@byok-sdk/keys 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ancienttwo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,150 @@
+# @byok-sdk/keys
+
+Key-based BYOK: a validated provider profile, credential-backed auth headers, and
+direct transports to OpenAI-compatible and Anthropic providers.
+
+Status: **K3 done** — the pure-function layer (K0), the `SecretStore` layer
+backed by the macOS Keychain and the Windows Credential Manager (K1), and the
+configure/resolve registry with pluggable profile persistence (K2) have all
+landed. K3 settled the settings-page question, recorded under
+[Not in this package](#not-in-this-package). Next is K4, the aip-main-open swap.
+
+## Security boundary
+
+`@byok-sdk/keys` is a separate package with a separate security model from
+`@byok/client` / `@byok/server` / `@byok/protocol`. Those three dispatch tasks to
+agent runtimes the user already authenticated, and their credential-isolation
+rule (`packages/client/src/types.ts:120-124`, audited in
+`docs/security-review-m5-pilot-entry.md`) promises the dispatch path never
+touches credentials. This package's job *is* to hold a provider API key, so it
+lives on the other side of that line: `client`, `server`, and `protocol` must not
+depend on `keys`.
+
+Two consequences hold today and are the package's standing constraints:
+
+1. `client`, `server`, and `protocol` must not gain a dependency on `keys`.
+2. `@byok-sdk/keys` is outside the scope of the M5 credential-isolation claim.
+   Installing it is opting into a package that holds a provider API key, and
+   that choice is yours, not something the dispatch SDK does on your behalf.
+
+The full declaration of the boundary between the two security models is
+[`docs/security.md`](../../docs/security.md), section *Key management
+(`@byok-sdk/keys`) is a separate package with a separate security model*.
+
+## Not in this package
+
+**There is no settings-page HTTP server here, and there will not be one.** The
+source this package was ported from ships one — a localhost listener on a random
+port, guarded by a token plus `Host`/`Origin`/CSP checks, serving
+`/api/model/configure` and `/api/model/test`. It was evaluated for this package
+at milestone K3 and deliberately excluded. Three reasons:
+
+- **The host owns its own UI.** A settings page is product surface: its
+  branding, its routing, its invoke protocol, and its idea of what "configured"
+  should look like to a user. Shipping one from a library means every consumer
+  either accepts our product decisions or works around them.
+- **This is a library, not a local web server.** A package you `npm install` to
+  hold a key should not decide to bind a socket. Anything that listens has a
+  lifecycle, a port, and an availability story that belongs to the application,
+  not to a dependency of it.
+- **A key custodian does not open a listening port.** Every listener is an
+  entry point into the process that holds the API key. The narrowest defensible
+  posture for a component whose whole job is key custody is to expose no
+  network surface at all, so there is nothing to authenticate, rate-limit, or
+  CSRF-guard in the first place.
+
+**The alternative: call `ProviderRegistry` directly.** Everything the settings
+page did is available as a normal API. A host renders its own page and, in its
+own request handler, calls `configure()`, `list()`, `get()`,
+`setDefaultModelProvider()`, or `delete()`; to verify a key before committing to
+it, resolve a client and call `testConnection()` on it. The registry never
+returns the secret — `ProviderStatus` reports `secret_configured: boolean` and
+nothing more — so a host can serve that object to its own UI without a
+redaction step.
+
+### What this transfers to you
+
+This exclusion moves a security property, and the move is the point of this
+section. In the source, the settings page was part of the same local process
+and never sent the API key anywhere; **the package itself underwrote the
+guarantee that the key does not leave the machine.**
+
+With the page gone, `@byok-sdk/keys` guarantees only its own half: the key goes
+into the OS credential store, it is never written to the profile store, it is
+never present in any `ProviderStatus`, and it leaves the process only in the
+`authorization` / `x-api-key` header of a request to the provider base URL the
+profile declares. **Everything between the user's keystroke and
+`configure(configuration, secret)` is now yours.** If your settings page posts
+the key to your own backend before handing it to this package, or renders it
