@byok-sdk/keys 0.3.8 → 0.3.10

package/dist/index.js

@@ -1,7 +1,7 @@
 import { z } from 'zod';
+import { createHash } from 'crypto';
 import { spawn } from 'child_process';
 import path, { dirname } from 'path';
-import { createHash } from 'crypto';
 import { mkdirSync, existsSync, chmodSync } from 'fs';
 import { createRequire } from 'module';
 import { isCoreConflictError, contentHash } from '@byok-sdk/core';
@@ -99,12 +99,19 @@ function isPrivateNetworkLiteral(hostname) {
 }
 
 // src/provider-profile.ts
-var MODEL_PROVIDER_IDS = [
+var PROVIDER_PROFILE_REF_PATTERN = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u;
+var ProviderProfileRefSchema = z.string().min(1).max(64).regex(
+  PROVIDER_PROFILE_REF_PATTERN,
+  "provider profile refs must be lowercase portable identifiers"
+);
+var MODEL_PROVIDER_KINDS = [
   "openai",
   "deepseek",
   "anthropic",
   "custom"
 ];
+var PROVIDER_MODEL_CAPABILITIES = ["image-input"];
+var ProviderModelCapabilitySchema = z.enum(PROVIDER_MODEL_CAPABILITIES);
 var PROVIDER_AUTH_MODES = ["bearer", "x_api_key", "none"];
 var MODEL_PROVIDER_ADAPTERS = ["openai_compatible", "anthropic"];
 function boundedString(field, maximumLength) {
@@ -144,14 +151,23 @@ var ModelProviderProfileSchema = z.object({
   adapter: z.enum(MODEL_PROVIDER_ADAPTERS),
   auth_mode: z.enum(PROVIDER_AUTH_MODES),
   base_url: providerBaseUrl,
+  capabilities: z.array(ProviderModelCapabilitySchema).max(8),
   created_at: isoTimestamp("created_at"),
   display_name: boundedString("display_name", 100),
   enabled: z.boolean(),
   kind: z.literal("model"),
   model: boundedString("model", 160),
-  provider_id: z.enum(MODEL_PROVIDER_IDS),
+  profile_ref: ProviderProfileRefSchema,
+  provider_kind: z.enum(MODEL_PROVIDER_KINDS),
   updated_at: isoTimestamp("updated_at")
 }).superRefine((profile, ctx) => {
+  if (new Set(profile.capabilities).size !== profile.capabilities.length) {
+    ctx.addIssue({
+      code: "custom",
+      message: "Provider capabilities cannot repeat",
+      path: ["capabilities"]
+    });
+  }
   if (profile.adapter === "anthropic" && profile.auth_mode !== "x_api_key") {
     ctx.addIssue({
       code: "custom",
@@ -174,6 +190,47 @@ var ModelProviderProfileSchema = z.object({
     });
   }
 });
+function exactProviderProfileBinding(profileInput, requiredCapabilities = profileInput.capabilities) {
+  const profile = parseModelProviderProfile(profileInput);
+  const revision = Date.parse(profile.updated_at);
+  if (!Number.isSafeInteger(revision) || revision < 0) {
+    throw new ByokKeysError(
+      "PROVIDER_PROFILE_INVALID",
+      "Provider updated_at cannot be represented as a canonical revision"
+    );
+  }
+  const normalizedCapabilities = [...profile.capabilities].sort();
+  const canonical = JSON.stringify({
+    adapter: profile.adapter,
+    auth_mode: profile.auth_mode,
+    base_url: profile.base_url,
+    capabilities: normalizedCapabilities,
+    kind: profile.kind,
+    model: profile.model,
+    profile_ref: profile.profile_ref,
+    provider_kind: profile.provider_kind
+  });
+  return {
+    profileRef: profile.profile_ref,
+    profileRevision: String(revision),
+    profileHash: `sha256:${createHash("sha256").update(canonical).digest("hex")}`,
+    modelId: profile.model,
+    requiredCapabilities: [...requiredCapabilities]
+  };
+}
+function assertExactProviderProfileBinding(profile, expected) {
+  if (new Set(expected.requiredCapabilities).size !== expected.requiredCapabilities.length) {
+    throw new Error("provider profile required capabilities must be unique");
+  }
+  const actual = exactProviderProfileBinding(profile, expected.requiredCapabilities);
