@datacules/agent-identity 0.2.1

package/dist/cjs/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../src/providers.ts"],"names":[],"mappings":";;;AAgFA,gCAEC;AAUD,4CAEC;AA5FD,SAAS,oBAAoB,CAAC,UAA8B,EAAE,KAAqB,EAAE,SAA4B;IAC/G,MAAM,WAAW,GAAqB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1F,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,IAAI,SAAS,sBAAsB,KAAK,kDAAkD,UAAU,CAAC,GAAG,sBAAsB,CAAC,CAAC;IAClJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,qDAAqD,UAAU,CAAC,GAAG,oCAAoC,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAoB;IACrC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,QAAQ;IACf,gBAAgB,CAAC,OAAO,EAAE,UAAU;QAClC,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,cAAc,EAAE,4CAA4C,EAAE,EAAE,CAAC;IAChN,CAAC;IACD,QAAQ,CAAC,OAAO;QACd,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC5E,CAAC;IACD,oBAAoB,CAAC,UAAU,EAAE,KAAK,IAAI,oBAAoB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;CAC/F,CAAC;AAEF,MAAM,gBAAgB,GAAoB;IACxC,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,WAAW;IAClB,gBAAgB,CAAC,OAAO,EAAE,UAAU;QAClC,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAI,OAAO,CAAC,QAAoC,EAAE,OAAO,EAAE,UAAU,CAAC,WAAW,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE,gCAAgC,EAAE,EAAE,EAAE,CAAC;IAClO,CAAC;IACD,QAAQ,CAAC,OAAO;QACd,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrF,CAAC;IACD,oBAAoB,CAAC,UAAU,EAAE,KAAK,IAAI,oBAAoB,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;CAClG,CAAC;AAEF,MAAM,aAAa,GAAoB;IACrC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,QAAQ;IACf,gBAAgB,CAAC,OAAO,EAAE,UAAU;QAClC,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,GAAI,OAAO,CAAC,MAAkC,EAAE,OAAO,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,cAAc,EAAE,qCAAqC,EAAE,EAAE,CAAC;IACxQ,CAAC;IACD,QAAQ,CAAC,OAAO;QACd,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAClF,CAAC;IACD,oBAAoB,CAAC,UAAU,EAAE,KAAK,IAAI,oBAAoB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;CAC/F,CAAC;AAEF,MAAM,cAAc,GAAoB;IACtC,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,SAAS;IAChB,gBAAgB,CAAC,OAAO,EAAE,UAAU;QAClC,OAAO,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,cAAc,EAAE,4CAA4C,EAAE,EAAE,CAAC;IAClL,CAAC;IACD,QAAQ,CAAC,OAAO;QACd,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACnF,CAAC;IACD,oBAAoB,CAAC,UAAU,EAAE,KAAK,IAAI,oBAAoB,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;CAChG,CAAC;AAEF,MAAM,YAAY,GAAoB;IACpC,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,qBAAqB;IAC5B,gBAAgB,CAAC,OAAO,EAAE,UAAU;QAClC,OAAO,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,cAAc,EAAE,mBAAmB,EAAE,EAAE,CAAC;IACzJ,CAAC;IACD,oBAAoB,CAAC,UAAU,EAAE,KAAK,IAAI,oBAAoB,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9F,CAAC;AAEW,QAAA,iBAAiB,GAA+C;IAC3E,MAAM,EAAE,aAAa;IACrB,SAAS,EAAE,gBAAgB;IAC3B,MAAM,EAAE,aAAa;IACrB,OAAO,EAAE,cAAc;IACvB,KAAK,EAAE,YAAY;CACpB,CAAC;AAEF,SAAgB,UAAU,CAAC,QAA2B;IACpD,OAAO,yBAAiB,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,OAAwB;IACtD,yBAAqD,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC;AAC/E,CAAC"}

package/dist/cjs/rotation.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialRotationScheduler = void 0;
+// ─── CredentialRotationScheduler ─────────────────────────────────────────────
+class CredentialRotationScheduler {
+    constructor(repository, auditLogger) {
+        this.repository = repository;
+        this.auditLogger = auditLogger;
+        this.providers = new Map();
+        this.intervalHandle = null;
+    }
+    registerProvider(provider) {
+        this.providers.set(provider.id, provider);
+    }
+    /**
+     * Check all active credentials for pending rotation and rotate them.
