@heossi/qnsi 0.3.2

package/dist/autogen/executor.js

@@ -0,0 +1,277 @@
+/**
+ * QNSP AutoGen Executor — `@heossi/qnsi/autogen` subpath.
+ *
+ * Submits code-execution workloads to QNSP AI orchestrator enclaves and waits
+ * for completion, returning structured output with the enclave attestation
+ * proof. Provides a function-executor interface compatible with AutoGen's code
+ * execution pattern — without importing from `autogen` directly.
+ *
+ * Folded in from the former standalone `@heossi/qnsi-autogen-qnsp` package
+ * (2026-05-16). The workload submit/get HTTP is inlined here (faithful to the
+ * former `@heossi/qnsi-ai-sdk` `AiOrchestratorClient`: Bearer auth,
+ * `idempotency-key` header, `env` defaulted, bounded retry) so this subpath
+ * has no `@heossi/qnsi-*` workspace dependency — same pattern as
+ * `../_activation`. Tier/enclave access is enforced authoritatively by the
+ * edge-gateway + ai-orchestrator server side (a 402/403 surfaces as an Error);
+ * the former client-side tier pre-check was advisory only and is intentionally
+ * dropped (single source of truth = server).
+ */
+import { z } from "zod";
+import { activateSdk } from "../_activation/index.js";
+const SDK_VERSION = "0.3.0";
+const SDK_ID = "autogen-qnsp";
+// Activation handshake — keeps telemetry and tier limits consistent. Returns
+// the tenantId so callers can attach it to workload submissions.
+async function resolveActivationTenantId(apiKey, baseUrl) {
+    const activation = await activateSdk({
+        apiKey,
+        sdkId: SDK_ID,
+        sdkVersion: SDK_VERSION,
+        platformUrl: baseUrl,
+    });
+    return activation.tenantId;
+}
+// ─── Zod schema for workload security profile ─────────────────────────────────
+const securityProfileSchema = z.object({
+    attestationProof: z.string().nullable(),
+    hardwareProvider: z.string().nullable(),
+    attestationStatus: z.string().nullable(),
+    controlPlaneTokenSha256: z.string().nullable(),
+    pqcSignatures: z.array(z.object({ provider: z.string(), algorithm: z.string() })),
+});
+// ─── Terminal status set ──────────────────────────────────────────────────────
+const TERMINAL_STATUSES = new Set(["succeeded", "failed", "canceled"]);
+// ─── Language → command mapping ───────────────────────────────────────────────
+const LANGUAGE_COMMANDS = {
+    python: ["python", "-c"],
+    bash: ["bash", "-c"],
+    javascript: ["node", "-e"],
+};
+// ─── QnspExecutor ─────────────────────────────────────────────────────────────
+/**
+ * AutoGen-compatible code executor backed by QNSP AI orchestrator enclaves.
+ *
+ * @example
+ * ```typescript
+ * import { QnspExecutor } from "@heossi/qnsi/autogen";
+ *
+ * const executor = new QnspExecutor({ apiKey: process.env.QNSP_API_KEY });
+ * const result = await executor.execute({ code: "print('hi')", language: "python" });
+ * console.log(result.status, result.attestationProof);
+ * ```
+ */
+export class QnspExecutor {
+    #apiKey;
+    #baseUrl;
+    #containerImage;
+    #cpu;
+    #memoryGiB;
+    #gpu;
+    #acceleratorType;
+    #pollTimeoutMs;
+    #pollIntervalMs;
+    #requestTimeoutMs;
+    #resolvedTenantId;
+    #activationPromise = null;
+    constructor(config) {
+        this.#resolvedTenantId = config.tenantId ?? null;
+        this.#containerImage = config.containerImage ?? "qnsp/enclave-python-runtime:latest";
+        this.#cpu = config.cpu ?? 1;
+        this.#memoryGiB = config.memoryGiB ?? 2;
+        this.#gpu = config.gpu ?? 0;
+        this.#acceleratorType = config.acceleratorType ?? "nvidia-a100";
+        this.#pollTimeoutMs = config.pollTimeoutMs ?? 300_000;
+        this.#pollIntervalMs = config.pollIntervalMs ?? 2_000;
+        this.#requestTimeoutMs = config.requestTimeoutMs ?? 30_000;
+        this.#apiKey = config.apiKey;
+        this.#baseUrl = (config.baseUrl ?? "https://api.qnsp.cuilabs.io").replace(/\/$/, "");
