@id-wispera/core 0.1.0

package/dist/provisioning/providers/anthropic.js

@@ -0,0 +1,116 @@
+/**
+ * Anthropic Provisioning Provider
+ * Management-only provider: list, update, and disable API keys.
+ * Anthropic does NOT support key creation via API.
+ */
+import { BaseProvisioningProvider } from '../provider.js';
+const ANTHROPIC_BASE_URL = 'https://api.anthropic.com/v1';
+export class AnthropicProvider extends BaseProvisioningProvider {
+    provider = 'anthropic';
+    capabilities = {
+        canCreate: false,
+        canConfigurePermissions: false,
+        canRotate: false,
+        canRevoke: true,
+        canList: true,
+        supportsExpiry: false,
+        supportsScopedKeys: false,
+    };
+    /**
+     * Anthropic does not support key creation via API.
+     * This method always returns an error with guidance.
+     */
+    async provision(request) {
+        this.ensureInitialized();
+        const config = request.config;
+        if (config.provider !== 'anthropic') {
+            return {
+                success: false,
+                error: {
+                    code: 'INVALID_CONFIG',
+                    message: `Expected anthropic config, got ${config.provider}`,
+                },
+            };
+        }
+        return {
+            success: false,
+            error: {
+                code: 'CREATE_NOT_SUPPORTED',
+                message: 'Anthropic does not support API key creation via API. ' +
+                    'Create keys manually at console.anthropic.com, then use this provider to list, ' +
+                    'manage, and disable existing keys.',
+            },
+        };
+    }
+    async list() {
+        this.ensureInitialized();
+        if (this.auth?.type !== 'api-key') {
+            throw new Error('Anthropic provider requires api-key authentication');
+        }
+        const config = this.buildHeaders();
+        const response = await fetch(`${ANTHROPIC_BASE_URL}/api_keys`, {
+            headers: config,
+        });
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`Failed to list Anthropic keys: ${response.status} ${errorBody}`);
+        }
+        const data = await response.json();
+        return (data.data ?? []).map((key) => ({
+            id: key.id,
+            name: key.name,
+            createdAt: new Date(key.created_at),
+            status: key.status,
+        }));
+    }
+    async revoke(keyId) {
+        this.ensureInitialized();
+        if (this.auth?.type !== 'api-key') {
+            return { success: false, error: 'Anthropic provider requires api-key authentication' };
+        }
+        try {
+            const response = await fetch(`${ANTHROPIC_BASE_URL}/api_keys/${keyId}`, {
+                method: 'POST',
+                headers: this.buildHeaders(),
+                body: JSON.stringify({ status: 'disabled' }),
+            });
+            if (!response.ok) {
+                const errorBody = await response.text();
+                return { success: false, error: `Failed to disable key: ${response.status} ${errorBody}` };
+            }
+            return { success: true };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return { success: false, error: message };
+        }
+    }
+    async validateAuth() {
+        this.ensureInitialized();
+        if (this.auth?.type !== 'api-key') {
+            return { valid: false, error: 'Anthropic provider requires api-key authentication' };
+        }
+        try {
+            const response = await fetch(`${ANTHROPIC_BASE_URL}/api_keys?limit=1`, {
+                headers: this.buildHeaders(),
+            });
+            if (response.ok) {
+                return { valid: true };
+            }
+            return { valid: false, error: `Auth validation failed: ${response.status}` };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return { valid: false, error: message };
+        }
+    }
+    buildHeaders() {
+        const auth = this.auth;
+        return {
+            'x-api-key': auth.key,
+            'anthropic-version': '2023-06-01',
+            'Content-Type': 'application/json',
+        };
+    }