+     * Call this on a schedule (e.g. every hour via cron or setInterval).
+     */
+    async runOnce() {
+        const credentials = await this.repository.listActive();
+        const now = new Date();
+        for (const cred of credentials) {
+            if (!cred.rotation)
+                continue;
+            const due = this.isRotationDue(cred, cred.rotation, now);
+            if (!due) {
+                await this.maybeEmitWarning(cred, cred.rotation, now);
+                continue;
+            }
+            const provider = cred.rotation.provisioner
+                ? this.providers.get(cred.rotation.provisioner)
+                : null;
+            if (!provider) {
+                console.warn(`[RotationScheduler] No provider for credential ${cred.id} (provisioner: ${cred.rotation.provisioner ?? 'unset'})`);
+                continue;
+            }
+            try {
+                const { newRef, rotatedAt } = await provider.rotate(cred);
+                await this.repository.update(cred.id, { ref: newRef, lastRotated: rotatedAt });
+                if (this.auditLogger) {
+                    await this.auditLogger.log({
+                        timestamp: new Date().toISOString(),
+                        traceId: `rotation-${cred.id}`,
+                        userId: 'system',
+                        action: 'credential.rotated',
+                        resourceId: cred.id,
+                        resourceKind: 'shared',
+                        provider: 'local',
+                        model: 'system',
+                        credentialId: cred.id,
+                        credentialKind: cred.kind,
+                        resolvedFor: 'system',
+                    });
+                }
+            }
+            catch (err) {
+                console.error(`[RotationScheduler] Rotation failed for ${cred.id}:`, err);
+                if (this.auditLogger) {
+                    await this.auditLogger.log({
+                        timestamp: new Date().toISOString(),
+                        traceId: `rotation-${cred.id}`,
+                        userId: 'system',
+                        action: 'credential.rotation_failed',
+                        resourceId: cred.id,
+                        resourceKind: 'shared',
+                        provider: 'local',
+                        model: 'system',
+                        credentialId: cred.id,
+                        credentialKind: cred.kind,
+                        resolvedFor: 'system',
+                    });
+                }
+            }
+        }
+    }
+    /**
+     * Start a background rotation loop at the given interval.
+     * @param intervalMs Check frequency in milliseconds (default: 3600000 = 1 hour)
+     */
+    start(intervalMs = 3600000) {
+        if (this.intervalHandle !== null)
+            return;
+        this.intervalHandle = setInterval(() => {
+            this.runOnce().catch(console.error);
+        }, intervalMs);
+    }
+    stop() {
+        if (this.intervalHandle !== null) {
+            clearInterval(this.intervalHandle);
+            this.intervalHandle = null;
+        }
+    }
+    isRotationDue(cred, policy, now) {
+        if (policy.rotateAfterDays !== undefined && cred.lastRotated) {
+            const lastRotated = new Date(cred.lastRotated);
+            const daysSince = (now.getTime() - lastRotated.getTime()) / 86400000;
+            if (daysSince >= policy.rotateAfterDays)
+                return true;
+        }
+        return false;
+    }
+    async maybeEmitWarning(cred, policy, now) {
+        if (!this.auditLogger)
+            return;
+        if (policy.notifyBeforeDays !== undefined && policy.rotateAfterDays !== undefined && cred.lastRotated) {
+            const lastRotated = new Date(cred.lastRotated);
+            const daysUntilDue = policy.rotateAfterDays - (now.getTime() - lastRotated.getTime()) / 86400000;
