@heossi/qnsi 0.3.2

package/dist/langchain/tools/vault.js

@@ -0,0 +1,107 @@
+/**
+ * QNSP Vault Tools for LangChain
+ *
+ * Provides governed agents with PQC-encrypted secret storage.
+ * Every read and write is automatically audited via the QNSP audit trail.
+ */
+import { StructuredTool } from "@langchain/core/tools";
+import { z } from "zod";
+// ─── Read Secret ─────────────────────────────────────────────────────────────
+const readSecretSchema = z.object({
+    secretId: z.string().min(1).describe("The UUID of the secret to read"),
+});
+/**
+ * LangChain tool that reads a PQC-encrypted secret from QNSP Vault.
+ */
+export class QnspReadSecretTool extends StructuredTool {
+    name = "qnsp_read_secret";
+    description = "Read a PQC-encrypted secret from QNSP Vault. Returns the secret name and encrypted envelope. Use this when an agent needs to retrieve a stored credential, API key, or sensitive value.";
+    schema = readSecretSchema;
+    #vault;
+    constructor(vault, fields) {
+        super(fields);
+        this.#vault = vault;
+    }
+    async _call(input) {
+        const secret = await this.#vault.getSecret(input.secretId);
+        return JSON.stringify({
+            id: secret.id,
+            name: secret.name,
+            tenantId: secret.tenantId,
+            version: secret.version,
+            algorithm: secret.pqc?.algorithm ?? secret.envelope.algorithm,
+            createdAt: secret.createdAt,
+        });
+    }
+}
+// ─── Write Secret ─────────────────────────────────────────────────────────────
+const writeSecretSchema = z.object({
+    tenantId: z.string().min(1).describe("The tenant ID that will own the secret"),
+    name: z.string().min(1).max(255).describe("A human-readable name for the secret"),
+    payload: z
+        .string()
+        .min(1)
+        .describe("The secret value to store, base64-encoded (e.g. btoa('my-api-key'))"),
+    description: z.string().max(1000).optional().describe("Optional description stored in metadata"),
+});
+/**
+ * LangChain tool that stores a PQC-encrypted secret in QNSP Vault.
+ */
+export class QnspWriteSecretTool extends StructuredTool {
+    name = "qnsp_write_secret";
+    description = "Store a PQC-encrypted secret in QNSP Vault. The payload must be base64-encoded. Returns the created secret ID. Use this when an agent needs to persist a credential, token, or sensitive value securely.";
+    schema = writeSecretSchema;
+    #vault;
+    constructor(vault, fields) {
+        super(fields);
+        this.#vault = vault;
+    }
+    async _call(input) {
+        const secret = await this.#vault.createSecret({
+            tenantId: input.tenantId,
+            name: input.name,
+            payload: input.payload,
+            ...(input.description !== undefined ? { metadata: { description: input.description } } : {}),
+        });
+        return JSON.stringify({
+            id: secret.id,
+            name: secret.name,
+            tenantId: secret.tenantId,
+            algorithm: secret.pqc?.algorithm ?? secret.envelope.algorithm,
+            createdAt: secret.createdAt,
+        });
+    }
+}
+// ─── Rotate Secret ────────────────────────────────────────────────────────────
+const rotateSecretSchema = z.object({
+    secretId: z.string().min(1).describe("The UUID of the secret to rotate"),
+    tenantId: z.string().min(1).describe("The tenant ID that owns the secret"),
+    newPayload: z.string().min(1).describe("The new secret value, base64-encoded"),
+});
+/**
+ * LangChain tool that rotates a secret in QNSP Vault with a new value.
+ */
+export class QnspRotateSecretTool extends StructuredTool {
+    name = "qnsp_rotate_secret";
+    description = "Rotate a secret in QNSP Vault with a new PQC-encrypted value. The previous version is retained for rollback. Use this when an agent needs to update a credential after rotation.";
+    schema = rotateSecretSchema;
+    #vault;
+    constructor(vault, fields) {
+        super(fields);
+        this.#vault = vault;
+    }
+    async _call(input) {
+        const secret = await this.#vault.rotateSecret(input.secretId, {
+            tenantId: input.tenantId,
+            newPayload: input.newPayload,
+        });
+        return JSON.stringify({
+            id: secret.id,
+            name: secret.name,
+            version: secret.version,
+            algorithm: secret.pqc?.algorithm ?? secret.envelope.algorithm,
+            rotatedAt: secret.updatedAt,
+        });
+    }
+}
+//# sourceMappingURL=vault.js.map

