natureco-cli 5.18.3 → 5.20.0

package/skills/email-service/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: email-service
+description: Build email services with templates, sending, tracking, and bounce handling
+category: Software Development
+---
+
+# Email Service
+
+## Overview
+Build email services with templates, sending, tracking, and bounce handling. This skill helps you apply structured, repeatable methods for consistent results.
+
+## When to Use
+- When you need to apply email service best practices
+- When establishing processes or standards for your workflow
+- When training team members on email service
+- When automating or optimizing email service tasks
+
+## Instructions
+1. **Assess**: Evaluate the current state, requirements, and constraints
+2. **Plan**: Define the approach, steps, and success criteria
+3. **Execute**: Follow the established patterns and best practices
+4. **Verify**: Check results against expected outcomes and quality standards
+5. **Iterate**: Refine based on feedback and lessons learned
+
+## Examples
+```
+User: Help me apply email service for my current project
+Assistant: I'll help you apply email service step by step...
+```
+
+## Related Skills
+- Use with `workflow` tool for orchestrated execution
+- Combine with `task` tool for delegated processing
+- Reference `system-prompt` for system-level integration

package/skills/embedding-generation/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: embedding-generation
+description: Generate and optimize embeddings for text, images, and multimodal content
+category: AI Agents
+---
+
+# Embedding Generation
+
+## Overview
+Generate and optimize embeddings for text, images, and multimodal content. This skill helps you apply structured, repeatable methods for consistent results.
+
+## When to Use
+- When you need to apply embedding generation best practices
+- When establishing processes or standards for your workflow
+- When training team members on embedding generation
+- When automating or optimizing embedding generation tasks
+
+## Instructions
+1. **Assess**: Evaluate the current state, requirements, and constraints
+2. **Plan**: Define the approach, steps, and success criteria
+3. **Execute**: Follow the established patterns and best practices
+4. **Verify**: Check results against expected outcomes and quality standards
+5. **Iterate**: Refine based on feedback and lessons learned
+
+## Examples
+```
+User: Help me apply embedding generation for my current project
+Assistant: I'll help you apply embedding generation step by step...
+```
+
+## Related Skills
+- Use with `workflow` tool for orchestrated execution
+- Combine with `task` tool for delegated processing
+- Reference `system-prompt` for system-level integration

package/skills/entity-extraction/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: entity-extraction
+description: Extract entities from text with NER, regex patterns, and LLM-based extraction
+category: AI Agents
+---
+
+# Entity Extraction
+
+## Overview
+Extract entities from text with NER, regex patterns, and LLM-based extraction. This skill helps you apply structured, repeatable methods for consistent results.
+
+## When to Use
+- When you need to apply entity extraction best practices
+- When establishing processes or standards for your workflow
+- When training team members on entity extraction
+- When automating or optimizing entity extraction tasks
+
+## Instructions
+1. **Assess**: Evaluate the current state, requirements, and constraints
+2. **Plan**: Define the approach, steps, and success criteria
+3. **Execute**: Follow the established patterns and best practices
+4. **Verify**: Check results against expected outcomes and quality standards
+5. **Iterate**: Refine based on feedback and lessons learned
+
+## Examples
+```
+User: Help me apply entity extraction for my current project
+Assistant: I'll help you apply entity extraction step by step...
+```
+
+## Related Skills
+- Use with `workflow` tool for orchestrated execution
+- Combine with `task` tool for delegated processing
+- Reference `system-prompt` for system-level integration

package/skills/entra-agent-id/SKILL.md

@@ -0,0 +1,356 @@
+---
+name: entra-agent-id
+description: "Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmi_path, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmi_path token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Azure RBAC (use azure-rbac), Microsoft Foundry agent authoring (use microsoft-foundry)."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.0.1"
+---
+
+# Microsoft Entra Agent ID
+
+Create and manage OAuth 2.0-capable identities for AI agents using Microsoft Graph. Every agent instance gets a distinct identity, audit trail, and independently-scoped permission grants.
