agentfootprint/dist/identity.js

The explainable agent framework — backtrack a wrong answer to the exact context that caused it (evidence, not guesses). Built on footprintjs.

"use strict";
/**
 * identity — outbound credential vending for agent tools.
 *
 * The {@link CredentialProvider} port + adapters. A tool calls
 * `provider.getCredential({ service })` to get a token for a downstream service;
 * `agentCoreIdentity()` backs it with AWS Bedrock AgentCore Identity, or
 * `staticTokens()` for dev/test.
 *
 * SECURITY: a vended token is a secret — use it locally inside a tool's
 * `execute` (e.g. an HTTP header); never write it to tracked scope. See
 * `./identity/types` for the full invariant.
 *
 * @example
 * ```ts
 * import { agentCoreIdentity } from 'agentfootprint/security';
 *
 * const credentials = agentCoreIdentity({ region: 'us-east-1' });
 * const r = await credentials.getCredential({ service: 'github', mode: 'user', scopes: ['repo'] });
 * if (r.status === 'authorization-required') {
 *   // surface r.authorizationUrl to the user (e.g. pause the run), then retry.
 * } else {
 *   callGitHub({ headers: r.credential.toHeaders() }); // universal applicator
 * }
 * ```
 *
 * Not an import path of its own since 9.0.0. This is the implementation barrel
 * behind `agentfootprint/security`, which re-exports every name here — same
 * symbols, one door. Import from the door.
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.IdentityConfigError = exports.identityConfigFromEnv = exports.SCRYPT_FLOOR = exports.SCRYPT_DEFAULT = exports.LocalPasswordConfigError = exports.localPasswords = exports.hashPassword = exports.escapeFilterValue = exports.adSubCodeName = exports.MissingLdaptsError = exports.ldapDirectory = exports.directoryPasswords = exports.identityFromConfig = exports.oidcSignIn = exports.OidcSignInSetupError = exports.MissingOpenIdClientError = exports.oidcIdentity = exports.MissingJwksSupportError = exports.jwksIdentity = exports.AZURE_COGNITIVE_SERVICES_SCOPE = exports.AZURE_MANAGEMENT_SCOPE = exports.AZURE_AI_SCOPE = exports.entraIdentity = exports.CLOUD_PLATFORM_SCOPE = exports.googleIdentity = exports.vaultCredentials = exports.completeAgentCoreAuthorization = exports.agentCoreIdentity = exports.withCredentialRetry = exports.CredentialConsentRequiredError = exports.RequestCredentialError = exports.decodedWith = exports.asApiKey = exports.asBearer = exports.requestCredentials = exports.isRequestContext = exports.requestContext = exports.staticTokens = exports.headers = exports.basic = exports.apiKey = exports.bearer = exports.unconfiguredCredentialProvider = exports.isCredentialIssued = void 0;
var types_js_1 = require("./identity/types.js");
Object.defineProperty(exports, "isCredentialIssued", { enumerable: true, get: function () { return types_js_1.isCredentialIssued; } });
Object.defineProperty(exports, "unconfiguredCredentialProvider", { enumerable: true, get: function () { return types_js_1.unconfiguredCredentialProvider; } });
var kinds_js_1 = require("./identity/kinds.js");
Object.defineProperty(exports, "bearer", { enumerable: true, get: function () { return kinds_js_1.bearer; } });
Object.defineProperty(exports, "apiKey", { enumerable: true, get: function () { return kinds_js_1.apiKey; } });
Object.defineProperty(exports, "basic", { enumerable: true, get: function () { return kinds_js_1.basic; } });
Object.defineProperty(exports, "headers", { enumerable: true, get: function () { return kinds_js_1.headers; } });
var staticTokens_js_1 = require("./identity/staticTokens.js");
Object.defineProperty(exports, "staticTokens", { enumerable: true, get: function () { return staticTokens_js_1.staticTokens; } });
// Credentials from the INCOMING REQUEST: the host seals the request's secrets
// per run (`requestContext`), and `requestCredentials` vends them to a tool's
// declared `needs` — only for the run that carries them, failing closed by name.
