agentfootprint 9.64.0 → 9.66.0

package/dist/hosting/index.js

@@ -94,8 +94,8 @@
  *   process.on('SIGTERM', () => void handle.close());
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bearerToken = exports.sessionLifecycleConformance = exports.runSessionLifecycleConformance = exports.runSessionLifecycleCase = exports.formatConformanceReport = exports.resolveSessionOwner = exports.sessionRetention = exports.SessionsNotCarriedError = exports.SessionOwnershipConflictError = exports.SessionNotFoundError = exports.SessionRetentionUnavailableError = exports.SessionIndexUnavailableError = exports.SessionOpNeedsIdentityError = exports.AdmissionRefusedError = exports.VerifierUnavailableError = exports.IdentityNotVerifiedError = exports.ArtifactNotCarriedError = exports.ArtifactNotFoundError = exports.NoArtifactStoreError = exports.ArtifactSessionRequiredError = exports.InvalidWireOpError = exports.FrameTooLargeError = exports.ConversationClosedError = exports.UnreadableEnvelopeError = exports.NoPendingAskError = exports.AwaitingDecisionError = exports.PauseNotCarriedError = exports.ConcurrentRunError = exports.HostClosedError = exports.requireCapability = exports.DEFAULT_SWEEP_LIMIT = exports.DEFAULT_MAX_ACTIVE_SESSIONS = exports.standingAgent = exports.checkEnvelope = exports.readPausedRun = exports.readEnvelope = exports.toPausedEnvelope = exports.envelopeTranscript = exports.envelopeOwner = exports.toEnvelope = exports.UnreadableSessionFileError = exports.SqliteUnavailableError = exports.sqliteSessions = exports.memorySessions = exports.headerValue = exports.httpHost = exports.DEFAULT_SESSION_HEADER = exports.jsonWireWith = exports.jsonWire = exports.nodeHost = void 0;
-exports.ARTIFACT_GET_OP = exports.ARTIFACT_HEAD_OP = exports.artifactWireBody = exports.readArtifactWireOp = exports.WIRE_OPS = exports.refuseUnknownWireOp = exports.isWireOp = exports.ALL_WIRE_OPS = exports.SESSION_TRANSCRIPT_OP = exports.SESSION_LIST_OP = exports.sessionWireBody = exports.readSessionWireOp = exports.turnsPerHour = exports.spendLedger = exports.spendKeyFor = exports.verifyRequestIdentity = void 0;
+exports.runSessionLifecycleConformance = exports.runSessionLifecycleCase = exports.formatConformanceReport = exports.resolveSessionOwner = exports.sessionRetention = exports.WireRequestRefusal = exports.RequestTooLargeError = exports.SessionsNotCarriedError = exports.SessionOwnershipConflictError = exports.SessionNotFoundError = exports.SessionRetentionUnavailableError = exports.SessionIndexUnavailableError = exports.SessionOpNeedsIdentityError = exports.AdmissionRefusedError = exports.VerifierUnavailableError = exports.IdentityNotVerifiedError = exports.ArtifactNotCarriedError = exports.ArtifactNotFoundError = exports.NoArtifactStoreError = exports.ArtifactSessionRequiredError = exports.InvalidWireOpError = exports.FrameTooLargeError = exports.ConversationClosedError = exports.UnreadableEnvelopeError = exports.NoPendingAskError = exports.AwaitingDecisionError = exports.PauseNotCarriedError = exports.ConcurrentRunError = exports.HostClosedError = exports.requireCapability = exports.DEFAULT_SWEEP_LIMIT = exports.DEFAULT_MAX_ACTIVE_SESSIONS = exports.standingAgent = exports.checkEnvelope = exports.readPausedRun = exports.readEnvelope = exports.toPausedEnvelope = exports.envelopeTranscript = exports.envelopeOwner = exports.toEnvelope = exports.UnreadableSessionFileError = exports.SqliteUnavailableError = exports.sqliteSessions = exports.memorySessions = exports.headerValue = exports.httpHost = exports.DEFAULT_SESSION_HEADER = exports.jsonWireWith = exports.jsonWire = exports.nodeHost = void 0;
+exports.ARTIFACT_GET_OP = exports.ARTIFACT_HEAD_OP = exports.artifactWireBody = exports.readArtifactWireOp = exports.WIRE_OPS = exports.refuseUnknownWireOp = exports.isWireOp = exports.ALL_WIRE_OPS = exports.SESSION_TRANSCRIPT_OP = exports.SESSION_LIST_OP = exports.sessionWireBody = exports.readSessionWireOp = exports.turnsPerHour = exports.spendLedger = exports.spendKeyFor = exports.verifyRequestIdentity = exports.bearerToken = exports.sessionLifecycleConformance = void 0;
 var nodeHost_js_1 = require("./nodeHost.js");
 Object.defineProperty(exports, "nodeHost", { enumerable: true, get: function () { return nodeHost_js_1.nodeHost; } });
 Object.defineProperty(exports, "jsonWire", { enumerable: true, get: function () { return nodeHost_js_1.jsonWire; } });
@@ -153,6 +153,8 @@ Object.defineProperty(exports, "SessionRetentionUnavailableError", { enumerable:
 Object.defineProperty(exports, "SessionNotFoundError", { enumerable: true, get: function () { return errors_js_1.SessionNotFoundError; } });
 Object.defineProperty(exports, "SessionOwnershipConflictError", { enumerable: true, get: function () { return errors_js_1.SessionOwnershipConflictError; } });
 Object.defineProperty(exports, "SessionsNotCarriedError", { enumerable: true, get: function () { return errors_js_1.SessionsNotCarriedError; } });
+Object.defineProperty(exports, "RequestTooLargeError", { enumerable: true, get: function () { return errors_js_1.RequestTooLargeError; } });
+Object.defineProperty(exports, "WireRequestRefusal", { enumerable: true, get: function () { return errors_js_1.WireRequestRefusal; } });
 // Retention (9.42.0) — the ONE feature detection for the port's optional
 // `retention()` member, and the refusal a store without one produces. A door
 // rather than `sessions.retention?.()`, because `undefined` there reads as

