@id-wispera/core 0.1.0

package/dist/provisioning/providers/azure-entra.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-entra.d.ts","sourceRoot":"","sources":["../../../src/provisioning/providers/azure-entra.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EAGf,MAAM,aAAa,CAAC;AAsCrB,qBAAa,kBAAmB,SAAQ,wBAAwB;IAC9D,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAiB;IAExD,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAQzC;IAEF,OAAO,CAAC,WAAW,CAAC,CAAS;IAEvB,SAAS,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA4CpE,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAkCrF,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAUpF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA4CpE,YAAY,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YAqBnD,iBAAiB;YA0BjB,kBAAkB;YA4ClB,cAAc;YAqCd,wBAAwB;CAmFvC"}

package/dist/provisioning/providers/azure-entra.js

@@ -0,0 +1,312 @@
+/**
+ * Azure Entra (formerly Azure AD) Provisioning Provider
+ * Creates app registrations and client secrets via Microsoft Graph API.
+ */
+import { BaseProvisioningProvider } from '../provider.js';
+const GRAPH_URL = 'https://graph.microsoft.com/v1.0';
+export class AzureEntraProvider extends BaseProvisioningProvider {
+    provider = 'azure-entra';
+    capabilities = {
+        canCreate: true,
+        canConfigurePermissions: true,
+        canRotate: true,
+        canRevoke: true,
+        canList: true,
+        supportsExpiry: true,
+        supportsScopedKeys: true,
+    };
+    accessToken;
+    async provision(request) {
+        this.ensureInitialized();
+        const config = request.config;
+        if (config.provider !== 'azure-entra') {
+            return {
+                success: false,
+                error: {
+                    code: 'INVALID_CONFIG',
+                    message: `Expected azure-entra config, got ${config.provider}`,
+                },
+            };
+        }
+        if (this.auth?.type !== 'oauth2') {
+            return {
+                success: false,
+                error: {
+                    code: 'INVALID_AUTH',
+                    message: 'Azure Entra provider requires oauth2 authentication (clientId + clientSecret + tenantId)',
+                },
+            };
+        }
+        try {
+            await this.ensureAccessToken(config.tenantId);
+            if (config.mode === 'create-app') {
+                return await this.createAppAndSecret(request, config);
+            }
+            else {
+                return await this.addSecretToApp(request, config);
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                success: false,
+                error: {
+                    code: 'PROVISIONING_FAILED',
+                    message: `Azure Entra provisioning failed: ${message}`,
+                },
+            };
+        }
+    }
+    async list() {
+        this.ensureInitialized();
+        if (this.auth?.type !== 'oauth2') {
+            throw new Error('Azure Entra provider requires oauth2 authentication');
+        }
+        const tenantId = this.auth.tenantId;
+        if (!tenantId) {
+            throw new Error('tenantId is required for Azure Entra operations');
+        }
+        await this.ensureAccessToken(tenantId);
+        const response = await fetch(`${GRAPH_URL}/applications?$select=id,displayName,createdDateTime`, {
+            headers: {
+                'Authorization': `Bearer ${this.accessToken}`,
+            },
+        });
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`Failed to list Azure Entra apps: ${response.status} ${errorBody}`);
+        }
+        const data = await response.json();
+        return (data.value ?? []).map((app) => ({
+            id: app.id,
+            name: app.displayName,
+            createdAt: new Date(app.createdDateTime),
+            status: 'active',
+        }));
+    }
+    async rotate(existingKeyId, request) {
+        const newCredential = await this.provision(request);
+        return {
+            newCredential,
+            oldKeyId: existingKeyId,
+            recommendedRevocationDelay: 120, // 2 minutes for Azure AD propagation
+        };
+    }
+    async revoke(keyId) {
+        this.ensureInitialized();
+        if (this.auth?.type !== 'oauth2') {
+            return { success: false, error: 'Azure Entra provider requires oauth2 authentication' };
+        }
+        const tenantId = this.auth.tenantId;
+        if (!tenantId) {
+            return { success: false, error: 'tenantId is required for Azure Entra operations' };
+        }
+        try {
+            await this.ensureAccessToken(tenantId);
+            // keyId format: "applicationId:keyId"
+            const parts = keyId.split(':');
+            if (parts.length !== 2) {
