agentfootprint 9.65.0 → 9.66.0

package/dist/esm/observability-providers.d.ts

@@ -44,7 +44,7 @@
  * behind `agentfootprint/observe`, which re-exports every name here — same
  * symbols, one door. Import from the door.
  */
-export { agentcoreObservability, type AgentcoreObservabilityOptions, } from './adapters/observability/agentcore.js';
+export { agentcoreObservability, agentCoreEvaluationSpans, AGENTCORE_EVALUATIONS_SCOPE_NAME, type AgentcoreObservabilityOptions, } from './adapters/observability/agentcore.js';
 export { cloudwatchObservability, type CloudwatchObservabilityOptions, } from './adapters/observability/cloudwatch.js';
 export { xrayObservability, type XrayObservabilityOptions, type XRayLikeClient, } from './adapters/observability/xray.js';
 export { otelObservability, type OtelObservabilityOptions, type OtelObservabilityStrategy, type OtelDecisionEvidenceRecorder, type OtelTracerLike, type OtelSpanLike, type OtelSpanOptions, type OtelAttributeValue, } from './adapters/observability/otel.js';

package/dist/esm/observability-providers.js

@@ -44,7 +44,11 @@
  * behind `agentfootprint/observe`, which re-exports every name here — same
  * symbols, one door. Import from the door.
  */
-export { agentcoreObservability, } from './adapters/observability/agentcore.js';
+export { agentcoreObservability, 
+// Spans shaped for AgentCore Evaluations (9.66.0) — a configuration of
+// `otelObservability`, kept in the vendor's file because the requirement
+// (the scope name their classifier routes on) is the vendor's.
+agentCoreEvaluationSpans, AGENTCORE_EVALUATIONS_SCOPE_NAME, } from './adapters/observability/agentcore.js';
 export { cloudwatchObservability, } from './adapters/observability/cloudwatch.js';
 export { xrayObservability, } from './adapters/observability/xray.js';
 export { otelObservability, } from './adapters/observability/otel.js';

package/dist/esm/observability-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability-providers.js","sourceRoot":"","sources":["../../src/observability-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EACL,sBAAsB,GAEvB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uBAAuB,GAExB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,iBAAiB,GAGlB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,GAQlB,MAAM,kCAAkC,CAAC;AAC1C,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,OAAO,EACL,iBAAiB,GAGlB,MAAM,kCAAkC,CAAC;AAC1C,sEAAsE;AACtE,sEAAsE;AACtE,8CAA8C;AAC9C,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,eAAe,GAOhB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,iEAAiE;AACjE,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,4DAA4D;AAC5D,OAAO,EACL,iBAAiB,GAIlB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,kBAAkB,GAInB,MAAM,gDAAgD,CAAC"}
+{"version":3,"file":"observability-providers.js","sourceRoot":"","sources":["../../src/observability-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EACL,sBAAsB;AACtB,uEAAuE;AACvE,yEAAyE;AACzE,+DAA+D;AAC/D,wBAAwB,EACxB,gCAAgC,GAEjC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uBAAuB,GAExB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,iBAAiB,GAGlB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,GAQlB,MAAM,kCAAkC,CAAC;AAC1C,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,OAAO,EACL,iBAAiB,GAGlB,MAAM,kCAAkC,CAAC;AAC1C,sEAAsE;AACtE,sEAAsE;AACtE,8CAA8C;AAC9C,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,eAAe,GAOhB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,iEAAiE;AACjE,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,4DAA4D;AAC5D,OAAO,EACL,iBAAiB,GAIlB,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,kBAAkB,GAInB,MAAM,gDAAgD,CAAC"}

package/dist/identity.js

@@ -29,7 +29,7 @@
  * symbols, one door. Import from the door.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MissingJwksSupportError = exports.jwksIdentity = exports.CLOUD_PLATFORM_SCOPE = exports.googleIdentity = exports.vaultCredentials = exports.agentCoreIdentity = exports.withCredentialRetry = exports.CredentialConsentRequiredError = exports.staticTokens = exports.headers = exports.basic = exports.apiKey = exports.bearer = exports.unconfiguredCredentialProvider = exports.isCredentialIssued = void 0;
+exports.MissingJwksSupportError = exports.jwksIdentity = exports.CLOUD_PLATFORM_SCOPE = exports.googleIdentity = exports.vaultCredentials = exports.completeAgentCoreAuthorization = exports.agentCoreIdentity = exports.withCredentialRetry = exports.CredentialConsentRequiredError = exports.staticTokens = exports.headers = exports.basic = exports.apiKey = exports.bearer = exports.unconfiguredCredentialProvider = exports.isCredentialIssued = void 0;
 var types_js_1 = require("./identity/types.js");
 Object.defineProperty(exports, "isCredentialIssued", { enumerable: true, get: function () { return types_js_1.isCredentialIssued; } });
 Object.defineProperty(exports, "unconfiguredCredentialProvider", { enumerable: true, get: function () { return types_js_1.unconfiguredCredentialProvider; } });
@@ -46,6 +46,10 @@ var withCredentialRetry_js_1 = require("./identity/withCredentialRetry.js");
 Object.defineProperty(exports, "withCredentialRetry", { enumerable: true, get: function () { return withCredentialRetry_js_1.withCredentialRetry; } });
 var agentcore_js_1 = require("./adapters/identity/agentcore.js");
 Object.defineProperty(exports, "agentCoreIdentity", { enumerable: true, get: function () { return agentcore_js_1.agentCoreIdentity; } });
+// The consent handshake (9.66.0) — called from YOUR callback route, not from
+// the agent run, which is why it is a function of its own rather than a
+// method on the provider that route never sees.
+Object.defineProperty(exports, "completeAgentCoreAuthorization", { enumerable: true, get: function () { return agentcore_js_1.completeAgentCoreAuthorization; } });
 // HashiCorp-Vault-compatible KV v2, over plain HTTP (9.8.0) — no SDK, no
 // vendor client. V1 is token auth + KV v2 + no leases, and every other shape
 // is refused by name rather than guessed at; see the module docstring.