+            if (daysUntilDue > 0 && daysUntilDue <= policy.notifyBeforeDays) {
+                await this.auditLogger.log({
+                    timestamp: new Date().toISOString(),
+                    traceId: `rotation-warning-${cred.id}`,
+                    userId: 'system',
+                    action: 'credential.rotation_due',
+                    resourceId: cred.id,
+                    resourceKind: 'shared',
+                    provider: 'local',
+                    model: 'system',
+                    credentialId: cred.id,
+                    credentialKind: cred.kind,
+                    resolvedFor: 'system',
+                });
+            }
+        }
+    }
+}
+exports.CredentialRotationScheduler = CredentialRotationScheduler;
+//# sourceMappingURL=rotation.js.map

package/dist/cjs/rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.js","sourceRoot":"","sources":["../../src/rotation.ts"],"names":[],"mappings":";;;AA+BA,gFAAgF;AAEhF,MAAa,2BAA2B;IAItC,YACmB,UAA8B,EAC9B,WAAyB;QADzB,eAAU,GAAV,UAAU,CAAoB;QAC9B,gBAAW,GAAX,WAAW,CAAc;QAL3B,cAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;QACzD,mBAAc,GAA0C,IAAI,CAAC;IAKlE,CAAC;IAEJ,gBAAgB,CAAC,QAA0B;QACzC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAE7B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACzD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACtD,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW;gBACxC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC/C,CAAC,CAAC,IAAI,CAAC;YAET,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,kDAAkD,IAAI,CAAC,EAAE,kBAAkB,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,OAAO,GAAG,CAAC,CAAC;gBACjI,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;gBAE/E,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;wBACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,OAAO,EAAE,YAAY,IAAI,CAAC,EAAE,EAAE;wBAC9B,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,oBAAoB;wBAC5B,UAAU,EAAE,IAAI,CAAC,EAAE;wBACnB,YAAY,EAAE,QAAQ;wBACtB,QAAQ,EAAE,OAAO;wBACjB,KAAK,EAAE,QAAQ;wBACf,YAAY,EAAE,IAAI,CAAC,EAAE;wBACrB,cAAc,EAAE,IAAI,CAAC,IAAI;wBACzB,WAAW,EAAE,QAAQ;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1E,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;wBACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,OAAO,EAAE,YAAY,IAAI,CAAC,EAAE,EAAE;wBAC9B,MAAM,EAAE,QAAQ;wBAChB,MAAM,EAAE,4BAA4B;wBACpC,UAAU,EAAE,IAAI,CAAC,EAAE;wBACnB,YAAY,EAAE,QAAQ;wBACtB,QAAQ,EAAE,OAAO;wBACjB,KAAK,EAAE,QAAQ;wBACf,YAAY,EAAE,IAAI,CAAC,EAAE;wBACrB,cAAc,EAAE,IAAI,CAAC,IAAI;wBACzB,WAAW,EAAE,QAAQ;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,GAAG,OAAS;QAC1B,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;YAAE,OAAO;QACzC,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;YACrC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACjC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,IAAgB,EAAE,MAAsB,EAAE,GAAS;QACvE,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7D,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,GAAG,QAAU,CAAC;YACvE,IAAI,SAAS,IAAI,MAAM,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAgB,EAAE,MAAsB,EAAE,GAAS;QAChF,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAC9B,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtG,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/C,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,GAAG,QAAU,CAAC;YACnG,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAChE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;oBACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,EAAE;oBACtC,MAAM,EAAE,QAAQ;oBAChB,MAAM,EAAE,yBAAyB;oBACjC,UAAU,EAAE,IAAI,CAAC,EAAE;oBACnB,YAAY,EAAE,QAAQ;oBACtB,QAAQ,EAAE,OAAO;oBACjB,KAAK,EAAE,QAAQ;oBACf,YAAY,EAAE,IAAI,CAAC,EAAE;oBACrB,cAAc,EAAE,IAAI,CAAC,IAAI;oBACzB,WAAW,EAAE,QAAQ;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAhID,kEAgIC"}

package/dist/cjs/router.js

@@ -0,0 +1,216 @@
+"use strict";
+/**
+ * Credential Router — core of @datacules/agent-identity.
