@heossi/qnsi 0.3.2

package/dist/cli/utils/token-cache.js

@@ -0,0 +1,22 @@
+const tokenCache = new Map();
+const DEFAULT_TOKEN_TTL_MS = 3600000;
+export function getCachedToken(serviceId) {
+    const cached = tokenCache.get(serviceId);
+    if (cached && Date.now() < cached.expiresAt) {
+        return cached.token;
+    }
+    if (cached) {
+        tokenCache.delete(serviceId);
+    }
+    return null;
+}
+export function setCachedToken(serviceId, token, ttlMs = DEFAULT_TOKEN_TTL_MS) {
+    tokenCache.set(serviceId, {
+        token,
+        expiresAt: Date.now() + ttlMs,
+    });
+}
+export function clearTokenCache() {
+    tokenCache.clear();
+}
+//# sourceMappingURL=token-cache.js.map

package/dist/cli/utils/token-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cache.js","sourceRoot":"","sources":["../../../src/cli/utils/token-cache.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;AAElD,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAErC,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACZ,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,cAAc,CAC7B,SAAiB,EACjB,KAAa,EACb,KAAK,GAAG,oBAAoB;IAE5B,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;QACzB,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC7B,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,UAAU,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Top-level QNSP SDK entry point.
+ *
+ * One client owns one HTTP connection pool and one activation cache;
+ * the eleven service sub-clients (`vault`, `kms`, `audit`, `auth`,
+ * `tenant`, `access`, `billing`, `cryptoInventory`, `storage`,
+ * `search`, `ai`) share both. Mirrors the `qnsp` Python / Go / Rust
+ * SDK shape byte-for-byte.
+ */
+import type { SdkActivationResponse } from "./_activation/index.js";
+import { type QnspClientOptions } from "./_internal.js";
+import { AccessClient } from "./access.js";
+import { AiClient } from "./ai.js";
+import { AuditClient } from "./audit.js";
+import { AuthClient } from "./auth.js";
+import { BillingClient } from "./billing.js";
+import { CryptoInventoryClient } from "./crypto-inventory.js";
+import { KmsClient } from "./kms.js";
+import { SearchClient } from "./search.js";
+import { StorageClient } from "./storage.js";
+import { TenantClient } from "./tenant.js";
+import { VaultClient } from "./vault.js";
+export declare class QnspClient {
+    readonly vault: VaultClient;
+    readonly kms: KmsClient;
+    readonly audit: AuditClient;
+    readonly auth: AuthClient;
+    readonly tenant: TenantClient;
+    readonly access: AccessClient;
+    readonly billing: BillingClient;
+    readonly cryptoInventory: CryptoInventoryClient;
+    readonly storage: StorageClient;
+    readonly search: SearchClient;
+    readonly ai: AiClient;
+    private readonly internal;
+    constructor(options: QnspClientOptions);
+    /**
+     * Force the activation handshake to run now. Surfaces invalid-API-key
+     * errors at startup rather than on the first service call.
+     */
+    ensureActivated(): Promise<SdkActivationResponse>;
+    /** Tenant ID resolved by activation. */
+    tenantId(): Promise<string>;
+    /** Plan tier resolved by activation. */
+    tier(): Promise<string>;
+    /** Tier limits dict from activation. */
+    limits(): Promise<Record<string, unknown>>;
+    /** Whether the tenant's plan enables a billing-side boolean feature. */
+    hasFeature(feature: string): Promise<boolean>;
+}
+export type { QnspClientOptions } from "./_internal.js";
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,EAAY,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,qBAAa,UAAU;IACtB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IAEtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;gBAExB,OAAO,EAAE,iBAAiB;IAetC;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAIvD,wCAAwC;IAClC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;IAKjC,wCAAwC;IAClC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAK7B,wCAAwC;IAClC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKhD,wEAAwE;IAClE,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAKnD;AAED,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/client.js

