@heossi/qnsi 0.3.2

package/dist/_activation/types.d.ts

@@ -0,0 +1,128 @@
+/**
+ * SDK Activation Types
+ *
+ * Shared contract between SDK clients and the billing-service activation endpoint.
+ * Browser-compatible — no node: imports.
+ *
+ * @module
+ */
+import { z } from "zod";
+/**
+ * SDK identifier sent during activation to identify which package is being used.
+ */
+export declare const SdkIdentifierSchema: z.ZodEnum<{
+    "browser-sdk": "browser-sdk";
+    "vault-sdk": "vault-sdk";
+    "storage-sdk": "storage-sdk";
+    "search-sdk": "search-sdk";
+    "kms-client": "kms-client";
+    "ai-sdk": "ai-sdk";
+    "tenant-sdk": "tenant-sdk";
+    "billing-sdk": "billing-sdk";
+    "auth-sdk": "auth-sdk";
+    "audit-sdk": "audit-sdk";
+    "access-control-sdk": "access-control-sdk";
+    "crypto-inventory-sdk": "crypto-inventory-sdk";
+    cryptography: "cryptography";
+    qnsp: "qnsp";
+    "qnsp-python": "qnsp-python";
+    "qnsp-go": "qnsp-go";
+    "qnsp-rust": "qnsp-rust";
+    "qnsp-jvm": "qnsp-jvm";
+    "langchain-qnsp": "langchain-qnsp";
+    "llamaindex-qnsp": "llamaindex-qnsp";
+    "autogen-qnsp": "autogen-qnsp";
+    "mcp-server": "mcp-server";
+}>;
+export type SdkIdentifier = z.infer<typeof SdkIdentifierSchema>;
+/**
+ * Request body for POST /billing/v1/sdk/activate
+ */
+export declare const SdkActivationRequestSchema: z.ZodObject<{
+    sdkId: z.ZodEnum<{
+        "browser-sdk": "browser-sdk";
+        "vault-sdk": "vault-sdk";
+        "storage-sdk": "storage-sdk";
+        "search-sdk": "search-sdk";
+        "kms-client": "kms-client";
+        "ai-sdk": "ai-sdk";
+        "tenant-sdk": "tenant-sdk";
+        "billing-sdk": "billing-sdk";
+        "auth-sdk": "auth-sdk";
+        "audit-sdk": "audit-sdk";
+        "access-control-sdk": "access-control-sdk";
+        "crypto-inventory-sdk": "crypto-inventory-sdk";
+        cryptography: "cryptography";
+        qnsp: "qnsp";
+        "qnsp-python": "qnsp-python";
+        "qnsp-go": "qnsp-go";
+        "qnsp-rust": "qnsp-rust";
+        "qnsp-jvm": "qnsp-jvm";
+        "langchain-qnsp": "langchain-qnsp";
+        "llamaindex-qnsp": "llamaindex-qnsp";
+        "autogen-qnsp": "autogen-qnsp";
+        "mcp-server": "mcp-server";
+    }>;
+    sdkVersion: z.ZodString;
+    runtime: z.ZodEnum<{
+        browser: "browser";
+        node: "node";
+        edge: "edge";
+        python: "python";
+        go: "go";
+        rust: "rust";
+        jvm: "jvm";
+    }>;
+}, z.core.$strip>;
+export type SdkActivationRequest = z.infer<typeof SdkActivationRequestSchema>;
+/**
+ * Tier limits returned in the activation response.
+ * Subset of full TierLimits — only what SDKs need for client-side enforcement.
+ */
+export declare const SdkActivationLimitsSchema: z.ZodObject<{
+    storageGB: z.ZodNumber;
+    apiCalls: z.ZodNumber;
+    enclavesEnabled: z.ZodBoolean;
+    aiTrainingEnabled: z.ZodBoolean;
+    aiInferenceEnabled: z.ZodBoolean;
+    sseEnabled: z.ZodBoolean;
+    vaultEnabled: z.ZodBoolean;
+}, z.core.$strip>;
+export type SdkActivationLimits = z.infer<typeof SdkActivationLimitsSchema>;
+/**
+ * Successful activation response from billing-service.
+ */
+export declare const SdkActivationResponseSchema: z.ZodObject<{
+    activated: z.ZodLiteral<true>;
+    tenantId: z.ZodString;
+    tier: z.ZodString;
+    limits: z.ZodObject<{
+        storageGB: z.ZodNumber;
+        apiCalls: z.ZodNumber;
+        enclavesEnabled: z.ZodBoolean;
+        aiTrainingEnabled: z.ZodBoolean;
+        aiInferenceEnabled: z.ZodBoolean;
+        sseEnabled: z.ZodBoolean;
+        vaultEnabled: z.ZodBoolean;
+    }, z.core.$strip>;
+    activationToken: z.ZodString;
+    expiresInSeconds: z.ZodNumber;
+    activatedAt: z.ZodString;
+}, z.core.$strip>;
+export type SdkActivationResponse = z.infer<typeof SdkActivationResponseSchema>;
+/**
+ * Error response from the activation endpoint.
+ */
+export declare const SdkActivationErrorSchema: z.ZodObject<{
+    activated: z.ZodLiteral<false>;
+    error: z.ZodString;
+    code: z.ZodEnum<{
+        INVALID_API_KEY: "INVALID_API_KEY";
+        ACCOUNT_SUSPENDED: "ACCOUNT_SUSPENDED";
+        TIER_INSUFFICIENT: "TIER_INSUFFICIENT";
+        RATE_LIMITED: "RATE_LIMITED";
+        SERVICE_UNAVAILABLE: "SERVICE_UNAVAILABLE";
+    }>;
+}, z.core.$strip>;
+export type SdkActivationError = z.infer<typeof SdkActivationErrorSchema>;
+//# sourceMappingURL=types.d.ts.map

