@byok-sdk/keys 0.1.0 → 0.2.0

package/dist/index.js

@@ -4,6 +4,7 @@ import { createHash } from 'crypto';
 import { mkdirSync, existsSync, chmodSync } from 'fs';
 import { createRequire } from 'module';
 import { dirname } from 'path';
+import { isCoreConflictError, contentHash } from '@byok-sdk/core';
 
 // src/errors.ts
 var ByokKeysError = class extends Error {
@@ -38,13 +39,16 @@ var BYOK_KEYS_ERROR_CODES = {
   MODEL_RESPONSE_INVALID: "MODEL_RESPONSE_INVALID",
   PROVIDER_NOT_CONFIGURED: "PROVIDER_NOT_CONFIGURED",
   PROVIDER_PROFILE_INVALID: "PROVIDER_PROFILE_INVALID",
+  PROVIDER_PROFILE_CONFLICT: "PROVIDER_PROFILE_CONFLICT",
   PROVIDER_REQUEST_TIMEOUT: "PROVIDER_REQUEST_TIMEOUT",
   PROVIDER_RESPONSE_INVALID: "PROVIDER_RESPONSE_INVALID",
   PROVIDER_RESPONSE_TOO_LARGE: "PROVIDER_RESPONSE_TOO_LARGE",
   PROVIDER_SECRET_EMPTY: "PROVIDER_SECRET_EMPTY",
   PROVIDER_SECRET_MISSING: "PROVIDER_SECRET_MISSING",
   PROVIDER_SECRET_NOT_ALLOWED: "PROVIDER_SECRET_NOT_ALLOWED",
+  PROVIDER_SECRET_ROLLBACK_FAILED: "PROVIDER_SECRET_ROLLBACK_FAILED",
   PROVIDER_STORE_UNAVAILABLE: "PROVIDER_STORE_UNAVAILABLE",
+  PROVIDER_TRUTH_INVALID: "PROVIDER_TRUTH_INVALID",
   PROVIDER_URL_INVALID: "PROVIDER_URL_INVALID",
   SECRET_ENVELOPE_INVALID: "SECRET_ENVELOPE_INVALID",
   SECRET_NAME_INVALID: "SECRET_NAME_INVALID",
@@ -1135,24 +1139,24 @@ function providerNotConfigured(providerId) {
 }
 var InMemoryProviderProfileStore = class {
   #profiles = /* @__PURE__ */ new Map();
-  close() {
+  async close() {
     this.#profiles.clear();
   }
-  delete(providerId) {
+  async delete(providerId) {
     return this.#profiles.delete(providerId);
   }
-  get(providerId) {
+  async get(providerId) {
     return this.#profiles.get(providerId);
   }
-  getEnabled() {
-    return this.list().find((profile) => profile.enabled);
+  async getEnabled() {
+    return [...this.#profiles.values()].find((profile) => profile.enabled);
   }
-  list() {
+  async list() {
     return [...this.#profiles.values()].sort(
       (left, right) => left.provider_id.localeCompare(right.provider_id)
     );
   }
-  save(profile) {
+  async save(profile) {
     const validated = parseModelProviderProfile({
       ...profile,
       created_at: this.#profiles.get(profile.provider_id)?.created_at ?? profile.created_at
@@ -1167,12 +1171,20 @@ var InMemoryProviderProfileStore = class {
     this.#profiles.set(validated.provider_id, validated);
     return validated;
   }
-  setEnabled(providerId) {
+  async setEnabled(providerId) {
     const existing = this.#profiles.get(providerId);
     if (existing === void 0) throw providerNotConfigured(providerId);
     return this.save({ ...existing, enabled: true });
   }
 };
+function closeSqliteDatabaseAfterInitializationFailure(database, initializationError, message, close = (handle) => handle.close()) {
+  try {
+    close(database);
+  } catch (closeError) {
+    throw new AggregateError([initializationError, closeError], message);
+  }
+  throw initializationError;
+}
 var SECURE_DIR_MODE = 448;
 var SECURE_FILE_MODE = 384;
 var DEFAULT_BUSY_TIMEOUT_MS = 5e3;
@@ -1195,20 +1207,33 @@ function isSqliteAvailable() {
     return false;
   }
 }
-function openSqliteDatabase(path, options) {
+function openSqliteDatabase(path, options, faults) {
   const { DatabaseSync } = loadSqliteModule();
-  if (path !== ":memory:") {
+  const readOnly = options?.readOnly === true;
+  if (path !== ":memory:" && !readOnly) {
     mkdirSync(dirname(path), { mode: SECURE_DIR_MODE, recursive: true });
   }
   const database = new DatabaseSync(path, {
     timeout: DEFAULT_BUSY_TIMEOUT_MS,
     ...options
   });
-  if (path !== ":memory:") {
-    database.exec("PRAGMA journal_mode = WAL");