+ *
+ * Key features added in this version:
+ * - Canary routing: canaryRef + canaryWeight on RoutingRule
+ * - Attestation: optional AttestationSigner on router config
+ * - Budget enforcement: BudgetEnforcer check before resolving
+ * - Approval gate: ApprovalManager integration on rules with approval policy
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialRouter = exports.MemoryCredentialStore = void 0;
+exports.createRouter = createRouter;
+exports.createRouterFromStore = createRouterFromStore;
+exports.createRouterWithConfig = createRouterWithConfig;
+const attestation_1 = require("./attestation");
+function isSyncCapable(store) {
+    return typeof store.findByRefSync === 'function';
+}
+class MemoryCredentialStore {
+    constructor(credentials) {
+        this.reservations = new Map();
+        this.creds = credentials;
+    }
+    findByRefSync(ref) {
+        return this.creds.find((c) => c.ref === ref && c.status === 'active') ?? null;
+    }
+    async findByRef(ref) {
+        return this.findByRefSync(ref);
+    }
+    async listActive() {
+        return this.creds.filter((c) => c.status === 'active');
+    }
+    async listByKind(kind) {
+        return this.creds.filter((c) => c.kind === kind);
+    }
+    async reserve(ref, migrationId, ttlSeconds) {
+        const existing = this.reservations.get(ref);
+        const now = Date.now();
+        if (existing && existing.migrationId !== migrationId && existing.expiresAt > now)
+            return false;
+        this.reservations.set(ref, { migrationId, expiresAt: now + ttlSeconds * 1000 });
+        return true;
+    }
+    async release(ref, migrationId) {
+        const existing = this.reservations.get(ref);
+        if (existing?.migrationId === migrationId)
+            this.reservations.delete(ref);
+    }
+}
+exports.MemoryCredentialStore = MemoryCredentialStore;
+class CredentialRouter {
+    constructor(config) {
+        this.config = config;
+    }
+    // ─── Sync resolve (requires SyncCapable store) ────────────────────────────
+    resolve(ctx) {
+        const { store, rules } = this.config;
+        const matching = rules
+            .filter((r) => this.ruleMatches(r, ctx))
+            .sort((a, b) => b.priority - a.priority);
+        const rule = matching[0];
+        if (!rule)
+            return null;
+        if (!isSyncCapable(store)) {
+            console.warn('[CredentialRouter] resolve() requires findByRefSync(). Use resolveAsync() for async stores.');
+            return null;
+        }
+        // Canary selection
+        const ref = this.selectRef(rule);
+        const isCanary = ref === rule.canaryRef;
+        const cred = store.findByRefSync(ref);
+        if (!cred)
+            return null;
+        if (cred.expiresAt && new Date(cred.expiresAt) < new Date())
+            return null;
+        if (rule.readOnly && !cred.scope.toLowerCase().includes('read'))
+            return null;
+        const resolved = {
+            credentialId: cred.id,
+            kind: cred.kind,
+            ref: cred.ref,
+            resolvedFor: cred.kind === 'user-delegated' ? ctx.userId : 'service',
+            expiresAt: cred.expiresAt,
+            isCanary,
+        };
+        if (this.config.logger) {
+            this.config.logger.log(this.buildAuditEntry(ctx, resolved, rule, isCanary)).catch(console.error);
+        }
+        return resolved;
+    }
+    // ─── Async resolve (all stores; supports approval + budget + attestation) ─
+    async resolveAsync(ctx) {
+        const { store, rules, approvalManager, budgetEnforcer, attestationSigner } = this.config;
+        const matching = rules
+            .filter((r) => this.ruleMatches(r, ctx))
+            .sort((a, b) => b.priority - a.priority);
+        const rule = matching[0];
+        if (!rule)
+            return null;
+        // Approval gate
+        if (rule.approval && approvalManager) {
+            const status = await approvalManager.request(ctx, rule.approval, rule.credentialRef, rule.id);
+            if (status !== 'approved' && status !== 'break_glass')
+                return null;
+        }
+        const ref = this.selectRef(rule);
+        const isCanary = ref === rule.canaryRef;
+        const cred = await store.findByRef(ref);
+        if (!cred)
+            return null;
+        if (cred.expiresAt && new Date(cred.expiresAt) < new Date())
+            return null;
+        if (rule.readOnly && !cred.scope.toLowerCase().includes('read'))
+            return null;
+        // Budget check
+        if (budgetEnforcer) {
+            const budget = await budgetEnforcer.check(cred);
+            if (!budget.allowed)
