@heossi/qnsi 0.5.0 → 0.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +58 -58
- package/dist/auth.d.ts +2 -2
- package/dist/auth.js +3 -3
- package/dist/auth.js.map +1 -1
- package/dist/crypto-inventory.d.ts +28 -3
- package/dist/crypto-inventory.d.ts.map +1 -1
- package/dist/crypto-inventory.js +41 -6
- package/dist/crypto-inventory.js.map +1 -1
- package/package.json +3 -3
package/README.md
CHANGED
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
[](https://www.npmjs.com/package/@heossi/qnsi)
|
|
4
4
|
[](./LICENSE)
|
|
5
5
|
|
|
6
|
-
The official **single-package** Node.js / TypeScript SDK for QNSI. Covers the full customer-facing platform — vault, KMS, audit, auth, tenant, access-control, billing, crypto-inventory, storage, search, and AI orchestrator — plus webhook signature verification. Mirrors the shape of the `
|
|
6
|
+
The official **single-package** Node.js / TypeScript SDK for QNSI. Covers the full customer-facing platform — vault, KMS, audit, auth, tenant, access-control, billing, crypto-inventory, storage, search, and AI orchestrator — plus webhook signature verification. Mirrors the shape of the `qnsi` Python / Go / Rust SDKs byte-for-byte: same wire contracts, same algorithm names, same FIPS 203 / 204 / 205 posture.
|
|
7
7
|
|
|
8
8
|
> **Free tier available.** Free-forever account at <https://cloud.qnsi.heossi.com/auth> — 60-second signup, no credit card. Includes 10 GB PQC storage, 50 000 API calls/month, 20 KMS keys, 25 vault secrets.
|
|
9
9
|
|
|
@@ -14,12 +14,12 @@ Previous TypeScript consumers had to install up to 11 separate `@heossi/qnsi-*-s
|
|
|
14
14
|
```ts
|
|
15
15
|
import { QnsiClient } from "@heossi/qnsi";
|
|
16
16
|
|
|
17
|
-
const
|
|
17
|
+
const qnsi = new QnsiClient({ apiKey: process.env.QNSI_API_KEY! });
|
|
18
18
|
|
|
19
|
-
await
|
|
20
|
-
await
|
|
21
|
-
await
|
|
22
|
-
await
|
|
19
|
+
await qnsi.vault.createSecret({ ... }); // was @heossi/qnsi-vault-sdk
|
|
20
|
+
await qnsi.kms.sign(keyId, data); // was @heossi/qnsi-kms-client
|
|
21
|
+
await qnsi.audit.logEvent({ ... }); // was @heossi/qnsi-audit-sdk
|
|
22
|
+
await qnsi.tenant.getTenant(tenantId); // was @heossi/qnsi-tenant-sdk
|
|
23
23
|
// ...
|
|
24
24
|
```
|
|
25
25
|
|
|
@@ -42,30 +42,30 @@ Requires Node.js ≥ 22.0.0. ESM-first; CommonJS consumers can `await import("@h
|
|
|
42
42
|
```ts
|
|
43
43
|
import { QnsiClient } from "@heossi/qnsi";
|
|
44
44
|
|
|
45
|
-
const
|
|
45
|
+
const qnsi = new QnsiClient({ apiKey: process.env.QNSI_API_KEY! });
|
|
46
46
|
|
|
47
47
|
// Vault — PQC-encrypted secret storage
|
|
48
|
-
const secret = await
|
|
48
|
+
const secret = await qnsi.vault.createSecret({
|
|
49
49
|
name: "openai-api-key",
|
|
50
50
|
payloadB64: Buffer.from("sk-...").toString("base64"),
|
|
51
51
|
algorithm: "ml-kem-768",
|
|
52
52
|
});
|
|
53
53
|
|
|
54
54
|
// KMS — server-side PQC keys
|
|
55
|
-
const key = await
|
|
56
|
-
const sig = await
|
|
57
|
-
const ok = await
|
|
55
|
+
const key = await qnsi.kms.createKey({ algorithm: "ml-dsa-65", purpose: "signing" });
|
|
56
|
+
const sig = await qnsi.kms.sign(key.keyId as string, new TextEncoder().encode("hello"));
|
|
57
|
+
const ok = await qnsi.kms.verify(key.keyId as string, new TextEncoder().encode("hello"), sig);
|
|
58
58
|
|
|
59
59
|
// Audit — immutable, hash-chained event log
|
|
60
|
-
await
|
|
60
|
+
await qnsi.audit.logEvent({
|
|
61
61
|
eventType: "model.inference",
|
|
62
62
|
payload: { modelId: "gpt-4o", latencyMs: 412 },