+  if (actual.profileRef !== expected.profileRef) throw new Error("provider profile ref mismatch");
+  if (actual.profileRevision !== expected.profileRevision) throw new Error("provider profile revision mismatch");
+  if (actual.profileHash !== expected.profileHash) throw new Error("provider profile hash mismatch");
+  if (actual.modelId !== expected.modelId) throw new Error("provider profile model mismatch");
+  const supported = new Set(profile.capabilities);
+  const unsupported = expected.requiredCapabilities.find((capability) => !supported.has(capability));
+  if (unsupported !== void 0) throw new Error(`provider profile does not support required capability ${unsupported}`);
+}
 function parseModelProviderProfile(value) {
   const result = ModelProviderProfileSchema.safeParse(value);
   if (result.success) return result.data;
@@ -527,14 +584,16 @@ function assertSecretNamespace(value) {
 
 // src/secret-store.ts
 var DEFAULT_SECRET_SERVICE_PREFIX = "com.byok.keys";
-var MODEL_PROVIDER_SECRET_NAMES = {
-  anthropic: "model-anthropic-api-key",
-  custom: "model-custom-api-key",
-  deepseek: "model-deepseek-api-key",
-  openai: "model-openai-api-key"
-};
-function modelProviderSecretName(providerId) {
-  return MODEL_PROVIDER_SECRET_NAMES[providerId];
+function modelProviderSecretName(profileRef) {
+  const parsed = ProviderProfileRefSchema.safeParse(profileRef);
+  if (!parsed.success) {
+    throw new ByokKeysError(
+      "PROVIDER_PROFILE_INVALID",
+      "Provider profile ref must be a lowercase portable identifier",
+      { cause: parsed.error }
+    );
+  }
+  return assertSecretName(`model-${parsed.data}-api-key`);
 }
 function assertSharedSecretValue(secret) {
   if (secret.length === 0 || /[\u0000\r\n]/u.test(secret)) {
@@ -1143,10 +1202,10 @@ function normalizeSecretScope(scope) {
 }
 
 // src/profile-store.ts
-function providerNotConfigured(providerId) {
+function providerNotConfigured(profileRef) {
   return new ByokKeysError(
     "PROVIDER_NOT_CONFIGURED",
-    `${providerId} model provider is not configured`
+    `${profileRef} model provider is not configured`
   );
 }
 var InMemoryProviderProfileStore = class {
@@ -1154,38 +1213,38 @@ var InMemoryProviderProfileStore = class {
   async close() {
     this.#profiles.clear();
   }
-  async delete(providerId) {
-    return this.#profiles.delete(providerId);
+  async delete(profileRef) {
+    return this.#profiles.delete(profileRef);
   }
-  async get(providerId) {
-    return this.#profiles.get(providerId);
+  async get(profileRef) {
+    return this.#profiles.get(profileRef);
   }
   async getEnabled() {
     return [...this.#profiles.values()].find((profile) => profile.enabled);
   }
   async list() {
     return [...this.#profiles.values()].sort(
-      (left, right) => left.provider_id.localeCompare(right.provider_id)
+      (left, right) => left.profile_ref.localeCompare(right.profile_ref)
     );
   }
   async save(profile) {
     const validated = parseModelProviderProfile({
       ...profile,
-      created_at: this.#profiles.get(profile.provider_id)?.created_at ?? profile.created_at
+      created_at: this.#profiles.get(profile.profile_ref)?.created_at ?? profile.created_at
     });
     if (validated.enabled) {
-      for (const [providerId, existing] of this.#profiles) {
-        if (providerId !== validated.provider_id && existing.enabled) {
-          this.#profiles.set(providerId, { ...existing, enabled: false });
+      for (const [profileRef, existing] of this.#profiles) {
+        if (profileRef !== validated.profile_ref && existing.enabled) {
+          this.#profiles.set(profileRef, { ...existing, enabled: false });
