@heossi/qnsi 0.3.2

package/dist/langchain/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/langchain/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,oCAAoC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,yBAAyB;AACzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,uBAAuB;AACvB,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,yBAAyB;AACzB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/langchain/toolkit.d.ts

@@ -0,0 +1,85 @@
+/**
+ * QNSP Toolkit for LangChain
+ *
+ * A pre-configured set of QNSP tools for governed AI agents.
+ * Provides PQC-encrypted secrets, quantum-safe signing, and immutable audit trails
+ * as a single composable toolkit.
+ *
+ * @example
+ * ```typescript
+ * import { QnspToolkit } from "@heossi/qnsi-langchain-qnsp";
+ * import { ChatOpenAI } from "@langchain/openai";
+ * import { AgentExecutor, createToolCallingAgent } from "langchain/agents";
+ *
+ * const toolkit = new QnspToolkit({
+ *   apiKey: process.env.QNSP_API_KEY,
+ * });
+ *
+ * const agent = createToolCallingAgent({
+ *   llm: new ChatOpenAI({ model: "gpt-4o" }),
+ *   tools: toolkit.getTools(),
+ *   prompt,
+ * });
+ * ```
+ */
+import type { StructuredTool } from "@langchain/core/tools";
+export interface QnspToolkitConfig {
+    /**
+     * QNSP API key. Get one at https://cloud.qnsp.cuilabs.io/api-keys
+     * The API key carries the tenant ID — no separate tenantId needed.
+     */
+    readonly apiKey: string;
+    /**
+     * Tenant ID. Required for KMS and audit operations.
+     * If omitted, defaults to empty string (tenant resolved from API key by edge gateway).
+     */
+    readonly tenantId?: string;
+    /**
+     * Base URL for the QNSP API.
+     * Defaults to https://api.qnsp.cuilabs.io
+     */
+    readonly baseUrl?: string;
+    /**
+     * Request timeout in milliseconds.
+     * Defaults to 15000 (15 seconds).
+     */
+    readonly timeoutMs?: number;
+    /**
+     * Which tool categories to include.
+     * Defaults to all categories.
+     */
+    readonly include?: ReadonlyArray<"vault" | "kms" | "audit">;
+}
+/**
+ * QNSP Toolkit — a composable set of LangChain tools for governed AI agents.
+ *
+ * Provides:
+ * - Vault tools: read, write, and rotate PQC-encrypted secrets
+ * - KMS tools: sign and verify data with quantum-safe algorithms
+ * - Audit tools: write immutable, PQC-signed audit events
+ */
+export declare class QnspToolkit {
+    #private;
+    constructor(config: QnspToolkitConfig);
+    /**
+     * One-shot activation handshake against billing-service. Validates the API
+     * key, captures tenantId + tier, caches the activation token. Required:
+     * call `await toolkit.activate()` before `toolkit.getTools()` — `getTools()`
+     * throws otherwise.
+     *
+     * Idempotent — repeat calls are cheap (cached) and only re-fetch when the
+     * activation token approaches expiry.
+     */
+    activate(): Promise<void>;
+    /** Returns all configured QNSP tools for use with a LangChain agent. */
+    getTools(): StructuredTool[];
+    /** Returns only the vault tools (read, write, rotate secrets). */
+    getVaultTools(): StructuredTool[];
+    /** Returns only the KMS tools (sign, verify). */
+    getKmsTools(): StructuredTool[];
+    /** Returns only the audit tool (log agent actions). */
+    getAuditTools(): StructuredTool[];
+    /** True once `activate()` has resolved successfully. */
+    get isActivated(): boolean;
+}
+//# sourceMappingURL=toolkit.d.ts.map

package/dist/langchain/toolkit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolkit.d.ts","sourceRoot":"","sources":["../../src/langchain/toolkit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAW5D,MAAM,WAAW,iBAAiB;IACjC;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC,CAAC;CAC5D;AAED;;;;;;;GAOG;AACH,qBAAa,WAAW;;gBASX,MAAM,EAAE,iBAAiB;IAcrC;;;;;;;;OAQG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IA+B/B,wEAAwE;IACxE,QAAQ,IAAI,cAAc,EAAE;IAiB5B,kEAAkE;IAClE,aAAa,IAAI,cAAc,EAAE;IASjC,iDAAiD;IACjD,WAAW,IAAI,cAAc,EAAE;IAW/B,uDAAuD;IACvD,aAAa,IAAI,cAAc,EAAE;IAWjC,wDAAwD;IACxD,IAAI,WAAW,IAAI,OAAO,CAEzB;CACD"}