+    }
+    /**
+     * Resolve the effective tenant ID — either from config or via SDK activation.
+     * Caches the result after the first call.
+     */
+    async #ensureTenantId() {
+        if (this.#resolvedTenantId) {
+            return this.#resolvedTenantId;
+        }
+        if (!this.#activationPromise) {
+            this.#activationPromise = resolveActivationTenantId(this.#apiKey, this.#baseUrl).then((tenantId) => {
+                this.#resolvedTenantId = tenantId;
+            });
+        }
+        await this.#activationPromise;
+        if (!this.#resolvedTenantId) {
+            throw new Error("QNSP AutoGen: tenantId could not be resolved. Ensure your API key is valid.");
+        }
+        return this.#resolvedTenantId;
+    }
+    /**
+     * Authenticated request against the AI orchestrator via the edge gateway.
+     * Faithful to the former @heossi/qnsi-ai-sdk request: Bearer apiKey, JSON,
+     * bounded retry (3 attempts, 1s backoff) on network / 5xx.
+     */
+    async #request(method, path, body, extraHeaders) {
+        const url = `${this.#baseUrl}${path}`;
+        const headers = {
+            authorization: `Bearer ${this.#apiKey}`,
+            accept: "application/json",
+            ...extraHeaders,
+        };
+        const init = { method, headers };
+        if (body !== undefined) {
+            headers["content-type"] = "application/json";
+            init.body = JSON.stringify(body);
+        }
+        const maxAttempts = 3;
+        let lastErr;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), this.#requestTimeoutMs);
+            try {
+                const response = await fetch(url, { ...init, signal: controller.signal });
+                const text = await response.text().catch(() => "");
+                if (!response.ok) {
+                    // Retry only transient 5xx; surface 4xx (incl. tier 402/403) immediately.
+                    if (response.status >= 500 && attempt < maxAttempts) {
+                        lastErr = new Error(`AI orchestrator ${response.status}: ${text}`);
+                        await delay(1_000);
+                        continue;
+                    }
+                    let message = `AI orchestrator request failed (${response.status})`;
+                    try {
+                        const parsed = JSON.parse(text);
+                        if (typeof parsed["message"] === "string")
+                            message = parsed["message"];
+                        else if (typeof parsed["error"] === "string")
+                            message = parsed["error"];
+                    }
+                    catch {
+                        if (text.length > 0)
+                            message = text;
+                    }
+                    throw new Error(message);
+                }
+                if (response.status === 204 || text.length === 0) {
+                    return {};
+                }
+                return JSON.parse(text);
+            }
+            catch (err) {
+                lastErr = err;
+                const isAbort = err instanceof Error && err.name === "AbortError";
+                if (attempt < maxAttempts && (isAbort || err instanceof TypeError)) {
+                    await delay(1_000);
+                    continue;
+                }
+                throw err;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        throw lastErr instanceof Error ? lastErr : new Error("AI orchestrator request failed");
+    }
+    /**
+     * Execute code inside a QNSP enclave and wait for the result.
+     */
+    async execute(request) {
+        const language = request.language ?? "python";
+        const command = LANGUAGE_COMMANDS[language];
+        if (!command) {
+            throw new Error(`Unsupported language: ${language}. Supported: python, bash, javascript`);
+        }