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAWH,gDAAyF;AAAhF,8GAAA,kBAAkB,OAAA;AAAE,0HAAA,8BAA8B,OAAA;AAC3D,gDAS6B;AAR3B,kGAAA,MAAM,OAAA;AACN,kGAAA,MAAM,OAAA;AACN,iGAAA,KAAK,OAAA;AACL,mGAAA,OAAO,OAAA;AAMT,8DAAoF;AAA3E,+GAAA,YAAY,OAAA;AAKrB,kGAGsD;AAFpD,mJAAA,8BAA8B,OAAA;AAGhC,4EAG2C;AAFzC,6HAAA,mBAAmB,OAAA;AAGrB,iEAK0C;AAJxC,iHAAA,iBAAiB,OAAA;AAKnB,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,yDAA8F;AAArF,4GAAA,gBAAgB,OAAA;AAEzB,4EAA4E;AAC5E,uEAAuE;AACvE,6EAA6E;AAC7E,6DAA6D;AAC7D,2DAMuC;AALrC,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AAMtB,8EAA8E;AAC9E,iEAAiE;AACjE,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,uDAKqC;AAJnC,uGAAA,YAAY,OAAA;AACZ,kHAAA,uBAAuB,OAAA"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAWH,gDAAyF;AAAhF,8GAAA,kBAAkB,OAAA;AAAE,0HAAA,8BAA8B,OAAA;AAC3D,gDAS6B;AAR3B,kGAAA,MAAM,OAAA;AACN,kGAAA,MAAM,OAAA;AACN,iGAAA,KAAK,OAAA;AACL,mGAAA,OAAO,OAAA;AAMT,8DAAoF;AAA3E,+GAAA,YAAY,OAAA;AAKrB,kGAGsD;AAFpD,mJAAA,8BAA8B,OAAA;AAGhC,4EAG2C;AAFzC,6HAAA,mBAAmB,OAAA;AAGrB,iEAU0C;AATxC,iHAAA,iBAAiB,OAAA;AACjB,6EAA6E;AAC7E,wEAAwE;AACxE,gDAAgD;AAChD,8HAAA,8BAA8B,OAAA;AAMhC,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,yDAA8F;AAArF,4GAAA,gBAAgB,OAAA;AAEzB,4EAA4E;AAC5E,uEAAuE;AACvE,6EAA6E;AAC7E,6DAA6D;AAC7D,2DAMuC;AALrC,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AAMtB,8EAA8E;AAC9E,iEAAiE;AACjE,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,uDAKqC;AAJnC,uGAAA,YAAY,OAAA;AACZ,kHAAA,uBAAuB,OAAA"}

package/dist/observability-providers.js

@@ -46,9 +46,14 @@
  * symbols, one door. Import from the door.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.githubDeviceSignIn = exports.githubBugReporter = exports.CANONICAL_JSON_VERSION = exports.canonicalJson = exports.AUDIT_ZERO_HASH = exports.AUDIT_GENESIS_EVENT_TYPE = exports.AUDIT_BUNDLE_FORMAT = exports.verifyAuditBundle = exports.auditExport = exports.fileObservability = exports.otelObservability = exports.xrayObservability = exports.cloudwatchObservability = exports.agentcoreObservability = void 0;
+exports.githubDeviceSignIn = exports.githubBugReporter = exports.CANONICAL_JSON_VERSION = exports.canonicalJson = exports.AUDIT_ZERO_HASH = exports.AUDIT_GENESIS_EVENT_TYPE = exports.AUDIT_BUNDLE_FORMAT = exports.verifyAuditBundle = exports.auditExport = exports.fileObservability = exports.otelObservability = exports.xrayObservability = exports.cloudwatchObservability = exports.AGENTCORE_EVALUATIONS_SCOPE_NAME = exports.agentCoreEvaluationSpans = exports.agentcoreObservability = void 0;
 var agentcore_js_1 = require("./adapters/observability/agentcore.js");
 Object.defineProperty(exports, "agentcoreObservability", { enumerable: true, get: function () { return agentcore_js_1.agentcoreObservability; } });
+// Spans shaped for AgentCore Evaluations (9.66.0) — a configuration of
+// `otelObservability`, kept in the vendor's file because the requirement
+// (the scope name their classifier routes on) is the vendor's.
+Object.defineProperty(exports, "agentCoreEvaluationSpans", { enumerable: true, get: function () { return agentcore_js_1.agentCoreEvaluationSpans; } });
+Object.defineProperty(exports, "AGENTCORE_EVALUATIONS_SCOPE_NAME", { enumerable: true, get: function () { return agentcore_js_1.AGENTCORE_EVALUATIONS_SCOPE_NAME; } });
 var cloudwatch_js_1 = require("./adapters/observability/cloudwatch.js");
 Object.defineProperty(exports, "cloudwatchObservability", { enumerable: true, get: function () { return cloudwatch_js_1.cloudwatchObservability; } });
 var xray_js_1 = require("./adapters/observability/xray.js");