         }
       }
     }
-    this.#profiles.set(validated.provider_id, validated);
+    this.#profiles.set(validated.profile_ref, validated);
     return validated;
   }
-  async setEnabled(providerId) {
-    const existing = this.#profiles.get(providerId);
-    if (existing === void 0) throw providerNotConfigured(providerId);
+  async setEnabled(profileRef) {
+    const existing = this.#profiles.get(profileRef);
+    if (existing === void 0) throw providerNotConfigured(profileRef);
     return this.save({ ...existing, enabled: true });
   }
 };
@@ -1263,16 +1322,18 @@ function secureSqliteFilePermissions(databasePath) {
 // src/sqlite-profile-store.ts
 var SCHEMA = `
 CREATE TABLE IF NOT EXISTS provider_profile (
-  provider_id  TEXT PRIMARY KEY CHECK (provider_id IN ('openai', 'deepseek', 'anthropic', 'custom')),
-  kind         TEXT NOT NULL CHECK (kind = 'model'),
-  adapter      TEXT NOT NULL CHECK (adapter IN ('openai_compatible', 'anthropic')),
-  display_name TEXT NOT NULL,
-  base_url     TEXT NOT NULL,
-  auth_mode    TEXT NOT NULL CHECK (auth_mode IN ('bearer', 'x_api_key', 'none')),
-  model        TEXT NOT NULL,
-  enabled      INTEGER NOT NULL CHECK (enabled IN (0, 1)),
-  created_at   TEXT NOT NULL,
-  updated_at   TEXT NOT NULL
+  profile_ref   TEXT PRIMARY KEY,
+  provider_kind TEXT NOT NULL CHECK (provider_kind IN ('openai', 'deepseek', 'anthropic', 'custom')),
+  kind          TEXT NOT NULL CHECK (kind = 'model'),
+  adapter       TEXT NOT NULL CHECK (adapter IN ('openai_compatible', 'anthropic')),
+  display_name  TEXT NOT NULL,
+  base_url      TEXT NOT NULL,
+  auth_mode     TEXT NOT NULL CHECK (auth_mode IN ('bearer', 'x_api_key', 'none')),
+  model         TEXT NOT NULL,
+  capabilities  TEXT NOT NULL,
+  enabled       INTEGER NOT NULL CHECK (enabled IN (0, 1)),
+  created_at    TEXT NOT NULL,
+  updated_at    TEXT NOT NULL
 );
 `;
 var ENABLED_INDEX = `
@@ -1312,12 +1373,12 @@ var SqliteProviderProfileStore = class {
     this.#closed = true;
     this.#database.close();
   }
-  async delete(providerId) {
-    const result = this.#database.prepare("DELETE FROM provider_profile WHERE provider_id = ?").run(providerId);
+  async delete(profileRef) {
+    const result = this.#database.prepare("DELETE FROM provider_profile WHERE profile_ref = ?").run(profileRef);
     return Number(result.changes) === 1;
   }
-  async get(providerId) {
-    const row = this.#database.prepare("SELECT * FROM provider_profile WHERE provider_id = ?").get(providerId);
+  async get(profileRef) {
+    const row = this.#database.prepare("SELECT * FROM provider_profile WHERE profile_ref = ?").get(profileRef);
     return row === void 0 ? void 0 : parseRow(row);
   }
   async getEnabled() {
@@ -1325,11 +1386,11 @@ var SqliteProviderProfileStore = class {
     return row === void 0 ? void 0 : parseRow(row);
   }
   async list() {
-    const rows = this.#database.prepare("SELECT * FROM provider_profile ORDER BY provider_id ASC").all();
+    const rows = this.#database.prepare("SELECT * FROM provider_profile ORDER BY profile_ref ASC").all();
     return rows.map(parseRow);
   }
   async save(profile) {
-    const existing = await this.get(profile.provider_id);
+    const existing = await this.get(profile.profile_ref);
     const validated = parseModelProviderProfile({
       ...profile,
       created_at: existing?.created_at ?? profile.created_at
@@ -1337,40 +1398,44 @@ var SqliteProviderProfileStore = class {
     this.#transaction(() => {
       if (validated.enabled) {
         this.#database.prepare(
-          "UPDATE provider_profile SET enabled = 0 WHERE provider_id <> ?"
