@byok-sdk/keys 0.3.10 → 0.4.1

package/dist/errors.d.ts

@@ -27,8 +27,9 @@ export declare class ByokKeysError extends Error {
  * stored value as-is), `SECRET_ENVELOPE_INVALID` (it reported a malformed
  * envelope as an absent secret), and `SECRET_NAME_INVALID` /
  * `SECRET_VALUE_INVALID` (the runtime replacements for the closed
- * `KeychainSecretName` union). Everything else matches the source string for
- * string.
+ * `KeychainSecretName` union). `PROVIDER_STORE_SCHEMA_STALE` joins them: it
+ * guards a persisted `provider_profile` DDL that differs from the one this
+ * package generates. Everything else matches the source string for string.
  *
  * `SECRET_NAMESPACE_INVALID` is a separate case. The source does record it:
  * `normalizeSecretNamespace` (`index.ts:748-757`) throws the verbatim string
@@ -70,6 +71,7 @@ export declare const BYOK_KEYS_ERROR_CODES: {
     readonly PROVIDER_SECRET_MISSING: 'PROVIDER_SECRET_MISSING';
     readonly PROVIDER_SECRET_NOT_ALLOWED: 'PROVIDER_SECRET_NOT_ALLOWED';
     readonly PROVIDER_SECRET_ROLLBACK_FAILED: 'PROVIDER_SECRET_ROLLBACK_FAILED';
+    readonly PROVIDER_STORE_SCHEMA_STALE: 'PROVIDER_STORE_SCHEMA_STALE';
     readonly PROVIDER_STORE_UNAVAILABLE: 'PROVIDER_STORE_UNAVAILABLE';
     readonly PROVIDER_TRUTH_INVALID: 'PROVIDER_TRUTH_INVALID';
     readonly PROVIDER_URL_INVALID: 'PROVIDER_URL_INVALID';

package/dist/index.d.ts

@@ -2,6 +2,8 @@ export { ByokKeysError, BYOK_KEYS_ERROR_CODES } from './errors';
 export type { ByokKeysErrorCode } from './errors';
 export { MODEL_PROVIDER_ADAPTERS, MODEL_PROVIDER_KINDS, PROVIDER_AUTH_MODES, PROVIDER_MODEL_CAPABILITIES, ModelProviderProfileSchema, ProviderModelCapabilitySchema, ProviderProfileRefSchema, parseModelProviderProfile, exactProviderProfileBinding, assertExactProviderProfileBinding, } from './provider-profile';
 export type { ModelProviderAdapter, ModelProviderKind, ModelProviderProfile, ModelProviderProfileInput, ExactProviderProfileBinding, ProviderAuthMode, ProviderModelCapability, ProviderProfileRef, } from './provider-profile';
+export { MODEL_PROVIDER_VENDORS, MODEL_PROVIDER_VENDOR_IDS, modelProviderVendor, } from './provider-catalog';
+export type { ModelProviderVendor, ModelProviderVendorId, } from './provider-catalog';
 export { providerHeaders, requiredProviderSecret } from './headers';
 export type { ProviderAuthProfile } from './headers';
 export { normalizeProviderUrl, isLoopbackHost, isLoopbackProviderUrl, isPrivateNetworkLiteral, } from './url';

package/dist/index.js

@@ -47,6 +47,7 @@ var BYOK_KEYS_ERROR_CODES = {
   PROVIDER_SECRET_MISSING: "PROVIDER_SECRET_MISSING",
   PROVIDER_SECRET_NOT_ALLOWED: "PROVIDER_SECRET_NOT_ALLOWED",
   PROVIDER_SECRET_ROLLBACK_FAILED: "PROVIDER_SECRET_ROLLBACK_FAILED",
+  PROVIDER_STORE_SCHEMA_STALE: "PROVIDER_STORE_SCHEMA_STALE",
   PROVIDER_STORE_UNAVAILABLE: "PROVIDER_STORE_UNAVAILABLE",
   PROVIDER_TRUTH_INVALID: "PROVIDER_TRUTH_INVALID",
   PROVIDER_URL_INVALID: "PROVIDER_URL_INVALID",
@@ -56,6 +57,89 @@ var BYOK_KEYS_ERROR_CODES = {
   SECRET_VALUE_INVALID: "SECRET_VALUE_INVALID"
 };
 