+                return { success: false, error: 'keyId must be in format "applicationId:keyId"' };
+            }
+            const [applicationId, passwordKeyId] = parts;
+            const response = await fetch(`${GRAPH_URL}/applications/${applicationId}/removePassword`, {
+                method: 'POST',
+                headers: {
+                    'Authorization': `Bearer ${this.accessToken}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({ keyId: passwordKeyId }),
+            });
+            if (!response.ok) {
+                const errorBody = await response.text();
+                return { success: false, error: `Failed to revoke: ${response.status} ${errorBody}` };
+            }
+            return { success: true };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return { success: false, error: message };
+        }
+    }
+    async validateAuth() {
+        this.ensureInitialized();
+        if (this.auth?.type !== 'oauth2') {
+            return { valid: false, error: 'Azure Entra provider requires oauth2 authentication' };
+        }
+        try {
+            const tenantId = this.auth.tenantId;
+            if (!tenantId) {
+                return { valid: false, error: 'tenantId is required for Azure Entra operations' };
+            }
+            await this.ensureAccessToken(tenantId);
+            return { valid: true };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return { valid: false, error: message };
+        }
+    }
+    async ensureAccessToken(tenantId) {
+        if (this.accessToken)
+            return;
+        const auth = this.auth;
+        const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`;
+        const response = await fetch(tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'client_credentials',
+                client_id: auth.clientId,
+                client_secret: auth.clientSecret,
+                scope: 'https://graph.microsoft.com/.default',
+            }).toString(),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Failed to obtain Azure Entra access token: ${response.status} ${error}`);
+        }
+        const data = await response.json();
+        this.accessToken = data.access_token;
+    }
+    async createAppAndSecret(request, config) {
+        if (!config.displayName) {
+            return {
+                success: false,
+                error: {
+                    code: 'MISSING_DISPLAY_NAME',
+                    message: 'displayName is required for create-app mode',
+                },
+            };
+        }
+        // Step 1: Create the application registration
+        const appResponse = await fetch(`${GRAPH_URL}/applications`, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${this.accessToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                displayName: config.displayName,
+            }),
+        });
+        if (!appResponse.ok) {
+            const errorBody = await appResponse.json().catch(() => ({}));
+            return {
+                success: false,
+                error: {
+                    code: `AZURE_${errorBody.error?.code ?? appResponse.status}`,
+                    message: errorBody.error?.message ?? `HTTP ${appResponse.status}`,
+                    details: errorBody,
+                },
+            };
+        }
+        const app = await appResponse.json();
+        // Step 2: Add a client secret to the new application
+        return this.addPasswordToApplication(request, config, app.id, app.appId);
+    }
+    async addSecretToApp(request, config) {
+        if (!config.applicationId) {
+            return {
+                success: false,
+                error: {
+                    code: 'MISSING_APPLICATION_ID',
+                    message: 'applicationId is required for add-secret mode',
+                },
+            };
+        }
+        // Get the app's client ID
+        const appResponse = await fetch(`${GRAPH_URL}/applications/${config.applicationId}?$select=appId`, {
+            headers: {
+                'Authorization': `Bearer ${this.accessToken}`,
+            },
+        });
+        if (!appResponse.ok) {
+            const errorBody = await appResponse.json().catch(() => ({}));
+            return {
+                success: false,
+                error: {
+                    code: `AZURE_${errorBody.error?.code ?? appResponse.status}`,
+                    message: errorBody.error?.message ?? `HTTP ${appResponse.status}`,
+                    details: errorBody,
+                },
+            };
+        }
+        const app = await appResponse.json();
+        return this.addPasswordToApplication(request, config, config.applicationId, app.appId);
+    }
+    async addPasswordToApplication(request, config, applicationObjectId, applicationClientId) {