package/dist/observability-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability-providers.js","sourceRoot":"","sources":["../src/observability-providers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;;;AAEH,sEAG+C;AAF7C,sHAAA,sBAAsB,OAAA;AAGxB,wEAGgD;AAF9C,wHAAA,uBAAuB,OAAA;AAGzB,4DAI0C;AAHxC,4GAAA,iBAAiB,OAAA;AAInB,4DAS0C;AARxC,4GAAA,iBAAiB,OAAA;AASnB,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,4DAI0C;AAHxC,4GAAA,iBAAiB,OAAA;AAInB,sEAAsE;AACtE,sEAAsE;AACtE,8CAA8C;AAC9C,8DAY2C;AAXzC,uGAAA,WAAW,OAAA;AACX,6GAAA,iBAAiB,OAAA;AACjB,+GAAA,mBAAmB,OAAA;AACnB,oHAAA,wBAAwB,OAAA;AACxB,2GAAA,eAAe,OAAA;AAQjB,2DAA+E;AAAtE,iHAAA,aAAa,OAAA;AAAE,0HAAA,sBAAsB,OAAA;AAC9C,4EAA4E;AAC5E,6EAA6E;AAC7E,iEAAiE;AACjE,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,4DAA4D;AAC5D,sFAKuD;AAJrD,yHAAA,iBAAiB,OAAA;AAKnB,wFAKwD;AAJtD,2HAAA,kBAAkB,OAAA"}
+{"version":3,"file":"observability-providers.js","sourceRoot":"","sources":["../src/observability-providers.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;;;AAEH,sEAQ+C;AAP7C,sHAAA,sBAAsB,OAAA;AACtB,uEAAuE;AACvE,yEAAyE;AACzE,+DAA+D;AAC/D,wHAAA,wBAAwB,OAAA;AACxB,gIAAA,gCAAgC,OAAA;AAGlC,wEAGgD;AAF9C,wHAAA,uBAAuB,OAAA;AAGzB,4DAI0C;AAHxC,4GAAA,iBAAiB,OAAA;AAInB,4DAS0C;AARxC,4GAAA,iBAAiB,OAAA;AASnB,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,4DAI0C;AAHxC,4GAAA,iBAAiB,OAAA;AAInB,sEAAsE;AACtE,sEAAsE;AACtE,8CAA8C;AAC9C,8DAY2C;AAXzC,uGAAA,WAAW,OAAA;AACX,6GAAA,iBAAiB,OAAA;AACjB,+GAAA,mBAAmB,OAAA;AACnB,oHAAA,wBAAwB,OAAA;AACxB,2GAAA,eAAe,OAAA;AAQjB,2DAA+E;AAAtE,iHAAA,aAAa,OAAA;AAAE,0HAAA,sBAAsB,OAAA;AAC9C,4EAA4E;AAC5E,6EAA6E;AAC7E,iEAAiE;AACjE,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,4DAA4D;AAC5D,sFAKuD;AAJrD,yHAAA,iBAAiB,OAAA;AAKnB,wFAKwD;AAJtD,2HAAA,kBAAkB,OAAA"}