-    database.exec("PRAGMA synchronous = FULL");
+  try {
+    faults?.onStep?.("after-open");
+    if (path !== ":memory:" && !readOnly) {
+      database.exec("PRAGMA journal_mode = WAL");
+      faults?.onStep?.("after-wal");
+      database.exec("PRAGMA synchronous = FULL");
+      faults?.onStep?.("after-synchronous");
+    }
+    return database;
+  } catch (error) {
+    closeSqliteDatabaseAfterInitializationFailure(
+      database,
+      error,
+      "provider profile SQLite open initialization failed and its native handle could not be closed",
+      faults?.close
+    );
   }
-  return database;
 }
 function secureSqliteFilePermissions(databasePath) {
   if (databasePath === ":memory:") return;
@@ -1247,10 +1272,22 @@ var SqliteProviderProfileStore = class {
   #database;
   #closed = false;
   constructor(options) {
-    this.#database = openSqliteDatabase(options.path);
-    this.#database.exec(SCHEMA);
-    this.#database.exec(ENABLED_INDEX);
-    secureSqliteFilePermissions(options.path);
+    this.#database = openSqliteDatabase(options.path, {
+      readOnly: options.readOnly ?? false
+    });
+    if (!options.readOnly) {
+      try {
+        this.#database.exec(SCHEMA);
+        this.#database.exec(ENABLED_INDEX);
+        secureSqliteFilePermissions(options.path);
+      } catch (error) {
+        closeSqliteDatabaseAfterInitializationFailure(
+          this.#database,
+          error,
+          "SqliteProviderProfileStore initialization failed and its native handle could not be closed"
+        );
+      }
+    }
   }
   /**
    * Idempotent, as {@link ProviderProfileStore.close} requires: `node:sqlite`
@@ -1258,31 +1295,32 @@ var SqliteProviderProfileStore = class {
    * routinely closed both by the code that finished with it and by a test's
    * teardown.
    */
-  close() {
+  async close() {
     if (this.#closed) return;
     this.#closed = true;
     this.#database.close();
   }
-  delete(providerId) {
+  async delete(providerId) {
     const result = this.#database.prepare("DELETE FROM provider_profile WHERE provider_id = ?").run(providerId);
     return Number(result.changes) === 1;
   }
-  get(providerId) {
+  async get(providerId) {
     const row = this.#database.prepare("SELECT * FROM provider_profile WHERE provider_id = ?").get(providerId);
     return row === void 0 ? void 0 : parseRow(row);
   }
-  getEnabled() {
+  async getEnabled() {
     const row = this.#database.prepare("SELECT * FROM provider_profile WHERE enabled = 1").get();
     return row === void 0 ? void 0 : parseRow(row);
   }
-  list() {
+  async list() {
     const rows = this.#database.prepare("SELECT * FROM provider_profile ORDER BY provider_id ASC").all();
     return rows.map(parseRow);
   }
-  save(profile) {
+  async save(profile) {
+    const existing = await this.get(profile.provider_id);
     const validated = parseModelProviderProfile({
       ...profile,
-      created_at: this.get(profile.provider_id)?.created_at ?? profile.created_at
+      created_at: existing?.created_at ?? profile.created_at
     });
     this.#transaction(() => {
       if (validated.enabled) {
@@ -1316,10 +1354,10 @@ var SqliteProviderProfileStore = class {
         validated.updated_at
       );
     });
-    return this.get(validated.provider_id);
+    return await this.get(validated.provider_id);
   }
-  setEnabled(providerId) {
-    const existing = this.get(providerId);
+  async setEnabled(providerId) {
+    const existing = await this.get(providerId);
     if (existing === void 0) throw providerNotConfigured(providerId);
     return this.save({ ...existing, enabled: true });
   }
@@ -1341,6 +1379,219 @@ function parseRow(row) {
     enabled: row.enabled === 1
   });
 }