+        const expiryDays = config.secretExpiryDays ?? 365;
+        const endDateTime = new Date();
+        endDateTime.setDate(endDateTime.getDate() + expiryDays);
+        const response = await fetch(`${GRAPH_URL}/applications/${applicationObjectId}/addPassword`, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${this.accessToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                passwordCredential: {
+                    displayName: request.name,
+                    endDateTime: endDateTime.toISOString(),
+                },
+            }),
+        });
+        if (!response.ok) {
+            const errorBody = await response.json().catch(() => ({}));
+            return {
+                success: false,
+                error: {
+                    code: `AZURE_${errorBody.error?.code ?? response.status}`,
+                    message: errorBody.error?.message ?? `HTTP ${response.status}`,
+                    details: errorBody,
+                },
+            };
+        }
+        const secret = await response.json();
+        const now = new Date().toISOString();
+        const permissions = request.permissions;
+        const hasElevated = (permissions?.graphPermissions?.length ?? 0) > 5 ||
+            (permissions?.rbacRoles?.length ?? 0) > 0;
+        return {
+            success: true,
+            credentialValue: secret.secretText,
+            providerKeyId: `${applicationObjectId}:${secret.keyId}`,
+            metadata: {
+                applicationObjectId,
+                applicationClientId,
+                tenantId: config.tenantId,
+                keyId: secret.keyId,
+                displayName: secret.displayName,
+                hint: secret.hint,
+                mode: config.mode,
+            },
+            expiresAt: new Date(secret.endDateTime),
+            passportInput: {
+                name: request.name,
+                credentialType: 'secret',
+                credentialValue: secret.secretText,
+                visaType: this.mapToVisaType('azure-entra', hasElevated),
+                issuingAuthority: 'Azure Entra',
+                platforms: [this.mapToPlatform('azure-entra')],
+                scope: permissions?.graphPermissions ?? ['User.Read'],
+                validFrom: secret.startDateTime ?? now,
+                validUntil: secret.endDateTime,
+                humanOwner: request.humanOwner,
+                agentId: request.agentId,
+                delegationChain: request.delegationChain ?? [
+                    {
+                        from: request.humanOwner,
+                        to: request.agentId ?? request.name,
+                        grantedAt: now,
+                        scope: permissions?.graphPermissions ?? ['User.Read'],
+                        expiresAt: secret.endDateTime,
+                        notes: `Provisioned via Azure Entra (tenant: ${config.tenantId}, app: ${applicationClientId})`,
+                    },
+                ],
+                tags: [...(request.tags ?? []), 'provisioned', 'azure-entra', config.mode],
+                notes: request.notes ?? `Azure Entra client secret for app ${applicationClientId} (tenant: ${config.tenantId})`,
+            },
+        };
+    }
+}
+//# sourceMappingURL=azure-entra.js.map

package/dist/provisioning/providers/azure-entra.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-entra.js","sourceRoot":"","sources":["../../../src/provisioning/providers/azure-entra.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AA6C1D,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD,MAAM,OAAO,kBAAmB,SAAQ,wBAAwB;IACrD,QAAQ,GAAyB,aAAa,CAAC;IAE/C,YAAY,GAAyB;QAC5C,SAAS,EAAE,IAAI;QACf,uBAAuB,EAAE,IAAI;QAC7B,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,IAAI;QACpB,kBAAkB,EAAE,IAAI;KACzB,CAAC;IAEM,WAAW,CAAU;IAE7B,KAAK,CAAC,SAAS,CAAC,OAA4B;QAC1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAA0B,CAAC;QAClD,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACtC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,oCAAoC,MAAM,CAAC,QAAQ,EAAE;iBAC/D;aACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,0FAA0F;iBACpG;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAE9C,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,oCAAoC,OAAO,EAAE;iBACvD;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEvC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,sDAAsD,EAAE;YAC/F,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC9C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA2C,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtC,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,WAAW;YACrB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;YACxC,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAqB,EAAE,