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/provisioning/providers/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../../src/provisioning/providers/anthropic.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAoB1D,MAAM,kBAAkB,GAAG,8BAA8B,CAAC;AAE1D,MAAM,OAAO,iBAAkB,SAAQ,wBAAwB;IACpD,QAAQ,GAAyB,WAAW,CAAC;IAE7C,YAAY,GAAyB;QAC5C,SAAS,EAAE,KAAK;QAChB,uBAAuB,EAAE,KAAK;QAC9B,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,KAAK;QACrB,kBAAkB,EAAE,KAAK;KAC1B,CAAC;IAEF;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,OAA4B;QAC1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAyB,CAAC;QACjD,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,kCAAkC,MAAM,CAAC,QAAQ,EAAE;iBAC7D;aACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EACL,uDAAuD;oBACvD,iFAAiF;oBACjF,oCAAoC;aACvC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAEnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,kBAAkB,WAAW,EAAE;YAC7D,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAmC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YACnC,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;QACzF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,kBAAkB,aAAa,KAAK,EAAE,EAAE;gBACtE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;aAC7C,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC;YAC7F,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC;QACvF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,kBAAkB,mBAAmB,EAAE;gBACrE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;aAC7B,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAwC,CAAC;QAC3D,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,GAAG;YACrB,mBAAmB,EAAE,YAAY;YACjC,cAAc,EAAE,kBAAkB;SACnC,CAAC;IACJ,CAAC;CACF"}

package/dist/provisioning/providers/aws.d.ts

@@ -0,0 +1,29 @@
+/**
+ * AWS Provisioning Provider
+ * Creates IAM access keys and STS temporary credentials
+ */
+import { BaseProvisioningProvider } from '../provider.js';
+import { ProvisioningProvider, ProviderCapabilities, ProvisioningRequest, ProvisioningResult, RotationResult } from '../types.js';
+export declare class AWSProvider extends BaseProvisioningProvider {
+    readonly provider: ProvisioningProvider;
+    readonly capabilities: ProviderCapabilities;
+    provision(request: ProvisioningRequest): Promise<ProvisioningResult>;
+    list(): Promise<Array<{
+        id: string;
+        name: string;
+        createdAt: Date;
+        status: string;
+    }>>;
+    rotate(existingKeyId: string, request: ProvisioningRequest): Promise<RotationResult>;
+    revoke(keyId: string): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    validateAuth(): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    private createAccessKey;
+    private assumeRole;
+}
+//# sourceMappingURL=aws.d.ts.map

package/dist/provisioning/providers/aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/provisioning/providers/aws.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EAGf,MAAM,aAAa,CAAC;AA6GrB,qBAAa,WAAY,SAAQ,wBAAwB;IACvD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAS;IAEhD,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAQzC;IAEI,SAAS,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA0CpE,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA2DrF,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAUpF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAyCpE,YAAY,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YAwCnD,eAAe;YAiGf,UAAU;CAuIzB"}

package/dist/provisioning/providers/aws.js

@@ -0,0 +1,455 @@
+/**
+ * AWS Provisioning Provider
+ * Creates IAM access keys and STS temporary credentials
+ */
+import { BaseProvisioningProvider } from '../provider.js';
+/**
+ * AWS SigV4 signing utilities
+ * Implements the essential parts of AWS Signature Version 4 signing process
+ */
+async function hmacSha256(key, message) {
+    const cryptoKey = await crypto.subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    return crypto.subtle.sign('HMAC', cryptoKey, new TextEncoder().encode(message));
+}
+async function sha256(message) {
+    const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(message));
+    return Array.from(new Uint8Array(hash))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+async function getSignatureKey(secretKey, dateStamp, region, service) {
+    const kDate = await hmacSha256(new TextEncoder().encode(`AWS4${secretKey}`).buffer, dateStamp);
+    const kRegion = await hmacSha256(kDate, region);
+    const kService = await hmacSha256(kRegion, service);
+    return hmacSha256(kService, 'aws4_request');
+}
+async function signRequest(params) {
+    const now = new Date();
+    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, '');
+    const dateStamp = amzDate.substring(0, 8);
+    const payloadHash = await sha256(params.body);
+    const canonicalHeaders = `content-type:application/x-www-form-urlencoded\n` +
