@ai-sdk-byok/drizzle 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cyril Tsui
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,64 @@
+# @ai-sdk-byok/drizzle
+
+Drizzle-backed PostgreSQL storage adapter for [`ai-sdk-byok`](https://github.com/Xyri1/ai-sdk-byok). Credentials are encrypted in trusted application code before they reach SQL.
+
+## Install
+
+```sh
+npm install ai-sdk-byok @ai-sdk-byok/drizzle drizzle-orm
+```
+
+`drizzle-orm` is a peer dependency. Install and configure a PostgreSQL-compatible Drizzle driver in the application; this package does not create connections or own pooling.
+
+## Requirements
+
+- Node.js 22 or newer.
+- A PostgreSQL database.
+- A caller-owned Drizzle database instance.
+- Trusted server-side code for the master key and credential retrieval.
+
+The initial supported dialect is `postgres`. SQLite is not supported by this adapter yet.
+
+## Migration setup
+
+Apply [`migrations/0001_ai_sdk_byok_init.sql`](migrations/0001_ai_sdk_byok_init.sql) to the application database. When installed from npm, the file is available at `node_modules/@ai-sdk-byok/drizzle/migrations/0001_ai_sdk_byok_init.sql` and can be copied into the application's migrations directory.
+
+Applications using Drizzle Kit can instead generate a migration from the exported `aiSdkByokKeys` schema. Use either the shipped SQL migration or the generated equivalent, not both.
+
+## Usage
+
+`db` is the application's configured Drizzle PostgreSQL database:
+
+```ts
+import { createByokManager } from 'ai-sdk-byok';
+import { drizzleAdapter } from '@ai-sdk-byok/drizzle';
+
+export const byok = createByokManager({
+  storage: drizzleAdapter({
+    db,
+    dialect: 'postgres',
+    encryption: {
+      current: {
+        version: 'v1',
+        key: process.env.AI_SDK_BYOK_MASTER_KEY!,
+      },
+    },
+  }),
+});
+```
+
+Generate a string master key with `openssl rand -base64 32` and keep it in a server-side secret. The adapter accepts the configured `current` key for new writes and optional `previous` keys for reading older rows.
+
+## Key rotation
+
+Set the new key as `current` and keep the old key in `previous`. New writes and credential rotations use `current`; `previous` keys are read-only and decrypt rows carrying their matching version. Re-encryption of existing rows may be deferred, so keep each previous key configured while those rows remain.
+
+## Security
+
+- The master key is never stored in SQL.
+- Losing the master key makes stored credentials unrecoverable.
+- If a master key leaks, rows encrypted under that key must be treated as compromised when their ciphertext may also have been exposed. Affected users should rotate their provider API keys.
+- This adapter protects against database-only compromise, including leaked backups, dumps, and read replicas. It does not protect against application-server compromise.
+- Cryptography is pinned to AES-256-GCM with a 32-byte base64 master key, a new random 12-byte nonce for each write, and additional authenticated data bound to `(userId, provider)`.
+
+SQL stores metadata plus base64url ciphertext, nonce, and the non-secret encryption-key version. Plaintext credentials and key material remain in trusted application memory.

package/dist/index.d.ts

@@ -0,0 +1,210 @@
+import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
+import { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
+import { ByokManagerOptions } from 'ai-sdk-byok';
+
+declare const aiSdkByokKeys: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "ai_sdk_byok_keys";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_pg_core.PgColumn<{
+            name: "id";
+            tableName: "ai_sdk_byok_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: drizzle_orm_pg_core.PgColumn<{
+            name: "user_id";
+            tableName: "ai_sdk_byok_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provider: drizzle_orm_pg_core.PgColumn<{
+            name: "provider";
+            tableName: "ai_sdk_byok_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        label: drizzle_orm_pg_core.PgColumn<{
+            name: "label";
+            tableName: "ai_sdk_byok_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        keyHint: drizzle_orm_pg_core.PgColumn<{
+            name: "key_hint";
+            tableName: "ai_sdk_byok_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credentialsCiphertext: drizzle_orm_pg_core.PgColumn<{
+            name: "credentials_ciphertext";
+            tableName: "ai_sdk_byok_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        credentialsNonce: drizzle_orm_pg_core.PgColumn<{
+            name: "credentials_nonce";
+            tableName: "ai_sdk_byok_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        encryptionKeyVersion: drizzle_orm_pg_core.PgColumn<{
+            name: "encryption_key_version";
+            tableName: "ai_sdk_byok_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: drizzle_orm_pg_core.PgColumn<{
+            name: "created_at";
+            tableName: "ai_sdk_byok_keys";
+            dataType: "string";
+            columnType: "PgTimestampString";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "updated_at";
+            tableName: "ai_sdk_byok_keys";
+            dataType: "string";
+            columnType: "PgTimestampString";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+
+type EncryptionKey = {
+    version: string;
+    key: string | Uint8Array | CryptoKey;
+};
+type EncryptionConfig = {
+    current: EncryptionKey;
+    previous?: EncryptionKey[];
+};
+interface EncryptedPayload {
+    ciphertext: string;
+    nonce: string;
+    keyVersion: string;
+}
+declare function credentialAad(...parts: string[]): string;
+declare function createKeyring(config: EncryptionConfig): {
+    encrypt(plaintext: string, aad: string): Promise<EncryptedPayload>;
+    decrypt(payload: EncryptedPayload, aad: string): Promise<string>;