package/dist/_activation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/_activation/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;EAuB9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;GAEG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;iBAQpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;GAEG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;iBAetC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;GAEG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;iBAUnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/_activation/types.js

@@ -0,0 +1,94 @@
+/**
+ * SDK Activation Types
+ *
+ * Shared contract between SDK clients and the billing-service activation endpoint.
+ * Browser-compatible — no node: imports.
+ *
+ * @module
+ */
+import { z } from "zod";
+/**
+ * SDK identifier sent during activation to identify which package is being used.
+ */
+export const SdkIdentifierSchema = z.enum([
+    "browser-sdk",
+    "vault-sdk",
+    "storage-sdk",
+    "search-sdk",
+    "kms-client",
+    "ai-sdk",
+    "tenant-sdk",
+    "billing-sdk",
+    "auth-sdk",
+    "audit-sdk",
+    "access-control-sdk",
+    "crypto-inventory-sdk",
+    "cryptography",
+    "qnsp",
+    "qnsp-python",
+    "qnsp-go",
+    "qnsp-rust",
+    "qnsp-jvm",
+    "langchain-qnsp",
+    "llamaindex-qnsp",
+    "autogen-qnsp",
+    "mcp-server",
+]);
+/**
+ * Request body for POST /billing/v1/sdk/activate
+ */
+export const SdkActivationRequestSchema = z.object({
+    /** The SDK package requesting activation */
+    sdkId: SdkIdentifierSchema,
+    /** SDK version string (e.g., "0.1.0") */
+    sdkVersion: z.string().min(1).max(32),
+    /** Runtime environment. JS family: "browser" | "node" | "edge". Native SDKs: "python" | "go" | "rust" | "jvm". */
+    runtime: z.enum(["browser", "node", "edge", "python", "go", "rust", "jvm"]),
+});
+/**
+ * Tier limits returned in the activation response.
+ * Subset of full TierLimits — only what SDKs need for client-side enforcement.
+ */
+export const SdkActivationLimitsSchema = z.object({
+    storageGB: z.number(),
+    apiCalls: z.number(),
+    enclavesEnabled: z.boolean(),
+    aiTrainingEnabled: z.boolean(),
+    aiInferenceEnabled: z.boolean(),
+    sseEnabled: z.boolean(),
+    vaultEnabled: z.boolean(),
+});
+/**
+ * Successful activation response from billing-service.
+ */
+export const SdkActivationResponseSchema = z.object({
+    /** Whether activation succeeded */
+    activated: z.literal(true),
+    /** Tenant ID associated with the API key */
+    tenantId: z.string().uuid(),
+    /** Current pricing tier */
+    tier: z.string().min(1),
+    /** Tier limits for client-side enforcement */
+    limits: SdkActivationLimitsSchema,
+    /** Activation token — opaque string, valid for `expiresInSeconds` */
+    activationToken: z.string().min(1),
+    /** Token validity in seconds (default: 3600 = 1 hour) */
+    expiresInSeconds: z.number().int().positive(),
+    /** ISO 8601 timestamp of activation */
+    activatedAt: z.string().datetime(),
+});
+/**
+ * Error response from the activation endpoint.
+ */
+export const SdkActivationErrorSchema = z.object({
+    activated: z.literal(false),
+    error: z.string(),
+    code: z.enum([
+        "INVALID_API_KEY",
+        "ACCOUNT_SUSPENDED",
+        "TIER_INSUFFICIENT",
+        "RATE_LIMITED",
+        "SERVICE_UNAVAILABLE",
+    ]),
+});
+//# sourceMappingURL=types.js.map