package/dist/langchain/tools/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../../src/langchain/tools/vault.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAmB,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,gCAAgC,CAAC;CACtE,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACnC,IAAI,GAAG,kBAAkB,CAAC;IAC1B,WAAW,GAC5B,yLAAyL,CAAC;IACzK,MAAM,GAAG,gBAAgB,CAAC;IAEnC,MAAM,CAAc;IAE7B,YAAY,KAAkB,EAAE,MAAmB;QAClD,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,CAAC;IAES,KAAK,CAAC,KAAK,CAAC,KAAuC;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS;YAC7D,SAAS,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,CAAC;IACJ,CAAC;CACD;AAED,iFAAiF;AAEjF,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;IAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IACjF,OAAO,EAAE,CAAC;SACR,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,qEAAqE,CAAC;IACjF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;CAChG,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IACpC,IAAI,GAAG,mBAAmB,CAAC;IAC3B,WAAW,GAC5B,0MAA0M,CAAC;IAC1L,MAAM,GAAG,iBAAiB,CAAC;IAEpC,MAAM,CAAc;IAE7B,YAAY,KAAkB,EAAE,MAAmB;QAClD,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,CAAC;IAES,KAAK,CAAC,KAAK,CAAC,KAAwC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC7C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS;YAC7D,SAAS,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,CAAC;IACJ,CAAC;CACD;AAED,iFAAiF;AAEjF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;CAC9E,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,cAAc;IACrC,IAAI,GAAG,oBAAoB,CAAC;IAC5B,WAAW,GAC5B,kLAAkL,CAAC;IAClK,MAAM,GAAG,kBAAkB,CAAC;IAErC,MAAM,CAAc;IAE7B,YAAY,KAAkB,EAAE,MAAmB;QAClD,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACrB,CAAC;IAES,KAAK,CAAC,KAAK,CAAC,KAAyC;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC7D,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS;YAC7D,SAAS,EAAE,MAAM,CAAC,SAAS;SAC3B,CAAC,CAAC;IACJ,CAAC;CACD"}