OAA4B;QAC9D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEpD,OAAO;YACL,aAAa;YACb,QAAQ,EAAE,aAAa;YACvB,0BAA0B,EAAE,GAAG,EAAE,qCAAqC;SACvE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;QACtF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAEvC,sCAAsC;YACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;YACpF,CAAC;YAED,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC;YAE7C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,iBAAiB,aAAa,iBAAiB,EAAE;gBACxF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,eAAe,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;oBAC7C,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;aAC/C,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,CAAC;YACxF,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;QACxF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAC;YACpF,CAAC;YAED,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACvC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,QAAgB;QAC9C,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAqF,CAAC;QACxG,MAAM,QAAQ,GAAG,qCAAqC,QAAQ,oBAAoB,CAAC;QAEnF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;gBAChC,KAAK,EAAE,sCAAsC;aAC9C,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA8B,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,OAA4B,EAC5B,MAAwB;QAExB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,6CAA6C;iBACvD;aACF,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,eAAe,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;gBAC7C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAuB,CAAC;YACnF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE;oBAC5D,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,WAAW,CAAC,MAAM,EAAE;oBACjE,OAAO,EAAE,SAAS;iBACnB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAA8B,CAAC;QAEjE,qDAAqD;QACrD,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,OAA4B,EAC5B,MAAwB;QAExB,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,+CAA+C;iBACzD;aACF,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,iBAAiB,MAAM,CAAC,aAAa,gBAAgB,EAAE;YACjG,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC9C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAuB,CAAC;YACnF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE;oBAC5D,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,WAAW,CAAC,MAAM,EAAE;oBACjE,OAAO,EAAE,SAAS;iBACnB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAuB,CAAC;QAC1D,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,OAA4B,EAC5B,MAAwB,EACxB,mBAA2B,EAC3B,mBAA2B;QAE3B,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC;QAClD,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,WAAW,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,iBAAiB,mBAAmB,cAAc,EAAE;YAC3F,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;gBAC7C,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,kBAAkB,EAAE;oBAClB,WAAW,EAAE,OAAO,CAAC,IAAI;oBACzB,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;iBACvC;aACF,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAuB,CAAC;YAChF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE;oBACzD,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE;oBAC9D,OAAO,EAAE,SAAS;iBACnB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA6B,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAgD,CAAC;QAC7E,MAAM,WAAW,GAAG,CAAC,WAAW,EAAE,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;YAClE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAE5C,OAAO;YACL,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,MAAM,CAAC,UAAU;YAClC,aAAa,EAAE,GAAG,mBAAmB,IAAI,MAAM,CAAC,KAAK,EAAE;YACvD,QAAQ,EAAE;gBACR,mBAAmB;gBACnB,mBAAmB;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;YACD,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YACvC,aAAa,EAAE;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,cAAc,EAAE,QAAQ;gBACxB,eAAe,EAAE,MAAM,CAAC,UAAU;gBAClC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,WAAW,CAAC;gBACxD,gBAAgB,EAAE,aAAa;gBAC/B,SAAS,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;gBAC9C,KAAK,EAAE,WAAW,EAAE,gBAAgB,IAAI,CAAC,WAAW,CAAC;gBACrD,SAAS,EAAE,MAAM,CAAC,aAAa,IAAI,GAAG;gBACtC,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI;oBAC1C;wBACE,IAAI,EAAE,OAAO,CAAC,UAAU;wBACxB,EAAE,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI;wBACnC,SAAS,EAAE,GAAG;wBACd,KAAK,EAAE,WAAW,EAAE,gBAAgB,IAAI,CAAC,WAAW,CAAC;wBACrD,SAAS,EAAE,MAAM,CAAC,WAAW;wBAC7B,KAAK,EAAE,wCAAwC,MAAM,CAAC,QAAQ,UAAU,mBAAmB,GAAG;qBAC/F;iBACF;gBACD,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC;gBAC1E,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,qCAAqC,mBAAmB,aAAa,MAAM,CAAC,QAAQ,GAAG;aAChH;SACF,CAAC;IACJ,CAAC;CACF"}

package/dist/provisioning/providers/github.d.ts

@@ -0,0 +1,24 @@
+/**
+ * GitHub Provisioning Provider
+ * Creates installation access tokens via the GitHub App API.