|
|
63
63
|
});
|
|
64
64
|
|
|
65
65
|
// Tenant, access, billing, crypto-inventory, storage, search, ai, auth — all on one client
|
|
66
|
-
await
|
|
67
|
-
await
|
|
68
|
-
await
|
|
66
|
+
await qnsi.tenant.getTenant(await qnsi.tenantId());
|
|
67
|
+
await qnsi.access.checkPermission({ subjectId: "user-1", permission: "vault.read" });
|
|
68
|
+
await qnsi.billing.getEntitlements();
|
|
69
69
|
```
|
|
70
70
|
|
|
71
71
|
## Modules
|
|
@@ -74,39 +74,39 @@ Each sub-namespace wraps one QNSI backend service:
|
|
|
74
74
|
|
|
75
75
|
| Sub-client | Wraps | Key methods |
|
|
76
76
|
|---|---|---|
|
|
77
|
-
| `
|
|
78
|
-
| `
|
|
79
|
-
| `
|
|
80
|
-
| `
|
|
81
|
-
| `
|
|
82
|
-
| `
|
|
83
|
-
| `
|
|
84
|
-
| `
|
|
85
|
-
| `
|
|
86
|
-
| `
|
|
87
|
-
| `
|
|
77
|
+
| `qnsi.vault` | `apps/vault-service` (`/vault/v1`) | `createSecret`, `getSecret`, `getSecretVersion`, `rotateSecret`, `deleteSecret`, `listSecretVersions` |
|
|
78
|
+
| `qnsi.kms` | `apps/kms-service` (`/kms/v1`) | `createKey`, `listKeys`, `getKey`, `rotateKey`, `deleteKey`, `sign`, `verify`, `wrap`, `unwrap` |
|
|
79
|
+
| `qnsi.audit` | `apps/audit-service` (`/audit/v1`) | `logEvent`, `ingestEvents`, `listEvents` |
|
|
80
|
+
| `qnsi.auth` | `apps/auth-service` (`/auth/v1`) | `login`, `refreshToken`, `revoke`, WebAuthn passkey lifecycle, `mfaChallenge` / `mfaVerify`, `federateSAML` / `federateOIDC`, `evaluateRisk` |
|
|
81
|
+
| `qnsi.tenant` | `apps/tenant-service` (`/tenant/v1`) | `createTenant`, `getTenant`, `updateTenant`, `listTenants`, `getCryptoPolicy`, `upsertCryptoPolicy`, `getCurrentHealth`, `getCurrentQuotas` |
|
|
82
|
+
| `qnsi.access` | `apps/access-control-service` (`/access/v1`) | `createRole`, `getRole`, `listRoles`, `deleteRole`, `assignRole`, `revokeRoleAssignment`, `checkPermission` |
|
|
83
|
+
| `qnsi.billing` | `apps/billing-service` (`/billing/v1`) | `getEntitlements`, `ingestMeter`, `ingestMeters`, `listInvoices`, `getInvoice`, `getCreditBalance` |
|
|
84
|
+
| `qnsi.cryptoInventory` | `apps/crypto-inventory-service` (`/crypto/v1`) | `listAssets`, `getAsset`, `getAssetStats`, `discoverAssets`, `getReadinessScore` |
|
|
85
|
+
| `qnsi.storage` | `apps/storage-service` (`/storage/storage/v1`) | `putObject`, `getObject` (returns `[bytes, descriptor]`), `deleteObject`, `listObjects`, `listBuckets` |
|
|
86
|
+
| `qnsi.search` | `apps/search-service` (`/search/v1`) | `createIndex`, `listIndexes`, `deleteIndex`, `upsertVectors`, `query` |
|
|
87
|
+
| `qnsi.ai` | `apps/ai-orchestrator` (`/ai/v1`) | model registry (`registerModel`, `listModels`, `getModel`, `updateModel`, `activateModel`, `deployModel`), workloads (`submitWorkload`, `getWorkload`, `listWorkloads`, `cancelWorkload`), `invokeInference`, `registerArtifact` |
|
|
88
88
|
|
|
89
89
|
## Verifying inbound webhooks
|
|
90
90
|
|
|
91
91
|
QNSI signs every webhook with HMAC-SHA-256. Verify the **raw body** before parsing JSON:
|
|
92
92
|
|
|
93
93
|
```ts
|
|
94
|
-
import {
|
|
94
|
+
import { parseQnsiWebhook, QnsiWebhookError } from "@heossi/qnsi";
|
|
95
95
|
|
|
96
|
-
app.post("/webhooks/
|
|
96
|
+
app.post("/webhooks/qnsi", express.raw({ type: "application/json" }), (req, res) => {
|
|
97
97
|
try {
|
|
98
|
-
const event =
|
|
98
|
+
const event = parseQnsiWebhook({
|
|
99
99
|
body: req.body, // raw Buffer
|
|
100
100
|
signatureHeader: req.header("x-qnsp-signature") ?? "",
|
|
101
101
|
timestampHeader: req.header("x-qnsp-timestamp"),
|
|
102
|
-
secret: process.env.