package/dist/_activation/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/_activation/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,aAAa;IACb,WAAW;IACX,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,UAAU;IACV,WAAW;IACX,oBAAoB;IACpB,sBAAsB;IACtB,cAAc;IACd,MAAM;IACN,aAAa;IACb,SAAS;IACT,WAAW;IACX,UAAU;IACV,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,YAAY;CACZ,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,4CAA4C;IAC5C,KAAK,EAAE,mBAAmB;IAC1B,yCAAyC;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACrC,kHAAkH;IAClH,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;CAC3E,CAAC,CAAC;AAIH;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;CACzB,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,mCAAmC;IACnC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,2BAA2B;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,8CAA8C;IAC9C,MAAM,EAAE,yBAAyB;IACjC,qEAAqE;IACrE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,yDAAyD;IACzD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,uCAAuC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACZ,iBAAiB;QACjB,mBAAmB;QACnB,mBAAmB;QACnB,cAAc;QACd,qBAAqB;KACrB,CAAC;CACF,CAAC,CAAC"}

package/dist/_internal.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Shared HTTP plumbing + activation cache.
+ *
+ * Internal — consumers should reach this only via `QnspClient`. Each
+ * service module (vault, kms, audit, …) takes an `Internal` instance
+ * in its constructor and calls `internal.request(method, path, …)`.
+ */
+import { type SdkActivationResponse } from "./_activation/index.js";
+export declare const SDK_ID = "qnsp";
+export declare const SDK_VERSION = "0.3.0";
+/** Public configuration accepted by `new QnspClient(opts)`. */
+export interface QnspClientOptions {
+    /** API key issued from <https://cloud.qnsp.cuilabs.io/api-keys>. Required. */
+    readonly apiKey: string;
+    /** Override the QNSP edge-gateway URL. Defaults to https://api.qnsp.cuilabs.io. */
+    readonly baseUrl?: string;
+    /** Per-request timeout in milliseconds. Defaults to 15 000. */
+    readonly timeoutMs?: number;
+}
+/** Optional per-request overrides. */
+export interface RequestOptions {
+    readonly idempotencyKey?: string | undefined;
+    readonly query?: Record<string, string | number | boolean | undefined> | undefined;
+}
+export declare class Internal {
+    readonly baseUrl: string;
+    readonly timeoutMs: number;
+    readonly apiKey: string;
+    private cached;
+    private activationPromise;
+    constructor(opts: QnspClientOptions);
+    /** Force the activation handshake to run now. */
+    ensureActivated(): Promise<SdkActivationResponse>;
+    /** The activated tenant id (for endpoints that require the tenant in the URL path). */
+    resolveTenantId(): Promise<string>;
+    /** Drop the cached activation; the next request will re-handshake. */
+    invalidateActivation(): void;
+    private refreshActivation;
+    /**
+     * Authenticated request against the QNSP edge gateway. JSON in, JSON
+     * out. A 401 invalidates the activation cache and retries once.
+     *
+     * @param method  HTTP method (GET / POST / PUT / PATCH / DELETE)
+     * @param path    Path under the base URL, including the service prefix
+     *                (e.g. "/vault/v1/secrets")
+     * @param body    JSON body for non-GET methods. `undefined` to omit.
+     * @param options Per-request options (idempotency key, query string)
+     */
+    request<T = Record<string, unknown>>(method: string, path: string, body?: unknown, options?: RequestOptions): Promise<T>;
+    private send;
+}
+//# sourceMappingURL=_internal.d.ts.map

package/dist/_internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_internal.d.ts","sourceRoot":"","sources":["../src/_internal.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAe,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAIjF,eAAO,MAAM,MAAM,SAAS,CAAC;AAG7B,eAAO,MAAM,WAAW,UAAU,CAAC;AAMnC,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAQD,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CACnF;AAED,qBAAa,QAAQ;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,iBAAiB,CAA+C;gBAE5D,IAAI,EAAE,iBAAiB;IASnC,iDAAiD;IAC3C,eAAe,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAWvD,uFAAuF;IACjF,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAIxC,sEAAsE;IACtE,oBAAoB,IAAI,IAAI;YAKd,iBAAiB;IAsB/B;;;;;;;;;OASG;IACG,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,cAAc,GACtB,OAAO,CAAC,CAAC,CAAC;YAyCC,IAAI;CA8BlB"}

package/dist/_internal.js

@@ -0,0 +1,235 @@
+/**
+ * Shared HTTP plumbing + activation cache.
+ *
+ * Internal — consumers should reach this only via `QnspClient`. Each
+ * service module (vault, kms, audit, …) takes an `Internal` instance
+ * in its constructor and calls `internal.request(method, path, …)`.
+ */
+import { activateSdk } from "./_activation/index.js";
+import { QnspApiError, QnspAuthError, QnspNetworkError } from "./errors.js";
+export const SDK_ID = "qnsp";
+// Bump in lockstep with packages/qnsp/package.json `version` (activation
+// telemetry label). Same release contract as browser/sdk-package-version.ts.
+export const SDK_VERSION = "0.3.0";
+const DEFAULT_BASE_URL = "https://api.qnsp.cuilabs.io";
+const DEFAULT_TIMEOUT_MS = 15_000;
+const EXPIRY_BUFFER_MS = 60_000; // refresh 60 s before expiry
+export class Internal {
+    baseUrl;
+    timeoutMs;
+    apiKey;
+    cached = null;
+    activationPromise = null;
+    constructor(opts) {
+        if (!opts.apiKey || opts.apiKey.trim().length === 0) {
+            throw new QnspAuthError("api key required (sign up at https://cloud.qnsp.cuilabs.io/auth)");
+        }
+        this.apiKey = opts.apiKey;
+        this.baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, "");
+        this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    }
+    /** Force the activation handshake to run now. */
+    async ensureActivated() {
+        const cached = this.cached;
+        if (cached !== null) {
+            const expiresAtMs = parseExpiresAt(cached.response);
+            if (expiresAtMs - Date.now() > EXPIRY_BUFFER_MS) {
+                return cached.response;
+            }
+        }
+        return this.refreshActivation();
+    }
+    /** The activated tenant id (for endpoints that require the tenant in the URL path). */
+    async resolveTenantId() {
+        return (await this.ensureActivated()).tenantId;
+    }
+    /** Drop the cached activation; the next request will re-handshake. */
+    invalidateActivation() {
+        this.cached = null;
+        this.activationPromise = null;
+    }
+    async refreshActivation() {
+        if (this.activationPromise) {
+            return this.activationPromise;
+        }
+        this.activationPromise = activateSdk({
+            apiKey: this.apiKey,
+            sdkId: SDK_ID,
+            sdkVersion: SDK_VERSION,
+            platformUrl: this.baseUrl,
+        })
+            .then((response) => {
+            this.cached = { response, cachedAt: Date.now() };
+            this.activationPromise = null;
+            return response;
+        })
+            .catch((err) => {
+            this.activationPromise = null;
+            throw err;
+        });
+        return this.activationPromise;
+    }
+    /**
+     * Authenticated request against the QNSP edge gateway. JSON in, JSON
+     * out. A 401 invalidates the activation cache and retries once.
+     *
+     * @param method  HTTP method (GET / POST / PUT / PATCH / DELETE)
+     * @param path    Path under the base URL, including the service prefix
+     *                (e.g. "/vault/v1/secrets")
+     * @param body    JSON body for non-GET methods. `undefined` to omit.
+     * @param options Per-request options (idempotency key, query string)
+     */
+    async request(method, path, body, options) {
+        const activation = await this.ensureActivated();
+        // Backend write schemas (vault/kms/...) REQUIRE tenantId (uuid) and scope the
+        // request to it. The SDK already knows the activated tenant, so inject it into
+        // object bodies centrally rather than per-method. Caller-supplied tenantId wins.
+        const effectiveBody = withTenantId(body, activation.tenantId);
+        // Backend GET endpoints (e.g. GET /kms/v1/keys/:id, /crypto/v1/assets) read tenantId from
+        // the QUERY string, not a body, and 400 without it. The body injection above cannot help a