+// src/provider-catalog.ts
+function openAiCompatible(display_name, base_url, api_key_env) {
+  return {
+    display_name,
+    base_url,
+    adapter: "openai_compatible",
+    auth_mode: "bearer",
+    api_key_env
+  };
+}
+function anthropicMessages(display_name, base_url, api_key_env) {
+  return {
+    display_name,
+    base_url,
+    adapter: "anthropic",
+    auth_mode: "x_api_key",
+    api_key_env
+  };
+}
+var MODEL_PROVIDER_VENDORS = {
+  "ant-ling": openAiCompatible("Ant Ling", "https://api.ant-ling.com/v1", "ANT_LING_API_KEY"),
+  baseten: openAiCompatible("Baseten", "https://inference.baseten.co/v1", "BASETEN_API_KEY"),
+  cerebras: openAiCompatible("Cerebras", "https://api.cerebras.ai/v1", "CEREBRAS_API_KEY"),
+  deepseek: openAiCompatible("DeepSeek", "https://api.deepseek.com", "DEEPSEEK_API_KEY"),
+  groq: openAiCompatible("Groq", "https://api.groq.com/openai/v1", "GROQ_API_KEY"),
+  huggingface: openAiCompatible("Hugging Face", "https://router.huggingface.co/v1", "HF_TOKEN"),
+  moonshotai: openAiCompatible("Moonshot AI", "https://api.moonshot.ai/v1", "MOONSHOT_API_KEY"),
+  "moonshotai-cn": openAiCompatible("Moonshot AI CN", "https://api.moonshot.cn/v1", "MOONSHOT_API_KEY"),
+  nvidia: openAiCompatible("NVIDIA", "https://integrate.api.nvidia.com/v1", "NVIDIA_API_KEY"),
+  openai: openAiCompatible("OpenAI", "https://api.openai.com/v1", "OPENAI_API_KEY"),
+  openrouter: openAiCompatible("OpenRouter", "https://openrouter.ai/api/v1", "OPENROUTER_API_KEY"),
+  "qwen-token-plan": openAiCompatible(
+    "Qwen Token Plan",
+    "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1",
+    "QWEN_TOKEN_PLAN_API_KEY"
+  ),
+  "qwen-token-plan-cn": openAiCompatible(
+    "Qwen Token Plan CN",
+    "https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1",
+    "QWEN_TOKEN_PLAN_CN_API_KEY"
+  ),
+  together: openAiCompatible("Together", "https://api.together.ai/v1", "TOGETHER_API_KEY"),
+  xai: openAiCompatible("xAI", "https://api.x.ai/v1", "XAI_API_KEY"),
+  xiaomi: openAiCompatible("Xiaomi", "https://api.xiaomimimo.com/v1", "XIAOMI_API_KEY"),
+  "xiaomi-token-plan-ams": openAiCompatible(
+    "Xiaomi Token Plan AMS",
+    "https://token-plan-ams.xiaomimimo.com/v1",
+    "XIAOMI_TOKEN_PLAN_AMS_API_KEY"
+  ),
+  "xiaomi-token-plan-cn": openAiCompatible(
+    "Xiaomi Token Plan CN",
+    "https://token-plan-cn.xiaomimimo.com/v1",
+    "XIAOMI_TOKEN_PLAN_CN_API_KEY"
+  ),
+  "xiaomi-token-plan-sgp": openAiCompatible(
+    "Xiaomi Token Plan SGP",
+    "https://token-plan-sgp.xiaomimimo.com/v1",
+    "XIAOMI_TOKEN_PLAN_SGP_API_KEY"
+  ),
+  zai: openAiCompatible("Z.AI", "https://api.z.ai/api/coding/paas/v4", "ZAI_API_KEY"),
+  "zai-coding-cn": openAiCompatible(
+    "Z.AI Coding CN",
+    "https://open.bigmodel.cn/api/coding/paas/v4",
+    "ZAI_CODING_CN_API_KEY"
+  ),
+  anthropic: anthropicMessages("Anthropic", "https://api.anthropic.com/v1", "ANTHROPIC_API_KEY"),
+  fireworks: anthropicMessages("Fireworks", "https://api.fireworks.ai/inference/v1", "FIREWORKS_API_KEY"),
+  "kimi-coding": anthropicMessages("Kimi For Coding", "https://api.kimi.com/coding/v1", "KIMI_API_KEY"),
+  minimax: anthropicMessages("MiniMax", "https://api.minimax.io/anthropic/v1", "MINIMAX_API_KEY"),
+  "minimax-cn": anthropicMessages("MiniMax CN", "https://api.minimaxi.com/anthropic/v1", "MINIMAX_CN_API_KEY"),
+  "vercel-ai-gateway": anthropicMessages(
+    "Vercel AI Gateway",
+    "https://ai-gateway.vercel.sh/v1",
+    "AI_GATEWAY_API_KEY"
+  )
+};
+var MODEL_PROVIDER_VENDOR_IDS = Object.keys(
+  MODEL_PROVIDER_VENDORS
+);
+function modelProviderVendor(kind) {
+  return Object.hasOwn(MODEL_PROVIDER_VENDORS, kind) ? MODEL_PROVIDER_VENDORS[kind] : void 0;
+}
+
 // src/url.ts
 function normalizeProviderUrl(value) {
   let url;
@@ -105,9 +189,7 @@ var ProviderProfileRefSchema = z.string().min(1).max(64).regex(
   "provider profile refs must be lowercase portable identifiers"
 );
 var MODEL_PROVIDER_KINDS = [
-  "openai",
-  "deepseek",
-  "anthropic",
+  ...MODEL_PROVIDER_VENDOR_IDS,
   "custom"
 ];
 var PROVIDER_MODEL_CAPABILITIES = ["image-input"];
@@ -182,6 +264,14 @@ var ModelProviderProfileSchema = z.object({
       path: ["auth_mode"]
     });
   }
+  const vendor = modelProviderVendor(profile.provider_kind);
+  if (vendor !== void 0 && vendor.adapter !== profile.adapter) {
+    ctx.addIssue({
+      code: "custom",
+      message: `Provider kind ${profile.provider_kind} speaks the ${vendor.adapter} adapter`,
+      path: ["adapter"]
+    });
+  }
   if (Date.parse(profile.updated_at) < Date.parse(profile.created_at)) {
     ctx.addIssue({
       code: "custom",
@@ -1320,15 +1410,18 @@ function secureSqliteFilePermissions(databasePath) {
 }
 