+back into a response, or logs the request body, the key has left the machine —
+and no property of this package prevents that. You are the custodian of that
+path now.
+
+## Node version and storage backends
+
+`engines.node` is `>=20`, and that floor is deliberate: the package is fully
+usable on Node 20.
+
+| Backend | Requirement | Behaviour below it |
+| --- | --- | --- |
+| `InMemoryProviderProfileStore` | Node 20+ | — the whole configure/resolve lifecycle works |
+| `SqliteProviderProfileStore` | Node 22.5+ (`node:sqlite`) | fails closed with `PROVIDER_STORE_UNAVAILABLE` |
+
+Only on-disk profile persistence needs the newer runtime. `node:sqlite` shipped
+in Node 22.5 and spent part of the 22.x line behind `--experimental-sqlite`, so
+a version-number comparison would be wrong in both directions; call
+`isSqliteAvailable()` to branch, and constructing a `SqliteProviderProfileStore`
+without it throws `ByokKeysError` with code `PROVIDER_STORE_UNAVAILABLE` rather
+than degrading to a plaintext file.
+
+The floor rises only when a consumer needs on-disk persistence as an
+install-time guarantee rather than a runtime capability — that is, when
+"`@byok-sdk/keys` installed successfully" must by itself imply
+`SqliteProviderProfileStore` will construct. Until then, raising it would drop
+Node 20 hosts that are served perfectly well by the in-memory store.
+
+## Module inventory
+
+Every module under `src/`, one line of responsibility each. The public surface is
+whatever `index.ts` re-exports; nothing here is reachable by deep import.
+
+| Module | Contents |
+| --- | --- |
+| `index.ts` | The package barrel — the single public entry point, and the only supported import path |
+| `errors.ts` | `ByokKeysError` (`code` + message) and `BYOK_KEYS_ERROR_CODES`, the code strings consumers branch on |
+| `provider-profile.ts` | zod schema for the model provider profile, including the adapter/auth-mode legality rules |
+| `headers.ts` | `providerHeaders()` and fail-closed `requiredProviderSecret()` |
+| `url.ts` | `normalizeProviderUrl()` with the HTTPS / loopback / private-network guard |
+| `http.ts` | Shared transport guards: injectable `fetch`, timeout, bounded JSON, HTTP error classification |
+| `openai-client.ts` | `OpenAiCompatibleChatClient` — chat/completions, injected `fetchImpl` |
+| `anthropic-client.ts` | `AnthropicMessagesClient` — Messages API, injected `fetchImpl` |
+| `secret-store.ts` | The `SecretStore` contract one credential entry is read and written through, plus the shared value/encoding guards |
+| `secret-name.ts` | Runtime validation of secret entry names and namespaces, including the dot exclusion that stops one scope from spelling out another's storage key |
+| `secret-scope.ts` | `SecretScope` and the envelope-scoped store that partitions a credential store by account and workspace |
+| `macos-keychain.ts` | `SecretStore` backed by the macOS Keychain via the `security` CLI |
+| `windows-credential-manager.ts` | `SecretStore` backed by the Win32 credential API via a PowerShell bridge |
+| `command-runner.ts` | The `CommandRunner` injection seam both OS backends are written against, so no unit test touches a real credential store |
+| `profile-store.ts` | The `ProviderProfileStore` persistence contract, plus the in-memory implementation |
+| `sqlite-profile-store.ts` | `SqliteProviderProfileStore` — on-disk profile persistence on `node:sqlite` |
+| `sqlite-support.ts` | Runtime `node:sqlite` capability detection and owner-only database file/directory creation |
+| `registry.ts` | `ProviderRegistry` — the configure / list / resolve / delete lifecycle that binds a profile store to a secret store and hands back a ready client |
+
+Auth modes map to headers as follows, and this mapping is the package's wire
+contract:
+
+| `auth_mode` | Headers added on top of `accept` / `content-type` |
+| --- | --- |
+| `bearer` | `authorization: Bearer <secret>` |
+| `x_api_key` | `x-api-key: <secret>`, `anthropic-version: 2023-06-01` |
+| `none` | none |
+
+A profile declaring `bearer` or `x_api_key` without a secret fails closed with
+`PROVIDER_SECRET_MISSING` instead of sending an unauthenticated request.
+
+## Provenance
+
+Ported symbol by symbol from `aip-main-open@c6a5385`
+`apps/local-agent/src/providers.ts`. The AiphaBee narrative and finance domain
+symbols listed in `docs/researches/HANDOFF-byok-keys.md` §4.5 deliberately stayed
+behind; the clients here take generic `messages` / `max_tokens` / `system`
+parameters instead of building domain prompts.

