*
|
|
21
|
-
*
|
|
22
|
-
* human can act on. `onUnavailable: 'allow-with-warning'` is available for
|
|
23
|
-
* teams rolling policy out gradually, and it is deliberately awkward to type,
|
|
24
|
-
* because "we could not check, so we allowed it" is a sentence you should have
|
|
25
|
-
* to write down on purpose.
|
|
26
|
-
*
|
|
27
|
-
* **2. The reason rides to the model AS DATA.** A denied tool call comes back
|
|
28
|
-
* to the LLM as a `tellLLM` string, not as an exception. The model then
|
|
29
|
-
* re-decides with the refusal in front of it, which is the difference between
|
|
30
|
-
* an agent that says "I am not allowed to do that" and a run that dies.
|
|
31
|
-
* Telemetry (`reason`) stays out of `tellLLM` — the model does not get taught
|
|
32
|
-
* the shape of the rule space.
|
|
33
|
-
*
|
|
34
|
-
* **3. One evaluation per (tool, principal) per turn.** The ReAct loop can put
|
|
35
|
-
* the same tool in front of the gate several times in one iteration; paying for
|
|
36
|
-
* a round-trip each time buys nothing, because nothing between them could have
|
|
37
|
-
* changed the answer. The cache key is the tool, the principal AND the
|
|
38
|
-
* iteration, so the NEXT turn re-asks — a policy that changed mid-conversation
|
|
39
|
-
* is honoured on the next turn rather than at the end of the run.
|
|
40
|
-
*
|
|
41
|
-
* ── Verification status, stated plainly ──────────────────────────────────────
|
|
42
|
-
* **Contract-mapped and injection-tested.** Every AWS interaction is exercised
|
|
43
|
-
* through the `_client` seam; no test in this repo reaches AWS, and none
|
|
44
|
-
* pretends to. Confirm the command and field names against your installed
|
|
45
|
-
* `@aws-sdk/client-bedrock-agentcore` — this adapter targets an
|
|
46
|
-
* evaluate-a-request shape and is structured so the request → decision mapping
|
|
47
|
-
* is unit-tested independently of the SDK. Real-cloud verification lands with a
|
|
48
|
-
* field deployment.
|
|
49
|
-
*
|
|
50
|
-
* Pattern: Adapter (GoF) + lazy peer-dep load. Role: Layer-3 cross-cutting
|
|
51
|
-
* guard, exactly where `PermissionPolicy` sits — this one just asks somebody
|
|
52
|
-
* else.
|
|
40
|
+
* The `PermissionChecker` port itself is untouched, and so is every local
|
|
41
|
+
* policy built on it. A real AgentCore *data-plane* authorization API, if one
|
|
42
|
+
* ever ships, plugs in behind that same port.
|
|
53
43
|
*/
|
|
54
44
|
import type { PermissionChecker } from '../types.js';
|
|
55
|
-
/**
|
|
45
|
+
/**
|
|
46
|
+
* What the policy engine answered.
|
|
47
|
+
*
|
|
48
|
+
* @deprecated 9.4.0 — kept so existing imports still compile. See the module
|
|
49
|
+
* header: there is no AgentCore data-plane policy evaluation to answer.
|
|
50
|
+
*/
|
|
56
51
|
export interface AgentCorePolicyEvaluation {
|
|
57
|
-
/**
|
|
58
|
-
* The engine's verdict. Compared case-insensitively against `'allow'`;
|
|
59
|
-
* ANYTHING else is a denial, including a value this adapter has never seen.
|
|
60
|
-
* An unrecognised verdict is not a permission.
|
|
61
|
-
*/
|
|
62
52
|
readonly decision: string;
|
|
63
|
-
/** Why, when the engine explains itself. Surfaces to the model on a denial. */
|
|
64
53
|
readonly reason?: string;
|
|
65
|
-
/** Which policy decided, for the audit trail. */
|
|
66
54
|
readonly policyId?: string;
|
|
67
55
|
}
|
|
68
56
|
/**
|
|
69
|
-
* The minimal surface
|
|
70
|
-
*
|
|
57
|
+
* The minimal surface the retired adapter called.
|
|
58
|
+
*
|
|
59
|
+
* @deprecated 9.4.0 — kept so existing imports still compile.
