@datacules/agent-identity-store-dynamic 0.10.0 → 0.11.1

package/LICENSE

@@ -0,0 +1,109 @@
+Datacules Agent Identity License — Version 1.0
+Copyright (c) 2026 Datacules LLC. All rights reserved.
+
+─────────────────────────────────────────────────────────────────────────────
+PREAMBLE
+─────────────────────────────────────────────────────────────────────────────
+
+This software — Agent Identity & Auth Patterns — is developed and owned by
+Datacules LLC. It is made available to the public as open-source software
+under the permissive terms below.
+
+Datacules LLC retains ownership and authorship of this software while
+granting broad, royalty-free rights for anyone to use, copy, modify, and
+distribute it — in commercial or non-commercial contexts — without requiring
+that derivative works also become open source.
+
+─────────────────────────────────────────────────────────────────────────────
+TERMS AND CONDITIONS
+─────────────────────────────────────────────────────────────────────────────
+
+1. PERMISSION TO USE
+
+   Permission is hereby granted, free of charge, to any person or
+   organization obtaining a copy of this software and associated
+   documentation files (the "Software"), to use, copy, modify, merge,
+   publish, distribute, sublicense, and/or sell copies of the Software,
+   and to permit persons to whom the Software is furnished to do so,
+   subject to the conditions below.
+
+2. ATTRIBUTION
+
+   a. Redistributions of source code must retain this copyright notice,
+      this list of conditions, and the disclaimer below.
+
+   b. Redistributions in binary form or as a product must reproduce this
+      copyright notice, this list of conditions, and the disclaimer in the
+      documentation and/or other materials provided with the distribution.
+
+   c. Neither the name "Datacules LLC" nor the names of its contributors
+      may be used to endorse or promote products derived from this Software
+      without prior written permission from Datacules LLC.
+
+3. COMMERCIAL USE
+
+   Use of this Software in commercial products, SaaS platforms, internal
+   enterprise tools, or any revenue-generating context is explicitly
+   permitted without royalty, fee, or additional licensing agreement,
+   provided that the conditions in Section 2 (Attribution) are met.
+
+4. NO COPYLEFT / NO VIRAL REQUIREMENT
+
+   This license does NOT require that derivative works, modifications,
+   or software that uses or embeds this Software be made open source.
+   You may incorporate this Software into proprietary or closed-source
+   products under your own license terms.
+
+5. MODIFICATIONS
+
+   Modified versions of the Software may be distributed under the same
+   terms as this license or under any other permissive open-source
+   license (e.g. MIT, Apache 2.0, BSD), provided that:
+
+   a. The original copyright notice of Datacules LLC is preserved.
+   b. Modifications are clearly documented and distinguished from the
+      original work.
+
+6. COMPATIBILITY
+
+   This license is compatible with other permissive open-source licenses
+   such as MIT, BSD 2-Clause, BSD 3-Clause, and Apache License 2.0. It
+   is also GPL-compatible — this Software may coexist with GPL-licensed
+   code, though this Software itself is not distributed under the GPL.
+
+─────────────────────────────────────────────────────────────────────────────
+DISCLAIMER
+─────────────────────────────────────────────────────────────────────────────
+
+THIS SOFTWARE IS PROVIDED BY DATACULES LLC AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE,
+AND NON-INFRINGEMENT ARE DISCLAIMED.