+ * Requires a GitHub App private key for JWT-based authentication.
+ */
+import { BaseProvisioningProvider } from '../provider.js';
+import { ProvisioningProvider, ProviderCapabilities, ProvisioningRequest, ProvisioningResult, RotationResult } from '../types.js';
+export declare class GitHubProvider extends BaseProvisioningProvider {
+    readonly provider: ProvisioningProvider;
+    readonly capabilities: ProviderCapabilities;
+    provision(request: ProvisioningRequest): Promise<ProvisioningResult>;
+    rotate(existingKeyId: string, request: ProvisioningRequest): Promise<RotationResult>;
+    validateAuth(): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    /**
+     * Create a JWT for GitHub App authentication.
+     * The JWT is signed with the App's private key and is valid for 10 minutes.
+     */
+    private createAppJWT;
+    private createInstallationToken;
+}
+//# sourceMappingURL=github.d.ts.map

package/dist/provisioning/providers/github.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.d.ts","sourceRoot":"","sources":["../../../src/provisioning/providers/github.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EAGf,MAAM,aAAa,CAAC;AAuBrB,qBAAa,cAAe,SAAQ,wBAAwB;IAC1D,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAY;IAEnD,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAQzC;IAEI,SAAS,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAuCpE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAWpF,YAAY,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA6BjE;;;OAGG;YACW,YAAY;YAkCZ,uBAAuB;CAyFtC"}

package/dist/provisioning/providers/github.js

@@ -0,0 +1,219 @@
+/**
+ * GitHub Provisioning Provider
+ * Creates installation access tokens via the GitHub App API.
+ * Requires a GitHub App private key for JWT-based authentication.
+ */
+import { BaseProvisioningProvider } from '../provider.js';
+const GITHUB_API_URL = 'https://api.github.com';
+export class GitHubProvider extends BaseProvisioningProvider {
+    provider = 'github';
+    capabilities = {
+        canCreate: true,
+        canConfigurePermissions: true,
+        canRotate: true,
+        canRevoke: false, // Installation tokens expire naturally, no revocation API
+        canList: false, // No API to list installation tokens
+        supportsExpiry: true, // Tokens expire in 1 hour
+        supportsScopedKeys: true, // Fine-grained permissions
+    };
+    async provision(request) {
+        this.ensureInitialized();
+        const config = request.config;
+        if (config.provider !== 'github') {
+            return {
+                success: false,
+                error: {
+                    code: 'INVALID_CONFIG',
+                    message: `Expected github config, got ${config.provider}`,
+                },
+            };
+        }
+        if (this.auth?.type !== 'jwt') {
+            return {
+                success: false,
+                error: {
+                    code: 'INVALID_AUTH',
+                    message: 'GitHub provider requires jwt authentication (App private key + App ID)',
+                },
+            };
+        }
+        try {
+            const jwt = await this.createAppJWT();
+            return await this.createInstallationToken(request, config, jwt);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                success: false,
+                error: {
+                    code: 'PROVISIONING_FAILED',
+                    message: `GitHub provisioning failed: ${message}`,
+                },
+            };
+        }
+    }
+    async rotate(existingKeyId, request) {
+        // GitHub installation tokens can't be revoked, just create a new one
+        const newCredential = await this.provision(request);
+        return {
+            newCredential,
+            oldKeyId: existingKeyId,
+            recommendedRevocationDelay: 0, // Old token will expire naturally within 1 hour
+        };
+    }
+    async validateAuth() {
+        this.ensureInitialized();
+        if (this.auth?.type !== 'jwt') {
+            return { valid: false, error: 'GitHub provider requires jwt authentication' };
+        }
+        try {
+            const jwt = await this.createAppJWT();
+            const response = await fetch(`${GITHUB_API_URL}/app`, {
+                headers: {
+                    'Authorization': `Bearer ${jwt}`,
+                    'Accept': 'application/vnd.github+json',
+                    'X-GitHub-Api-Version': '2022-11-28',
+                },
+            });
+            if (response.ok) {
+                return { valid: true };
+            }
+            return { valid: false, error: `Auth validation failed: ${response.status}` };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return { valid: false, error: message };
+        }
+    }
+    /**
+     * Create a JWT for GitHub App authentication.