package/dist/hosting/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hosting/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;;;;AAEH,6CAAyF;AAAhF,uGAAA,QAAQ,OAAA;AAAE,uGAAA,QAAQ,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,qHAAA,sBAAsB,OAAA;AAEjE,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAC/E,oCAAoC;AAEpC,6CAAsD;AAA7C,uGAAA,QAAQ,OAAA;AAAE,0GAAA,WAAW,OAAA;AAW9B,yDAAqD;AAA5C,mHAAA,cAAc,OAAA;AACvB,yDAI6B;AAH3B,mHAAA,cAAc,OAAA;AACd,2HAAA,sBAAsB,OAAA;AACtB,+HAAA,0BAA0B,OAAA;AAM5B,6CAQuB;AAPrB,yGAAA,UAAU,OAAA;AACV,4GAAA,aAAa,OAAA;AACb,iHAAA,kBAAkB,OAAA;AAClB,+GAAA,gBAAgB,OAAA;AAChB,2GAAA,YAAY,OAAA;AACZ,4GAAA,aAAa,OAAA;AACb,4GAAA,aAAa,OAAA;AAEf,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AAEtB,uCAA8E;AAArE,uHAAA,2BAA2B,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAEzD,yCAwBqB;AAvBnB,8GAAA,iBAAiB,OAAA;AACjB,4GAAA,eAAe,OAAA;AACf,+GAAA,kBAAkB,OAAA;AAClB,iHAAA,oBAAoB,OAAA;AACpB,kHAAA,qBAAqB,OAAA;AACrB,8GAAA,iBAAiB,OAAA;AACjB,oHAAA,uBAAuB,OAAA;AACvB,oHAAA,uBAAuB,OAAA;AACvB,+GAAA,kBAAkB,OAAA;AAClB,+GAAA,kBAAkB,OAAA;AAClB,yHAAA,4BAA4B,OAAA;AAC5B,iHAAA,oBAAoB,OAAA;AACpB,kHAAA,qBAAqB,OAAA;AACrB,oHAAA,uBAAuB,OAAA;AACvB,qHAAA,wBAAwB,OAAA;AACxB,qHAAA,wBAAwB,OAAA;AACxB,kHAAA,qBAAqB,OAAA;AACrB,wHAAA,2BAA2B,OAAA;AAC3B,yHAAA,4BAA4B,OAAA;AAC5B,6HAAA,gCAAgC,OAAA;AAChC,iHAAA,oBAAoB,OAAA;AACpB,0HAAA,6BAA6B,OAAA;AAC7B,oHAAA,uBAAuB,OAAA;AAIzB,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,kCAAkC;AAClC,6DAAyD;AAAhD,uHAAA,gBAAgB,OAAA;AAEzB,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,cAAc;AACd,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAE5B,4EAA4E;AAC5E,4EAA4E;AAC5E,4CAA4C;AAC5C,yCAAyC;AACzC,mDAKgC;AAJ9B,mHAAA,uBAAuB,OAAA;AACvB,mHAAA,uBAAuB,OAAA;AACvB,0HAAA,8BAA8B,OAAA;AAC9B,uHAAA,2BAA2B,OAAA;AAY7B,2EAA2E;AAC3E,iEAAiE;AACjE,8EAA8E;AAC9E,yDAAyD;AACzD,qEAA+E;AAAtE,sHAAA,WAAW,OAAA;AAAE,gIAAA,qBAAqB,OAAA;AAO3C,+EAA+E;AAC/E,uEAAuE;AACvE,2DAA2D;AAC3D,+CAAwE;AAA/D,2GAAA,WAAW,OAAA;AAAE,2GAAA,WAAW,OAAA;AAAE,4GAAA,YAAY,OAAA;AAuB/C,+EAA+E;AAC/E,yEAAyE;AACzE,qBAAqB;AACrB,mDAK0B;AAJxB,mHAAA,iBAAiB,OAAA;AACjB,iHAAA,eAAe,OAAA;AACf,iHAAA,eAAe,OAAA;AACf,uHAAA,qBAAqB,OAAA;AAQvB,2CAAqF;AAA5E,0GAAA,YAAY,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,iHAAA,mBAAmB,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAG9D,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2BAA2B;AAC3B,qDAK2B;AAJzB,qHAAA,kBAAkB,OAAA;AAClB,mHAAA,gBAAgB,OAAA;AAChB,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hosting/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6FG;;;;AAEH,6CAAyF;AAAhF,uGAAA,QAAQ,OAAA;AAAE,uGAAA,QAAQ,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,qHAAA,sBAAsB,OAAA;AAEjE,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAC/E,oCAAoC;AAEpC,6CAAsD;AAA7C,uGAAA,QAAQ,OAAA;AAAE,0GAAA,WAAW,OAAA;AAc9B,yDAAqD;AAA5C,mHAAA,cAAc,OAAA;AACvB,yDAI6B;AAH3B,mHAAA,cAAc,OAAA;AACd,2HAAA,sBAAsB,OAAA;AACtB,+HAAA,0BAA0B,OAAA;AAM5B,6CAQuB;AAPrB,yGAAA,UAAU,OAAA;AACV,4GAAA,aAAa,OAAA;AACb,iHAAA,kBAAkB,OAAA;AAClB,+GAAA,gBAAgB,OAAA;AAChB,2GAAA,YAAY,OAAA;AACZ,4GAAA,aAAa,OAAA;AACb,4GAAA,aAAa,OAAA;AAEf,uDAAmD;AAA1C,iHAAA,aAAa,OAAA;AAEtB,uCAA8E;AAArE,uHAAA,2BAA2B,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAEzD,yCA0BqB;AAzBnB,8GAAA,iBAAiB,OAAA;AACjB,4GAAA,eAAe,OAAA;AACf,+GAAA,kBAAkB,OAAA;AAClB,iHAAA,oBAAoB,OAAA;AACpB,kHAAA,qBAAqB,OAAA;AACrB,8GAAA,iBAAiB,OAAA;AACjB,oHAAA,uBAAuB,OAAA;AACvB,oHAAA,uBAAuB,OAAA;AACvB,+GAAA,kBAAkB,OAAA;AAClB,+GAAA,kBAAkB,OAAA;AAClB,yHAAA,4BAA4B,OAAA;AAC5B,iHAAA,oBAAoB,OAAA;AACpB,kHAAA,qBAAqB,OAAA;AACrB,oHAAA,uBAAuB,OAAA;AACvB,qHAAA,wBAAwB,OAAA;AACxB,qHAAA,wBAAwB,OAAA;AACxB,kHAAA,qBAAqB,OAAA;AACrB,wHAAA,2BAA2B,OAAA;AAC3B,yHAAA,4BAA4B,OAAA;AAC5B,6HAAA,gCAAgC,OAAA;AAChC,iHAAA,oBAAoB,OAAA;AACpB,0HAAA,6BAA6B,OAAA;AAC7B,oHAAA,uBAAuB,OAAA;AACvB,iHAAA,oBAAoB,OAAA;AACpB,+GAAA,kBAAkB,OAAA;AAIpB,yEAAyE;AACzE,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,kCAAkC;AAClC,6DAAyD;AAAhD,uHAAA,gBAAgB,OAAA;AAEzB,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,cAAc;AACd,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAE5B,4EAA4E;AAC5E,4EAA4E;AAC5E,4CAA4C;AAC5C,yCAAyC;AACzC,mDAKgC;AAJ9B,mHAAA,uBAAuB,OAAA;AACvB,mHAAA,uBAAuB,OAAA;AACvB,0HAAA,8BAA8B,OAAA;AAC9B,uHAAA,2BAA2B,OAAA;AAY7B,2EAA2E;AAC3E,iEAAiE;AACjE,8EAA8E;AAC9E,yDAAyD;AACzD,qEAA+E;AAAtE,sHAAA,WAAW,OAAA;AAAE,gIAAA,qBAAqB,OAAA;AAO3C,+EAA+E;AAC/E,uEAAuE;AACvE,2DAA2D;AAC3D,+CAAwE;AAA/D,2GAAA,WAAW,OAAA;AAAE,2GAAA,WAAW,OAAA;AAAE,4GAAA,YAAY,OAAA;AAuB/C,+EAA+E;AAC/E,yEAAyE;AACzE,qBAAqB;AACrB,mDAK0B;AAJxB,mHAAA,iBAAiB,OAAA;AACjB,iHAAA,eAAe,OAAA;AACf,iHAAA,eAAe,OAAA;AACf,uHAAA,qBAAqB,OAAA;AAQvB,2CAAqF;AAA5E,0GAAA,YAAY,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAAE,iHAAA,mBAAmB,OAAA;AAAE,sGAAA,QAAQ,OAAA;AAG9D,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,2BAA2B;AAC3B,qDAK2B;AAJzB,qHAAA,kBAAkB,OAAA;AAClB,mHAAA,gBAAgB,OAAA;AAChB,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA"}