package/dist/langchain/vault-client.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Minimal QNSP Vault client — `@heossi/qnsi/langchain` subpath.
+ *
+ * Faithful inline of the `getSecret` / `createSecret` / `rotateSecret` slice of
+ * the former `@heossi/qnsi-vault-sdk` `VaultClient` (2026-05-16
+ * consolidation): Bearer auth, `x-qnsp-tenant-id` header, 429 retry with
+ * exponential backoff + `Retry-After`, per-request timeout, `Vault API
+ * error: <status> <statusText>` on failure. Endpoints and request/response
+ * shapes are byte-for-byte preserved. Activation is owned by `QnspToolkit`
+ * (single `langchain-qnsp` handshake); the resolved tenant id is injected via
+ * {@link VaultClient.setTenantId} — so this subpath has no `@heossi/qnsi-*`
+ * workspace dependency (same pattern as `../_activation`).
+ */
+export interface VaultClientConfig {
+    readonly baseUrl?: string;
+    readonly apiKey: string;
+    readonly timeoutMs?: number;
+    readonly maxRetries?: number;
+    readonly retryDelayMs?: number;
+}
+export interface RotationPolicy {
+    /** When false the secret is never auto-rotated (static / not opted in). */
+    readonly enabled: boolean;
+    readonly intervalSeconds: number;
+    readonly expiresAt: number | null;
+}
+export interface RotationPolicyInput {
+    readonly enabled?: boolean;
+    readonly intervalSeconds?: number;
+    readonly expiresAt?: number;
+}
+export interface SecretEnvelope {
+    readonly encrypted: string;
+    readonly algorithm: string;
+    readonly keyId?: string;
+}
+export interface VaultSecretPqcMetadata {
+    readonly provider: string;
+    readonly algorithm: string;
+    readonly algorithmNist?: string;
+    readonly keyId: string;
+}
+export interface Secret {
+    readonly id: string;
+    readonly name: string;
+    readonly tenantId: string;
+    readonly version: number;
+    readonly metadata: Record<string, unknown>;
+    readonly rotationPolicy: RotationPolicy;
+    readonly checksum: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly versionCreatedAt: string;
+    readonly envelope: SecretEnvelope;
+    readonly pqc?: VaultSecretPqcMetadata;
+}
+export interface CreateSecretRequest {
+    readonly tenantId?: string;
+    readonly name: string;
+    readonly payload: string;
+    readonly metadata?: Record<string, unknown>;
+    readonly rotationPolicy?: RotationPolicyInput;
+}
+export interface RotateSecretRequest {
+    readonly tenantId: string;
+    readonly newPayload?: string;
+    readonly metadata?: Record<string, unknown>;
+    readonly rotationPolicy?: RotationPolicyInput;
+}
+export declare class VaultClient {
+    #private;
+    constructor(config: VaultClientConfig);
+    /** Inject the activation-resolved tenant id (sent as `x-qnsp-tenant-id`). */
+    setTenantId(tenantId: string): void;
+    /** Create a new secret. Payload must be base64-encoded. */
+    createSecret(request: CreateSecretRequest): Promise<Secret>;
+    /** Get the latest version of a secret. */
+    getSecret(id: string): Promise<Secret>;
+    /** Rotate a secret to create a new version. */
+    rotateSecret(id: string, request: RotateSecretRequest): Promise<Secret>;
+}
+//# sourceMappingURL=vault-client.d.ts.map

package/dist/langchain/vault-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-client.d.ts","sourceRoot":"","sources":["../../src/langchain/vault-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC9B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,cAAc,CAAC,EAAE,mBAAmB,CAAC;CAC9C;AASD,qBAAa,WAAW;;gBAQX,MAAM,EAAE,iBAAiB;IAarC,6EAA6E;IAC7E,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAgEnC,2DAA2D;IACrD,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBjE,0CAA0C;IACpC,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK5C,+CAA+C;IACzC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;CAY7E"}