package/dist/langchain/toolkit.js

@@ -0,0 +1,146 @@
+/**
+ * QNSP Toolkit for LangChain
+ *
+ * A pre-configured set of QNSP tools for governed AI agents.
+ * Provides PQC-encrypted secrets, quantum-safe signing, and immutable audit trails
+ * as a single composable toolkit.
+ *
+ * @example
+ * ```typescript
+ * import { QnspToolkit } from "@heossi/qnsi-langchain-qnsp";
+ * import { ChatOpenAI } from "@langchain/openai";
+ * import { AgentExecutor, createToolCallingAgent } from "langchain/agents";
+ *
+ * const toolkit = new QnspToolkit({
+ *   apiKey: process.env.QNSP_API_KEY,
+ * });
+ *
+ * const agent = createToolCallingAgent({
+ *   llm: new ChatOpenAI({ model: "gpt-4o" }),
+ *   tools: toolkit.getTools(),
+ *   prompt,
+ * });
+ * ```
+ */
+import { activateSdk } from "../_activation/index.js";
+import { QnspLogAgentActionTool } from "./tools/audit.js";
+import { QnspSignDataTool, QnspVerifySignatureTool } from "./tools/kms.js";
+import { QnspReadSecretTool, QnspRotateSecretTool, QnspWriteSecretTool } from "./tools/vault.js";
+import { VaultClient } from "./vault-client.js";
+const SDK_VERSION = "0.3.0";
+/**
+ * QNSP Toolkit — a composable set of LangChain tools for governed AI agents.
+ *
+ * Provides:
+ * - Vault tools: read, write, and rotate PQC-encrypted secrets
+ * - KMS tools: sign and verify data with quantum-safe algorithms
+ * - Audit tools: write immutable, PQC-signed audit events
+ */
+export class QnspToolkit {
+    #apiKey;
+    #tenantId;
+    #baseUrl;
+    #timeoutMs;
+    #include;
+    #vaultClient;
+    #activated = false;
+    constructor(config) {
+        this.#apiKey = config.apiKey;
+        this.#tenantId = config.tenantId ?? "";
+        this.#baseUrl = config.baseUrl ?? "https://api.qnsp.cuilabs.io";
+        this.#timeoutMs = config.timeoutMs ?? 15_000;
+        this.#include = config.include ?? ["vault", "kms", "audit"];
+        this.#vaultClient = new VaultClient({
+            baseUrl: this.#baseUrl,
+            apiKey: this.#apiKey,
+            timeoutMs: this.#timeoutMs,
+        });
+    }
+    /**
+     * One-shot activation handshake against billing-service. Validates the API
+     * key, captures tenantId + tier, caches the activation token. Required:
+     * call `await toolkit.activate()` before `toolkit.getTools()` — `getTools()`
+     * throws otherwise.
+     *
+     * Idempotent — repeat calls are cheap (cached) and only re-fetch when the
+     * activation token approaches expiry.
+     */
+    async activate() {
+        const activation = await activateSdk({
+            apiKey: this.#apiKey,
+            sdkId: "langchain-qnsp",
+            sdkVersion: SDK_VERSION,
+            platformUrl: this.#baseUrl,
+        });
+        // If the caller did not specify tenantId, inherit it from activation
+        // so KMS and audit tools have a tenant-scoped header without an extra
+        // constructor argument.
+        if (this.#tenantId === "") {
+            this.#tenantId = activation.tenantId;
+        }
+        // Inject the resolved tenant into the inlined vault client so its
+        // requests carry the x-qnsp-tenant-id header (the former
+        // @heossi/qnsi-vault-sdk did this via its own internal activation;
+        // here the single langchain-qnsp activation covers it).
+        this.#vaultClient.setTenantId(this.#tenantId);
+        this.#activated = true;
+    }
+    #assertActivated() {
+        if (!this.#activated) {
+            throw new Error("@heossi/qnsi-langchain-qnsp: call `await toolkit.activate()` once before `getTools()`. " +
+                "This validates your QNSP API key and resolves the tenant ID. " +
+                "Free signup (no credit card): https://cloud.qnsp.cuilabs.io/auth");
+        }
+    }
+    /** Returns all configured QNSP tools for use with a LangChain agent. */
+    getTools() {
+        this.#assertActivated();
+        const tools = [];
+        if (this.#include.includes("vault")) {
+            tools.push(...this.getVaultTools());
+        }
+        if (this.#include.includes("kms")) {
+            tools.push(...this.getKmsTools());
+        }
+        if (this.#include.includes("audit")) {
+            tools.push(...this.getAuditTools());
+        }
+        return tools;
+    }
+    /** Returns only the vault tools (read, write, rotate secrets). */
+    getVaultTools() {
+        this.#assertActivated();
+        return [
+            new QnspReadSecretTool(this.#vaultClient),
+            new QnspWriteSecretTool(this.#vaultClient),
+            new QnspRotateSecretTool(this.#vaultClient),
+        ];
+    }
+    /** Returns only the KMS tools (sign, verify). */
+    getKmsTools() {
+        this.#assertActivated();
+        const kmsConfig = {
+            baseUrl: this.#baseUrl,
+            apiKey: this.#apiKey,
+            tenantId: this.#tenantId,
+            timeoutMs: this.#timeoutMs,
+        };
+        return [new QnspSignDataTool(kmsConfig), new QnspVerifySignatureTool(kmsConfig)];
+    }
+    /** Returns only the audit tool (log agent actions). */
+    getAuditTools() {
+        this.#assertActivated();
+        const auditConfig = {
+            baseUrl: this.#baseUrl,
+            apiKey: this.#apiKey,
+            tenantId: this.#tenantId,
+            timeoutMs: this.#timeoutMs,
+        };
+        return [new QnspLogAgentActionTool(auditConfig)];
+    }
+    /** True once `activate()` has resolved successfully. */
+    get isActivated() {
+        return this.#activated;
+    }
+}
+//# sourceMappingURL=toolkit.js.map