package/dist/hosting-providers.js

@@ -26,6 +26,19 @@
  *     idleMs: 900000 }` declared, session affinity readable from header or
  *     query, and a `Sec-WebSocket-Protocol` bearer mapped into
  *     `headers.authorization`.
+ *   • `foundryResponsesHost({ port?, hostname?, model?, maxBodyBytes? })` — an
+ *     `AgentHost` for Microsoft Foundry's hosted-agent contract: `POST
+ *     /responses`, a `HEAD` capability probe on the same path, `GET /readiness`
+ *     answering `{"status":"healthy"}`, port 8088, and the session read from
+ *     `conversation` / `agent_session_id` / `session_id` in that order. It
+ *     streams when the BODY says `stream: true` — not the `Accept` header —
+ *     and frames that stream as the Responses lifecycle.
+ *     **Inbound only:** it is the door callers arrive at, and says nothing
+ *     about which model the agent calls. It does NOT provide Workflow
+ *     Visualizer topology; see the adapter's header.
+ *   • `responsesWire({ defaultModel?, sessionFields?, health? })` — the
+ *     Responses PROTOCOL as an `HttpWire`, with no vendor in it, for the next
+ *     runtime that speaks it on paths of its own.
  *   • `agentCoreSessions({ store })` — a `SessionLifecycle` whose checkpoint
  *     home you choose at construction: a JSON file in the runtime's own session
  *     storage (survives a stop/resume, needs no SDK), or one AgentCore Memory
@@ -88,13 +101,29 @@
  * symbols, one door. Import from the door.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FirestoreIndexMissingError = exports.EnvelopeTooLargeError = exports.FIRESTORE_MAX_ENVELOPE_BYTES = exports.FIRESTORE_MAX_DOCUMENT_BYTES = exports.EXPIRES_AT_FIELD = exports.DEFAULT_SESSION_COLLECTION = exports.firestoreSessions = exports.SESSION_EVENT_AUTHOR = exports.SESSION_STATE_KEY = exports.DEFAULT_USER_ID = exports.agentEngineSessions = exports.DEFAULT_SESSION_STORAGE_PATH = exports.agentCoreSessions = exports.readAgentCoreConversation = exports.agentCoreRuntimeWire = exports.agentCoreRuntimeHost = void 0;
+exports.FirestoreIndexMissingError = exports.EnvelopeTooLargeError = exports.FIRESTORE_MAX_ENVELOPE_BYTES = exports.FIRESTORE_MAX_DOCUMENT_BYTES = exports.EXPIRES_AT_FIELD = exports.DEFAULT_SESSION_COLLECTION = exports.firestoreSessions = exports.SESSION_EVENT_AUTHOR = exports.SESSION_STATE_KEY = exports.DEFAULT_USER_ID = exports.agentEngineSessions = exports.PUBLIC_FAILURE_MESSAGE = exports.DEFAULT_SESSION_FIELDS = exports.readResponsesSession = exports.readResponsesInput = exports.responsesWire = exports.FOUNDRY_SESSION_FIELDS = exports.FOUNDRY_READINESS_PATH = exports.FOUNDRY_INVOKE_PATH = exports.DEFAULT_FOUNDRY_PORT = exports.foundryResponsesHost = exports.DEFAULT_SESSION_STORAGE_PATH = exports.agentCoreSessions = exports.readAgentCoreConversation = exports.agentCoreRuntimeWire = exports.agentCoreRuntimeHost = void 0;
 var agentcore_js_1 = require("./adapters/hosting/agentcore.js");
 Object.defineProperty(exports, "agentCoreRuntimeHost", { enumerable: true, get: function () { return agentcore_js_1.agentCoreRuntimeHost; } });
 Object.defineProperty(exports, "agentCoreRuntimeWire", { enumerable: true, get: function () { return agentcore_js_1.agentCoreRuntimeWire; } });
 Object.defineProperty(exports, "readAgentCoreConversation", { enumerable: true, get: function () { return agentcore_js_1.readAgentCoreConversation; } });
 Object.defineProperty(exports, "agentCoreSessions", { enumerable: true, get: function () { return agentcore_js_1.agentCoreSessions; } });
 Object.defineProperty(exports, "DEFAULT_SESSION_STORAGE_PATH", { enumerable: true, get: function () { return agentcore_js_1.DEFAULT_SESSION_STORAGE_PATH; } });
+var foundryResponses_js_1 = require("./adapters/hosting/foundryResponses.js");
+Object.defineProperty(exports, "foundryResponsesHost", { enumerable: true, get: function () { return foundryResponses_js_1.foundryResponsesHost; } });
+Object.defineProperty(exports, "DEFAULT_FOUNDRY_PORT", { enumerable: true, get: function () { return foundryResponses_js_1.DEFAULT_FOUNDRY_PORT; } });
+Object.defineProperty(exports, "FOUNDRY_INVOKE_PATH", { enumerable: true, get: function () { return foundryResponses_js_1.FOUNDRY_INVOKE_PATH; } });
+Object.defineProperty(exports, "FOUNDRY_READINESS_PATH", { enumerable: true, get: function () { return foundryResponses_js_1.FOUNDRY_READINESS_PATH; } });
+Object.defineProperty(exports, "FOUNDRY_SESSION_FIELDS", { enumerable: true, get: function () { return foundryResponses_js_1.FOUNDRY_SESSION_FIELDS; } });
+// The protocol under it, on the barrel in its own right: a deployment that
+// speaks Responses on paths of its own is a `httpHost` away, and having to
+// import a vendor-named module to reach a vendor-neutral dialect would be the
+// split this pair exists to make.
+var responsesWire_js_1 = require("./adapters/hosting/responsesWire.js");
+Object.defineProperty(exports, "responsesWire", { enumerable: true, get: function () { return responsesWire_js_1.responsesWire; } });
+Object.defineProperty(exports, "readResponsesInput", { enumerable: true, get: function () { return responsesWire_js_1.readResponsesInput; } });
+Object.defineProperty(exports, "readResponsesSession", { enumerable: true, get: function () { return responsesWire_js_1.readResponsesSession; } });
+Object.defineProperty(exports, "DEFAULT_SESSION_FIELDS", { enumerable: true, get: function () { return responsesWire_js_1.DEFAULT_SESSION_FIELDS; } });
+Object.defineProperty(exports, "PUBLIC_FAILURE_MESSAGE", { enumerable: true, get: function () { return responsesWire_js_1.PUBLIC_FAILURE_MESSAGE; } });
 var googleAgentEngine_js_1 = require("./adapters/hosting/googleAgentEngine.js");
 Object.defineProperty(exports, "agentEngineSessions", { enumerable: true, get: function () { return googleAgentEngine_js_1.agentEngineSessions; } });
 Object.defineProperty(exports, "DEFAULT_USER_ID", { enumerable: true, get: function () { return googleAgentEngine_js_1.DEFAULT_USER_ID; } });