+     * The JWT is signed with the App's private key and is valid for 10 minutes.
+     */
+    async createAppJWT() {
+        const auth = this.auth;
+        const now = Math.floor(Date.now() / 1000);
+        const header = base64UrlEncode(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));
+        const payload = base64UrlEncode(JSON.stringify({
+            iat: now - 60, // Issued 60 seconds in the past for clock drift
+            exp: now + 600, // Expires in 10 minutes (GitHub max)
+            iss: auth.appId,
+        }));
+        const signInput = `${header}.${payload}`;
+        // Import the PEM private key and sign
+        const pemKey = auth.privateKey;
+        const binaryDer = pemToArrayBuffer(pemKey);
+        const cryptoKey = await crypto.subtle.importKey('pkcs8', binaryDer, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign']);
+        const signature = await crypto.subtle.sign('RSASSA-PKCS1-v1_5', cryptoKey, new TextEncoder().encode(signInput));
+        const sig = arrayBufferToBase64Url(signature);
+        return `${signInput}.${sig}`;
+    }
+    async createInstallationToken(request, config, jwt) {
+        const permissions = request.permissions;
+        const body = {};
+        // Scope to specific repositories if specified
+        if (config.repositoryIds?.length) {
+            body.repository_ids = config.repositoryIds;
+        }
+        else if (config.repositories?.length) {
+            body.repositories = config.repositories;
+        }
+        // Set fine-grained permissions
+        if (permissions?.permissions) {
+            body.permissions = permissions.permissions;
+        }
+        const url = `${GITHUB_API_URL}/app/installations/${config.installationId}/access_tokens`;
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Authorization': `Bearer ${jwt}`,
+                'Accept': 'application/vnd.github+json',
+                'X-GitHub-Api-Version': '2022-11-28',
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            const errorBody = await response.json().catch(() => ({}));
+            return {
+                success: false,
+                error: {
+                    code: `GITHUB_${response.status}`,
+                    message: errorBody.message ?? `HTTP ${response.status}`,
+                    details: errorBody,
+                },
+            };
+        }
+        const data = await response.json();
+        const now = new Date().toISOString();
+        const expiresAt = new Date(data.expires_at);
+        const grantedPermissions = Object.keys(data.permissions ?? {});
+        return {
+            success: true,
+            credentialValue: data.token,
+            providerKeyId: `ghs_${config.installationId}_${Date.now()}`,
+            metadata: {
+                installationId: config.installationId,
+                permissions: data.permissions,
+                repositorySelection: data.repository_selection,
+                repositories: data.repositories?.map((r) => r.full_name),
+            },
+            expiresAt,
+            passportInput: {
+                name: request.name,
+                credentialType: 'jwt',
+                credentialValue: data.token,
+                visaType: this.mapToVisaType('github', false),
+                issuingAuthority: 'GitHub',
+                platforms: [this.mapToPlatform('github')],
+                scope: grantedPermissions.length > 0 ? grantedPermissions : ['metadata:read'],
+                validFrom: now,
+                validUntil: expiresAt.toISOString(),
+                humanOwner: request.humanOwner,
+                agentId: request.agentId,
+                delegationChain: request.delegationChain ?? [
+                    {
+                        from: request.humanOwner,
+                        to: request.agentId ?? request.name,
+                        grantedAt: now,