|
|
71
60
|
*/
|
|
72
61
|
export interface AgentCorePolicyClientLike {
|
|
73
62
|
evaluate(input: {
|
|
74
63
|
readonly policyStoreId: string;
|
|
75
|
-
/** Who is acting — the end user when the run carries one, else the agent. */
|
|
76
64
|
readonly principal: string;
|
|
77
|
-
/** What they are trying to do — the tool name for a tool call. */
|
|
78
65
|
readonly action: string;
|
|
79
|
-
/** What they are trying to do it to — the capability being exercised. */
|
|
80
66
|
readonly resource: string;
|
|
81
|
-
/** Everything else the policy may want to read. */
|
|
82
67
|
readonly context?: Readonly<Record<string, unknown>>;
|
|
83
68
|
}): Promise<AgentCorePolicyEvaluation>;
|
|
84
69
|
}
|
|
85
|
-
/**
|
|
70
|
+
/**
|
|
71
|
+
* What to do when the policy engine cannot be reached.
|
|
72
|
+
*
|
|
73
|
+
* @deprecated 9.4.0 — kept so existing imports still compile.
|
|
74
|
+
*/
|
|
86
75
|
export type AgentCorePolicyUnavailable = 'deny' | 'allow-with-warning';
|
|
87
|
-
/**
|
|
76
|
+
/**
|
|
77
|
+
* Options for the retired {@link agentCorePolicy}.
|
|
78
|
+
*
|
|
79
|
+
* @deprecated 9.4.0 — kept so existing imports still compile.
|
|
80
|
+
*/
|
|
88
81
|
export interface AgentCorePolicyOptions {
|
|
89
|
-
/** The AgentCore policy store to evaluate against. Required. */
|
|
90
82
|
readonly policyStoreId: string;
|
|
91
|
-
/** AWS region, when the adapter constructs the SDK client itself. */
|
|
92
83
|
readonly region?: string;
|
|
93
|
-
/**
|
|
94
|
-
* What an evaluation FAILURE means. Default `'deny'` — fail closed.
|
|
95
|
-
*
|
|
96
|
-
* `'allow-with-warning'` allows the call and reports the failure through
|
|
97
|
-
* `onWarning`, for a rollout where the policy store is not yet the source of
|
|
98
|
-
* truth. It never applies to a successful evaluation that said no: an
|
|
99
|
-
* explicit denial is always a denial.
|
|
100
|
-
*/
|
|
101
84
|
readonly onUnavailable?: AgentCorePolicyUnavailable;
|
|
102
|
-
/**
|
|
103
|
-
* Called when `onUnavailable: 'allow-with-warning'` lets a call through.
|
|
104
|
-
* Default: `console.warn`. Give it your logger so the allow-on-failure is
|
|
105
|
-
* something an on-call engineer can find later.
|
|
106
|
-
*/
|
|
107
85
|
readonly onWarning?: (message: string, error: Error) => void;
|
|
108
|
-
/**
|
|
109
|
-
* Derive the policy principal from the run's identity. Default:
|
|
110
|
-
* `identity.principal`, else `identity.tenant`, else `'agent'`.
|
|
111
|
-
*
|
|
112
|
-
* The default is also the cache key, so a checker shared across users never
|
|
113
|
-
* hands one user's decision to another.
|
|
114
|
-
*/
|
|
115
86
|
readonly principalFor?: (identity: {
|
|
116
87
|
readonly principal?: string;
|
|
117
88
|
readonly tenant?: string;
|
|
118
89
|
} | undefined) => string;
|
|
119
|
-
/** Stable name, surfaced on permission events. Default `'agentCorePolicy'`. */
|
|
120
90
|
readonly name?: string;
|
|
121
|
-
/** Most decisions to keep cached at once. Default 500. Oldest are evicted first. */
|
|
122
91
|
readonly cacheSize?: number;
|
|
123
|
-
/** @internal
|
|
92
|
+
/** @internal */
|
|
124
93
|
readonly _client?: AgentCorePolicyClientLike;
|
|
125
|
-
/** @internal
|
|
94
|
+
/** @internal */
|
|
126
95
|
readonly _sdk?: BedrockAgentCorePolicySdkModule;
|
|
127
96
|
}
|
|
128
97
|
/**
|
|
129
|
-
*
|
|
98
|
+
* The slice of `@aws-sdk/client-bedrock-agentcore` the retired shim reached for.