 // src/sqlite-profile-store.ts
+function sqlList(values) {
+  return values.map((value) => `'${value}'`).join(", ");
+}
 var SCHEMA = `
 CREATE TABLE IF NOT EXISTS provider_profile (
   profile_ref   TEXT PRIMARY KEY,
-  provider_kind TEXT NOT NULL CHECK (provider_kind IN ('openai', 'deepseek', 'anthropic', 'custom')),
+  provider_kind TEXT NOT NULL CHECK (provider_kind IN (${sqlList(MODEL_PROVIDER_KINDS)})),
   kind          TEXT NOT NULL CHECK (kind = 'model'),
-  adapter       TEXT NOT NULL CHECK (adapter IN ('openai_compatible', 'anthropic')),
+  adapter       TEXT NOT NULL CHECK (adapter IN (${sqlList(MODEL_PROVIDER_ADAPTERS)})),
   display_name  TEXT NOT NULL,
   base_url      TEXT NOT NULL,
-  auth_mode     TEXT NOT NULL CHECK (auth_mode IN ('bearer', 'x_api_key', 'none')),
+  auth_mode     TEXT NOT NULL CHECK (auth_mode IN (${sqlList(PROVIDER_AUTH_MODES)})),
   model         TEXT NOT NULL,
   capabilities  TEXT NOT NULL,
   enabled       INTEGER NOT NULL CHECK (enabled IN (0, 1)),
@@ -1336,6 +1429,21 @@ CREATE TABLE IF NOT EXISTS provider_profile (
   updated_at    TEXT NOT NULL
 );
 `;
+function normalizeTableDdl(sql) {
+  return sql.replace(/\bIF\s+NOT\s+EXISTS\b/giu, "").replace(/\s+/gu, " ").trim().replace(/;$/u, "").trim();
+}
+function assertProviderProfileSchemaIsCurrent(database, path2) {
+  const row = database.prepare(
+    "SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'provider_profile'"
+  ).get();
+  const stored = row?.sql;
+  if (typeof stored !== "string") return;
+  if (normalizeTableDdl(stored) === normalizeTableDdl(SCHEMA)) return;
+  throw new ByokKeysError(
+    "PROVIDER_STORE_SCHEMA_STALE",
+    `Provider profile store at ${path2} was created by a different @byok-sdk/keys schema; recreate the store file to continue`
+  );
+}
 var ENABLED_INDEX = `
 CREATE UNIQUE INDEX IF NOT EXISTS provider_profile_one_enabled
 ON provider_profile(kind)
@@ -1352,6 +1460,7 @@ var SqliteProviderProfileStore = class {
       try {
         this.#database.exec(SCHEMA);
         this.#database.exec(ENABLED_INDEX);
+        assertProviderProfileSchemaIsCurrent(this.#database, options.path);
         secureSqliteFilePermissions(options.path);
       } catch (error) {
         closeSqliteDatabaseAfterInitializationFailure(
@@ -1360,6 +1469,16 @@ var SqliteProviderProfileStore = class {
           "SqliteProviderProfileStore initialization failed and its native handle could not be closed"
         );
       }
+    } else {
+      try {
+        assertProviderProfileSchemaIsCurrent(this.#database, options.path);
+      } catch (error) {
+        closeSqliteDatabaseAfterInitializationFailure(
+          this.#database,
+          error,
+          "SqliteProviderProfileStore read-only schema check failed and its native handle could not be closed"
+        );
+      }
     }
   }
   /**
@@ -1866,6 +1985,6 @@ function buildPiProviderProjection(profile) {
   };
 }
 