+        const workloadName = request.name ?? `autogen-${language}-${Date.now()}`;
+        const issuedAt = new Date().toISOString();
+        const tenantId = await this.#ensureTenantId();
+        const workloadRequest = {
+            tenantId,
+            name: workloadName,
+            priority: "normal",
+            schedulingPolicy: this.#gpu > 0 ? "on-demand" : "spot",
+            containerImage: this.#containerImage,
+            command: [...command, request.code],
+            env: request.env ?? {},
+            resources: {
+                cpu: this.#cpu,
+                memoryGiB: this.#memoryGiB,
+                gpu: this.#gpu,
+                acceleratorType: this.#acceleratorType,
+            },
+            artifacts: [],
+            manifest: {
+                pqcSignature: "",
+                algorithm: "none",
+                issuedAt,
+                language,
+                executor: "autogen-qnsp",
+            },
+            labels: {
+                "qnsp.io/executor": "autogen-qnsp",
+                "qnsp.io/language": language,
+            },
+            ...(request.idempotencyKey !== undefined ? { idempotencyKey: request.idempotencyKey } : {}),
+        };
+        const submitted = await this.#submitWorkload(workloadRequest);
+        // If already in a terminal state (e.g. replayed idempotent result), return immediately
+        if (TERMINAL_STATUSES.has(submitted.status)) {
+            return {
+                workloadId: submitted.workloadId,
+                status: submitted.status,
+                replayed: submitted.replayed,
+                attestationProof: null,
+                hardwareProvider: null,
+                acceptedAt: submitted.acceptedAt,
+                completedAt: null,
+            };
+        }
+        const detail = await this.#pollUntilComplete(submitted.workloadId);
+        const security = securityProfileSchema.safeParse(detail.security);
+        return {
+            workloadId: detail.id,
+            status: detail.status,
+            replayed: submitted.replayed,
+            attestationProof: security.success ? security.data.attestationProof : null,
+            hardwareProvider: security.success ? security.data.hardwareProvider : null,
+            acceptedAt: detail.acceptedAt,
+            completedAt: detail.completedAt,
+        };
+    }
+    /**
+     * Submit a workload. Faithful to @heossi/qnsi-ai-sdk: `idempotencyKey` is
+     * stripped from the body and sent as the `idempotency-key` header; `env`
+     * defaults to `{}`.
+     */
+    async #submitWorkload(input) {
+        const { idempotencyKey, ...payload } = input;
+        const extraHeaders = {};
+        if (idempotencyKey) {
+            extraHeaders["idempotency-key"] = idempotencyKey;
+        }
+        return this.#request("POST", "/ai/v1/workloads", { ...payload, env: payload.env ?? {} }, extraHeaders);
+    }
+    async #getWorkload(workloadId) {
+        return this.#request("GET", `/ai/v1/workloads/${encodeURIComponent(workloadId)}`);
+    }
+    /**
+     * Poll a workload until it reaches a terminal state or the timeout is exceeded.
+     */
+    async #pollUntilComplete(workloadId) {
+        const deadline = Date.now() + this.#pollTimeoutMs;
+        while (Date.now() < deadline) {
+            const detail = await this.#getWorkload(workloadId);
+            if (TERMINAL_STATUSES.has(detail.status)) {
+                return detail;
+            }
+            const remaining = deadline - Date.now();
+            const wait = Math.min(this.#pollIntervalMs, remaining);
+            if (wait > 0) {
+                await delay(wait);
+            }
+        }
+        throw new Error(`Workload ${workloadId} did not complete within ${this.#pollTimeoutMs}ms poll timeout`);
+    }
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=executor.js.map