|
|
99
|
+
* `EvaluatePolicyCommand` is listed here as the record of a command that never
|
|
100
|
+
* existed — see the module header.
|
|
130
101
|
*
|
|
131
|
-
*
|
|
132
|
-
* particular `gatedTools(...)` is a DIFFERENT layer and stays untouched: the
|
|
133
|
-
* gate decides what the model is shown, this decides what actually runs, and
|
|
134
|
-
* neither needs to be told the other exists. A tool hidden by a gate is never
|
|
135
|
-
* evaluated (the model cannot call what it cannot see); a tool the gate shows
|
|
136
|
-
* still has to get past the policy.
|
|
137
|
-
*
|
|
138
|
-
* @example Fail closed (the default)
|
|
139
|
-
* permissionChecker: agentCorePolicy({ policyStoreId, region: 'us-west-2' })
|
|
140
|
-
*
|
|
141
|
-
* @example Rolling policy out, with the allow-on-failure logged where you can find it
|
|
142
|
-
* agentCorePolicy({
|
|
143
|
-
* policyStoreId,
|
|
144
|
-
* onUnavailable: 'allow-with-warning',
|
|
145
|
-
* onWarning: (message, error) => logger.warn({ err: error }, message),
|
|
146
|
-
* });
|
|
102
|
+
* @deprecated 9.4.0 — kept so existing imports still compile.
|
|
147
103
|
*/
|
|
148
|
-
export declare function agentCorePolicy(options: AgentCorePolicyOptions): PermissionChecker;
|
|
149
|
-
/** The slice of `@aws-sdk/client-bedrock-agentcore` this shim touches. */
|
|
150
104
|
export interface BedrockAgentCorePolicySdkModule {
|
|
151
105
|
readonly BedrockAgentCoreClient?: new (config: {
|
|
152
106
|
region?: string;
|
|
@@ -155,4 +109,24 @@ export interface BedrockAgentCorePolicySdkModule {
|
|
|
155
109
|
};
|
|
156
110
|
readonly EvaluatePolicyCommand?: new (input: unknown) => unknown;
|
|
157
111
|
}
|
|
112
|
+
/**
|
|
113
|
+
* Raised by {@link agentCorePolicy}. Carries the whole explanation in
|
|
114
|
+
* `message`; the class exists so a caller can catch this specific retirement
|
|
115
|
+
* rather than pattern-matching prose.
|
|
116
|
+
*/
|
|
117
|
+
export declare class AgentCorePolicyRetiredError extends Error {
|
|
118
|
+
readonly code: "ERR_AGENTCORE_POLICY_RETIRED";
|
|
119
|
+
constructor();
|
|
120
|
+
}
|
|
121
|
+
/**
|
|
122
|
+
* **Retired (9.4.0).** Throws {@link AgentCorePolicyRetiredError} naming why,
|
|
123
|
+
* what to use for local rules, and where Gateway-enforced denials actually
|
|
124
|
+
* arrive. See the module header for the full story.
|
|
125
|
+
*
|
|
126
|
+
* @deprecated 9.4.0 — use `PermissionPolicy.fromRoles(...)` (local rules) or
|
|
127
|
+
* `.toolMiddleware()` (conditional rules); AgentCore Gateway policy is enforced
|
|
128
|
+
* at the Gateway and surfaces as an MCP error on the tool call.
|
|
129
|
+
* @throws {AgentCorePolicyRetiredError} always.