+var PROVIDER_PROFILE_TRUTH_RECORD_KEY = "byok-sdk.keys/model-provider-registry-v1";
+var PROFILE_KEYS = [
+  "adapter",
+  "auth_mode",
+  "base_url",
+  "created_at",
+  "display_name",
+  "enabled",
+  "kind",
+  "model",
+  "provider_id",
+  "updated_at"
+];
+var TruthStoreProviderProfileStore = class {
+  #tenant;
+  #truth;
+  constructor(options) {
+    this.#tenant = options.tenant;
+    this.#truth = options.truthStore;
+  }
+  async close() {
+  }
+  async delete(providerId) {
+    const current = await this.#load();
+    if (!current.profiles.some((profile) => profile.provider_id === providerId)) {
+      return false;
+    }
+    await this.#write(
+      current.profiles.filter((profile) => profile.provider_id !== providerId),
+      current.rev
+    );
+    return true;
+  }
+  async get(providerId) {
+    return (await this.#load()).profiles.find(
+      (profile) => profile.provider_id === providerId
+    );
+  }
+  async getEnabled() {
+    return (await this.#load()).profiles.find((profile) => profile.enabled);
+  }
+  async list() {
+    return [...(await this.#load()).profiles];
+  }
+  async save(profile) {
+    const current = await this.#load();
+    const existing = current.profiles.find(
+      (candidate) => candidate.provider_id === profile.provider_id
+    );
+    const validated = parseModelProviderProfile({
+      ...profile,
+      created_at: existing?.created_at ?? profile.created_at
+    });
+    const next = current.profiles.filter((candidate) => candidate.provider_id !== validated.provider_id).map(
+      (candidate) => validated.enabled && candidate.enabled ? { ...candidate, enabled: false } : candidate
+    );
+    next.push(validated);
+    await this.#write(next, current.rev);
+    return validated;
+  }
+  async setEnabled(providerId) {
+    const current = await this.#load();
+    const selected = current.profiles.find(
+      (profile) => profile.provider_id === providerId
+    );
+    if (selected === void 0) throw providerNotConfigured(providerId);
+    const next = current.profiles.map((profile) => ({
+      ...profile,
+      enabled: profile.provider_id === providerId
+    }));
+    await this.#write(next, current.rev);
+    return { ...selected, enabled: true };
+  }
+  async #load() {
+    const record = await this.#truth.getRecord(this.#tenant, {
+      kind: "profile",
+      recordKey: PROVIDER_PROFILE_TRUTH_RECORD_KEY
+    });
+    if (record === void 0) return { profiles: [], rev: 0 };
+    return decodeRegistryRecord(record, this.#tenant);
+  }
+  async #write(profiles, expectedRev) {
+    const encoded = encodeRegistry(profiles);
+    let written;
+    try {
+      written = await this.#truth.writeSnapshot(this.#tenant, {
+        kind: "profile",
+        recordKey: PROVIDER_PROFILE_TRUTH_RECORD_KEY,
+        expectedRev,
+        contentHash: hashBody(encoded),
+        byteSize: BigInt(new TextEncoder().encode(encoded).byteLength),
+        body: { kind: "inline", body: encoded },
+        label: "BYOK model provider registry"
+      });
+    } catch (cause) {
+      if (isCoreConflictError(cause, "truth_revision_conflict")) {
+        throw new ByokKeysError(
+          "PROVIDER_PROFILE_CONFLICT",
+          "Provider profiles changed since this operation read them",
+          { cause }
+        );
+      }
+      throw cause;
+    }
+    if (written.body.kind !== "inline" || written.body.body !== encoded) {
+      throw invalidTruth("TruthStore did not confirm the requested provider profile snapshot");
+    }
+    const confirmed = decodeRegistryRecord(written, this.#tenant);
+    if (confirmed.rev !== expectedRev + 1) {
+      throw invalidTruth("TruthStore confirmed an unexpected provider profile revision");
+    }
+  }
+};
+function encodeRegistry(profiles) {