package/dist/langchain/toolkit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolkit.js","sourceRoot":"","sources":["../../src/langchain/toolkit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,WAAW,GAAG,OAAO,CAAC;AA8B5B;;;;;;;GAOG;AACH,MAAM,OAAO,WAAW;IACd,OAAO,CAAS;IACzB,SAAS,CAAS;IACT,QAAQ,CAAS;IACjB,UAAU,CAAS;IACnB,QAAQ,CAA2C;IACnD,YAAY,CAAc;IACnC,UAAU,GAAY,KAAK,CAAC;IAE5B,YAAY,MAAyB;QACpC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,6BAA6B,CAAC;QAChE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,YAAY,GAAG,IAAI,WAAW,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,SAAS,EAAE,IAAI,CAAC,UAAU;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ;QACb,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,KAAK,EAAE,gBAAgB;YACvB,UAAU,EAAE,WAAW;YACvB,WAAW,EAAE,IAAI,CAAC,QAAQ;SAC1B,CAAC,CAAC;QACH,qEAAqE;QACrE,sEAAsE;QACtE,wBAAwB;QACxB,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC;QACtC,CAAC;QACD,kEAAkE;QAClE,yDAAyD;QACzD,mEAAmE;QACnE,wDAAwD;QACxD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,gBAAgB;QACf,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACd,yFAAyF;gBACxF,+DAA+D;gBAC/D,kEAAkE,CACnE,CAAC;QACH,CAAC;IACF,CAAC;IAED,wEAAwE;IACxE,QAAQ;QACP,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,MAAM,KAAK,GAAqB,EAAE,CAAC;QAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,OAAO,KAAK,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,aAAa;QACZ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,OAAO;YACN,IAAI,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC;YACzC,IAAI,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC;YAC1C,IAAI,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC;SAC3C,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,WAAW;QACV,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,MAAM,SAAS,GAAsB;YACpC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS,EAAE,IAAI,CAAC,UAAU;SAC1B,CAAC;QACF,OAAO,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,EAAE,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,uDAAuD;IACvD,aAAa;QACZ,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,MAAM,WAAW,GAAwB;YACxC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS,EAAE,IAAI,CAAC,UAAU;SAC1B,CAAC;QACF,OAAO,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,wDAAwD;IACxD,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,UAAU,CAAC;IACxB,CAAC;CACD"}