+
+## Quick Reference
+
+| Property | Value |
+|----------|-------|
+| Service | Microsoft Entra Agent ID |
+| API | Microsoft Graph (`https://graph.microsoft.com/v1.0`) |
+| Required role | Agent Identity Developer, Agent Identity Administrator, or Application Administrator |
+| Object model | Blueprint (application) → BlueprintPrincipal (SP) → Agent Identity (SP) |
+| Runtime exchange | Two-step `fmi_path` exchange (autonomous and OBO) |
+| .NET helper | `Microsoft.Identity.Web.AgentIdentities` |
+| Polyglot helper | Microsoft Entra SDK for AgentID (sidecar container) |
+
+## When to Use This Skill
+
+- Provisioning a new Agent Identity Blueprint and BlueprintPrincipal
+- Creating per-instance Agent Identities under a Blueprint
+- Configuring credentials (FIC, Managed Identity, or client secret) on the Blueprint
+- Implementing the two-step `fmi_path` runtime token exchange (autonomous or OBO)
+- Cross-tenant agent token flows
+- Deploying the Microsoft Entra SDK for AgentID sidecar for polyglot agents (Python, Node, Go, Java)
+- Granting per-Agent-Identity application (`appRoleAssignments`) or delegated (`oauth2PermissionGrants`) permissions
+- Diagnosing Agent ID errors such as `AADSTS82001`, `AADSTS700211`, or `PropertyNotCompatibleWithAgentIdentity`
+
+## MCP Tools
+
+| Tool | Use |
+|------|-----|
+| `mcp_azure_mcp_documentation` | Search Microsoft Learn for current Agent ID setup, Graph API shapes, and SDK configuration |
+
+There is no dedicated Agent Identity MCP server today. This skill guides direct Microsoft Graph API calls (PowerShell or Python `requests`). Use `mcp_azure_mcp_documentation` to verify request bodies and endpoints against current docs before running.
+
+## Before You Start
+
+Use the `mcp_azure_mcp_documentation` tool to search Microsoft Learn for current Agent ID documentation:
+- "Microsoft Entra Agent ID setup instructions"
+- "Microsoft Entra SDK for AgentID"
+
+Verify request bodies and endpoints against the installed SDK version — Graph API shapes evolve.
+
+## Conceptual Model
+
+```
+Agent Identity Blueprint (application)         ← one per agent type/project
+  └── BlueprintPrincipal (service principal)    ← MUST be created explicitly
+        ├── Agent Identity (SP): agent-1        ← one per agent instance
+        ├── Agent Identity (SP): agent-2
+        └── Agent Identity (SP): agent-3
+```
+
+| Concept | Description |
+|---------|-------------|
+| **Blueprint** | Application object that defines a type/class of agent. Holds credentials (secret, certificate, federated identity). |
+| **BlueprintPrincipal** | Service principal for the Blueprint in the tenant. Not auto-created. |
+| **Agent Identity** | Service-principal-only identity for a single agent instance. Cannot hold its own credentials. |
+| **Sponsor** | A User (or Group, for Agent Identity) who is responsible for the identity. Required on creation. |
+
+## Prerequisites
+
+### Required Entra Roles
+
+One of: **Agent Identity Developer**, **Agent Identity Administrator**, or **Application Administrator**.
+
+### PowerShell (interactive setup)
+
+```powershell
+# PowerShell 7+
+Install-Module Microsoft.Graph.Applications -Scope CurrentUser -Force
+```
+
+### Python (programmatic provisioning)
+
+```bash
+pip install azure-identity requests
+```
+
+## Authentication
+
+> **`DefaultAzureCredential` is not supported.** Azure CLI tokens carry `Directory.AccessAsUser.All`, which Agent Identity APIs hard-reject (403). Use a dedicated app registration with `client_credentials`, or `Connect-MgGraph` with explicit delegated scopes.
+
+### PowerShell (delegated)
+
+```powershell
+Connect-MgGraph -Scopes @(
+    "AgentIdentityBlueprint.Create",
+    "AgentIdentityBlueprint.ReadWrite.All",
+    "AgentIdentityBlueprintPrincipal.Create",
+    "AgentIdentity.Create.All",
+    "User.Read"
+)
+```
+
+### Python (application)
+
+```python
+import os, requests
+from azure.identity import ClientSecretCredential
+
+credential = ClientSecretCredential(
+    tenant_id=os.environ["AZURE_TENANT_ID"],
+    client_id=os.environ["AZURE_CLIENT_ID"],
+    client_secret=os.environ["AZURE_CLIENT_SECRET"],
+)
+token = credential.get_token("https://graph.microsoft.com/.default")
+
+GRAPH = "https://graph.microsoft.com/v1.0"
+headers = {
+    "Authorization": f"Bearer {token.token}",
+    "Content-Type": "application/json",
+    "OData-Version": "4.0",
+}
+```
+
+## Core Workflow
+
+### Step 1: Create Agent Identity Blueprint
+
+Use the typed endpoint. Sponsors must be **Users** at Blueprint creation. This snippet assumes the `requests` client and `headers` dict from the Python authentication block above.
