Microsoft Foundry SDK for JavaScript 2.8

Apply the Node.js 24 and TypeScript 7 prompts first. This pack covers @azure/ai-projects 2.8, checked against 2.8.0. Its boundary includes Foundry project resources, the authenticated OpenAI client, agent and toolbox execution, voice sessions, evaluation and optimization jobs, and preview APIs. Use a supported Node.js LTS runtime for server work.

Identity, endpoints, and credentials

• Construct AIProjectClient from an application-owned HTTPS project endpoint and Entra TokenCredential. Reject caller control of options.endpoint, credential scopes, API version, transport, proxy, pipeline policies, or per-call requestOptions; these fields can redirect or reshape authenticated operations.
• Use a managed or workload identity with only the Foundry and connected-service roles it needs. If production uses DefaultAzureCredential, narrow the credential chain and verify the selected identity. Enforce the end user's project and resource authorization separately from the service token.
• Keep connections.getWithCredentials, connections.get(name, { includeCredentials: true }), and connections.getDefault(type, { includeCredentials: true }) behind explicit secret-read authorization. Use credential-free discovery where possible, and validate the actual connection target and authentication mode before an agent uses it.
• Keep SAS URLs, connection credentials, WebSocket bearer tokens, model credentials, and telemetry connection strings out of prompts, datasets, tool results, browser responses, logs, and traces. Scope storage and retention of each secret to the