package/dist/langchain/tools/audit.d.ts

@@ -0,0 +1,43 @@
+/**
+ * QNSP Audit Tool for LangChain
+ *
+ * Provides governed agents with immutable, PQC-signed audit trail logging.
+ * Every agent action logged here is tamper-evident and cryptographically chained.
+ */
+import { StructuredTool, type ToolParams } from "@langchain/core/tools";
+import { z } from "zod";
+export interface QnspAuditToolConfig {
+    /** Base URL for the QNSP API (e.g. https://api.qnsp.cuilabs.io) */
+    readonly baseUrl: string;
+    /** API key or Bearer token for authentication */
+    readonly apiKey: string;
+    /** Tenant ID for all audit events */
+    readonly tenantId: string;
+    /** Request timeout in milliseconds (default: 15000) */
+    readonly timeoutMs?: number;
+}
+declare const logAgentActionSchema: z.ZodObject<{
+    topic: z.ZodString;
+    sourceService: z.ZodString;
+    payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+/**
+ * LangChain tool that writes an immutable, PQC-signed audit event to QNSP.
+ * Use this to create a tamper-evident record of every significant agent action.
+ */
+export declare class QnspLogAgentActionTool extends StructuredTool {
+    #private;
+    readonly name = "qnsp_log_agent_action";
+    readonly description = "Write an immutable, PQC-signed audit event to QNSP. Creates a tamper-evident record of agent actions, decisions, tool calls, and outputs. Use this for compliance, governance, and traceability of agent behavior.";
+    readonly schema: z.ZodObject<{
+        topic: z.ZodString;
+        sourceService: z.ZodString;
+        payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>;
+    constructor(config: QnspAuditToolConfig, fields?: ToolParams);
+    protected _call(input: z.infer<typeof logAgentActionSchema>): Promise<string>;
+}
+export {};
+//# sourceMappingURL=audit.d.ts.map

package/dist/langchain/tools/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/langchain/tools/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,mBAAmB;IACnC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID,QAAA,MAAM,oBAAoB;;;;;iBAsBxB,CAAC;AAEH;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,cAAc;;IACzD,SAAkB,IAAI,2BAA2B;IACjD,SAAkB,WAAW,wNACyL;IACtN,SAAkB,MAAM;;;;;sBAAwB;gBAIpC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAAE,UAAU;cAK5C,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAwCnF"}