+                        scope: grantedPermissions.length > 0 ? grantedPermissions : ['metadata:read'],
+                        expiresAt: expiresAt.toISOString(),
+                        notes: `Provisioned via GitHub App (installation: ${config.installationId})`,
+                    },
+                ],
+                tags: [...(request.tags ?? []), 'provisioned', 'github', 'installation-token'],
+                notes: request.notes ?? `GitHub installation access token (expires: ${expiresAt.toISOString()})`,
+            },
+        };
+    }
+}
+/**
+ * Convert a PEM-encoded key to an ArrayBuffer
+ */
+function pemToArrayBuffer(pem) {
+    const lines = pem.split('\n').filter((line) => !line.startsWith('-----'));
+    const base64 = lines.join('');
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+}
+/**
+ * Base64url encode a string
+ */
+function base64UrlEncode(str) {
+    return btoa(str).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * Convert an ArrayBuffer to base64url encoding
+ */
+function arrayBufferToBase64Url(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+//# sourceMappingURL=github.js.map

package/dist/provisioning/providers/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/provisioning/providers/github.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AA8B1D,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAEhD,MAAM,OAAO,cAAe,SAAQ,wBAAwB;IACjD,QAAQ,GAAyB,QAAQ,CAAC;IAE1C,YAAY,GAAyB;QAC5C,SAAS,EAAE,IAAI;QACf,uBAAuB,EAAE,IAAI;QAC7B,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,KAAK,EAAE,0DAA0D;QAC5E,OAAO,EAAE,KAAK,EAAI,qCAAqC;QACvD,cAAc,EAAE,IAAI,EAAG,0BAA0B;QACjD,kBAAkB,EAAE,IAAI,EAAE,2BAA2B;KACtD,CAAC;IAEF,KAAK,CAAC,SAAS,CAAC,OAA4B;QAC1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAsB,CAAC;QAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,+BAA+B,MAAM,CAAC,QAAQ,EAAE;iBAC1D;aACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,wEAAwE;iBAClF;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,OAAO,EAAE,+BAA+B,OAAO,EAAE;iBAClD;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,aAAqB,EAAE,OAA4B;QAC9D,qEAAqE;QACrE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAEpD,OAAO;YACL,aAAa;YACb,QAAQ,EAAE,aAAa;YACvB,0BAA0B,EAAE,CAAC,EAAE,gDAAgD;SAChF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC;QAChF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAEtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,MAAM,EAAE;gBACpD,OAAO,EAAE;oBACP,eAAe,EAAE,UAAU,GAAG,EAAE;oBAChC,QAAQ,EAAE,6BAA6B;oBACvC,sBAAsB,EAAE,YAAY;iBACrC;aACF,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0D,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;YAC7C,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,gDAAgD;YAC/D,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,qCAAqC;YACrD,GAAG,EAAE,IAAI,CAAC,KAAK;SAChB,CAAC,CAAC,CAAC;QAEJ,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;QAEzC,sCAAsC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAC/B,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC7C,OAAO,EACP,SAAS,EACT,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,mBAAmB,EACnB,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CAAC;QAEF,MAAM,GAAG,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,GAAG,SAAS,IAAI,GAAG,EAAE,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,OAA4B,EAC5B,MAAoB,EACpB,GAAW;QAEX,MAAM,WAAW,GAAG,OAAO,CAAC,WAA4C,CAAC;QAEzE,MAAM,IAAI,GAA4B,EAAE,CAAC;QAEzC,8CAA8C;QAC9C,IAAI,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QAC7C,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC1C,CAAC;QAED,+BAA+B;QAC/B,IAAI,WAAW,EAAE,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;QAC7C,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,cAAc,sBAAsB,MAAM,CAAC,cAAc,gBAAgB,CAAC;QAEzF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,UAAU,GAAG,EAAE;gBAChC,QAAQ,EAAE,6BAA6B;gBACvC,sBAAsB,EAAE,YAAY;gBACpC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAwB,CAAC;YACjF