package/dist/types/adapters/identity/agentcore.d.ts

@@ -103,7 +103,7 @@ export interface AgentCoreIdentityClientLike {
     getResourceOauth2Token(input: {
         readonly resourceCredentialProviderName: string;
         readonly scopes: readonly string[];
-        readonly oauth2Flow: 'M2M' | 'USER_FEDERATION';
+        readonly oauth2Flow: 'M2M' | 'USER_FEDERATION' | 'ON_BEHALF_OF_TOKEN_EXCHANGE';
         readonly forceAuthentication: boolean;
         readonly workloadIdentityToken?: string;
     }): Promise<AgentCoreOauthResponse>;
@@ -126,6 +126,25 @@ export interface AgentCoreIdentityClientLike {
     }): Promise<{
         readonly workloadAccessToken?: string;
     }>;
+    /** Optional — required only for services named in `apiKeyServices`. AgentCore
+     *  keeps API keys in the same vault as OAuth tokens, behind a different
+     *  operation, so this is a sibling of `getResourceOauth2Token` rather than a
+     *  mode of it. */
+    getResourceApiKey?(input: {
+        readonly resourceCredentialProviderName: string;
+        /** REQUIRED on the wire — `GetResourceApiKeyRequest` declares it non-optional. */
+        readonly workloadIdentityToken: string;
+    }): Promise<{
+        readonly apiKey?: string;
+    }>;
+    /** Optional — required only by {@link completeAgentCoreAuthorization}. Tells
+     *  AgentCore that the person behind `sessionId` finished consenting, which is
+     *  what releases the token into the vault for the next vend. */
+    completeResourceTokenAuth?(input: {
+        readonly sessionId: string;
+        readonly userToken?: string;
+        readonly userId?: string;
+    }): Promise<void>;
 }
 export interface AgentCoreIdentityOptions {
     readonly region?: string;
@@ -165,6 +184,42 @@ export interface AgentCoreIdentityOptions {
         readonly principal?: string;
         readonly tenant?: string;
     }) => string | undefined;
+    /**
+     * How a `mode: 'user'` request gets its token (9.66.0). Default `'consent'`.
+     *
+     *   `'consent'`  — AgentCore's `USER_FEDERATION`. If the vault has no grant
+     *                  for this (workload, user), the result is an
+     *                  `authorization-required` with a URL to send the person to.
+     *                  They approve once; later calls return a token directly.
+     *   `'exchange'` — AgentCore's `ON_BEHALF_OF_TOKEN_EXCHANGE`. The person's
+     *                  own login is TRADED for a scoped downstream token, with no
+     *                  consent screen at any point.
+     *
+     * `'exchange'` is not simply the nicer one. It works only where the
+     * downstream provider was configured for it (an on-behalf-of exchange grant
+     * on the credential provider) and where trading the user's session for
+     * downstream access is a decision your organisation has already made — the
+     * consent screen is what asks the person, and this flow is the deployment
+     * saying it does not need to. Choose it deliberately.
+     *
+     * `mode: 'machine'` is unaffected: M2M has no user to act for.
+     */
+    readonly userFlow?: 'consent' | 'exchange';
+    /**
+     * Services whose credential is an API KEY, not an OAuth token (9.66.0).
+     *
+     * AgentCore's vault holds both kinds behind two different operations, and the
+     * provider NAME alone does not say which — so a request for a service named
+     * here is vended with `GetResourceApiKey` and comes back as an
+     * {@link apiKey} credential. Everything else takes the OAuth path.
+     *
+     * There is no auto-detection on purpose: guessing would mean calling one
+     * operation, catching a failure, and retrying with the other, which turns a
+     * configuration mistake into two round-trips and an ambiguous error.
+     */
+    readonly apiKeyServices?: readonly string[];
+    /** Header an API-key credential is sent in. Default `'x-api-key'`. */
+    readonly apiKeyHeader?: string;
     /** Stable provider id (default 'agentcore-identity'). */
     readonly id?: string;
     /** Test seam — inject a client implementing {@link AgentCoreIdentityClientLike}.
@@ -184,7 +239,66 @@ export interface BedrockAgentCoreIdentitySdkModule {
     readonly GetResourceOauth2TokenCommand?: new (input: unknown) => unknown;
     readonly GetWorkloadAccessTokenForUserIdCommand?: new (input: unknown) => unknown;
     readonly GetWorkloadAccessTokenForJWTCommand?: new (input: unknown) => unknown;
+    readonly GetResourceApiKeyCommand?: new (input: unknown) => unknown;
+    readonly CompleteResourceTokenAuthCommand?: new (input: unknown) => unknown;
 }
 /** Build a {@link CredentialProvider} backed by AWS Bedrock AgentCore Identity. */
 export declare function agentCoreIdentity(options?: AgentCoreIdentityOptions): CredentialProvider;
+/** Connection options for {@link completeAgentCoreAuthorization}. */
+export interface CompleteAgentCoreAuthorizationOptions {
+    /** The 3LO round-trip this completes — the `sessionId` from the
+     *  `authorization-required` result the agent returned. */
+    readonly sessionId: string;
+    /** The person's own IdP-issued JWT, if your callback has it. Preferred: it is
+     *  the artifact their provider signed. */
+    readonly userToken?: string;
+    /** The user id you asserted for them, when no JWT is available. Exactly one
+     *  of `userToken` / `userId` is required. */
+    readonly userId?: string;
+    readonly region?: string;
+    /** Test seam — same client surface the provider uses. */
+    readonly _client?: AgentCoreIdentityClientLike;
+    /** @internal Test injection — the AWS SDK module. */
+    readonly _sdk?: BedrockAgentCoreIdentitySdkModule;
+}
+/**
+ * Tell AgentCore the person finished consenting, so the token lands in the vault.
+ *
+ * ── Where this runs, and why it is not a provider method ─────────────────────
+ * A 3LO consent has three actors and two processes. The agent asks for a
+ * credential and gets back `authorization-required` with a URL and a session
+ * id; the PERSON opens that URL in their browser and approves; AgentCore then
+ * redirects their browser to a callback route **your web app** owns. That route
+ * is where this belongs — a different process from the agent run, often a
+ * different service — so it takes its own connection options rather than
+ * pretending to be a method on a provider that route has never seen.
+ *
+ * Your route's job before calling this is the part nobody else can do: confirm
+ * the browser session really belongs to the user you are about to name. This
+ * function is the handshake, not the authentication.
+ *
+ * ── After it returns ─────────────────────────────────────────────────────────
+ * Nothing is handed back — success is an empty acknowledgement. The token now
+ * exists in the vault for that (workload, user), and the way to obtain it is to
+ * run the agent's request again: the next `getCredential` for that service
+ * returns `issued` where the last one returned `authorization-required`. In
+ * agentfootprint terms the consent is a PAUSE, and this is what makes the
+ * resume succeed.
+ *
+ * The authorization URL and its session are short-lived (AWS documents ten
+ * minutes) — a person who wanders off has to start the consent again, and the
+ * refusal you get is AgentCore's, not this adapter's.
+ *
+ * @example  An Express-style callback route
+ *   app.get('/oauth/callback', async (req, res) => {
+ *     const user = await requireSignedInUser(req);   // yours, and load-bearing
+ *     await completeAgentCoreAuthorization({
+ *       sessionId: String(req.query.session),
+ *       userId: user.id,
+ *       region: 'us-east-1',
+ *     });
+ *     res.send('Approved — you can return to the assistant.');
+ *   });
+ */
+export declare function completeAgentCoreAuthorization(options: CompleteAgentCoreAuthorizationOptions): Promise<void>;
 //# sourceMappingURL=agentcore.d.ts.map