+
+```python
+import subprocess
+import requests
+
+user_id = subprocess.run(
+    ["az", "ad", "signed-in-user", "show", "--query", "id", "-o", "tsv"],
+    capture_output=True, text=True, check=True,
+).stdout.strip()
+
+blueprint_body = {
+    "displayName": "My Agent Blueprint",
+    "sponsors@odata.bind": [
+        f"https://graph.microsoft.com/v1.0/users/{user_id}"
+    ],
+}
+resp = requests.post(
+    f"{GRAPH}/applications/microsoft.graph.agentIdentityBlueprint",
+    headers=headers, json=blueprint_body,
+)
+resp.raise_for_status()
+
+blueprint = resp.json()
+app_id = blueprint["appId"]
+blueprint_obj_id = blueprint["id"]
+```
+
+### Step 2: Create BlueprintPrincipal
+
+> Mandatory. Creating a Blueprint does NOT auto-create its service principal. Skipping this step produces:
+> `400: The Agent Blueprint Principal for the Agent Blueprint does not exist.`
+
+```python
+sp_body = {"appId": app_id}
+resp = requests.post(
+    f"{GRAPH}/servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal",
+    headers=headers, json=sp_body,
+)
+resp.raise_for_status()
+```
+
+Make your provisioning scripts idempotent — always check for the BlueprintPrincipal even when the Blueprint already exists.
+
+### Step 3: Create Agent Identities
+
+Sponsors for an Agent Identity may be **Users or Groups**.
+
+```python
+agent_body = {
+    "displayName": "my-agent-instance-1",
+    "agentIdentityBlueprintId": app_id,
+    "sponsors@odata.bind": [
+        f"https://graph.microsoft.com/v1.0/users/{user_id}"
+    ],
+}
+resp = requests.post(
+    f"{GRAPH}/servicePrincipals/microsoft.graph.agentIdentity",
+    headers=headers, json=agent_body,
+)
+resp.raise_for_status()
+agent = resp.json()
+agent_sp_id = agent["id"]
+```
+
+## Runtime Authentication
+
+Agents authenticate at runtime using credentials configured on the **Blueprint** (not on the Agent Identity — Agent Identities can't hold credentials).
+
+| Option | Use case | Credential on Blueprint |
+|--------|----------|------------------------|
+| **Managed Identity + WIF** | Production (Azure-hosted) | Federated Identity Credential |
+| **Client secret** | Local dev / testing | Password credential |
+| **Microsoft Entra SDK for AgentID** | Polyglot / 3P agents | Sidecar container acquires tokens over HTTP |
+
+For the two-step `fmi_path` exchange (parent token → per-Agent-Identity Graph token) that gives each agent instance a distinct `sub` claim and audit trail, see [references/runtime-token-exchange.md](references/runtime-token-exchange.md).
+
+For OBO (agent acting on behalf of a user), see [references/obo-blueprint-setup.md](references/obo-blueprint-setup.md).
+
+For the containerized polyglot auth sidecar (Python, Node, Go, Java — no SDK embedding), see [references/sdk-sidecar.md](references/sdk-sidecar.md).
+
+For MI+WIF and client-secret setup details, see [references/oauth2-token-flow.md](references/oauth2-token-flow.md).
+
+### .NET quick path
+
+For .NET services, use **`Microsoft.Identity.Web.AgentIdentities`** — it handles Federated Identity Credential management and the two-step exchange for you. See the package README at `github.com/AzureAD/microsoft-identity-web` under `src/Microsoft.Identity.Web.AgentIdentities/`.
+
+## Granting Permissions (Per Agent Identity)
+
+Agent Identities support both application permissions (autonomous) and delegated permissions (OBO). Grants are scoped **per Agent Identity**, not to the BlueprintPrincipal.