+};
+
+type DrizzlePostgresDatabase = PgDatabase<PgQueryResultHKT, Record<string, unknown>>;
+interface DrizzleAdapterOptions {
+    db: DrizzlePostgresDatabase;
+    dialect: 'postgres';
+    encryption: EncryptionConfig;
+}
+declare function drizzleAdapter(options: DrizzleAdapterOptions): ByokManagerOptions['storage'];
+
+export { type DrizzleAdapterOptions, type EncryptedPayload, type EncryptionConfig, type EncryptionKey, aiSdkByokKeys, createKeyring, credentialAad, drizzleAdapter };

package/dist/index.js

@@ -0,0 +1,333 @@
+import { pgTable, timestamp, text, unique, index } from 'drizzle-orm/pg-core';
+import { AiSdkByokAdapterError, AiSdkByokValidationError } from 'ai-sdk-byok';
+import { and, eq, desc } from 'drizzle-orm';
+
+// packages/drizzle/src/schema.ts
+var aiSdkByokKeys = pgTable(
+  "ai_sdk_byok_keys",
+  {
+    id: text("id").primaryKey(),
+    userId: text("user_id").notNull(),
+    provider: text("provider").notNull(),
+    label: text("label").notNull(),
+    keyHint: text("key_hint").notNull(),
+    credentialsCiphertext: text("credentials_ciphertext").notNull(),
+    credentialsNonce: text("credentials_nonce").notNull(),
+    encryptionKeyVersion: text("encryption_key_version").notNull(),
+    createdAt: timestamp("created_at", { mode: "string", withTimezone: true }).notNull(),
+    updatedAt: timestamp("updated_at", { mode: "string", withTimezone: true }).notNull()
+  },
+  (table) => [
+    unique("ai_sdk_byok_keys_user_provider_label_unique").on(table.userId, table.provider, table.label),
+    index("ai_sdk_byok_keys_user_updated_created_idx").on(
+      table.userId,
+      table.updatedAt.desc(),
+      table.createdAt.desc()
+    )
+  ]
+);
+var NONCE_LENGTH_BYTES = 12;
+var KEY_LENGTH_BYTES = 32;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function credentialAad(...parts) {
+  return parts.join("\0");
+}
+function decodeBase64(value) {
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let index2 = 0; index2 < binary.length; index2 += 1) {
+    bytes[index2] = binary.charCodeAt(index2);
+  }
+  return bytes;
+}
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64Url(value) {
+  const padded = value.replaceAll("-", "+").replaceAll("_", "/");
+  return decodeBase64(padded + "=".repeat((4 - padded.length % 4) % 4));
+}
+function decodeKeyMaterial(value) {
+  let bytes;
+  try {
+    bytes = decodeBase64(value.trim());
+  } catch {
+    throw new AiSdkByokValidationError("encryption key must be a base64-encoded string");
+  }
+  if (bytes.length !== KEY_LENGTH_BYTES) {
+    throw new AiSdkByokValidationError("encryption key must decode to exactly 32 bytes");
+  }
+  return bytes;
+}
+function isCryptoKey(value) {
+  return typeof CryptoKey !== "undefined" && value instanceof CryptoKey;
+}
+function normalizeKey(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new AiSdkByokValidationError("encryption key must be an object");
+  }
+  const input = value;
+  if (typeof input.version !== "string" || input.version.trim().length === 0) {
+    throw new AiSdkByokValidationError("encryption key version must be a non-empty string");
+  }
+  let material;
+  if (typeof input.key === "string") {
+    material = decodeKeyMaterial(input.key);
+  } else if (input.key instanceof Uint8Array) {
+    if (input.key.byteLength !== KEY_LENGTH_BYTES) {
+      throw new AiSdkByokValidationError("encryption key must be exactly 32 bytes");
+    }
+    material = new Uint8Array(input.key);
+  } else if (isCryptoKey(input.key)) {
+    const algorithm = input.key.algorithm;
+    if (input.key.type !== "secret" || algorithm.name !== "AES-GCM" || !("length" in algorithm) || algorithm.length !== 256 || !input.key.usages.includes("encrypt") || !input.key.usages.includes("decrypt")) {
+      throw new AiSdkByokValidationError("encryption key must be an AES-GCM key usable for encrypt and decrypt");
+    }
+    material = input.key;
+  } else {
+    throw new AiSdkByokValidationError("encryption key must be a string, Uint8Array, or CryptoKey");
+  }
+  return { version: input.version, material, keyPromise: null };
+}
+function normalizeConfig(config) {
+  if (typeof config !== "object" || config === null || Array.isArray(config)) {
+    throw new AiSdkByokValidationError("encryption config must be an object");
+  }
+  const input = config;
+  const previous = input.previous === void 0 ? [] : input.previous;
+  if (!Array.isArray(previous)) {
+    throw new AiSdkByokValidationError("encryption config previous keys must be an array");
+  }
+  const current = normalizeKey(input.current);
+  const keys = /* @__PURE__ */ new Map();
+  for (const key of [current, ...previous.map(normalizeKey)]) {
+    if (keys.has(key.version)) {
+      throw new AiSdkByokValidationError("encryption key versions must be unique");
+    }
+    keys.set(key.version, key);
+  }
+  return { current, keys };
+}
+function importKey(key) {
+  if (isCryptoKey(key.material)) {
+    return Promise.resolve(key.material);
+  }
+  key.keyPromise ??= globalThis.crypto.subtle.importKey("raw", key.material, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]).catch((error) => {
+    key.keyPromise = null;
+    throw error;
+  });
+  return key.keyPromise;
+}
+function createKeyring(config) {
+  const { current, keys } = normalizeConfig(config);
+  return {
+    async encrypt(plaintext, aad) {
+      try {
+        const key = await importKey(current);
+        const nonce = globalThis.crypto.getRandomValues(new Uint8Array(NONCE_LENGTH_BYTES));
+        const ciphertext = await globalThis.crypto.subtle.encrypt(
+          { name: "AES-GCM", iv: nonce, additionalData: encoder.encode(aad) },
+          key,
+          encoder.encode(plaintext)
+        );
+        return {
+          ciphertext: toBase64Url(new Uint8Array(ciphertext)),
+          nonce: toBase64Url(nonce),
+          keyVersion: current.version
+        };
+      } catch {
