@heossi/qnsi 0.5.6 → 0.6.0

package/dist/code-scan/strip.js

@@ -0,0 +1,150 @@
+/**
+ * Comment stripping — string-aware, per language family.
+ *
+ * Comments are removed BEFORE rule matching so a migration note that merely
+ * mentions a crypto API can never become a finding (the
+ * guard-that-reads-its-own-comment failure class, see
+ * .claude/rules/toolchain-single-source.md). String literals are KEPT:
+ * crypto APIs take algorithm names as string arguments
+ * (`Cipher.getInstance("RSA")`), so rules anchor on API context instead.
+ */
+const COMMENT_STYLE = {
+    javascript: "c",
+    typescript: "c",
+    java: "c",
+    kotlin: "c",
+    go: "c",
+    c: "c",
+    cpp: "c",
+    csharp: "c",
+    rust: "c",
+    python: "hash",
+    config: "hash",
+};
+export function createStripState() {
+    return { inBlockComment: false, inTripleQuote: null };
+}
+function isEscaped(line, index) {
+    let backslashes = 0;
+    for (let i = index - 1; i >= 0 && line[i] === "\\"; i--) {
+        backslashes++;
+    }
+    return backslashes % 2 === 1;
+}
+/**
+ * Strip C-family comments from one line, tracking block-comment state across
+ * lines and skipping comment tokens that appear inside string literals.
+ */
+function stripCFamilyLine(line, state) {
+    let out = "";
+    let inString = null;
+    let i = 0;
+    while (i < line.length) {
+        const ch = line[i] ?? "";
+        const next = line[i + 1] ?? "";
+        if (state.inBlockComment) {
+            if (ch === "*" && next === "/") {
+                state.inBlockComment = false;
+                i += 2;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (inString !== null) {
+            out += ch;
+            if (ch === inString && !isEscaped(line, i)) {
+                inString = null;
+            }
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === "`") {
+            inString = ch;
+            out += ch;
+            i++;
+            continue;
+        }
+        if (ch === "/" && next === "/") {
+            break; // line comment — drop the rest
+        }
+        if (ch === "/" && next === "*") {
+            state.inBlockComment = true;
+            i += 2;
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+/**
+ * Strip hash-family comments (Python, YAML, TOML, shell-style configs) from
+ * one line, tracking Python triple-quoted blocks across lines and skipping
+ * `#` characters that appear inside string literals.
+ */
+function stripHashFamilyLine(line, state) {
+    let out = "";
+    let inString = null;
+    let i = 0;
+    while (i < line.length) {
+        const ch = line[i] ?? "";
+        if (state.inTripleQuote !== null) {
+            if (line.startsWith(state.inTripleQuote, i)) {
+                state.inTripleQuote = null;
+                i += 3;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (inString !== null) {
+            out += ch;
+            if (ch === inString && !isEscaped(line, i)) {
+                inString = null;
+            }
+            i++;
+            continue;
+        }
+        if (line.startsWith('"""', i) || line.startsWith("'''", i)) {
+            state.inTripleQuote = line.slice(i, i + 3);
+            i += 3;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            inString = ch;
+            out += ch;
+            i++;
+            continue;
+        }
+        if (ch === "#") {
+            break; // comment — drop the rest
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+/**
+ * Strip comments from a full file, returning one entry per original line so
+ * finding line numbers stay 1:1 with the source.
+ */
+export function stripComments(content, language) {
+    const style = COMMENT_STYLE[language];
+    const lines = content.split(/\r?\n/);
+    if (style === "none") {
+        return lines;
+    }
+    const state = createStripState();
+    const stripped = [];
+    for (const line of lines) {
+        if (style === "c") {
+            stripped.push(stripCFamilyLine(line, state));
+        }
+        else {
+            stripped.push(stripHashFamilyLine(line, state));
+        }
+    }
+    return stripped;
+}
+//# sourceMappingURL=strip.js.map