@@ -0,0 +1,78 @@
+/**
+ * Top-level QNSP SDK entry point.
+ *
+ * One client owns one HTTP connection pool and one activation cache;
+ * the eleven service sub-clients (`vault`, `kms`, `audit`, `auth`,
+ * `tenant`, `access`, `billing`, `cryptoInventory`, `storage`,
+ * `search`, `ai`) share both. Mirrors the `qnsp` Python / Go / Rust
+ * SDK shape byte-for-byte.
+ */
+import { Internal } from "./_internal.js";
+import { AccessClient } from "./access.js";
+import { AiClient } from "./ai.js";
+import { AuditClient } from "./audit.js";
+import { AuthClient } from "./auth.js";
+import { BillingClient } from "./billing.js";
+import { CryptoInventoryClient } from "./crypto-inventory.js";
+import { KmsClient } from "./kms.js";
+import { SearchClient } from "./search.js";
+import { StorageClient } from "./storage.js";
+import { TenantClient } from "./tenant.js";
+import { VaultClient } from "./vault.js";
+export class QnspClient {
+    vault;
+    kms;
+    audit;
+    auth;
+    tenant;
+    access;
+    billing;
+    cryptoInventory;
+    storage;
+    search;
+    ai;
+    internal;
+    constructor(options) {
+        this.internal = new Internal(options);
+        this.vault = new VaultClient(this.internal);
+        this.kms = new KmsClient(this.internal);
+        this.audit = new AuditClient(this.internal);
+        this.auth = new AuthClient(this.internal);
+        this.tenant = new TenantClient(this.internal);
+        this.access = new AccessClient(this.internal);
+        this.billing = new BillingClient(this.internal);
+        this.cryptoInventory = new CryptoInventoryClient(this.internal);
+        this.storage = new StorageClient(this.internal);
+        this.search = new SearchClient(this.internal);
+        this.ai = new AiClient(this.internal);
+    }
+    /**
+     * Force the activation handshake to run now. Surfaces invalid-API-key
+     * errors at startup rather than on the first service call.
+     */
+    async ensureActivated() {
+        return this.internal.ensureActivated();
+    }
+    /** Tenant ID resolved by activation. */
+    async tenantId() {
+        const a = await this.internal.ensureActivated();
+        return a.tenantId;
+    }
+    /** Plan tier resolved by activation. */
+    async tier() {
+        const a = await this.internal.ensureActivated();
+        return a.tier;
+    }
+    /** Tier limits dict from activation. */
+    async limits() {
+        const a = await this.internal.ensureActivated();
+        return a.limits;
+    }
+    /** Whether the tenant's plan enables a billing-side boolean feature. */
+    async hasFeature(feature) {
+        const limits = await this.limits();
+        const v = limits[feature];
+        return v === true;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,QAAQ,EAA0B,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,OAAO,UAAU;IACb,KAAK,CAAc;IACnB,GAAG,CAAY;IACf,KAAK,CAAc;IACnB,IAAI,CAAa;IACjB,MAAM,CAAe;IACrB,MAAM,CAAe;IACrB,OAAO,CAAgB;IACvB,eAAe,CAAwB;IACvC,OAAO,CAAgB;IACvB,MAAM,CAAe;IACrB,EAAE,CAAW;IAEL,QAAQ,CAAW;IAEpC,YAAY,OAA0B;QACrC,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,eAAe,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;IACxC,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,QAAQ;QACb,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAChD,OAAO,CAAC,CAAC,QAAQ,CAAC;IACnB,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,IAAI;QACT,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAChD,OAAO,CAAC,CAAC,IAAI,CAAC;IACf,CAAC;IAED,wCAAwC;IACxC,KAAK,CAAC,MAAM;QACX,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAChD,OAAO,CAAC,CAAC,MAA4C,CAAC;IACvD,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,UAAU,CAAC,OAAe;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1B,OAAO,CAAC,KAAK,IAAI,CAAC;IACnB,CAAC;CACD"}

package/dist/crypto-inventory.d.ts

@@ -0,0 +1,21 @@
+/**
+ * QNSP Crypto-Inventory (CBOM) — asset catalogue, discovery runs,
+ * deprecation policies, PQC migration readiness. Wraps
+ * `apps/crypto-inventory-service` (`/crypto/v1`).
+ */
+import type { Internal, RequestOptions } from "./_internal.js";
+export interface DiscoverAssetsRequest {
+    readonly targets?: readonly string[];
+    readonly modes?: readonly string[];
+    readonly options?: Record<string, unknown>;
+}
+export declare class CryptoInventoryClient {
+    private readonly internal;
+    constructor(internal: Internal);
+    listAssets(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
+    getAsset(assetId: string): Promise<Record<string, unknown>>;
+    getAssetStats(tenantId: string): Promise<Record<string, unknown>>;
+    discoverAssets(req: DiscoverAssetsRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    getReadinessScore(tenantId: string): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=crypto-inventory.d.ts.map