+        `host:${params.host}\n` +
+        `x-amz-date:${amzDate}\n`;
+    const signedHeadersList = 'content-type;host;x-amz-date';
+    const canonicalRequest = [
+        params.method,
+        params.path,
+        '', // query string (empty for POST)
+        canonicalHeaders,
+        signedHeadersList,
+        payloadHash,
+    ].join('\n');
+    const credentialScope = `${dateStamp}/${params.region}/${params.service}/aws4_request`;
+    const stringToSign = [
+        'AWS4-HMAC-SHA256',
+        amzDate,
+        credentialScope,
+        await sha256(canonicalRequest),
+    ].join('\n');
+    const signingKey = await getSignatureKey(params.secretAccessKey, dateStamp, params.region, params.service);
+    const signatureBuffer = await hmacSha256(signingKey, stringToSign);
+    const signature = Array.from(new Uint8Array(signatureBuffer))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+    const authorization = `AWS4-HMAC-SHA256 ` +
+        `Credential=${params.accessKeyId}/${credentialScope}, ` +
+        `SignedHeaders=${signedHeadersList}, ` +
+        `Signature=${signature}`;
+    return {
+        'Content-Type': 'application/x-www-form-urlencoded',
+        'Host': params.host,
+        'X-Amz-Date': amzDate,
+        'Authorization': authorization,
+    };
+}
+/**
+ * Parse AWS XML response into a simple key-value structure
+ */
+function parseXmlValue(xml, tag) {
+    const regex = new RegExp(`<${tag}>([^<]*)</${tag}>`);
+    const match = regex.exec(xml);
+    return match?.[1];
+}
+export class AWSProvider extends BaseProvisioningProvider {
+    provider = 'aws';
+    capabilities = {
+        canCreate: true,
+        canConfigurePermissions: true,
+        canRotate: true,
+        canRevoke: true,
+        canList: true,
+        supportsExpiry: true, // STS credentials expire
+        supportsScopedKeys: true, // STS supports session policies
+    };
+    async provision(request) {
+        this.ensureInitialized();
+        const config = request.config;
+        if (config.provider !== 'aws') {
+            return {
+                success: false,
+                error: {
+                    code: 'INVALID_CONFIG',
+                    message: `Expected aws config, got ${config.provider}`,
+                },
+            };
+        }
+        if (this.auth?.type !== 'aws-sigv4') {
+            return {
+                success: false,
+                error: {
+                    code: 'INVALID_AUTH',
+                    message: 'AWS provider requires aws-sigv4 authentication',
+                },
+            };
+        }
+        try {
+            if (config.roleArn) {
+                return await this.assumeRole(request, config);
+            }
+            else {
+                return await this.createAccessKey(request, config);
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                success: false,
+                error: {
+                    code: 'PROVISIONING_FAILED',
+                    message: `AWS provisioning failed: ${message}`,
+                },
+            };
+        }
+    }
+    async list() {
+        this.ensureInitialized();
+        if (this.auth?.type !== 'aws-sigv4') {
+            throw new Error('AWS provider requires aws-sigv4 authentication');
+        }
+        const region = this.auth.region ?? 'us-east-1';
+        const body = 'Action=ListAccessKeys&Version=2010-05-08';
+        const host = 'iam.amazonaws.com';
+        const headers = await signRequest({
+            method: 'POST',
+            host,
+            path: '/',
+            body,
+            service: 'iam',
+            region,
+            accessKeyId: this.auth.accessKeyId,
+            secretAccessKey: this.auth.secretAccessKey,
+        });
+        const response = await fetch(`https://${host}/`, {
+            method: 'POST',
+            headers,
+            body,
+        });
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`Failed to list AWS keys: ${response.status} ${errorBody}`);
+        }
+        const xml = await response.text();
+        // Parse AccessKeyMetadata entries from XML
+        const keys = [];
+        const memberRegex = /<member>([\s\S]*?)<\/member>/g;
+        let match;
+        while ((match = memberRegex.exec(xml)) !== null) {
+            const memberXml = match[1] ?? '';
+            const accessKeyId = parseXmlValue(memberXml, 'AccessKeyId');
+            const userName = parseXmlValue(memberXml, 'UserName');