package/dist/code-scan/strip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip.js","sourceRoot":"","sources":["../../src/code-scan/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,aAAa,GAAmC;IACrD,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,GAAG;IACf,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,EAAE,EAAE,GAAG;IACP,CAAC,EAAE,GAAG;IACN,GAAG,EAAE,GAAG;IACR,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;CACd,CAAC;AASF,MAAM,UAAU,gBAAgB;IAC/B,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACzD,WAAW,EAAE,CAAC;IACf,CAAC;IACD,OAAO,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAiB;IACxD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAChC,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;gBAC7B,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5C,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5C,QAAQ,GAAG,EAAE,CAAC;YACd,GAAG,IAAI,EAAE,CAAC;YACV,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,MAAM,CAAC,+BAA+B;QACvC,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QAED,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,EAAE,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAiB;IAC3D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzB,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC7C,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC3B,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5C,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5D,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC9B,QAAQ,GAAG,EAAE,CAAC;YACd,GAAG,IAAI,EAAE,CAAC;YACV,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,MAAM,CAAC,0BAA0B;QAClC,CAAC;QAED,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,EAAE,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,QAAkB;IAChE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/code-scan/types.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Core types for the source-code cryptography scanner.
+ *
+ * Design: docs/design/code-crypto-scanner.md. Findings are transport-shaped
+ * for the crypto-inventory ingest path: no source-code content beyond the
+ * matched rule id and a hash of the matched line ever leaves the scan host.
+ */
+export type Language = "javascript" | "typescript" | "python" | "java" | "kotlin" | "go" | "c" | "cpp" | "csharp" | "rust" | "config";
+export type FindingCategory = "asymmetric" | "symmetric" | "hash" | "protocol" | "artifact";
+/** Whether the detected primitive is quantum-vulnerable, PQC, or a hybrid. */
+export type FindingClassification = "classical" | "pqc" | "hybrid";
+export type Confidence = "high" | "medium";
+export interface CryptoDetectionRule {
+    /** Stable rule id, e.g. "js-node-crypto-generate-keypair-rsa". */
+    readonly id: string;
+    readonly languages: readonly Language[];
+    /**
+     * Matched against a single comment-stripped line. Patterns MUST anchor on
+     * API/import context (e.g. `Cipher.getInstance("RSA`), never on a bare
+     * algorithm word — bare words in prose strings are not usage evidence.
+     */
+    readonly pattern: RegExp;
+    /**
+     * Canonical algorithm id (matching the crypto-inventory assessor keys,
+     * e.g. "rsa-2048", "ecdsa-p256", "md5"), or an extractor deriving it from
+     * the regex match. Extractors may return null to veto a match.
+     */
+    readonly algorithm: string | ((match: RegExpExecArray, line: string) => string | null);
+    readonly category: FindingCategory;
+    readonly classification: FindingClassification;
+    readonly confidence: Confidence;
+    /** Library/API family the rule targets, e.g. "node:crypto", "JCA". */
+    readonly library: string;
+    /**
+     * When true and the canonical algorithm is size-parameterized (rsa/dsa),
+     * the scanner searches a few adjacent lines for a key-size literal.
+     */
+    readonly wantsKeySize?: boolean;
+}
+export interface CodeCryptoFinding {
+    /** Repo-relative POSIX path of the file. */
+    readonly path: string;
+    /** 1-indexed line of the match. */
+    readonly line: number;
+    readonly language: Language;
+    readonly ruleId: string;
+    readonly library: string;
+    /** Canonical algorithm id, e.g. "rsa-2048", "rsa-unknown", "ml-kem-768". */
+    readonly algorithm: string;
+    readonly category: FindingCategory;
+    readonly classification: FindingClassification;
+    readonly confidence: Confidence;
+    /** SHA-256 (hex) of the whitespace-normalized matched line. */
+    readonly lineHash: string;
+    readonly keySize?: number;
+    /** True when the file path looks like test code. */
+    readonly testContext?: boolean;
+}
+export interface ScanOptions {
+    /** Absolute directory to scan. */
+    readonly rootDir: string;
+    /** Additional directory names to skip (merged with built-in skip list). */
+    readonly excludeDirs?: readonly string[];
+    /** Per-file size cap in bytes (default 2 MiB). */
+    readonly maxFileBytes?: number;
+    /** Cap on total findings (default 50_000) — the scan stops at the cap. */
+    readonly maxFindings?: number;
+}
+export interface ScanSummary {
+    readonly filesScanned: number;
+    readonly filesSkipped: number;
+    readonly findings: readonly CodeCryptoFinding[];
+    /** True when maxFindings stopped the scan early (never silently). */
+    readonly truncated: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/code-scan/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/code-scan/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,QAAQ,GACjB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,IAAI,GACJ,GAAG,GACH,KAAK,GACL,QAAQ,GACR,MAAM,GACN,QAAQ,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAE5F,8EAA8E;AAC9E,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEnE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IACnC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC;IACvF,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IACjC,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,kDAAkD;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC5B"}