package/dist/autogen/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../src/autogen/executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B,6EAA6E;AAC7E,iEAAiE;AACjE,KAAK,UAAU,yBAAyB,CAAC,MAAc,EAAE,OAAe;IACvE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC;QACpC,MAAM;QACN,KAAK,EAAE,MAAM;QACb,UAAU,EAAE,WAAW;QACvB,WAAW,EAAE,OAAO;KACpB,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC;AAC5B,CAAC;AAwLD,iFAAiF;AAEjF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;CACjF,CAAC,CAAC;AAEH,iFAAiF;AAEjF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAiB,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAEvF,iFAAiF;AAEjF,MAAM,iBAAiB,GAAsC;IAC5D,MAAM,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC;IACpB,UAAU,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC;CAC1B,CAAC;AAEF,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAY;IACf,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,eAAe,CAAS;IACxB,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,IAAI,CAAS;IACb,gBAAgB,CAAS;IACzB,cAAc,CAAS;IACvB,eAAe,CAAS;IACxB,iBAAiB,CAAS;IACnC,iBAAiB,CAAgB;IACjC,kBAAkB,GAAyB,IAAI,CAAC;IAEhD,YAAY,MAA0B;QACrC,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QACjD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,IAAI,oCAAoC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,eAAe,IAAI,aAAa,CAAC;QAChE,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,IAAI,OAAO,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC;QACtD,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACpB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC9B,IAAI,CAAC,kBAAkB,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpF,CAAC,QAAQ,EAAE,EAAE;gBACZ,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC;YACnC,CAAC,CACD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACd,6EAA6E,CAC7E,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,MAAc,EACd,IAAY,EACZ,IAAc,EACd,YAAqC;QAErC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;QACtC,MAAM,OAAO,GAA2B;YACvC,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,EAAE;YACvC,MAAM,EAAE,kBAAkB;YAC1B,GAAG,YAAY;SACf,CAAC;QACF,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,CAAC;QACtB,IAAI,OAAgB,CAAC;QACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;YACzD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC3E,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC1E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBAClB,0EAA0E;oBAC1E,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;wBACrD,OAAO,GAAG,IAAI,KAAK,CAAC,mBAAmB,QAAQ,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;wBACnE,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;wBACnB,SAAS;oBACV,CAAC;oBACD,IAAI,OAAO,GAAG,mCAAmC,QAAQ,CAAC,MAAM,GAAG,CAAC;oBACpE,IAAI,CAAC;wBACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;wBAC3D,IAAI,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;4BAAE,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;6BAClE,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;4BAAE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;oBACzE,CAAC;oBAAC,MAAM,CAAC;wBACR,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;4BAAE,OAAO,GAAG,IAAI,CAAC;oBACrC,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC1B,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClD,OAAO,EAAO,CAAC;gBAChB,CAAC;gBACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,OAAO,GAAG,GAAG,CAAC;gBACd,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC;gBAClE,IAAI,OAAO,GAAG,WAAW,IAAI,CAAC,OAAO,IAAI,GAAG,YAAY,SAAS,CAAC,EAAE,CAAC;oBACpE,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;oBACnB,SAAS;gBACV,CAAC;gBACD,MAAM,GAAG,CAAC;YACX,CAAC;oBAAS,CAAC;gBACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACF,CAAC;QACD,MAAM,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACxF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,OAA2B;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC9C,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,uCAAuC,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE9C,MAAM,eAAe,GAA0B;YAC9C,QAAQ;YACR,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,QAAQ;YAClB,gBAAgB,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM;YACtD,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,OAAO,EAAE,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC;YACnC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE;YACtB,SAAS,EAAE;gBACV,GAAG,EAAE,IAAI,CAAC,IAAI;gBACd,SAAS,EAAE,IAAI,CAAC,UAAU;gBAC1B,GAAG,EAAE,IAAI,CAAC,IAAI;gBACd,eAAe,EAAE,IAAI,CAAC,gBAAgB;aACtC;YACD,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE;gBACT,YAAY,EAAE,EAAE;gBAChB,SAAS,EAAE,MAAM;gBACjB,QAAQ;gBACR,QAAQ;gBACR,QAAQ,EAAE,cAAc;aACxB;YACD,MAAM,EAAE;gBACP,kBAAkB,EAAE,cAAc;gBAClC,kBAAkB,EAAE,QAAQ;aAC5B;YACD,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAE9D,uFAAuF;QACvF,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACN,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,QAAQ,EAAE,SAAS,CAAC,QAAQ;gBAC5B,gBAAgB,EAAE,IAAI;gBACtB,gBAAgB,EAAE,IAAI;gBACtB,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,WAAW,EAAE,IAAI;aACjB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAElE,OAAO;YACN,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;YAC1E,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;YAC1E,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;SAC/B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,KAA4B;QACjD,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;QAC7C,MAAM,YAAY,GAA2B,EAAE,CAAC;QAChD,IAAI,cAAc,EAAE,CAAC;YACpB,YAAY,CAAC,iBAAiB,CAAC,GAAG,cAAc,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CACnB,MAAM,EACN,kBAAkB,EAClB,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,EACtC,YAAY,CACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB;QACpC,OAAO,IAAI,CAAC,QAAQ,CACnB,KAAK,EACL,oBAAoB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CACpD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,UAAkB;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAElD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;YAEnD,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,OAAO,MAAM,CAAC;YACf,CAAC;YAED,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;YACvD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBACd,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACF,CAAC;QAED,MAAM,IAAI,KAAK,CACd,YAAY,UAAU,4BAA4B,IAAI,CAAC,cAAc,iBAAiB,CACtF,CAAC;IACH,CAAC;CACD;AAED,SAAS,KAAK,CAAC,EAAU;IACxB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/autogen/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `@heossi/qnsi/autogen` — AutoGen function executor for QNSP.
+ *
+ * Submits code workloads to QNSP AI orchestrator enclaves with PQC
+ * attestation. Folded in from the former standalone
+ * `@heossi/qnsi-autogen-qnsp` package (2026-05-16).
+ *
+ * @example
+ * ```typescript
+ * import { QnspExecutor } from "@heossi/qnsi/autogen";
+ *
+ * const executor = new QnspExecutor({ apiKey: process.env.QNSP_API_KEY });
+ * const result = await executor.execute({ code: "print('Hello')", language: "python" });
+ * ```
+ */
+export type { ExecuteCodeRequest, ExecuteCodeResult, QnspExecutorConfig, SubmitWorkloadRequest, WorkloadDetail, WorkloadStatus, } from "./executor.js";
+export { QnspExecutor } from "./executor.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/autogen/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/autogen/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACX,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,cAAc,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}