-        ).run(validated.provider_id);
+          "UPDATE provider_profile SET enabled = 0 WHERE profile_ref <> ?"
+        ).run(validated.profile_ref);
       }
       this.#database.prepare(
         `INSERT INTO provider_profile (
-             provider_id, kind, adapter, display_name, base_url,
-             auth_mode, model, enabled, created_at, updated_at
-           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-           ON CONFLICT(provider_id) DO UPDATE SET
+             profile_ref, provider_kind, kind, adapter, display_name, base_url,
+             auth_mode, model, capabilities, enabled, created_at, updated_at
+           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+           ON CONFLICT(profile_ref) DO UPDATE SET
+             provider_kind = excluded.provider_kind,
              adapter = excluded.adapter,
              display_name = excluded.display_name,
              base_url = excluded.base_url,
              auth_mode = excluded.auth_mode,
              model = excluded.model,
+             capabilities = excluded.capabilities,
              enabled = excluded.enabled,
              updated_at = excluded.updated_at`
       ).run(
-        validated.provider_id,
+        validated.profile_ref,
+        validated.provider_kind,
         validated.kind,
         validated.adapter,
         validated.display_name,
         validated.base_url,
         validated.auth_mode,
         validated.model,
+        JSON.stringify(validated.capabilities),
         validated.enabled ? 1 : 0,
         validated.created_at,
         validated.updated_at
       );
     });
-    return await this.get(validated.provider_id);
+    return await this.get(validated.profile_ref);
   }
-  async setEnabled(providerId) {
-    const existing = await this.get(providerId);
-    if (existing === void 0) throw providerNotConfigured(providerId);
+  async setEnabled(profileRef) {
+    const existing = await this.get(profileRef);
+    if (existing === void 0) throw providerNotConfigured(profileRef);
     return this.save({ ...existing, enabled: true });
   }
   /** `BEGIN IMMEDIATE` / `COMMIT` / `ROLLBACK`, per `providers.ts:1252-1263`. */
@@ -1386,8 +1451,19 @@ var SqliteProviderProfileStore = class {
   }
 };
 function parseRow(row) {
+  let capabilities;
+  try {
+    capabilities = JSON.parse(row.capabilities);
+  } catch (cause) {
+    throw new ByokKeysError(
+      "PROVIDER_PROFILE_INVALID",
+      "Provider profile capabilities column is not valid JSON",
+      { cause }
+    );
+  }
   return parseModelProviderProfile({
     ...row,
+    capabilities,
     enabled: row.enabled === 1
   });
 }
@@ -1396,14 +1472,17 @@ var PROFILE_KEYS = [
   "adapter",
   "auth_mode",
   "base_url",
+  "capabilities",
   "created_at",
   "display_name",
   "enabled",
   "kind",
   "model",
-  "provider_id",
+  "profile_ref",
+  "provider_kind",
   "updated_at"
 ];
+var MAX_PROVIDER_PROFILES = 32;
 var TruthStoreProviderProfileStore = class {
   #tenant;
   #truth;
@@ -1413,20 +1492,20 @@ var TruthStoreProviderProfileStore = class {
   }
   async close() {
   }
-  async delete(providerId) {
+  async delete(profileRef) {
     const current = await this.#load();
-    if (!current.profiles.some((profile) => profile.provider_id === providerId)) {
+    if (!current.profiles.some((profile) => profile.profile_ref === profileRef)) {
       return false;
     }
     await this.#write(
-      current.profiles.filter((profile) => profile.provider_id !== providerId),
+      current.profiles.filter((profile) => profile.profile_ref !== profileRef),
       current.rev
     );
     return true;
   }
-  async get(providerId) {
+  async get(profileRef) {
     return (await this.#load()).profiles.find(
-      (profile) => profile.provider_id === providerId
+      (profile) => profile.profile_ref === profileRef