package/dist/anthropic-client.d.ts

@@ -0,0 +1,37 @@
+import type { ModelProviderClientOptions } from './openai-client';
+/** One Anthropic message. `content` is `unknown` so block arrays pass through. */
+export interface AnthropicMessage {
+    role: 'user' | 'assistant';
+    content: unknown;
+}
+/**
+ * A Messages API request minus `model`, which the client fills from the
+ * profile. `max_tokens` is required because the API requires it.
+ */
+export interface AnthropicMessageRequest {
+    messages: readonly AnthropicMessage[];
+    max_tokens: number;
+    system?: string;
+    temperature?: number;
+}
+/**
+ * Transport for the Anthropic Messages API, ported from
+ * `aip-main-open@c6a5385` `providers.ts:831-1067`.
+ *
+ * As with the OpenAI-compatible client, only `#createMessage`'s generic
+ * request/parse/error path travels; the narrative methods that wrapped it stay
+ * in aip-main-open per `docs/researches/HANDOFF-byok-keys.md` §4.5.
+ */
+export declare class AnthropicMessagesClient {
+    #private;
+    readonly model: string;
+    /** False only when the provider is loopback, i.e. no data leaves the machine. */
+    readonly remoteDataTransfer: boolean;
+    constructor(options: ModelProviderClientOptions);
+    /** POST `<base_url>/messages`; returns the parsed response object. */
+    createMessage(request: AnthropicMessageRequest, signal?: AbortSignal): Promise<Record<string, unknown>>;
+    /** Round-trip the configured key against the provider (`providers.ts:1037-1054`). */
+    testConnection(signal?: AbortSignal): Promise<void>;
+}
+/** Pull the assistant text out of a Messages API payload (`providers.ts:1084`). */
+export declare function anthropicMessageText(payload: Record<string, unknown>): string;

package/dist/command-runner.d.ts

@@ -0,0 +1,22 @@
+/** A finished child process, ported from `aip-main-open@c6a5385` `index.ts:284-288`. */
+export interface CommandResult {
+    exitCode: number;
+    stderr: string;
+    stdout: string;
+}
+/**
+ * The injection seam both OS backends are written against. Unit tests supply a
+ * fake so no test ever reads or writes a real credential store; production code
+ * gets {@link runCommand}.
+ */
+export type CommandRunner = (executable: string, args: string[], stdin?: string) => Promise<CommandResult>;
+/**
+ * Spawn `executable`, feed it `stdin`, and collect its output
+ * (`index.ts:2498-2527`).
+ *
+ * It never rejects: a missing executable resolves as exit code 127 so the
+ * backends' `available()` probes can treat "no such binary" the same way they
+ * treat "binary said no". Stdin is always closed, otherwise a child that reads
+ * to EOF would hang forever.
+ */
+export declare function runCommand(executable: string, args: string[], stdin?: string): Promise<CommandResult>;