+        // GET (no body), so also inject the activated tenant into the query (reaudit 2026-06-13
+        // #29/#31). Caller-supplied query tenantId wins; the edge validates it == the api-key tenant.
+        const effectiveOptions = withTenantIdQuery(options, activation.tenantId);
+        let response = await this.send(method, path, effectiveBody, effectiveOptions);
+        if (response.status === 401) {
+            this.invalidateActivation();
+            const reactivated = await this.ensureActivated();
+            response = await this.send(method, path, withTenantId(body, reactivated.tenantId), withTenantIdQuery(options, reactivated.tenantId));
+        }
+        const text = await safeReadText(response);
+        if (!response.ok) {
+            throw parseApiError(response.status, text);
+        }
+        if (response.status === 204 || text.length === 0) {
+            return {};
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new QnspApiError("response is not valid JSON", response.status);
+        }
+    }
+    async send(method, path, body, options) {
+        const url = buildUrl(this.baseUrl, path, options?.query);
+        const headers = {
+            authorization: `Bearer ${this.apiKey}`,
+            accept: "application/json",
+        };
+        const init = { method, headers };
+        if (body !== undefined) {
+            headers["content-type"] = "application/json";
+            init.body = JSON.stringify(body);
+        }
+        if (options?.idempotencyKey) {
+            headers["idempotency-key"] = options.idempotencyKey;
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        init.signal = controller.signal;
+        try {
+            return await fetch(url, init);
+        }
+        catch (err) {
+            throw new QnspNetworkError(method, url, err);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+/**
+ * Inject the activated tenantId into a plain-object JSON body if not already set.
+ * Backend write schemas require tenantId (uuid); leaving it to each method is what
+ * let "missing tenantId" 400s ship. Non-object bodies (undefined, arrays, strings)
+ * pass through unchanged.
+ */
+/**
+ * Inject the activated tenantId into the request query string (for GET endpoints that read it
+ * from the query and 400 without it). Returns the options unchanged when no tenant is known or the
+ * caller already supplied a query tenantId (caller wins). Reaudit 2026-06-13 #29/#31.
+ */
+function withTenantIdQuery(options, tenantId) {
+    if (!tenantId)
+        return options;
+    const query = options?.query;
+    if (query && query["tenantId"] !== undefined)
+        return options;
+    return { ...options, query: { ...(query ?? {}), tenantId } };
+}
+function withTenantId(body, tenantId) {
+    if (body === undefined ||
+        body === null ||
+        typeof body !== "object" ||
+        Array.isArray(body) ||
+        !tenantId) {
+        return body;
+    }
+    const obj = body;
+    if (obj["tenantId"] !== undefined)
+        return body;
+    return { tenantId, ...obj };
+}
+function buildUrl(base, path, query) {
+    let url = `${base}${path}`;
+    if (query) {
+        const usp = new URLSearchParams();
+        for (const [key, value] of Object.entries(query)) {
+            if (value === undefined)
+                continue;
+            usp.set(key, String(value));
+        }
+        const encoded = usp.toString();
+        if (encoded.length > 0) {
+            url += url.includes("?") ? `&${encoded}` : `?${encoded}`;
+        }
+    }
+    return url;
+}
+async function safeReadText(response) {
+    try {
+        return await response.text();
+    }
+    catch {
+        return "";
+    }
+}
+function parseApiError(status, raw) {
+    let body = null;
+    try {
+        body = JSON.parse(raw);
+    }
+    catch {
+        body = raw;
+    }
+    let code = null;
+    let message = `HTTP ${status}`;
+    if (body && typeof body === "object") {
+        const obj = body;
+        if (typeof obj["code"] === "string")
+            code = obj["code"];
+        if (typeof obj["message"] === "string") {
+            message = obj["message"];
+        }
+        else if (typeof obj["error"] === "string") {
+            message = obj["error"];
+        }
+    }
+    else if (typeof raw === "string" && raw.length > 0) {
+        message = raw;
+    }
+    return new QnspApiError(message, status, code, body);
+}
+function parseExpiresAt(response) {
+    const { expiresAt } = response;
+    if (typeof expiresAt === "number")
+        return expiresAt;
+    if (typeof expiresAt === "string") {
+        const parsed = Date.parse(expiresAt);
+        if (!Number.isNaN(parsed))
+            return parsed;
+    }
+    // Conservative default — 5 minutes from now.
+    return Date.now() + 5 * 60_000;
+}
+//# sourceMappingURL=_internal.js.map

