@datacules/agent-identity-store-azure

--- package/src/AzureKeyVaultCredentialStore.ts (excerpt) ---
/**
 * Azure Key Vault + Azure Table Storage CredentialStore implementation.
 *
 * Key Vault holds each credential as a secret whose name is the credential ref.
 * The secret value is the JSON-serialised Credential object.
 * The secret's "content-type" tag carries the status (active | pending | revoked)
 * so listActive() can skip inactive secrets without fetching their values.
 *
 * Table Storage holds migration reservation locks.
 * Table name: agent-identity-locks
 * Partition key: "lock"  (constant — all locks in one partition for simplicity)
 * Row key: the credential ref being locked
 * Columns: migrationId (string), expiresAt (number — Unix epoch seconds)
 *
 * Azure setup:
 *   1. Create an Azure Key Vault and store each Credential as a JSON secret.
 *      Set the secret's ContentType to "active", "pending", or "revoked".
 *   2. Create a Storage Account and a Table named "agentidentitylocks".
 *      (Table names may not contain hyphens — use "agentidentitylocks".)
 *   3. Grant the running identity:
 *        Key Vault Secrets User  (read secrets)
 *        Key Vault Secrets Officer  (only needed for write operations)
 *        Storage Table Data Contributor  (read + write locks table)
 *   4. Set AZURE_KEYVAULT_URL and AZURE_TABLES_ENDPOINT environment variables,
 *      or pass them as constructor options.
 *      DefaultAzureCredential resolves auth automatically from:
 *        - Managed Identity (production)
 *        - AZURE_CLIENT_ID / AZURE_TENANT_ID / AZU