agentfootprint/dist/types/identity.d.ts

The explainable agent framework — backtrack a wrong answer to the exact context that caused it (evidence, not guesses). Built on footprintjs.

/**
 * identity — outbound credential vending for agent tools.
 *
 * The {@link CredentialProvider} port + adapters. A tool calls
 * `provider.getCredential({ service })` to get a token for a downstream service;
 * `agentCoreIdentity()` backs it with AWS Bedrock AgentCore Identity, or
 * `staticTokens()` for dev/test.
 *
 * SECURITY: a vended token is a secret — use it locally inside a tool's
 * `execute` (e.g. an HTTP header); never write it to tracked scope. See
 * `./identity/types` for the full invariant.
 *
 * @example
 * ```ts
 * import { agentCoreIdentity } from 'agentfootprint/security';
 *
 * const credentials = agentCoreIdentity({ region: 'us-east-1' });
 * const r = await credentials.getCredential({ service: 'github', mode: 'user', scopes: ['repo'] });
 * if (r.status === 'authorization-required') {
 *   // surface r.authorizationUrl to the user (e.g. pause the run), then retry.
 * } else {
 *   callGitHub({ headers: r.credential.toHeaders() }); // universal applicator
 * }
 * ```
 *
 * Not an import path of its own since 9.0.0. This is the implementation barrel
 * behind `agentfootprint/security`, which re-exports every name here — same
 * symbols, one door. Import from the door.
 */
export type { Credential, CredentialProvider, CredentialRequest, CredentialResult, CredentialIssued, CredentialAuthorizationRequired, CredentialNeed, } from './identity/types.js';
export { isCredentialIssued, unconfiguredCredentialProvider } from './identity/types.js';
export { bearer, apiKey, basic, headers, type BearerCredential, type ApiKeyCredential, type BasicCredential, type HeadersCredential, } from './identity/kinds.js';
export { staticTokens, type StaticTokensOptions } from './identity/staticTokens.js';
export { requestContext, isRequestContext, type RequestContext, type RequestContextOptions, } from './identity/requestContext.js';
export { requestCredentials, asBearer, asApiKey, decodedWith, RequestCredentialError, type RequestCredentialsOptions, type RequestCredentialSource, type RequestCredentialStrategy, type RequestCredentialRefusal, } from './identity/requestCredentials.js';
export type { AuthorizationRequiredMode, ConsentRequest } from './identity/consent.js';
export { CredentialConsentRequiredError, type CredentialConsentRequiredContext, } from './identity/CredentialConsentRequiredError.js';
export { withCredentialRetry, type WithCredentialRetryOptions, } from './identity/withCredentialRetry.js';
export { agentCoreIdentity, completeAgentCoreAuthorization, type AgentCoreIdentityOptions, type AgentCoreIdentityClientLike, type AgentCoreOauthResponse, type CompleteAgentCoreAuthorizationOptions, } from './adapters/identity/agentcore.js';
export { vaultCredentials, type VaultCredentialsOptions } from './adapters/identity/vault.js';
export { googleIdentity, CLOUD_PLATFORM_SCOPE, type GoogleIdentityOptions, type GoogleImpersonation, type GoogleAuthClientLike, } from './adapters/identity/google.js';
export { entraIdentity, AZURE_AI_SCOPE, AZURE_MANAGEMENT_SCOPE, AZURE_COGNITIVE_SERVICES_SCOPE, type EntraIdentityOptions, type TokenCredentialLike, type AccessTokenLike, type AzureIdentitySdkModule, } from './adapters/identity/azure.js';
export { jwksIdentity, MissingJwksSupportError, type ClaimPath, type JoseBackend, type JwksIdentityOptions, type RolesFormat, } from './adapters/identity/jwks.js';
export { oidcIdentity, type DiscoveryFetch, type OidcDiscoveryState, type OidcIdentity, type OidcIdentityOptions, } from './adapters/identity/oidc.js';
export type { DiscoveredIssuer } from './adapters/identity/verify/discovery.js';
export { MissingOpenIdClientError, OidcSignInSetupError, oidcSignIn, type OidcClientCredential, type OidcSignInOptions, type OpenIdClientBackend, } from './adapters/identity/oidcSignIn.js';
export { identityFromConfig, type IdentityBootOptions, type IdentityChoice, type IdentityMode, } from './adapters/identity/strategies/choose.js';
export { directoryPasswords, type DirectoryPasswordsOptions, } from './adapters/identity/directory/directoryPasswords.js';
export { ldapDirectory, MissingLdaptsError, type LdapDirectoryOptions, type LdaptsBackend, } from './adapters/identity/directory/ldapDirectory.js';
export { adSubCodeName, escapeFilterValue, type Directory, type DirectoryBind, type DirectoryBindRefused, type DirectoryEntry, type DirectorySession, } from './adapters/identity/directory/port.js';
export { hashPassword, localPasswords, LocalPasswordConfigError, SCRYPT_DEFAULT, SCRYPT_FLOOR, type ScryptCost, } from './adapters/identity/localPassword.js';
export { identityConfigFromEnv, IdentityConfigError, type IdentityConfig, } from './adapters/identity/strategies/config.js';
export type { IdentityStrategyName } from './adapters/identity/strategies/vocabulary.js';
//# sourceMappingURL=identity.d.ts.map