|
|
130
|
+
*/
|
|
131
|
+
export declare function agentCorePolicy(_options: AgentCorePolicyOptions): PermissionChecker;
|
|
158
132
|
//# sourceMappingURL=agentcore.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../../../src/adapters/security/agentcore.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../../../src/adapters/security/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACtD,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,oBAAoB,CAAC;AAEvE;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,0BAA0B,CAAC;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE,CACtB,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,KAC5E,MAAM,CAAC;IACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB;IAChB,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;IAC7C,gBAAgB;IAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,+BAA+B,CAAC;CACjD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,sBAAsB,CAAC,EAAE,KAAK,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK;QACrE,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAClE;AAED;;;;GAIG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,IAAI,iCAA2C;;CA6BzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,sBAAsB,GAAG,iBAAiB,CAEnF"}
|
|
@@ -38,6 +38,9 @@ export interface RunContext {
|
|
|
38
38
|
/** Optional turn/iter indices from agent runtime. */
|
|
39
39
|
readonly turnIndex?: number;
|
|
40
40
|
readonly iterIndex?: number;
|
|
41
|
+
/** The hosting conversation this run belongs to, when it belongs to one
|
|
42
|
+
* (9.4.0). Absent for an unhosted or anonymous run — never fabricated. */
|
|
43
|
+
readonly sessionId?: string;
|
|
41
44
|
}
|
|
42
45
|
/**
|
|
43
46
|
* Build an EventMeta from a stage origin + run-level context.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"eventMeta.d.ts","sourceRoot":"","sources":["../../../src/bridge/eventMeta.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAMpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,GAAG,gBAAgB,GAAG,SAAS,EAClD,GAAG,EAAE,UAAU,GACd,SAAS,
|
|
1
|
+
{"version":3,"file":"eventMeta.d.ts","sourceRoot":"","sources":["../../../src/bridge/eventMeta.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAMpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,qDAAqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;+EAC2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,WAAW,GAAG,gBAAgB,GAAG,SAAS,EAClD,GAAG,EAAE,UAAU,GACd,SAAS,CA4BX;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,MAAM,EAAE,CAG3E"}
|
|
@@ -57,6 +57,22 @@ export interface AgentRunOptions extends RunOptions {
|
|
|
57
57
|
correlationId?: string;
|
|
58
58
|
/** OTEL-style trace id — forwarded onto every emitted event's `EventMeta.traceId`. Falls back to `options.env?.traceId` when unset. */
|
|
59
59
|
traceId?: string;
|
|
60
|
+
/**
|
|
61
|
+
* The hosting CONVERSATION this run belongs to (9.4.0) — forwarded onto
|
|
62
|
+
* every emitted event's `EventMeta.sessionId`, and from there into whatever
|
|
63
|
+
* an observability strategy ships (the CloudWatch/AgentCore adapters
|
|
64
|
+
* serialize the whole envelope, so it arrives without their knowing).
|
|
65
|
+
*
|
|
66
|
+
* `runId` is per run; a session spans many. Without this, a shipped event
|
|
67
|
+
* stream can answer "what happened in this run?" and not "what happened in
|
|
68
|
+
* this conversation?", which is the question a session-oriented host is
|
|
69
|
+
* built around. `standingAgent` sets this for you from the request's own
|
|
70
|
+
* session id, on both `run()` and `resume()`.
|
|
71
|
+
*
|
|
72
|
+
* Omit it for an unhosted run. It is never derived, guessed, or defaulted to
|
|
73
|
+
* the runId: an absent session and an invented one are different facts.
|
|
74
|
+
*/
|
|
75
|
+
sessionId?: string;
|
|
60
76
|
/**
|
|
61
77
|
* Who this run is for — the same tuple as `run({ identity })`, reachable
|
|
62
78
|
* from the doors whose input is a stored conversation rather than a
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"Agent.d.ts","sourceRoot":"","sources":["../../../src/core/Agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAGL,KAAK,sBAAsB,EAI3B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAExB,KAAK,UAAU,EACf,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAOjE,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"Agent.d.ts","sourceRoot":"","sources":["../../../src/core/Agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAGL,KAAK,sBAAsB,EAI3B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAExB,KAAK,UAAU,EACf,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAOjE,OAAO,EAA+C,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAuClG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAGL,KAAK,qBAAqB,EAE3B,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAW/E,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAEtF,OAAO,EAAuB,KAAK,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAML,KAAK,kBAAkB,EAExB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAwC,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAElG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE9E,OAAO,EAAE,UAAU,EAAa,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAM/D,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,uBAAuB,EACvB,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAQrF,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,CAAC;AAMxB,YAAY,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,uBAAuB,EACvB,SAAS,EACT,gBAAgB,EAChB,WAAW,EACX,mBAAmB,GACpB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uIAAuI;IACvI,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAOD,qBAAa,KAAM,SAAQ,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAc;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAc;IACtD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAU;IAC/C;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IACxD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD;;mEAE+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAgD;IACrF;;4DAEwD;IACxD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAiD;IACtF;;+EAE2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAGb;IAC3B;8EAC0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAsB;IAC5D;;;uFAGmF;IACnF,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAwC;IACpF;;;;+CAI2C;IAC3C,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAA+C;IAC5F;;;4EAGwE;IACxE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAe;IAC7C,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAqB;IACjD,8EAA8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAgC;IAC/D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAoB;IACvD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAwB;IAC3D;;kFAE8E;IAC9E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD;;yDAEqD;IACrD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAc;IAC3C;uEACmE;IACnE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAiB;IACjD;;6EAEyE;IACzE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAC3D;8DAC0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA+B;IACjE;2EACuE;IACvE,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAwB;IAC/D;;iEAE6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD;;;;qCAIiC;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmB;IAChD;;uEAEmE;IACnE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqB;IACzD;uEACmE;IACnE,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAA4B;IACpE;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAS/B;IACJ,qEAAqE;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAA+B;IAC/D;;;4DAGwD;IACxD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IACzD;wDACoD;IACpD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAA0B;IAEnE;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE7D,OAAO,CAAC,iBAAiB,CAIvB;IAcF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;IAEvD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAA8B;IAClE;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAA4B;IAE/D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAkC;IAErE;;uEAEmE;IACnE,OAAO,CAAC,oBAAoB,CAAC,CAAwB;IAErD;;;8EAG0E;IAC1E,OAAO,CAAC,mBAAmB,CAAC,CAAwB;IAEpD;;iCAE6B;IAC7B,OAAO,CAAC,aAAa,CAAC,CAAS;IAE/B;;;4CAGwC;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAS;IAErC;;;iEAG6D;IAC7D,OAAO,CAAC,eAAe,CAAC,CAAiB;IAEzC;;gEAE4D;IAC5D,OAAO,CAAC,aAAa,CAAC,CAAS;IAE/B;;6EAEyE;IACzE,OAAO,CAAC,eAAe,CAAC,CAItB;IAEF;;sFAEkF;IAClF,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAEhD;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAe;IAErD;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAoB;IAEvD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAkB;IACnD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAS;IACzC;;;sBAGkB;IAClB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAqD;IACzF;qDACiD;IACjD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAA4C;IAClF;;;;4BAIwB;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4C;gBAGpE,IAAI,EAAE,YAAY,EAClB,iBAAiB,EAAE,MAAM,EACzB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,KAAK,EAAE;QACL,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KAC9D,EACD,UAAU,GAAE,SAAS,SAAS,EAAO,EACrC,QAAQ,GAAE,SAAS,gBAAgB,EAAO,EAC1C,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAChD,YAAY,CAAC,EAAE,YAAY,EAC3B,uBAAuB,GAAE,WAAsB,EAC/C,eAAe,UAAQ,EACvB,aAAa,CAAC,EAAE,aAAa,EAC7B,iBAAiB,CAAC,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACnD,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,oBAAoB,CAAC,EAAE,eAAe,GAAG,IAAI,EAC7C,mBAAmB,CAAC,EAAE,MAAM,EAC5B,mBAAmB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,MAAM,GAAG,SAAS,EACnE,mBAAmB,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,EACpE,sBAAsB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,EAC/F,cAAc,CAAC,EAAE,qBAAqB,EACtC,WAAW,CAAC,EAAE,WAAW,EACzB,cAAc,CAAC,EAAE,cAAc,EAC/B,cAAc,CAAC,EAAE,SAAS,cAAc,EAAE,EAC1C,iBAAiB,CAAC,EAAE,SAAS,iBAAiB,EAAE,EAChD,iBAAiB,CAAC,EAAE,yBAAyB,EAC7C,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,EACzC,0BAA0B,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,UAAU,EAClE,gBAAgB,CAAC,EAAE,OAAO,EAC1B,2BAA2B,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,SAAS,MAAM,EAAE;IA8J5E,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,GAAG,YAAY;IAI/C;;;;;OAKG;IACH,0BAA0B,IAAI,WAAW;IAIzC;