package/dist/crypto-inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-inventory.d.ts","sourceRoot":"","sources":["../src/crypto-inventory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI/D,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,qBAAa,qBAAqB;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,UAAU,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAI1C,QAAQ,CAAC,OAAO,EAAE,MAAM;IAIxB,aAAa,CAAC,QAAQ,EAAE,MAAM;IAI9B,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAIxF,iBAAiB,CAAC,QAAQ,EAAE,MAAM;CAGlC"}

package/dist/crypto-inventory.js

@@ -0,0 +1,28 @@
+/**
+ * QNSP Crypto-Inventory (CBOM) — asset catalogue, discovery runs,
+ * deprecation policies, PQC migration readiness. Wraps
+ * `apps/crypto-inventory-service` (`/crypto/v1`).
+ */
+const PATH_PREFIX = "/proxy/crypto/v1";
+export class CryptoInventoryClient {
+    internal;
+    constructor(internal) {
+        this.internal = internal;
+    }
+    listAssets(query) {
+        return this.internal.request("GET", `${PATH_PREFIX}/assets`, undefined, { query });
+    }
+    getAsset(assetId) {
+        return this.internal.request("GET", `${PATH_PREFIX}/assets/${assetId}`);
+    }
+    getAssetStats(tenantId) {
+        return this.internal.request("GET", `${PATH_PREFIX}/assets/stats/${tenantId}`);
+    }
+    discoverAssets(req, opts) {
+        return this.internal.request("POST", `${PATH_PREFIX}/discovery/runs`, req, opts);
+    }
+    getReadinessScore(tenantId) {
+        return this.internal.request("GET", `${PATH_PREFIX}/readiness/${tenantId}`);
+    }
+}
+//# sourceMappingURL=crypto-inventory.js.map

package/dist/crypto-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-inventory.js","sourceRoot":"","sources":["../src/crypto-inventory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAQvC,MAAM,OAAO,qBAAqB;IACJ;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,UAAU,CAAC,KAA+B;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,SAAS,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,QAAQ,CAAC,OAAe;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,WAAW,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,aAAa,CAAC,QAAgB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,cAAc,CAAC,GAA0B,EAAE,IAA6C;QACvF,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;IAED,iBAAiB,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,cAAc,QAAQ,EAAE,CAAC,CAAC;IAC7E,CAAC;CACD"}

package/dist/errors.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Typed error hierarchy for the QNSP SDK.
+ *
+ * Every method in `@heossi/qnsi` rejects with an instance of one of these
+ * classes — never with a bare `Error` or a string. Callers can branch on
+ * the failure mode without parsing error messages.
+ */
+/** Base class — all QNSP SDK errors inherit. */
+export declare class QnspError extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+/** DNS, TLS, timeout, or connection failure reaching the QNSP edge gateway. */
+export declare class QnspNetworkError extends QnspError {
+    readonly op: string;
+    readonly url: string;
+    constructor(op: string, url: string, cause?: unknown);
+}
+/** API key rejected at activation. */
+export declare class QnspAuthError extends QnspError {
+    readonly code: string | null;
+    constructor(message: string, code?: string | null);
+}
+/** A QNSP service returned a 4xx/5xx with a structured body. */
+export declare class QnspApiError extends QnspError {
+    readonly statusCode: number;
+    readonly code: string | null;
+    readonly body: unknown;
+    constructor(message: string, statusCode: number, code?: string | null, body?: unknown);
+}
+/** HMAC mismatch, expired/future timestamp, malformed body, or missing fields. */
+export declare class QnspWebhookError extends QnspError {
+    readonly reason: string;
+    constructor(reason: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,gDAAgD;AAChD,qBAAa,SAAU,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAInD;AAED,+EAA+E;AAC/E,qBAAa,gBAAiB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBACT,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAMpD;AAED,sCAAsC;AACtC,qBAAa,aAAc,SAAQ,SAAS;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;gBACjB,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,GAAG,IAAW;CAKvD;AAED,gEAAgE;AAChE,qBAAa,YAAa,SAAQ,SAAS;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,MAAM,GAAG,IAAW,EAC1B,IAAI,GAAE,OAAc;CAQrB;AAED,kFAAkF;AAClF,qBAAa,gBAAiB,SAAQ,SAAS;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAK1B"}