package/dist/code-scan/types.js

@@ -0,0 +1,9 @@
+/**
+ * Core types for the source-code cryptography scanner.
+ *
+ * Design: docs/design/code-crypto-scanner.md. Findings are transport-shaped
+ * for the crypto-inventory ingest path: no source-code content beyond the
+ * matched rule id and a hash of the matched line ever leaves the scan host.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/code-scan/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/code-scan/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/index.d.ts

@@ -55,7 +55,7 @@ QnsiError as QnspError, QnsiNetworkError,
 QnsiNetworkError as QnspNetworkError, QnsiWebhookError, 
 /** @deprecated Use `QnsiWebhookError`. */
 QnsiWebhookError as QnspWebhookError, } from "./errors.js";
-export { type CreateKeyRequest, KmsClient } from "./kms.js";
+export { type CreateKeyRequest, type HspkSealRequest, type HspkSealResponse, type HspkSignRequest, KmsClient, type SealedPqcKey, } from "./kms.js";
 export { type CreateIndexRequest, type QueryRequest, SearchClient, type Vector, } from "./search.js";
 export { type PutObjectInput, StorageClient } from "./storage.js";
 export { type CreateTenantRequest, TenantClient } from "./tenant.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACN,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,QAAQ,EACR,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC1B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,EACN,UAAU;AACV,oEAAoE;AACpE,UAAU,IAAI,UAAU,EACxB,KAAK,iBAAiB;AACtB,2CAA2C;AAC3C,KAAK,iBAAiB,IAAI,iBAAiB,GAC3C,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACN,YAAY;AACZ,sCAAsC;AACtC,YAAY,IAAI,YAAY,EAC5B,aAAa;AACb,uCAAuC;AACvC,aAAa,IAAI,aAAa,EAC9B,SAAS;AACT,mCAAmC;AACnC,SAAS,IAAI,SAAS,EACtB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,YAAY,EACZ,KAAK,MAAM,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,KAAK,mBAAmB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,KAAK,gBAAgB;AACrB,0CAA0C;AAC1C,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,0BAA0B;AAC1B,oDAAoD;AACpD,0BAA0B,IAAI,0BAA0B,GACxD,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACN,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,QAAQ,EACR,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC1B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,EACN,UAAU;AACV,oEAAoE;AACpE,UAAU,IAAI,UAAU,EACxB,KAAK,iBAAiB;AACtB,2CAA2C;AAC3C,KAAK,iBAAiB,IAAI,iBAAiB,GAC3C,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACN,YAAY;AACZ,sCAAsC;AACtC,YAAY,IAAI,YAAY,EAC5B,aAAa;AACb,uCAAuC;AACvC,aAAa,IAAI,aAAa,EAC9B,SAAS;AACT,mCAAmC;AACnC,SAAS,IAAI,SAAS,EACtB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,SAAS,EACT,KAAK,YAAY,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,YAAY,EACZ,KAAK,MAAM,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,KAAK,mBAAmB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,KAAK,gBAAgB;AACrB,0CAA0C;AAC1C,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,0BAA0B;AAC1B,oDAAoD;AACpD,0BAA0B,IAAI,0BAA0B,GACxD,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -55,7 +55,7 @@ QnsiError as QnspError, QnsiNetworkError,