package/dist/hosting-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"hosting-providers.js","sourceRoot":"","sources":["../src/hosting-providers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuFG;;;AAEH,gEAMyC;AALvC,oHAAA,oBAAoB,OAAA;AACpB,oHAAA,oBAAoB,OAAA;AACpB,yHAAA,yBAAyB,OAAA;AACzB,iHAAA,iBAAiB,OAAA;AACjB,4HAAA,4BAA4B,OAAA;AAG9B,gFAKiD;AAJ/C,2HAAA,mBAAmB,OAAA;AACnB,uHAAA,eAAe,OAAA;AACf,yHAAA,iBAAiB,OAAA;AACjB,4HAAA,oBAAoB,OAAA;AAQtB,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,mBAAmB;AACnB,gFAaiD;AAZ/C,yHAAA,iBAAiB,OAAA;AACjB,kIAAA,0BAA0B,OAAA;AAC1B,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wHAAA,gBAAgB,OAAA;AAChB,oIAAA,4BAA4B,OAAA;AAC5B,oIAAA,4BAA4B,OAAA;AAC5B,6HAAA,qBAAqB,OAAA;AACrB,kIAAA,0BAA0B,OAAA"}
+{"version":3,"file":"hosting-providers.js","sourceRoot":"","sources":["../src/hosting-providers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoGG;;;AAEH,gEAMyC;AALvC,oHAAA,oBAAoB,OAAA;AACpB,oHAAA,oBAAoB,OAAA;AACpB,yHAAA,yBAAyB,OAAA;AACzB,iHAAA,iBAAiB,OAAA;AACjB,4HAAA,4BAA4B,OAAA;AAG9B,8EAMgD;AAL9C,2HAAA,oBAAoB,OAAA;AACpB,2HAAA,oBAAoB,OAAA;AACpB,0HAAA,mBAAmB,OAAA;AACnB,6HAAA,sBAAsB,OAAA;AACtB,6HAAA,sBAAsB,OAAA;AAKxB,2EAA2E;AAC3E,2EAA2E;AAC3E,8EAA8E;AAC9E,kCAAkC;AAClC,wEAM6C;AAL3C,iHAAA,aAAa,OAAA;AACb,sHAAA,kBAAkB,OAAA;AAClB,wHAAA,oBAAoB,OAAA;AACpB,0HAAA,sBAAsB,OAAA;AACtB,0HAAA,sBAAsB,OAAA;AAKxB,gFAKiD;AAJ/C,2HAAA,mBAAmB,OAAA;AACnB,uHAAA,eAAe,OAAA;AACf,yHAAA,iBAAiB,OAAA;AACjB,4HAAA,oBAAoB,OAAA;AAQtB,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,mBAAmB;AACnB,gFAaiD;AAZ/C,yHAAA,iBAAiB,OAAA;AACjB,kIAAA,0BAA0B,OAAA;AAC1B,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wHAAA,gBAAgB,OAAA;AAChB,oIAAA,4BAA4B,OAAA;AAC5B,oIAAA,4BAA4B,OAAA;AAC5B,6HAAA,qBAAqB,OAAA;AACrB,kIAAA,0BAA0B,OAAA"}

package/dist/identity.js

@@ -29,7 +29,7 @@
  * symbols, one door. Import from the door.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MissingJwksSupportError = exports.jwksIdentity = exports.CLOUD_PLATFORM_SCOPE = exports.googleIdentity = exports.vaultCredentials = exports.agentCoreIdentity = exports.withCredentialRetry = exports.CredentialConsentRequiredError = exports.staticTokens = exports.headers = exports.basic = exports.apiKey = exports.bearer = exports.unconfiguredCredentialProvider = exports.isCredentialIssued = void 0;
+exports.MissingJwksSupportError = exports.jwksIdentity = exports.CLOUD_PLATFORM_SCOPE = exports.googleIdentity = exports.vaultCredentials = exports.completeAgentCoreAuthorization = exports.agentCoreIdentity = exports.withCredentialRetry = exports.CredentialConsentRequiredError = exports.staticTokens = exports.headers = exports.basic = exports.apiKey = exports.bearer = exports.unconfiguredCredentialProvider = exports.isCredentialIssued = void 0;
 var types_js_1 = require("./identity/types.js");
 Object.defineProperty(exports, "isCredentialIssued", { enumerable: true, get: function () { return types_js_1.isCredentialIssued; } });
 Object.defineProperty(exports, "unconfiguredCredentialProvider", { enumerable: true, get: function () { return types_js_1.unconfiguredCredentialProvider; } });
@@ -46,6 +46,10 @@ var withCredentialRetry_js_1 = require("./identity/withCredentialRetry.js");
 Object.defineProperty(exports, "withCredentialRetry", { enumerable: true, get: function () { return withCredentialRetry_js_1.withCredentialRetry; } });
 var agentcore_js_1 = require("./adapters/identity/agentcore.js");
 Object.defineProperty(exports, "agentCoreIdentity", { enumerable: true, get: function () { return agentcore_js_1.agentCoreIdentity; } });
+// The consent handshake (9.66.0) — called from YOUR callback route, not from
+// the agent run, which is why it is a function of its own rather than a
+// method on the provider that route never sees.
+Object.defineProperty(exports, "completeAgentCoreAuthorization", { enumerable: true, get: function () { return agentcore_js_1.completeAgentCoreAuthorization; } });
 // HashiCorp-Vault-compatible KV v2, over plain HTTP (9.8.0) — no SDK, no
 // vendor client. V1 is token auth + KV v2 + no leases, and every other shape
 // is refused by name rather than guessed at; see the module docstring.

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAWH,gDAAyF;AAAhF,8GAAA,kBAAkB,OAAA;AAAE,0HAAA,8BAA8B,OAAA;AAC3D,gDAS6B;AAR3B,kGAAA,MAAM,OAAA;AACN,kGAAA,MAAM,OAAA;AACN,iGAAA,KAAK,OAAA;AACL,mGAAA,OAAO,OAAA;AAMT,8DAAoF;AAA3E,+GAAA,YAAY,OAAA;AAKrB,kGAGsD;AAFpD,mJAAA,8BAA8B,OAAA;AAGhC,4EAG2C;AAFzC,6HAAA,mBAAmB,OAAA;AAGrB,iEAK0C;AAJxC,iHAAA,iBAAiB,OAAA;AAKnB,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,yDAA8F;AAArF,4GAAA,gBAAgB,OAAA;AAEzB,4EAA4E;AAC5E,uEAAuE;AACvE,6EAA6E;AAC7E,6DAA6D;AAC7D,2DAMuC;AALrC,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AAMtB,8EAA8E;AAC9E,iEAAiE;AACjE,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,uDAKqC;AAJnC,uGAAA,YAAY,OAAA;AACZ,kHAAA,uBAAuB,OAAA"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAWH,gDAAyF;AAAhF,8GAAA,kBAAkB,OAAA;AAAE,0HAAA,8BAA8B,OAAA;AAC3D,gDAS6B;AAR3B,kGAAA,MAAM,OAAA;AACN,kGAAA,MAAM,OAAA;AACN,iGAAA,KAAK,OAAA;AACL,mGAAA,OAAO,OAAA;AAMT,8DAAoF;AAA3E,+GAAA,YAAY,OAAA;AAKrB,kGAGsD;AAFpD,mJAAA,8BAA8B,OAAA;AAGhC,4EAG2C;AAFzC,6HAAA,mBAAmB,OAAA;AAGrB,iEAU0C;AATxC,iHAAA,iBAAiB,OAAA;AACjB,6EAA6E;AAC7E,wEAAwE;AACxE,gDAAgD;AAChD,8HAAA,8BAA8B,OAAA;AAMhC,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,yDAA8F;AAArF,4GAAA,gBAAgB,OAAA;AAEzB,4EAA4E;AAC5E,uEAAuE;AACvE,6EAA6E;AAC7E,6DAA6D;AAC7D,2DAMuC;AALrC,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AAMtB,8EAA8E;AAC9E,iEAAiE;AACjE,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,uDAKqC;AAJnC,uGAAA,YAAY,OAAA;AACZ,kHAAA,uBAAuB,OAAA"}