+        throw new AiSdkByokAdapterError("Drizzle encryption failed");
+      }
+    },
+    async decrypt(payload, aad) {
+      const key = keys.get(payload.keyVersion);
+      if (key === void 0) {
+        throw new AiSdkByokAdapterError("Drizzle credential payload uses an unconfigured encryption key");
+      }
+      try {
+        const plaintext = await globalThis.crypto.subtle.decrypt(
+          { name: "AES-GCM", iv: fromBase64Url(payload.nonce), additionalData: encoder.encode(aad) },
+          await importKey(key),
+          fromBase64Url(payload.ciphertext)
+        );
+        return decoder.decode(plaintext);
+      } catch {
+        throw new AiSdkByokAdapterError("Drizzle credential payload failed to decrypt");
+      }
+    }
+  };
+}
+function adapterError(operation) {
+  return new AiSdkByokAdapterError(`Drizzle BYOK adapter failed during ${operation}`);
+}
+function toMetadata(row) {
+  return {
+    id: row.id,
+    userId: row.userId,
+    provider: row.provider,
+    label: row.label,
+    keyHint: row.keyHint,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt
+  };
+}
+function parseCredentials(plaintext) {
+  try {
+    const parsed = JSON.parse(plaintext);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || Object.keys(parsed).length !== 1 || typeof parsed.apiKey !== "string") {
+      throw new Error("invalid credential payload shape");
+    }
+    return { apiKey: parsed.apiKey };
+  } catch {
+    throw new AiSdkByokAdapterError("Drizzle credential payload has an invalid shape");
+  }
+}
+function drizzleAdapter(options) {
+  if (options?.dialect !== "postgres") {
+    throw new AiSdkByokValidationError("Drizzle dialect must be postgres");
+  }
+  const db = options.db;
+  const keyring = createKeyring(options.encryption);
+  return {
+    async save(input) {
+      const encrypted = await keyring.encrypt(
+        JSON.stringify({ apiKey: input.credentials.apiKey }),
+        credentialAad(input.userId, input.provider)
+      );
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      let row;
+      try {
+        [row] = await db.insert(aiSdkByokKeys).values({
+          id: crypto.randomUUID(),
+          userId: input.userId,
+          provider: input.provider,
+          label: input.label,
+          keyHint: input.keyHint,
+          credentialsCiphertext: encrypted.ciphertext,
+          credentialsNonce: encrypted.nonce,
+          encryptionKeyVersion: encrypted.keyVersion,
+          createdAt: now,
+          updatedAt: now
+        }).onConflictDoUpdate({
+          target: [aiSdkByokKeys.userId, aiSdkByokKeys.provider, aiSdkByokKeys.label],
+          set: {
+            keyHint: input.keyHint,
+            credentialsCiphertext: encrypted.ciphertext,
+            credentialsNonce: encrypted.nonce,
+            encryptionKeyVersion: encrypted.keyVersion,
+            updatedAt: now
+          }
+        }).returning({
+          id: aiSdkByokKeys.id,
+          userId: aiSdkByokKeys.userId,
+          provider: aiSdkByokKeys.provider,
+          label: aiSdkByokKeys.label,
+          keyHint: aiSdkByokKeys.keyHint,
+          createdAt: aiSdkByokKeys.createdAt,
+          updatedAt: aiSdkByokKeys.updatedAt
+        });
+      } catch {
+        throw adapterError("save");
+      }
+      if (row === void 0) {
+        throw adapterError("save");
+      }
+      return toMetadata(row);
+    },
+    async list(input) {
+      try {
+        const rows = await db.select({
+          id: aiSdkByokKeys.id,
+          userId: aiSdkByokKeys.userId,
+          provider: aiSdkByokKeys.provider,
+          label: aiSdkByokKeys.label,
+          keyHint: aiSdkByokKeys.keyHint,
+          createdAt: aiSdkByokKeys.createdAt,
+          updatedAt: aiSdkByokKeys.updatedAt
+        }).from(aiSdkByokKeys).where(eq(aiSdkByokKeys.userId, input.userId)).orderBy(desc(aiSdkByokKeys.updatedAt), desc(aiSdkByokKeys.createdAt));
+        return rows.map(toMetadata);
+      } catch {
+        throw adapterError("list");
+      }
+    },
+    async get(input) {
+      let row;
+      try {
+        [row] = await db.select({
+          userId: aiSdkByokKeys.userId,
+          provider: aiSdkByokKeys.provider,
+          credentialsCiphertext: aiSdkByokKeys.credentialsCiphertext,
+          credentialsNonce: aiSdkByokKeys.credentialsNonce,
+          encryptionKeyVersion: aiSdkByokKeys.encryptionKeyVersion
+        }).from(aiSdkByokKeys).where(
+          and(
+            eq(aiSdkByokKeys.userId, input.userId),
+            eq(aiSdkByokKeys.provider, input.provider),
+            eq(aiSdkByokKeys.label, input.label)
+          )
+        );
+      } catch {
+        throw adapterError("get");
+      }
+      if (row === void 0) {
+        return null;
+      }
+      const plaintext = await keyring.decrypt(
+        {
+          ciphertext: row.credentialsCiphertext,
+          nonce: row.credentialsNonce,
+          keyVersion: row.encryptionKeyVersion
+        },
+        credentialAad(row.userId, row.provider)
+      );
+      return parseCredentials(plaintext);
+    },
+    async getById(input) {
+      let row;
+      try {
+        [row] = await db.select({
+          id: aiSdkByokKeys.id,
+          userId: aiSdkByokKeys.userId,
+          provider: aiSdkByokKeys.provider,
+          label: aiSdkByokKeys.label,
+          keyHint: aiSdkByokKeys.keyHint,
+          createdAt: aiSdkByokKeys.createdAt,
+          updatedAt: aiSdkByokKeys.updatedAt,
+          credentialsCiphertext: aiSdkByokKeys.credentialsCiphertext,
+          credentialsNonce: aiSdkByokKeys.credentialsNonce,
+          encryptionKeyVersion: aiSdkByokKeys.encryptionKeyVersion
+        }).from(aiSdkByokKeys).where(and(eq(aiSdkByokKeys.userId, input.userId), eq(aiSdkByokKeys.id, input.keyId)));
+      } catch {
+        throw adapterError("getById");
+      }
+      if (row === void 0) {
+        return null;
+      }
+      const plaintext = await keyring.decrypt(
+        {