var requestContext_js_1 = require("./identity/requestContext.js");
Object.defineProperty(exports, "requestContext", { enumerable: true, get: function () { return requestContext_js_1.requestContext; } });
Object.defineProperty(exports, "isRequestContext", { enumerable: true, get: function () { return requestContext_js_1.isRequestContext; } });
var requestCredentials_js_1 = require("./identity/requestCredentials.js");
Object.defineProperty(exports, "requestCredentials", { enumerable: true, get: function () { return requestCredentials_js_1.requestCredentials; } });
Object.defineProperty(exports, "asBearer", { enumerable: true, get: function () { return requestCredentials_js_1.asBearer; } });
Object.defineProperty(exports, "asApiKey", { enumerable: true, get: function () { return requestCredentials_js_1.asApiKey; } });
Object.defineProperty(exports, "decodedWith", { enumerable: true, get: function () { return requestCredentials_js_1.decodedWith; } });
Object.defineProperty(exports, "RequestCredentialError", { enumerable: true, get: function () { return requestCredentials_js_1.RequestCredentialError; } });
var CredentialConsentRequiredError_js_1 = require("./identity/CredentialConsentRequiredError.js");
Object.defineProperty(exports, "CredentialConsentRequiredError", { enumerable: true, get: function () { return CredentialConsentRequiredError_js_1.CredentialConsentRequiredError; } });
var withCredentialRetry_js_1 = require("./identity/withCredentialRetry.js");
Object.defineProperty(exports, "withCredentialRetry", { enumerable: true, get: function () { return withCredentialRetry_js_1.withCredentialRetry; } });
var agentcore_js_1 = require("./adapters/identity/agentcore.js");
Object.defineProperty(exports, "agentCoreIdentity", { enumerable: true, get: function () { return agentcore_js_1.agentCoreIdentity; } });
// The consent handshake (9.66.0) — called from YOUR callback route, not from
// the agent run, which is why it is a function of its own rather than a
// method on the provider that route never sees.
Object.defineProperty(exports, "completeAgentCoreAuthorization", { enumerable: true, get: function () { return agentcore_js_1.completeAgentCoreAuthorization; } });
// HashiCorp-Vault-compatible KV v2, over plain HTTP (9.8.0) — no SDK, no
// vendor client. V1 is token auth + KV v2 + no leases, and every other shape
// is refused by name rather than guessed at; see the module docstring.
var vault_js_1 = require("./adapters/identity/vault.js");
Object.defineProperty(exports, "vaultCredentials", { enumerable: true, get: function () { return vault_js_1.vaultCredentials; } });
// Google access tokens from whatever credential the environment already has
// (ADC, workload identity, an impersonated service account). Narrow on
// purpose: it vends the DEPLOYMENT's identity, and `mode: 'user'` is refused
// by name rather than quietly downgraded to a machine token.
var google_js_1 = require("./adapters/identity/google.js");
Object.defineProperty(exports, "googleIdentity", { enumerable: true, get: function () { return google_js_1.googleIdentity; } });
Object.defineProperty(exports, "CLOUD_PLATFORM_SCOPE", { enumerable: true, get: function () { return google_js_1.CLOUD_PLATFORM_SCOPE; } });
// Entra ID tokens from whatever credential the environment already has —
// DefaultAzureCredential's chain (env service principal, workload identity,
// managed identity, VS Code, az CLI), or any TokenCredential you built
// (9.74.0). Same narrowness as googleIdentity: it vends the DEPLOYMENT's
// identity; `mode: 'user'` and per-request user tokens are refused by name
// until an OBO surface exists. AZURE_AI_SCOPE vs AZURE_MANAGEMENT_SCOPE
// matters — a token for one audience does not work on the other, which is
// why both constants are exported instead of one "azure scope".
var azure_js_1 = require("./adapters/identity/azure.js");
Object.defineProperty(exports, "entraIdentity", { enumerable: true, get: function () { return azure_js_1.entraIdentity; } });
Object.defineProperty(exports, "AZURE_AI_SCOPE", { enumerable: true, get: function () { return azure_js_1.AZURE_AI_SCOPE; } });
Object.defineProperty(exports, "AZURE_MANAGEMENT_SCOPE", { enumerable: true, get: function () { return azure_js_1.AZURE_MANAGEMENT_SCOPE; } });
Object.defineProperty(exports, "AZURE_COGNITIVE_SERVICES_SCOPE", { enumerable: true, get: function () { return azure_js_1.AZURE_COGNITIVE_SERVICES_SCOPE; } });
// Verifying WHO is calling (9.26.0) — the other half of identity. The rest of
// this door vends credentials for calls the agent makes OUTWARD;
// `jwksIdentity` checks the credential a caller presents INWARD, against an
// identity provider's published key set. Wire it at the hosting door:
// `standingAgent({ …, identity: { verify: jwksIdentity({ … }).verify } })`.
var jwks_js_1 = require("./adapters/identity/jwks.js");
Object.defineProperty(exports, "jwksIdentity", { enumerable: true, get: function () { return jwks_js_1.jwksIdentity; } });
Object.defineProperty(exports, "MissingJwksSupportError", { enumerable: true, get: function () { return jwks_js_1.MissingJwksSupportError; } });
// Sign-in strategies picked by CONFIG (the identity-strategies design). One
// strategy per deployment, judged once at boot: `identityFromConfig` refuses a
// wrong or missing setting by name, and production must name its strategy.