+
+### Application permissions (autonomous)
+
+```python
+graph_sp = requests.get(
+    f"{GRAPH}/servicePrincipals?$filter=appId eq '00000003-0000-0000-c000-000000000000'",
+    headers=headers,
+).json()["value"][0]
+
+user_read_all = next(r for r in graph_sp["appRoles"] if r["value"] == "User.Read.All")
+
+requests.post(
+    f"{GRAPH}/servicePrincipals/{agent_sp_id}/appRoleAssignments",
+    headers=headers,
+    json={
+        "principalId": agent_sp_id,
+        "resourceId": graph_sp["id"],
+        "appRoleId": user_read_all["id"],
+    },
+).raise_for_status()
+```
+
+### Delegated permissions (OBO)
+
+```python
+from datetime import datetime, timedelta, timezone
+
+expiry = (datetime.now(timezone.utc) + timedelta(days=3650)).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+requests.post(
+    f"{GRAPH}/oauth2PermissionGrants",
+    headers=headers,
+    json={
+        "clientId": agent_sp_id,
+        "consentType": "AllPrincipals",
+        "resourceId": graph_sp["id"],
+        "scope": "User.Read Tasks.ReadWrite Mail.Send",
+        "expiryTime": expiry,
+    },
+).raise_for_status()
+```
+
+Browser-based admin consent URLs do not work for Agent Identities — use `oauth2PermissionGrants` for programmatic delegated consent.
+
+## Cross-Tenant Agent Identities
+
+Blueprints can be multi-tenant (`signInAudience: AzureADMultipleOrgs`). When exchanging tokens cross-tenant:
+
+> **Step 1 of the parent token exchange MUST target the Agent Identity's home tenant**, not the Blueprint's. Wrong tenant → `AADSTS700211: No matching federated identity record found`.
+
+See [references/runtime-token-exchange.md](references/runtime-token-exchange.md) for full cross-tenant examples.
+
+## API Reference
+
+| Operation | Method | Endpoint |
+|-----------|--------|----------|
+| Create Blueprint | `POST` | `/applications/microsoft.graph.agentIdentityBlueprint` |
+| Create BlueprintPrincipal | `POST` | `/servicePrincipals/microsoft.graph.agentIdentityBlueprintPrincipal` |
+| Create Agent Identity | `POST` | `/servicePrincipals/microsoft.graph.agentIdentity` |
+| Add FIC to Blueprint | `POST` | `/applications/{id}/microsoft.graph.agentIdentityBlueprint/federatedIdentityCredentials` |
+| List Agent Identities | `GET` | `/servicePrincipals/microsoft.graph.agentIdentity` |
+| Grant app permission | `POST` | `/servicePrincipals/{id}/appRoleAssignments` |
+| Grant delegated permission | `POST` | `/oauth2PermissionGrants` |
+| Delete Agent Identity | `DELETE` | `/servicePrincipals/{id}` |
+| Delete Blueprint | `DELETE` | `/applications/{id}` |
+
+Base URL: `https://graph.microsoft.com/v1.0`.
+
+## Required Graph Permissions
+
+| Permission | Purpose |
+|-----------|---------|
+| `AgentIdentityBlueprint.Create` | Create Blueprints |
+| `AgentIdentityBlueprint.ReadWrite.All` | Read/update Blueprints |
+| `AgentIdentityBlueprintPrincipal.Create` | Create BlueprintPrincipals |
+| `AgentIdentity.Create.All` | Create Agent Identities |
+| `AgentIdentity.ReadWrite.All` | Read/update Agent Identities |
+| `Application.ReadWrite.All` | Blueprint CRUD on application objects |
+| `AppRoleAssignment.ReadWrite.All` | Grant application permissions |
+| `DelegatedPermissionGrant.ReadWrite.All` | Grant delegated permissions |
+
+Grant admin consent (required for application permissions):
+
+```bash
+az ad app permission admin-consent --id <client-id>
+```
+
+After admin consent, tokens may not include new claims for 30–120 seconds — retry with exponential backoff.
+
+## Best Practices
+
+1. **Always create BlueprintPrincipal after Blueprint** — not auto-created.
+2. **Use typed endpoints** (`/applications/microsoft.graph.agentIdentityBlueprint`) instead of raw `/applications` with `@odata.type`.
+3. **Credentials live on the Blueprint** — Agent Identities can't hold secrets/certs (`PropertyNotCompatibleWithAgentIdentity`).