+          ciphertext: row.credentialsCiphertext,
+          nonce: row.credentialsNonce,
+          keyVersion: row.encryptionKeyVersion
+        },
+        credentialAad(row.userId, row.provider)
+      );
+      return { ...toMetadata(row), credentials: parseCredentials(plaintext) };
+    },
+    async delete(input) {
+      try {
+        await db.delete(aiSdkByokKeys).where(and(eq(aiSdkByokKeys.userId, input.userId), eq(aiSdkByokKeys.id, input.keyId)));
+      } catch {
+        throw adapterError("delete");
+      }
+    }
+  };
+}
+
+export { aiSdkByokKeys, createKeyring, credentialAad, drizzleAdapter };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schema.ts","../src/crypto.ts","../src/adapter.ts"],"names":["index","AiSdkByokAdapterError","AiSdkByokValidationError"],"mappings":";;;;;AAEO,IAAM,aAAA,GAAgB,OAAA;AAAA,EAC3B,kBAAA;AAAA,EACA;AAAA,IACE,EAAA,EAAI,IAAA,CAAK,IAAI,CAAA,CAAE,UAAA,EAAW;AAAA,IAC1B,MAAA,EAAQ,IAAA,CAAK,SAAS,CAAA,CAAE,OAAA,EAAQ;AAAA,IAChC,QAAA,EAAU,IAAA,CAAK,UAAU,CAAA,CAAE,OAAA,EAAQ;AAAA,IACnC,KAAA,EAAO,IAAA,CAAK,OAAO,CAAA,CAAE,OAAA,EAAQ;AAAA,IAC7B,OAAA,EAAS,IAAA,CAAK,UAAU,CAAA,CAAE,OAAA,EAAQ;AAAA,IAClC,qBAAA,EAAuB,IAAA,CAAK,wBAAwB,CAAA,CAAE,OAAA,EAAQ;AAAA,IAC9D,gBAAA,EAAkB,IAAA,CAAK,mBAAmB,CAAA,CAAE,OAAA,EAAQ;AAAA,IACpD,oBAAA,EAAsB,IAAA,CAAK,wBAAwB,CAAA,CAAE,OAAA,EAAQ;AAAA,IAC7D,SAAA,EAAW,SAAA,CAAU,YAAA,EAAc,EAAE,IAAA,EAAM,UAAU,YAAA,EAAc,IAAA,EAAM,CAAA,CAAE,OAAA,EAAQ;AAAA,IACnF,SAAA,EAAW,SAAA,CAAU,YAAA,EAAc,EAAE,IAAA,EAAM,UAAU,YAAA,EAAc,IAAA,EAAM,CAAA,CAAE,OAAA;AAAQ,GACrF;AAAA,EACA,CAAC,KAAA,KAAU;AAAA,IACT,MAAA,CAAO,6CAA6C,CAAA,CAAE,EAAA,CAAG,MAAM,MAAA,EAAQ,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,KAAK,CAAA;AAAA,IAClG,KAAA,CAAM,2CAA2C,CAAA,CAAE,EAAA;AAAA,MACjD,KAAA,CAAM,MAAA;AAAA,MACN,KAAA,CAAM,UAAU,IAAA,EAAK;AAAA,MACrB,KAAA,CAAM,UAAU,IAAA;AAAK;AACvB;AAEJ;ACAA,IAAM,kBAAA,GAAqB,EAAA;AAC3B,IAAM,gBAAA,GAAmB,EAAA;AACzB,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAEzB,SAAS,iBAAiB,KAAA,EAAyB;AACxD,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEA,SAAS,aAAa,KAAA,EAAwC;AAC5D,EAAA,MAAM,MAAA,GAAS,KAAK,KAAK,CAAA;AACzB,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,EAAA,KAAA,IAASA,SAAQ,CAAA,EAAGA,MAAAA,GAAQ,MAAA,CAAO,MAAA,EAAQA,UAAS,CAAA,EAAG;AACrD,IAAA,KAAA,CAAMA,MAAK,CAAA,GAAI,MAAA,CAAO,UAAA,CAAWA,MAAK,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,YAAY,KAAA,EAA2B;AAC9C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAA,IAAU,MAAA,CAAO,aAAa,IAAI,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA,CAAK,MAAM,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AACjF;AAEA,SAAS,cAAc,KAAA,EAAwC;AAC7D,EAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,GAAA,EAAK,GAAG,CAAA,CAAE,UAAA,CAAW,KAAK,GAAG,CAAA;AAC7D,EAAA,OAAO,YAAA,CAAa,SAAS,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,MAAA,CAAO,MAAA,GAAS,CAAA,IAAM,CAAC,CAAC,CAAA;AACxE;AAEA,SAAS,kBAAkB,KAAA,EAAwC;AACjE,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,YAAA,CAAa,KAAA,CAAM,IAAA,EAAM,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,yBAAyB,gDAAgD,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,KAAA,CAAM,WAAW,gBAAA,EAAkB;AACrC,IAAA,MAAM,IAAI,yBAAyB,gDAAgD,CAAA;AAAA,EACrF;AAEA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,YAAY,KAAA,EAAoC;AACvD,EAAA,OAAO,OAAO,SAAA,KAAc,WAAA,IAAe,KAAA,YAAiB,SAAA;AAC9D;AAEA,SAAS,aAAa,KAAA,EAAyC;AAC7D,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACvE,IAAA,MAAM,IAAI,yBAAyB,kCAAkC,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA;AACd,EAAA,IAAI,OAAO,MAAM,OAAA,KAAY,QAAA,IAAY,MAAM,OAAA,CAAQ,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AAC1E,IAAA,MAAM,IAAI,yBAAyB,mDAAmD,CAAA;AAAA,EACxF;AAEA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,EAAU;AACjC,IAAA,QAAA,GAAW,iBAAA,CAAkB,MAAM,GAAG,CAAA;AAAA,EACxC,CAAA,MAAA,IAAW,KAAA,CAAM,GAAA,YAAe,UAAA,EAAY;AAC1C,IAAA,IAAI,KAAA,CAAM,GAAA,CAAI,UAAA,KAAe,gBAAA,EAAkB;AAC7C,MAAA,MAAM,IAAI,yBAAyB,yCAAyC,CAAA;AAAA,IAC9E;AACA,IAAA,QAAA,GAAW,IAAI,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA;AAAA,EACrC,CAAA,MAAA,IAAW,WAAA,CAAY,KAAA,CAAM,GAAG,CAAA,EAAG;AACjC,IAAA,MAAM,SAAA,GAAY,MAAM,GAAA,CAAI,SAAA;AAC5B,IAAA,IACE,KAAA,CAAM,GAAA,CAAI,IAAA,KAAS,QAAA,IACnB,SAAA,CAAU,IAAA,KAAS,SAAA,IACnB,EAAE,QAAA,IAAY,SAAA,CAAA,IACd,SAAA,CAAU,MAAA,KAAW,GAAA,IACrB,CAAC,KAAA,CAAM,GAAA,CAAI,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IACpC,CAAC,KAAA,CAAM,GAAA,CAAI,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,EACpC;AACA,MAAA,MAAM,IAAI,yBAAyB,sEAAsE,CAAA;AAAA,IAC3G;AACA,IAAA,QAAA,GAAW,KAAA,CAAM,GAAA;AAAA,EACnB,CAAA,MAAO;AACL,IAAA,MAAM,IAAI,yBAAyB,2DAA2D,CAAA;AAAA,EAChG;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,EAAS,QAAA,EAAU,YAAY,IAAA,EAAK;AAC9D;AAEA,SAAS,gBAAgB,MAAA,EAAmG;AAC1H,EAAA,IAAI,OAAO,WAAW,QAAA,IAAY,MAAA,KAAW,QAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC1E,IAAA,MAAM,IAAI,yBAAyB,qCAAqC,CAAA;AAAA,EAC1E;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAA;AACd,EAAA,MAAM,WAAW,KAAA,CAAM,QAAA,KAAa,MAAA,GAAY,KAAK,KAAA,CAAM,QAAA;AAC3D,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,yBAAyB,kDAAkD,CAAA;AAAA,EACvF;AAEA,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,KAAA,CAAM,OAAO,CAAA;AAC1C,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAqC;AACtD,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,OAAA,EAAS,GAAG,SAAS,GAAA,CAAI,YAAY,CAAC,CAAA,EAAG;AAC1D,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,OAAO,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,yBAAyB,wCAAwC,CAAA;AAAA,IAC7E;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,OAAA,EAAS,GAAG,CAAA;AAAA,EAC3B;AAEA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB;AAEA,SAAS,UAAU,GAAA,EAAkD;AACnE,EAAA,IAAI,WAAA,CAAY,GAAA,CAAI,QAAQ,CAAA,EAAG;AAC7B,IAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAAA,EACrC;AAEA,EAAA,GAAA,CAAI,UAAA,KAAe,WAAW,MAAA,CAAO,MAAA,CAClC,UAAU,KAAA,EAAO,GAAA,CAAI,UAAU,EAAE,IAAA,EAAM,WAAU,EAAG,KAAA,EAAO,CAAC,SAAA,EAAW,SAAS,CAAC,CAAA,CACjF,KAAA,CAAM,CAAC,KAAA,KAAmB;AACzB,IAAA,GAAA,CAAI,UAAA,GAAa,IAAA;AACjB,IAAA,MAAM,KAAA;AAAA,EACR,CAAC,CAAA;AACH,EAAA,OAAO,GAAA,CAAI,UAAA;AACb;AAEO,SAAS,cAAc,MAAA,EAA0B;AACtD,EAAA,MAAM,EAAE,OAAA,EAAS,IAAA,EAAK,GAAI,gBAAgB,MAAM,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,MAAM,OAAA,CAAQ,SAAA,EAAmB,GAAA,EAAwC;AACvE,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,MAAM,SAAA,CAAU,OAAO,CAAA;AACnC,QAAA,MAAM,QAAQ,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,kBAAkB,CAAC,CAAA;AAClF,QAAA,MAAM,UAAA,GAAa,MAAM,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,OAAA;AAAA,UAChD,EAAE,MAAM,SAAA,EAAW,EAAA,EAAI,OAAO,cAAA,EAAgB,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA,EAAE;AAAA,UAClE,GAAA;AAAA,UACA,OAAA,CAAQ,OAAO,SAAS;AAAA,SAC1B;AAEA,QAAA,OAAO;AAAA,UACL,UAAA,EAAY,WAAA,CAAY,IAAI,UAAA,CAAW,UAAU,CAAC,CAAA;AAAA,UAClD,KAAA,EAAO,YAAY,KAAK,CAAA;AAAA,UACxB,YAAY,OAAA,CAAQ;AAAA,SACtB;AAAA,MACF,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,IAAI,sBAAsB,2BAA2B,CAAA;AAAA,MAC7D;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,OAAA,CAAQ,OAAA,EAA2B,GAAA,EAA8B;AACrE,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,UAAU,CAAA;AACvC,MAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,QAAA,MAAM,IAAI,sBAAsB,gEAAgE,CAAA;AAAA,MAClG;AAEA,MAAA,IAAI;AACF,QAAA,MAAM,SAAA,GAAY,MAAM,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,OAAA;AAAA,UAC/C,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAI,aAAA,CAAc,OAAA,CAAQ,KAAK,CAAA,EAAG,cAAA,EAAgB,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA,EAAE;AAAA,UACzF,MAAM,UAAU,GAAG,CAAA;AAAA,UACnB,aAAA,CAAc,QAAQ,UAAU;AAAA,SAClC;AACA,QAAA,OAAO,OAAA,CAAQ,OAAO,SAAS,CAAA;AAAA,MACjC,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,IAAI,sBAAsB,8CAA8C,CAAA;AAAA,MAChF;AAAA,IACF;AAAA,GACF;AACF;AC1JA,SAAS,aAAa,SAAA,EAA0C;AAC9D,EAAA,OAAO,IAAIC,qBAAAA,CAAsB,CAAA,mCAAA,EAAsC,SAAS,CAAA,CAAE,CAAA;AACpF;AAEA,SAAS,WAAW,GAAA,EAAkC;AACpD,EAAA,OAAO;AAAA,IACL,IAAI,GAAA,CAAI,EAAA;AAAA,IACR,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,UAAU,GAAA,CAAI,QAAA;AAAA,IACd,OAAO,GAAA,CAAI,KAAA;AAAA,IACX,SAAS,GAAA,CAAI,OAAA;AAAA,IACb,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,WAAW,GAAA,CAAI;AAAA,GACjB;AACF;AAEA,SAAS,iBAAiB,SAAA,EAAsC;AAC9D,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AAE5C,IAAA,IACE,OAAO,MAAA,KAAW,QAAA,IAClB,WAAW,IAAA,IACX,KAAA,CAAM,QAAQ,MAAM,CAAA,IACpB,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,KAAW,KAC/B,OAAQ,MAAA,CAAgC,WAAW,QAAA,EACnD;AACA,MAAA,MAAM,IAAI,MAAM,kCAAkC,CAAA;AAAA,IACpD;AAEA,IAAA,OAAO,EAAE,MAAA,EAAS,MAAA,CAA8B,MAAA,EAAO;AAAA,EACzD,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAIA,sBAAsB,iDAAiD,CAAA;AAAA,EACnF;AACF;AAEO,SAAS,eAAe,OAAA,EAA+D;AAC5F,EAAA,IAAI,OAAA,EAAS,YAAY,UAAA,EAAY;AACnC,IAAA,MAAM,IAAIC,yBAAyB,kCAAkC,CAAA;AAAA,EACvE;AAEA,EAAA,MAAM,KAAK,OAAA,CAAQ,EAAA;AACnB,EAAA,MAAM,OAAA,GAAU,aAAA,CAAc,OAAA,CAAQ,UAAU,CAAA;AAEhD,EAAA,OAAO;AAAA,IACL,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,OAAA;AAAA,QAC9B,KAAK,SAAA,CAAU,EAAE,QAAQ,KAAA,CAAM,WAAA,CAAY,QAAQ,CAAA;AAAA,QACnD,aAAA,CAAc,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,QAAQ;AAAA,OAC5C;AACA,MAAA,MAAM,GAAA,GAAA,iBAAM,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACnC,MAAA,IAAI,GAAA;AAEJ,MAAA,IAAI;AACF,QAAA,CAAC,GAAG,CAAA,GAAI,MAAM,GACX,MAAA,CAAO,aAAa,EACpB,MAAA,CAAO;AAAA,UACN,EAAA,EAAI,OAAO,UAAA,EAAW;AAAA,UACtB,QAAQ,KAAA,CAAM,MAAA;AAAA,UACd,UAAU,KAAA,CAAM,QAAA;AAAA,UAChB,OAAO,KAAA,CAAM,KAAA;AAAA,UACb,SAAS,KAAA,CAAM,OAAA;AAAA,UACf,uBAAuB,SAAA,CAAU,UAAA;AAAA,UACjC,kBAAkB,SAAA,CAAU,KAAA;AAAA,UAC5B,sBAAsB,SAAA,CAAU,UAAA;AAAA,UAChC,SAAA,EAAW,GAAA;AAAA,UACX,SAAA,EAAW;AAAA,SACZ,EACA,kBAAA,CAAmB;AAAA,UAClB,QAAQ,CAAC,aAAA,CAAc,QAAQ,aAAA,CAAc,QAAA,EAAU,cAAc,KAAK,CAAA;AAAA,UAC1E,GAAA,EAAK;AAAA,YACH,SAAS,KAAA,CAAM,OAAA;AAAA,YACf,uBAAuB,SAAA,CAAU,UAAA;AAAA,YACjC,kBAAkB,SAAA,CAAU,KAAA;AAAA,YAC5B,sBAAsB,SAAA,CAAU,UAAA;AAAA,YAChC,SAAA,EAAW;AAAA;AACb,SACD,EACA,SAAA,CAAU;AAAA,UACT,IAAI,aAAA,CAAc,EAAA;AAAA,UAClB,QAAQ,aAAA,CAAc,MAAA;AAAA,UACtB,UAAU,aAAA,CAAc,QAAA;AAAA,UACxB,OAAO,aAAA,CAAc,KAAA;AAAA,UACrB,SAAS,aAAA,CAAc,OAAA;AAAA,UACvB,WAAW,aAAA,CAAc,SAAA;AAAA,UACzB,WAAW,aAAA,CAAc;AAAA,SAC1B,CAAA;AAAA,MACL,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,aAAa,MAAM,CAAA;AAAA,MAC3B;AAEA,MAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,QAAA,MAAM,aAAa,MAAM,CAAA;AAAA,MAC3B;AAEA,MAAA,OAAO,WAAW,GAAG,CAAA;AAAA,IACvB,CAAA;AAAA,IAEA,MAAM,KAAK,KAAA,EAAO;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,MAAM,EAAA,CAChB,MAAA,CAAO;AAAA,UACN,IAAI,aAAA,CAAc,EAAA;AAAA,UAClB,QAAQ,aAAA,CAAc,MAAA;AAAA,UACtB,UAAU,aAAA,CAAc,QAAA;AAAA,UACxB,OAAO,aAAA,CAAc,KAAA;AAAA,UACrB,SAAS,aAAA,CAAc,OAAA;AAAA,UACvB,WAAW,aAAA,CAAc,SAAA;AAAA,UACzB,WAAW,aAAA,CAAc;AAAA,SAC1B,EACA,IAAA,CAAK,aAAa,EAClB,KAAA,CAAM,EAAA,CAAG,cAAc,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAC,CAAA,CAC5C,QAAQ,IAAA,CAAK,aAAA,CAAc,SAAS,CAAA,EAAG,IAAA,CAAK,aAAA,CAAc,SAAS,CAAC,CAAA;AAEvE,QAAA,OAAO,IAAA,CAAK,IAAI,UAAU,CAAA;AAAA,MAC5B,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,aAAa,MAAM,CAAA;AAAA,MAC3B;AAAA,IACF,CAAA;AAAA,IAEA,MAAM,IAAI,KAAA,EAAO;AACf,MAAA,IAAI,GAAA;AAEJ,MAAA,IAAI;AACF,QAAA,CAAC,GAAG,CAAA,GAAI,MAAM,EAAA,CACX,MAAA,CAAO;AAAA,UACN,QAAQ,aAAA,CAAc,MAAA;AAAA,UACtB,UAAU,aAAA,CAAc,QAAA;AAAA,UACxB,uBAAuB,aAAA,CAAc,qBAAA;AAAA,UACrC,kBAAkB,aAAA,CAAc,gBAAA;AAAA,UAChC,sBAAsB,aAAA,CAAc;AAAA,SACrC,CAAA,CACA,IAAA,CAAK,aAAa,CAAA,CAClB,KAAA;AAAA,UACC,GAAA;AAAA,YACE,EAAA,CAAG,aAAA,CAAc,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA;AAAA,YACrC,EAAA,CAAG,aAAA,CAAc,QAAA,EAAU,KAAA,CAAM,QAAQ,CAAA;AAAA,YACzC,EAAA,CAAG,aAAA,CAAc,KAAA,EAAO,KAAA,CAAM,KAAK;AAAA;AACrC,SACF;AAAA,MACJ,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,aAAa,KAAK,CAAA;AAAA,MAC1B;AAEA,MAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,OAAA;AAAA,QAC9B;AAAA,UACE,YAAY,GAAA,CAAI,qBAAA;AAAA,UAChB,OAAO,GAAA,CAAI,gBAAA;AAAA,UACX,YAAY,GAAA,CAAI;AAAA,SAClB;AAAA,QACA,aAAA,CAAc,GAAA,CAAI,MAAA,EAAQ,GAAA,CAAI,QAAQ;AAAA,OACxC;AACA,MAAA,OAAO,iBAAiB,SAAS,CAAA;AAAA,IACnC,CAAA;AAAA,IAEA,MAAM,QAAQ,KAAA,EAAO;AACnB,MAAA,IAAI,GAAA;AAEJ,MAAA,IAAI;AACF,QAAA,CAAC,GAAG,CAAA,GAAI,MAAM,EAAA,CACX,MAAA,CAAO;AAAA,UACN,IAAI,aAAA,CAAc,EAAA;AAAA,UAClB,QAAQ,aAAA,CAAc,MAAA;AAAA,UACtB,UAAU,aAAA,CAAc,QAAA;AAAA,UACxB,OAAO,aAAA,CAAc,KAAA;AAAA,UACrB,SAAS,aAAA,CAAc,OAAA;AAAA,UACvB,WAAW,aAAA,CAAc,SAAA;AAAA,UACzB,WAAW,aAAA,CAAc,SAAA;AAAA,UACzB,uBAAuB,aAAA,CAAc,qBAAA;AAAA,UACrC,kBAAkB,aAAA,CAAc,gBAAA;AAAA,UAChC,sBAAsB,aAAA,CAAc;AAAA,SACrC,CAAA,CACA,IAAA,CAAK,aAAa,CAAA,CAClB,KAAA,CAAM,IAAI,EAAA,CAAG,aAAA,CAAc,QAAQ,KAAA,CAAM,MAAM,GAAG,EAAA,CAAG,aAAA,CAAc,IAAI,KAAA,CAAM,KAAK,CAAC,CAAC,CAAA;AAAA,MACzF,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,aAAa,SAAS,CAAA;AAAA,MAC9B;AAEA,MAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,QAAA,OAAO,IAAA;AAAA,MACT;AAEA,MAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,OAAA;AAAA,QAC9B;AAAA,UACE,YAAY,GAAA,CAAI,qBAAA;AAAA,UAChB,OAAO,GAAA,CAAI,gBAAA;AAAA,UACX,YAAY,GAAA,CAAI;AAAA,SAClB;AAAA,QACA,aAAA,CAAc,GAAA,CAAI,MAAA,EAAQ,GAAA,CAAI,QAAQ;AAAA,OACxC;AACA,MAAA,OAAO,EAAE,GAAG,UAAA,CAAW,GAAG,GAAG,WAAA,EAAa,gBAAA,CAAiB,SAAS,CAAA,EAAE;AAAA,IACxE,CAAA;AAAA,IAEA,MAAM,OAAO,KAAA,EAAO;AAClB,MAAA,IAAI;AACF,QAAA,MAAM,GACH,MAAA,CAAO,aAAa,EACpB,KAAA,CAAM,GAAA,CAAI,GAAG,aAAA,CAAc,MAAA,EAAQ,KAAA,CAAM,MAAM,GAAG,EAAA,CAAG,aAAA,CAAc,IAAI,KAAA,CAAM,KAAK,CAAC,CAAC,CAAA;AAAA,MACzF,CAAA,CAAA,MAAQ;AACN,QAAA,MAAM,aAAa,QAAQ,CAAA;AAAA,MAC7B;AAAA,IACF;AAAA,GACF;AACF","file":"index.js","sourcesContent":["import { index, pgTable, text, timestamp, unique } from 'drizzle-orm/pg-core';\n\nexport const aiSdkByokKeys = pgTable(\n  'ai_sdk_byok_keys',\n  {\n    id: text('id').primaryKey(),\n    userId: text('user_id').notNull(),\n    provider: text('provider').notNull(),\n    label: text('label').notNull(),\n    keyHint: text('key_hint').notNull(),\n    credentialsCiphertext: text('credentials_ciphertext').notNull(),\n    credentialsNonce: text('credentials_nonce').notNull(),\n    encryptionKeyVersion: text('encryption_key_version').notNull(),\n    createdAt: timestamp('created_at', { mode: 'string', withTimezone: true }).notNull(),\n    updatedAt: timestamp('updated_at', { mode: 'string', withTimezone: true }).notNull(),\n  },\n  (table) => [\n    unique('ai_sdk_byok_keys_user_provider_label_unique').on(table.userId, table.provider, table.label),\n    index('ai_sdk_byok_keys_user_updated_created_idx').on(\n      table.userId,\n      table.updatedAt.desc(),\n      table.createdAt.desc(),\n    ),\n  ],\n);\n","import { AiSdkByokAdapterError, AiSdkByokValidationError } from 'ai-sdk-byok';\n\nexport type EncryptionKey = {\n  version: string;\n  key: string | Uint8Array | CryptoKey;\n};\n\nexport type EncryptionConfig = {\n  current: EncryptionKey;\n  previous?: EncryptionKey[];\n};\n\nexport interface EncryptedPayload {\n  ciphertext: string;\n  nonce: string;\n  keyVersion: string;\n}\n\ninterface NormalizedEncryptionKey {\n  version: string;\n  material: Uint8Array<ArrayBuffer> | CryptoKey;\n  keyPromise: Promise<CryptoKey> | null;\n}\n\nconst NONCE_LENGTH_BYTES = 12;\nconst KEY_LENGTH_BYTES = 32;\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\n\nexport function credentialAad(...parts: string[]): string {\n  return parts.join('\\0');\n}\n\nfunction decodeBase64(value: string): Uint8Array<ArrayBuffer> {\n  const binary = atob(value);\n  const bytes = new Uint8Array(binary.length);\n  for (let index = 0; index < binary.length; index += 1) {\n    bytes[index] = binary.charCodeAt(index);\n  }\n  return bytes;\n}\n\nfunction toBase64Url(bytes: Uint8Array): string {\n  let binary = '';\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte);\n  }\n  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');\n}\n\nfunction fromBase64Url(value: string): Uint8Array<ArrayBuffer> {\n  const padded = value.replaceAll('-', '+').replaceAll('_', '/');\n  return decodeBase64(padded + '='.repeat((4 - (padded.length % 4)) % 4));\n}\n\nfunction decodeKeyMaterial(value: string): Uint8Array<ArrayBuffer> {\n  let bytes: Uint8Array<ArrayBuffer>;\n  try {\n    bytes = decodeBase64(value.trim());\n  } catch {\n    throw new AiSdkByokValidationError('encryption key must be a base64-encoded string');\n  }\n\n  if (bytes.length !== KEY_LENGTH_BYTES) {\n    throw new AiSdkByokValidationError('encryption key must decode to exactly 32 bytes');\n  }\n\n  return bytes;\n}\n\nfunction isCryptoKey(value: unknown): value is CryptoKey {\n  return typeof CryptoKey !== 'undefined' && value instanceof CryptoKey;\n}\n\nfunction normalizeKey(value: unknown): NormalizedEncryptionKey {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) {\n    throw new AiSdkByokValidationError('encryption key must be an object');\n  }\n\n  const input = value as Partial<EncryptionKey>;\n  if (typeof input.version !== 'string' || input.version.trim().length === 0) {\n    throw new AiSdkByokValidationError('encryption key version must be a non-empty string');\n  }\n\n  let material: Uint8Array<ArrayBuffer> | CryptoKey;\n  if (typeof input.key === 'string') {\n    material = decodeKeyMaterial(input.key);\n  } else if (input.key instanceof Uint8Array) {\n    if (input.key.byteLength !== KEY_LENGTH_BYTES) {\n      throw new AiSdkByokValidationError('encryption key must be exactly 32 bytes');\n    }\n    material = new Uint8Array(input.key);\n  } else if (isCryptoKey(input.key)) {\n    const algorithm = input.key.algorithm;\n    if (\n      input.key.type !== 'secret' ||\n      algorithm.name !== 'AES-GCM' ||\n      !('length' in algorithm) ||\n      algorithm.length !== 256 ||\n      !input.key.usages.includes('encrypt') ||\n      !input.key.usages.includes('decrypt')\n    ) {\n      throw new AiSdkByokValidationError('encryption key must be an AES-GCM key usable for encrypt and decrypt');\n    }\n    material = input.key;\n  } else {\n    throw new AiSdkByokValidationError('encryption key must be a string, Uint8Array, or CryptoKey');\n  }\n\n  return { version: input.version, material, keyPromise: null };\n}\n\nfunction normalizeConfig(config: unknown): { current: NormalizedEncryptionKey; keys: Map<string, NormalizedEncryptionKey> } {\n  if (typeof config !