// `oidcIdentity` is the `oidc-token` verifier: jwksIdentity's checks plus
// discovery, AD FS's second issuer, and the PERSON test — an application's own
// token is not an employee.
var oidc_js_1 = require("./adapters/identity/oidc.js");
Object.defineProperty(exports, "oidcIdentity", { enumerable: true, get: function () { return oidc_js_1.oidcIdentity; } });
// Browser sign-in for oidc-token: the authorization-code flow through
// `openid-client` (optional peer). PENDING INDEPENDENT REVIEW before a company
// install. The person is read from an ACCESS token by the strategy's own verify.
var oidcSignIn_js_1 = require("./adapters/identity/oidcSignIn.js");
Object.defineProperty(exports, "MissingOpenIdClientError", { enumerable: true, get: function () { return oidcSignIn_js_1.MissingOpenIdClientError; } });
Object.defineProperty(exports, "OidcSignInSetupError", { enumerable: true, get: function () { return oidcSignIn_js_1.OidcSignInSetupError; } });
Object.defineProperty(exports, "oidcSignIn", { enumerable: true, get: function () { return oidcSignIn_js_1.oidcSignIn; } });
var choose_js_1 = require("./adapters/identity/strategies/choose.js");
Object.defineProperty(exports, "identityFromConfig", { enumerable: true, get: function () { return choose_js_1.identityFromConfig; } });
// `directory-password`: Active Directory over LDAPS — bind, RFC 4532
// Who-am-I, exactly one entry, its objectGUID. `ldapts` is an optional peer.
var directoryPasswords_js_1 = require("./adapters/identity/directory/directoryPasswords.js");
Object.defineProperty(exports, "directoryPasswords", { enumerable: true, get: function () { return directoryPasswords_js_1.directoryPasswords; } });
var ldapDirectory_js_1 = require("./adapters/identity/directory/ldapDirectory.js");
Object.defineProperty(exports, "ldapDirectory", { enumerable: true, get: function () { return ldapDirectory_js_1.ldapDirectory; } });
Object.defineProperty(exports, "MissingLdaptsError", { enumerable: true, get: function () { return ldapDirectory_js_1.MissingLdaptsError; } });
var port_js_1 = require("./adapters/identity/directory/port.js");
Object.defineProperty(exports, "adSubCodeName", { enumerable: true, get: function () { return port_js_1.adSubCodeName; } });
Object.defineProperty(exports, "escapeFilterValue", { enumerable: true, get: function () { return port_js_1.escapeFilterValue; } });
// `local-password` (development, tests, demos; refused in production): hashed
// entries only, scrypt from node:crypto. `hashPassword` makes an entry.
var localPassword_js_1 = require("./adapters/identity/localPassword.js");
Object.defineProperty(exports, "hashPassword", { enumerable: true, get: function () { return localPassword_js_1.hashPassword; } });
Object.defineProperty(exports, "localPasswords", { enumerable: true, get: function () { return localPassword_js_1.localPasswords; } });
Object.defineProperty(exports, "LocalPasswordConfigError", { enumerable: true, get: function () { return localPassword_js_1.LocalPasswordConfigError; } });
Object.defineProperty(exports, "SCRYPT_DEFAULT", { enumerable: true, get: function () { return localPassword_js_1.SCRYPT_DEFAULT; } });
Object.defineProperty(exports, "SCRYPT_FLOOR", { enumerable: true, get: function () { return localPassword_js_1.SCRYPT_FLOOR; } });
var config_js_1 = require("./adapters/identity/strategies/config.js");
Object.defineProperty(exports, "identityConfigFromEnv", { enumerable: true, get: function () { return config_js_1.identityConfigFromEnv; } });
Object.defineProperty(exports, "IdentityConfigError", { enumerable: true, get: function () { return config_js_1.IdentityConfigError; } });
//# sourceMappingURL=identity.js.map