package/dist/autogen/index.js

@@ -0,0 +1,17 @@
+/**
+ * `@heossi/qnsi/autogen` — AutoGen function executor for QNSP.
+ *
+ * Submits code workloads to QNSP AI orchestrator enclaves with PQC
+ * attestation. Folded in from the former standalone
+ * `@heossi/qnsi-autogen-qnsp` package (2026-05-16).
+ *
+ * @example
+ * ```typescript
+ * import { QnspExecutor } from "@heossi/qnsi/autogen";
+ *
+ * const executor = new QnspExecutor({ apiKey: process.env.QNSP_API_KEY });
+ * const result = await executor.execute({ code: "print('Hello')", language: "python" });
+ * ```
+ */
+export { QnspExecutor } from "./executor.js";
+//# sourceMappingURL=index.js.map

package/dist/autogen/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/autogen/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}

package/dist/billing.d.ts

@@ -0,0 +1,22 @@
+/**
+ * QNSP Billing — entitlement queries, usage meters, invoice listing,
+ * credit balance. Wraps `apps/billing-service` (`/billing/v1`).
+ */
+import type { Internal, RequestOptions } from "./_internal.js";
+export interface IngestMeterRequest {
+    readonly meterId: string;
+    readonly quantity: number;
+    readonly occurredAt?: string;
+    readonly metadata?: Record<string, unknown>;
+}
+export declare class BillingClient {
+    private readonly internal;
+    constructor(internal: Internal);
+    getEntitlements(): Promise<Record<string, unknown>>;
+    ingestMeter(req: IngestMeterRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    ingestMeters(meters: readonly IngestMeterRequest[], opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
+    listInvoices(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
+    getInvoice(invoiceId: string): Promise<Record<string, unknown>>;
+    getCreditBalance(tenantId: string): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=billing.d.ts.map

package/dist/billing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI/D,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,qBAAa,aAAa;IACb,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAEzC,eAAe;IAOrB,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAIlF,YAAY,CACX,MAAM,EAAE,SAAS,kBAAkB,EAAE,EACrC,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAK9C,YAAY,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAI5C,UAAU,CAAC,SAAS,EAAE,MAAM;IAI5B,gBAAgB,CAAC,QAAQ,EAAE,MAAM;CAGjC"}

package/dist/billing.js

@@ -0,0 +1,33 @@
+/**
+ * QNSP Billing — entitlement queries, usage meters, invoice listing,
+ * credit balance. Wraps `apps/billing-service` (`/billing/v1`).
+ */
+const PATH_PREFIX = "/proxy/billing/v1";
+export class BillingClient {
+    internal;
+    constructor(internal) {
+        this.internal = internal;
+    }
+    async getEntitlements() {
+        // reaudit 2026-06-13 #30: the bare /entitlements path does not exist on billing-service.
+        // The resolved entitlements live at /billing/v1/entitlements/resolved/:tenantId.
+        const tenantId = await this.internal.resolveTenantId();
+        return this.internal.request("GET", `${PATH_PREFIX}/entitlements/resolved/${tenantId}`);
+    }
+    ingestMeter(req, opts) {
+        return this.internal.request("POST", `${PATH_PREFIX}/meters`, req, opts);
+    }
+    ingestMeters(meters, opts) {
+        return this.internal.request("POST", `${PATH_PREFIX}/meters/batch`, { meters }, opts);
+    }
+    listInvoices(query) {
+        return this.internal.request("GET", `${PATH_PREFIX}/invoices`, undefined, { query });
+    }
+    getInvoice(invoiceId) {
+        return this.internal.request("GET", `${PATH_PREFIX}/invoices/${invoiceId}`);
+    }
+    getCreditBalance(tenantId) {
+        return this.internal.request("GET", `${PATH_PREFIX}/credits/balance/${tenantId}`);
+    }
+}
+//# sourceMappingURL=billing.js.map

package/dist/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,WAAW,GAAG,mBAAmB,CAAC;AASxC,MAAM,OAAO,aAAa;IACI;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,KAAK,CAAC,eAAe;QACpB,yFAAyF;QACzF,iFAAiF;QACjF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,0BAA0B,QAAQ,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,WAAW,CAAC,GAAuB,EAAE,IAA6C;QACjF,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;IAED,YAAY,CACX,MAAqC,EACrC,IAA6C;QAE7C,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;IACvF,CAAC;IAED,YAAY,CAAC,KAA+B;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,WAAW,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,UAAU,CAAC,SAAiB;QAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,aAAa,SAAS,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,oBAAoB,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC;CACD"}