package/dist/langchain/tools/audit.js

@@ -0,0 +1,78 @@
+/**
+ * QNSP Audit Tool for LangChain
+ *
+ * Provides governed agents with immutable, PQC-signed audit trail logging.
+ * Every agent action logged here is tamper-evident and cryptographically chained.
+ */
+import { StructuredTool } from "@langchain/core/tools";
+import { z } from "zod";
+// ─── Log Agent Action ─────────────────────────────────────────────────────────
+const logAgentActionSchema = z.object({
+    topic: z
+        .string()
+        .min(1)
+        .max(255)
+        .describe("The audit topic / event type (e.g. 'agent.decision', 'agent.tool_call', 'agent.output')"),
+    sourceService: z
+        .string()
+        .min(1)
+        .max(255)
+        .describe("The name of the agent or service emitting this event (e.g. 'research-agent')"),
+    payload: z
+        .record(z.string(), z.unknown())
+        .describe("Structured data describing the action — what the agent did, inputs, outputs, reasoning"),
+    metadata: z
+        .record(z.string(), z.unknown())
+        .optional()
+        .describe("Optional metadata: run ID, model name, token counts, latency, etc."),
+});
+/**
+ * LangChain tool that writes an immutable, PQC-signed audit event to QNSP.
+ * Use this to create a tamper-evident record of every significant agent action.
+ */
+export class QnspLogAgentActionTool extends StructuredTool {
+    name = "qnsp_log_agent_action";
+    description = "Write an immutable, PQC-signed audit event to QNSP. Creates a tamper-evident record of agent actions, decisions, tool calls, and outputs. Use this for compliance, governance, and traceability of agent behavior.";
+    schema = logAgentActionSchema;
+    #config;
+    constructor(config, fields) {
+        super(fields);
+        this.#config = { timeoutMs: 15_000, ...config };
+    }
+    async _call(input) {
+        const url = `${this.#config.baseUrl}/proxy/audit/v1/events`;
+        const event = {
+            tenantId: this.#config.tenantId,
+            sourceService: input.sourceService,
+            topic: input.topic,
+            version: "1.0",
+            payload: input.payload,
+        };
+        if (input.metadata !== undefined) {
+            event["metadata"] = input.metadata;
+        }
+        const response = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${this.#config.apiKey}`,
+                "x-qnsp-tenant-id": this.#config.tenantId,
+            },
+            body: JSON.stringify({ events: [event] }),
+            signal: AbortSignal.timeout(this.#config.timeoutMs),
+        });
+        if (!response.ok) {
+            const err = (await response.json().catch(() => ({})));
+            throw new Error(`Audit ingest failed (${response.status}): ${String(err["message"] ?? "unknown error")}`);
+        }
+        const result = (await response.json());
+        return JSON.stringify({
+            accepted: result["accepted"],
+            received: result["received"],
+            topic: input.topic,
+            sourceService: input.sourceService,
+            loggedAt: new Date().toISOString(),
+        });
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/langchain/tools/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/langchain/tools/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAmB,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,iFAAiF;AAEjF,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CACR,yFAAyF,CACzF;IACF,aAAa,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CAAC,8EAA8E,CAAC;IAC1F,OAAO,EAAE,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC/B,QAAQ,CACR,wFAAwF,CACxF;IACF,QAAQ,EAAE,CAAC;SACT,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC/B,QAAQ,EAAE;SACV,QAAQ,CAAC,oEAAoE,CAAC;CAChF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,OAAO,sBAAuB,SAAQ,cAAc;IACvC,IAAI,GAAG,uBAAuB,CAAC;IAC/B,WAAW,GAC5B,oNAAoN,CAAC;IACpM,MAAM,GAAG,oBAAoB,CAAC;IAEvC,OAAO,CAAgC;IAEhD,YAAY,MAA2B,EAAE,MAAmB;QAC3D,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACjD,CAAC;IAES,KAAK,CAAC,KAAK,CAAC,KAA2C;QAChE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,wBAAwB,CAAC;QAC5D,MAAM,KAAK,GAA4B;YACtC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC;QACF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAC9C,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;YACjF,MAAM,IAAI,KAAK,CACd,wBAAwB,QAAQ,CAAC,MAAM,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,EAAE,CACxF,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,OAAO,IAAI,CAAC,SAAS,CAAC;YACrB,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;YAC5B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC,CAAC;IACJ,CAAC;CACD"}

package/dist/langchain/tools/kms.d.ts

@@ -0,0 +1,62 @@
+/**
+ * QNSP KMS Tools for LangChain
+ *
+ * Provides governed agents with quantum-safe signing and key operations.
+ * Uses ML-DSA (FIPS 204), SLH-DSA (FIPS 205), and FN-DSA for signatures.
+ */
+import { StructuredTool, type ToolParams } from "@langchain/core/tools";
+import { z } from "zod";
+export interface QnspKmsToolConfig {
+    /** Base URL for the QNSP API (e.g. https://api.qnsp.cuilabs.io) */
+    readonly baseUrl: string;
+    /** API key or Bearer token for authentication */
+    readonly apiKey: string;
+    /** Tenant ID for all KMS operations */
+    readonly tenantId: string;
+    /** Request timeout in milliseconds (default: 15000) */
+    readonly timeoutMs?: number;
+}
+declare const signDataSchema: z.ZodObject<{
+    keyId: z.ZodString;
+    data: z.ZodString;
+    context: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * LangChain tool that signs data with a PQC key (ML-DSA / SLH-DSA / FN-DSA).
+ */
+export declare class QnspSignDataTool extends StructuredTool {
+    #private;
+    readonly name = "qnsp_sign_data";
+    readonly description = "Sign data with a quantum-safe PQC key (ML-DSA, SLH-DSA, or FN-DSA). Returns a base64-encoded signature. Use this when an agent needs to cryptographically attest to data it produced or decisions it made.";
+    readonly schema: z.ZodObject<{
+        keyId: z.ZodString;
+        data: z.ZodString;
+        context: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    constructor(config: QnspKmsToolConfig, fields?: ToolParams);
+    protected _call(input: z.infer<typeof signDataSchema>): Promise<string>;
+}
+declare const verifySignatureSchema: z.ZodObject<{
+    keyId: z.ZodString;
+    data: z.ZodString;
+    signature: z.ZodString;
+    context: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * LangChain tool that verifies a PQC signature against data and a key.
+ */
+export declare class QnspVerifySignatureTool extends StructuredTool {
+    #private;
+    readonly name = "qnsp_verify_signature";
+    readonly description = "Verify a quantum-safe PQC signature. Returns true/false and the algorithm used. Use this when an agent needs to verify the authenticity of data or attestations from other agents or services.";
+    readonly schema: z.ZodObject<{
+        keyId: z.ZodString;
+        data: z.ZodString;
+        signature: z.ZodString;
+        context: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    constructor(config: QnspKmsToolConfig, fields?: ToolParams);
+    protected _call(input: z.infer<typeof verifySignatureSchema>): Promise<string>;
+}
+export {};
+//# sourceMappingURL=kms.d.ts.map