 QnsiNetworkError as QnspNetworkError, QnsiWebhookError, 
 /** @deprecated Use `QnsiWebhookError`. */
 QnsiWebhookError as QnspWebhookError, } from "./errors.js";
-export { KmsClient } from "./kms.js";
+export { KmsClient, } from "./kms.js";
 export { SearchClient, } from "./search.js";
 export { StorageClient } from "./storage.js";
 export { TenantClient } from "./tenant.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACN,YAAY,GAIZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,QAAQ,GAKR,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAwB,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAqB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAA2B,MAAM,cAAc,CAAC;AACtE,8EAA8E;AAC9E,uEAAuE;AACvE,OAAO,EACN,UAAU;AACV,oEAAoE;AACpE,UAAU,IAAI,UAAU,GAIxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAA8B,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACN,YAAY;AACZ,sCAAsC;AACtC,YAAY,IAAI,YAAY,EAC5B,aAAa;AACb,uCAAuC;AACvC,aAAa,IAAI,aAAa,EAC9B,SAAS;AACT,mCAAmC;AACnC,SAAS,IAAI,SAAS,EACtB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,SAAS,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAGN,YAAY,GAEZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAuB,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAA4B,YAAY,EAAE,MAAM,aAAa,CAAC;AACrE,yEAAyE;AACzE,OAAO,EAA4B,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EAIpC,0BAA0B;AAC1B,oDAAoD;AACpD,0BAA0B,IAAI,0BAA0B,GACxD,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACN,YAAY,GAIZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,QAAQ,GAKR,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAwB,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAqB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAA2B,MAAM,cAAc,CAAC;AACtE,8EAA8E;AAC9E,uEAAuE;AACvE,OAAO,EACN,UAAU;AACV,oEAAoE;AACpE,UAAU,IAAI,UAAU,GAIxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAA8B,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACN,YAAY;AACZ,sCAAsC;AACtC,YAAY,IAAI,YAAY,EAC5B,aAAa;AACb,uCAAuC;AACvC,aAAa,IAAI,aAAa,EAC9B,SAAS;AACT,mCAAmC;AACnC,SAAS,IAAI,SAAS,EACtB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EAKN,SAAS,GAET,MAAM,UAAU,CAAC;AAClB,OAAO,EAGN,YAAY,GAEZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAuB,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAA4B,YAAY,EAAE,MAAM,aAAa,CAAC;AACrE,yEAAyE;AACzE,OAAO,EAA4B,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EAIpC,0BAA0B;AAC1B,oDAAoD;AACpD,0BAA0B,IAAI,0BAA0B,GACxD,MAAM,eAAe,CAAC"}