+
+IN NO EVENT SHALL DATACULES LLC OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
+INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+─────────────────────────────────────────────────────────────────────────────
+SUMMARY (non-binding)
+─────────────────────────────────────────────────────────────────────────────
+
+  ✔  Use freely — commercial, proprietary, or open-source projects
+  ✔  Modify and distribute with or without changes
+  ✔  Sell products built on this Software
+  ✔  No royalties or fees
+  ✔  No requirement to open-source your own code
+  ✔  Attribution to Datacules LLC required in source and binary distributions
+  ✗  Do not use "Datacules LLC" to endorse derived products without permission
+
+─────────────────────────────────────────────────────────────────────────────
+CONTACT
+─────────────────────────────────────────────────────────────────────────────
+
+Datacules LLC
+For licensing enquiries: legal@datacules.com
+Product: https://github.com/hvrcharon1/agent-identity

package/dist/cjs/index.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DynamicCredentialStore = exports.AzureManagedIdentityProvisioner = exports.AwsRolesAnywhereProvisioner = exports.VaultDynamicProvisioner = void 0;
+class VaultDynamicProvisioner {
+    constructor(opts) {
+        this.opts = opts;
+        this.id = 'vault-dynamic';
+    }
+    async provision(_ref) {
+        const { vaultAddr, token, mount, role, ttl } = this.opts;
+        const url = `${vaultAddr}/v1/${mount}/creds/${role}`;
+        const res = await fetch(url, {
+            headers: { 'X-Vault-Token': token, ...(ttl ? { 'X-Vault-Wrap-TTL': ttl } : {}) },
+        });
+        if (!res.ok)
+            throw new Error(`Vault provision failed: ${res.status} ${await res.text()}`);
+        const body = await res.json();
+        const expiresAt = new Date(Date.now() + body.lease_duration * 1000).toISOString();
+        return { leaseId: body.lease_id, expiresAt, secret: JSON.stringify(body.data) };
+    }
+    async revoke(leaseId) {
+        const { vaultAddr, token } = this.opts;
+        await fetch(`${vaultAddr}/v1/sys/leases/revoke`, {
+            method: 'PUT',
+            headers: { 'X-Vault-Token': token, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ lease_id: leaseId }),
+        }).catch(console.error);
+    }
+}
+exports.VaultDynamicProvisioner = VaultDynamicProvisioner;
+/**
+ * Provisions temporary AWS credentials via IAM Roles Anywhere.
+ * Requires `aws_signing_helper` or equivalent OIDC-based credential exchange.
+ */
+class AwsRolesAnywhereProvisioner {
+    constructor(opts) {
+        this.opts = opts;
+        this.id = 'aws-roles-anywhere';
+    }
+    async provision(_ref) {
+        const { durationSeconds = 3600, region, profileArn, roleArn, trustAnchorArn } = this.opts;
+        const endpoint = `https://rolesanywhere.${region}.amazonaws.com/sessions`;
+        const res = await fetch(endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ durationSeconds, profileArn, roleArn, trustAnchorArn }),
+        });
+        if (!res.ok)
+            throw new Error(`AWS Roles Anywhere provision failed: ${res.status}`);
+        const body = await res.json();
+        const creds = body.credentialSet[0].credentials;
+        return {
+            leaseId: `aws-session-${Date.now()}`,
+            expiresAt: creds.expiration,
+            secret: JSON.stringify({
+                accessKeyId: creds.accessKeyId,
+                secretAccessKey: creds.secretAccessKey,
+                sessionToken: creds.sessionToken,
+            }),
+        };
+    }
+}
+exports.AwsRolesAnywhereProvisioner = AwsRolesAnywhereProvisioner;
+/**
+ * Provisions a short-lived Azure AD access token via the Azure Instance
+ * Metadata Service (IMDS). Works on Azure VMs, AKS pods with workload identity,
+ * App Service, Container Apps, and Azure Arc-enabled servers.
+ *
+ * The IMDS endpoint is a link-local address (169.254.169.254) only reachable
+ * from within an Azure-hosted workload — calls will fail outside Azure.