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,IAAI,eAAe,GAAG,SAAS;IAI9C;;;;;;OAMG;IACH,uBAAuB,IAAI,SAAS,sBAAsB,EAAE;IAI5D;;;;;;OAMG;cAMgB,kBAAkB,IAAI,OAAO,iBAAiB,EAAE,eAAe,GAAG,SAAS;IAI9F;;;;;;;;6BAQyB;cACN,oBAAoB,IAAI,OAAO,iBAAiB,EAAE,aAAa;IAelF;;;;;;;;;;OAUG;IACH,WAAW,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC;IAUxC;;;;;;;;;OASG;IACG,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAqC5D;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAQ3B;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC;IAiB9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACG,GAAG,CACP,KAAK,EAAE,UAAU,GAAG,MAAM,EAC1B,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;IAuI5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACG,QAAQ,CACZ,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;IAc5C;;;;;;;;;;;;;;OAcG;IACH,YAAY,IACR;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACxF,SAAS;IAMb;;;;;;;;;;;;;OAaG;IACH,UAAU,IAAI,OAAO;IAIrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACG,aAAa,CACjB,UAAU,EAAE,kBAAkB,GAAG,OAAO,EACxC,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;IA4B5C;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAOnB;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IA4D1B,MAAM,CACV,UAAU,EAAE,mBAAmB,EAC/B,KAAK,CAAC,EAAE,OAAO,EACf,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,WAAW,GAAG,kBAAkB,CAAC;IA6C5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAyCG;IACH,UAAU,IAAI,kBAAkB,GAAG,SAAS;IA4B5C;;;;;;;;;;OAUG;IACH,OAAO,CAAC,aAAa;IAMrB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,iBAAiB;IAazB,6DAA6D;IAC7D,OAAO,CAAC,gBAAgB;IAMxB;4CACwC;IACxC,OAAO,CAAC,uBAAuB;IAM/B;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB;IAe7B;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI;IAIlD;;;;;;;;;;;;;;OAcG;IACH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,YAAY;IAWpB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,iBAAiB;IA2BzB,OAAO,CAAC,sBAAsB;IAqC9B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,+BAA+B;IAcvC,OAAO,CAAC,cAAc;IAuKtB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,YAAY,IAAI,UAAU,CAAC,cAAc,CAAC;IAO1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,mBAAmB,IAAI,UAAU,CAAC,qBAAqB,CAAC;IAOxD,OAAO,CAAC,cAAc;IAqItB,OAAO,CAAC,UAAU;CAoTnB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"toolCalls.d.ts","sourceRoot":"","sources":["../../../../../src/core/agent/stages/toolCalls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAIhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEjF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,EAIL,KAAK,qBAAqB,EAG3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,oBAAoB;IACnC;;4DAEwD;IACxD,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnD;;qDAEiD;IACjD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,YAAY,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;4DAEwD;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;kEAE8D;IAC9D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;8EAG0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;IAC1E;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAEpD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,yBAAyB,CAAC;IAC7D;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE;QAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,IAAI,CAAC;IACX;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9D;
|
|
1
|
+
{"version":3,"file":"toolCalls.d.ts","sourceRoot":"","sources":["../../../../../src/core/agent/stages/toolCalls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAIhF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEjF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,EAIL,KAAK,qBAAqB,EAG3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,oBAAoB;IACnC;;4DAEwD;IACxD,QAAQ,CAAC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnD;;qDAEiD;IACjD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,YAAY,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;4DAEwD;IACxD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;kEAE8D;IAC9D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;8EAG0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,cAAc,CAAC,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;IAC1E;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAEpD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACxD;;;OAGG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,yBAAyB,CAAC;IAC7D;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE;QAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,IAAI,CAAC;IACX;;;;;;;OAOG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9D;AAyHD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,oBAAoB,GACzB,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAmyCzC"}
|
|
@@ -4,8 +4,9 @@
|
|
|
4
4
|
* Two halves of the same question:
|
|
5
5
|
*
|
|
6
6
|
* • Authorization — `PermissionPolicy`, `PolicyHaltError`, the
|
|
7
|
-
* `PermissionChecker` port,
|
|
8
|
-
*
|
|
7
|
+
* `PermissionChecker` port, and thinking-block redaction. (`agentCorePolicy`
|
|
8
|
+
* is retired in 9.4.0 — AgentCore enforces policy at the Gateway, so there
|
|
9
|
+
* was never a data-plane call for it to make.)