package/dist/kms.d.ts

@@ -14,6 +14,45 @@ export interface CreateKeyRequest {
     readonly purpose?: string;
     readonly metadata?: Record<string, unknown>;
 }
+/** A PQC private key sealed under an HSM RSA-OAEP custody key (HSPK). The caller
+ * stores this opaque object and passes it back to `hspkSign`. */
+export interface SealedPqcKey {
+    readonly scheme: string;
+    readonly algorithm: string;
+    readonly hsmKeyId: string;
+    readonly wrappedCek: string;
+    readonly iv: string;
+    readonly ciphertext: string;
+    readonly authTag: string;
+    readonly publicKey: string;
+    readonly sealedAt: string;
+}
+export interface HspkSealRequest {
+    /** An active BYOHSM connection the tenant has provisioned. */
+    readonly connectionId: string;
+    /** keyId of an HSM RSA key with encrypt+decrypt usage (the custody root). */
+    readonly keyId: string;
+    /** PQC signature algorithm to generate + seal. Default: "ml-dsa-65". */
+    readonly algorithm?: "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87";
+    /** RSA-OAEP hash; default "sha256". Use "sha1" only for HSMs that require it. */
+    readonly oaepHash?: "sha1" | "sha256";
+}
+export interface HspkSealResponse {
+    readonly algorithm: string;
+    /** PQC public key, base64. */
+    readonly publicKey: string;
+    readonly sealedKey: SealedPqcKey;
+    readonly hsmKeyHandle: string;
+}
+export interface HspkSignRequest {
+    readonly connectionId: string;
+    /** The same HSM RSA custody key used to seal. */
+    readonly keyId: string;
+    /** The object returned by `hspkSeal`. */
+    readonly sealedKey: SealedPqcKey;
+    /** Must match the oaepHash used at seal time. Default: "sha256". */
+    readonly oaepHash?: "sha1" | "sha256";
+}
 export declare class KmsClient {
     private readonly internal;
     constructor(internal: Internal);
@@ -26,5 +65,25 @@ export declare class KmsClient {
     verify(keyId: string, data: Uint8Array, signature: Uint8Array): Promise<boolean>;
     wrap(keyId: string, plaintext: Uint8Array, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Uint8Array>;
     unwrap(keyId: string, ciphertext: Uint8Array, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Uint8Array>;
+    /**
+     * HSM-Sealed Post-Quantum Keys (HSPK): generate a NIST PQC keypair and seal its
+     * private key under a non-extractable HSM RSA-OAEP custody key on your BYOHSM
+     * connection — giving the PQC key a FIPS hardware root of trust at rest. Stateless:
+     * store the returned `sealedKey` and pass it to `hspkSign`. Requires a customer-
+     * provisioned BYOHSM connection with an RSA encrypt/decrypt key.
+     *
+     * Wire contract: sealPqcSchema = { tenantId, connectionId, keyId, algorithm?,
+     * oaepHash? }; response { algorithm, publicKey, sealedKey, hsmKeyHandle }.
+     */
+    hspkSeal(req: HspkSealRequest, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<HspkSealResponse>;
+    /**
+     * HSPK: unseal a previously sealed PQC private key via the HSM (which RSA-OAEP-
+     * unwraps the content key) and sign `data`. The PQC private key exists in plaintext
+     * only transiently in memory during the signature.
+     *
+     * Wire contract: signPqcSchema = { tenantId, connectionId, keyId, sealedKey,
+     * data(base64), oaepHash? }; response { algorithm, signature(base64) }.
+     */
+    hspkSign(req: HspkSignRequest, data: Uint8Array, opts?: Pick<RequestOptions, "idempotencyKey">): Promise<Uint8Array>;
 }
 //# sourceMappingURL=kms.d.ts.map

package/dist/kms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../src/kms.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAK/D,MAAM,WAAW,gBAAgB;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IACvD,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAoBD,qBAAa,SAAS;IACT,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,SAAS,CAAC,GAAG,GAAE,gBAAqB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAkBnF,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM;IAIpB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAkBvF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIpD,IAAI,CACT,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC;IAgBhB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAYhF,IAAI,CACT,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC;IAmBhB,MAAM,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,UAAU,EACtB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC;CAkBtB"}
+{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../src/kms.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAK/D,MAAM,WAAW,gBAAgB;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;IACvD,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAoBD;iEACiE;AACjE,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;IAC7D,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8BAA8B;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACtC;AAED,qBAAa,SAAS;IACT,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,SAAS,CAAC,GAAG,GAAE,gBAAqB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAkBnF,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC;IAIxC,MAAM,CAAC,KAAK,EAAE,MAAM;IAIpB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAkBvF,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAIpD,IAAI,CACT,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC;IAgBhB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAYhF,IAAI,CACT,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC;IAmBhB,MAAM,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,UAAU,EACtB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC;IAmBtB;;;;;;;;;OASG;IACH,QAAQ,CACP,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,gBAAgB,CAAC;IAO5B;;;;;;;OAOG;IACG,QAAQ,CACb,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,UAAU,EAChB,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,GAC3C,OAAO,CAAC,UAAU,CAAC;CAmBtB"}