|
|
102
|
+
secret: process.env.QNSI_WEBHOOK_SECRET!,
|
|
103
103
|
});
|
|
104
104
|
if (event.eventType === "key.rotated") {
|
|
105
105
|
// ...
|
|
106
106
|
}
|
|
107
107
|
res.sendStatus(200);
|
|
108
108
|
} catch (err) {
|
|
109
|
-
if (err instanceof
|
|
109
|
+
if (err instanceof QnsiWebhookError) {
|
|
110
110
|
res.status(400).send(err.reason);
|
|
111
111
|
} else {
|
|
112
112
|
throw err;
|
|
@@ -119,23 +119,23 @@ Constant-time HMAC comparison, 5-minute replay window by default (`MAX_WEBHOOK_S
|
|
|
119
119
|
|
|
120
120
|
## Error handling
|
|
121
121
|
|
|
122
|
-
All errors descend from `
|
|
122
|
+
All errors descend from `QnsiError`:
|
|
123
123
|
|
|
124
124
|
| Class | When |
|
|
125
125
|
|---|---|
|
|
126
|
-
| `
|
|
127
|
-
| `
|
|
128
|
-
| `
|
|
129
|
-
| `
|
|
126
|
+
| `QnsiNetworkError` | DNS, TLS, timeout, or connection failure |
|
|
127
|
+
| `QnsiAuthError` | API key rejected at activation |
|
|
128
|
+
| `QnsiApiError` | A service returned 4xx/5xx with a structured body |
|
|
129
|
+
| `QnsiWebhookError` | HMAC mismatch, expired timestamp, malformed body, etc. |
|
|
130
130
|
|
|
131
131
|
```ts
|
|
132
|
-
import {
|
|
132
|
+
import { QnsiApiError, QnsiNetworkError } from "@heossi/qnsi";
|
|
133
133
|
|
|
134
134
|
try {
|
|
135
|
-
await
|
|
135
|
+
await qnsi.vault.getSecret("missing");
|
|
136
136
|
} catch (err) {
|
|
137
|
-
if (err instanceof
|
|
138
|
-
else if (err instanceof
|
|
137
|
+
if (err instanceof QnsiApiError) console.log("HTTP", err.statusCode, err.code);
|
|
138
|
+
else if (err instanceof QnsiNetworkError) console.log("could not reach QNSI:", err.message);
|
|
139
139
|
else throw err;
|
|
140
140
|
}
|
|
141
141
|
```
|
|
@@ -145,13 +145,13 @@ try {
|
|
|
145
145
|
`QnsiClient` performs a one-shot handshake against `/billing/v1/sdk/activate` on first use. The result is cached in memory; subsequent calls reuse it until ~60 s before expiry. You can inspect the current activation:
|
|
146
146
|
|
|
147
147
|
```ts
|
|
148
|
-
await
|
|
149
|
-
await
|
|
150
|
-
await
|
|
151
|
-
await
|
|
148
|
+
await qnsi.tenantId(); // resolved tenant
|
|
149
|
+
await qnsi.tier(); // plan tier
|
|
150
|
+
await qnsi.limits(); // full limits dict
|
|
151
|
+
await qnsi.hasFeature("sseEnabled"); // convenience boolean
|
|
152
152
|
|
|
153
153
|
// Force the handshake at startup so you fail fast on a bad key:
|
|
154
|
-
await
|
|
154
|
+
await qnsi.ensureActivated();
|
|
155
155
|
```
|
|
156
156
|
|
|
157
157
|
If the activation token is rotated server-side, the SDK invalidates its cache and retries the originating request once on a 401.