package/dist/errors.js

@@ -0,0 +1,64 @@
+/**
+ * Typed error hierarchy for the QNSP SDK.
+ *
+ * Every method in `@heossi/qnsi` rejects with an instance of one of these
+ * classes — never with a bare `Error` or a string. Callers can branch on
+ * the failure mode without parsing error messages.
+ */
+/** Base class — all QNSP SDK errors inherit. */
+export class QnspError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "QnspError";
+    }
+}
+/** DNS, TLS, timeout, or connection failure reaching the QNSP edge gateway. */
+export class QnspNetworkError extends QnspError {
+    op;
+    url;
+    constructor(op, url, cause) {
+        super(`qnsp: network error on ${op} ${url}: ${stringifyCause(cause)}`, { cause });
+        this.name = "QnspNetworkError";
+        this.op = op;
+        this.url = url;
+    }
+}
+/** API key rejected at activation. */
+export class QnspAuthError extends QnspError {
+    code;
+    constructor(message, code = null) {
+        super(`qnsp: auth error${code ? ` (${code})` : ""}: ${message}`);
+        this.name = "QnspAuthError";
+        this.code = code;
+    }
+}
+/** A QNSP service returned a 4xx/5xx with a structured body. */
+export class QnspApiError extends QnspError {
+    statusCode;
+    code;
+    body;
+    constructor(message, statusCode, code = null, body = null) {
+        super(`qnsp: api error ${statusCode}${code ? ` ${code}` : ""}: ${message}`);
+        this.name = "QnspApiError";
+        this.statusCode = statusCode;
+        this.code = code;
+        this.body = body;
+    }
+}
+/** HMAC mismatch, expired/future timestamp, malformed body, or missing fields. */
+export class QnspWebhookError extends QnspError {
+    reason;
+    constructor(reason) {
+        super(`qnsp: webhook error: ${reason}`);
+        this.name = "QnspWebhookError";
+        this.reason = reason;
+    }
+}
+function stringifyCause(cause) {
+    if (cause instanceof Error)
+        return cause.message;
+    if (typeof cause === "string")
+        return cause;
+    return "unknown error";
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,gDAAgD;AAChD,MAAM,OAAO,SAAU,SAAQ,KAAK;IACnC,YAAY,OAAe,EAAE,OAAsB;QAClD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IACzB,CAAC;CACD;AAED,+EAA+E;AAC/E,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IACrC,EAAE,CAAS;IACX,GAAG,CAAS;IACrB,YAAY,EAAU,EAAE,GAAW,EAAE,KAAe;QACnD,KAAK,CAAC,0BAA0B,EAAE,IAAI,GAAG,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IAChB,CAAC;CACD;AAED,sCAAsC;AACtC,MAAM,OAAO,aAAc,SAAQ,SAAS;IAClC,IAAI,CAAgB;IAC7B,YAAY,OAAe,EAAE,OAAsB,IAAI;QACtD,KAAK,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAED,gEAAgE;AAChE,MAAM,OAAO,YAAa,SAAQ,SAAS;IACjC,UAAU,CAAS;IACnB,IAAI,CAAgB;IACpB,IAAI,CAAU;IACvB,YACC,OAAe,EACf,UAAkB,EAClB,OAAsB,IAAI,EAC1B,OAAgB,IAAI;QAEpB,KAAK,CAAC,mBAAmB,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAED,kFAAkF;AAClF,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IACrC,MAAM,CAAS;IACxB,YAAY,MAAc;QACzB,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;CACD;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,eAAe,CAAC;AACxB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,50 @@
+/**
+ * `@heossi/qnsi` — official Node.js / TypeScript SDK for the
+ * Quantum-Native Security Infrastructure.
+ *
+ * Single package covering vault, kms, audit, auth, tenant, access,
+ * billing, crypto-inventory, storage, search, and ai-orchestrator,
+ * plus webhook signature verification. Mirrors the `qnsp` Python /
+ * Go / Rust SDK surface byte-for-byte.
+ *
+ * @example
+ * ```ts
+ * import { QnspClient } from "@heossi/qnsi";
+ *
+ * const qnsp = new QnspClient({ apiKey: process.env.QNSP_API_KEY! });
+ *
+ * // Vault
+ * const secret = await qnsp.vault.createSecret({
+ *   name: "openai-api-key",
+ *   payloadB64: Buffer.from("sk-...").toString("base64"),
+ *   algorithm: "ml-kem-768",
+ * });
+ *
+ * // KMS
+ * const key = await qnsp.kms.createKey({ algorithm: "ml-dsa-65", purpose: "signing" });
+ * const sig = await qnsp.kms.sign(key.keyId, new TextEncoder().encode("hello"));
+ *
+ * // Audit
+ * await qnsp.audit.logEvent({
+ *   eventType: "model.inference",
+ *   payload: { modelId: "gpt-4o", latencyMs: 412 },
+ * });
+ * ```
+ *
+ * Sign up for a free QNSI account at https://cloud.qnsp.cuilabs.io/auth.
+ */
+export { AccessClient, type AssignRoleRequest, type CheckPermissionRequest, type CreateRoleRequest, } from "./access.js";