package/dist/kms.js

@@ -97,6 +97,47 @@ export class KmsClient {
         }
         return decodeB64(unwrapped);
     }
+    /**
+     * HSM-Sealed Post-Quantum Keys (HSPK): generate a NIST PQC keypair and seal its
+     * private key under a non-extractable HSM RSA-OAEP custody key on your BYOHSM
+     * connection — giving the PQC key a FIPS hardware root of trust at rest. Stateless:
+     * store the returned `sealedKey` and pass it to `hspkSign`. Requires a customer-
+     * provisioned BYOHSM connection with an RSA encrypt/decrypt key.
+     *
+     * Wire contract: sealPqcSchema = { tenantId, connectionId, keyId, algorithm?,
+     * oaepHash? }; response { algorithm, publicKey, sealedKey, hsmKeyHandle }.
+     */
+    hspkSeal(req, opts) {
+        const body = { connectionId: req.connectionId, keyId: req.keyId };
+        if (req.algorithm)
+            body["algorithm"] = req.algorithm;
+        if (req.oaepHash)
+            body["oaepHash"] = req.oaepHash;
+        return this.internal.request("POST", `${PATH_PREFIX}/byohsm/pqc/seal`, body, opts);
+    }
+    /**
+     * HSPK: unseal a previously sealed PQC private key via the HSM (which RSA-OAEP-
+     * unwraps the content key) and sign `data`. The PQC private key exists in plaintext
+     * only transiently in memory during the signature.
+     *
+     * Wire contract: signPqcSchema = { tenantId, connectionId, keyId, sealedKey,
+     * data(base64), oaepHash? }; response { algorithm, signature(base64) }.
+     */
+    async hspkSign(req, data, opts) {
+        const body = {
+            connectionId: req.connectionId,
+            keyId: req.keyId,
+            sealedKey: req.sealedKey,
+            data: encodeB64(data),
+        };
+        if (req.oaepHash)
+            body["oaepHash"] = req.oaepHash;
+        const resp = await this.internal.request("POST", `${PATH_PREFIX}/byohsm/pqc/sign`, body, opts);
+        if (!resp.signature) {
+            throw new QnsiApiError("kms.hspkSign: response missing signature", 200);
+        }
+        return decodeB64(resp.signature);
+    }
 }
 function encodeB64(bytes) {
     return Buffer.from(bytes).toString("base64");