+            const status = parseXmlValue(memberXml, 'Status');
+            const createDate = parseXmlValue(memberXml, 'CreateDate');
+            if (accessKeyId) {
+                keys.push({
+                    id: accessKeyId,
+                    name: userName ?? accessKeyId,
+                    createdAt: createDate ? new Date(createDate) : new Date(),
+                    status: status?.toLowerCase() ?? 'active',
+                });
+            }
+        }
+        return keys;
+    }
+    async rotate(existingKeyId, request) {
+        const newCredential = await this.provision(request);
+        return {
+            newCredential,
+            oldKeyId: existingKeyId,
+            recommendedRevocationDelay: 300, // 5 minutes for AWS propagation
+        };
+    }
+    async revoke(keyId) {
+        this.ensureInitialized();
+        if (this.auth?.type !== 'aws-sigv4') {
+            return { success: false, error: 'AWS provider requires aws-sigv4 authentication' };
+        }
+        try {
+            const region = this.auth.region ?? 'us-east-1';
+            const body = `Action=DeleteAccessKey&AccessKeyId=${encodeURIComponent(keyId)}&Version=2010-05-08`;
+            const host = 'iam.amazonaws.com';
+            const headers = await signRequest({
+                method: 'POST',
+                host,
+                path: '/',
+                body,
+                service: 'iam',
+                region,
+                accessKeyId: this.auth.accessKeyId,
+                secretAccessKey: this.auth.secretAccessKey,
+            });
+            const response = await fetch(`https://${host}/`, {
+                method: 'POST',
+                headers,
+                body,
+            });
+            if (!response.ok) {
+                const errorBody = await response.text();
+                return { success: false, error: `Failed to delete key: ${response.status} ${errorBody}` };
+            }
+            return { success: true };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return { success: false, error: message };
+        }
+    }
+    async validateAuth() {
+        this.ensureInitialized();
+        if (this.auth?.type !== 'aws-sigv4') {
+            return { valid: false, error: 'AWS provider requires aws-sigv4 authentication' };
+        }
+        try {
+            const region = this.auth.region ?? 'us-east-1';
+            const body = 'Action=GetCallerIdentity&Version=2011-06-15';
+            const host = 'sts.amazonaws.com';
+            const headers = await signRequest({
+                method: 'POST',
+                host,
+                path: '/',
+                body,
+                service: 'sts',
+                region,
+                accessKeyId: this.auth.accessKeyId,
+                secretAccessKey: this.auth.secretAccessKey,
+            });
+            const response = await fetch(`https://${host}/`, {
+                method: 'POST',
+                headers,
+                body,
+            });
+            if (response.ok) {
+                return { valid: true };
+            }
+            return { valid: false, error: `Auth validation failed: ${response.status}` };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return { valid: false, error: message };
+        }
+    }
+    async createAccessKey(request, config) {
+        const auth = this.auth;
+        const region = auth.region ?? 'us-east-1';
+        let body = 'Action=CreateAccessKey&Version=2010-05-08';
+        if (config.userName) {
+            body += `&UserName=${encodeURIComponent(config.userName)}`;
+        }
+        const host = 'iam.amazonaws.com';
+        const headers = await signRequest({
+            method: 'POST',
+            host,
+            path: '/',
+            body,
+            service: 'iam',
+            region,
+            accessKeyId: auth.accessKeyId,
+            secretAccessKey: auth.secretAccessKey,
+        });
+        const response = await fetch(`https://${host}/`, {
+            method: 'POST',
+            headers,
+            body,
+        });
+        if (!response.ok) {
+            const errorBody = await response.text();
+            const errorMessage = parseXmlValue(errorBody, 'Message') ?? `HTTP ${response.status}`;
+            const errorCode = parseXmlValue(errorBody, 'Code') ?? `AWS_${response.status}`;
+            return {
+                success: false,
+                error: {
+                    code: errorCode,