+export { AiClient, type InferenceRequest, type RegisterArtifactRequest, type RegisterModelRequest, type SubmitWorkloadRequest, } from "./ai.js";
+export { AuditClient, type LogEventRequest } from "./audit.js";
+export { AuthClient, type LoginRequest } from "./auth.js";
+export { BillingClient, type IngestMeterRequest } from "./billing.js";
+export { QnspClient, type QnspClientOptions } from "./client.js";
+export { CryptoInventoryClient, type DiscoverAssetsRequest } from "./crypto-inventory.js";
+export { QnspApiError, QnspAuthError, QnspError, QnspNetworkError, QnspWebhookError, } from "./errors.js";
+export { type CreateKeyRequest, KmsClient } from "./kms.js";
+export { type CreateIndexRequest, type QueryRequest, SearchClient, type Vector, } from "./search.js";
+export { type PutObjectInput, StorageClient } from "./storage.js";
+export { type CreateTenantRequest, TenantClient } from "./tenant.js";
+export { type CreateSecretRequest, VaultClient } from "./vault.js";
+export { MAX_WEBHOOK_SKEW_MS, parseQnspWebhook, type QnspWebhookEvent, verifyQnspWebhookSignature, } from "./webhooks.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACN,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,QAAQ,EACR,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC1B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACN,YAAY,EACZ,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,YAAY,EACZ,KAAK,MAAM,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,KAAK,mBAAmB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,0BAA0B,GAC1B,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,51 @@
+/**
+ * `@heossi/qnsi` — official Node.js / TypeScript SDK for the
+ * Quantum-Native Security Infrastructure.
+ *
+ * Single package covering vault, kms, audit, auth, tenant, access,
+ * billing, crypto-inventory, storage, search, and ai-orchestrator,
+ * plus webhook signature verification. Mirrors the `qnsp` Python /
+ * Go / Rust SDK surface byte-for-byte.
+ *
+ * @example
+ * ```ts
+ * import { QnspClient } from "@heossi/qnsi";
+ *
+ * const qnsp = new QnspClient({ apiKey: process.env.QNSP_API_KEY! });
+ *
+ * // Vault
+ * const secret = await qnsp.vault.createSecret({
+ *   name: "openai-api-key",
+ *   payloadB64: Buffer.from("sk-...").toString("base64"),
+ *   algorithm: "ml-kem-768",
+ * });
+ *
+ * // KMS
+ * const key = await qnsp.kms.createKey({ algorithm: "ml-dsa-65", purpose: "signing" });
+ * const sig = await qnsp.kms.sign(key.keyId, new TextEncoder().encode("hello"));
+ *
+ * // Audit
+ * await qnsp.audit.logEvent({
+ *   eventType: "model.inference",
+ *   payload: { modelId: "gpt-4o", latencyMs: 412 },
+ * });
+ * ```
+ *
+ * Sign up for a free QNSI account at https://cloud.qnsp.cuilabs.io/auth.
+ */
+export { AccessClient, } from "./access.js";
+export { AiClient, } from "./ai.js";
+export { AuditClient } from "./audit.js";
+export { AuthClient } from "./auth.js";
+export { BillingClient } from "./billing.js";
+export { QnspClient } from "./client.js";
+export { CryptoInventoryClient } from "./crypto-inventory.js";
+export { QnspApiError, QnspAuthError, QnspError, QnspNetworkError, QnspWebhookError, } from "./errors.js";
+export { KmsClient } from "./kms.js";
+export { SearchClient, } from "./search.js";
+export { StorageClient } from "./storage.js";
+export { TenantClient } from "./tenant.js";
+// Service classes — exported so callers can construct mocks for testing.
+export { VaultClient } from "./vault.js";
+export { MAX_WEBHOOK_SKEW_MS, parseQnspWebhook, verifyQnspWebhookSignature, } from "./webhooks.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACN,YAAY,GAIZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,QAAQ,GAKR,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAwB,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAqB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAA2B,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,UAAU,EAA0B,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAA8B,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACN,YAAY,EACZ,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,gBAAgB,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,SAAS,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAGN,YAAY,GAEZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAuB,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAA4B,YAAY,EAAE,MAAM,aAAa,CAAC;AACrE,yEAAyE;AACzE,OAAO,EAA4B,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAEhB,0BAA0B,GAC1B,MAAM,eAAe,CAAC"}