+  const normalized = profiles.map((profile) => parseModelProviderProfile(profile)).sort((left, right) => left.provider_id.localeCompare(right.provider_id));
+  assertRegistryInvariants(normalized);
+  const snapshot = {
+    schema_version: 1,
+    profiles: normalized.map((profile) => ({
+      adapter: profile.adapter,
+      auth_mode: profile.auth_mode,
+      base_url: profile.base_url,
+      created_at: profile.created_at,
+      display_name: profile.display_name,
+      enabled: profile.enabled,
+      kind: profile.kind,
+      model: profile.model,
+      provider_id: profile.provider_id,
+      updated_at: profile.updated_at
+    }))
+  };
+  return JSON.stringify(snapshot);
+}
+function decodeRegistryRecord(record, tenant) {
+  if (record.tenantId !== tenant || record.kind !== "profile" || record.recordKey !== PROVIDER_PROFILE_TRUTH_RECORD_KEY || !Number.isSafeInteger(record.rev) || record.rev < 1) {
+    throw invalidTruth("TruthStore returned mismatched provider profile authority");
+  }
+  if (record.body.kind !== "inline") {
+    throw invalidTruth("Provider profiles must use an inline TruthStore body");
+  }
+  const bytes = new TextEncoder().encode(record.body.body);
+  if (record.byteSize !== BigInt(bytes.byteLength)) {
+    throw invalidTruth("Provider profile TruthStore byte size does not match its body");
+  }
+  if (record.contentHash !== hashBody(record.body.body)) {
+    throw invalidTruth("Provider profile TruthStore hash does not match its body");
+  }
+  let raw;
+  try {
+    raw = JSON.parse(record.body.body);
+  } catch (cause) {
+    throw invalidTruth("Provider profile TruthStore body is not valid JSON", cause);
+  }
+  if (!isPlainRecord(raw) || !hasExactKeys(raw, ["profiles", "schema_version"])) {
+    throw invalidTruth("Provider profile TruthStore body has an unknown top-level field");
+  }
+  if (raw.schema_version !== 1 || !Array.isArray(raw.profiles)) {
+    throw invalidTruth("Provider profile TruthStore body has an unsupported schema");
+  }
+  if (raw.profiles.length > MODEL_PROVIDER_IDS.length) {
+    throw invalidTruth("Provider profile TruthStore body exceeds the provider registry bound");
+  }
+  let profiles;
+  try {
+    profiles = raw.profiles.map((candidate) => {
+      if (!isPlainRecord(candidate) || !hasExactKeys(candidate, PROFILE_KEYS)) {
+        throw invalidTruth("Provider profile TruthStore body contains an unknown profile field");
+      }
+      return parseModelProviderProfile(candidate);
+    });
+  } catch (cause) {
+    if (cause instanceof ByokKeysError && cause.code === "PROVIDER_TRUTH_INVALID") {
+      throw cause;
+    }
+    throw invalidTruth("Provider profile TruthStore body contains an invalid profile", cause);
+  }
+  assertRegistryInvariants(profiles);
+  if (record.body.body !== encodeRegistry(profiles)) {
+    throw invalidTruth("Provider profile TruthStore body is not in canonical form");
+  }
+  return { profiles, rev: record.rev };
+}
+function assertRegistryInvariants(profiles) {
+  const seen = /* @__PURE__ */ new Set();
+  let enabled = 0;
+  for (const profile of profiles) {
+    if (seen.has(profile.provider_id)) {
+      throw invalidTruth(`Provider profile ${profile.provider_id} appears more than once`);
+    }
+    seen.add(profile.provider_id);
+    if (profile.enabled) enabled += 1;
+  }
+  if (enabled > 1) {
+    throw invalidTruth("Provider profile TruthStore body enables more than one provider");
+  }
+}
+function hashBody(body) {
+  const digest = createHash("sha256").update(body, "utf8").digest("hex");
+  return contentHash(`sha256:${digest}`);
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, expected) {