package/dist/errors.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Single error class for `@byok/keys`.
+ *
+ * The ported source (`aip-main-open@c6a5385`, `apps/local-agent/src/providers.ts`)
+ * raised two different classes — `LocalExecutionError` and
+ * `ResearchExecutionError` — that differed only in which subsystem owned the
+ * throw site; both carried a `code` string and consumers branched on that code.
+ * The narrative/research subsystem stays behind in aip-main-open, so this
+ * package keeps one class and preserves the `code` strings verbatim. K4's swap
+ * converts aip's two `instanceof` sites to structured code detection, so the
+ * strings — not the class identity — are the compatibility surface.
+ */
+export declare class ByokKeysError extends Error {
+    readonly code: string;
+    readonly httpStatus?: number;
+    constructor(code: string, message: string, options?: ErrorOptions & {
+        httpStatus?: number;
+    });
+}
+/**
+ * Error codes this package can throw, ported verbatim from the source. Kept as
+ * a named record so consumers (and K4's aip-main-open swap) can branch on
+ * `error.code` without retyping string literals.
+ *
+ * Four codes have no source counterpart, and each guards a check the source did
+ * not make: `KEYCHAIN_SECRET_DECODE_FAILED` (the source returned an undecodable
+ * stored value as-is), `SECRET_ENVELOPE_INVALID` (it reported a malformed
+ * envelope as an absent secret), and `SECRET_NAME_INVALID` /
+ * `SECRET_VALUE_INVALID` (the runtime replacements for the closed
+ * `KeychainSecretName` union). Everything else matches the source string for
+ * string.
+ *
+ * `SECRET_NAMESPACE_INVALID` is a separate case. The source does record it:
+ * `normalizeSecretNamespace` (`index.ts:748-757`) throws the verbatim string
+ * `'SECRET_NAMESPACE_INVALID'` at `index.ts:752`, and this package ports both
+ * that string and its pattern unchanged. It is still not a compatibility
+ * surface K4 must match, but for a different reason than the string: neither
+ * side has a branch consumer. In the source the only callers are the two OS
+ * stores' `scope()` methods, which just compose a service prefix; here the code
+ * is only ever asserted in tests. Matching it costs nothing and constrains
+ * nothing.
+ */
+export declare const BYOK_KEYS_ERROR_CODES: {
+    readonly CREDENTIAL_MANAGER_DELETE_FAILED: 'CREDENTIAL_MANAGER_DELETE_FAILED';
+    readonly CREDENTIAL_MANAGER_READ_FAILED: 'CREDENTIAL_MANAGER_READ_FAILED';
+    readonly CREDENTIAL_MANAGER_SECRET_INVALID: 'CREDENTIAL_MANAGER_SECRET_INVALID';
+    readonly CREDENTIAL_MANAGER_UNAVAILABLE: 'CREDENTIAL_MANAGER_UNAVAILABLE';
+    readonly CREDENTIAL_MANAGER_WRITE_FAILED: 'CREDENTIAL_MANAGER_WRITE_FAILED';
+    readonly KEYCHAIN_ARGUMENT_INVALID: 'KEYCHAIN_ARGUMENT_INVALID';
+    readonly KEYCHAIN_DELETE_FAILED: 'KEYCHAIN_DELETE_FAILED';
+    readonly KEYCHAIN_READ_FAILED: 'KEYCHAIN_READ_FAILED';
+    readonly KEYCHAIN_SECRET_DECODE_FAILED: 'KEYCHAIN_SECRET_DECODE_FAILED';
+    readonly KEYCHAIN_SECRET_INVALID: 'KEYCHAIN_SECRET_INVALID';
+    readonly KEYCHAIN_UNAVAILABLE: 'KEYCHAIN_UNAVAILABLE';
+    readonly KEYCHAIN_WRITE_FAILED: 'KEYCHAIN_WRITE_FAILED';
+    readonly LOCAL_ACCOUNT_SCOPE_INVALID: 'LOCAL_ACCOUNT_SCOPE_INVALID';
+    readonly MODEL_PROVIDER_AUTH_FAILED: 'MODEL_PROVIDER_AUTH_FAILED';
+    readonly MODEL_PROVIDER_BALANCE_INSUFFICIENT: 'MODEL_PROVIDER_BALANCE_INSUFFICIENT';
+    readonly MODEL_PROVIDER_HTTP_ERROR: 'MODEL_PROVIDER_HTTP_ERROR';
+    readonly MODEL_PROVIDER_MODEL_NOT_FOUND: 'MODEL_PROVIDER_MODEL_NOT_FOUND';
+    readonly MODEL_PROVIDER_RATE_LIMITED: 'MODEL_PROVIDER_RATE_LIMITED';
+    readonly MODEL_RESPONSE_INVALID: 'MODEL_RESPONSE_INVALID';
+    readonly PROVIDER_NOT_CONFIGURED: 'PROVIDER_NOT_CONFIGURED';
+    readonly PROVIDER_PROFILE_INVALID: 'PROVIDER_PROFILE_INVALID';
+    readonly PROVIDER_REQUEST_TIMEOUT: 'PROVIDER_REQUEST_TIMEOUT';
+    readonly PROVIDER_RESPONSE_INVALID: 'PROVIDER_RESPONSE_INVALID';
+    readonly PROVIDER_RESPONSE_TOO_LARGE: 'PROVIDER_RESPONSE_TOO_LARGE';
+    readonly PROVIDER_SECRET_EMPTY: 'PROVIDER_SECRET_EMPTY';
+    readonly PROVIDER_SECRET_MISSING: 'PROVIDER_SECRET_MISSING';
+    readonly PROVIDER_SECRET_NOT_ALLOWED: 'PROVIDER_SECRET_NOT_ALLOWED';
+    readonly PROVIDER_STORE_UNAVAILABLE: 'PROVIDER_STORE_UNAVAILABLE';
+    readonly PROVIDER_URL_INVALID: 'PROVIDER_URL_INVALID';
+    readonly SECRET_ENVELOPE_INVALID: 'SECRET_ENVELOPE_INVALID';
+    readonly SECRET_NAME_INVALID: 'SECRET_NAME_INVALID';
+    readonly SECRET_NAMESPACE_INVALID: 'SECRET_NAMESPACE_INVALID';
+    readonly SECRET_VALUE_INVALID: 'SECRET_VALUE_INVALID';
+};
+export type ByokKeysErrorCode = (typeof BYOK_KEYS_ERROR_CODES)[keyof typeof BYOK_KEYS_ERROR_CODES];