package/dist/kms.d.ts

@@ -0,0 +1,30 @@
+/**
+ * QNSP KMS — server-side PQC keys with sign, verify, wrap, and unwrap.
+ * Wraps `apps/kms-service` (`/kms/v1`).
+ */
+import type { Internal, RequestOptions } from "./_internal.js";
+export interface CreateKeyRequest {
+    /** Caller key identifier (1-255 chars). Auto-generated (uuid) if omitted. */
+    readonly keyId?: string;
+    /** Key type per backend schema. Defaults to "data". */
+    readonly keyType?: "root" | "master" | "data" | "byok";
+    /** Symmetric/PQC algorithm. Backend default: AES-256-GCM. */
+    readonly algorithm?: string;
+    /** Optional hint (e.g. "signing"/"encryption"/"kem"); folded into metadata. */
+    readonly purpose?: string;
+    readonly metadata?: Record<string, unknown>;
+}
+export declare class KmsClient {
+    private readonly internal;
+    constructor(internal: Internal);
+    createKey(req?: CreateKeyRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    listKeys(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
+    getKey(keyId: string): Promise<Record<string, unknown>>;
+    rotateKey(keyId: string, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    deleteKey(keyId: string): Promise<Record<string, unknown>>;
+    sign(keyId: string, data: Uint8Array, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Uint8Array>;
+    verify(keyId: string, data: Uint8Array, signature: Uint8Array): Promise<boolean>;
+    wrap(keyId: string, plaintext: Uint8Array, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Uint8Array>;
+    unwrap(keyId: string, ciphertext: Uint8Array, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Uint8Array>;
+}
+//# sourceMappingURL=kms.d.ts.map

package/dist/kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../src/kms.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAK/D,MAAM,WAAW,gBAAgB;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IACvD,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAoBD,qBAAa,SAAS;IACT,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,SAAS,CAAC,GAAG,GAAE,gBAAqB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAkBnF,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM;IAIpB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAItE,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIpD,IAAI,CACT,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC;IAgBhB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAYhF,IAAI,CACT,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC;IAmBhB,MAAM,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,UAAU,EACtB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC;CAkBtB"}