package/dist/langchain/tools/kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../../src/langchain/tools/kms.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,iBAAiB;IACjC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAID,QAAA,MAAM,cAAc;;;;iBAUlB,CAAC;AAEH;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,cAAc;;IACnD,SAAkB,IAAI,oBAAoB;IAC1C,SAAkB,WAAW,gNACiL;IAC9M,SAAkB,MAAM;;;;sBAAkB;gBAI9B,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,UAAU;cAK1C,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAoC7E;AAID,QAAA,MAAM,qBAAqB;;;;;iBAQzB,CAAC;AAEH;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,cAAc;;IAC1D,SAAkB,IAAI,2BAA2B;IACjD,SAAkB,WAAW,oMACqK;IAClM,SAAkB,MAAM;;;;;sBAAyB;gBAIrC,MAAM,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,UAAU;cAK1C,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAqCpF"}

package/dist/langchain/tools/kms.js

@@ -0,0 +1,120 @@
+/**
+ * QNSP KMS Tools for LangChain
+ *
+ * Provides governed agents with quantum-safe signing and key operations.
+ * Uses ML-DSA (FIPS 204), SLH-DSA (FIPS 205), and FN-DSA for signatures.
+ */
+import { StructuredTool } from "@langchain/core/tools";
+import { z } from "zod";
+// ─── Sign Data ────────────────────────────────────────────────────────────────
+const signDataSchema = z.object({
+    keyId: z.string().min(1).describe("The UUID of the PQC signing key to use"),
+    data: z
+        .string()
+        .min(1)
+        .describe("The data to sign, base64-encoded (e.g. btoa(JSON.stringify(payload)))"),
+    context: z
+        .string()
+        .optional()
+        .describe("Optional context string for domain separation (base64-encoded)"),
+});
+/**
+ * LangChain tool that signs data with a PQC key (ML-DSA / SLH-DSA / FN-DSA).
+ */
+export class QnspSignDataTool extends StructuredTool {
+    name = "qnsp_sign_data";
+    description = "Sign data with a quantum-safe PQC key (ML-DSA, SLH-DSA, or FN-DSA). Returns a base64-encoded signature. Use this when an agent needs to cryptographically attest to data it produced or decisions it made.";
+    schema = signDataSchema;
+    #config;
+    constructor(config, fields) {
+        super(fields);
+        this.#config = { timeoutMs: 15_000, ...config };
+    }
+    async _call(input) {
+        const url = `${this.#config.baseUrl}/proxy/kms/v1/keys/${encodeURIComponent(input.keyId)}/sign`;
+        const body = {
+            tenantId: this.#config.tenantId,
+            data: input.data,
+        };
+        if (input.context !== undefined) {
+            body["context"] = input.context;
+        }
+        const response = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${this.#config.apiKey}`,
+                "x-qnsp-tenant-id": this.#config.tenantId,
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(this.#config.timeoutMs),
+        });
+        if (!response.ok) {
+            const err = (await response.json().catch(() => ({})));
+            throw new Error(`KMS sign failed (${response.status}): ${String(err["message"] ?? "unknown error")}`);
+        }
+        const result = (await response.json());
+        return JSON.stringify({
+            keyId: input.keyId,
+            signature: result["signature"],
+            algorithm: result["algorithm"],
+            signedAt: new Date().toISOString(),
+        });
+    }
+}
+// ─── Verify Signature ─────────────────────────────────────────────────────────
+const verifySignatureSchema = z.object({
+    keyId: z.string().min(1).describe("The UUID of the PQC key used to create the signature"),
+    data: z.string().min(1).describe("The original data that was signed, base64-encoded"),
+    signature: z.string().min(1).describe("The signature to verify, base64-encoded"),
+    context: z
+        .string()
+        .optional()
+        .describe("Optional context string used during signing (base64-encoded)"),
+});
+/**
+ * LangChain tool that verifies a PQC signature against data and a key.
+ */
+export class QnspVerifySignatureTool extends StructuredTool {
+    name = "qnsp_verify_signature";
+    description = "Verify a quantum-safe PQC signature. Returns true/false and the algorithm used. Use this when an agent needs to verify the authenticity of data or attestations from other agents or services.";
+    schema = verifySignatureSchema;
+    #config;
+    constructor(config, fields) {
+        super(fields);
+        this.#config = { timeoutMs: 15_000, ...config };
+    }
+    async _call(input) {
+        const url = `${this.#config.baseUrl}/proxy/kms/v1/keys/${encodeURIComponent(input.keyId)}/verify`;
+        const body = {
+            tenantId: this.#config.tenantId,
+            data: input.data,
+            signature: input.signature,
+        };
+        if (input.context !== undefined) {
+            body["context"] = input.context;
+        }
+        const response = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${this.#config.apiKey}`,
+                "x-qnsp-tenant-id": this.#config.tenantId,
+            },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(this.#config.timeoutMs),
+        });
+        if (!response.ok) {
+            const err = (await response.json().catch(() => ({})));
+            throw new Error(`KMS verify failed (${response.status}): ${String(err["message"] ?? "unknown error")}`);
+        }
+        const result = (await response.json());
+        return JSON.stringify({
+            keyId: input.keyId,
+            valid: result["valid"],
+            algorithm: result["algorithm"],
+            verifiedAt: new Date().toISOString(),
+        });
+    }
+}
+//# sourceMappingURL=kms.js.map