+ *
+ * @example
+ * ```typescript
+ * const store = new DynamicCredentialStore({
+ *   provisioner: new AzureManagedIdentityProvisioner({
+ *     resource: 'https://vault.azure.net',
+ *   }),
+ * });
+ * ```
+ */
+class AzureManagedIdentityProvisioner {
+    constructor(opts) {
+        this.opts = opts;
+        this.id = 'azure-managed-identity';
+    }
+    async provision(_ref) {
+        const { resource, clientId, apiVersion = '2018-02-01' } = this.opts;
+        const imdsUrl = new URL('http://169.254.169.254/metadata/identity/oauth2/token');
+        imdsUrl.searchParams.set('api-version', apiVersion);
+        imdsUrl.searchParams.set('resource', resource);
+        if (clientId)
+            imdsUrl.searchParams.set('client_id', clientId);
+        const res = await fetch(imdsUrl.toString(), {
+            headers: { Metadata: 'true' },
+        });
+        if (!res.ok) {
+            throw new Error(`Azure IMDS token request failed: ${res.status} ${await res.text()}`);
+        }
+        const body = await res.json();
+        const expiresAt = new Date(Date.now() + parseInt(body.expires_in, 10) * 1000).toISOString();
+        const identityKind = clientId ? `user-assigned:${clientId}` : 'system-assigned';
+        return {
+            leaseId: `azure-mi-${identityKind}-${Date.now()}`,
+            expiresAt,
+            secret: body.access_token,
+        };
+    }
+}
+exports.AzureManagedIdentityProvisioner = AzureManagedIdentityProvisioner;
+class DynamicCredentialStore {
+    constructor(opts) {
+        this.opts = opts;
+        this.leaseCache = new Map();
+    }
+    async findByRef(ref) {
+        const cache = this.opts.cache !== false;
+        const renew = this.opts.renewBeforeExpireSeconds ?? 60;
+        if (cache) {
+            const cached = this.leaseCache.get(ref);
+            if (cached && cached.expiresAt > Date.now() + renew * 1000) {
+                return cached.credential;
+            }
+        }
+        const provisioned = await this.opts.provisioner.provision(ref);
+        const credential = {
+            id: `dyn-${provisioned.leaseId}`,
+            kind: 'fixed',
+            name: `Dynamic credential for ${ref}`,
+            scope: 'dynamic',
+            status: 'active',
+            ref: provisioned.leaseId,
+            expiresAt: provisioned.expiresAt,
+            lastRotated: new Date().toISOString(),
+        };
+        if (cache) {
+            this.leaseCache.set(ref, {
+                credential,
+                expiresAt: new Date(provisioned.expiresAt).getTime(),
+            });
+        }
+        return credential;
+    }
+    async listActive() {
+        const now = Date.now();
+        return Array.from(this.leaseCache.values())
+            .filter((e) => e.expiresAt > now)
+            .map((e) => e.credential);
+    }
+    async listByKind(kind) {
+        const active = await this.listActive();
+        return active.filter((c) => c.kind === kind);
+    }
+}
+exports.DynamicCredentialStore = DynamicCredentialStore;
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AA6DA,MAAa,uBAAuB;IAGlC,YAA6B,IAAoC;QAApC,SAAI,GAAJ,IAAI,CAAgC;QAFjE,OAAE,GAAG,eAAe,CAAC;IAE+C,CAAC;IAErE,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QACzD,MAAM,GAAG,GAAG,GAAG,SAAS,OAAO,KAAK,UAAU,IAAI,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACjF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAgF,CAAC;QAC5G,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAClF,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,MAAM,KAAK,CAAC,GAAG,SAAS,uBAAuB,EAAE;YAC/C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SAC5C,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;CACF;AAzBD,0DAyBC;AAeD;;;GAGG;AACH,MAAa,2BAA2B;IAGtC,YAA6B,IAAwC;QAAxC,SAAI,GAAJ,IAAI,CAAoC;QAFrE,OAAE,GAAG,oBAAoB,CAAC;IAE8C,CAAC;IAEzE,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,EAAE,eAAe,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1F,MAAM,QAAQ,GAAG,yBAAyB,MAAM,yBAAyB,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAE1B,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,eAAe,IAAI,CAAC,GAAG,EAAE,EAAE;YACpC,SAAS,EAAE,KAAK,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;gBACrB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;SACH,CAAC;IACJ,CAAC;CACF;AA5BD,kEA4BC;AAwBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,+BAA+B;IAG1C,YAA6B,IAA4C;QAA5C,SAAI,GAAJ,IAAI,CAAwC;QAFzE,OAAE,GAAG,wBAAwB,CAAC;IAE8C,CAAC;IAE7E,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAEpE,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,uDAAuD,CACxD,CAAC;QACF,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACpD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;YAC1C,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAK1B,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,IAAI,CAClD,CAAC,WAAW,EAAE,CAAC;QAEhB,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAEhF,OAAO;YACL,OAAO,EAAE,YAAY,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;YACjD,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B,CAAC;IACJ,CAAC;CACF;AA3CD,0EA2CC;AAYD,MAAa,sBAAsB;IAGjC,YAA6B,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;QAF/C,eAAU,GAAG,IAAI,GAAG,EAAyD,CAAC;IAE5B,CAAC;IAEpE,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC;QAEvD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC;gBAC3D,OAAO,MAAM,CAAC,UAAU,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAe;YAC7B,EAAE,EAAE,OAAO,WAAW,CAAC,OAAO,EAAE;YAChC,IAAI,EAAE,OAAyB;YAC/B,IAAI,EAAE,0BAA0B,GAAG,EAAE;YACrC,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,WAAW,CAAC,OAAO;YACxB,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QAEF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE;gBACvB,UAAU;gBACV,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAoB;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/C,CAAC;CACF;AAjDD,wDAiDC"}

package/dist/esm/index.js

@@ -0,0 +1,148 @@
+export class VaultDynamicProvisioner {
+    constructor(opts) {
+        this.opts = opts;
+        this.id = 'vault-dynamic';
+    }
+    async provision(_ref) {
+        const { vaultAddr, token, mount, role, ttl } = this.opts;
+        const url = `${vaultAddr}/v1/${mount}/creds/${role}`;
+        const res = await fetch(url, {
+            headers: { 'X-Vault-Token': token, ...(ttl ? { 'X-Vault-Wrap-TTL': ttl } : {}) },
+        });
+        if (!res.ok)
+            throw new Error(`Vault provision failed: ${res.status} ${await res.text()}`);
+        const body = await res.json();
+        const expiresAt = new Date(Date.now() + body.lease_duration * 1000).toISOString();
+        return { leaseId: body.lease_id, expiresAt, secret: JSON.stringify(body.data) };
+    }
+    async revoke(leaseId) {
+        const { vaultAddr, token } = this.opts;
+        await fetch(`${vaultAddr}/v1/sys/leases/revoke`, {
+            method: 'PUT',
+            headers: { 'X-Vault-Token': token, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ lease_id: leaseId }),
+        }).catch(console.error);
+    }
+}
+/**
+ * Provisions temporary AWS credentials via IAM Roles Anywhere.
+ * Requires `aws_signing_helper` or equivalent OIDC-based credential exchange.
+ */
+export class AwsRolesAnywhereProvisioner {
+    constructor(opts) {
+        this.opts = opts;
+        this.id = 'aws-roles-anywhere';
+    }
+    async provision(_ref) {
+        const { durationSeconds = 3600, region, profileArn, roleArn, trustAnchorArn } = this.opts;
+        const endpoint = `https://rolesanywhere.${region}.amazonaws.com/sessions`;
+        const res = await fetch(endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ durationSeconds, profileArn, roleArn, trustAnchorArn }),
+        });
+        if (!res.ok)
+            throw new Error(`AWS Roles Anywhere provision failed: ${res.status}`);
+        const body = await res.json();
+        const creds = body.credentialSet[0].credentials;
+        return {
+            leaseId: `aws-session-${Date.now()}`,
+            expiresAt: creds.expiration,
+            secret: JSON.stringify({
+                accessKeyId: creds.accessKeyId,
+                secretAccessKey: creds.secretAccessKey,
+                sessionToken: creds.sessionToken,
+            }),
+        };
+    }
+}
+/**
+ * Provisions a short-lived Azure AD access token via the Azure Instance
+ * Metadata Service (IMDS). Works on Azure VMs, AKS pods with workload identity,
+ * App Service, Container Apps, and Azure Arc-enabled servers.
+ *
+ * The IMDS endpoint is a link-local address (169.254.169.254) only reachable
+ * from within an Azure-hosted workload — calls will fail outside Azure.