== 'object' || config === null || Array.isArray(config)) {\n    throw new AiSdkByokValidationError('encryption config must be an object');\n  }\n\n  const input = config as { current?: unknown; previous?: unknown };\n  const previous = input.previous === undefined ? [] : input.previous;\n  if (!Array.isArray(previous)) {\n    throw new AiSdkByokValidationError('encryption config previous keys must be an array');\n  }\n\n  const current = normalizeKey(input.current);\n  const keys = new Map<string, NormalizedEncryptionKey>();\n  for (const key of [current, ...previous.map(normalizeKey)]) {\n    if (keys.has(key.version)) {\n      throw new AiSdkByokValidationError('encryption key versions must be unique');\n    }\n    keys.set(key.version, key);\n  }\n\n  return { current, keys };\n}\n\nfunction importKey(key: NormalizedEncryptionKey): Promise<CryptoKey> {\n  if (isCryptoKey(key.material)) {\n    return Promise.resolve(key.material);\n  }\n\n  key.keyPromise ??= globalThis.crypto.subtle\n    .importKey('raw', key.material, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt'])\n    .catch((error: unknown) => {\n      key.keyPromise = null;\n      throw error;\n    });\n  return key.keyPromise;\n}\n\nexport function createKeyring(config: EncryptionConfig) {\n  const { current, keys } = normalizeConfig(config);\n\n  return {\n    async encrypt(plaintext: string, aad: string): Promise<EncryptedPayload> {\n      try {\n        const key = await importKey(current);\n        const nonce = globalThis.crypto.getRandomValues(new Uint8Array(NONCE_LENGTH_BYTES));\n        const ciphertext = await globalThis.crypto.subtle.encrypt(\n          { name: 'AES-GCM', iv: nonce, additionalData: encoder.encode(aad) },\n          key,\n          encoder.encode(plaintext),\n        );\n\n        return {\n          ciphertext: toBase64Url(new Uint8Array(ciphertext)),\n          nonce: toBase64Url(nonce),\n          keyVersion: current.version,\n        };\n      } catch {\n        throw new AiSdkByokAdapterError('Drizzle encryption failed');\n      }\n    },\n\n    async decrypt(payload: EncryptedPayload, aad: string): Promise<string> {\n      const key = keys.get(payload.keyVersion);\n      if (key === undefined) {\n        throw new AiSdkByokAdapterError('Drizzle credential payload uses an unconfigured encryption key');\n      }\n\n      try {\n        const plaintext = await globalThis.crypto.subtle.decrypt(\n          { name: 'AES-GCM', iv: fromBase64Url(payload.nonce), additionalData: encoder.encode(aad) },\n          await importKey(key),\n          fromBase64Url(payload.ciphertext),\n        );\n        return decoder.decode(plaintext);\n      } catch {\n        throw new AiSdkByokAdapterError('Drizzle credential payload failed to decrypt');\n      }\n    },\n  };\n}\n","import {\n  AiSdkByokAdapterError,\n  AiSdkByokValidationError,\n  type ApiKeyCredentials,\n  type ByokManagerOptions,\n  type KeyMetadata,\n  type StoredKeyCredentialRecord,\n} from 'ai-sdk-byok';\nimport { and, desc, eq } from 'drizzle-orm';\nimport type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';\nimport { createKeyring, credentialAad, type EncryptionConfig } from './crypto.js';\nimport { aiSdkByokKeys } from './schema.js';\n\ntype DrizzlePostgresDatabase = PgDatabase<PgQueryResultHKT, Record<string, unknown>>;\n\ninterface KeyMetadataRow {\n  id: string;\n  userId: string;\n  provider: string;\n  label: string;\n  keyHint: string;\n  createdAt: string;\n  updatedAt: string;\n}\n\ninterface CredentialRow extends KeyMetadataRow {\n  credentialsCiphertext: string;\n  credentialsNonce: string;\n  encryptionKeyVersion: string;\n}\n\nexport interface DrizzleAdapterOptions {\n  db: DrizzlePostgresDatabase;\n  dialect: 'postgres';\n  encryption: EncryptionConfig;\n}\n\nfunction adapterError(operation: string): AiSdkByokAdapterError {\n  return new AiSdkByokAdapterError(`Drizzle BYOK adapter failed during ${operation}`);\n}\n\nfunction toMetadata(row: KeyMetadataRow): KeyMetadata {\n  return {\n    id: row.id,\n    userId: row.userId,\n    provider: row.provider,\n    label: row.label,\n    keyHint: row.keyHint,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\nfunction parseCredentials(plaintext: string): ApiKeyCredentials {\n  try {\n    const parsed: unknown = JSON.parse(plaintext);\n\n    if (\n      typeof parsed !== 'object' ||\n      parsed === null ||\n      Array.isArray(parsed) ||\n      Object.keys(parsed).length !== 1 ||\n      typeof (parsed as { apiKey?: unknown }).apiKey !== 'string'\n    ) {\n      throw new Error('invalid credential payload shape');\n    }\n\n    return { apiKey: (parsed as { apiKey: string }).apiKey };\n  } catch {\n    throw new AiSdkByokAdapterError('Drizzle credential payload has an invalid shape');\n  }\n}\n\nexport function drizzleAdapter(options: DrizzleAdapterOptions): ByokManagerOptions['storage'] {\n  if (options?.dialect !