@qnsp/tenant-sdk 0.1.1 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/CHANGELOG.md +48 -0
  2. package/dist/index.d.ts +85 -0
  3. package/dist/index.d.ts.map +1 -1
  4. package/dist/index.js +127 -0
  5. package/dist/index.js.map +1 -1
  6. package/package.json +4 -4
  7. package/src/index.ts +188 -0
  8. package/tsconfig.tsbuildinfo +1 -1
  9. package/.turbo/turbo-build.log +0 -5
  10. package/.turbo/turbo-lint.log +0 -6
  11. package/.turbo/turbo-test.log +0 -58
  12. package/.turbo/turbo-typecheck.log +0 -5
package/CHANGELOG.md CHANGED
@@ -1,5 +1,53 @@
1
1
  # @qnsp/tenant-sdk
2
2
 
3
+ ## 0.2.0
4
+
5
+ ### Minor Changes
6
+
7
+ - Add tenant crypto policy integration and PQC algorithm utilities to all SDKs.
8
+
9
+ ### @qnsp/tenant-sdk
10
+
11
+ - Added crypto policy management APIs: `getTenantCryptoPolicy()`, `upsertTenantCryptoPolicy()`
12
+ - Added algorithm query methods: `getAllowedKemAlgorithms()`, `getAllowedSignatureAlgorithms()`, `getDefaultKemAlgorithm()`, `getDefaultSignatureAlgorithm()`
13
+ - Added `CRYPTO_POLICY_ALGORITHMS` tier configurations
14
+ - Added `toNistAlgorithmName()` and `ALGORITHM_TO_NIST` utilities
15
+
16
+ ### @qnsp/storage-sdk
17
+
18
+ - Added `PqcMetadata` interface with `algorithmNist` field
19
+ - `initiateUpload()` now returns NIST algorithm name
20
+ - Added `toNistAlgorithmName()` utility
21
+
22
+ ### @qnsp/auth-sdk
23
+
24
+ - Added `PqcSignatureMetadata` interface
25
+ - Added `toNistAlgorithmName()` and `ALGORITHM_TO_NIST` for signature algorithms
26
+
27
+ ### @qnsp/vault-sdk
28
+
29
+ - Enhanced `VaultSecretPqcMetadata` with `algorithmNist` field
30
+ - Added `toNistAlgorithmName()` utility
31
+
32
+ ### @qnsp/kms-client
33
+
34
+ - Added `KmsPqcMetadata` interface
35
+ - `wrapKey()` now returns `algorithmNist` field
36
+ - Added `toNistAlgorithmName()` utility
37
+
38
+ ### @qnsp/audit-sdk
39
+
40
+ - Added `toNistAlgorithmName()` and `ALGORITHM_TO_NIST` for signature algorithms
41
+
42
+ ### @qnsp/access-control-sdk
43
+
44
+ - Added `toNistAlgorithmName()` and `ALGORITHM_TO_NIST` for signature algorithms
45
+
46
+ ### Documentation
47
+
48
+ - Updated all SDK documentation with crypto policy integration examples
49
+ - Added algorithm naming conventions (internal vs NIST)
50
+
3
51
  ## 0.1.1
4
52
 
5
53
  ### Patch Changes
package/dist/index.d.ts CHANGED
@@ -14,6 +14,62 @@ export interface TenantClientConfig {
14
14
  readonly retryDelayMs?: number;
15
15
  }
16
16
  export type TenantStatus = "active" | "suspended" | "pending" | "deleted";
17
+ /**
18
+ * Crypto policy tier determines which PQC algorithms are allowed.
19
+ * Maps to tenant_crypto_policies.policy_tier in tenant-service.
20
+ */
21
+ export type CryptoPolicyTier = "default" | "strict" | "maximum" | "government";
22
+ /**
23
+ * Tenant crypto policy configuration.
24
+ */
25
+ export interface TenantCryptoPolicy {
26
+ readonly tenantId: string;
27
+ readonly policyTier: CryptoPolicyTier;
28
+ readonly customAllowedKemAlgorithms: readonly string[] | null;
29
+ readonly customAllowedSignatureAlgorithms: readonly string[] | null;
30
+ readonly customAllowedSymmetricAlgorithms?: readonly string[] | null;
31
+ readonly customForbiddenAlgorithms?: readonly string[] | null;
32
+ readonly requireHsmForRootKeys: boolean;
33
+ readonly maxKeyAgeDays: number;
34
+ readonly enforcementMode?: "audit" | "enforce";
35
+ readonly createdAt: string;
36
+ readonly updatedAt: string;
37
+ }
38
+ /**
39
+ * Input for creating or updating a tenant crypto policy.
40
+ */
41
+ export interface TenantCryptoPolicyInput {
42
+ readonly policyTier: CryptoPolicyTier;
43
+ readonly customAllowedKemAlgorithms?: readonly string[] | null;
44
+ readonly customAllowedSignatureAlgorithms?: readonly string[] | null;
45
+ readonly requireHsmForRootKeys?: boolean;
46
+ readonly maxKeyAgeDays?: number;
47
+ }
48
+ /**
49
+ * Algorithm configuration per crypto policy tier.