package/dist/langchain/vault-client.js

@@ -0,0 +1,133 @@
+/**
+ * Minimal QNSP Vault client — `@heossi/qnsi/langchain` subpath.
+ *
+ * Faithful inline of the `getSecret` / `createSecret` / `rotateSecret` slice of
+ * the former `@heossi/qnsi-vault-sdk` `VaultClient` (2026-05-16
+ * consolidation): Bearer auth, `x-qnsp-tenant-id` header, 429 retry with
+ * exponential backoff + `Retry-After`, per-request timeout, `Vault API
+ * error: <status> <statusText>` on failure. Endpoints and request/response
+ * shapes are byte-for-byte preserved. Activation is owned by `QnspToolkit`
+ * (single `langchain-qnsp` handshake); the resolved tenant id is injected via
+ * {@link VaultClient.setTenantId} — so this subpath has no `@heossi/qnsi-*`
+ * workspace dependency (same pattern as `../_activation`).
+ */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function validateUUID(value, field) {
+    if (!UUID_RE.test(value)) {
+        throw new Error(`QNSP Vault: ${field} must be a valid UUID, received "${value}"`);
+    }
+}
+const DEFAULT_BASE_URL = "https://api.qnsp.cuilabs.io";
+export class VaultClient {
+    #baseUrl;
+    #apiKey;
+    #timeoutMs;
+    #maxRetries;
+    #retryDelayMs;
+    #tenantId = null;
+    constructor(config) {
+        if (!config.apiKey || config.apiKey.trim().length === 0) {
+            throw new Error("QNSP Vault: apiKey is required. Get a free key at https://cloud.qnsp.cuilabs.io/auth");
+        }
+        this.#baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+        this.#apiKey = config.apiKey;
+        this.#timeoutMs = config.timeoutMs ?? 15_000;
+        this.#maxRetries = config.maxRetries ?? 3;
+        this.#retryDelayMs = config.retryDelayMs ?? 1_000;
+    }
+    /** Inject the activation-resolved tenant id (sent as `x-qnsp-tenant-id`). */
+    setTenantId(tenantId) {
+        this.#tenantId = tenantId;
+    }
+    async #request(method, path, options, attempt = 0) {
+        const url = `${this.#baseUrl}${path}`;
+        const headers = {
+            "Content-Type": "application/json",
+            ...options?.headers,
+            Authorization: `Bearer ${this.#apiKey}`,
+        };
+        if (this.#tenantId) {
+            headers["x-qnsp-tenant-id"] = this.#tenantId;
+        }
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.#timeoutMs);
+        try {
+            const init = { method, headers, signal: controller.signal };
+            if (options?.body !== undefined) {
+                init.body = JSON.stringify(options.body);
+            }
+            const response = await fetch(url, init);
+            clearTimeout(timeoutId);
+            if (response.status === 429) {
+                if (attempt < this.#maxRetries) {
+                    const retryAfterHeader = response.headers.get("Retry-After");
+                    let delayMs = this.#retryDelayMs;
+                    if (retryAfterHeader) {
+                        const retryAfterSeconds = Number.parseInt(retryAfterHeader, 10);
+                        if (!Number.isNaN(retryAfterSeconds) && retryAfterSeconds > 0) {
+                            delayMs = retryAfterSeconds * 1_000;
+                        }
+                    }
+                    else {
+                        delayMs = Math.min(2 ** attempt * this.#retryDelayMs, 30_000);
+                    }
+                    await new Promise((resolve) => setTimeout(resolve, delayMs));
+                    return this.#request(method, path, options, attempt + 1);
+                }
+                throw new Error(`Vault API error: Rate limit exceeded after ${this.#maxRetries} retries`);
+            }
+            if (!response.ok) {
+                throw new Error(`Vault API error: ${response.status} ${response.statusText}`);
+            }
+            if (response.status === 204) {
+                return undefined;
+            }
+            return (await response.json());
+        }
+        catch (error) {
+            clearTimeout(timeoutId);
+            if (error instanceof Error && error.name === "AbortError") {
+                throw new Error(`Request timeout after ${this.#timeoutMs}ms`);
+            }
+            throw error;
+        }
+    }
+    /** Create a new secret. Payload must be base64-encoded. */
+    async createSecret(request) {
+        if (request.tenantId !== undefined) {
+            validateUUID(request.tenantId, "tenantId");
+        }
+        const effectiveTenantId = request.tenantId ?? this.#tenantId;
+        if (!effectiveTenantId) {
+            throw new Error("QNSP Vault: tenantId could not be resolved. Ensure your API key is valid.");
+        }
+        return this.#request("POST", "/vault/v1/secrets", {
+            body: {
+                tenantId: effectiveTenantId,
+                name: request.name,
+                payload: request.payload,
+                ...(request.metadata !== undefined ? { metadata: request.metadata } : {}),
+                ...(request.rotationPolicy !== undefined ? { rotationPolicy: request.rotationPolicy } : {}),
+            },
+        });
+    }
+    /** Get the latest version of a secret. */
+    async getSecret(id) {
+        validateUUID(id, "id");
+        return this.#request("GET", `/vault/v1/secrets/${id}`, undefined);
+    }
+    /** Rotate a secret to create a new version. */
+    async rotateSecret(id, request) {
+        validateUUID(id, "id");
+        validateUUID(request.tenantId, "tenantId");
+        return this.#request("POST", `/vault/v1/secrets/${id}/rotate`, {
+            body: {
+                tenantId: request.tenantId,
+                ...(request.newPayload !== undefined ? { newPayload: request.newPayload } : {}),
+                ...(request.metadata !== undefined ? { metadata: request.metadata } : {}),
+                ...(request.rotationPolicy !== undefined ? { rotationPolicy: request.rotationPolicy } : {}),
+            },
+        });
+    }
+}
+//# sourceMappingURL=vault-client.js.map