+  const keys = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  return keys.length === wanted.length && keys.every((key, index) => key === wanted[index]);
+}
+function invalidTruth(message, cause) {
+  return new ByokKeysError("PROVIDER_TRUTH_INVALID", message, {
+    ...cause === void 0 ? {} : { cause }
+  });
+}
 
 // src/registry.ts
 var ProviderRegistry = class {
@@ -1354,8 +1605,8 @@ var ProviderRegistry = class {
     this.#profiles = options.profileStore;
     this.#secrets = options.secretStore;
   }
-  close() {
-    this.#profiles.close();
+  async close() {
+    await this.#profiles.close();
   }
   /**
    * Persist a provider's profile and, when supplied, its secret
@@ -1368,15 +1619,17 @@ var ProviderRegistry = class {
    */
   async configure(configuration, secret) {
     const timestamp = this.#now().toISOString();
-    const previous = this.#profiles.get(configuration.provider_id);
-    const profile = {
+    const previous = await this.#profiles.get(configuration.provider_id);
+    const profile = parseModelProviderProfile({
       ...configuration,
       created_at: previous?.created_at ?? timestamp,
       enabled: configuration.enabled ?? true,
       kind: "model",
       updated_at: timestamp
-    };
+    });
     const secretName = modelProviderSecretName(configuration.provider_id);
+    let previousSecret;
+    let secretWritten = false;
     if (configuration.auth_mode === "none" && secret !== void 0) {
       throw new ByokKeysError(
         "PROVIDER_SECRET_NOT_ALLOWED",
@@ -1390,7 +1643,9 @@ var ProviderRegistry = class {
           "Provider secret cannot be empty"
         );
       }
+      previousSecret = await this.#secrets.get(secretName);
       await this.#secrets.set(secretName, secret);
+      secretWritten = true;
     }
     if (configuration.auth_mode !== "none" && !await this.#secrets.has(secretName)) {
       throw new ByokKeysError(
@@ -1398,7 +1653,27 @@ var ProviderRegistry = class {
         "Provider authentication requires a secret in the operating-system credential store"
       );
     }
-    const saved = this.#profiles.save(profile);
+    let saved;
+    try {
+      saved = await this.#profiles.save(profile);
+    } catch (cause) {
+      if (secretWritten) {
+        try {
+          if (previousSecret === void 0) {
+            await this.#secrets.delete(secretName);
+          } else {
+            await this.#secrets.set(secretName, previousSecret);
+          }
+        } catch (rollbackCause) {
+          throw new ByokKeysError(
+            "PROVIDER_SECRET_ROLLBACK_FAILED",
+            "Provider profile write failed and the previous secret could not be restored",
+            { cause: new AggregateError([cause, rollbackCause]) }
+          );
+        }
+      }
+      throw cause;
+    }
     if (saved.auth_mode === "none") {
       await this.#secrets.delete(secretName);
     }
@@ -1406,17 +1681,17 @@ var ProviderRegistry = class {
   }
   /** Remove a provider's profile and its secret together. */
   async delete(providerId) {
-    const removed = this.#profiles.delete(providerId);
+    const removed = await this.#profiles.delete(providerId);
     await this.#secrets.delete(modelProviderSecretName(providerId));
     return removed;
   }
   async get(providerId) {
-    const profile = this.#profiles.get(providerId);
+    const profile = await this.#profiles.get(providerId);
     return profile === void 0 ? void 0 : this.#status(profile);
   }
   async list() {
     return Promise.all(
-      this.#profiles.list().map((profile) => this.#status(profile))
+      (await this.#profiles.list()).map((profile) => this.#status(profile))
     );
   }
   /**
@@ -1427,7 +1702,7 @@ var ProviderRegistry = class {
    * missing secret or an unusable profile is a fault, not an absence.