50
+ */
51
+ export interface TierAlgorithmConfig {
52
+ readonly kemAlgorithms: readonly string[];
53
+ readonly signatureAlgorithms: readonly string[];
54
+ readonly defaultKemAlgorithm: string;
55
+ readonly defaultSignatureAlgorithm: string;
56
+ }
57
+ /**
58
+ * Default algorithms per crypto policy tier.
59
+ */
60
+ export declare const CRYPTO_POLICY_ALGORITHMS: Record<CryptoPolicyTier, TierAlgorithmConfig>;
61
+ /**
62
+ * Mapping from internal algorithm names to NIST standardized names.
63
+ */
64
+ export declare const ALGORITHM_TO_NIST: Record<string, string>;
65
+ /**
66
+ * Convert internal algorithm name to NIST standardized name.
67
+ */
68
+ export declare function toNistAlgorithmName(internal: string): string;
69
+ /**
70
+ * Get algorithm config for a crypto policy tier.
71
+ */
72
+ export declare function getAlgorithmConfigForTier(tier: CryptoPolicyTier): TierAlgorithmConfig;
17
73
  export interface TenantSecurityEnvelope {
18
74
  readonly controlPlaneTokenSha256: string | null;
19
75
  readonly pqcSignatures: readonly {
@@ -110,6 +166,35 @@ export declare class TenantClient {
110
166
  readonly limit?: number;
111
167
  readonly cursor?: string;
112
168
  }): Promise<ListTenantsResponse>;
169
+ /**
170
+ * Get the crypto policy for a tenant.
171
+ * Returns the tenant's crypto policy configuration including allowed algorithms.
172
+ * If no policy exists, a default policy is created and returned.
173
+ */
174
+ getTenantCryptoPolicy(tenantId: string): Promise<TenantCryptoPolicy>;
175
+ /**
176
+ * Create or update the crypto policy for a tenant.
177
+ * Sets the policy tier and optional custom algorithm restrictions.
178
+ */
179
+ upsertTenantCryptoPolicy(tenantId: string, policy: TenantCryptoPolicyInput): Promise<TenantCryptoPolicy>;
180
+ /**
181
+ * Get the allowed KEM algorithms for a tenant based on their crypto policy.
182
+ * Convenience method that fetches the policy and returns the allowed algorithms.
183
+ */
184
+ getAllowedKemAlgorithms(tenantId: string): Promise<readonly string[]>;
185
+ /**
186
+ * Get the allowed signature algorithms for a tenant based on their crypto policy.
187
+ * Convenience method that fetches the policy and returns the allowed algorithms.
188
+ */
189
+ getAllowedSignatureAlgorithms(tenantId: string): Promise<readonly string[]>;
190
+ /**
191
+ * Get the default KEM algorithm for a tenant based on their crypto policy tier.
192
+ */
193
+ getDefaultKemAlgorithm(tenantId: string): Promise<string>;
194
+ /**
195
+ * Get the default signature algorithm for a tenant based on their crypto policy tier.
196
+ */
197
+ getDefaultSignatureAlgorithm(tenantId: string): Promise<string>;
113
198
  }
114
199
  export * from "./observability.js";
115
200
  export * from "./validation.js";
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,qBAAqB,EACrB,2BAA2B,EAE3B,MAAM,oBAAoB,CAAC;AAI5B;;;;;GAKG;AAEH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,GAAG,2BAA2B,CAAC;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAUD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1E,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,SAAS;QAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,EAAE,CAAC;IACJ,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;KAC5B,EAAE,CAAC;IACJ,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAWD,qBAAa,YAAY;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+B;IACzD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,MAAM,EAAE,kBAAkB;YAqCxB,OAAO;YAIP,gBAAgB;IA6G9B,OAAO,CAAC,oBAAoB;IAO5B;;;OAGG;IACG,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBjE;;;OAGG;IACG,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB7E;;;OAGG;IACG,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ5C;;;OAGG;IACG,WAAW,CAAC,OAAO,CAAC,EAAE;QAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAehC;AAED,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACX,qBAAqB,EACrB,2BAA2B,EAE3B,MAAM,oBAAoB,CAAC;AAI5B;;;;;GAKG;AAEH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,GAAG,2BAA2B,CAAC;IACzE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAC/B;AAUD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1E;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAC;AAE/E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,0BAA0B,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9D,QAAQ,CAAC,gCAAgC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACpE,QAAQ,CAAC,gCAAgC,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACrE,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9D,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/D,QAAQ,CAAC,gCAAgC,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACrE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;CAC3C;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAyBlF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAWpD,CAAC;AAEF;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG,mBAAmB,CAErF;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,SAAS;QAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC3B,EAAE,CAAC;IACJ,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;KAC5B,EAAE,CAAC;IACJ,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAWD,qBAAa,YAAY;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+B;IACzD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,MAAM,EAAE,kBAAkB;YAqCxB,OAAO;YAIP,gBAAgB;IA6G9B,OAAO,CAAC,oBAAoB;IAO5B;;;OAGG;IACG,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBjE;;;OAGG;IACG,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB7E;;;OAGG;IACG,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ5C;;;OAGG;IACG,WAAW,CAAC,OAAO,CAAC,EAAE;QAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAgBhC;;;;OAIG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ1E;;;OAGG;IACG,wBAAwB,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,uBAAuB,GAC7B,OAAO,CAAC,kBAAkB,CAAC;IAqB9B;;;OAGG;IACG,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAQ3E;;;OAGG;IACG,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC;IAWjF;;OAEG;IACG,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/D;;OAEG;IACG,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAIrE;AAED,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC"}
package/dist/index.js CHANGED
@@ -1,6 +1,62 @@
1
1
  import { performance } from "node:perf_hooks";
2
2
  import { createTenantClientTelemetry, isTenantClientTelemetry } from "./observability.js";
3
3
  import { validateUUID } from "./validation.js";
4
+ /**
5
+ * Default algorithms per crypto policy tier.