|
|
@@ -162,17 +162,17 @@ The per-service `@heossi/qnsi-*-sdk` packages on npm are now **deprecated** in f
|
|
|
162
162
|
|
|
163
163
|
| Before | After |
|
|
164
164
|
|---|---|
|
|
165
|
-
| `import { VaultClient } from "@heossi/qnsi-vault-sdk"` | `import { QnsiClient } from "@heossi/qnsi"` then `
|
|
166
|
-
| `import { KmsClient } from "@heossi/qnsi-kms-client"` | `
|
|
167
|
-
| `import { AuthClient } from "@heossi/qnsi-auth-sdk"` | `
|
|
168
|
-
| `import { TenantClient } from "@heossi/qnsi-tenant-sdk"` | `
|
|
169
|
-
| `import { AccessControlClient } from "@heossi/qnsi-access-control-sdk"` | `
|
|
170
|
-
| `import { BillingClient } from "@heossi/qnsi-billing-sdk"` | `
|
|
171
|
-
| `import { CryptoInventoryClient } from "@heossi/qnsi-crypto-inventory-sdk"` | `
|
|
172
|
-
| `import { StorageClient } from "@heossi/qnsi-storage-sdk"` | `
|
|
173
|
-
| `import { SearchClient } from "@heossi/qnsi-search-sdk"` | `
|
|
174
|
-
| `import { AiOrchestratorClient } from "@heossi/qnsi-ai-sdk"` | `
|
|
175
|
-
| `import { AuditClient } from "@heossi/qnsi-audit-sdk"` | `
|
|
165
|
+
| `import { VaultClient } from "@heossi/qnsi-vault-sdk"` | `import { QnsiClient } from "@heossi/qnsi"` then `qnsi.vault` |
|
|
166
|
+
| `import { KmsClient } from "@heossi/qnsi-kms-client"` | `qnsi.kms` |
|
|
167
|
+
| `import { AuthClient } from "@heossi/qnsi-auth-sdk"` | `qnsi.auth` |
|
|
168
|
+
| `import { TenantClient } from "@heossi/qnsi-tenant-sdk"` | `qnsi.tenant` |
|
|
169
|
+
| `import { AccessControlClient } from "@heossi/qnsi-access-control-sdk"` | `qnsi.access` |
|
|
170
|
+
| `import { BillingClient } from "@heossi/qnsi-billing-sdk"` | `qnsi.billing` |
|
|
171
|
+
| `import { CryptoInventoryClient } from "@heossi/qnsi-crypto-inventory-sdk"` | `qnsi.cryptoInventory` |
|
|
172
|
+
| `import { StorageClient } from "@heossi/qnsi-storage-sdk"` | `qnsi.storage` |
|
|
173
|
+
| `import { SearchClient } from "@heossi/qnsi-search-sdk"` | `qnsi.search` |
|
|
174
|
+
| `import { AiOrchestratorClient } from "@heossi/qnsi-ai-sdk"` | `qnsi.ai` |
|
|
175
|
+
| `import { AuditClient } from "@heossi/qnsi-audit-sdk"` | `qnsi.audit` |
|
|
176
176
|
|
|
177
177
|
The constructor signature is simpler — one `apiKey` for everything, instead of a per-service config:
|
|
178
178
|
|
|
@@ -189,8 +189,8 @@ const audit = new AuditClient({ apiKey, baseUrl: "https://api.qnsi.heossi.com/pr
|
|
|
189
189
|
// After — one package, one activation, one client
|
|
190
190
|
import { QnsiClient } from "@heossi/qnsi";
|
|
191
191
|
|
|
192
|
-
const
|
|
193
|
-
//
|
|
192
|
+
const qnsi = new QnsiClient({ apiKey });
|
|
193
|
+
// qnsi.vault, qnsi.kms, qnsi.audit, ... all share one connection pool + one activation cache
|
|
194
194
|
```
|
|
195
195
|
|
|
196
196
|
The wire contracts are identical, so migrating method-by-method is mechanical.
|
package/dist/auth.d.ts
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* QNSI Auth — JWT issuance, refresh, revocation, WebAuthn passkeys, MFA,
|
|
3
3
|
* federated identity (SAML / OIDC), risk-based authentication. Wraps
|
|
4
|
-
* `apps/auth-service` (`/auth
|
|
4
|
+
* `apps/auth-service` (routes are `/auth/*`, no `/v1` segment).