     );
   }
   async getEnabled() {
@@ -1438,28 +1517,28 @@ var TruthStoreProviderProfileStore = class {
   async save(profile) {
     const current = await this.#load();
     const existing = current.profiles.find(
-      (candidate) => candidate.provider_id === profile.provider_id
+      (candidate) => candidate.profile_ref === profile.profile_ref
     );
     const validated = parseModelProviderProfile({
       ...profile,
       created_at: existing?.created_at ?? profile.created_at
     });
-    const next = current.profiles.filter((candidate) => candidate.provider_id !== validated.provider_id).map(
+    const next = current.profiles.filter((candidate) => candidate.profile_ref !== validated.profile_ref).map(
       (candidate) => validated.enabled && candidate.enabled ? { ...candidate, enabled: false } : candidate
     );
     next.push(validated);
     await this.#write(next, current.rev);
     return validated;
   }
-  async setEnabled(providerId) {
+  async setEnabled(profileRef) {
     const current = await this.#load();
     const selected = current.profiles.find(
-      (profile) => profile.provider_id === providerId
+      (profile) => profile.profile_ref === profileRef
     );
-    if (selected === void 0) throw providerNotConfigured(providerId);
+    if (selected === void 0) throw providerNotConfigured(profileRef);
     const next = current.profiles.map((profile) => ({
       ...profile,
-      enabled: profile.provider_id === providerId
+      enabled: profile.profile_ref === profileRef
     }));
     await this.#write(next, current.rev);
     return { ...selected, enabled: true };
@@ -1505,7 +1584,7 @@ var TruthStoreProviderProfileStore = class {
   }
 };
 function encodeRegistry(profiles) {
-  const normalized = profiles.map((profile) => parseModelProviderProfile(profile)).sort((left, right) => left.provider_id.localeCompare(right.provider_id));
+  const normalized = profiles.map((profile) => parseModelProviderProfile(profile)).sort((left, right) => left.profile_ref.localeCompare(right.profile_ref));
   assertRegistryInvariants(normalized);
   const snapshot = {
     schema_version: 1,
@@ -1513,12 +1592,14 @@ function encodeRegistry(profiles) {
       adapter: profile.adapter,
       auth_mode: profile.auth_mode,
       base_url: profile.base_url,
+      capabilities: profile.capabilities,
       created_at: profile.created_at,
       display_name: profile.display_name,
       enabled: profile.enabled,
       kind: profile.kind,
       model: profile.model,
-      provider_id: profile.provider_id,
+      profile_ref: profile.profile_ref,
+      provider_kind: profile.provider_kind,
       updated_at: profile.updated_at
     }))
   };
@@ -1550,7 +1631,7 @@ function decodeRegistryRecord(record, tenant) {
   if (raw.schema_version !== 1 || !Array.isArray(raw.profiles)) {
     throw invalidTruth("Provider profile TruthStore body has an unsupported schema");
   }
-  if (raw.profiles.length > MODEL_PROVIDER_IDS.length) {
+  if (raw.profiles.length > MAX_PROVIDER_PROFILES) {
     throw invalidTruth("Provider profile TruthStore body exceeds the provider registry bound");
   }
   let profiles;
@@ -1577,10 +1658,10 @@ function assertRegistryInvariants(profiles) {
   const seen = /* @__PURE__ */ new Set();
   let enabled = 0;
   for (const profile of profiles) {
-    if (seen.has(profile.provider_id)) {
-      throw invalidTruth(`Provider profile ${profile.provider_id} appears more than once`);
+    if (seen.has(profile.profile_ref)) {
+      throw invalidTruth(`Provider profile ${profile.profile_ref} appears more than once`);
     }
-    seen.add(profile.provider_id);
+    seen.add(profile.profile_ref);
     if (profile.enabled) enabled += 1;
   }
   if (enabled > 1) {
@@ -1630,16 +1711,23 @@ var ProviderRegistry = class {
    * authentication it cannot perform.