6
+ */
7
+ export const CRYPTO_POLICY_ALGORITHMS = {
8
+ default: {
9
+ kemAlgorithms: ["kyber-512", "kyber-768", "kyber-1024"],
10
+ signatureAlgorithms: ["dilithium-2", "dilithium-3", "dilithium-5"],
11
+ defaultKemAlgorithm: "kyber-768",
12
+ defaultSignatureAlgorithm: "dilithium-3",
13
+ },
14
+ strict: {
15
+ kemAlgorithms: ["kyber-768", "kyber-1024"],
16
+ signatureAlgorithms: ["dilithium-3", "dilithium-5", "falcon-1024"],
17
+ defaultKemAlgorithm: "kyber-768",
18
+ defaultSignatureAlgorithm: "dilithium-3",
19
+ },
20
+ maximum: {
21
+ kemAlgorithms: ["kyber-1024"],
22
+ signatureAlgorithms: ["dilithium-5", "falcon-1024", "sphincs-shake-256f-simple"],
23
+ defaultKemAlgorithm: "kyber-1024",
24
+ defaultSignatureAlgorithm: "dilithium-5",
25
+ },
26
+ government: {
27
+ kemAlgorithms: ["kyber-1024"],
28
+ signatureAlgorithms: ["dilithium-5", "sphincs-shake-256f-simple"],
29
+ defaultKemAlgorithm: "kyber-1024",
30
+ defaultSignatureAlgorithm: "dilithium-5",
31
+ },
32
+ };
33
+ /**
34
+ * Mapping from internal algorithm names to NIST standardized names.
35
+ */
36
+ export const ALGORITHM_TO_NIST = {
37
+ "kyber-512": "ML-KEM-512",
38
+ "kyber-768": "ML-KEM-768",
39
+ "kyber-1024": "ML-KEM-1024",
40
+ "dilithium-2": "ML-DSA-44",
41
+ "dilithium-3": "ML-DSA-65",
42
+ "dilithium-5": "ML-DSA-87",
43
+ "falcon-512": "FN-DSA-512",
44
+ "falcon-1024": "FN-DSA-1024",
45
+ "sphincs-shake-128f-simple": "SLH-DSA-SHAKE-128f",
46
+ "sphincs-shake-256f-simple": "SLH-DSA-SHAKE-256f",
47
+ };
48
+ /**
49
+ * Convert internal algorithm name to NIST standardized name.
50
+ */
51
+ export function toNistAlgorithmName(internal) {
52
+ return ALGORITHM_TO_NIST[internal] ?? internal;
53
+ }
54
+ /**
55
+ * Get algorithm config for a crypto policy tier.
56
+ */
57
+ export function getAlgorithmConfigForTier(tier) {
58
+ return CRYPTO_POLICY_ALGORITHMS[tier];
59
+ }
4
60
  export class TenantClient {
5
61
  config;
6
62
  telemetry;
@@ -201,6 +257,77 @@ export class TenantClient {
201
257
  operation: "listTenants",
202
258
  });
203
259
  }
260
+ /**
261
+ * Get the crypto policy for a tenant.
262
+ * Returns the tenant's crypto policy configuration including allowed algorithms.
263
+ * If no policy exists, a default policy is created and returned.
264
+ */
265
+ async getTenantCryptoPolicy(tenantId) {
266
+ validateUUID(tenantId, "tenantId");
267
+ return this.request("GET", `/tenant/v1/tenants/${tenantId}/crypto-policy`, {
268
+ operation: "getTenantCryptoPolicy",
269
+ });
270
+ }
271
+ /**
272
+ * Create or update the crypto policy for a tenant.
273
+ * Sets the policy tier and optional custom algorithm restrictions.