package/dist/browser/encrypt.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Client-side encryption (CSE) helpers for browser PQC operations.
+ *
+ * Provides encrypt-before-upload and decrypt-after-download using:
+ * - ML-KEM (FIPS 203) for key encapsulation → derives AES-256-GCM key
+ * - AES-256-GCM via WebCrypto API for bulk data encryption (hardware-accelerated)
+ *
+ * No node: imports. Works in browsers, Deno, Bun, and Node.js 20+.
+ *
+ * @module
+ */
+import type { PqcAlgorithm } from "./pqc-types.js";
+/**
+ * CSE envelope: contains everything needed to decrypt the data.
+ * The recipient needs their private key + this envelope to recover plaintext.
+ */
+export interface CseEnvelope {
+    /** PQC algorithm used for key encapsulation. */
+    readonly algorithm: PqcAlgorithm;
+    /** KEM ciphertext (encapsulated shared secret). */
+    readonly kemCiphertext: Uint8Array;
+    /** AES-256-GCM initialization vector. */
+    readonly iv: Uint8Array;
+    /** AES-256-GCM encrypted data (includes authentication tag). */
+    readonly ciphertext: Uint8Array;
+}
+/**
+ * Encrypt data using PQC key encapsulation + AES-256-GCM.
+ *
+ * Flow:
+ * 1. ML-KEM encapsulate with recipient's public key → shared secret + KEM ciphertext
+ * 2. Derive AES-256-GCM key from shared secret (first 32 bytes)
+ * 3. Generate random IV
+ * 4. AES-256-GCM encrypt the plaintext
+ * 5. Return CSE envelope (KEM ciphertext + IV + AES ciphertext)
+ *
+ * @param plaintext - Data to encrypt
+ * @param publicKey - Recipient's PQC public key (from ML-KEM keygen)
+ * @param algorithm - KEM algorithm to use (kyber-512, kyber-768, kyber-1024)
+ * @returns CSE envelope containing all data needed for decryption
+ */
+export declare function encryptBeforeUpload(plaintext: Uint8Array, publicKey: Uint8Array, algorithm: PqcAlgorithm): Promise<CseEnvelope>;
+/**
+ * Decrypt a CSE envelope using PQC key decapsulation + AES-256-GCM.
+ *
+ * Flow:
+ * 1. ML-KEM decapsulate with recipient's private key → shared secret
+ * 2. Derive AES-256-GCM key from shared secret (first 32 bytes)
+ * 3. AES-256-GCM decrypt using IV from envelope
+ * 4. Return plaintext
+ *
+ * @param envelope - CSE envelope from encryptBeforeUpload()
+ * @param privateKey - Recipient's PQC private key (from ML-KEM keygen)
+ * @returns Decrypted plaintext
+ */
+export declare function decryptAfterDownload(envelope: CseEnvelope, privateKey: Uint8Array): Promise<Uint8Array>;
+/**
+ * Serialize a CSE envelope to a single Uint8Array for storage/transmission.
+ *
+ * Format: [algorithmLen(2)] [algorithm] [kemCtLen(4)] [kemCt] [ivLen(1)] [iv] [ciphertext]
+ * All lengths are big-endian unsigned integers.
+ */
+export declare function serializeCseEnvelope(envelope: CseEnvelope): Uint8Array;
+/**
+ * Deserialize a CSE envelope from a Uint8Array.
+ */
+export declare function deserializeCseEnvelope(data: Uint8Array): CseEnvelope;
+//# sourceMappingURL=encrypt.d.ts.map

package/dist/browser/encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../src/browser/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAenD;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,mDAAmD;IACnD,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC;IACnC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CAChC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACxC,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,YAAY,GACrB,OAAO,CAAC,WAAW,CAAC,CAgDtB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACzC,QAAQ,EAAE,WAAW,EACrB,UAAU,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAuCrB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,WAAW,GAAG,UAAU,CAqCtE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,CAkDpE"}