+                    message: errorMessage,
+                    details: errorBody,
+                },
+            };
+        }
+        const xml = await response.text();
+        const accessKeyId = parseXmlValue(xml, 'AccessKeyId');
+        const secretAccessKey = parseXmlValue(xml, 'SecretAccessKey');
+        const userName = parseXmlValue(xml, 'UserName');
+        if (!accessKeyId || !secretAccessKey) {
+            return {
+                success: false,
+                error: {
+                    code: 'PARSE_ERROR',
+                    message: 'Failed to parse access key from AWS response',
+                },
+            };
+        }
+        const now = new Date().toISOString();
+        const hasElevated = !config.userName; // Root-level keys are elevated
+        return {
+            success: true,
+            credentialValue: accessKeyId,
+            secondaryValue: secretAccessKey,
+            providerKeyId: accessKeyId,
+            metadata: {
+                userName: userName ?? config.userName,
+                keyType: 'long-lived',
+            },
+            passportInput: {
+                name: request.name,
+                credentialType: 'api-key',
+                credentialValue: `${accessKeyId}:${secretAccessKey}`,
+                visaType: this.mapToVisaType('aws', hasElevated),
+                issuingAuthority: 'AWS IAM',
+                platforms: [this.mapToPlatform('aws')],
+                scope: ['iam'],
+                validFrom: now,
+                humanOwner: request.humanOwner,
+                agentId: request.agentId,
+                delegationChain: request.delegationChain ?? [
+                    {
+                        from: request.humanOwner,
+                        to: request.agentId ?? request.name,
+                        grantedAt: now,
+                        scope: ['iam'],
+                        notes: `Provisioned via AWS IAM CreateAccessKey${config.userName ? ` (user: ${config.userName})` : ''}`,
+                    },
+                ],
+                tags: [...(request.tags ?? []), 'provisioned', 'aws', 'iam', 'long-lived'],
+                notes: request.notes ?? `AWS IAM access key${config.userName ? ` for user ${config.userName}` : ''}`,
+            },
+        };
+    }
+    async assumeRole(request, config) {
+        const auth = this.auth;
+        const region = auth.region ?? 'us-east-1';
+        const permissions = request.permissions;
+        if (!config.roleArn) {
+            return {
+                success: false,
+                error: {
+                    code: 'MISSING_ROLE_ARN',
+                    message: 'roleArn is required for STS AssumeRole',
+                },
+            };
+        }
+        const sessionName = config.sessionName ?? 'id-wispera-session';
+        const durationSeconds = config.durationSeconds ?? 3600;
+        let body = `Action=AssumeRole&Version=2011-06-15` +
+            `&RoleArn=${encodeURIComponent(config.roleArn)}` +
+            `&RoleSessionName=${encodeURIComponent(sessionName)}` +
+            `&DurationSeconds=${durationSeconds}`;
+        if (config.externalId) {
+            body += `&ExternalId=${encodeURIComponent(config.externalId)}`;
+        }
+        if (permissions?.sessionPolicy) {
+            body += `&Policy=${encodeURIComponent(permissions.sessionPolicy)}`;
+        }
+        if (permissions?.policyArns) {
+            permissions.policyArns.forEach((arn, index) => {
+                body += `&PolicyArns.member.${index + 1}.arn=${encodeURIComponent(arn)}`;
+            });
+        }
+        const host = 'sts.amazonaws.com';
+        const headers = await signRequest({
+            method: 'POST',
+            host,
+            path: '/',
+            body,
+            service: 'sts',
+            region,
+            accessKeyId: auth.accessKeyId,
+            secretAccessKey: auth.secretAccessKey,
+        });
+        const response = await fetch(`https://${host}/`, {
+            method: 'POST',
+            headers,
+            body,
+        });
+        if (!response.ok) {
+            const errorBody = await response.text();
+            const errorMessage = parseXmlValue(errorBody, 'Message') ?? `HTTP ${response.status}`;
+            const errorCode = parseXmlValue(errorBody, 'Code') ?? `AWS_${response.status}`;
+            return {
+                success: false,
+                error: {
+                    code: errorCode,