+                return null;
+        }
+        const resolved = {
+            credentialId: cred.id,
+            kind: cred.kind,
+            ref: cred.ref,
+            resolvedFor: cred.kind === 'user-delegated' ? ctx.userId : 'service',
+            expiresAt: cred.expiresAt,
+            isCanary,
+        };
+        // Attestation
+        if (attestationSigner) {
+            resolved.credentialAttestation = await (0, attestation_1.buildAttestation)(ctx, resolved, {
+                signer: attestationSigner,
+                ruleId: rule.id,
+            });
+        }
+        if (this.config.logger) {
+            await this.config.logger.log(this.buildAuditEntry(ctx, resolved, rule, isCanary));
+        }
+        return resolved;
+    }
+    // ─── Pair resolve for migration ───────────────────────────────────────────
+    resolvePair(ctx) {
+        const sourceCtx = { ...ctx, resourceId: ctx.sourceResourceId, action: 'read' };
+        const targetCtx = { ...ctx, resourceId: ctx.targetResourceId, action: ctx.dryRun ? 'read' : ctx.action };
+        const source = this.resolve(sourceCtx);
+        const target = this.resolve(targetCtx);
+        if (!source || !target)
+            return null;
+        return { source, target, migrationId: ctx.migrationId };
+    }
+    // ─── Canary selection ─────────────────────────────────────────────────────
+    selectRef(rule) {
+        if (rule.canaryRef && rule.canaryWeight && rule.canaryWeight > 0) {
+            const roll = Math.random() * 100;
+            if (roll < rule.canaryWeight)
+                return rule.canaryRef;
+        }
+        return rule.credentialRef;
+    }
+    // ─── Rule matching ────────────────────────────────────────────────────────
+    ruleMatches(rule, ctx) {
+        if (rule.matchResourceKind && rule.matchResourceKind !== ctx.resourceKind)
+            return false;
+        if (rule.matchProvider && rule.matchProvider !== ctx.provider)
+            return false;
+        if (rule.matchUserId && rule.matchUserId !== ctx.userId)
+            return false;
+        if (rule.matchSpiffeId && ctx.spiffeId !== rule.matchSpiffeId)
+            return false;
+        if (rule.matchAction) {
+            const actions = Array.isArray(rule.matchAction) ? rule.matchAction : [rule.matchAction];
+            if (!actions.includes(ctx.action))
+                return false;
+        }
+        if (rule.matchPhase) {
+            const migCtx = ctx;
+            if (!migCtx.phase)
+                return false;
+            const phases = Array.isArray(rule.matchPhase) ? rule.matchPhase : [rule.matchPhase];
+            if (!phases.includes(migCtx.phase))
+                return false;
+        }
+        return true;
+    }
+    // ─── Audit entry builder ─────────────────────────────────────────────────
+    buildAuditEntry(ctx, resolved, rule, isCanary) {
+        return {
+            timestamp: new Date().toISOString(),
+            traceId: ctx.traceId,
+            userId: ctx.userId,
+            action: ctx.action,
+            resourceId: ctx.resourceId,
+            resourceKind: ctx.resourceKind,
+            provider: ctx.provider,
+            model: ctx.model,
+            credentialId: resolved.credentialId,
+            credentialKind: resolved.kind,
+            resolvedFor: resolved.resolvedFor,
+            isCanary,
+            spiffeId: ctx.spiffeId,
+        };
+    }
+}
+exports.CredentialRouter = CredentialRouter;
+// ─── Factory functions ────────────────────────────────────────────────────────
+function createRouter(credentials, rules, logger) {
+    return new CredentialRouter({ store: new MemoryCredentialStore(credentials), rules, logger });
+}
+function createRouterFromStore(store, rules, logger) {
+    return new CredentialRouter({ store, rules, logger });
+}
+function createRouterWithConfig(config) {
+    return new CredentialRouter(config);
+}
+//# sourceMappingURL=router.js.map

package/dist/cjs/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/router.