package/dist/_internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_internal.js","sourceRoot":"","sources":["../src/_internal.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAA8B,MAAM,wBAAwB,CAAC;AAEjF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC;AAC7B,yEAAyE;AACzE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,6BAA6B;AAwB9D,MAAM,OAAO,QAAQ;IACX,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,MAAM,CAAS;IAEhB,MAAM,GAA2B,IAAI,CAAC;IACtC,iBAAiB,GAA0C,IAAI,CAAC;IAExE,YAAY,IAAuB;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,aAAa,CAAC,kEAAkE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,eAAe;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpD,IAAI,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,EAAE,CAAC;gBACjD,OAAO,MAAM,CAAC,QAAQ,CAAC;YACxB,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;IACjC,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,eAAe;QACpB,OAAO,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC;IAChD,CAAC;IAED,sEAAsE;IACtE,oBAAoB;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC9B,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,iBAAiB,GAAG,WAAW,CAAC;YACpC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,WAAW;YACvB,WAAW,EAAE,IAAI,CAAC,OAAO;SACzB,CAAC;aACA,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;YAClB,IAAI,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,OAAO,QAAQ,CAAC;QACjB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACvB,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,MAAM,GAAG,CAAC;QACX,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAC/B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CACZ,MAAc,EACd,IAAY,EACZ,IAAc,EACd,OAAwB;QAExB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChD,8EAA8E;QAC9E,+EAA+E;QAC/E,iFAAiF;QACjF,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC9D,0FAA0F;QAC1F,2FAA2F;QAC3F,wFAAwF;QACxF,8FAA8F;QAC9F,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEzE,IAAI,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;QAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CACzB,MAAM,EACN,IAAI,EACJ,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,QAAQ,CAAC,EACxC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,CAChD,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,EAAO,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,YAAY,CAAC,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,IAAI,CACjB,MAAc,EACd,IAAY,EACZ,IAAa,EACb,OAAmC;QAEnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,OAAO,GAA2B;YACvC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;YACtC,MAAM,EAAE,kBAAkB;SAC1B,CAAC;QACF,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;YAC7B,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACrD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAChC,IAAI,CAAC;YACJ,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACF,CAAC;CACD;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,SAAS,iBAAiB,CACzB,OAAmC,EACnC,QAAgB;IAEhB,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC7D,OAAO,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,QAAgB;IACpD,IACC,IAAI,KAAK,SAAS;QAClB,IAAI,KAAK,IAAI;QACb,OAAO,IAAI,KAAK,QAAQ;QACxB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACnB,CAAC,QAAQ,EACR,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,KAA8B;IAC3E,IAAI,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IAC3B,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1D,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC7C,IAAI,CAAC;QACJ,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,GAAW;IACjD,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,IAAI,GAAG,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,OAAO,GAAG,QAAQ,MAAM,EAAE,CAAC;IAC/B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,GAAG,GAAG,CAAC;IACf,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,cAAc,CAAC,QAA+B;IACtD,MAAM,EAAE,SAAS,EAAE,GAAG,QAAsD,CAAC;IAC7E,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IACD,6CAA6C;IAC7C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC;AAChC,CAAC"}

package/dist/access.d.ts

@@ -0,0 +1,32 @@
+/**
+ * QNSP Access-Control — RBAC: roles, permissions, role assignments.
+ * Wraps `apps/access-control-service` (`/access/v1`).
+ */
+import type { Internal, RequestOptions } from "./_internal.js";
+export interface CreateRoleRequest {
+    readonly name: string;
+    readonly permissions: readonly string[];
+    readonly description?: string;
+}
+export interface AssignRoleRequest {
+    readonly roleId: string;
+    readonly subjectId: string;
+    readonly scope?: string;
+}
+export interface CheckPermissionRequest {
+    readonly subjectId: string;
+    readonly permission: string;
+    readonly scope?: string;
+}
+export declare class AccessClient {
+    private readonly internal;
+    constructor(internal: Internal);
+    createRole(req: CreateRoleRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    getRole(roleId: string): Promise<Record<string, unknown>>;
+    listRoles(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
+    deleteRole(roleId: string): Promise<void>;
+    assignRole(req: AssignRoleRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    revokeRoleAssignment(assignmentId: string): Promise<void>;
+    checkPermission(req: CheckPermissionRequest): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=access.d.ts.map