274
+ */
275
+ async upsertTenantCryptoPolicy(tenantId, policy) {
276
+ validateUUID(tenantId, "tenantId");
277
+ return this.request("PUT", `/tenant/v1/tenants/${tenantId}/crypto-policy`, {
278
+ body: {
279
+ policyTier: policy.policyTier,
280
+ ...(policy.customAllowedKemAlgorithms !== undefined
281
+ ? { customAllowedKemAlgorithms: policy.customAllowedKemAlgorithms }
282
+ : {}),
283
+ ...(policy.customAllowedSignatureAlgorithms !== undefined
284
+ ? { customAllowedSignatureAlgorithms: policy.customAllowedSignatureAlgorithms }
285
+ : {}),
286
+ ...(policy.requireHsmForRootKeys !== undefined
287
+ ? { requireHsmForRootKeys: policy.requireHsmForRootKeys }
288
+ : {}),
289
+ ...(policy.maxKeyAgeDays !== undefined ? { maxKeyAgeDays: policy.maxKeyAgeDays } : {}),
290
+ },
291
+ operation: "upsertTenantCryptoPolicy",
292
+ });
293
+ }
294
+ /**
295
+ * Get the allowed KEM algorithms for a tenant based on their crypto policy.
296
+ * Convenience method that fetches the policy and returns the allowed algorithms.
297
+ */
298
+ async getAllowedKemAlgorithms(tenantId) {
299
+ const policy = await this.getTenantCryptoPolicy(tenantId);
300
+ if (policy.customAllowedKemAlgorithms && policy.customAllowedKemAlgorithms.length > 0) {
301
+ return policy.customAllowedKemAlgorithms;
302
+ }
303
+ return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].kemAlgorithms;
304
+ }
305
+ /**
306
+ * Get the allowed signature algorithms for a tenant based on their crypto policy.
307
+ * Convenience method that fetches the policy and returns the allowed algorithms.
308
+ */
309
+ async getAllowedSignatureAlgorithms(tenantId) {
310
+ const policy = await this.getTenantCryptoPolicy(tenantId);
311
+ if (policy.customAllowedSignatureAlgorithms &&
312
+ policy.customAllowedSignatureAlgorithms.length > 0) {
313
+ return policy.customAllowedSignatureAlgorithms;
314
+ }
315
+ return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].signatureAlgorithms;
316
+ }
317
+ /**
318
+ * Get the default KEM algorithm for a tenant based on their crypto policy tier.
319
+ */
320
+ async getDefaultKemAlgorithm(tenantId) {
321
+ const policy = await this.getTenantCryptoPolicy(tenantId);
322
+ return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].defaultKemAlgorithm;
323
+ }
324
+ /**
325
+ * Get the default signature algorithm for a tenant based on their crypto policy tier.
326
+ */
327
+ async getDefaultSignatureAlgorithm(tenantId) {
328
+ const policy = await this.getTenantCryptoPolicy(tenantId);
329
+ return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].defaultSignatureAlgorithm;
330
+ }
204
331
  }
205
332
  export * from "./observability.js";
206
333
  export * from "./validation.js";
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAO9C,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AA6G/C,MAAM,OAAO,YAAY;IACP,MAAM,CAA6B;IACnC,SAAS,CAA+B;IACxC,aAAa,CAAS;IAEvC,YAAY,MAA0B;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAElD,6EAA6E;QAC7E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,MAAM,WAAW,GAChB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YAClF,MAAM,aAAa,GAClB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;YACjF,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACd,0FAA0F,CAC1F,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,CAAC,MAAM,GAAG;YACb,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM;YACrC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;YAClC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;SAC1C,CAAC;QAEF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS;YAChC,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC1C,CAAC,CAAC,MAAM,CAAC,SAAS;gBAClB,CAAC,CAAC,2BAA2B,CAAC,MAAM,CAAC,SAAS,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC;QAER,IAAI,CAAC;YACJ,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC;QACvC,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,OAAwB;QAC9E,OAAO,IAAI,CAAC,gBAAgB,CAAI,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,MAAc,EACd,IAAY,EACZ,OAAmC,EACnC,OAAe;QAEf,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAA2B;YACvC,cAAc,EAAE,kBAAkB;YAClC,GAAG,OAAO,EAAE,OAAO;SACnB,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,EAAE,cAAc,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACrF,MAAM,MAAM,GAAG,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC,aAAa,CAAC;QAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAM,GAAmB,IAAI,CAAC;QAClC,IAAI,UAA8B,CAAC;QACnC,IAAI,YAAgC,CAAC;QAErC,IAAI,CAAC;YACJ,MAAM,IAAI,GAAgB;gBACzB,MAAM;gBACN,OAAO;gBACP,MAAM;aACN,CAAC;YAEF,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAExC,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;YAE7B,8CAA8C;YAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;oBACtC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBAC7D,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;oBAEvC,IAAI,gBAAgB,EAAE,CAAC;wBACtB,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;wBAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;4BAC/D,OAAO,GAAG,iBAAiB,GAAG,KAAK,CAAC;wBACrC,CAAC;oBACF,CAAC;yBAAM,CAAC;wBACP,mEAAmE;wBACnE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBACrE,CAAC;oBAED,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;oBAC7D,OAAO,IAAI,CAAC,gBAAgB,CAAI,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