|
|
5
5
|
*/
|
|
6
6
|
import type { Internal } from "./_internal.js";
|
|
7
7
|
export interface LoginRequest {
|
package/dist/auth.js
CHANGED
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* QNSI Auth — JWT issuance, refresh, revocation, WebAuthn passkeys, MFA,
|
|
3
3
|
* federated identity (SAML / OIDC), risk-based authentication. Wraps
|
|
4
|
-
* `apps/auth-service` (`/auth
|
|
4
|
+
* `apps/auth-service` (routes are `/auth/*`, no `/v1` segment).
|
|
5
5
|
*/
|
|
6
|
-
const PATH_PREFIX = "/proxy/auth
|
|
6
|
+
const PATH_PREFIX = "/proxy/auth";
|
|
7
7
|
export class AuthClient {
|
|
8
8
|
internal;
|
|
9
9
|
constructor(internal) {
|
package/dist/auth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,GAAG,
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,GAAG,aAAa,CAAC;AAQlC,MAAM,OAAO,UAAU;IACO;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,KAAK,CAAC,GAAiB;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,QAAQ,EAAE,GAAG,CAAC,CAAC;IACnE,CAAC;IAED,YAAY,CAAC,YAAoB;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,UAAU,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAoB;QAChC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,oEAAoE;IAEpE,oBAAoB,CAAC,MAAc,EAAE,QAAgB;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,0BAA0B,EAAE;YAC9E,MAAM;YACN,QAAQ;SACR,CAAC,CAAC;IACJ,CAAC;IAED,uBAAuB,CAAC,IAA6B;QACpD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,6BAA6B,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,wBAAwB,CAAC,IAA6B;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,8BAA8B,EAAE,IAAI,CAAC,CAAC;IAC1F,CAAC;IAED,2BAA2B,CAAC,IAA6B;QACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,iCAAiC,EAAE,IAAI,CAAC,CAAC;IAC7F,CAAC;IAED,YAAY,CAAC,MAAc,EAAE,QAAgB;QAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,WAAW,EAAE,SAAS,EAAE;YACzE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC3B,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,YAAoB;QACvC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,WAAW,aAAa,YAAY,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,oEAAoE;IAEpE,YAAY,CAAC,IAA6B;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,SAAS,CAAC,IAA6B;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,aAAa,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,mEAAmE;IAEnE,YAAY,CAAC,IAA6B;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,YAAY,CAAC,IAA6B;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,oEAAoE;IAEpE,YAAY,CAAC,IAA6B;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,gBAAgB,EAAE,SAAS,EAAE;YAC9E,KAAK,EAAE,EAAE,QAAQ,EAAE;SACnB,CAAC,CAAC;IACJ,CAAC;CACD"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* QNSI Crypto-Inventory (CBOM) — asset catalogue, discovery runs,
|
|
3
3
|
* deprecation policies, PQC migration readiness. Wraps
|
|
4
4
|
* `apps/crypto-inventory-service` (`/crypto/v1`).
|
|
5
5
|
*/
|
|
@@ -14,8 +14,33 @@ export declare class CryptoInventoryClient {
|
|
|
14
14
|
constructor(internal: Internal);
|
|
15
15
|
listAssets(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
|
|
16
16
|
getAsset(assetId: string): Promise<Record<string, unknown>>;
|
|
17
|
-
|
|
17
|
+
/** @param _tenantId deprecated and ignored — the tenant is derived from the API key. */
|
|
18
|
+
getAssetStats(_tenantId?: string): Promise<Record<string, unknown>>;
|
|
18
19
|
discoverAssets(req: DiscoverAssetsRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
|
|
19
|
-
|
|
20
|
+
/**
|
|
21
|
+
* Basic readiness summary (`/readiness`). For the scored PQC-migration
|
|
22
|
+
* attestation prefer {@link getPqcReadinessScore}.
|
|
23
|
+
* @param _tenantId deprecated and ignored — the tenant is derived from the API key.
|
|
24
|
+
*/
|
|
25
|
+
getReadinessScore(_tenantId?: string): Promise<Record<string, unknown>>;
|
|
26
|
+
/**
|
|
27
|
+
* PQC migration-readiness score for the tenant (0–100 with category
|
|
28
|
+
* breakdown) — the score behind a "PQC-ready" attestation.