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,UAAU,QAAQ,CAAC,MAAM,EAAE;oBACjC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE;oBACvD,OAAO,EAAE,SAAS;iBACnB;aACF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAE/D,OAAO;YACL,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,IAAI,CAAC,KAAK;YAC3B,aAAa,EAAE,OAAO,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE;YAC3D,QAAQ,EAAE;gBACR,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,mBAAmB,EAAE,IAAI,CAAC,oBAAoB;gBAC9C,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;aACzD;YACD,SAAS;YACT,aAAa,EAAE;gBACb,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,cAAc,EAAE,KAAK;gBACrB,eAAe,EAAE,IAAI,CAAC,KAAK;gBAC3B,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC;gBAC7C,gBAAgB,EAAE,QAAQ;gBAC1B,SAAS,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBACzC,KAAK,EAAE,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC7E,SAAS,EAAE,GAAG;gBACd,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE;gBACnC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI;oBAC1C;wBACE,IAAI,EAAE,OAAO,CAAC,UAAU;wBACxB,EAAE,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI;wBACnC,SAAS,EAAE,GAAG;wBACd,KAAK,EAAE,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;wBAC7E,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;wBAClC,KAAK,EAAE,6CAA6C,MAAM,CAAC,cAAc,GAAG;qBAC7E;iBACF;gBACD,IAAI,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,aAAa,EAAE,QAAQ,EAAE,oBAAoB,CAAC;gBAC9E,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,8CAA8C,SAAS,CAAC,WAAW,EAAE,GAAG;aACjG;SACF,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,MAAqB,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,MAAmB;IACjD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/provisioning/providers/google-cloud.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Google Cloud Provisioning Provider
+ * Creates API keys and service account keys via Google Cloud APIs.
+ * Supports OAuth2 client credentials and service account authentication.
+ */
+import { BaseProvisioningProvider } from '../provider.js';
+import { ProvisioningProvider, ProviderCapabilities, ProvisioningRequest, ProvisioningResult, RotationResult } from '../types.js';
+export declare class GoogleCloudProvider extends BaseProvisioningProvider {
+    readonly provider: ProvisioningProvider;
+    readonly capabilities: ProviderCapabilities;
+    private accessToken?;
+    provision(request: ProvisioningRequest): Promise<ProvisioningResult>;
+    list(): Promise<Array<{
+        id: string;
+        name: string;
+        createdAt: Date;
+        status: string;
+    }>>;
+    rotate(existingKeyId: string, request: ProvisioningRequest): Promise<RotationResult>;
+    revoke(keyId: string): Promise<{
+        success: boolean;
+        error?: string;
+    }>;
+    validateAuth(): Promise<{
+        valid: boolean;
+        error?: string;
+    }>;
+    private ensureAccessToken;
+    private getOAuth2Token;
+    private getServiceAccountToken;
+    private createApiKey;
+    private createServiceAccountKey;
+}
+//# sourceMappingURL=google-cloud.d.ts.map

package/dist/provisioning/providers/google-cloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-cloud.d.ts","sourceRoot":"","sources":["../../../src/provisioning/providers/google-cloud.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EAGf,MAAM,aAAa,CAAC;AAwCrB,qBAAa,mBAAoB,SAAQ,wBAAwB;IAC/D,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAkB;IAEzD,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAQzC;IAEF,OAAO,CAAC,WAAW,CAAC,CAAS;IAEvB,SAAS,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkCpE,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IA0BrF,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAUpF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA0BpE,YAAY,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YAYnD,iBAAiB;YAYjB,cAAc;YAuBd,sBAAsB;YAkDtB,YAAY;YAsFZ,uBAAuB;CAyFtC"}