package/dist/types/adapters/identity/agentcore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../../../src/adapters/identity/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAGnB,MAAM,yBAAyB,CAAC;AAGjC,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;sDACkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;4EAEwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;iEAGiE;AACjE,MAAM,WAAW,2BAA2B;IAC1C,sBAAsB,CAAC,KAAK,EAAE;QAC5B,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;QAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,iBAAiB,CAAC;QAC/C,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACtC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KACzC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpC;;kEAE8D;IAC9D,+BAA+B,CAAC,CAAC,KAAK,EAAE;QACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;6DAGyD;IACzD,4BAA4B,CAAC,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;2DAEuD;IACvD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;yEAMqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;iEAI6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE;QAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB;4EACwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC;IAC/C;sDACkD;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC;CACnD;AAED,0EAA0E;AAC1E,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,KAAK,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK;QACrE,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,6BAA6B,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IACzE,QAAQ,CAAC,sCAAsC,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAClF,QAAQ,CAAC,mCAAmC,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAChF;AAuMD,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,GAAG,kBAAkB,CAyH5F"}
+{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../../../src/adapters/identity/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmFG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAGnB,MAAM,yBAAyB,CAAC;AAGjC,sEAAsE;AACtE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;sDACkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;4EAEwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;iEAGiE;AACjE,MAAM,WAAW,2BAA2B;IAC1C,sBAAsB,CAAC,KAAK,EAAE;QAC5B,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;QAChD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,UAAU,EAAE,KAAK,GAAG,iBAAiB,GAAG,6BAA6B,CAAC;QAC/E,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;QACtC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KACzC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpC;;kEAE8D;IAC9D,+BAA+B,CAAC,CAAC,KAAK,EAAE;QACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;6DAGyD;IACzD,4BAA4B,CAAC,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD;;;sBAGkB;IAClB,iBAAiB,CAAC,CAAC,KAAK,EAAE;QACxB,QAAQ,CAAC,8BAA8B,EAAE,MAAM,CAAC;QAChD,kFAAkF;QAClF,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;KACxC,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1C;;oEAEgE;IAChE,yBAAyB,CAAC,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;2DAEuD;IACvD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;yEAMqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;iEAI6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE;QAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAC3C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,sEAAsE;IACtE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,yDAAyD;IACzD,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB;4EACwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC;IAC/C;sDACkD;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC;CACnD;AAED,0EAA0E;AAC1E,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,KAAK,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK;QACrE,IAAI,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACtC,CAAC;IACF,QAAQ,CAAC,6BAA6B,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IACzE,QAAQ,CAAC,sCAAsC,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAClF,QAAQ,CAAC,mCAAmC,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC/E,QAAQ,CAAC,wBAAwB,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IACpE,QAAQ,CAAC,gCAAgC,CAAC,EAAE,KAAK,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAC7E;AAwND,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,wBAA6B,GAAG,kBAAkB,CAuK5F;AAED,qEAAqE;AACrE,MAAM,WAAW,qCAAqC;IACpD;8DAC0D;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;8CAC0C;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;iDAC6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC;IAC/C,qDAAqD;IACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,iCAAiC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAgCf"}