|
|
29
|
+
*/
|
|
30
|
+
getPqcReadinessScore(): Promise<Record<string, unknown>>;
|
|
31
|
+
/** Actionable PQC-migration recommendations for the tenant. */
|
|
32
|
+
getPqcReadinessRecommendations(): Promise<Record<string, unknown>>;
|
|
33
|
+
/**
|
|
34
|
+
* Aggregated Cryptographic Bill of Materials (CycloneDX 1.5) for the tenant —
|
|
35
|
+
* the machine-verifiable inventory behind the conformance/attestation claim.
|
|
36
|
+
*/
|
|
37
|
+
getCbom(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
|
|
38
|
+
/** List discovery runs for the tenant. */
|
|
39
|
+
listDiscoveryRuns(query?: RequestOptions["query"]): Promise<Record<string, unknown>>;
|
|
40
|
+
/**
|
|
41
|
+
* Import a batch of cryptographic assets (scan output / inventory upload)
|
|
42
|
+
* into the tenant's CBOM.
|
|
43
|
+
*/
|
|
44
|
+
importAssets(body: Record<string, unknown>, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Record<string, unknown>>;
|
|
20
45
|
}
|
|
21
46
|
//# sourceMappingURL=crypto-inventory.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"crypto-inventory.d.ts","sourceRoot":"","sources":["../src/crypto-inventory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI/D,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,qBAAa,qBAAqB;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,UAAU,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAI1C,QAAQ,CAAC,OAAO,EAAE,MAAM;IAIxB,aAAa,CAAC,
|
|
1
|
+
{"version":3,"file":"crypto-inventory.d.ts","sourceRoot":"","sources":["../src/crypto-inventory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI/D,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,qBAAa,qBAAqB;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,UAAU,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAI1C,QAAQ,CAAC,OAAO,EAAE,MAAM;IAIxB,wFAAwF;IACxF,aAAa,CAAC,SAAS,CAAC,EAAE,MAAM;IAIhC,cAAc,CAAC,GAAG,EAAE,qBAAqB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAIxF;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM;IAIpC;;;OAGG;IACH,oBAAoB;IAIpB,+DAA+D;IAC/D,8BAA8B;IAI9B;;;OAGG;IACH,OAAO,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAIvC,0CAA0C;IAC1C,iBAAiB,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAIjD;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;CAGzF"}
|
package/dist/crypto-inventory.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
/**
|
|
2
|
-
*
|
|
2
|
+
* QNSI Crypto-Inventory (CBOM) — asset catalogue, discovery runs,
|
|
3
3
|
* deprecation policies, PQC migration readiness. Wraps
|
|
4
4
|
* `apps/crypto-inventory-service` (`/crypto/v1`).
|
|
5
5
|
*/
|
|
@@ -15,14 +15,49 @@ export class CryptoInventoryClient {
|
|
|
15
15
|
getAsset(assetId) {
|
|
16
16
|
return this.internal.request("GET", `${PATH_PREFIX}/assets/${assetId}`);
|
|
17
17
|
}
|
|
18
|
-
|
|
19
|
-
|
|
18
|
+
/** @param _tenantId deprecated and ignored — the tenant is derived from the API key. */
|
|
19
|
+
getAssetStats(_tenantId) {
|
|
20
|
+
return this.internal.request("GET", `${PATH_PREFIX}/assets/stats`);
|
|
20
21
|
}
|
|
21
22
|
discoverAssets(req, opts) {
|
|
22
|
-
return this.internal.request("POST", `${PATH_PREFIX}/
|
|
23
|
+
return this.internal.request("POST", `${PATH_PREFIX}/assets/discover`, req, opts);
|
|
23
24
|
}
|
|
24
|
-
|
|
25
|
-
|
|
25
|
+
/**
|
|
26
|
+
* Basic readiness summary (`/readiness`). For the scored PQC-migration
|
|
27
|
+
* attestation prefer {@link getPqcReadinessScore}.
|
|
28
|
+
* @param _tenantId deprecated and ignored — the tenant is derived from the API key.
|
|
29
|
+
*/
|
|
30
|
+
getReadinessScore(_tenantId) {
|
|
31
|
+
return this.internal.request("GET", `${PATH_PREFIX}/readiness`);
|
|
32
|
+
}
|
|
33
|
+
/**
|
|
34
|
+
* PQC migration-readiness score for the tenant (0–100 with category
|
|
35
|
+
* breakdown) — the score behind a "PQC-ready" attestation.