+4. **Include `OData-Version: 4.0`** on every Graph request.
+5. **Use Workload Identity Federation for production** — client secrets only for local dev.
+6. **Set `identifierUris: ["api://{appId}"]` on the Blueprint** before OAuth2 scope resolution.
+7. **Never use Azure CLI tokens** for Agent Identity APIs — `Directory.AccessAsUser.All` causes hard 403.
+8. **Use `fmi_path`** with `client_credentials` — NOT RFC 8693 `urn:ietf:params:oauth:grant-type:token-exchange` (returns `AADSTS82001`).
+9. **Always use `/.default` scope** in both steps of the exchange — individual scopes fail.
+10. **Step 1 targets the Agent Identity's home tenant** in cross-tenant flows.
+11. **Grant permissions per Agent Identity**, not to the BlueprintPrincipal.
+12. **Handle permission-propagation delays** — retry 403s with 30–120s backoff after admin consent.
+13. **Keep the Entra SDK for AgentID on localhost** — never expose via LoadBalancer or Ingress.
+
+## Troubleshooting
+
+| Error | Cause | Fix |
+|-------|-------|-----|
+| `AADSTS82001` | Used RFC 8693 token-exchange grant | Use `client_credentials` with `fmi_path` |
+| `AADSTS700211` | Step 1 parent token targeted wrong tenant | Target Agent Identity's home tenant |
+| `AADSTS50013` | OBO user token targets Graph, not Blueprint | Use `api://{blueprint_app_id}/access_as_user` |
+| `AADSTS65001` | Missing grant or used individual scopes | Use `/.default` and verify `oauth2PermissionGrants` |
+| `403 Authorization_RequestDenied` | No grant on this Agent Identity | Add via `appRoleAssignments` or `oauth2PermissionGrants` |
+| `PropertyNotCompatibleWithAgentIdentity` | Tried to add credential to Agent Identity SP | Put credentials on the Blueprint |
+| `Agent Blueprint Principal does not exist` | BlueprintPrincipal not created | Step 2 of the Core Workflow |
+| `AADSTS650051` on admin consent | SP already exists from partial consent | Grant directly via `appRoleAssignments` |
+
+## References
+
+| File | Contents |
+|------|----------|
+| [references/runtime-token-exchange.md](references/runtime-token-exchange.md) | Two-step `fmi_path` exchange: autonomous + OBO, cross-tenant |
+| [references/oauth2-token-flow.md](references/oauth2-token-flow.md) | MI + WIF (production) and client secret (local dev) |
+| [references/obo-blueprint-setup.md](references/obo-blueprint-setup.md) | Configuring the Blueprint as an OAuth2 API for OBO |
+| [references/sdk-sidecar.md](references/sdk-sidecar.md) | Microsoft Entra SDK for AgentID — architecture, configuration, endpoints |
+| [references/sdk-sidecar-deployment.md](references/sdk-sidecar-deployment.md) | SDK code patterns (Python/TypeScript), Docker/Kubernetes manifests, security, troubleshooting |
+| [references/known-limitations.md](references/known-limitations.md) | Documented gaps organized by category |
+
+### External Links
+
+| Resource | URL |
+|----------|-----|
+| Agent ID Setup Guide | https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/agent-id-setup-instructions |
+| AI-Guided Setup | https://learn.microsoft.com/en-us/entra/agent-id/identity-platform/agent-id-ai-guided-setup |
+| Microsoft Entra SDK for AgentID | https://learn.microsoft.com/en-us/entra/msidweb/agent-id-sdk/overview |
+| Microsoft.Identity.Web.AgentIdentities (.NET) | https://github.com/AzureAD/microsoft-identity-web/blob/master/src/Microsoft.Identity.Web.AgentIdentities/README.AgentIdentities.md |

package/skills/entra-app-registration/SKILL.md

@@ -0,0 +1,191 @@
+---
+name: entra-app-registration
+description: "Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Azure RBAC or role assignments (use azure-rbac), Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance."
+license: MIT
+metadata:
+  author: Microsoft
+  version: "1.1.1"
+---
+
+## Overview
+
+Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. App registrations allow applications to authenticate users and access Azure resources securely.