+ *
+ * @example
+ * ```typescript
+ * const store = new DynamicCredentialStore({
+ *   provisioner: new AzureManagedIdentityProvisioner({
+ *     resource: 'https://vault.azure.net',
+ *   }),
+ * });
+ * ```
+ */
+export class AzureManagedIdentityProvisioner {
+    constructor(opts) {
+        this.opts = opts;
+        this.id = 'azure-managed-identity';
+    }
+    async provision(_ref) {
+        const { resource, clientId, apiVersion = '2018-02-01' } = this.opts;
+        const imdsUrl = new URL('http://169.254.169.254/metadata/identity/oauth2/token');
+        imdsUrl.searchParams.set('api-version', apiVersion);
+        imdsUrl.searchParams.set('resource', resource);
+        if (clientId)
+            imdsUrl.searchParams.set('client_id', clientId);
+        const res = await fetch(imdsUrl.toString(), {
+            headers: { Metadata: 'true' },
+        });
+        if (!res.ok) {
+            throw new Error(`Azure IMDS token request failed: ${res.status} ${await res.text()}`);
+        }
+        const body = await res.json();
+        const expiresAt = new Date(Date.now() + parseInt(body.expires_in, 10) * 1000).toISOString();
+        const identityKind = clientId ? `user-assigned:${clientId}` : 'system-assigned';
+        return {
+            leaseId: `azure-mi-${identityKind}-${Date.now()}`,
+            expiresAt,
+            secret: body.access_token,
+        };
+    }
+}
+export class DynamicCredentialStore {
+    constructor(opts) {
+        this.opts = opts;
+        this.leaseCache = new Map();
+    }
+    async findByRef(ref) {
+        const cache = this.opts.cache !== false;
+        const renew = this.opts.renewBeforeExpireSeconds ?? 60;
+        if (cache) {
+            const cached = this.leaseCache.get(ref);
+            if (cached && cached.expiresAt > Date.now() + renew * 1000) {
+                return cached.credential;
+            }
+        }
+        const provisioned = await this.opts.provisioner.provision(ref);
+        const credential = {
+            id: `dyn-${provisioned.leaseId}`,
+            kind: 'fixed',
+            name: `Dynamic credential for ${ref}`,
+            scope: 'dynamic',
+            status: 'active',
+            ref: provisioned.leaseId,
+            expiresAt: provisioned.expiresAt,
+            lastRotated: new Date().toISOString(),
+        };
+        if (cache) {
+            this.leaseCache.set(ref, {
+                credential,
+                expiresAt: new Date(provisioned.expiresAt).getTime(),
+            });
+        }
+        return credential;
+    }
+    async listActive() {
+        const now = Date.now();
+        return Array.from(this.leaseCache.values())
+            .filter((e) => e.expiresAt > now)
+            .map((e) => e.credential);
+    }
+    async listByKind(kind) {
+        const active = await this.listActive();
+        return active.filter((c) => c.kind === kind);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AA6DA,MAAM,OAAO,uBAAuB;IAGlC,YAA6B,IAAoC;QAApC,SAAI,GAAJ,IAAI,CAAgC;QAFjE,OAAE,GAAG,eAAe,CAAC;IAE+C,CAAC;IAErE,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QACzD,MAAM,GAAG,GAAG,GAAG,SAAS,OAAO,KAAK,UAAU,IAAI,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACjF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAgF,CAAC;QAC5G,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAClF,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QACvC,MAAM,KAAK,CAAC,GAAG,SAAS,uBAAuB,EAAE;YAC/C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;SAC5C,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;CACF;AAeD;;;GAGG;AACH,MAAM,OAAO,2BAA2B;IAGtC,YAA6B,IAAwC;QAAxC,SAAI,GAAJ,IAAI,CAAoC;QAFrE,OAAE,GAAG,oBAAoB,CAAC;IAE8C,CAAC;IAEzE,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,EAAE,eAAe,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1F,MAAM,QAAQ,GAAG,yBAAyB,MAAM,yBAAyB,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;SAC/E,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAE1B,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,eAAe,IAAI,CAAC,GAAG,EAAE,EAAE;YACpC,SAAS,EAAE,KAAK,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;gBACrB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;SACH,CAAC;IACJ,CAAC;CACF;AAwBD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,+BAA+B;IAG1C,YAA6B,IAA4C;QAA5C,SAAI,GAAJ,IAAI,CAAwC;QAFzE,OAAE,GAAG,wBAAwB,CAAC;IAE8C,CAAC;IAE7E,KAAK,CAAC,SAAS,CAAC,IAAY;QAC1B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAEpE,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,uDAAuD,CACxD,CAAC;QACF,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACpD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE9D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;YAC1C,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAK1B,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,IAAI,CAClD,CAAC,WAAW,EAAE,CAAC;QAEhB,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAEhF,OAAO;YACL,OAAO,EAAE,YAAY,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;YACjD,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B,CAAC;IACJ,CAAC;CACF;AAYD,MAAM,OAAO,sBAAsB;IAGjC,YAA6B,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;QAF/C,eAAU,GAAG,IAAI,GAAG,EAAyD,CAAC;IAE5B,CAAC;IAEpE,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC;QAEvD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC;gBAC3D,OAAO,MAAM,CAAC,UAAU,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAe;YAC7B,EAAE,EAAE,OAAO,WAAW,CAAC,OAAO,EAAE;YAChC,IAAI,EAAE,OAAyB;YAC/B,IAAI,EAAE,0BAA0B,GAAG,EAAE;YACrC,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,QAAQ;YAChB,GAAG,EAAE,WAAW,CAAC,OAAO;YACxB,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QAEF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE;gBACvB,UAAU;gBACV,SAAS,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAoB;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/types/index.d.ts

@@ -0,0 +1,138 @@
+/**
+ * @datacules/agent-identity-store-dynamic
+ *
+ * Just-in-time credential provisioning. Credentials don't exist until the
+ * agent requests them. Mints a short-lived secret on demand and returns its
+ * ref. The upstream system (Vault, AWS, Azure) revokes the secret when the
+ * TTL expires — no long-lived static credentials sit in the store at all.