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAsPH,oCAMC;AAED,sDAMC;AAED,wDAEC;AA1PD,+CAAiD;AAQjD,SAAS,aAAa,CAAC,KAAsB;IAC3C,OAAO,OAAQ,KAA0B,CAAC,aAAa,KAAK,UAAU,CAAC;AACzE,CAAC;AAcD,MAAa,qBAAqB;IAIhC,YAAY,WAAyB;QAFpB,iBAAY,GAAG,IAAI,GAAG,EAAsD,CAAC;QAG5F,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC;IAC3B,CAAC;IAED,aAAa,CAAC,GAAW;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAwB;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,WAAmB,EAAE,UAAkB;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,QAAQ,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,IAAI,QAAQ,CAAC,SAAS,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QAC/F,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,WAAmB;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,WAAW,KAAK,WAAW;YAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;CACF;AApCD,sDAoCC;AAED,MAAa,gBAAgB;IAC3B,YAA6B,MAAoB;QAApB,WAAM,GAAN,MAAM,CAAc;IAAG,CAAC;IAErD,6EAA6E;IAE7E,OAAO,CAAC,GAAwB;QAC9B,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE3C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,6FAA6F,CAAC,CAAC;YAC5G,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mBAAmB;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC;QAExC,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACzE,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAE7E,MAAM,QAAQ,GAAuB;YACnC,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACpE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ;SACT,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnG,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,YAAY,CAAC,GAAwB;QACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACzF,MAAM,QAAQ,GAAG,KAAK;aACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE3C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,gBAAgB;QAChB,IAAI,IAAI,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9F,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,aAAa;gBAAE,OAAO,IAAI,CAAC;QACrE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC;QAExC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QACzE,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAE7E,eAAe;QACf,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;QACnC,CAAC;QAED,MAAM,QAAQ,GAAuB;YACnC,YAAY,EAAE,IAAI,CAAC,EAAE;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACpE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ;SACT,CAAC;QAEF,cAAc;QACd,IAAI,iBAAiB,EAAE,CAAC;YACtB,QAAQ,CAAC,qBAAqB,GAAG,MAAM,IAAA,8BAAgB,EAAC,GAAG,EAAE,QAAQ,EAAE;gBACrE,MAAM,EAAE,iBAAiB;gBACzB,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,6EAA6E;IAE7E,WAAW,CAAC,GAAqB;QAC/B,MAAM,SAAS,GAAwB,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACpG,MAAM,SAAS,GAAwB,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAE9H,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAErE,SAAS,CAAC,IAAiB;QACjC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC;YACjC,IAAI,IAAI,GAAG,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,6EAA6E;IAErE,WAAW,CAAC,IAAiB,EAAE,GAAwB;QAC7D,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,KAAK,GAAG,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QACxF,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,GAAG,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5E,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,IAAI,CAAC,aAAa,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAC5E,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACxF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,GAAuB,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YAChC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACpF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;QACnD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAEpE,eAAe,CACrB,GAAwB,EACxB,QAA4B,EAC5B,IAAiB,EACjB,QAAiB;QAEjB,OAAO;YACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,cAAc,EAAE,QAAQ,CAAC,IAAI;YAC7B,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,QAAQ;YACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC;IACJ,CAAC;CACF;AAtKD,4CAsKC;AAED,iFAAiF;AAEjF,SAAgB,YAAY,CAC1B,WAAyB,EACzB,KAAoB,EACpB,MAAoB;IAEpB,OAAO,IAAI,gBAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,qBAAqB,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,SAAgB,qBAAqB,CACnC,KAAsB,EACtB,KAAoB,EACpB,MAAoB;IAEpB,OAAO,IAAI,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,sBAAsB,CAAC,MAAoB;IACzD,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/cjs/schemas.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MigrationContextSchema = exports.AgentRequestContextSchema = exports.RoutingRuleSchema = exports.CredentialSchema = exports.ApprovalPolicySchema = exports.ApproverSchema = exports.BudgetPolicySchema = exports.RotationPolicySchema = exports.ApproverKindSchema = exports.MigrationPhaseSchema = exports.CredentialStatusSchema = exports.CredentialKindSchema = exports.ResourceKindSchema = exports.SupportedProviderSchema = void 0;
+/**
+ * @datacules/agent-identity/schemas
+ *
+ * Zod schemas mirroring every public type. Three uses simultaneously:
+ *   1. Runtime validation in route handlers (replaces manual field loops)
+ *   2. TypeScript type inference via z.infer<>
+ *   3. JSON Schema / OpenAPI generation via zod-to-json-schema
+ *
+ * Since zod is already in dependencies, this costs nothing to ship.