package/dist/observability-providers.js

@@ -46,9 +46,14 @@
  * symbols, one door. Import from the door.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.githubDeviceSignIn = exports.githubBugReporter = exports.CANONICAL_JSON_VERSION = exports.canonicalJson = exports.AUDIT_ZERO_HASH = exports.AUDIT_GENESIS_EVENT_TYPE = exports.AUDIT_BUNDLE_FORMAT = exports.verifyAuditBundle = exports.auditExport = exports.fileObservability = exports.otelObservability = exports.xrayObservability = exports.cloudwatchObservability = exports.agentcoreObservability = void 0;
+exports.githubDeviceSignIn = exports.githubBugReporter = exports.CANONICAL_JSON_VERSION = exports.canonicalJson = exports.AUDIT_ZERO_HASH = exports.AUDIT_GENESIS_EVENT_TYPE = exports.AUDIT_BUNDLE_FORMAT = exports.verifyAuditBundle = exports.auditExport = exports.fileObservability = exports.otelObservability = exports.xrayObservability = exports.cloudwatchObservability = exports.AGENTCORE_EVALUATIONS_SCOPE_NAME = exports.agentCoreEvaluationSpans = exports.agentcoreObservability = void 0;
 var agentcore_js_1 = require("./adapters/observability/agentcore.js");
 Object.defineProperty(exports, "agentcoreObservability", { enumerable: true, get: function () { return agentcore_js_1.agentcoreObservability; } });
+// Spans shaped for AgentCore Evaluations (9.66.0) — a configuration of
+// `otelObservability`, kept in the vendor's file because the requirement
+// (the scope name their classifier routes on) is the vendor's.
+Object.defineProperty(exports, "agentCoreEvaluationSpans", { enumerable: true, get: function () { return agentcore_js_1.agentCoreEvaluationSpans; } });
+Object.defineProperty(exports, "AGENTCORE_EVALUATIONS_SCOPE_NAME", { enumerable: true, get: function () { return agentcore_js_1.AGENTCORE_EVALUATIONS_SCOPE_NAME; } });
 var cloudwatch_js_1 = require("./adapters/observability/cloudwatch.js");
 Object.defineProperty(exports, "cloudwatchObservability", { enumerable: true, get: function () { return cloudwatch_js_1.cloudwatchObservability; } });
 var xray_js_1 = require("./adapters/observability/xray.js");

package/dist/observability-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability-providers.js","sourceRoot":"","sources":["../src/observability-providers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;;;AAEH,sEAG+C;AAF7C,sHAAA,sBAAsB,OAAA;AAGxB,wEAGgD;AAF9C,wHAAA,uBAAuB,OAAA;AAGzB,4DAI0C;AAHxC,4GAAA,iBAAiB,OAAA;AAInB,4DAS0C;AARxC,4GAAA,iBAAiB,OAAA;AASnB,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,4DAI0C;AAHxC,4GAAA,iBAAiB,OAAA;AAInB,sEAAsE;AACtE,sEAAsE;AACtE,8CAA8C;AAC9C,8DAY2C;AAXzC,uGAAA,WAAW,OAAA;AACX,6GAAA,iBAAiB,OAAA;AACjB,+GAAA,mBAAmB,OAAA;AACnB,oHAAA,wBAAwB,OAAA;AACxB,2GAAA,eAAe,OAAA;AAQjB,2DAA+E;AAAtE,iHAAA,aAAa,OAAA;AAAE,0HAAA,sBAAsB,OAAA;AAC9C,4EAA4E;AAC5E,6EAA6E;AAC7E,iEAAiE;AACjE,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,4DAA4D;AAC5D,sFAKuD;AAJrD,yHAAA,iBAAiB,OAAA;AAKnB,wFAKwD;AAJtD,2HAAA,kBAAkB,OAAA"}
+{"version":3,"file":"observability-providers.js","sourceRoot":"","sources":["../src/observability-providers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;;;AAEH,sEAQ+C;AAP7C,sHAAA,sBAAsB,OAAA;AACtB,uEAAuE;AACvE,yEAAyE;AACzE,+DAA+D;AAC/D,wHAAA,wBAAwB,OAAA;AACxB,gIAAA,gCAAgC,OAAA;AAGlC,wEAGgD;AAF9C,wHAAA,uBAAuB,OAAA;AAGzB,4DAI0C;AAHxC,4GAAA,iBAAiB,OAAA;AAInB,4DAS0C;AARxC,4GAAA,iBAAiB,OAAA;AASnB,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,4DAI0C;AAHxC,4GAAA,iBAAiB,OAAA;AAInB,sEAAsE;AACtE,sEAAsE;AACtE,8CAA8C;AAC9C,8DAY2C;AAXzC,uGAAA,WAAW,OAAA;AACX,6GAAA,iBAAiB,OAAA;AACjB,+GAAA,mBAAmB,OAAA;AACnB,oHAAA,wBAAwB,OAAA;AACxB,2GAAA,eAAe,OAAA;AAQjB,2DAA+E;AAAtE,iHAAA,aAAa,OAAA;AAAE,0HAAA,sBAAsB,OAAA;AAC9C,4EAA4E;AAC5E,6EAA6E;AAC7E,iEAAiE;AACjE,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,4DAA4D;AAC5D,sFAKuD;AAJrD,yHAAA,iBAAiB,OAAA;AAKnB,wFAKwD;AAJtD,2HAAA,kBAAkB,OAAA"}