    */
   async resolveDefaultModelProvider() {
-    const profile = this.#profiles.getEnabled();
+    const profile = await this.#profiles.getEnabled();
     if (profile === void 0) return void 0;
     const secret = await this.#secrets.get(
       modelProviderSecretName(profile.provider_id)
@@ -1437,7 +1712,7 @@ var ProviderRegistry = class {
   }
   /** Switch which configured provider is the default. */
   async setDefaultModelProvider(providerId) {
-    return this.#status(this.#profiles.setEnabled(providerId));
+    return this.#status(await this.#profiles.setEnabled(providerId));
   }
   async #status(profile) {
     return {
@@ -1457,6 +1732,31 @@ var ProviderRegistry = class {
   }
 };
 
-export { AnthropicMessagesClient, BYOK_KEYS_ERROR_CODES, ByokKeysError, DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX, DEFAULT_SECRET_ENVELOPE_PREFIX, DEFAULT_SECRET_SERVICE_PREFIX, EnvelopeScopedSecretStore, InMemoryProviderProfileStore, InMemorySecretStore, MODEL_PROVIDER_ADAPTERS, MODEL_PROVIDER_IDS, MODEL_PROVIDER_SECRET_NAMES, MacOsKeychainSecretStore, ModelProviderProfileSchema, OpenAiCompatibleChatClient, PROVIDER_AUTH_MODES, PROVIDER_RESPONSE_MAX_BYTES, PROVIDER_TIMEOUT_MS, ProviderRegistry, SECRET_NAMESPACE_PATTERN, SECRET_NAME_PATTERN, SqliteProviderProfileStore, WindowsCredentialManagerSecretStore, anthropicMessageText, assertLiveModelResponse, assertSecretName, assertSecretNamespace, assertSharedSecretValue, chatCompletionText, classifyModelProviderHttpError, decodeStrictBase64Utf8, fetchWithProviderGuards, isLoopbackHost, isLoopbackProviderUrl, isPrivateNetworkLiteral, isSqliteAvailable, loadSqliteModule, modelApiUrl, modelMessageText, modelProviderSecretName, normalizeProviderUrl, objectValue, openSqliteDatabase, parseBoundedJsonResponse, parseModelProviderProfile, providerHeaders, readModelProviderResponse, requiredProviderSecret, runCommand, scopeSecretStore, secretScopeId, secureSqliteFilePermissions };
+// src/pi-provider-projection.ts
+var PI_PROJECTED_KEY_ENV = "PI_PROVIDER_API_KEY";
+function piProjectionProviderId(profileProviderId) {
+  return `byok-sdk-${profileProviderId}`;
+}
+function buildPiProviderProjection(profile) {
+  const projectedProviderId = piProjectionProviderId(profile.provider_id);
+  return {
+    providers: {
+      [projectedProviderId]: {
+        baseUrl: profile.base_url,
+        api: profile.adapter === "anthropic" ? "anthropic-messages" : "openai-completions",
+        ...profile.auth_mode === "none" ? {} : { apiKey: `$${PI_PROJECTED_KEY_ENV}` },
+        ...profile.auth_mode === "bearer" ? { authHeader: true } : {},
+        models: [
+          {
+            id: profile.model,
+            name: profile.display_name
+          }
+        ]
+      }
+    }
+  };
+}
+
+export { AnthropicMessagesClient, BYOK_KEYS_ERROR_CODES, ByokKeysError, DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX, DEFAULT_SECRET_ENVELOPE_PREFIX, DEFAULT_SECRET_SERVICE_PREFIX, EnvelopeScopedSecretStore, InMemoryProviderProfileStore, InMemorySecretStore, MODEL_PROVIDER_ADAPTERS, MODEL_PROVIDER_IDS, MODEL_PROVIDER_SECRET_NAMES, MacOsKeychainSecretStore, ModelProviderProfileSchema, OpenAiCompatibleChatClient, PI_PROJECTED_KEY_ENV, PROVIDER_AUTH_MODES, PROVIDER_PROFILE_TRUTH_RECORD_KEY, PROVIDER_RESPONSE_MAX_BYTES, PROVIDER_TIMEOUT_MS, ProviderRegistry, SECRET_NAMESPACE_PATTERN, SECRET_NAME_PATTERN, SqliteProviderProfileStore, TruthStoreProviderProfileStore, WindowsCredentialManagerSecretStore, anthropicMessageText, assertLiveModelResponse, assertSecretName, assertSecretNamespace, assertSharedSecretValue, buildPiProviderProjection, chatCompletionText, classifyModelProviderHttpError, decodeStrictBase64Utf8, fetchWithProviderGuards, isLoopbackHost, isLoopbackProviderUrl, isPrivateNetworkLiteral, isSqliteAvailable, loadSqliteModule, modelApiUrl, modelMessageText, modelProviderSecretName, normalizeProviderUrl, objectValue, openSqliteDatabase, parseBoundedJsonResponse, parseModelProviderProfile, providerHeaders, readModelProviderResponse, requiredProviderSecret, runCommand, scopeSecretStore, secretScopeId, secureSqliteFilePermissions };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map