package/dist/browser/encrypt.js

@@ -0,0 +1,191 @@
+/**
+ * Client-side encryption (CSE) helpers for browser PQC operations.
+ *
+ * Provides encrypt-before-upload and decrypt-after-download using:
+ * - ML-KEM (FIPS 203) for key encapsulation → derives AES-256-GCM key
+ * - AES-256-GCM via WebCrypto API for bulk data encryption (hardware-accelerated)
+ *
+ * No node: imports. Works in browsers, Deno, Bun, and Node.js 20+.
+ *
+ * @module
+ */
+import { getActiveProvider } from "./provider-setup.js";
+/** KEM algorithms supported for CSE operations. */
+const KEM_ALGORITHMS = new Set(["kyber-512", "kyber-768", "kyber-1024"]);
+/** AES-256-GCM IV size in bytes. */
+const AES_GCM_IV_BYTES = 12;
+/** AES-256-GCM key size in bytes. */
+const AES_GCM_KEY_BYTES = 32;
+/** AES-256-GCM tag size in bits. */
+const AES_GCM_TAG_BITS = 128;
+/**
+ * Encrypt data using PQC key encapsulation + AES-256-GCM.
+ *
+ * Flow:
+ * 1. ML-KEM encapsulate with recipient's public key → shared secret + KEM ciphertext
+ * 2. Derive AES-256-GCM key from shared secret (first 32 bytes)
+ * 3. Generate random IV
+ * 4. AES-256-GCM encrypt the plaintext
+ * 5. Return CSE envelope (KEM ciphertext + IV + AES ciphertext)
+ *
+ * @param plaintext - Data to encrypt
+ * @param publicKey - Recipient's PQC public key (from ML-KEM keygen)
+ * @param algorithm - KEM algorithm to use (kyber-512, kyber-768, kyber-1024)
+ * @returns CSE envelope containing all data needed for decryption
+ */
+export async function encryptBeforeUpload(plaintext, publicKey, algorithm) {
+    if (!KEM_ALGORITHMS.has(algorithm)) {
+        throw new Error(`Algorithm '${algorithm}' is not a supported KEM algorithm for CSE. ` +
+            `Supported: ${[...KEM_ALGORITHMS].join(", ")}`);
+    }
+    if (plaintext.length === 0) {
+        throw new Error("Plaintext must not be empty");
+    }
+    if (publicKey.length === 0) {
+        throw new Error("Public key must not be empty");
+    }
+    const provider = getActiveProvider();
+    // Step 1: KEM encapsulate → shared secret + ciphertext
+    const { ciphertext: kemCiphertext, sharedSecret } = await provider.encapsulate({
+        algorithm,
+        publicKey,
+    });
+    // Step 2: Derive AES-256-GCM key from shared secret
+    const aesKeyBytes = new Uint8Array(sharedSecret.buffer.slice(sharedSecret.byteOffset, sharedSecret.byteOffset + AES_GCM_KEY_BYTES));
+    const aesKey = await crypto.subtle.importKey("raw", aesKeyBytes, { name: "AES-GCM" }, false, [
+        "encrypt",
+    ]);
+    // Step 3: Generate random IV
+    const iv = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
+    // Step 4: AES-256-GCM encrypt
+    const encrypted = await crypto.subtle.encrypt({ name: "AES-GCM", iv, tagLength: AES_GCM_TAG_BITS }, aesKey, new Uint8Array(plaintext));
+    return {
+        algorithm,
+        kemCiphertext: new Uint8Array(kemCiphertext),
+        iv: new Uint8Array(iv),
+        ciphertext: new Uint8Array(encrypted),
+    };
+}
+/**
+ * Decrypt a CSE envelope using PQC key decapsulation + AES-256-GCM.
+ *
+ * Flow:
+ * 1. ML-KEM decapsulate with recipient's private key → shared secret
+ * 2. Derive AES-256-GCM key from shared secret (first 32 bytes)
+ * 3. AES-256-GCM decrypt using IV from envelope
+ * 4. Return plaintext
+ *
+ * @param envelope - CSE envelope from encryptBeforeUpload()
+ * @param privateKey - Recipient's PQC private key (from ML-KEM keygen)
+ * @returns Decrypted plaintext
+ */
+export async function decryptAfterDownload(envelope, privateKey) {
+    if (!KEM_ALGORITHMS.has(envelope.algorithm)) {
+        throw new Error(`Algorithm '${envelope.algorithm}' is not a supported KEM algorithm for CSE. ` +
+            `Supported: ${[...KEM_ALGORITHMS].join(", ")}`);
+    }
+    if (privateKey.length === 0) {
+        throw new Error("Private key must not be empty");
+    }
+    const provider = getActiveProvider();
+    // Step 1: KEM decapsulate → shared secret