== 'postgres') {\n    throw new AiSdkByokValidationError('Drizzle dialect must be postgres');\n  }\n\n  const db = options.db;\n  const keyring = createKeyring(options.encryption);\n\n  return {\n    async save(input) {\n      const encrypted = await keyring.encrypt(\n        JSON.stringify({ apiKey: input.credentials.apiKey }),\n        credentialAad(input.userId, input.provider),\n      );\n      const now = new Date().toISOString();\n      let row: KeyMetadataRow | undefined;\n\n      try {\n        [row] = await db\n          .insert(aiSdkByokKeys)\n          .values({\n            id: crypto.randomUUID(),\n            userId: input.userId,\n            provider: input.provider,\n            label: input.label,\n            keyHint: input.keyHint,\n            credentialsCiphertext: encrypted.ciphertext,\n            credentialsNonce: encrypted.nonce,\n            encryptionKeyVersion: encrypted.keyVersion,\n            createdAt: now,\n            updatedAt: now,\n          })\n          .onConflictDoUpdate({\n            target: [aiSdkByokKeys.userId, aiSdkByokKeys.provider, aiSdkByokKeys.label],\n            set: {\n              keyHint: input.keyHint,\n              credentialsCiphertext: encrypted.ciphertext,\n              credentialsNonce: encrypted.nonce,\n              encryptionKeyVersion: encrypted.keyVersion,\n              updatedAt: now,\n            },\n          })\n          .returning({\n            id: aiSdkByokKeys.id,\n            userId: aiSdkByokKeys.userId,\n            provider: aiSdkByokKeys.provider,\n            label: aiSdkByokKeys.label,\n            keyHint: aiSdkByokKeys.keyHint,\n            createdAt: aiSdkByokKeys.createdAt,\n            updatedAt: aiSdkByokKeys.updatedAt,\n          });\n      } catch {\n        throw adapterError('save');\n      }\n\n      if (row === undefined) {\n        throw adapterError('save');\n      }\n\n      return toMetadata(row);\n    },\n\n    async list(input) {\n      try {\n        const rows = await db\n          .select({\n            id: aiSdkByokKeys.id,\n            userId: aiSdkByokKeys.userId,\n            provider: aiSdkByokKeys.provider,\n            label: aiSdkByokKeys.label,\n            keyHint: aiSdkByokKeys.keyHint,\n            createdAt: aiSdkByokKeys.createdAt,\n            updatedAt: aiSdkByokKeys.updatedAt,\n          })\n          .from(aiSdkByokKeys)\n          .where(eq(aiSdkByokKeys.userId, input.userId))\n          .orderBy(desc(aiSdkByokKeys.updatedAt), desc(aiSdkByokKeys.createdAt));\n\n        return rows.map(toMetadata);\n      } catch {\n        throw adapterError('list');\n      }\n    },\n\n    async get(input) {\n      let row: Pick<CredentialRow, 'userId' | 'provider' | 'credentialsCiphertext' | 'credentialsNonce' | 'encryptionKeyVersion'> | undefined;\n\n      try {\n        [row] = await db\n          .select({\n            userId: aiSdkByokKeys.userId,\n            provider: aiSdkByokKeys.provider,\n            credentialsCiphertext: aiSdkByokKeys.credentialsCiphertext,\n            credentialsNonce: aiSdkByokKeys.credentialsNonce,\n            encryptionKeyVersion: aiSdkByokKeys.encryptionKeyVersion,\n          })\n          .from(aiSdkByokKeys)\n          .where(\n            and(\n              eq(aiSdkByokKeys.userId, input.userId),\n              eq(aiSdkByokKeys.provider, input.provider),\n              eq(aiSdkByokKeys.label, input.label),\n            ),\n          );\n      } catch {\n        throw adapterError('get');\n      }\n\n      if (row === undefined) {\n        return null;\n      }\n\n      const plaintext = await keyring.decrypt(\n        {\n          ciphertext: row.credentialsCiphertext,\n          nonce: row.credentialsNonce,\n          keyVersion: row.encryptionKeyVersion,\n        },\n        credentialAad(row.userId, row.provider),\n      );\n      return parseCredentials(plaintext);\n    },\n\n    async getById(input) {\n      let row: CredentialRow | undefined;\n\n      try {\n        [row] = await db\n          .select({\n            id: aiSdkByokKeys.id,\n            userId: aiSdkByokKeys.userId,\n            provider: aiSdkByokKeys.provider,\n            label: aiSdkByokKeys.label,\n            keyHint: aiSdkByokKeys.keyHint,\n            createdAt: aiSdkByokKeys.createdAt,\n            updatedAt: aiSdkByokKeys.updatedAt,\n            credentialsCiphertext: aiSdkByokKeys.credentialsCiphertext,\n            credentialsNonce: aiSdkByokKeys.credentialsNonce,\n            encryptionKeyVersion: aiSdkByokKeys.encryptionKeyVersion,\n          })\n          .from(aiSdkByokKeys)\n          .where(and(eq(aiSdkByokKeys.userId, input.userId), eq(aiSdkByokKeys.id, input.keyId)));\n      } catch {\n        throw adapterError('getById');\n      }\n\n      if (row === undefined) {\n        return null;\n      }\n\n      const plaintext = await keyring.decrypt(\n        {\n          ciphertext: row.credentialsCiphertext,\n          nonce: row.credentialsNonce,\n          keyVersion: row.encryptionKeyVersion,\n        },\n        credentialAad(row.userId, row.provider),\n      );\n      return { ...toMetadata(row), credentials: parseCredentials(plaintext) } satisfies StoredKeyCredentialRecord;\n    },\n\n    async delete(input) {\n      try {\n        await db\n          .delete(aiSdkByokKeys)\n          .where(and(eq(aiSdkByokKeys.userId, input.userId), eq(aiSdkByokKeys.id, input.keyId)));\n      } catch {\n        throw adapterError('delete');\n      }\n    },\n  };\n}\n"]}

package/migrations/0001_ai_sdk_byok_init.sql

@@ -0,0 +1,16 @@
+CREATE TABLE ai_sdk_byok_keys (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  label TEXT NOT NULL,
+  key_hint TEXT NOT NULL,
+  credentials_ciphertext TEXT NOT NULL,
+  credentials_nonce TEXT NOT NULL,
+  encryption_key_version TEXT NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL,
+  CONSTRAINT ai_sdk_byok_keys_user_provider_label_unique UNIQUE (user_id, provider, label)
+);
+
+CREATE INDEX ai_sdk_byok_keys_user_updated_created_idx
+  ON ai_sdk_byok_keys (user_id, updated_at DESC, created_at DESC);

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@ai-sdk-byok/drizzle",
+  "version": "0.2.0",
+  "description": "Drizzle SQL storage adapter for ai-sdk-byok.",
+  "license": "MIT",
+  "homepage": "https://github.com/Xyri1/ai-sdk-byok#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Xyri1/ai-sdk-byok.git",
+    "directory": "packages/drizzle"
+  },
+  "bugs": {
+    "url": "https://github.com/Xyri1/ai-sdk-byok/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./migrations/*.sql": "./migrations/*.sql"
+  },
+  "files": [
+    "dist",
+    "migrations"
+  ],
+  "dependencies": {
+    "ai-sdk-byok": "0.2.0"
+  },
+  "peerDependencies": {
+    "drizzle-orm": ">=0.41.0"
+  },
+  "devDependencies": {
+    "drizzle-orm": "^0.41.0"
+  }
+}