;gBACrE,CAAC;gBAED,MAAM,GAAG,OAAO,CAAC;gBACjB,YAAY,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACd,+CAA+C,IAAI,CAAC,MAAM,CAAC,UAAU,UAAU,CAC/E,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,GAAG,OAAO,CAAC;gBACjB,2DAA2D;gBAC3D,4EAA4E;gBAC5E,YAAY,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO,SAAc,CAAC;YACvB,CAAC;YAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,MAAM,GAAG,OAAO,CAAC;YACjB,IAAI,CAAC,YAAY,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC7C,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC3D,YAAY,GAAG,iBAAiB,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;gBAAS,CAAC;YACV,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAC7C,MAAM,KAAK,GAA+B;gBACzC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,GAAG,MAAM,IAAI,KAAK,EAAE;gBACrD,MAAM;gBACN,KAAK;gBACL,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACF,CAAC;IAEO,oBAAoB,CAAC,KAAiC;QAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO;QACR,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC9C,uFAAuF;QACvF,OAAO,IAAI,CAAC,OAAO,CAAS,MAAM,EAAE,oBAAoB,EAAE;YACzD,IAAI,EAAE;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E;YACD,SAAS,EAAE,cAAc;SACzB,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,OAA4B;QAC1D,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAEvB,OAAO,IAAI,CAAC,OAAO,CAAS,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE;YAChE,IAAI,EAAE;gBACL,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E;YACD,SAAS,EAAE,cAAc;SACzB,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,EAAU;QACzB,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAEvB,OAAO,IAAI,CAAC,OAAO,CAAS,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE;YAC9D,SAAS,EAAE,WAAW;SACtB,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAGjB;QACA,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAEtF,OAAO,IAAI,CAAC,OAAO,CAAsB,KAAK,EAAE,IAAI,EAAE;YACrD,SAAS,EAAE,aAAa;SACxB,CAAC,CAAC;IACJ,CAAC;CACD;AAED,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAO9C,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAwE/C;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAkD;IACtF,OAAO,EAAE;QACR,aAAa,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC;QACvD,mBAAmB,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC;QAClE,mBAAmB,EAAE,WAAW;QAChC,yBAAyB,EAAE,aAAa;KACxC;IACD,MAAM,EAAE;QACP,aAAa,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;QAC1C,mBAAmB,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC;QAClE,mBAAmB,EAAE,WAAW;QAChC,yBAAyB,EAAE,aAAa;KACxC;IACD,OAAO,EAAE;QACR,aAAa,EAAE,CAAC,YAAY,CAAC;QAC7B,mBAAmB,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,2BAA2B,CAAC;QAChF,mBAAmB,EAAE,YAAY;QACjC,yBAAyB,EAAE,aAAa;KACxC;IACD,UAAU,EAAE;QACX,aAAa,EAAE,CAAC,YAAY,CAAC;QAC7B,mBAAmB,EAAE,CAAC,aAAa,EAAE,2BAA2B,CAAC;QACjE,mBAAmB,EAAE,YAAY;QACjC,yBAAyB,EAAE,aAAa;KACxC;CACD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACxD,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,YAAY;IACzB,YAAY,EAAE,aAAa;IAC3B,aAAa,EAAE,WAAW;IAC1B,aAAa,EAAE,WAAW;IAC1B,aAAa,EAAE,WAAW;IAC1B,YAAY,EAAE,YAAY;IAC1B,aAAa,EAAE,aAAa;IAC5B,2BAA2B,EAAE,oBAAoB;IACjD,2BAA2B,EAAE,oBAAoB;CACjD,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IACnD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAsB;IAC/D,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAmFD,MAAM,OAAO,YAAY;IACP,MAAM,CAA6B;IACnC,SAAS,CAA+B;IACxC,aAAa,CAAS;IAEvC,YAAY,MAA0B;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAElD,6EAA6E;QAC7E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,MAAM,WAAW,GAChB,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;YAClF,MAAM,aAAa,GAClB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,MAAM,CAAC;YACjF,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACd,0FAA0F,CAC1F,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,CAAC,MAAM,GAAG;YACb,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM;YACrC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;YAClC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;SAC1C,CAAC;QAEF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS;YAChC,CAAC,CAAC,uBAAuB,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC1C,CAAC,CAAC,MAAM,CAAC,SAAS;gBAClB,CAAC,CAAC,2BAA2B,CAAC,MAAM,CAAC,SAAS,CAAC;YAChD,CAAC,CAAC,IAAI,CAAC;QAER,IAAI,CAAC;YACJ,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACR,IAAI,CAAC,aAAa,GAAG,gBAAgB,CAAC;QACvC,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,OAAwB;QAC9E,OAAO,IAAI,CAAC,gBAAgB,CAAI,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC7B,MAAc,EACd,IAAY,EACZ,OAAmC,EACnC,OAAe;QAEf,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAA2B;YACvC,cAAc,EAAE,kBAAkB;YAClC,GAAG,OAAO,EAAE,OAAO;SACnB,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC3D,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,EAAE,cAAc,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACrF,MAAM,MAAM,GAAG,OAAO,EAAE,eAAe,IAAI,IAAI,CAAC,aAAa,CAAC;QAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,MAAM,GAAmB,IAAI,CAAC;QAClC,IAAI,UAA8B,CAAC;QACnC,IAAI,YAAgC,CAAC;QAErC,IAAI,CAAC;YACJ,MAAM,IAAI,GAAgB;gBACzB,MAAM;gBACN,OAAO;gBACP,MAAM;aACN,CAAC;YAEF,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAExC,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;YAE7B,8CAA8C;YAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;oBACtC