+ */
+const zod_1 = require("zod");
+// ─── Primitives ───────────────────────────────────────────────────────────────
+exports.SupportedProviderSchema = zod_1.z.enum([
+    'openai',
+    'anthropic',
+    'gemini',
+    'mistral',
+    'local',
+]);
+exports.ResourceKindSchema = zod_1.z.enum(['shared', 'personal']);
+exports.CredentialKindSchema = zod_1.z.enum(['fixed', 'user-delegated']);
+exports.CredentialStatusSchema = zod_1.z.enum(['active', 'pending', 'revoked']);
+exports.MigrationPhaseSchema = zod_1.z.enum([
+    'dry-run',
+    'extract',
+    'transform',
+    'load',
+    'verify',
+    'rollback',
+]);
+exports.ApproverKindSchema = zod_1.z.enum(['webhook', 'email', 'slack']);
+// ─── Rotation Policy ─────────────────────────────────────────────────────────
+exports.RotationPolicySchema = zod_1.z.object({
+    rotateAfterDays: zod_1.z.number().int().positive().optional(),
+    rotateAfterUses: zod_1.z.number().int().positive().optional(),
+    gracePeriodSeconds: zod_1.z.number().int().nonnegative().optional(),
+    notifyBeforeDays: zod_1.z.number().int().positive().optional(),
+    provisioner: zod_1.z.string().optional(),
+});
+// ─── Budget Policy ────────────────────────────────────────────────────────────
+exports.BudgetPolicySchema = zod_1.z.object({
+    maxResolutionsPerHour: zod_1.z.number().int().positive().optional(),
+    maxConcurrentSessions: zod_1.z.number().int().positive().optional(),
+    maxDailySpendUsd: zod_1.z.number().positive().optional(),
+    softThresholdPercent: zod_1.z.number().min(0).max(100).optional(),
+    resetSchedule: zod_1.z.string().optional(),
+});
+// ─── Approval Policy ─────────────────────────────────────────────────────────
+exports.ApproverSchema = zod_1.z.object({
+    kind: exports.ApproverKindSchema,
+    target: zod_1.z.string().min(1),
+});
+exports.ApprovalPolicySchema = zod_1.z.object({
+    requiredApprovers: zod_1.z.number().int().positive(),
+    approvers: zod_1.z.array(exports.ApproverSchema),
+    timeoutSeconds: zod_1.z.number().int().positive().optional(),
+    breakGlass: zod_1.z
+        .object({
+        approver: zod_1.z.string().min(1),
+        requireJustification: zod_1.z.boolean().optional(),
+    })
+        .optional(),
+});
+// ─── Credential ─────────────────────────────────────────────────────────────
+exports.CredentialSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1),
+    kind: exports.CredentialKindSchema,
+    name: zod_1.z.string().min(1),
+    scope: zod_1.z.string(),
+    status: exports.CredentialStatusSchema,
+    provider: zod_1.z.string().optional(),
+    ref: zod_1.z.string().min(1),
+    expiresAt: zod_1.z.string().datetime().optional(),
+    lastRotated: zod_1.z.string().datetime().optional(),
+    refreshTokenRef: zod_1.z.string().optional(),
+    rotationIntervalDays: zod_1.z.number().int().nonnegative().optional(),
+    rotation: exports.RotationPolicySchema.optional(),
+    budget: exports.BudgetPolicySchema.optional(),
+    tags: zod_1.z.array(zod_1.z.string()).optional(),
+});
+// ─── Routing Rule ──────────────────────────────────────────────────────────
+exports.RoutingRuleSchema = zod_1.z.object({
+    id: zod_1.z.string().min(1),
+    description: zod_1.z.string(),
+    credentialRef: zod_1.z.string().min(1),
+    credentialKind: exports.CredentialKindSchema,
+    priority: zod_1.z.number().int(),
+    matchResourceKind: exports.ResourceKindSchema.optional(),
+    matchAction: zod_1.z.union([zod_1.z.string(), zod_1.z.array(zod_1.z.string())]).optional(),
+    matchProvider: exports.SupportedProviderSchema.optional(),
+    matchUserId: zod_1.z.string().optional(),
+    matchPhase: zod_1.z
+        .union([exports.MigrationPhaseSchema, zod_1.z.array(exports.MigrationPhaseSchema)])
+        .optional(),
+    matchSpiffeId: zod_1.z.string().optional(),
+    readOnly: zod_1.z.boolean().optional(),
+    canaryRef: zod_1.z.string().optional(),
+    canaryWeight: zod_1.z.number().int().min(0).max(100).optional(),
+    approval: exports.ApprovalPolicySchema.optional(),
+});
+// ─── Agent Request Context ───────────────────────────────────────────────