+ *
+ * Usage:
+ *   import { DynamicCredentialStore, VaultDynamicProvisioner } from '@datacules/agent-identity-store-dynamic';
+ *
+ *   const store = new DynamicCredentialStore({
+ *     provisioner: new VaultDynamicProvisioner({
+ *       vaultAddr: 'http://vault:8200',
+ *       token: process.env.VAULT_TOKEN!,
+ *       mount: 'database',
+ *       role: 'crm-readonly',
+ *       ttl: '30m',
+ *     }),
+ *   });
+ *
+ *   const router = createRouterFromStore(store, rules, logger);
+ */
+import type { Credential, CredentialStore, CredentialKind } from '@datacules/agent-identity';
+export interface DynamicProvisioner {
+    /** ID that matches the ref prefix used in routing rules, e.g. 'vault-db' */
+    id: string;
+    /**
+     * Mint a new short-lived secret and return a ref (lease ID or ARN) that
+     * the router can use to retrieve the actual secret later.
+     */
+    provision(ref: string): Promise<ProvisionedSecret>;
+    /** Revoke a lease/secret early (called on router shutdown) */
+    revoke?(leaseId: string): Promise<void>;
+}
+export interface ProvisionedSecret {
+    /** Opaque ref / lease ID — passed to your vault fetch function, never to the model */
+    leaseId: string;
+    /** ISO 8601 lease expiry */
+    expiresAt: string;
+    /** The raw secret — kept server-side only, never passed to the model layer */
+    secret?: string;
+}
+export interface VaultDynamicProvisionerOptions {
+    vaultAddr: string;
+    token: string;
+    /** KV or secrets engine mount path */
+    mount: string;
+    /** Vault role that defines the secret scope */
+    role: string;
+    /** Lease duration e.g. '30m', '1h' */
+    ttl?: string;
+}
+export declare class VaultDynamicProvisioner implements DynamicProvisioner {
+    private readonly opts;
+    id: string;
+    constructor(opts: VaultDynamicProvisionerOptions);
+    provision(_ref: string): Promise<ProvisionedSecret>;
+    revoke(leaseId: string): Promise<void>;
+}
+export interface AwsRolesAnywhereProvisionerOptions {
+    profileArn: string;
+    roleArn: string;
+    trustAnchorArn: string;
+    region: string;
+    /** Duration in seconds (900–3600) */
+    durationSeconds?: number;
+    /** Path to certificate PEM for signing */
+    certPath?: string;
+}
+/**
+ * Provisions temporary AWS credentials via IAM Roles Anywhere.
+ * Requires `aws_signing_helper` or equivalent OIDC-based credential exchange.
+ */
+export declare class AwsRolesAnywhereProvisioner implements DynamicProvisioner {
+    private readonly opts;
+    id: string;
+    constructor(opts: AwsRolesAnywhereProvisionerOptions);
+    provision(_ref: string): Promise<ProvisionedSecret>;
+}
+export interface AzureManagedIdentityProvisionerOptions {
+    /**
+     * The resource URI (audience) for the token.
+     * e.g. 'https://vault.azure.net' for Azure Key Vault,
+     *      'https://management.azure.com/' for ARM,
+     *      'https://storage.azure.com/' for Blob Storage.