+                    message: errorMessage,
+                    details: errorBody,
+                },
+            };
+        }
+        const xml = await response.text();
+        const accessKeyId = parseXmlValue(xml, 'AccessKeyId');
+        const secretAccessKey = parseXmlValue(xml, 'SecretAccessKey');
+        const sessionToken = parseXmlValue(xml, 'SessionToken');
+        const expiration = parseXmlValue(xml, 'Expiration');
+        if (!accessKeyId || !secretAccessKey || !sessionToken) {
+            return {
+                success: false,
+                error: {
+                    code: 'PARSE_ERROR',
+                    message: 'Failed to parse STS credentials from AWS response',
+                },
+            };
+        }
+        const now = new Date().toISOString();
+        const expiresAt = expiration ? new Date(expiration) : new Date(Date.now() + durationSeconds * 1000);
+        const hasElevated = !permissions?.sessionPolicy; // Unrestricted sessions are elevated
+        // Determine scope from role/policies
+        const scope = permissions?.sessionPolicy ? ['scoped-session'] : ['full-session'];
+        return {
+            success: true,
+            credentialValue: accessKeyId,
+            secondaryValue: `${secretAccessKey}:${sessionToken}`,
+            providerKeyId: accessKeyId,
+            metadata: {
+                roleArn: config.roleArn,
+                sessionName,
+                sessionToken,
+                keyType: 'temporary',
+                durationSeconds,
+            },
+            expiresAt,
+            passportInput: {
+                name: request.name,
+                credentialType: 'api-key',
+                credentialValue: `${accessKeyId}:${secretAccessKey}:${sessionToken}`,
+                visaType: this.mapToVisaType('aws', hasElevated),
+                issuingAuthority: 'AWS STS',
+                platforms: [this.mapToPlatform('aws')],
+                scope,
+                validFrom: now,
+                validUntil: expiresAt.toISOString(),
+                humanOwner: request.humanOwner,
+                agentId: request.agentId,
+                delegationChain: request.delegationChain ?? [
+                    {
+                        from: request.humanOwner,
+                        to: request.agentId ?? request.name,
+                        grantedAt: now,
+                        scope,
+                        expiresAt: expiresAt.toISOString(),
+                        notes: `Provisioned via AWS STS AssumeRole (role: ${config.roleArn})`,
+                    },
+                ],
+                tags: [...(request.tags ?? []), 'provisioned', 'aws', 'sts', 'temporary'],
+                notes: request.notes ?? `AWS STS temporary credentials for role ${config.roleArn} (expires: ${expiresAt.toISOString()})`,
+            },
+        };
+    }
+}
+//# sourceMappingURL=aws.js.map

package/dist/provisioning/providers/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/provisioning/providers/aws.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAW1D;;;GAGG;AAEH,KAAK,UAAU,UAAU,CAAC,GAAgB,EAAE,OAAe;IACzD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,KAAK,EACL,GAAG,EACH,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAAe;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,SAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,OAAe;IAEf,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC,MAAqB,EAAE,SAAS,CAAC,CAAC;IAC9G,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAMD,KAAK,UAAU,WAAW,CAAC,MAS1B;IACC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE1C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,gBAAgB,GACpB,kDAAkD;QAClD,QAAQ,MAAM,CAAC,IAAI,IAAI;QACvB,cAAc,OAAO,IAAI,CAAC;IAC5B,MAAM,iBAAiB,GAAG,8BAA8B,CAAC;IAEzD,MAAM,gBAAgB,GAAG;QACvB,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI;QACX,EAAE,EAAE,gCAAgC;QACpC,gBAAgB;QAChB,iBAAiB;QACjB,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,eAAe,CAAC;IACvF,MAAM,YAAY,GAAG;QACnB,kBAAkB;QAClB,OAAO;QACP,eAAe;QACf,MAAM,MAAM,CAAC,gBAAgB,CAAC;KAC/B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3G,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,MAAM,aAAa,GACjB,mBAAmB;QACnB,cAAc,MAAM,CAAC,WAAW,IAAI,eAAe,IAAI;QACvD,iBAAiB,iBAAiB,IAAI;QACtC,aAAa,SAAS,EAAE,CAAC;IAE3B,OAAO;QACL,cAAc,EAAE,mCAAmC;QACnD,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,YAAY,EAAE,OAAO;QACrB,eAAe,EAAE,aAAa;KAC/B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,GAAW;IAC7C