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBAC7D,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;oBAEvC,IAAI,gBAAgB,EAAE,CAAC;wBACtB,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;wBAChE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;4BAC/D,OAAO,GAAG,iBAAiB,GAAG,KAAK,CAAC;wBACrC,CAAC;oBACF,CAAC;yBAAM,CAAC;wBACP,mEAAmE;wBACnE,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;oBACrE,CAAC;oBAED,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;oBAC7D,OAAO,IAAI,CAAC,gBAAgB,CAAI,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;gBACrE,CAAC;gBAED,MAAM,GAAG,OAAO,CAAC;gBACjB,YAAY,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACd,+CAA+C,IAAI,CAAC,MAAM,CAAC,UAAU,UAAU,CAC/E,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,GAAG,OAAO,CAAC;gBACjB,2DAA2D;gBAC3D,4EAA4E;gBAC5E,YAAY,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7B,OAAO,SAAc,CAAC;YACvB,CAAC;YAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,MAAM,GAAG,OAAO,CAAC;YACjB,IAAI,CAAC,YAAY,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC7C,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,CAAC;YACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC3D,YAAY,GAAG,iBAAiB,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC;gBAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;gBAAS,CAAC;YACV,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAC7C,MAAM,KAAK,GAA+B;gBACzC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,GAAG,MAAM,IAAI,KAAK,EAAE;gBACrD,MAAM;gBACN,KAAK;gBACL,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC;YACF,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACF,CAAC;IAEO,oBAAoB,CAAC,KAAiC;QAC7D,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO;QACR,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,OAA4B;QAC9C,uFAAuF;QACvF,OAAO,IAAI,CAAC,OAAO,CAAS,MAAM,EAAE,oBAAoB,EAAE;YACzD,IAAI,EAAE;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E;YACD,SAAS,EAAE,cAAc;SACzB,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,OAA4B;QAC1D,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAEvB,OAAO,IAAI,CAAC,OAAO,CAAS,OAAO,EAAE,sBAAsB,EAAE,EAAE,EAAE;YAChE,IAAI,EAAE;gBACL,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E;YACD,SAAS,EAAE,cAAc;SACzB,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,EAAU;QACzB,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAEvB,OAAO,IAAI,CAAC,OAAO,CAAS,KAAK,EAAE,sBAAsB,EAAE,EAAE,EAAE;YAC9D,SAAS,EAAE,WAAW;SACtB,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,OAGjB;QACA,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAEtF,OAAO,IAAI,CAAC,OAAO,CAAsB,KAAK,EAAE,IAAI,EAAE;YACrD,SAAS,EAAE,aAAa;SACxB,CAAC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QAC3C,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEnC,OAAO,IAAI,CAAC,OAAO,CAAqB,KAAK,EAAE,sBAAsB,QAAQ,gBAAgB,EAAE;YAC9F,SAAS,EAAE,uBAAuB;SAClC,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,wBAAwB,CAC7B,QAAgB,EAChB,MAA+B;QAE/B,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEnC,OAAO,IAAI,CAAC,OAAO,CAAqB,KAAK,EAAE,sBAAsB,QAAQ,gBAAgB,EAAE;YAC9F,IAAI,EAAE;gBACL,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,GAAG,CAAC,MAAM,CAAC,0BAA0B,KAAK,SAAS;oBAClD,CAAC,CAAC,EAAE,0BAA0B,EAAE,MAAM,CAAC,0BAA0B,EAAE;oBACnE,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,gCAAgC,KAAK,SAAS;oBACxD,CAAC,CAAC,EAAE,gCAAgC,EAAE,MAAM,CAAC,gCAAgC,EAAE;oBAC/E,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,qBAAqB,KAAK,SAAS;oBAC7C,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;oBACzD,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtF;YACD,SAAS,EAAE,0BAA0B;SACrC,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAAC,QAAgB;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,0BAA0B,IAAI,MAAM,CAAC,0BAA0B,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvF,OAAO,MAAM,CAAC,0BAA0B,CAAC;QAC1C,CAAC;QACD,OAAO,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC;IAClE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,6BAA6B,CAAC,QAAgB;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC1D,IACC,MAAM,CAAC,gCAAgC;YACvC,MAAM,CAAC,gCAAgC,CAAC,MAAM,GAAG,CAAC,EACjD,CAAC;YACF,OAAO,MAAM,CAAC,gCAAgC,CAAC;QAChD,CAAC;QACD,OAAO,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,mBAAmB,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAAC,QAAgB;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,mBAAmB,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,4BAA4B,CAAC,QAAgB;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC1D,OAAO,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,yBAAyB,CAAC;IAC9E,CAAC;CACD;AAED,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@qnsp/tenant-sdk",
3
- "version": "0.1.1",
3
+ "version": "0.2.0",
4
4
  "publishConfig": {
5
5
  "access": "public"
6
6
  },
@@ -30,9 +30,9 @@
30
30
  "zod": "^4.1.12"
31
31
  },
32
32
  "devDependencies": {
33
- "@types/node": "^22.13.14",
34
- "tsx": "^4.20.6",
35
- "vitest": "^4.0.10"
33
+ "@types/node": "^24.10.4",
34
+ "tsx": "^4.21.0",
35
+ "vitest": "4.0.16"
36
36
  },
37
37
  "engines": {
38
38
  "node": "24.12.0"
package/src/index.ts CHANGED
@@ -34,6 +34,110 @@ type InternalTenantClientConfig = {
34
34
 
35
35
  export type TenantStatus = "active" | "suspended" | "pending" | "deleted";
36
36
 
37
+ /**
38
+ * Crypto policy tier determines which PQC algorithms are allowed.