package/dist/headers.d.ts

@@ -0,0 +1,21 @@
+import type { ProviderAuthMode } from './provider-profile';
+/** The subset of a profile the header builder reads. */
+export interface ProviderAuthProfile {
+    auth_mode: ProviderAuthMode;
+    kind: string;
+}
+/**
+ * Fail-closed secret check. Ported from `aip-main-open@c6a5385`
+ * `providers.ts:1657-1671`: a profile that declares `bearer` or `x_api_key`
+ * must have a secret, or the request is refused rather than sent unauthenticated.
+ */
+export declare function requiredProviderSecret(profile: ProviderAuthProfile, secret: string | undefined): string | undefined;
+/**
+ * Build the outbound request headers for a provider call. Key-for-key
+ * equivalent to `providers.ts:1680-1697`:
+ * - always `accept` and `content-type`;
+ * - `bearer` adds `authorization: Bearer <secret>`;
+ * - `x_api_key` adds `x-api-key: <secret>` and `anthropic-version: 2023-06-01`;
+ * - `none` adds nothing.
+ */
+export declare function providerHeaders(profile: ProviderAuthProfile, secret: string | undefined): Record<string, string>;

package/dist/http.d.ts

@@ -0,0 +1,44 @@
+/** Injectable `fetch`. Defaults to `globalThis.fetch` at every call site. */
+export type ProviderFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+/** Response body ceiling, ported from `providers.ts:106`. */
+export declare const PROVIDER_RESPONSE_MAX_BYTES: number;
+/** Per-request timeout, ported from `providers.ts:107`. */
+export declare const PROVIDER_TIMEOUT_MS = 15000;
+/**
+ * Issue a provider request under the source's guards
+ * (`providers.ts:1711-1743`): the URL is re-validated immediately before the
+ * call, the caller's abort signal is chained, and an internal timeout aborts
+ * with a distinguishable reason so a timeout maps to
+ * `PROVIDER_REQUEST_TIMEOUT` rather than a bare `AbortError`.
+ */
+export declare function fetchWithProviderGuards(fetchImpl: ProviderFetch, url: string, init: RequestInit, signal: AbortSignal): Promise<Response>;
+/**
+ * Read a JSON body with a size ceiling (`providers.ts:1825-1851`). The
+ * `content-length` check is an early exit; the decoded-byte check is the one
+ * that actually holds, since `content-length` is attacker-controlled.
+ */
+export declare function parseBoundedJsonResponse(response: Response): Promise<unknown>;
+/**
+ * Parse a model-provider response, mapping non-2xx to a classified error
+ * (`providers.ts:1748-1769`). The source's `context` parameter only chose
+ * between two error classes; this package has one, so the parameter is gone.
+ */
+export declare function readModelProviderResponse(response: Response): Promise<unknown>;
+/**
+ * Map an HTTP status plus error body onto a stable code
+ * (`providers.ts:1783-1815`). Providers disagree on status codes for billing
+ * and key problems, so the body text is inspected as well — the pattern lists
+ * are verbatim from the source, including the Chinese-language variants the
+ * source's providers actually return.
+ */
+export declare function classifyModelProviderHttpError(status: number, payload: unknown): string;
+/** Join a normalized base URL with an API path, idempotently (`providers.ts:1949-1953`). */
+export declare function modelApiUrl(baseUrl: string, suffix: string): string;
+/**
+ * Flatten a message content field to text (`providers.ts:1955-1971`). Both
+ * dialects return either a string or an array of typed blocks.
+ */
+export declare function modelMessageText(value: unknown): string;
+export declare function objectValue(value: unknown): Record<string, unknown> | undefined;
+/** `providers.ts:2301-2308` — an empty completion does not prove a live key. */
+export declare function assertLiveModelResponse(value: string): void;