package/dist/langchain/vault-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-client.js","sourceRoot":"","sources":["../../src/langchain/vault-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,oCAAoC,KAAK,GAAG,CAAC,CAAC;IACnF,CAAC;AACF,CAAC;AAkED,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AAOvD,MAAM,OAAO,WAAW;IACd,QAAQ,CAAS;IACjB,OAAO,CAAS;IAChB,UAAU,CAAS;IACnB,WAAW,CAAS;IACpB,aAAa,CAAS;IAC/B,SAAS,GAAkB,IAAI,CAAC;IAEhC,YAAY,MAAyB;QACpC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACd,sFAAsF,CACtF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,IAAI,KAAK,CAAC;IACnD,CAAC;IAED,6EAA6E;IAC7E,WAAW,CAAC,QAAgB;QAC3B,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,MAAc,EACd,IAAY,EACZ,OAAmC,EACnC,OAAO,GAAG,CAAC;QAEX,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAA2B;YACvC,cAAc,EAAE,kBAAkB;YAClC,GAAG,OAAO,EAAE,OAAO;YACnB,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,EAAE;SACvC,CAAC;QACF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9C,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC;YACJ,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;YACzE,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxC,YAAY,CAAC,SAAS,CAAC,CAAC;YAExB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,IAAI,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBAChC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBAC7D,IAAI,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;oBACjC,IAAI,gBAAgB,EAAE,CAAC;wBACtB,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;wBAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;4BAC/D,OAAO,GAAG,iBAAiB,GAAG,KAAK,CAAC;wBACrC,CAAC;oBACF,CAAC;yBAAM,CAAC;wBACP,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;oBAC/D,CAAC;oBACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;oBAC7D,OAAO,IAAI,CAAC,QAAQ,CAAI,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,WAAW,UAAU,CAAC,CAAC;YAC3F,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO,SAAc,CAAC;YACvB,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC;QAC7D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAS,MAAM,EAAE,mBAAmB,EAAE;YACzD,IAAI,EAAE;gBACL,QAAQ,EAAE,iBAAiB;gBAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3F;SACD,CAAC,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,SAAS,CAAC,EAAU;QACzB,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAS,KAAK,EAAE,qBAAqB,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,OAA4B;QAC1D,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACvB,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAS,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE;YACtE,IAAI,EAAE;gBACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3F;SACD,CAAC,CAAC;IACJ,CAAC;CACD"}

package/dist/llamaindex/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `@heossi/qnsi/llamaindex` — LlamaIndex adapters for QNSP.
+ *
+ * PQC-encrypted vector store backed by QNSP search-service (SSE-X). Folded in
+ * from the former standalone `@heossi/qnsi-llamaindex-qnsp` (2026-05-16).
+ *
+ * @example
+ * ```typescript
+ * import { QnspVectorStore } from "@heossi/qnsi/llamaindex";
+ *
+ * const store = new QnspVectorStore({ apiKey: process.env.QNSP_API_KEY });
+ * ```
+ */
+export type { QnspVectorStoreConfig, SearchSecurityEnvelope, TextNode, VectorStoreQuery, VectorStoreQueryResult, } from "./vector-store.js";
+export { QnspVectorStore } from "./vector-store.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/llamaindex/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/llamaindex/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EACX,qBAAqB,EACrB,sBAAsB,EACtB,QAAQ,EACR,gBAAgB,EAChB,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/llamaindex/index.js