package/dist/types/adapters/observability/agentcore.d.ts

@@ -50,6 +50,7 @@
  */
 import type { ObservabilityStrategy } from '../../strategies/types.js';
 import { type CloudwatchObservabilityOptions } from './cloudwatch.js';
+import { type OtelObservabilityOptions, type OtelObservabilityStrategy } from './otel.js';
 /**
  * AgentCore-specific options. Currently identical to the generic
  * `CloudwatchObservabilityOptions` — kept as a separate type for
@@ -65,4 +66,53 @@ export type AgentcoreObservabilityOptions = CloudwatchObservabilityOptions;
  * distinguish AgentCore-targeted shipping from generic CloudWatch.
  */
 export declare function agentcoreObservability(opts: AgentcoreObservabilityOptions): ObservabilityStrategy;
+/**
+ * The instrumentation-scope name AgentCore **Evaluations** classifies spans by.
+ *
+ * Their span classifier reads `scope.name` and considers only names beginning
+ * `opentelemetry.instrumentation.` (or `openinference.instrumentation.`);
+ * anything else is skipped without a message. This is the one spelling that
+ * makes agentfootprint's spans visible to it — and it lives HERE, in the
+ * vendor's own file, because the requirement is theirs, not
+ * OpenTelemetry's and not ours.
+ */
+export declare const AGENTCORE_EVALUATIONS_SCOPE_NAME = "opentelemetry.instrumentation.agentfootprint";
+/**
+ * OTel spans shaped so AgentCore **Evaluations** can read and score them.
+ *
+ * ── What this is ─────────────────────────────────────────────────────────────
+ * A CONFIGURATION of {@link otelObservability}, not a second implementation:
+ * the same spans, the same attributes, with the two settings that vendor
+ * requires already correct — the scope name it classifies by, and the
+ * turn-level content its scorers read. Everything else is passed through
+ * untouched, so nothing about your telemetry becomes AgentCore-shaped except
+ * the two things that had to be.
+ *
+ * ── Why you would use it ─────────────────────────────────────────────────────
+ * Since July 2026 AgentCore Evaluations scores agents that DO NOT run on AWS —
+ * any agent whose spans reach CloudWatch and match its contract. That makes
+ * AWS's built-in evaluators available to an agentfootprint agent hosted
+ * anywhere. It does not make your agent an AWS agent, and it replaces nothing:
+ * their evaluators say what the score is, and agentfootprint's own trace is
+ * still what says why.
+ *
+ * ── Read this before enabling ────────────────────────────────────────────────
+ * It turns `captureContent` ON, which puts the turn's prompt and answer text on
+ * the span — that is the point (a scorer cannot grade a turn it cannot read),
+ * and it is also an export of raw content to your OTel backend. Pass
+ * `captureContent: false` to opt back out and keep the scope name alone;
+ * scores will then be based on an empty turn, which is worse than not scoring.
+ *
+ * Getting the spans to CloudWatch is separate and yours: point an OTLP exporter
+ * at the AgentCore log group per AWS's documented header contract, or run
+ * inside a runtime that does it for you.
+ *
+ * @example
+ *   import { agentCoreEvaluationSpans } from 'agentfootprint/observe';
+ *
+ *   agent.enable.observability({
+ *     strategy: agentCoreEvaluationSpans({ serviceName: 'support-agent' }),
+ *   });
+ */
+export declare function agentCoreEvaluationSpans(opts: OtelObservabilityOptions): OtelObservabilityStrategy;
 //# sourceMappingURL=agentcore.d.ts.map

package/dist/types/adapters/observability/agentcore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../../../src/adapters/observability/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,iBAAiB,CAAC;AAEzB;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,6BAA6B,GAAG,qBAAqB,CAEjG"}
+{"version":3,"file":"agentcore.d.ts","sourceRoot":"","sources":["../../../../src/adapters/observability/agentcore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC/B,MAAM,WAAW,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,6BAA6B,GAAG,qBAAqB,CAEjG;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,iDAAiD,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,wBAAwB,GAC7B,yBAAyB,CAS3B"}