|
|
9
10
|
* • Identity — the `CredentialProvider` port, the credential kinds
|
|
10
11
|
* (`bearer`, `apiKey`, `basic`, `headers`), `staticTokens`,
|
|
11
12
|
* `withCredentialRetry`, and `agentCoreIdentity`.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/doors/security.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/doors/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC"}
|
|
@@ -30,7 +30,7 @@ export interface ListenOptions {
|
|
|
30
30
|
readonly signal?: AbortSignal;
|
|
31
31
|
}
|
|
32
32
|
export type Unsubscribe = () => void;
|
|
33
|
-
export type DomainWildcard = 'agentfootprint.composition.*' | 'agentfootprint.agent.*' | 'agentfootprint.stream.*' | 'agentfootprint.context.*' | 'agentfootprint.memory.*' | 'agentfootprint.tools.*' | 'agentfootprint.skill.*' | 'agentfootprint.permission.*' | 'agentfootprint.risk.*' | 'agentfootprint.fallback.*' | 'agentfootprint.cost.*' | 'agentfootprint.eval.*' | 'agentfootprint.error.*' | 'agentfootprint.pause.*' | 'agentfootprint.checkin.*' | 'agentfootprint.middleware.*' | 'agentfootprint.embedding.*';
|
|
33
|
+
export type DomainWildcard = 'agentfootprint.composition.*' | 'agentfootprint.agent.*' | 'agentfootprint.stream.*' | 'agentfootprint.context.*' | 'agentfootprint.memory.*' | 'agentfootprint.tools.*' | 'agentfootprint.skill.*' | 'agentfootprint.permission.*' | 'agentfootprint.credential.*' | 'agentfootprint.risk.*' | 'agentfootprint.fallback.*' | 'agentfootprint.cost.*' | 'agentfootprint.eval.*' | 'agentfootprint.error.*' | 'agentfootprint.pause.*' | 'agentfootprint.checkin.*' | 'agentfootprint.middleware.*' | 'agentfootprint.embedding.*';
|
|
34
34
|
export type AllWildcard = '*';
|
|
35
35
|
export type WildcardSubscription = DomainWildcard | AllWildcard;
|
|
36
36
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../../src/events/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,eAAe,CAAC;AAQvB,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,uBAAuB,IAAI,CAC7D,KAAK,EAAE,sBAAsB,CAAC,CAAC,CAAC,KAC7B,IAAI,CAAC;AAEV,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAiBrC,MAAM,MAAM,cAAc,GACtB,8BAA8B,GAC9B,wBAAwB,GACxB,yBAAyB,GACzB,0BAA0B,GAC1B,yBAAyB,GACzB,wBAAwB,GACxB,wBAAwB,GACxB,6BAA6B,GAC7B,uBAAuB,GACvB,2BAA2B,GAC3B,uBAAuB,GACvB,uBAAuB,GACvB,wBAAwB,GACxB,wBAAwB,GACxB,0BAA0B,GAC1B,6BAA6B,GAC7B,4BAA4B,CAAC;AAEjC,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC;AAE9B,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,WAAW,CAAC;AA6BhE;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAI1D;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO;IAWvD;;;;;OAKG;IACH,EAAE,CAAC,CAAC,SAAS,uBAAuB,EAClC,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,WAAW;IACd,0EAA0E;IAC1E,EAAE,CAAC,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,WAAW;IAShG;;;;OAIG;IACH,IAAI,CAAC,CAAC,SAAS,uBAAuB,EACpC,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,EAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,GACpC,WAAW;IACd,IAAI,CACF,IAAI,EAAE,oBAAoB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,GACpC,WAAW;IASd;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAsCjB;;;;;OAKG;IACH,GAAG,CAAC,CAAC,SAAS,uBAAuB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI;IACjF,GAAG,CAAC,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAgBjE;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,IAAI,IAAI;IAQ1B;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,IAAI,CAAC,EAAE,uBAAuB,GAAG,oBAAoB,GAAG,MAAM;IAc5E;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI;IAe1C,OAAO,CAAC,WAAW;IASnB;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,UAAU;IAyBlB,OAAO,CAAC,SAAS;CAKlB"}
|
|
1
|
+