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,aAAa,GAAG,GAAG,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,wBAAwB;IAC9C,QAAQ,GAAyB,KAAK,CAAC;IAEvC,YAAY,GAAyB;QAC5C,SAAS,EAAE,IAAI;QACf,uBAAuB,EAAE,IAAI;QAC7B,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,IAAI,EAAE,yBAAyB;QAC/C,kBAAkB,EAAE,IAAI,EAAE,gCAAgC;KAC3D,CAAC;IAEF,KAAK,CAAC,SAAS,CAAC,OAA4B;QAC1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAmB,CAAC;QAC3C,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,4BAA4B,MAAM,CAAC,QAAQ,EAAE;iBACvD;aACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,gDAAgD;iBAC1D;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,4BAA4B,OAAO,EAAE;iBAC/C;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAC/C,MAAM,IAAI,GAAG,0CAA0C,CAAC;QACxD,MAAM,IAAI,GAAG,mBAAmB,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,IAAI,EAAE,GAAG;YACT,IAAI;YACJ,OAAO,EAAE,KAAK;YACd,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;SAC3C,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,GAAG,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAElC,2CAA2C;QAC3C,MAAM,IAAI,GAAyE,EAAE,CAAC;QACtF,MAAM,WAAW,GAAG,+BAA+B,CAAC;QACpD,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC5D,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAE1D,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,IAAI,CAAC;oBACR,EAAE,EAAE,WAAW;oBACf,IAAI,EAAE,QAAQ,IAAI,WAAW;oBAC7B,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE;oBACzD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,QAAQ;iBAC1C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAqB,EAAE,OAA4B;QAC9D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEpD,OAAO;YACL,aAAa;YACb,QAAQ,EAAE,aAAa;YACvB,0BAA0B,EAAE,GAAG,EAAE,gCAAgC;SAClE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;QACrF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;YAC/C,MAAM,IAAI,GAAG,sCAAsC,kBAAkB,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAClG,MAAM,IAAI,GAAG,mBAAmB,CAAC;YAEjC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;gBAClC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;aAC3C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,GAAG,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;aACL,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC;YAC5F,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC;QACnF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;YAC/C,MAAM,IAAI,GAAG,6CAA6C,CAAC;YAC3D,MAAM,IAAI,GAAG,mBAAmB,CAAC;YAEjC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;gBAChC,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;gBAClC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;aAC3C,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,GAAG,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI;aACL,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,OAA4B,EAC5B,MAAiB;QAEjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAA4F,CAAC;QAC/G,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAE1C,IAAI,IAAI,GAAG,2CAA2C,CAAC;QACvD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,IAAI,aAAa,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,IAAI,EAAE,GAAG;YACT,IAAI;YACJ,OAAO,EAAE,KAAK;YACd,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,GAAG,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC/E,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,YAAY;oBACrB,OAAO,EAAE,SAAS;iBACnB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACtD,MAAM,eAAe,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAEhD,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,8CAA8C;iBACxD;aACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,+BAA+B;QAErE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,WAAW;YAC5B,cAAc,EAAE,eAAe;YAC/B,aAAa,EAAE,WAAW;YAC1B,QAAQ,EAAE;gBACR,QAAQ,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ;gBACrC,OAAO,EAAE,YAAY;aACtB;YACD,aAAa,EAAE;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,cAAc,EAAE,SAAS;gBACzB,eAAe,EAAE,GAAG,WAAW,IAAI,eAAe,EAAE;gBACpD,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC;gBAChD,gBAAgB,EAAE,SAAS;gBAC3B,SAAS,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACtC,KAAK,EAAE,CAAC,KAAK,CAAC;gBACd,SAAS,EAAE,GAAG;gBACd,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI;oBAC1C;wBACE,IAAI,EAAE,OAAO,CAAC,UAAU;wBACxB,EAAE,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI;wBACnC,SAAS,EAAE,GAAG;wBACd,KAAK,EAAE,CAAC,KAAK,CAAC;wBACd,KAAK,EAAE,0CAA0C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;qBACxG;iBACF;gBACD,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC;gBAC1E,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,qBAAqB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aACrG;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,OAA4B,EAC5B,MAAiB;QAEjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAA4F,CAAC;QAC/G,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAyC,CAAC;QAEtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,wCAAwC;iBAClD;aACF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC;QAEvD,IAAI,IAAI,GAAG,sCAAsC;YAC/C,YAAY,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;YAChD,oBAAoB,kBAAkB,CAAC,WAAW,CAAC,EAAE;YACrD,oBAAoB,eAAe,EAAE,CAAC;QAExC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,IAAI,IAAI,eAAe,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,CAAC;QAED,IAAI,WAAW,EAAE,aAAa,EAAE,CAAC;YAC/B,IAAI,IAAI,WAAW,kBAAkB,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,WAAW,EAAE,UAAU,EAAE,CAAC;YAC5B,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;gBAC5C,IAAI,IAAI,sBAAsB,KAAK,GAAG,CAAC,QAAQ,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,mBAAmB,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,IAAI,EAAE,GAAG;YACT,IAAI;YACJ,OAAO,EAAE,KAAK;YACd,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;SACtC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,GAAG,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,YAAY,GAAG,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YACtF,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC/E,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,YAAY;oBACrB,OAAO,EAAE,SAAS;iBACnB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QACtD,MAAM,eAAe,GAAG,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAEpD,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,IAAI,CAAC,YAAY,EAAE,CAAC;YACtD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,aAAa;oBACnB,OAAO,EAAE,mDAAmD;iBAC7D;aACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,IAAI,CAAC,CAAC;QACpG,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,qCAAqC;QAEtF,qCAAqC;QACrC,MAAM,KAAK,GAAG,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAEjF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,WAAW;YAC5B,cAAc,EAAE,GAAG,eAAe,IAAI,YAAY,EAAE;YACpD,aAAa,EAAE,WAAW;YAC1B,QAAQ,EAAE;gBACR,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,WAAW;gBACX,YAAY;gBACZ,OAAO,EAAE,WAAW;gBACpB,eAAe;aAChB;YACD,SAAS;YACT,aAAa,EAAE;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,cAAc,EAAE,SAAS;gBACzB,eAAe,EAAE,GAAG,WAAW,IAAI,eAAe,IAAI,YAAY,EAAE;gBACpE,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC;gBAChD,gBAAgB,EAAE,SAAS;gBAC3B,SAAS,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACtC,KAAK;gBACL,SAAS,EAAE,GAAG;gBACd,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE;gBACnC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI;oBAC1C;wBACE,IAAI,EAAE,OAAO,CAAC,UAAU;wBACxB,EAAE,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI;wBACnC,SAAS,EAAE,GAAG;wBACd,KAAK;wBACL,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;wBAClC,KAAK,EAAE,6CAA6C,MAAM,CAAC,OAAO,GAAG;qBACtE;iBACF;gBACD,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;gBACzE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,0CAA0C,MAAM,CAAC,OAAO,cAAc,SAAS,CAAC,WAAW,EAAE,GAAG;aACzH;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/provisioning/providers/azure-entra.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Azure Entra (formerly Azure AD) Provisioning Provider
+ * Creates app registrations and client secrets via Microsoft Graph API.
+ */
+import { BaseProvisioningProvider } from '../provider.js';
+import { ProvisioningProvider, ProviderCapabilities, ProvisioningRequest, ProvisioningResult, RotationResult } from '../types.js';
+export declare class AzureEntraProvider extends BaseProvisioningProvider {
+    readonly provider: ProvisioningProvider;
+    readonly capabilities: ProviderCapabilities;
+    private accessToken?;
+    provision(request: ProvisioningRequest): Promise<ProvisioningResult>;
+    list(): Promise<Array<{
+        id: string;
+        name: string;
+        createdAt: Date;
+        status: string;
+    }>>;
+    rotate(existingKeyId: string, request: ProvisioningRequest): Promise<RotationResult>;
+    revoke(keyId: string): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    validateAuth(): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    private ensureAccessToken;
+    private createAppAndSecret;
+    private addSecretToApp;
+    private addPasswordToApplication;
+}
+//# sourceMappingURL=azure-entra.d.ts.map