package/dist/types/adapters/observability/otel.d.ts

@@ -124,10 +124,57 @@ export interface OtelObservabilityOptions {
     /** Service name on every emitted span. Surfaces in your OTel
      *  backend's service map. Required. */
     readonly serviceName: string;
-    /** OTel Tracer to use. Defaults to
-     *  `trace.getTracer('agentfootprint', AGENTFOOTPRINT_VERSION)`
-     *  (where `trace` is the lazy-imported `@opentelemetry/api`). */
+    /** OTel Tracer to use. Defaults to `trace.getTracer(scopeName)` — where
+     *  `trace` is the lazy-imported `@opentelemetry/api` and `scopeName` is the
+     *  option below. */
     readonly tracer?: OtelTracerLike;
+    /**
+     * The INSTRUMENTATION SCOPE name every span is recorded under — what a
+     * backend shows as `scope.name`. Default `'agentfootprint'`.
+     *
+     * ── Why this is a knob and not a constant ────────────────────────────────
+     * Some telemetry consumers ROUTE on this name rather than read it. AWS
+     * Bedrock AgentCore Evaluations is the case that forced the option: it will
+     * score any agent's traces, from anywhere, but only classifies spans whose
+     * scope name begins `opentelemetry.instrumentation.` or
+     * `openinference.instrumentation.` — everything else is skipped in silence,
+     * which is indistinguishable from "your agent was fine".
+     *
+     * The default does NOT change, because a rename moves every existing
+     * dashboard's spans out from under it. Consumers who need a routable name
+     * pass one; `agentCoreEvaluationSpans()` in the AgentCore adapter is that
+     * one consumer's spelling, kept in that vendor's own file.
+     *
+     * Ignored when `tracer` is supplied — a tracer you built already has a name.
+     */
+    readonly scopeName?: string;
+    /**
+     * Put the turn's PROMPT and ANSWER TEXT on the agent span (default
+     * `false`): `gen_ai.task.input` from the user's prompt and
+     * `gen_ai.task.output` from the final answer.
+     *
+     * ── Off by default, deliberately ─────────────────────────────────────────
+     * This adapter's standing rule is that content does not ride spans — the
+     * snapshot / audit-log channel carries it under the consumer's own
+     * redaction policy. Turning this on EXPORTS raw prompt and answer text to
+     * whatever backend the tracer points at, where it is typically retained and
+     * searchable, and no redaction of ours stands between the two.
+     *
+     * ── Why it exists ────────────────────────────────────────────────────────
+     * Trace-scoring services read the answer they are grading off the span.
+     * AgentCore Evaluations reads exactly these two attributes (after an event
+     * body it only emits in its own runtime), so a scorer sees an empty turn
+     * without them. Enable it when a consumer's whole purpose is to read the
+     * content, and not to make dashboards prettier.
+     *
+     * ── What it is NOT ───────────────────────────────────────────────────────
+     * Per-inference message arrays (`gen_ai.input.messages` /
+     * `gen_ai.output.messages`) are NOT emitted: this adapter's `llm_start` /
+     * `llm_end` events carry model, usage and stop reason, never the messages,
+     * so there is nothing truthful to put there. Turn-level input and output is
+     * what we have and all this claims.
+     */
+    readonly captureContent?: boolean;
     /** 0..1 — sample rate for turn-level spans. Default `1.0`.
      *  Sampling decisions are normally an OTel SDK concern (via
      *  `Sampler`); this option is a per-strategy override for cases
@@ -168,6 +215,13 @@ export interface OtelObservabilityOptions {
      * construction, but visible at the call site.
      */
     readonly onError?: (error: Error, event?: AgentfootprintEvent) => void;
+    /**
+     * @internal Pre-resolved `@opentelemetry/api` module, for tests that need
+     * the path where this adapter builds its OWN tracer — the only path on
+     * which {@link OtelObservabilityOptions.scopeName} is observable. Skips the
+     * lazy require, exactly as `_client` does on the SDK-backed adapters.
+     */
+    readonly _otelApi?: OtelApiModule;
 }
 /** Attribute value union we emit. Matches OTel's `AttributeValue`
  *  subset: primitives + homogeneous string arrays
@@ -201,6 +255,21 @@ export interface OtelSpanLike {
      *  signals degrade to flattened attributes when absent. */
     addEvent?(name: string, attributes?: Record<string, OtelAttributeValue>): unknown;
 }
+interface OtelApiModule {
+    readonly trace?: {
+        getTracer(name: string, version?: string): OtelTracerLike;
+        setSpan(context: unknown, span: OtelSpanLike): unknown;
+    };
+    readonly context?: {
+        active(): unknown;
+        with<T>(ctx: unknown, fn: () => T): T;
+    };
+    readonly SpanStatusCode?: {
+        OK: number;
+        ERROR: number;
+        UNSET: number;
+    };
+}
 /**
  * footprintjs CombinedRecorder (FlowRecorder channel) that forwards
  * decide()/select() operator-level evidence into the paired
@@ -249,4 +318,5 @@ export interface OtelObservabilityStrategy extends ObservabilityStrategy {
     decisionEvidenceRecorder(): OtelDecisionEvidenceRecorder;
 }
 export declare function otelObservability(opts: OtelObservabilityOptions): OtelObservabilityStrategy;
+export {};
 //# sourceMappingURL=otel.d.ts.map