{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../../src/events/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EACV,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,eAAe,CAAC;AAQvB,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,uBAAuB,IAAI,CAC7D,KAAK,EAAE,sBAAsB,CAAC,CAAC,CAAC,KAC7B,IAAI,CAAC;AAEV,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAiBrC,MAAM,MAAM,cAAc,GACtB,8BAA8B,GAC9B,wBAAwB,GACxB,yBAAyB,GACzB,0BAA0B,GAC1B,yBAAyB,GACzB,wBAAwB,GACxB,wBAAwB,GACxB,6BAA6B,GAO7B,6BAA6B,GAC7B,uBAAuB,GACvB,2BAA2B,GAC3B,uBAAuB,GACvB,uBAAuB,GACvB,wBAAwB,GACxB,wBAAwB,GACxB,0BAA0B,GAC1B,6BAA6B,GAC7B,4BAA4B,CAAC;AAEjC,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC;AAE9B,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,WAAW,CAAC;AA6BhE;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA0C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAI1D;;;OAGG;IACH,eAAe,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO;IAWvD;;;;;OAKG;IACH,EAAE,CAAC,CAAC,SAAS,uBAAuB,EAClC,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,WAAW;IACd,0EAA0E;IAC1E,EAAE,CAAC,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,WAAW;IAShG;;;;OAIG;IACH,IAAI,CAAC,CAAC,SAAS,uBAAuB,EACpC,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,EAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,GACpC,WAAW;IACd,IAAI,CACF,IAAI,EAAE,oBAAoB,EAC1B,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,GACpC,WAAW;IASd;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAsCjB;;;;;OAKG;IACH,GAAG,CAAC,CAAC,SAAS,uBAAuB,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI;IACjF,GAAG,CAAC,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAgBjE;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,IAAI,IAAI;IAQ1B;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,IAAI,CAAC,EAAE,uBAAuB,GAAG,oBAAoB,GAAG,MAAM;IAc5E;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI;IAe1C,OAAO,CAAC,WAAW;IASnB;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAUnB,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,UAAU;IAyBlB,OAAO,CAAC,SAAS;CAKlB"}
|
|
@@ -722,10 +722,32 @@ export interface CredentialAuthorizationRequiredPayload {
|
|
|
722
722
|
readonly service: string;
|
|
723
723
|
readonly sessionId: string;
|
|
724
724
|
}
|
|
725
|
-
/**
|
|
725
|
+
/**
|
|
726
|
+
* Credential resolution failed — the provider threw, so the tool is not run
|
|
727
|
+
* (fail-closed: never half-authed).
|
|
728
|
+
*
|
|
729
|
+
* **Never carries the credential, the token, or the authorization URL.** See
|
|
730
|
+
* the security contract on `CredentialProvider`: `reason` is the provider's own
|
|
731
|
+
* thrown message, so a provider must scrub secrets before throwing.
|
|
732
|
+
*
|
|
733
|
+
* `tool` and `errorClass` were added in 9.4.0, for the operator watching a
|
|
734
|
+
* dashboard rather than reading a transcript. Without the tool name this event
|
|
735
|
+
* says a service failed but not what stopped working; without the class every
|
|
736
|
+
* distinct failure is one undifferentiated string. Both are optional because
|
|
737
|
+
* neither is always knowable: `tool` is absent when the resolution was not made
|
|
738
|
+
* on a tool's behalf, and `errorClass` is absent when what was thrown was not
|
|
739
|
+
* an `Error`.
|
|
740
|
+
*/
|
|
726
741
|
export interface CredentialFailedPayload {
|
|
742
|
+
/** The service id the tool declared (or asked for), never the credential. */
|
|
727
743
|
readonly service: string;
|
|
744
|
+
/** The provider's thrown message. */
|
|
728
745
|
readonly reason: string;
|
|
746
|
+
/** The tool whose call needed it — the thing that actually stopped working. */
|
|
747
|
+
readonly tool?: string;
|
|
748
|
+
/** Constructor name of what was thrown (e.g. `'TypeError'`, `'TimeoutError'`)
|
|
749
|
+
* — the routable half of the failure, so alerts do not have to parse prose. */
|
|
750
|
+
readonly errorClass?: string;
|
|
729
751
|
}
|
|
730
752
|
export interface PermissionGateClosedPayload {
|
|
731
753
|
readonly gateId: string;
|