package/dist/types/adapters/hosting/foundryResponses.d.ts

@@ -0,0 +1,90 @@
+/**
+ * adapters/hosting/foundryResponses — an agent behind Microsoft Foundry's
+ * hosted-agent contract.
+ *
+ * ── The split, and why it is here ────────────────────────────────────────────
+ * Two different things are needed to serve a Foundry hosted agent, and only one
+ * of them is Microsoft's:
+ *
+ *   • The **Responses protocol** — `input` items, a `response` object, the
+ *     named streaming lifecycle. That is a protocol several runtimes speak, so
+ *     it lives in `responsesWire.ts` with no vendor in it.
+ *   • The **hosting contract** — port 8088, `POST /responses`, a `HEAD` probe
+ *     on the same path, `GET /readiness` answering `{"status":"healthy"}`, and
+ *     `agent_session_id` as a session alias. That IS this runtime's contract,
+ *     the same way `/invocations` and `X-Amzn-…` are another's, and it is what
+ *     this file supplies.
+ *
+ * So this file is a configuration, not an implementation. Everything hard —
+ * draining on close, aborting when the caller hangs up, failing a handler that
+ * throws or answers nothing — is `httpHost`'s, shared with every other adapter
+ * rather than reimplemented here where the two would drift.
+ *
+ * ── What it does NOT do ──────────────────────────────────────────────────────
+ * **Workflow Visualizer topology is not provided.** The Inspector can invoke
+ * this host and render its answer; it does not learn that the answer came from
+ * four composed agents, because nothing in the Responses protocol carries that
+ * and inventing a channel for it would be claiming a compatibility this has
+ * never demonstrated. An agent's internal structure is readable from
+ * agentfootprint's own recorders.
+ *
+ * Everything the protocol does not carry — tool calls, image and file input,
+ * function-call output, structured output — is refused by name. See
+ * `responsesWire.ts`.
+ *
+ * This is an **inbound hosting adapter**: it is the door callers arrive at. It
+ * is not a model provider, and it has nothing to do with which model the agent
+ * calls — for Foundry models, that is `openai()` with the endpoint's base URL.
+ *
+ * @example  An agent behind the Inspector
+ *   import { foundryResponsesHost, memorySessions, standingAgent } from 'agentfootprint/hosting';
+ *
+ *   const handle = await standingAgent({
+ *     agent,
+ *     sessions: memorySessions(),
+ *     host: foundryResponsesHost(),
+ *   });
+ *   process.on('SIGTERM', () => void handle.close());
+ */
+/// <reference types="node" />
+import type { IncomingMessage, Server, ServerResponse } from 'node:http';
+import { type HttpHost } from '../../hosting/httpHost.js';
+/** The port a Foundry hosted agent is expected on. */
+export declare const DEFAULT_FOUNDRY_PORT = 8088;
+/** The path that takes a turn. */
+export declare const FOUNDRY_INVOKE_PATH = "/responses";
+/** The path a Foundry hosted agent answers a readiness probe on. */
+export declare const FOUNDRY_READINESS_PATH = "/readiness";
+/**
+ * Session aliases this contract accepts, in precedence order.
+ *
+ * `conversation` is the protocol's own; `agent_session_id` is this runtime's;
+ * `session_id` is the spelling several clients send anyway. First one present
+ * wins, so a caller using any of the three reaches the same session.
+ */
+export declare const FOUNDRY_SESSION_FIELDS: readonly string[];
+export interface FoundryResponsesHostOptions {
+    /** Port to bind. Default {@link DEFAULT_FOUNDRY_PORT}. Pass `0` for an ephemeral test port. */
+    readonly port?: number;
+    /** Interface to bind. Default `'0.0.0.0'` — a container's door has to be reachable from outside it. */
+    readonly hostname?: string;
+    /** Model label echoed in `response` objects when the request names none. */
+    readonly model?: string;
+    /** Ceiling on a request body. Default one mebibyte. */
+    readonly maxBodyBytes?: number;
+    /**
+     * A `node:http` server you own, to ATTACH these routes to rather than binding
+     * one. Refused together with `port`/`hostname`, which would name a socket
+     * this host does not bind.
+     */
+    readonly server?: Server;
+    /** Answer a path this host does not own. Private-server mode only. */
+    readonly onUnhandled?: (req: IncomingMessage, res: ServerResponse) => void;
+}
+/**
+ * An {@link HttpHost} speaking Foundry's hosted-agent contract.
+ *
+ * @param options - Port, interface, model label and body ceiling.
+ */
+export declare function foundryResponsesHost(options?: FoundryResponsesHostOptions): HttpHost;
+//# sourceMappingURL=foundryResponses.d.ts.map

package/dist/types/adapters/hosting/foundryResponses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"foundryResponses.d.ts","sourceRoot":"","sources":["../../../../src/adapters/hosting/foundryResponses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEzE,OAAO,EAAY,KAAK,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAGpE,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC,kCAAkC;AAClC,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAInD,CAAC;AAQF,MAAM,WAAW,2BAA2B;IAC1C,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uGAAuG;IACvG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;CAC5E;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,2BAAgC,GAAG,QAAQ,CA2BxF"}

package/dist/types/adapters/hosting/responsesWire.d.ts

@@ -0,0 +1,76 @@
+/**
+ * adapters/hosting/responsesWire — the Responses protocol, as an `HttpWire`.
+ *
+ * ── What this is, and what it deliberately is not ────────────────────────────
+ * This file speaks the **Responses** wire protocol: a request carries `input`
+ * as text or as message items, a reply is a `response` object with an id and a
+ * status, and a stream is a LIFECYCLE of named events that open the response,
+ * announce output, carry deltas, and close each part before closing the
+ * response itself.
+ *
+ * That protocol is nobody's product. It is the shape a Responses-speaking
+ * client sends and expects, and several hosted runtimes speak it. So it lives
+ * here as a dialect on its own, and the runtimes that CONFIGURE it — their
+ * paths, their ports, their probe bodies, their session aliases — live in their
+ * own files beside this one. Keeping the split means the next runtime that
+ * speaks Responses is a configuration rather than a copy, and it means no
+ * vendor's spelling ends up in the protocol.
+ *
+ * ── The subset ───────────────────────────────────────────────────────────────
+ * A text turn, streamed or not, with a session. Deliberately not the whole
+ * Responses API: tool calls, reasoning items, image/file input, structured
+ * output and function-call output are NOT carried, and each is REFUSED by name
+ * rather than dropped — a request whose content this dialect cannot represent
+ * is answered 400 before a turn is paid for, never answered 200 with the parts
+ * it happened to understand.
+ *
+ * @example  A host that speaks Responses on paths of its own choosing
+ *   httpHost({
+ *     name: 'myResponsesHost',
+ *     wire: responsesWire({ defaultModel: 'my-agent' }),
+ *     invokePath: '/responses',
+ *     healthPath: '/health',
+ *   });
+ */
+import type { HttpWire } from '../../hosting/httpHost.js';
+/** Body fields that may carry a session id, in the order they are consulted. */
+export declare const DEFAULT_SESSION_FIELDS: readonly string[];
+/**
+ * What a caller is told when a handler THREW.
+ *
+ * A thrown error's message is the author's note to their own logs — a query, a
+ * path, a token in a connection string — and none of it is the caller's. A
+ * handler that CHOSE to fail chose its words for the caller, so those travel
+ * unchanged. The host tells this dialect which happened; it never guesses from
+ * the message.
+ */
+export declare const PUBLIC_FAILURE_MESSAGE = "The agent could not complete this request.";
+export interface ResponsesWireOptions {
+    /** Model label echoed in `response` objects when the request names none. */
+    readonly defaultModel?: string;
+    /**
+     * Body fields that carry a session id, in precedence order. The first one
+     * present and non-empty wins. Default `['conversation', 'session_id']`.
+     *
+     * A runtime with its own spelling passes its own list — that is the seam a
+     * hosting contract configures rather than forks this file for.
+     */
+    readonly sessionFields?: readonly string[];
+    /** Body for the health probe. Default `{ status: 'ok' }`. */
+    readonly health?: unknown;
+}
+type JsonObject = Readonly<Record<string, unknown>>;
+/** The turn's text: a bare string, or the user message items that carry it. */
+export declare function readResponsesInput(input: unknown): string;
+/** The session this request claims, by whichever of its aliases it used. */
+export declare function readResponsesSession(body: JsonObject, fields: readonly string[]): string | undefined;
+/**
+ * An `HttpWire` speaking the Responses protocol.
+ *
+ * Pair it with `httpHost` and the paths your deployment contract names. The
+ * host keeps its own promises — draining, aborting on disconnect, failing a
+ * handler that throws or answers nothing — and this supplies only the dialect.
+ */
+export declare function responsesWire(options?: ResponsesWireOptions): HttpWire;
+export {};
+//# sourceMappingURL=responsesWire.d.ts.map