+    const sharedSecret = await provider.decapsulate({
+        algorithm: envelope.algorithm,
+        ciphertext: envelope.kemCiphertext,
+        privateKey,
+    });
+    // Step 2: Derive AES-256-GCM key from shared secret
+    const aesKeyBytes = new Uint8Array(sharedSecret.buffer.slice(sharedSecret.byteOffset, sharedSecret.byteOffset + AES_GCM_KEY_BYTES));
+    const aesKey = await crypto.subtle.importKey("raw", aesKeyBytes, { name: "AES-GCM" }, false, [
+        "decrypt",
+    ]);
+    // Step 3: AES-256-GCM decrypt
+    const ciphertextBuf = new Uint8Array(envelope.ciphertext);
+    const ivBuf = new Uint8Array(envelope.iv);
+    const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv: ivBuf, tagLength: AES_GCM_TAG_BITS }, aesKey, ciphertextBuf);
+    return new Uint8Array(decrypted);
+}
+/**
+ * Serialize a CSE envelope to a single Uint8Array for storage/transmission.
+ *
+ * Format: [algorithmLen(2)] [algorithm] [kemCtLen(4)] [kemCt] [ivLen(1)] [iv] [ciphertext]
+ * All lengths are big-endian unsigned integers.
+ */
+export function serializeCseEnvelope(envelope) {
+    const algorithmBytes = new TextEncoder().encode(envelope.algorithm);
+    const totalLen = 2 +
+        algorithmBytes.length +
+        4 +
+        envelope.kemCiphertext.length +
+        1 +
+        envelope.iv.length +
+        envelope.ciphertext.length;
+    const result = new Uint8Array(totalLen);
+    const view = new DataView(result.buffer);
+    let offset = 0;
+    // Algorithm name length (2 bytes) + algorithm name
+    view.setUint16(offset, algorithmBytes.length);
+    offset += 2;
+    result.set(algorithmBytes, offset);
+    offset += algorithmBytes.length;
+    // KEM ciphertext length (4 bytes) + KEM ciphertext
+    view.setUint32(offset, envelope.kemCiphertext.length);
+    offset += 4;
+    result.set(envelope.kemCiphertext, offset);
+    offset += envelope.kemCiphertext.length;
+    // IV length (1 byte) + IV
+    result[offset] = envelope.iv.length;
+    offset += 1;
+    result.set(envelope.iv, offset);
+    offset += envelope.iv.length;
+    // Remaining bytes = AES ciphertext
+    result.set(envelope.ciphertext, offset);
+    return result;
+}
+/**
+ * Deserialize a CSE envelope from a Uint8Array.
+ */
+export function deserializeCseEnvelope(data) {
+    if (data.length < 9) {
+        throw new Error("Invalid CSE envelope: too short");
+    }
+    const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+    let offset = 0;
+    // Algorithm name
+    const algorithmLen = view.getUint16(offset);
+    offset += 2;
+    if (offset + algorithmLen > data.length) {
+        throw new Error("Invalid CSE envelope: algorithm length exceeds data");
+    }
+    const algorithm = new TextDecoder().decode(data.slice(offset, offset + algorithmLen));
+    offset += algorithmLen;
+    // KEM ciphertext
+    if (offset + 4 > data.length) {
+        throw new Error("Invalid CSE envelope: missing KEM ciphertext length");
+    }
+    const kemCtLen = view.getUint32(offset);
+    offset += 4;
+    if (offset + kemCtLen > data.length) {
+        throw new Error("Invalid CSE envelope: KEM ciphertext length exceeds data");
+    }
+    const kemCiphertext = data.slice(offset, offset + kemCtLen);
+    offset += kemCtLen;
+    // IV
+    if (offset + 1 > data.length) {
+        throw new Error("Invalid CSE envelope: missing IV length");
+    }
+    const ivLen = data[offset] ?? 0;
+    offset += 1;
+    if (offset + ivLen > data.length) {
+        throw new Error("Invalid CSE envelope: IV length exceeds data");
+    }
+    const iv = data.slice(offset, offset + ivLen);
+    offset += ivLen;
+    // AES ciphertext (remaining bytes)
+    const ciphertext = data.slice(offset);
+    if (ciphertext.length === 0) {
+        throw new Error("Invalid CSE envelope: empty ciphertext");
+    }
+    return { algorithm, kemCiphertext, iv, ciphertext };
+}
+//# sourceMappingURL=encrypt.js.map