package/dist/langchain/tools/kms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.js","sourceRoot":"","sources":["../../../src/langchain/tools/kms.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAmB,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,iFAAiF;AAEjF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAC3E,IAAI,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,uEAAuE,CAAC;IACnF,OAAO,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;CAC5E,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,OAAO,gBAAiB,SAAQ,cAAc;IACjC,IAAI,GAAG,gBAAgB,CAAC;IACxB,WAAW,GAC5B,4MAA4M,CAAC;IAC5L,MAAM,GAAG,cAAc,CAAC;IAEjC,OAAO,CAA8B;IAE9C,YAAY,MAAyB,EAAE,MAAmB;QACzD,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACjD,CAAC;IAES,KAAK,CAAC,KAAK,CAAC,KAAqC;QAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QAChG,MAAM,IAAI,GAA2B;YACpC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;SAChB,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACjC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAC9C,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;YACjF,MAAM,IAAI,KAAK,CACd,oBAAoB,QAAQ,CAAC,MAAM,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,EAAE,CACpF,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,OAAO,IAAI,CAAC,SAAS,CAAC;YACrB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;YAC9B,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;YAC9B,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAClC,CAAC,CAAC;IACJ,CAAC;CACD;AAED,iFAAiF;AAEjF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;IACzF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mDAAmD,CAAC;IACrF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAChF,OAAO,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,8DAA8D,CAAC;CAC1E,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,OAAO,uBAAwB,SAAQ,cAAc;IACxC,IAAI,GAAG,uBAAuB,CAAC;IAC/B,WAAW,GAC5B,gMAAgM,CAAC;IAChL,MAAM,GAAG,qBAAqB,CAAC;IAExC,OAAO,CAA8B;IAE9C,YAAY,MAAyB,EAAE,MAAmB;QACzD,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACjD,CAAC;IAES,KAAK,CAAC,KAAK,CAAC,KAA4C;QACjE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAClG,MAAM,IAAI,GAA2B;YACpC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC1B,CAAC;QACF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QACjC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAC9C,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;YACjF,MAAM,IAAI,KAAK,CACd,sBAAsB,QAAQ,CAAC,MAAM,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,EAAE,CACtF,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAClE,OAAO,IAAI,CAAC,SAAS,CAAC;YACrB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;YACtB,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC;YAC9B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACJ,CAAC;CACD"}