+
+### Key Concepts
+
+| Concept | Description |
+|---------|-------------|
+| **App Registration** | Configuration that allows an app to use Microsoft identity platform |
+| **Application (Client) ID** | Unique identifier for your application |
+| **Tenant ID** | Unique identifier for your Azure AD tenant/directory |
+| **Client Secret** | Password for the application (confidential clients only) |
+| **Redirect URI** | URL where authentication responses are sent |
+| **API Permissions** | Access scopes your app requests |
+| **Service Principal** | Identity created in your tenant when you register an app |
+
+### Application Types
+
+| Type | Use Case |
+|------|----------|
+| **Web Application** | Server-side apps, APIs |
+| **Single Page App (SPA)** | JavaScript/React/Angular apps |
+| **Mobile/Native App** | Desktop, mobile apps |
+| **Daemon/Service** | Background services, APIs |
+
+## Core Workflow
+
+### Step 1: Register the Application
+
+Create an app registration in the Azure portal or using Azure CLI.
+
+**Portal Method:**
+1. Navigate to Azure Portal → Microsoft Entra ID → App registrations
+2. Click "New registration"
+3. Provide name, supported account types, and redirect URI
+4. Click "Register"
+
+**CLI Method:** See [references/cli-commands.md](references/cli-commands.md)
+**IaC Method:** See [references/BICEP-EXAMPLE.bicep](references/BICEP-EXAMPLE.bicep)
+
+It's highly recommended to use the IaC to manage Entra app registration if you already use IaC in your project, need a scalable solution for managing lots of app registrations or need fine-grained audit history of the configuration changes. 
+
+### Step 2: Configure Authentication
+
+Set up authentication settings based on your application type.
+
+- **Web Apps**: Add redirect URIs, enable ID tokens if needed
+- **SPAs**: Add redirect URIs, enable implicit grant flow if necessary
+- **Mobile/Desktop**: Use `http://localhost` or custom URI scheme
+- **Services**: No redirect URI needed for client credentials flow
+
+### Step 3: Configure API Permissions
+
+Grant your application permission to access Microsoft APIs or your own APIs.
+
+**Common Microsoft Graph Permissions:**
+- `User.Read` - Read user profile
+- `User.ReadWrite.All` - Read and write all users
+- `Directory.Read.All` - Read directory data
+- `Mail.Send` - Send mail as a user
+
+**Details:** See [references/api-permissions.md](references/api-permissions.md)
+
+### Step 4: Create Client Credentials (if needed)
+
+For confidential client applications (web apps, services), create a client secret, certificate or federated identity credential.
+
+**Client Secret:**
+- Navigate to "Certificates & secrets"
+- Create new client secret
+- Copy the value immediately (only shown once)
+- Store securely (Key Vault recommended)
+
+**Certificate:** For production environments, use certificates instead of secrets for enhanced security. Upload certificate via "Certificates & secrets" section.
+
+**Federated Identity Credential:** For dynamically authenticating the confidential client to Entra platform.
+
+### Step 5: Implement OAuth Flow
+
+Integrate the OAuth flow into your application code.
+
+**See:**
+- [references/oauth-flows.md](references/oauth-flows.md) - OAuth 2.0 flow details
+- [references/console-app-example.md](references/console-app-example.md) - Console app implementation
+
+## Common Patterns
+
+### Pattern 1: First-Time App Registration
+
+Walk user through their first app registration step-by-step.
+
+**Required Information:**
+- Application name
+- Application type (web, SPA, mobile, service)
+- Redirect URIs (if applicable)
+- Required permissions
+
+**Script:** See [references/first-app-registration.md](references/first-app-registration.md)
+
+### Pattern 2: Console Application with User Authentication
+
+Create a .NET/Python/Node.js console app that authenticates users.
+
+**Required Information:**
+- Programming language (C#, Python, JavaScript, etc.)
+- Authentication library (MSAL recommended)
+- Required permissions
+
+**Example:** See [references/console-app-example.md](references/console-app-example.md)
+
+### Pattern 3: Service-to-Service Authentication
+
+Set up daemon/service authentication without user interaction.