package/dist/index.d.ts

@@ -0,0 +1,31 @@
+export { ByokKeysError, BYOK_KEYS_ERROR_CODES } from './errors';
+export type { ByokKeysErrorCode } from './errors';
+export { MODEL_PROVIDER_IDS, MODEL_PROVIDER_ADAPTERS, PROVIDER_AUTH_MODES, ModelProviderProfileSchema, parseModelProviderProfile, } from './provider-profile';
+export type { ModelProviderAdapter, ModelProviderId, ModelProviderProfile, ModelProviderProfileInput, ProviderAuthMode, } from './provider-profile';
+export { providerHeaders, requiredProviderSecret } from './headers';
+export type { ProviderAuthProfile } from './headers';
+export { normalizeProviderUrl, isLoopbackHost, isLoopbackProviderUrl, isPrivateNetworkLiteral, } from './url';
+export { assertLiveModelResponse, classifyModelProviderHttpError, fetchWithProviderGuards, modelApiUrl, modelMessageText, objectValue, parseBoundedJsonResponse, PROVIDER_RESPONSE_MAX_BYTES, PROVIDER_TIMEOUT_MS, readModelProviderResponse, } from './http';
+export type { ProviderFetch } from './http';
+export { OpenAiCompatibleChatClient, chatCompletionText } from './openai-client';
+export type { ChatCompletionRequest, ChatMessage, ModelProviderClientOptions, } from './openai-client';
+export { AnthropicMessagesClient, anthropicMessageText } from './anthropic-client';
+export type { AnthropicMessage, AnthropicMessageRequest, } from './anthropic-client';
+export { runCommand } from './command-runner';
+export type { CommandResult, CommandRunner } from './command-runner';
+export { SECRET_NAME_PATTERN, SECRET_NAMESPACE_PATTERN, assertSecretName, assertSecretNamespace, } from './secret-name';
+export { DEFAULT_SECRET_SERVICE_PREFIX, InMemorySecretStore, MODEL_PROVIDER_SECRET_NAMES, assertSharedSecretValue, decodeStrictBase64Utf8, modelProviderSecretName, } from './secret-store';
+export type { ModelProviderSecretName, SecretStore } from './secret-store';
+export { DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX, MacOsKeychainSecretStore, } from './macos-keychain';
+export type { MacOsKeychainSecretStoreOptions } from './macos-keychain';
+export { WindowsCredentialManagerSecretStore } from './windows-credential-manager';
+export type { WindowsCredentialManagerSecretStoreOptions } from './windows-credential-manager';
+export { DEFAULT_SECRET_ENVELOPE_PREFIX, EnvelopeScopedSecretStore, scopeSecretStore, secretScopeId, } from './secret-scope';
+export type { SecretScope } from './secret-scope';
+export { InMemoryProviderProfileStore } from './profile-store';
+export type { ProviderProfileStore } from './profile-store';
+export { isSqliteAvailable, loadSqliteModule, openSqliteDatabase, secureSqliteFilePermissions, } from './sqlite-support';
+export { SqliteProviderProfileStore } from './sqlite-profile-store';
+export type { SqliteProviderProfileStoreOptions } from './sqlite-profile-store';
+export { ProviderRegistry } from './registry';
+export type { ModelProviderClient, ProviderConfiguration, ProviderRegistryOptions, ProviderStatus, } from './registry';