+     */
+    resource: string;
+    /**
+     * Client ID for a user-assigned managed identity.
+     * Omit to use the system-assigned managed identity of the host VM/container.
+     */
+    clientId?: string;
+    /**
+     * IMDS API version (default: '2018-02-01').
+     * Use '2019-08-01' for Arc-enabled servers.
+     */
+    apiVersion?: string;
+}
+/**
+ * Provisions a short-lived Azure AD access token via the Azure Instance
+ * Metadata Service (IMDS). Works on Azure VMs, AKS pods with workload identity,
+ * App Service, Container Apps, and Azure Arc-enabled servers.
+ *
+ * The IMDS endpoint is a link-local address (169.254.169.254) only reachable
+ * from within an Azure-hosted workload — calls will fail outside Azure.
+ *
+ * @example
+ * ```typescript
+ * const store = new DynamicCredentialStore({
+ *   provisioner: new AzureManagedIdentityProvisioner({
+ *     resource: 'https://vault.azure.net',
+ *   }),
+ * });
+ * ```
+ */
+export declare class AzureManagedIdentityProvisioner implements DynamicProvisioner {
+    private readonly opts;
+    id: string;
+    constructor(opts: AzureManagedIdentityProvisionerOptions);
+    provision(_ref: string): Promise<ProvisionedSecret>;
+}
+export interface DynamicCredentialStoreOptions {
+    provisioner: DynamicProvisioner;
+    /** Cache unexpired leases (default: true) */
+    cache?: boolean;
+    /** Renew cache entry N seconds before expiry (default: 60) */
+    renewBeforeExpireSeconds?: number;
+}
+export declare class DynamicCredentialStore implements CredentialStore {
+    private readonly opts;
+    private readonly leaseCache;
+    constructor(opts: DynamicCredentialStoreOptions);
+    findByRef(ref: string): Promise<Credential | null>;
+    listActive(): Promise<Credential[]>;
+    listByKind(kind: CredentialKind): Promise<Credential[]>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAI7F,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnD,8DAA8D;IAC9D,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,uBAAwB,YAAW,kBAAkB;IAGpD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,EAAE,SAAmB;gBAEQ,IAAI,EAAE,8BAA8B;IAE3D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAYnD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQ7C;AAID,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,qBAAa,2BAA4B,YAAW,kBAAkB;IAGxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,EAAE,SAAwB;gBAEG,IAAI,EAAE,kCAAkC;IAE/D,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAuB1D;AAID,MAAM,WAAW,sCAAsC;IACrD;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,+BAAgC,YAAW,kBAAkB;IAG5D,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,EAAE,SAA4B;gBAED,IAAI,EAAE,sCAAsC;IAEnE,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAsC1D;AAID,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,kBAAkB,CAAC;IAChC,6CAA6C;IAC7C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8DAA8D;IAC9D,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,qBAAa,sBAAuB,YAAW,eAAe;IAGhD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoE;gBAElE,IAAI,EAAE,6BAA6B;IAE1D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAiClD,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAOnC,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CAI9D"}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@datacules/agent-identity-store-dynamic",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "private": false,
   "description": "Just-in-time credential provisioning store for @datacules/agent-identity — mints short-lived secrets on demand via Vault dynamic secrets or AWS IAM Roles Anywhere",
   "author": "Datacules LLC",
-  "license": "MIT",
+  "license": "SEE LICENSE IN LICENSE",
   "repository": {
     "type": "git",
     "url": "https://github.com/hvrcharon1/agent-identity.git",
@@ -22,10 +22,11 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "tsc -p tsconfig.build.json && tsc -p tsconfig.cjs.json",
     "type-check": "tsc --noEmit",
     "lint": "eslint src --ext .ts"
   },
@@ -34,6 +35,17 @@
     "typescript": "^5"
   },
   "peerDependencies": {
-    "@datacules/agent-identity": "^0.6.0"
-  }
+    "@datacules/agent-identity": "^0.11.1"
+  },
+  "keywords": [
+    "agent-identity",
+    "jit",
+    "dynamic-credentials",
+    "vault",
+    "aws",
+    "azure",
+    "managed-identity",
+    "ai-agents",
+    "datacules"
+  ]
 }