|
|
36
|
+
*/
|
|
37
|
+
getPqcReadinessScore() {
|
|
38
|
+
return this.internal.request("GET", `${PATH_PREFIX}/pqc-readiness/score`);
|
|
39
|
+
}
|
|
40
|
+
/** Actionable PQC-migration recommendations for the tenant. */
|
|
41
|
+
getPqcReadinessRecommendations() {
|
|
42
|
+
return this.internal.request("GET", `${PATH_PREFIX}/pqc-readiness/recommendations`);
|
|
43
|
+
}
|
|
44
|
+
/**
|
|
45
|
+
* Aggregated Cryptographic Bill of Materials (CycloneDX 1.5) for the tenant —
|
|
46
|
+
* the machine-verifiable inventory behind the conformance/attestation claim.
|
|
47
|
+
*/
|
|
48
|
+
getCbom(query) {
|
|
49
|
+
return this.internal.request("GET", `${PATH_PREFIX}/cbom`, undefined, { query });
|
|
50
|
+
}
|
|
51
|
+
/** List discovery runs for the tenant. */
|
|
52
|
+
listDiscoveryRuns(query) {
|
|
53
|
+
return this.internal.request("GET", `${PATH_PREFIX}/discovery/runs`, undefined, { query });
|
|
54
|
+
}
|
|
55
|
+
/**
|
|
56
|
+
* Import a batch of cryptographic assets (scan output / inventory upload)
|
|
57
|
+
* into the tenant's CBOM.
|
|
58
|
+
*/
|
|
59
|
+
importAssets(body, opts) {
|
|
60
|
+
return this.internal.request("POST", `${PATH_PREFIX}/assets/import`, body, opts);
|
|
26
61
|
}
|
|
27
62
|
}
|
|
28
63
|
//# sourceMappingURL=crypto-inventory.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"crypto-inventory.js","sourceRoot":"","sources":["../src/crypto-inventory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAQvC,MAAM,OAAO,qBAAqB;IACJ;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,UAAU,CAAC,KAA+B;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,SAAS,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,QAAQ,CAAC,OAAe;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,WAAW,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,aAAa,CAAC,
|
|
1
|
+
{"version":3,"file":"crypto-inventory.js","sourceRoot":"","sources":["../src/crypto-inventory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAQvC,MAAM,OAAO,qBAAqB;IACJ;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,UAAU,CAAC,KAA+B;QACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,SAAS,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,QAAQ,CAAC,OAAe;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,WAAW,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,wFAAwF;IACxF,aAAa,CAAC,SAAkB;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,cAAc,CAAC,GAA0B,EAAE,IAA6C;QACvF,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,kBAAkB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,SAAkB;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,YAAY,CAAC,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,oBAAoB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,sBAAsB,CAAC,CAAC;IAC3E,CAAC;IAED,+DAA+D;IAC/D,8BAA8B;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,gCAAgC,CAAC,CAAC;IACrF,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,KAA+B;QACtC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,0CAA0C;IAC1C,iBAAiB,CAAC,KAA+B;QAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,iBAAiB,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,IAA6B,EAAE,IAA6C;QACxF,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,gBAAgB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;CACD"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@heossi/qnsi",
|
|
3
|
-
"version": "0.5.
|
|
3
|
+
"version": "0.5.1",
|
|
4
4
|
"publishConfig": {
|
|
5
5
|
"access": "public"
|
|
6
6
|
},
|
|
@@ -96,12 +96,12 @@
|
|
|
96
96
|
],
|
|
97
97
|
"repository": {
|
|
98
98
|
"type": "git",
|
|
99
|
-
"url": "https://github.com/
|
|
99
|
+
"url": "https://github.com/heossihq/qnsi-public",
|
|
100
100
|
"directory": "packages/qnsi"
|
|
101
101
|
},
|
|
102
102
|
"homepage": "https://cloud.qnsi.heossi.com",
|
|
103
103
|
"bugs": {
|
|
104
|
-
"url": "https://github.com/
|
|
104
|
+
"url": "https://github.com/heossihq/qnsi-public/issues"
|
|
105
105
|
},
|
|
106
106
|
"files": [
|
|
107
107
|
"dist/**/*",
|