package/dist/kms.js.map

@@ -1 +1 @@
-{"version":3,"file":"kms.js","sourceRoot":"","sources":["../src/kms.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,GAAG,eAAe,CAAC;AAgCpC,MAAM,OAAO,SAAS;IACQ;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,SAAS,CAAC,MAAwB,EAAE,EAAE,IAA6C;QAClF,iEAAiE;QACjE,uEAAuE;QACvE,6EAA6E;QAC7E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG;YAChB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;QACF,MAAM,IAAI,GAA4B;YACrC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;YAClD,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM;YAC9B,QAAQ;SACR,CAAC;QACF,IAAI,GAAG,CAAC,SAAS;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,QAAQ,CAAC,KAA+B;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,SAAS,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,SAAS,CAAC,KAAa,EAAE,MAAe,EAAE,IAA6C;QACtF,2EAA2E;QAC3E,EAAE;QACF,sFAAsF;QACtF,2EAA2E;QAC3E,mEAAmE;QACnE,EAAE;QACF,iFAAiF;QACjF,EAAE;QACF,6EAA6E;QAC7E,0EAA0E;QAC1E,EAAE;QACF,oFAAoF;QACpF,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,SAAS,KAAK,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,SAAS,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,WAAW,SAAS,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,IAAI,CACT,KAAa,EACb,IAAgB,EAChB,IAA6C;QAE7C,0EAA0E;QAC1E,iFAAiF;QACjF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,OAAO,EACnC,IAAI,EACJ,IAAI,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,YAAY,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAAgB,EAAE,SAAqB;QAClE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,SAAS,EACrC,IAAI,CACJ,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CACT,KAAa,EACb,SAAqB,EACrB,IAA6C;QAE7C,sEAAsE;QACtE,+EAA+E;QAC/E,8EAA8E;QAC9E,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,OAAO,EACnC,IAAI,EACJ,IAAI,CACJ,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,qDAAqD,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CACX,KAAa,EACb,UAAsB,EACtB,IAA6C;QAE7C,2EAA2E;QAC3E,4DAA4D;QAC5D,0EAA0E;QAC1E,yCAAyC;QACzC,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,SAAS,EACrC,IAAI,EACJ,IAAI,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;CACD;AAED,SAAS,SAAS,CAAC,KAAiB;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC7B,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"kms.js","sourceRoot":"","sources":["../src/kms.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,GAAG,eAAe,CAAC;AA2EpC,MAAM,OAAO,SAAS;IACQ;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,SAAS,CAAC,MAAwB,EAAE,EAAE,IAA6C;QAClF,iEAAiE;QACjE,uEAAuE;QACvE,6EAA6E;QAC7E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG;YAChB,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;QACF,MAAM,IAAI,GAA4B;YACrC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;YAClD,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,MAAM;YAC9B,QAAQ;SACR,CAAC;QACF,IAAI,GAAG,CAAC,SAAS;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IAED,QAAQ,CAAC,KAA+B;QACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,WAAW,SAAS,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,SAAS,CAAC,KAAa,EAAE,MAAe,EAAE,IAA6C;QACtF,2EAA2E;QAC3E,EAAE;QACF,sFAAsF;QACtF,2EAA2E;QAC3E,mEAAmE;QACnE,EAAE;QACF,iFAAiF;QACjF,EAAE;QACF,6EAA6E;QAC7E,0EAA0E;QAC1E,EAAE;QACF,oFAAoF;QACpF,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,SAAS,KAAK,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;IAED,SAAS,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,WAAW,SAAS,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,IAAI,CACT,KAAa,EACb,IAAgB,EAChB,IAA6C;QAE7C,0EAA0E;QAC1E,iFAAiF;QACjF,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,OAAO,EACnC,IAAI,EACJ,IAAI,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,YAAY,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,IAAgB,EAAE,SAAqB;QAClE,mEAAmE;QACnE,yEAAyE;QACzE,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,SAAS,EACrC,IAAI,CACJ,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,IAAI,CACT,KAAa,EACb,SAAqB,EACrB,IAA6C;QAE7C,sEAAsE;QACtE,+EAA+E;QAC/E,8EAA8E;QAC9E,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,OAAO,EACnC,IAAI,EACJ,IAAI,CACJ,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,YAAY,CAAC,qDAAqD,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CACX,KAAa,EACb,UAAsB,EACtB,IAA6C;QAE7C,2EAA2E;QAC3E,4DAA4D;QAC5D,0EAA0E;QAC1E,yCAAyC;QACzC,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,SAAS,KAAK,SAAS,EACrC,IAAI,EACJ,IAAI,CACJ,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,IAAI,YAAY,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ,CACP,GAAoB,EACpB,IAA6C;QAE7C,MAAM,IAAI,GAA4B,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QAC3F,IAAI,GAAG,CAAC,SAAS;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC;QACrD,IAAI,GAAG,CAAC,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,WAAW,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CACb,GAAoB,EACpB,IAAgB,EAChB,IAA6C;QAE7C,MAAM,IAAI,GAA4B;YACrC,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC;SACrB,CAAC;QACF,IAAI,GAAG,CAAC,QAAQ;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACvC,MAAM,EACN,GAAG,WAAW,kBAAkB,EAChC,IAAI,EACJ,IAAI,CACJ,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,YAAY,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;CACD;AAED,SAAS,SAAS,CAAC,KAAiB;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC7B,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heossi/qnsi",
-  "version": "0.5.6",
+  "version": "0.6.0",
   "publishConfig": {
     "access": "public"
   },
@@ -34,6 +34,10 @@
       "types": "./dist/autogen/index.d.ts",
       "import": "./dist/autogen/index.js"
     },
+    "./code-scan": {
+      "types": "./dist/code-scan/index.d.ts",
+      "import": "./dist/code-scan/index.js"
+    },
     "./package.json": "./package.json"
   },
   "bin": {