@@ -0,0 +1,15 @@
+/**
+ * `@heossi/qnsi/llamaindex` — LlamaIndex adapters for QNSP.
+ *
+ * PQC-encrypted vector store backed by QNSP search-service (SSE-X). Folded in
+ * from the former standalone `@heossi/qnsi-llamaindex-qnsp` (2026-05-16).
+ *
+ * @example
+ * ```typescript
+ * import { QnspVectorStore } from "@heossi/qnsi/llamaindex";
+ *
+ * const store = new QnspVectorStore({ apiKey: process.env.QNSP_API_KEY });
+ * ```
+ */
+export { QnspVectorStore } from "./vector-store.js";
+//# sourceMappingURL=index.js.map

package/dist/llamaindex/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/llamaindex/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/llamaindex/sse.d.ts

@@ -0,0 +1,36 @@
+/**
+ * SSE-X token derivation — `@heossi/qnsi/llamaindex` subpath.
+ *
+ * Faithful inline of the SSE-X token-derivation crypto from the former
+ * `@heossi/qnsi-search-sdk` `sse.ts` (2026-05-16 consolidation). Only the
+ * token-derivation functions are inlined — the former `checkSseAccess`/tier
+ * gate is NOT carried over here because the vector store never invoked it
+ * (server enforces the SSE entitlement authoritatively), which also lets this
+ * subpath avoid a `@heossi/qnsi-shared-kernel` dependency. Crypto is
+ * byte-for-byte preserved: HMAC-SHA3-512 over UTF-8 values, base64url output.
+ */
+/** Subset of an index document used for token derivation. */
+export interface SseDocumentPayload {
+    readonly tenantId: string;
+    readonly documentId: string;
+    readonly sourceService: string;
+    readonly tags?: readonly string[];
+    readonly metadata?: Record<string, unknown>;
+    readonly body?: string | null;
+    readonly title?: string | null;
+    readonly description?: string | null;
+}
+export declare function createSseToken(key: Uint8Array | string, value: string): string;
+export interface DeriveSseOptions {
+    readonly includeContent?: boolean;
+    readonly includeBody?: boolean;
+    readonly maxContentTokens?: number;
+    readonly minTokenLength?: number;
+}
+export declare function deriveDocumentSseTokens(payload: SseDocumentPayload, key: Uint8Array | string, options?: DeriveSseOptions): string[];
+export interface DeriveQuerySseOptions {
+    readonly maxTokens?: number;
+    readonly minTokenLength?: number;
+}
+export declare function deriveQuerySseTokens(query: string, key: Uint8Array | string, options?: DeriveQuerySseOptions): string[];
+//# sourceMappingURL=sse.d.ts.map

package/dist/llamaindex/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../src/llamaindex/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAiBD,wBAAgB,cAAc,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI9E;AAsED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC;AAWD,wBAAgB,uBAAuB,CACtC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,EAAE,UAAU,GAAG,MAAM,EACxB,OAAO,GAAE,gBAAqB,GAC5B,MAAM,EAAE,CAkDV;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,wBAAgB,oBAAoB,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,UAAU,GAAG,MAAM,EACxB,OAAO,GAAE,qBAA0B,GACjC,MAAM,EAAE,CAaV"}