package/dist/kms.js

@@ -0,0 +1,92 @@
+/**
+ * QNSP KMS — server-side PQC keys with sign, verify, wrap, and unwrap.
+ * Wraps `apps/kms-service` (`/kms/v1`).
+ */
+import { QnspApiError } from "./errors.js";
+const PATH_PREFIX = "/proxy/kms/v1";
+export class KmsClient {
+    internal;
+    constructor(internal) {
+        this.internal = internal;
+    }
+    createKey(req = {}, opts) {
+        // Wire contract: createKeySchema = { tenantId, keyId(req,1-255),
+        // keyType(req: root|master|data|byok), algorithm(default AES-256-GCM),
+        // metadata }. tenantId auto-injected. Default keyType "data", generate keyId
+        // if absent, fold the SDK "purpose" hint into metadata (not a backend field).
+        const metadata = {
+            ...(req.metadata ?? {}),
+            ...(req.purpose ? { purpose: req.purpose } : {}),
+        };
+        const body = {
+            keyId: req.keyId ?? globalThis.crypto.randomUUID(),
+            keyType: req.keyType ?? "data",
+            metadata,
+        };
+        if (req.algorithm)
+            body["algorithm"] = req.algorithm;
+        return this.internal.request("POST", `${PATH_PREFIX}/keys`, body, opts);
+    }
+    listKeys(query) {
+        return this.internal.request("GET", `${PATH_PREFIX}/keys`, undefined, { query });
+    }
+    getKey(keyId) {
+        return this.internal.request("GET", `${PATH_PREFIX}/keys/${keyId}`);
+    }
+    rotateKey(keyId, opts) {
+        return this.internal.request("POST", `${PATH_PREFIX}/keys/${keyId}/rotate`, undefined, opts);
+    }
+    deleteKey(keyId) {
+        return this.internal.request("DELETE", `${PATH_PREFIX}/keys/${keyId}`);
+    }
+    async sign(keyId, data, opts) {
+        // Wire contract: signDataSchema = { tenantId, data(base64), algorithm? };
+        // response SignDataResponse = { keyId, signature(base64), algorithm, provider }.
+        const body = { data: encodeB64(data) };
+        const resp = await this.internal.request("POST", `${PATH_PREFIX}/keys/${keyId}/sign`, body, opts);
+        if (!resp.signature) {
+            throw new QnspApiError("kms.sign: response missing signature", 200);
+        }
+        return decodeB64(resp.signature);
+    }
+    async verify(keyId, data, signature) {
+        // Wire contract: verifySignatureSchema = { tenantId, data(base64),
+        // signature(base64), algorithm? }; response { keyId, valid, algorithm }.
+        const body = { data: encodeB64(data), signature: encodeB64(signature) };
+        const resp = await this.internal.request("POST", `${PATH_PREFIX}/keys/${keyId}/verify`, body);
+        return resp.valid === true;
+    }
+    async wrap(keyId, plaintext, opts) {
+        // Wire request contract: wrapKeySchema = { tenantId, dataKey(base64),
+        // associatedData? }. tenantId auto-injected; the value to wrap is the dataKey.
+        // NOTE: the response field is NOT yet e2e-verified against a wrap-capable key
+        // (provable-evidence-mandate) — accept either wrappedKey or ciphertextB64.
+        const body = { dataKey: encodeB64(plaintext) };
+        const resp = await this.internal.request("POST", `${PATH_PREFIX}/keys/${keyId}/wrap`, body, opts);
+        const wrapped = resp.wrappedKey ?? resp.ciphertextB64;
+        if (!wrapped) {
+            throw new QnspApiError("kms.wrap: response missing wrappedKey/ciphertextB64", 200);
+        }
+        return decodeB64(wrapped);
+    }
+    async unwrap(keyId, ciphertext, opts) {
+        // Wire request contract: unwrapKeySchema = { tenantId, wrappedKey(base64),
+        // associatedData?, providerHint? }. tenantId auto-injected.
+        // NOTE: response field NOT yet e2e-verified (provable-evidence-mandate) —
+        // accept either dataKey or plaintextB64.
+        const body = { wrappedKey: encodeB64(ciphertext) };
+        const resp = await this.internal.request("POST", `${PATH_PREFIX}/keys/${keyId}/unwrap`, body, opts);
+        const unwrapped = resp.dataKey ?? resp.plaintextB64;
+        if (!unwrapped) {
+            throw new QnspApiError("kms.unwrap: response missing dataKey/plaintextB64", 200);
+        }
+        return decodeB64(unwrapped);
+    }
+}
+function encodeB64(bytes) {
+    return Buffer.from(bytes).toString("base64");
+}
+function decodeB64(b64) {
+    return new Uint8Array(Buffer.from(b64, "base64"));
+}
+//# sourceMappingURL=kms.js.map