package/dist/types/adapters/hosting/responsesWire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responsesWire.d.ts","sourceRoot":"","sources":["../../../../src/adapters/hosting/responsesWire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAKH,OAAO,KAAK,EAGV,QAAQ,EAGT,MAAM,2BAA2B,CAAC;AAEnC,gFAAgF;AAChF,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAmC,CAAC;AAExF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,+CAA+C,CAAC;AAInF,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,KAAK,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAuCpD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgCzD;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,MAAM,GAAG,SAAS,CAUpB;AAqMD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,QAAQ,CAuC1E"}

package/dist/types/adapters/identity/agentcore.d.ts

@@ -103,7 +103,7 @@ export interface AgentCoreIdentityClientLike {
     getResourceOauth2Token(input: {
         readonly resourceCredentialProviderName: string;
         readonly scopes: readonly string[];
-        readonly oauth2Flow: 'M2M' | 'USER_FEDERATION';
+        readonly oauth2Flow: 'M2M' | 'USER_FEDERATION' | 'ON_BEHALF_OF_TOKEN_EXCHANGE';
         readonly forceAuthentication: boolean;
         readonly workloadIdentityToken?: string;
     }): Promise<AgentCoreOauthResponse>;
@@ -126,6 +126,25 @@ export interface AgentCoreIdentityClientLike {
     }): Promise<{
         readonly workloadAccessToken?: string;
     }>;
+    /** Optional — required only for services named in `apiKeyServices`. AgentCore
+     *  keeps API keys in the same vault as OAuth tokens, behind a different
+     *  operation, so this is a sibling of `getResourceOauth2Token` rather than a
+     *  mode of it. */
+    getResourceApiKey?(input: {
+        readonly resourceCredentialProviderName: string;
+        /** REQUIRED on the wire — `GetResourceApiKeyRequest` declares it non-optional. */
+        readonly workloadIdentityToken: string;
+    }): Promise<{
+        readonly apiKey?: string;
+    }>;
+    /** Optional — required only by {@link completeAgentCoreAuthorization}. Tells
+     *  AgentCore that the person behind `sessionId` finished consenting, which is
+     *  what releases the token into the vault for the next vend. */
+    completeResourceTokenAuth?(input: {
+        readonly sessionId: string;
+        readonly userToken?: string;
+        readonly userId?: string;
+    }): Promise<void>;
 }
 export interface AgentCoreIdentityOptions {
     readonly region?: string;
@@ -165,6 +184,42 @@ export interface AgentCoreIdentityOptions {
         readonly principal?: string;
         readonly tenant?: string;
     }) => string | undefined;
+    /**
+     * How a `mode: 'user'` request gets its token (9.66.0). Default `'consent'`.
+     *
+     *   `'consent'`  — AgentCore's `USER_FEDERATION`. If the vault has no grant
+     *                  for this (workload, user), the result is an
+     *                  `authorization-required` with a URL to send the person to.
+     *                  They approve once; later calls return a token directly.
+     *   `'exchange'` — AgentCore's `ON_BEHALF_OF_TOKEN_EXCHANGE`. The person's
+     *                  own login is TRADED for a scoped downstream token, with no
+     *                  consent screen at any point.
+     *
+     * `'exchange'` is not simply the nicer one. It works only where the
+     * downstream provider was configured for it (an on-behalf-of exchange grant
+     * on the credential provider) and where trading the user's session for
+     * downstream access is a decision your organisation has already made — the
+     * consent screen is what asks the person, and this flow is the deployment
+     * saying it does not need to. Choose it deliberately.
+     *
+     * `mode: 'machine'` is unaffected: M2M has no user to act for.
+     */
+    readonly userFlow?: 'consent' | 'exchange';
+    /**
+     * Services whose credential is an API KEY, not an OAuth token (9.66.0).
+     *
+     * AgentCore's vault holds both kinds behind two different operations, and the
+     * provider NAME alone does not say which — so a request for a service named
+     * here is vended with `GetResourceApiKey` and comes back as an
+     * {@link apiKey} credential. Everything else takes the OAuth path.
+     *
+     * There is no auto-detection on purpose: guessing would mean calling one
+     * operation, catching a failure, and retrying with the other, which turns a
+     * configuration mistake into two round-trips and an ambiguous error.
+     */
+    readonly apiKeyServices?: readonly string[];
+    /** Header an API-key credential is sent in. Default `'x-api-key'`. */
+    readonly apiKeyHeader?: string;
     /** Stable provider id (default 'agentcore-identity'). */
     readonly id?: string;
     /** Test seam — inject a client implementing {@link AgentCoreIdentityClientLike}.
@@ -184,7 +239,66 @@ export interface BedrockAgentCoreIdentitySdkModule {
     readonly GetResourceOauth2TokenCommand?: new (input: unknown) => unknown;
     readonly GetWorkloadAccessTokenForUserIdCommand?: new (input: unknown) => unknown;
     readonly GetWorkloadAccessTokenForJWTCommand?: new (input: unknown) => unknown;
+    readonly GetResourceApiKeyCommand?: new (input: unknown) => unknown;
+    readonly CompleteResourceTokenAuthCommand?: new (input: unknown) => unknown;
 }
 /** Build a {@link CredentialProvider} backed by AWS Bedrock AgentCore Identity. */
 export declare function agentCoreIdentity(options?: AgentCoreIdentityOptions): CredentialProvider;
+/** Connection options for {@link completeAgentCoreAuthorization}. */
+export interface CompleteAgentCoreAuthorizationOptions {
+    /** The 3LO round-trip this completes — the `sessionId` from the
+     *  `authorization-required` result the agent returned. */
+    readonly sessionId: string;
+    /** The person's own IdP-issued JWT, if your callback has it. Preferred: it is
+     *  the artifact their provider signed. */
+    readonly userToken?: string;
+    /** The user id you asserted for them, when no JWT is available. Exactly one
+     *  of `userToken` / `userId` is required. */
+    readonly userId?: string;
+    readonly region?: string;
+    /** Test seam — same client surface the provider uses. */
+    readonly _client?: AgentCoreIdentityClientLike;
+    /** @internal Test injection — the AWS SDK module. */
+    readonly _sdk?: BedrockAgentCoreIdentitySdkModule;
+}
+/**
+ * Tell AgentCore the person finished consenting, so the token lands in the vault.
+ *
+ * ── Where this runs, and why it is not a provider method ─────────────────────
+ * A 3LO consent has three actors and two processes. The agent asks for a
+ * credential and gets back `authorization-required` with a URL and a session
+ * id; the PERSON opens that URL in their browser and approves; AgentCore then
+ * redirects their browser to a callback route **your web app** owns. That route
+ * is where this belongs — a different process from the agent run, often a
+ * different service — so it takes its own connection options rather than
+ * pretending to be a method on a provider that route has never seen.
+ *
+ * Your route's job before calling this is the part nobody else can do: confirm
+ * the browser session really belongs to the user you are about to name. This
+ * function is the handshake, not the authentication.
+ *
+ * ── After it returns ─────────────────────────────────────────────────────────
+ * Nothing is handed back — success is an empty acknowledgement. The token now
+ * exists in the vault for that (workload, user), and the way to obtain it is to
+ * run the agent's request again: the next `getCredential` for that service
+ * returns `issued` where the last one returned `authorization-required`. In
+ * agentfootprint terms the consent is a PAUSE, and this is what makes the
+ * resume succeed.
+ *
+ * The authorization URL and its session are short-lived (AWS documents ten
+ * minutes) — a person who wanders off has to start the consent again, and the
+ * refusal you get is AgentCore's, not this adapter's.
+ *
+ * @example  An Express-style callback route
+ *   app.get('/oauth/callback', async (req, res) => {
+ *     const user = await requireSignedInUser(req);   // yours, and load-bearing
+ *     await completeAgentCoreAuthorization({
+ *       sessionId: String(req.query.session),
+ *       userId: user.id,
+ *       region: 'us-east-1',
+ *     });
+ *     res.send('Approved — you can return to the assistant.');
+ *   });
+ */
+export declare function completeAgentCoreAuthorization(options: CompleteAgentCoreAuthorizationOptions): Promise<void>;
 //# sourceMappingURL=agentcore.d.ts.map