    */
   async configure(configuration, secret) {
-    const timestamp = this.#now().toISOString();
-    const previous = await this.#profiles.get(configuration.provider_id);
+    const previous = await this.#profiles.get(configuration.profile_ref);
+    const observedNow = this.#now().getTime();
+    const previousRevision = previous === void 0 ? void 0 : Date.parse(previous.updated_at);
+    const revision = previousRevision === void 0 ? observedNow : Math.max(observedNow, previousRevision + 1);
+    if (!Number.isSafeInteger(revision) || revision < 0) {
+      throw new ByokKeysError("PROVIDER_PROFILE_INVALID", "Provider clock cannot produce a monotonic profile revision");
+    }
+    const timestamp = new Date(revision).toISOString();
     const profile = parseModelProviderProfile({
       ...configuration,
+      capabilities: [...configuration.capabilities],
       created_at: previous?.created_at ?? timestamp,
       enabled: configuration.enabled ?? true,
       kind: "model",
       updated_at: timestamp
     });
-    const secretName = modelProviderSecretName(configuration.provider_id);
+    const secretName = modelProviderSecretName(configuration.profile_ref);
     let previousSecret;
     let secretWritten = false;
     if (configuration.auth_mode === "none" && secret !== void 0) {
@@ -1691,14 +1779,14 @@ var ProviderRegistry = class {
     }
     return this.#status(saved);
   }
-  /** Remove a provider's profile and its secret together. */
-  async delete(providerId) {
-    const removed = await this.#profiles.delete(providerId);
-    await this.#secrets.delete(modelProviderSecretName(providerId));
+  /** Remove a profile and its secret together. */
+  async delete(profileRef) {
+    const removed = await this.#profiles.delete(profileRef);
+    await this.#secrets.delete(modelProviderSecretName(profileRef));
     return removed;
   }
-  async get(providerId) {
-    const profile = await this.#profiles.get(providerId);
+  async get(profileRef) {
+    const profile = await this.#profiles.get(profileRef);
     return profile === void 0 ? void 0 : this.#status(profile);
   }
   async list() {
@@ -1717,27 +1805,32 @@ var ProviderRegistry = class {
     const profile = await this.#profiles.getEnabled();
     if (profile === void 0) return void 0;
     const secret = await this.#secrets.get(
-      modelProviderSecretName(profile.provider_id)
+      modelProviderSecretName(profile.profile_ref)
     );
     const options = { fetchImpl: this.#fetch, profile, secret };
     return profile.adapter === "anthropic" ? new AnthropicMessagesClient(options) : new OpenAiCompatibleChatClient(options);
   }
-  /** Switch which configured provider is the default. */
-  async setDefaultModelProvider(providerId) {
-    return this.#status(await this.#profiles.setEnabled(providerId));
+  /** Switch which configured profile is the default. */
+  async setDefaultModelProvider(profileRef) {
+    return this.#status(await this.#profiles.setEnabled(profileRef));
   }
   async #status(profile) {
+    const binding = exactProviderProfileBinding(profile, []);
     return {
       adapter: profile.adapter,
       auth_mode: profile.auth_mode,
       base_url: profile.base_url,
+      capabilities: profile.capabilities,
       created_at: profile.created_at,
       display_name: profile.display_name,
       enabled: profile.enabled,
       model: profile.model,
-      provider_id: profile.provider_id,
+      profile_ref: profile.profile_ref,
+      profile_revision: binding.profileRevision,
+      profile_hash: binding.profileHash,
+      provider_kind: profile.provider_kind,
       secret_configured: await this.#secrets.has(
-        modelProviderSecretName(profile.provider_id)
+        modelProviderSecretName(profile.profile_ref)
       ),
       updated_at: profile.updated_at
     };
@@ -1746,11 +1839,11 @@ var ProviderRegistry = class {
 