package/dist/langchain/tools/vault.d.ts

@@ -0,0 +1,69 @@
+/**
+ * QNSP Vault Tools for LangChain
+ *
+ * Provides governed agents with PQC-encrypted secret storage.
+ * Every read and write is automatically audited via the QNSP audit trail.
+ */
+import { StructuredTool, type ToolParams } from "@langchain/core/tools";
+import { z } from "zod";
+import type { VaultClient } from "../vault-client.js";
+declare const readSecretSchema: z.ZodObject<{
+    secretId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * LangChain tool that reads a PQC-encrypted secret from QNSP Vault.
+ */
+export declare class QnspReadSecretTool extends StructuredTool {
+    #private;
+    readonly name = "qnsp_read_secret";
+    readonly description = "Read a PQC-encrypted secret from QNSP Vault. Returns the secret name and encrypted envelope. Use this when an agent needs to retrieve a stored credential, API key, or sensitive value.";
+    readonly schema: z.ZodObject<{
+        secretId: z.ZodString;
+    }, z.core.$strip>;
+    constructor(vault: VaultClient, fields?: ToolParams);
+    protected _call(input: z.infer<typeof readSecretSchema>): Promise<string>;
+}
+declare const writeSecretSchema: z.ZodObject<{
+    tenantId: z.ZodString;
+    name: z.ZodString;
+    payload: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * LangChain tool that stores a PQC-encrypted secret in QNSP Vault.
+ */
+export declare class QnspWriteSecretTool extends StructuredTool {
+    #private;
+    readonly name = "qnsp_write_secret";
+    readonly description = "Store a PQC-encrypted secret in QNSP Vault. The payload must be base64-encoded. Returns the created secret ID. Use this when an agent needs to persist a credential, token, or sensitive value securely.";
+    readonly schema: z.ZodObject<{
+        tenantId: z.ZodString;
+        name: z.ZodString;
+        payload: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    constructor(vault: VaultClient, fields?: ToolParams);
+    protected _call(input: z.infer<typeof writeSecretSchema>): Promise<string>;
+}
+declare const rotateSecretSchema: z.ZodObject<{
+    secretId: z.ZodString;
+    tenantId: z.ZodString;
+    newPayload: z.ZodString;
+}, z.core.$strip>;
+/**
+ * LangChain tool that rotates a secret in QNSP Vault with a new value.
+ */
+export declare class QnspRotateSecretTool extends StructuredTool {
+    #private;
+    readonly name = "qnsp_rotate_secret";
+    readonly description = "Rotate a secret in QNSP Vault with a new PQC-encrypted value. The previous version is retained for rollback. Use this when an agent needs to update a credential after rotation.";
+    readonly schema: z.ZodObject<{
+        secretId: z.ZodString;
+        tenantId: z.ZodString;
+        newPayload: z.ZodString;
+    }, z.core.$strip>;
+    constructor(vault: VaultClient, fields?: ToolParams);
+    protected _call(input: z.infer<typeof rotateSecretSchema>): Promise<string>;
+}
+export {};
+//# sourceMappingURL=vault.d.ts.map

package/dist/langchain/tools/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/langchain/tools/vault.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAItD,QAAA,MAAM,gBAAgB;;iBAEpB,CAAC;AAEH;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,cAAc;;IACrD,SAAkB,IAAI,sBAAsB;IAC5C,SAAkB,WAAW,6LAC8J;IAC3L,SAAkB,MAAM;;sBAAoB;gBAIhC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,UAAU;cAKnC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAW/E;AAID,QAAA,MAAM,iBAAiB;;;;;iBAQrB,CAAC;AAEH;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,cAAc;;IACtD,SAAkB,IAAI,uBAAuB;IAC7C,SAAkB,WAAW,8MAC+K;IAC5M,SAAkB,MAAM;;;;;sBAAqB;gBAIjC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,UAAU;cAKnC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAehF;AAID,QAAA,MAAM,kBAAkB;;;;iBAItB,CAAC;AAEH;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,cAAc;;IACvD,SAAkB,IAAI,wBAAwB;IAC9C,SAAkB,WAAW,sLACuJ;IACpL,SAAkB,MAAM;;;;sBAAsB;gBAIlC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,UAAU;cAKnC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAajF"}