-export { AnthropicMessagesClient, BYOK_KEYS_ERROR_CODES, ByokKeysError, DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX, DEFAULT_SECRET_ENVELOPE_PREFIX, DEFAULT_SECRET_SERVICE_PREFIX, EnvelopeScopedSecretStore, InMemoryProviderProfileStore, InMemorySecretStore, MODEL_PROVIDER_ADAPTERS, MODEL_PROVIDER_KINDS, MacOsKeychainSecretStore, ModelProviderProfileSchema, OpenAiCompatibleChatClient, PI_PROJECTED_KEY_ENV, PROVIDER_AUTH_MODES, PROVIDER_MODEL_CAPABILITIES, PROVIDER_PROFILE_TRUTH_RECORD_KEY, PROVIDER_RESPONSE_MAX_BYTES, PROVIDER_TIMEOUT_MS, ProviderModelCapabilitySchema, ProviderProfileRefSchema, ProviderRegistry, SECRET_NAMESPACE_PATTERN, SECRET_NAME_PATTERN, SqliteProviderProfileStore, TruthStoreProviderProfileStore, WindowsCredentialManagerSecretStore, anthropicMessageText, assertExactProviderProfileBinding, assertLiveModelResponse, assertSecretName, assertSecretNamespace, assertSharedSecretValue, buildPiProviderProjection, chatCompletionText, classifyModelProviderHttpError, decodeStrictBase64Utf8, exactProviderProfileBinding, fetchWithProviderGuards, isLoopbackHost, isLoopbackProviderUrl, isPrivateNetworkLiteral, isSqliteAvailable, loadSqliteModule, modelApiUrl, modelMessageText, modelProviderSecretName, normalizeProviderUrl, objectValue, openSqliteDatabase, parseBoundedJsonResponse, parseModelProviderProfile, providerHeaders, readModelProviderResponse, requiredProviderSecret, runCommand, scopeSecretStore, secretScopeId, secureSqliteFilePermissions };
+export { AnthropicMessagesClient, BYOK_KEYS_ERROR_CODES, ByokKeysError, DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX, DEFAULT_SECRET_ENVELOPE_PREFIX, DEFAULT_SECRET_SERVICE_PREFIX, EnvelopeScopedSecretStore, InMemoryProviderProfileStore, InMemorySecretStore, MODEL_PROVIDER_ADAPTERS, MODEL_PROVIDER_KINDS, MODEL_PROVIDER_VENDORS, MODEL_PROVIDER_VENDOR_IDS, MacOsKeychainSecretStore, ModelProviderProfileSchema, OpenAiCompatibleChatClient, PI_PROJECTED_KEY_ENV, PROVIDER_AUTH_MODES, PROVIDER_MODEL_CAPABILITIES, PROVIDER_PROFILE_TRUTH_RECORD_KEY, PROVIDER_RESPONSE_MAX_BYTES, PROVIDER_TIMEOUT_MS, ProviderModelCapabilitySchema, ProviderProfileRefSchema, ProviderRegistry, SECRET_NAMESPACE_PATTERN, SECRET_NAME_PATTERN, SqliteProviderProfileStore, TruthStoreProviderProfileStore, WindowsCredentialManagerSecretStore, anthropicMessageText, assertExactProviderProfileBinding, assertLiveModelResponse, assertSecretName, assertSecretNamespace, assertSharedSecretValue, buildPiProviderProjection, chatCompletionText, classifyModelProviderHttpError, decodeStrictBase64Utf8, exactProviderProfileBinding, fetchWithProviderGuards, isLoopbackHost, isLoopbackProviderUrl, isPrivateNetworkLiteral, isSqliteAvailable, loadSqliteModule, modelApiUrl, modelMessageText, modelProviderSecretName, modelProviderVendor, normalizeProviderUrl, objectValue, openSqliteDatabase, parseBoundedJsonResponse, parseModelProviderProfile, providerHeaders, readModelProviderResponse, requiredProviderSecret, runCommand, scopeSecretStore, secretScopeId, secureSqliteFilePermissions };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map