39
+ * Maps to tenant_crypto_policies.policy_tier in tenant-service.
40
+ */
41
+ export type CryptoPolicyTier = "default" | "strict" | "maximum" | "government";
42
+
43
+ /**
44
+ * Tenant crypto policy configuration.
45
+ */
46
+ export interface TenantCryptoPolicy {
47
+ readonly tenantId: string;
48
+ readonly policyTier: CryptoPolicyTier;
49
+ readonly customAllowedKemAlgorithms: readonly string[] | null;
50
+ readonly customAllowedSignatureAlgorithms: readonly string[] | null;
51
+ readonly customAllowedSymmetricAlgorithms?: readonly string[] | null;
52
+ readonly customForbiddenAlgorithms?: readonly string[] | null;
53
+ readonly requireHsmForRootKeys: boolean;
54
+ readonly maxKeyAgeDays: number;
55
+ readonly enforcementMode?: "audit" | "enforce";
56
+ readonly createdAt: string;
57
+ readonly updatedAt: string;
58
+ }
59
+
60
+ /**
61
+ * Input for creating or updating a tenant crypto policy.
62
+ */
63
+ export interface TenantCryptoPolicyInput {
64
+ readonly policyTier: CryptoPolicyTier;
65
+ readonly customAllowedKemAlgorithms?: readonly string[] | null;
66
+ readonly customAllowedSignatureAlgorithms?: readonly string[] | null;
67
+ readonly requireHsmForRootKeys?: boolean;
68
+ readonly maxKeyAgeDays?: number;
69
+ }
70
+
71
+ /**
72
+ * Algorithm configuration per crypto policy tier.
73
+ */
74
+ export interface TierAlgorithmConfig {
75
+ readonly kemAlgorithms: readonly string[];
76
+ readonly signatureAlgorithms: readonly string[];
77
+ readonly defaultKemAlgorithm: string;
78
+ readonly defaultSignatureAlgorithm: string;
79
+ }
80
+
81
+ /**
82
+ * Default algorithms per crypto policy tier.
83
+ */
84
+ export const CRYPTO_POLICY_ALGORITHMS: Record<CryptoPolicyTier, TierAlgorithmConfig> = {
85
+ default: {
86
+ kemAlgorithms: ["kyber-512", "kyber-768", "kyber-1024"],
87
+ signatureAlgorithms: ["dilithium-2", "dilithium-3", "dilithium-5"],
88
+ defaultKemAlgorithm: "kyber-768",
89
+ defaultSignatureAlgorithm: "dilithium-3",
90
+ },
91
+ strict: {
92
+ kemAlgorithms: ["kyber-768", "kyber-1024"],
93
+ signatureAlgorithms: ["dilithium-3", "dilithium-5", "falcon-1024"],
94
+ defaultKemAlgorithm: "kyber-768",
95
+ defaultSignatureAlgorithm: "dilithium-3",
96
+ },
97
+ maximum: {
98
+ kemAlgorithms: ["kyber-1024"],
99
+ signatureAlgorithms: ["dilithium-5", "falcon-1024", "sphincs-shake-256f-simple"],
100
+ defaultKemAlgorithm: "kyber-1024",
101
+ defaultSignatureAlgorithm: "dilithium-5",
102
+ },
103
+ government: {
104
+ kemAlgorithms: ["kyber-1024"],
105
+ signatureAlgorithms: ["dilithium-5", "sphincs-shake-256f-simple"],
106
+ defaultKemAlgorithm: "kyber-1024",
107
+ defaultSignatureAlgorithm: "dilithium-5",
108
+ },
109
+ };
110
+
111
+ /**
112
+ * Mapping from internal algorithm names to NIST standardized names.
113
+ */
114
+ export const ALGORITHM_TO_NIST: Record<string, string> = {
115
+ "kyber-512": "ML-KEM-512",
116
+ "kyber-768": "ML-KEM-768",
117
+ "kyber-1024": "ML-KEM-1024",
118
+ "dilithium-2": "ML-DSA-44",
119
+ "dilithium-3": "ML-DSA-65",
120
+ "dilithium-5": "ML-DSA-87",
121
+ "falcon-512": "FN-DSA-512",
122
+ "falcon-1024": "FN-DSA-1024",
123
+ "sphincs-shake-128f-simple": "SLH-DSA-SHAKE-128f",
124
+ "sphincs-shake-256f-simple": "SLH-DSA-SHAKE-256f",
125
+ };
126
+
127
+ /**
128
+ * Convert internal algorithm name to NIST standardized name.