package/dist/kms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.js","sourceRoot":"","sources":["../src/kms.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,GAAG,eAAe,CAAC;AAgCpC,MAAM,OAAO,SAAS;IACQ;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,SAAS,CAAC,MAAwB,EAAE,EAAE,IAA6C;QAClF,iEAAiE;QACjE,uEAAuE;QACvE,6EAA6E;QAC7E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG;YAChB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;QACF,MAAM,IAAI,GAA4B;YACrC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;YAClD,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM;YAC9B,QAAQ;SACR,CAAC;QACF,IAAI,GAAG,CAAC,SAAS;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,QAAQ,CAAC,KAA+B;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,SAAS,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,SAAS,CAAC,KAAa,EAAE,IAA6C;QACrE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,SAAS,KAAK,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9F,CAAC;IAED,SAAS,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,WAAW,SAAS,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,IAAI,CACT,KAAa,EACb,IAAgB,EAChB,IAA6C;QAE7C,0EAA0E;QAC1E,iFAAiF;QACjF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,OAAO,EACnC,IAAI,EACJ,IAAI,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,YAAY,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAAgB,EAAE,SAAqB;QAClE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,SAAS,EACrC,IAAI,CACJ,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CACT,KAAa,EACb,SAAqB,EACrB,IAA6C;QAE7C,sEAAsE;QACtE,+EAA+E;QAC/E,8EAA8E;QAC9E,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,OAAO,EACnC,IAAI,EACJ,IAAI,CACJ,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,qDAAqD,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CACX,KAAa,EACb,UAAsB,EACtB,IAA6C;QAE7C,2EAA2E;QAC3E,4DAA4D;QAC5D,0EAA0E;QAC1E,yCAAyC;QACzC,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,SAAS,EACrC,IAAI,EACJ,IAAI,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;CACD;AAED,SAAS,SAAS,CAAC,KAAiB;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC7B,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/langchain/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @heossi/qnsi-langchain-qnsp
+ *
+ * LangChain tools for QNSP — governed agents with PQC-encrypted secrets,
+ * quantum-safe signing, and immutable audit trails.
+ *
+ * @example
+ * ```typescript
+ * import { QnspToolkit } from "@heossi/qnsi-langchain-qnsp";
+ *
+ * const toolkit = new QnspToolkit({ apiKey: process.env.QNSP_API_KEY });
+ * const tools = toolkit.getTools();
+ * ```
+ */
+export type { QnspToolkitConfig } from "./toolkit.js";
+export { QnspToolkit } from "./toolkit.js";
+export type { QnspAuditToolConfig } from "./tools/audit.js";
+export { QnspLogAgentActionTool } from "./tools/audit.js";
+export type { QnspKmsToolConfig } from "./tools/kms.js";
+export { QnspSignDataTool, QnspVerifySignatureTool } from "./tools/kms.js";
+export { QnspReadSecretTool, QnspRotateSecretTool, QnspWriteSecretTool } from "./tools/vault.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/langchain/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/langchain/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/langchain/index.js

@@ -0,0 +1,23 @@
+/**
+ * @heossi/qnsi-langchain-qnsp
+ *
+ * LangChain tools for QNSP — governed agents with PQC-encrypted secrets,
+ * quantum-safe signing, and immutable audit trails.
+ *
+ * @example
+ * ```typescript
+ * import { QnspToolkit } from "@heossi/qnsi-langchain-qnsp";
+ *
+ * const toolkit = new QnspToolkit({ apiKey: process.env.QNSP_API_KEY });
+ * const tools = toolkit.getTools();
+ * ```
+ */
+// Toolkit (recommended entry point)
+export { QnspToolkit } from "./toolkit.js";
+// Individual audit tools
+export { QnspLogAgentActionTool } from "./tools/audit.js";
+// Individual KMS tools
+export { QnspSignDataTool, QnspVerifySignatureTool } from "./tools/kms.js";
+// Individual vault tools
+export { QnspReadSecretTool, QnspRotateSecretTool, QnspWriteSecretTool } from "./tools/vault.js";
+//# sourceMappingURL=index.js.map