 // src/pi-provider-projection.ts
 var PI_PROJECTED_KEY_ENV = "PI_PROVIDER_API_KEY";
-function piProjectionProviderId(profileProviderId) {
-  return `byok-sdk-${profileProviderId}`;
+function piProjectionProviderId(profileRef) {
+  return `byok-sdk-${profileRef}`;
 }
 function buildPiProviderProjection(profile) {
-  const projectedProviderId = piProjectionProviderId(profile.provider_id);
+  const projectedProviderId = piProjectionProviderId(profile.profile_ref);
   return {
     providers: {
       [projectedProviderId]: {
@@ -1761,7 +1854,11 @@ function buildPiProviderProjection(profile) {
         models: [
           {
             id: profile.model,
-            name: profile.display_name
+            name: profile.display_name,
+            input: [
+              "text",
+              ...profile.capabilities.includes("image-input") ? ["image"] : []
+            ]
           }
         ]
       }
@@ -1769,6 +1866,6 @@ function buildPiProviderProjection(profile) {
   };
 }
 
-export { AnthropicMessagesClient, BYOK_KEYS_ERROR_CODES, ByokKeysError, DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX, DEFAULT_SECRET_ENVELOPE_PREFIX, DEFAULT_SECRET_SERVICE_PREFIX, EnvelopeScopedSecretStore, InMemoryProviderProfileStore, InMemorySecretStore, MODEL_PROVIDER_ADAPTERS, MODEL_PROVIDER_IDS, MODEL_PROVIDER_SECRET_NAMES, MacOsKeychainSecretStore, ModelProviderProfileSchema, OpenAiCompatibleChatClient, PI_PROJECTED_KEY_ENV, PROVIDER_AUTH_MODES, PROVIDER_PROFILE_TRUTH_RECORD_KEY, PROVIDER_RESPONSE_MAX_BYTES, PROVIDER_TIMEOUT_MS, ProviderRegistry, SECRET_NAMESPACE_PATTERN, SECRET_NAME_PATTERN, SqliteProviderProfileStore, TruthStoreProviderProfileStore, WindowsCredentialManagerSecretStore, anthropicMessageText, assertLiveModelResponse, assertSecretName, assertSecretNamespace, assertSharedSecretValue, buildPiProviderProjection, chatCompletionText, classifyModelProviderHttpError, decodeStrictBase64Utf8, fetchWithProviderGuards, isLoopbackHost, isLoopbackProviderUrl, isPrivateNetworkLiteral, isSqliteAvailable, loadSqliteModule, modelApiUrl, modelMessageText, modelProviderSecretName, normalizeProviderUrl, objectValue, openSqliteDatabase, parseBoundedJsonResponse, parseModelProviderProfile, providerHeaders, readModelProviderResponse, requiredProviderSecret, runCommand, scopeSecretStore, secretScopeId, secureSqliteFilePermissions };
+export { AnthropicMessagesClient, BYOK_KEYS_ERROR_CODES, ByokKeysError, DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX, DEFAULT_SECRET_ENVELOPE_PREFIX, DEFAULT_SECRET_SERVICE_PREFIX, EnvelopeScopedSecretStore, InMemoryProviderProfileStore, InMemorySecretStore, MODEL_PROVIDER_ADAPTERS, MODEL_PROVIDER_KINDS, MacOsKeychainSecretStore, ModelProviderProfileSchema, OpenAiCompatibleChatClient, PI_PROJECTED_KEY_ENV, PROVIDER_AUTH_MODES, PROVIDER_MODEL_CAPABILITIES, PROVIDER_PROFILE_TRUTH_RECORD_KEY, PROVIDER_RESPONSE_MAX_BYTES, PROVIDER_TIMEOUT_MS, ProviderModelCapabilitySchema, ProviderProfileRefSchema, ProviderRegistry, SECRET_NAMESPACE_PATTERN, SECRET_NAME_PATTERN, SqliteProviderProfileStore, TruthStoreProviderProfileStore, WindowsCredentialManagerSecretStore, anthropicMessageText, assertExactProviderProfileBinding, assertLiveModelResponse, assertSecretName, assertSecretNamespace, assertSharedSecretValue, buildPiProviderProjection, chatCompletionText, classifyModelProviderHttpError, decodeStrictBase64Utf8, exactProviderProfileBinding, fetchWithProviderGuards, isLoopbackHost, isLoopbackProviderUrl, isPrivateNetworkLiteral, isSqliteAvailable, loadSqliteModule, modelApiUrl, modelMessageText, modelProviderSecretName, normalizeProviderUrl, objectValue, openSqliteDatabase, parseBoundedJsonResponse, parseModelProviderProfile, providerHeaders, readModelProviderResponse, requiredProviderSecret, runCommand, scopeSecretStore, secretScopeId, secureSqliteFilePermissions };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map