129
+ */
130
+ export function toNistAlgorithmName(internal: string): string {
131
+ return ALGORITHM_TO_NIST[internal] ?? internal;
132
+ }
133
+
134
+ /**
135
+ * Get algorithm config for a crypto policy tier.
136
+ */
137
+ export function getAlgorithmConfigForTier(tier: CryptoPolicyTier): TierAlgorithmConfig {
138
+ return CRYPTO_POLICY_ALGORITHMS[tier];
139
+ }
140
+
37
141
  export interface TenantSecurityEnvelope {
38
142
  readonly controlPlaneTokenSha256: string | null;
39
143
  readonly pqcSignatures: readonly {
@@ -353,6 +457,90 @@ export class TenantClient {
353
457
  operation: "listTenants",
354
458
  });
355
459
  }
460
+
461
+ /**
462
+ * Get the crypto policy for a tenant.
463
+ * Returns the tenant's crypto policy configuration including allowed algorithms.
464
+ * If no policy exists, a default policy is created and returned.
465
+ */
466
+ async getTenantCryptoPolicy(tenantId: string): Promise<TenantCryptoPolicy> {
467
+ validateUUID(tenantId, "tenantId");
468
+
469
+ return this.request<TenantCryptoPolicy>("GET", `/tenant/v1/tenants/${tenantId}/crypto-policy`, {
470
+ operation: "getTenantCryptoPolicy",
471
+ });
472
+ }
473
+
474
+ /**
475
+ * Create or update the crypto policy for a tenant.
476
+ * Sets the policy tier and optional custom algorithm restrictions.
477
+ */
478
+ async upsertTenantCryptoPolicy(
479
+ tenantId: string,
480
+ policy: TenantCryptoPolicyInput,
481
+ ): Promise<TenantCryptoPolicy> {
482
+ validateUUID(tenantId, "tenantId");
483
+
484
+ return this.request<TenantCryptoPolicy>("PUT", `/tenant/v1/tenants/${tenantId}/crypto-policy`, {
485
+ body: {
486
+ policyTier: policy.policyTier,
487
+ ...(policy.customAllowedKemAlgorithms !== undefined
488
+ ? { customAllowedKemAlgorithms: policy.customAllowedKemAlgorithms }
489
+ : {}),
490
+ ...(policy.customAllowedSignatureAlgorithms !== undefined
491
+ ? { customAllowedSignatureAlgorithms: policy.customAllowedSignatureAlgorithms }
492
+ : {}),
493
+ ...(policy.requireHsmForRootKeys !== undefined
494
+ ? { requireHsmForRootKeys: policy.requireHsmForRootKeys }
495
+ : {}),
496
+ ...(policy.maxKeyAgeDays !== undefined ? { maxKeyAgeDays: policy.maxKeyAgeDays } : {}),
497
+ },
498
+ operation: "upsertTenantCryptoPolicy",
499
+ });
500
+ }
501
+
502
+ /**
503
+ * Get the allowed KEM algorithms for a tenant based on their crypto policy.
504
+ * Convenience method that fetches the policy and returns the allowed algorithms.
505
+ */
506
+ async getAllowedKemAlgorithms(tenantId: string): Promise<readonly string[]> {
507
+ const policy = await this.getTenantCryptoPolicy(tenantId);
508
+ if (policy.customAllowedKemAlgorithms && policy.customAllowedKemAlgorithms.length > 0) {
509
+ return policy.customAllowedKemAlgorithms;
510
+ }
511
+ return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].kemAlgorithms;
512
+ }
513
+
514
+ /**
515
+ * Get the allowed signature algorithms for a tenant based on their crypto policy.
516
+ * Convenience method that fetches the policy and returns the allowed algorithms.
517
+ */
518
+ async getAllowedSignatureAlgorithms(tenantId: string): Promise<readonly string[]> {
519
+ const policy = await this.getTenantCryptoPolicy(tenantId);
520
+ if (
521
+ policy.customAllowedSignatureAlgorithms &&
522
+ policy.customAllowedSignatureAlgorithms.length > 0
523
+ ) {
524
+ return policy.customAllowedSignatureAlgorithms;
525
+ }
526
+ return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].signatureAlgorithms;
527
+ }
528
+
529
+ /**
530
+ * Get the default KEM algorithm for a tenant based on their crypto policy tier.
531
+ */
532
+ async getDefaultKemAlgorithm(tenantId: string): Promise<string> {
533
+ const policy = await this.getTenantCryptoPolicy(tenantId);
534
+ return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].defaultKemAlgorithm;
535
+ }
536
+
537
+ /**
538
+ * Get the default signature algorithm for a tenant based on their crypto policy tier.
539
+ */
540
+ async getDefaultSignatureAlgorithm(tenantId: string): Promise<string> {
541
+ const policy = await this.getTenantCryptoPolicy(tenantId);
542
+ return CRYPTO_POLICY_ALGORITHMS[policy.policyTier].defaultSignatureAlgorithm;
543
+ }
356
544
  }
357
545
 
358
546
  export * from "./observability.js";