Strands Agents SDK for TypeScript 1.16.0

Apply the Node.js 24 and TypeScript 7 prompts first. These rules cover @strands-agents/sdk 1.16.0: agent input and restored state, tool execution and authorization, sandboxes, background tasks, MCP and A2A, persistence, memory, limits, and output disclosure.

Version scope and provider configuration

• Scope API assumptions to @strands-agents/sdk 1.16.0 and its resolved peers; Python SDK release numbers and Python-only security fixes do not describe this package. Strands has so far shipped TypeScript fixes only in new 1.x releases, not as patches to an older minor, so a minor-locked range stops receiving fixes once the next minor ships. If you pin a minor, as its versioning policy suggests for MCP, A2A, OpenTelemetry, and experimental features, move that pin to each new release through a reviewed update after reading its TypeScript release notes.
• Use the included supported Node.js 24 baseline with ESM configuration. Version 1.16.0 declares engines.node >=20.0.0; the Node.js 22 minimum in current documentation starts with 1.17.0 and is not this version's package requirement.
• Install only the provider, MCP, A2A, Cedar, and telemetry peers required by the deployment. Explicitly omit unused optional dependencies: 1.16.0 also lists @tobilu/qmd under optionalDependencies, so it can install native dependencies without any use of QmdSearchStrategy; its removal from default installs occurs in 1.17.0.
• Keep model selection, endpoints, clientConfig, and credentials server-owned. Prefer scoped IAM role credentials for BedrockModel; its apiKey option installs