package/dist/types/adapters/identity/agentcore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../../../src/adapters/identity/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAGnB,MAAM,yBAAyB,CAAC;AAGjC,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;sDACkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;4EAEwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;iEAGiE;AACjE,MAAM,WAAW,2BAA2B;IAC1C,sBAAsB,CAAC,KAAK,EAAE;QAC5B,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;QAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,iBAAiB,CAAC;QAC/C,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACtC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KACzC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpC;;kEAE8D;IAC9D,+BAA+B,CAAC,CAAC,KAAK,EAAE;QACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;6DAGyD;IACzD,4BAA4B,CAAC,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;2DAEuD;IACvD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;yEAMqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;iEAI6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE;QAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB;4EACwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC;IAC/C;sDACkD;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC;CACnD;AAED,0EAA0E;AAC1E,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,KAAK,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK;QACrE,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,6BAA6B,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IACzE,QAAQ,CAAC,sCAAsC,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAClF,QAAQ,CAAC,mCAAmC,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAChF;AAuMD,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,GAAG,kBAAkB,CAyH5F"}
+{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../../../src/adapters/identity/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAGnB,MAAM,yBAAyB,CAAC;AAGjC,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;sDACkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;4EAEwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;iEAGiE;AACjE,MAAM,WAAW,2BAA2B;IAC1C,sBAAsB,CAAC,KAAK,EAAE;QAC5B,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;QAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,iBAAiB,GAAG,6BAA6B,CAAC;QAC/E,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACtC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KACzC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpC;;kEAE8D;IAC9D,+BAA+B,CAAC,CAAC,KAAK,EAAE;QACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;6DAGyD;IACzD,4BAA4B,CAAC,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;sBAGkB;IAClB,iBAAiB,CAAC,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;QAChD,kFAAkF;QAClF,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;KACxC,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1C;;oEAEgE;IAChE,yBAAyB,CAAC,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;2DAEuD;IACvD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;yEAMqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;iEAI6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE;QAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAC3C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB;4EACwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC;IAC/C;sDACkD;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC;CACnD;AAED,0EAA0E;AAC1E,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,KAAK,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK;QACrE,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,6BAA6B,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IACzE,QAAQ,CAAC,sCAAsC,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAClF,QAAQ,CAAC,mCAAmC,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC/E,QAAQ,CAAC,wBAAwB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IACpE,QAAQ,CAAC,gCAAgC,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7E;AAwND,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,GAAG,kBAAkB,CAuK5F;AAED,qEAAqE;AACrE,MAAM,WAAW,qCAAqC;IACpD;8DAC0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;8CAC0C;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;iDAC6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC;IAC/C,qDAAqD;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAgCf"}

package/dist/types/adapters/observability/agentcore.d.ts

@@ -50,6 +50,7 @@
  */
 import type { ObservabilityStrategy } from '../../strategies/types.js';
 import { type CloudwatchObservabilityOptions } from './cloudwatch.js';
+import { type OtelObservabilityOptions, type OtelObservabilityStrategy } from './otel.js';
 /**
  * AgentCore-specific options. Currently identical to the generic
  * `CloudwatchObservabilityOptions` — kept as a separate type for
@@ -65,4 +66,53 @@ export type AgentcoreObservabilityOptions = CloudwatchObservabilityOptions;
  * distinguish AgentCore-targeted shipping from generic CloudWatch.
  */
 export declare function agentcoreObservability(opts: AgentcoreObservabilityOptions): ObservabilityStrategy;
+/**
+ * The instrumentation-scope name AgentCore **Evaluations** classifies spans by.
+ *
+ * Their span classifier reads `scope.name` and considers only names beginning
+ * `opentelemetry.instrumentation.` (or `openinference.instrumentation.`);
+ * anything else is skipped without a message. This is the one spelling that
+ * makes agentfootprint's spans visible to it — and it lives HERE, in the
+ * vendor's own file, because the requirement is theirs, not
+ * OpenTelemetry's and not ours.
+ */
+export declare const AGENTCORE_EVALUATIONS_SCOPE_NAME = "opentelemetry.instrumentation.agentfootprint";
+/**
+ * OTel spans shaped so AgentCore **Evaluations** can read and score them.
+ *
+ * ── What this is ─────────────────────────────────────────────────────────────
+ * A CONFIGURATION of {@link otelObservability}, not a second implementation:
+ * the same spans, the same attributes, with the two settings that vendor
+ * requires already correct — the scope name it classifies by, and the
+ * turn-level content its scorers read. Everything else is passed through
+ * untouched, so nothing about your telemetry becomes AgentCore-shaped except
+ * the two things that had to be.
+ *
+ * ── Why you would use it ─────────────────────────────────────────────────────
+ * Since July 2026 AgentCore Evaluations scores agents that DO NOT run on AWS —
+ * any agent whose spans reach CloudWatch and match its contract. That makes
+ * AWS's built-in evaluators available to an agentfootprint agent hosted
+ * anywhere. It does not make your agent an AWS agent, and it replaces nothing:
+ * their evaluators say what the score is, and agentfootprint's own trace is
+ * still what says why.
+ *
+ * ── Read this before enabling ────────────────────────────────────────────────
+ * It turns `captureContent` ON, which puts the turn's prompt and answer text on
+ * the span — that is the point (a scorer cannot grade a turn it cannot read),
+ * and it is also an export of raw content to your OTel backend. Pass
+ * `captureContent: false` to opt back out and keep the scope name alone;
+ * scores will then be based on an empty turn, which is worse than not scoring.
+ *
+ * Getting the spans to CloudWatch is separate and yours: point an OTLP exporter
+ * at the AgentCore log group per AWS's documented header contract, or run
+ * inside a runtime that does it for you.
+ *
+ * @example
+ *   import { agentCoreEvaluationSpans } from 'agentfootprint/observe';
+ *
+ *   agent.enable.observability({
+ *     strategy: agentCoreEvaluationSpans({ serviceName: 'support-agent' }),
+ *   });
+ */
+export declare function agentCoreEvaluationSpans(opts: OtelObservabilityOptions): OtelObservabilityStrategy;
 //# sourceMappingURL=agentcore.d.ts.map

package/dist/types/adapters/observability/agentcore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../../../src/adapters/observability/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,iBAAiB,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,6BAA6B,GAAG,qBAAqB,CAEjG"}
+{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../../../src/adapters/observability/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC/B,MAAM,WAAW,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,6BAA6B,GAAG,qBAAqB,CAEjG;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,iDAAiD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,wBAAwB,GAC7B,yBAAyB,CAS3B"}