package/dist/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI/D,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,YAAY;IACZ,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAIhF,OAAO,CAAC,MAAM,EAAE,MAAM;IAItB,SAAS,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAInC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,UAAU,CAAC,GAAG,EAAE,iBAAiB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAI1E,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/D,eAAe,CAAC,GAAG,EAAE,sBAAsB;CAG3C"}

package/dist/access.js

@@ -0,0 +1,33 @@
+/**
+ * QNSP Access-Control — RBAC: roles, permissions, role assignments.
+ * Wraps `apps/access-control-service` (`/access/v1`).
+ */
+const PATH_PREFIX = "/proxy/access/v1";
+export class AccessClient {
+    internal;
+    constructor(internal) {
+        this.internal = internal;
+    }
+    createRole(req, opts) {
+        return this.internal.request("POST", `${PATH_PREFIX}/roles`, req, opts);
+    }
+    getRole(roleId) {
+        return this.internal.request("GET", `${PATH_PREFIX}/roles/${roleId}`);
+    }
+    listRoles(query) {
+        return this.internal.request("GET", `${PATH_PREFIX}/roles`, undefined, { query });
+    }
+    async deleteRole(roleId) {
+        await this.internal.request("DELETE", `${PATH_PREFIX}/roles/${roleId}`);
+    }
+    assignRole(req, opts) {
+        return this.internal.request("POST", `${PATH_PREFIX}/role-assignments`, req, opts);
+    }
+    async revokeRoleAssignment(assignmentId) {
+        await this.internal.request("DELETE", `${PATH_PREFIX}/role-assignments/${assignmentId}`);
+    }
+    checkPermission(req) {
+        return this.internal.request("POST", `${PATH_PREFIX}/check`, req);
+    }
+}
+//# sourceMappingURL=access.js.map

package/dist/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAoBvC,MAAM,OAAO,YAAY;IACK;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,UAAU,CAAC,GAAsB,EAAE,IAA6C;QAC/E,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,MAAc;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,UAAU,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,SAAS,CAAC,KAA+B;QACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC9B,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,WAAW,UAAU,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,UAAU,CAAC,GAAsB,EAAE,IAA6C;QAC/E,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,mBAAmB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAoB;QAC9C,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,WAAW,qBAAqB,YAAY,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,eAAe,CAAC,GAA2B;QAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;CACD"}

package/dist/ai.d.ts

@@ -0,0 +1,51 @@
+/**
+ * QNSP AI Orchestrator — model registry, AI workloads with enclave
+ * attestation, inference, bias / prompt-injection monitoring. Wraps
+ * `apps/ai-orchestrator` (`/ai/v1`).
+ */
+import type { Internal, RequestOptions } from "./_internal.js";
+export interface RegisterModelRequest {
+    readonly name: string;
+    readonly version: string;
+    readonly provider: string;
+    readonly capabilities?: readonly string[];
+    readonly metadata?: Record<string, unknown>;
+}
+export interface SubmitWorkloadRequest {
+    readonly modelId: string;
+    readonly type: string;
+    readonly inputRefs?: readonly string[];
+    readonly outputBucket?: string;
+    readonly enclaveType?: string;
+    readonly metadata?: Record<string, unknown>;
+}
+export interface InferenceRequest {
+    readonly modelId: string;
+    readonly input: Record<string, unknown>;
+    readonly stream?: boolean;
+    readonly metadata?: Record<string, unknown>;
+}
+export interface RegisterArtifactRequest {
+    readonly name: string;
+    readonly hash: string;
+    readonly storageId: string;
+    readonly type?: string;
+    readonly metadata?: Record<string, unknown>;
+}
+export declare class AiClient {
+    private readonly internal;
+    constructor(internal: Internal);
+    registerModel(req: RegisterModelRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    listModels(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
+    getModel(modelId: string): Promise<Record<string, unknown>>;
+    updateModel(modelId: string, body: Record<string, unknown>, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    activateModel(modelId: string, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    deployModel(body: Record<string, unknown>, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    submitWorkload(req: SubmitWorkloadRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    getWorkload(workloadId: string): Promise<Record<string, unknown>>;
+    listWorkloads(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
+    cancelWorkload(workloadId: string, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    invokeInference(req: InferenceRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    registerArtifact(req: RegisterArtifactRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=ai.d.ts.map