Microsoft Foundry SDK for JavaScript 2.7

Apply the Node.js 24 and TypeScript 7 prompts first. These rules cover the @azure/ai-projects 2.7 line, checked against 2.7.1, including project clients, agents, voice sessions, toolboxes, datasets, and preview operations. Run server components on a supported Node.js LTS runtime; decide separately whether a browser client may hold its own user-scoped credential.

Project identity and client boundaries

• Create AIProjectClient with a trusted HTTPS project endpoint and TokenCredential. Do not accept a request-supplied options.endpoint, apiVersion, credential scope, proxy, transport, additionalPolicies, or requestOptions; these can change the destination or behavior of project and beta operations.
• Use a dedicated managed or workload identity for production services. If DefaultAzureCredential is necessary, constrain its production credential chain and verify which identity acquired the token. Grant that identity only the Foundry and connected-service roles its operations need.
• Authorize the current user and tenant before every project operation; a successful call under a shared service identity is not proof that the user owns the agent, connection, dataset, session, or trace. Separate clients and mutable option objects across tenants.
• Keep allowInsecureConnection off, retain URL encoding, and construct per-operation headers on the server. Caller-controlled headers and requestOptions.skipUrlEncoding can change generated requests.
• Protect connections.getWithCredentials and both connections.get and getDefault when includeCredentials is