package/dist/llamaindex/sse.js

@@ -0,0 +1,151 @@
+/**
+ * SSE-X token derivation — `@heossi/qnsi/llamaindex` subpath.
+ *
+ * Faithful inline of the SSE-X token-derivation crypto from the former
+ * `@heossi/qnsi-search-sdk` `sse.ts` (2026-05-16 consolidation). Only the
+ * token-derivation functions are inlined — the former `checkSseAccess`/tier
+ * gate is NOT carried over here because the vector store never invoked it
+ * (server enforces the SSE entitlement authoritatively), which also lets this
+ * subpath avoid a `@heossi/qnsi-shared-kernel` dependency. Crypto is
+ * byte-for-byte preserved: HMAC-SHA3-512 over UTF-8 values, base64url output.
+ */
+import { Buffer } from "node:buffer";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha3_512 } from "@noble/hashes/sha3.js";
+import { utf8ToBytes } from "@noble/hashes/utils.js";
+function toBase64Url(bytes) {
+    return Buffer.from(bytes)
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/u, "");
+}
+function normalizeKey(key) {
+    if (typeof key === "string") {
+        return Uint8Array.from(Buffer.from(key, "base64"));
+    }
+    return key;
+}
+export function createSseToken(key, value) {
+    const normalizedKey = normalizeKey(key);
+    const mac = hmac(sha3_512, normalizedKey, utf8ToBytes(value));
+    return toBase64Url(mac);
+}
+function flattenMetadata(metadata, prefix = "meta") {
+    const tokens = [];
+    for (const [key, value] of Object.entries(metadata)) {
+        const nextPrefix = `${prefix}.${key}`;
+        if (value === null ||
+            typeof value === "number" ||
+            typeof value === "string" ||
+            typeof value === "boolean") {
+            tokens.push(`${nextPrefix}=${String(value)}`);
+        }
+        else if (Array.isArray(value)) {
+            value.forEach((entry, index) => {
+                if (entry === null ||
+                    typeof entry === "number" ||
+                    typeof entry === "string" ||
+                    typeof entry === "boolean") {
+                    tokens.push(`${nextPrefix}[${index}]=${String(entry)}`);
+                }
+                else if (entry && typeof entry === "object") {
+                    tokens.push(...flattenMetadata(entry, `${nextPrefix}[${index}]`));
+                }
+            });
+        }
+        else if (value && typeof value === "object") {
+            tokens.push(...flattenMetadata(value, nextPrefix));
+        }
+    }
+    return tokens;
+}
+const DEFAULT_TOKENIZATION = {
+    maxTokens: 128,
+    minTokenLength: 3,
+};
+function tokenizeContent(value, options = DEFAULT_TOKENIZATION, accumulator) {
+    const tokens = accumulator ?? new Set();
+    const normalized = value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, " ")
+        .trim()
+        .split(/\s+/u);
+    for (const token of normalized) {
+        if (!token || token.length < options.minTokenLength) {
+            continue;
+        }
+        tokens.add(token);
+        if (tokens.size >= options.maxTokens) {
+            break;
+        }
+    }
+    return tokens;
+}
+function normalizeOptions(options) {
+    return {
+        includeContent: options?.includeContent ?? false,
+        includeBody: options?.includeBody ?? false,
+        maxContentTokens: options?.maxContentTokens ?? DEFAULT_TOKENIZATION.maxTokens,
+        minTokenLength: options?.minTokenLength ?? DEFAULT_TOKENIZATION.minTokenLength,
+    };
+}
+export function deriveDocumentSseTokens(payload, key, options = {}) {
+    const tokens = new Set();
+    const normalizedOptions = normalizeOptions(options);
+    const tokenizationOptions = {
+        maxTokens: normalizedOptions.maxContentTokens,
+        minTokenLength: normalizedOptions.minTokenLength,
+    };
+    const add = (raw) => {
+        if (!raw) {
+            return;
+        }
+        tokens.add(createSseToken(key, raw));
+    };
+    add(`tenant:${payload.tenantId}`);
+    add(`document:${payload.documentId}`);
+    add(`source:${payload.sourceService}`);
+    for (const tag of payload.tags ?? []) {
+        add(`tag:${tag}`);
+    }
+    if (normalizedOptions.includeContent) {
+        const contentTokens = new Set();
+        if (payload.title) {
+            tokenizeContent(payload.title, tokenizationOptions, contentTokens);
+        }
+        if (payload.description) {
+            tokenizeContent(payload.description, tokenizationOptions, contentTokens);
+        }
+        if (normalizedOptions.includeBody && payload.body) {
+            tokenizeContent(payload.body, tokenizationOptions, contentTokens);
+        }
+        let count = 0;
+        for (const keyword of contentTokens) {
+            add(`kw:${keyword}`);
+            count += 1;
+            if (count >= tokenizationOptions.maxTokens) {
+                break;
+            }
+        }
+    }
+    const metadata = payload.metadata ?? {};
+    for (const entry of flattenMetadata(metadata)) {
+        add(entry);
+    }
+    return Array.from(tokens);
+}
+export function deriveQuerySseTokens(query, key, options = {}) {
+    const normalized = normalizeOptions({
+        includeContent: true,
+        includeBody: true,
+        maxContentTokens: options.maxTokens ?? 64,
+        minTokenLength: options.minTokenLength ?? DEFAULT_TOKENIZATION.minTokenLength,
+    });
+    const keywordSet = tokenizeContent(query, {
+        maxTokens: normalized.maxContentTokens,
+        minTokenLength: normalized.minTokenLength,
+    });
+    return Array.from(keywordSet).map((keyword) => createSseToken(key, `kw:${keyword}`));
+}
+//# sourceMappingURL=sse.js.map