+exports.AgentRequestContextSchema = zod_1.z.object({
+    userId: zod_1.z.string().min(1),
+    resourceId: zod_1.z.string().min(1),
+    resourceKind: exports.ResourceKindSchema,
+    provider: exports.SupportedProviderSchema,
+    model: zod_1.z.string().min(1),
+    action: zod_1.z.string().min(1),
+    traceId: zod_1.z.string().min(1),
+    sessionId: zod_1.z.string().optional(),
+    requestedAt: zod_1.z.string().datetime(),
+    parentTraceId: zod_1.z.string().optional(),
+    spiffeId: zod_1.z.string().optional(),
+});
+exports.MigrationContextSchema = exports.AgentRequestContextSchema.extend({
+    migrationId: zod_1.z.string().min(1),
+    phase: exports.MigrationPhaseSchema,
+    sourceResourceId: zod_1.z.string().min(1),
+    targetResourceId: zod_1.z.string().min(1),
+    dryRun: zod_1.z.boolean(),
+    batchIndex: zod_1.z.number().int().nonnegative().optional(),
+    totalBatches: zod_1.z.number().int().positive().optional(),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/cjs/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/schemas.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,6BAAwB;AAExB,iFAAiF;AAEpE,QAAA,uBAAuB,GAAG,OAAC,CAAC,IAAI,CAAC;IAC5C,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAEU,QAAA,kBAAkB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAEpD,QAAA,oBAAoB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAE3D,QAAA,sBAAsB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAElE,QAAA,oBAAoB,GAAG,OAAC,CAAC,IAAI,CAAC;IACzC,SAAS;IACT,SAAS;IACT,WAAW;IACX,MAAM;IACN,QAAQ;IACR,UAAU;CACX,CAAC,CAAC;AAEU,QAAA,kBAAkB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAExE,gFAAgF;AAEnE,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC7D,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,iFAAiF;AAEpE,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7D,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7D,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,oBAAoB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3D,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,gFAAgF;AAEnE,QAAA,cAAc,GAAG,OAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,0BAAkB;IACxB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,OAAC,CAAC,KAAK,CAAC,sBAAc,CAAC;IAClC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,OAAC;SACV,MAAM,CAAC;QACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,oBAAoB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC7C,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,+EAA+E;AAElE,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,4BAAoB;IAC1B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,8BAAsB;IAC9B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,oBAAoB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC/D,QAAQ,EAAE,4BAAoB,CAAC,QAAQ,EAAE;IACzC,MAAM,EAAE,0BAAkB,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,8EAA8E;AAEjE,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,cAAc,EAAE,4BAAoB;IACpC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC1B,iBAAiB,EAAE,0BAAkB,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE,aAAa,EAAE,+BAAuB,CAAC,QAAQ,EAAE;IACjD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,OAAC;SACV,KAAK,CAAC,CAAC,4BAAoB,EAAE,OAAC,CAAC,KAAK,CAAC,4BAAoB,CAAC,CAAC,CAAC;SAC5D,QAAQ,EAAE;IACb,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,QAAQ,EAAE,4BAAoB,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH,4EAA4E;AAE/D,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,YAAY,EAAE,0BAAkB;IAChC,QAAQ,EAAE,+BAAuB;IACjC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEU,QAAA,sBAAsB,GAAG,iCAAyB,CAAC,MAAM,CAAC;IACrE,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,KAAK,EAAE,4BAAoB;IAC3B,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,OAAC,CAAC,OAAO,EAAE;IACnB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACrD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC"}

package/dist/cjs/types.js

@@ -0,0 +1,4 @@
+"use strict";
+// ─── Identity Types ───────────────────────────────────────────────────────────
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/cjs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":";AAAA,iFAAiF"}