package/dist/types/adapters/observability/otel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otel.d.ts","sourceRoot":"","sources":["../../../../src/adapters/observability/otel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAMvE,MAAM,WAAW,wBAAwB;IACvC;2CACuC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;qEAEiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC;;;;8DAI0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;CACxE;AAID;;0DAE0D;AAC1D,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,MAAM,EAAE,CAAC;AAE/E,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC;CACrF;AAED,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;IAC9D,SAAS,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;IAC/D,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;;+DAE2D;IAC3D,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,OAAO,CAAC;CACnF;AAgBD;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC3C,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC5C;AAED;wEACwE;AACxE,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,wBAAwB,IAAI,4BAA4B,CAAC;CAC1D;AA2GD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,yBAAyB,CAktB3F"}
+{"version":3,"file":"otel.d.ts","sourceRoot":"","sources":["../../../../src/adapters/observability/otel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsHG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAMvE,MAAM,WAAW,wBAAwB;IACvC;2CACuC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;wBAEoB;IACpB,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC;IACjC;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;8DAI0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACvE;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;CACnC;AAID;;0DAE0D;AAC1D,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,MAAM,EAAE,CAAC;AAE/E,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC;CACrF;AAED,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4DAA4D;AAC5D,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC;IAC9D,SAAS,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;IAC/D,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE;;+DAE2D;IAC3D,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,GAAG,OAAO,CAAC;CACnF;AAED,UAAU,aAAa;IACrB,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;QAC1D,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC;KACxD,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,MAAM,IAAI,OAAO,CAAC;QAClB,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;KACvC,CAAC;IACF,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACxE;AAID;;;;;;GAMG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC3C,UAAU,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC5C;AAED;wEACwE;AACxE,MAAM,WAAW,yBAA0B,SAAQ,qBAAqB;IACtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,wBAAwB,IAAI,4BAA4B,CAAC;CAC1D;AA2GD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,wBAAwB,GAAG,yBAAyB,CA4tB3F"}

package/dist/types/identity.d.ts

@@ -34,7 +34,7 @@ export { staticTokens, type StaticTokensOptions } from './identity/staticTokens.
 export type { AuthorizationRequiredMode, ConsentRequest } from './identity/consent.js';
 export { CredentialConsentRequiredError, type CredentialConsentRequiredContext, } from './identity/CredentialConsentRequiredError.js';
 export { withCredentialRetry, type WithCredentialRetryOptions, } from './identity/withCredentialRetry.js';
-export { agentCoreIdentity, type AgentCoreIdentityOptions, type AgentCoreIdentityClientLike, type AgentCoreOauthResponse, } from './adapters/identity/agentcore.js';
+export { agentCoreIdentity, completeAgentCoreAuthorization, type AgentCoreIdentityOptions, type AgentCoreIdentityClientLike, type AgentCoreOauthResponse, type CompleteAgentCoreAuthorizationOptions, } from './adapters/identity/agentcore.js';
 export { vaultCredentials, type VaultCredentialsOptions } from './adapters/identity/vault.js';
 export { googleIdentity, CLOUD_PLATFORM_SCOPE, type GoogleIdentityOptions, type GoogleImpersonation, type GoogleAuthClientLike, } from './adapters/identity/google.js';
 export { jwksIdentity, MissingJwksSupportError, type JoseBackend, type JwksIdentityOptions, } from './adapters/identity/jwks.js';

package/dist/types/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,+BAA+B,EAC/B,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EACL,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,EACP,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAIpF,YAAY,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EACL,8BAA8B,EAC9B,KAAK,gCAAgC,GACtC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAM9F,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,+BAA+B,CAAC;AAOvC,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,+BAA+B,EAC/B,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EACL,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,EACP,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAIpF,YAAY,EAAE,yBAAyB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EACL,8BAA8B,EAC9B,KAAK,gCAAgC,GACtC,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iBAAiB,EAIjB,8BAA8B,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,qCAAqC,GAC3C,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAAE,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAM9F,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,+BAA+B,CAAC;AAOvC,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC"}

package/dist/types/observability-providers.d.ts

@@ -44,7 +44,7 @@
  * behind `agentfootprint/observe`, which re-exports every name here — same
  * symbols, one door. Import from the door.
  */
-export { agentcoreObservability, type AgentcoreObservabilityOptions, } from './adapters/observability/agentcore.js';
+export { agentcoreObservability, agentCoreEvaluationSpans, AGENTCORE_EVALUATIONS_SCOPE_NAME, type AgentcoreObservabilityOptions, } from './adapters/observability/agentcore.js';
 export { cloudwatchObservability, type CloudwatchObservabilityOptions, } from './adapters/observability/cloudwatch.js';
 export { xrayObservability, type XrayObservabilityOptions, type XRayLikeClient, } from './adapters/observability/xray.js';
 export { otelObservability, type OtelObservabilityOptions, type OtelObservabilityStrategy, type OtelDecisionEvidenceRecorder, type OtelTracerLike, type OtelSpanLike, type OtelSpanOptions, type OtelAttributeValue, } from './adapters/observability/otel.js';

package/dist/types/observability-providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability-providers.d.ts","sourceRoot":"","sources":["../../src/observability-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,cAAc,GACpB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,UAAU,GAChB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAQ/E,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,GAC/B,MAAM,gDAAgD,CAAC"}
+{"version":3,"file":"observability-providers.d.ts","sourceRoot":"","sources":["../../src/observability-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EACL,sBAAsB,EAItB,wBAAwB,EACxB,gCAAgC,EAChC,KAAK,6BAA6B,GACnC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,KAAK,8BAA8B,GACpC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,cAAc,GACpB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,UAAU,GAChB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAQ/E,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,GAC/B,MAAM,gDAAgD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentfootprint",
-  "version": "9.65.0",
+  "version": "9.66.0",
   "description": "The explainable agent framework — backtrack a wrong answer to the exact context that caused it (evidence, not guesses). Built on footprintjs.",
   "license": "MIT",
   "type": "commonjs",