package/dist/llamaindex/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../src/llamaindex/sse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAcrD,SAAS,WAAW,CAAC,KAAiB;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACvB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,YAAY,CAAC,GAAwB;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAwB,EAAE,KAAa;IACrE,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,QAAiC,EAAE,MAAM,GAAG,MAAM;IAC1E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC;QACtC,IACC,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,QAAQ;YACzB,OAAO,KAAK,KAAK,SAAS,EACzB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC9B,IACC,KAAK,KAAK,IAAI;oBACd,OAAO,KAAK,KAAK,QAAQ;oBACzB,OAAO,KAAK,KAAK,QAAQ;oBACzB,OAAO,KAAK,KAAK,SAAS,EACzB,CAAC;oBACF,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzD,CAAC;qBAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC/C,MAAM,CAAC,IAAI,CACV,GAAG,eAAe,CAAC,KAAgC,EAAE,GAAG,UAAU,IAAI,KAAK,GAAG,CAAC,CAC/E,CAAC;gBACH,CAAC;YACF,CAAC,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,KAAgC,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/E,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAOD,MAAM,oBAAoB,GAAwB;IACjD,SAAS,EAAE,GAAG;IACd,cAAc,EAAE,CAAC;CACjB,CAAC;AAEF,SAAS,eAAe,CACvB,KAAa,EACb,UAA+B,oBAAoB,EACnD,WAAyB;IAEzB,MAAM,MAAM,GAAG,WAAW,IAAI,IAAI,GAAG,EAAU,CAAC;IAChD,MAAM,UAAU,GAAG,KAAK;SACtB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,IAAI,EAAE;SACN,KAAK,CAAC,MAAM,CAAC,CAAC;IAEhB,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;YACrD,SAAS;QACV,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM;QACP,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AASD,SAAS,gBAAgB,CAAC,OAA0B;IACnD,OAAO;QACN,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,KAAK;QAChD,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,KAAK;QAC1C,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,IAAI,oBAAoB,CAAC,SAAS;QAC7E,cAAc,EAAE,OAAO,EAAE,cAAc,IAAI,oBAAoB,CAAC,cAAc;KAC9E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,OAA2B,EAC3B,GAAwB,EACxB,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,mBAAmB,GAAwB;QAChD,SAAS,EAAE,iBAAiB,CAAC,gBAAgB;QAC7C,cAAc,EAAE,iBAAiB,CAAC,cAAc;KAChD,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,GAAmB,EAAE,EAAE;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACR,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC;IAEF,GAAG,CAAC,UAAU,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,YAAY,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACtC,GAAG,CAAC,UAAU,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEvC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACtC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,iBAAiB,CAAC,cAAc,EAAE,CAAC;QACtC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,eAAe,CAAC,OAAO,CAAC,WAAW,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,iBAAiB,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACnD,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACrC,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;YACrB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,IAAI,mBAAmB,CAAC,SAAS,EAAE,CAAC;gBAC5C,MAAM;YACP,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAOD,MAAM,UAAU,oBAAoB,CACnC,KAAa,EACb,GAAwB,EACxB,UAAiC,EAAE;IAEnC,MAAM,UAAU,GAAG,gBAAgB,CAAC;QACnC,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;QACzC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,oBAAoB,CAAC,cAAc;KAC7E,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE;QACzC,SAAS,EAAE,UAAU,CAAC,gBAAgB;QACtC,cAAc,EAAE,UAAU,CAAC,cAAc;KACzC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC"}