+
+**Required Information:**
+- Service/app name
+- Target API/resource
+- Whether to use secret or certificate
+
+**Implementation:** Use Client Credentials flow (see [references/oauth-flows.md#client-credentials-flow](references/oauth-flows.md#client-credentials-flow))
+
+## MCP Tools and CLI
+
+### Azure CLI Commands
+
+| Command | Purpose |
+|---------|---------|
+| `az ad app create` | Create new app registration |
+| `az ad app list` | List app registrations |
+| `az ad app show` | Show app details |
+| `az ad app permission add` | Add API permission |
+| `az ad app credential reset` | Generate new client secret |
+| `az ad sp create` | Create service principal |
+
+**Complete reference:** See [references/cli-commands.md](references/cli-commands.md)
+
+### Microsoft Authentication Library (MSAL)
+
+MSAL is the recommended library for integrating Microsoft identity platform.
+
+**Supported Languages:**
+- .NET/C# - `Microsoft.Identity.Client`
+- JavaScript/TypeScript - `@azure/msal-browser`, `@azure/msal-node`
+- Python - `msal`
+
+**Examples:** See [references/console-app-example.md](references/console-app-example.md)
+
+## Security Best Practices
+
+| Practice | Recommendation |
+|----------|---------------|
+| **Never hardcode secrets** | Use environment variables, Azure Key Vault, or managed identity |
+| **Rotate secrets regularly** | Set expiration, automate rotation |
+| **Use certificates over secrets** | More secure for production |
+| **Least privilege permissions** | Request only required API permissions |
+| **Enable MFA** | Require multi-factor authentication for users |
+| **Use managed identity** | For Azure-hosted apps, avoid secrets entirely |
+| **Validate tokens** | Always validate issuer, audience, expiration |
+| **Use HTTPS only** | All redirect URIs must use HTTPS (except localhost) |
+| **Monitor sign-ins** | Use Entra ID sign-in logs for anomaly detection |
+
+## SDK Quick References
+
+- **Azure Identity**: [Python](references/sdk/azure-identity-py.md) | [.NET](references/sdk/azure-identity-dotnet.md) | [TypeScript](references/sdk/azure-identity-ts.md) | [Java](references/sdk/azure-identity-java.md) | [Rust](references/sdk/azure-identity-rust.md)
+- **Key Vault (secrets)**: [Python](references/sdk/azure-keyvault-py.md) | [TypeScript](references/sdk/azure-keyvault-secrets-ts.md)
+- **Auth Events**: [.NET](references/sdk/microsoft-azure-webjobs-extensions-authentication-events-dotnet.md)
+
+## References
+
+- [OAuth Flows](references/oauth-flows.md) - Detailed OAuth 2.0 flow explanations
+- [CLI Commands](references/cli-commands.md) - Azure CLI reference for app registrations
+- [Console App Example](references/console-app-example.md) - Complete working examples
+- [First App Registration](references/first-app-registration.md) - Step-by-step guide for beginners
+- [API Permissions](references/api-permissions.md) - Understanding and configuring permissions
+- [Troubleshooting](references/troubleshooting.md) - Common issues and solutions
+
+## External Resources
+
+- [Microsoft Identity Platform Documentation](https://learn.microsoft.com/entra/identity-platform/)
+- [OAuth 2.0 and OpenID Connect protocols](https://learn.microsoft.com/entra/identity-platform/v2-protocols)
+- [MSAL Documentation](https://learn.microsoft.com/entra/msal/)
+- [Microsoft Graph API](https://learn.microsoft.com/graph/)

package/skills/environment-config/SKILL.md

@@ -0,0 +1,34 @@
+---
+name: environment-config
+description: Manage environment configurations with validation, defaults, and secret injection
+category: Software Development
+---
+
+# Environment Config
+
+## Overview
+Manage environment configurations with validation, defaults, and secret injection. This skill helps you apply structured, repeatable methods for consistent results.
+
+## When to Use
+- When you need to apply environment config best practices
+- When establishing processes or standards for your workflow
+- When training team members on environment config
+- When automating or optimizing environment config tasks
+
+## Instructions
+1. **Assess**: Evaluate the current state, requirements, and constraints
+2. **Plan**: Define the approach, steps, and success criteria
+3. **Execute**: Follow the established patterns and best practices
+4. **Verify**: Check results against expected outcomes and quality standards
+5. **Iterate**: Refine based on feedback and lessons learned
+
+## Examples
+```
+User: Help me apply environment config for my current project
+Assistant: I'll help you apply environment config step by step...
+```
+
+## Related Skills
+- Use with `workflow` tool for orchestrated execution
+- Combine with `task` tool for delegated processing
+- Reference `system-prompt` for system-level integration