@byok-sdk/keys 0.4.2 → 0.5.0

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export { ByokKeysError, BYOK_KEYS_ERROR_CODES } from './errors';
 export type { ByokKeysErrorCode } from './errors';
+export { PiModelConfigSchema, PI_THINKING_LEVELS } from './pi-model-config';
+export type { PiModelConfig } from './pi-model-config';
 export { MODEL_PROVIDER_ADAPTERS, MODEL_PROVIDER_KINDS, PROVIDER_AUTH_MODES, PROVIDER_MODEL_CAPABILITIES, ModelProviderProfileSchema, ProviderModelCapabilitySchema, ProviderProfileRefSchema, parseModelProviderProfile, exactProviderProfileBinding, assertExactProviderProfileBinding, } from './provider-profile';
 export type { ModelProviderAdapter, ModelProviderKind, ModelProviderProfile, ModelProviderProfileInput, ExactProviderProfileBinding, ProviderAuthMode, ProviderModelCapability, ProviderProfileRef, } from './provider-profile';
 export { MODEL_PROVIDER_VENDORS, MODEL_PROVIDER_VENDOR_IDS, modelProviderVendor, } from './provider-catalog';

package/dist/index.js

@@ -56,6 +56,54 @@ var BYOK_KEYS_ERROR_CODES = {
   SECRET_NAMESPACE_INVALID: "SECRET_NAMESPACE_INVALID",
   SECRET_VALUE_INVALID: "SECRET_VALUE_INVALID"
 };
+var PI_THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
+var effort = z.string().min(1).max(64).regex(/^[a-zA-Z0-9_-]+$/u).nullable();
+var PiModelConfigSchema = z.object({
+  contextWindow: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  maxTokens: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  reasoning: z.boolean(),
+  thinkingLevel: z.enum(PI_THINKING_LEVELS),
+  thinkingLevelMap: z.object({
+    off: effort,
+    minimal: effort,
+    low: effort,
+    medium: effort,
+    high: effort,
+    xhigh: effort,
+    max: effort
+  }).strict(),
+  compat: z.object({
+    supportsStore: z.boolean().optional(),
+    supportsDeveloperRole: z.boolean().optional(),
+    supportsReasoningEffort: z.boolean().optional(),
+    supportsUsageInStreaming: z.boolean().optional(),
+    maxTokensField: z.enum(["max_completion_tokens", "max_tokens"]).optional(),
+    thinkingFormat: z.enum([
+      "openai",
+      "openrouter",
+      "deepseek",
+      "together",
+      "baseten",
+      "zai",
+      "qwen",
+      "chat-template",
+      "qwen-chat-template",
+      "string-thinking",
+      "ant-ling"
+    ]).optional(),
+    zaiToolStream: z.boolean().optional()
+  }).strict()
+}).strict().superRefine((config, ctx) => {
+  if (config.maxTokens > config.contextWindow) {
+    ctx.addIssue({ code: "custom", path: ["maxTokens"], message: "Pi maximum output cannot exceed its context window" });
+  }
+  if (config.reasoning && config.thinkingLevelMap[config.thinkingLevel] === null) {
+    ctx.addIssue({ code: "custom", path: ["thinkingLevel"], message: "Pi thinking level is not supported by the declared model" });
+  }
+  if (!config.reasoning && config.thinkingLevel !== "off") {
+    ctx.addIssue({ code: "custom", path: ["thinkingLevel"], message: "Non-reasoning Pi models require thinking off" });
+  }
+});
 
 // src/provider-catalog.ts
 function openAiCompatible(display_name, base_url, api_key_env) {
@@ -239,6 +287,8 @@ var ModelProviderProfileSchema = z.object({
   enabled: z.boolean(),
   kind: z.literal("model"),
   model: boundedString("model", 160),
+  // Direct transports do not use Pi; Pi admission requires this explicit configuration.
+  pi_model: PiModelConfigSchema.optional(),
   profile_ref: ProviderProfileRefSchema,
   provider_kind: z.enum(MODEL_PROVIDER_KINDS),
   updated_at: isoTimestamp("updated_at")
@@ -297,6 +347,7 @@ function exactProviderProfileBinding(profileInput, requiredCapabilities = profil
     capabilities: normalizedCapabilities,
     kind: profile.kind,
     model: profile.model,
+    ...profile.pi_model === void 0 ? {} : { pi_model: profile.pi_model },
     profile_ref: profile.profile_ref,
     provider_kind: profile.provider_kind
   });
@@ -1423,6 +1474,7 @@ CREATE TABLE IF NOT EXISTS provider_profile (
   base_url      TEXT NOT NULL,
   auth_mode     TEXT NOT NULL CHECK (auth_mode IN (${sqlList(PROVIDER_AUTH_MODES)})),
   model         TEXT NOT NULL,
+  pi_model      TEXT,
   capabilities  TEXT NOT NULL,
   enabled       INTEGER NOT NULL CHECK (enabled IN (0, 1)),
   created_at    TEXT NOT NULL,
@@ -1441,7 +1493,7 @@ function assertProviderProfileSchemaIsCurrent(database, path2) {
   if (normalizeTableDdl(stored) === normalizeTableDdl(SCHEMA)) return;
   throw new ByokKeysError(
     "PROVIDER_STORE_SCHEMA_STALE",
-    `Provider profile store at ${path2} was created by a different @byok-sdk/keys schema; recreate the store file to continue`
+    `Provider profile store at ${path2} was created by a different @byok-sdk/keys schema; preserve this store and explicitly provision a separate current-schema store before continuing`
   );
 }
 var ENABLED_INDEX = `
@@ -1523,8 +1575,8 @@ var SqliteProviderProfileStore = class {
       this.#database.prepare(
         `INSERT INTO provider_profile (
              profile_ref, provider_kind, kind, adapter, display_name, base_url,
-             auth_mode, model, capabilities, enabled, created_at, updated_at
-           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+             auth_mode, model, pi_model, capabilities, enabled, created_at, updated_at
+           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
            ON CONFLICT(profile_ref) DO UPDATE SET
              provider_kind = excluded.provider_kind,
              adapter = excluded.adapter,
@@ -1532,6 +1584,7 @@ var SqliteProviderProfileStore = class {
              base_url = excluded.base_url,
              auth_mode = excluded.auth_mode,
              model = excluded.model,
+             pi_model = excluded.pi_model,
              capabilities = excluded.capabilities,
              enabled = excluded.enabled,
              updated_at = excluded.updated_at`
@@ -1544,6 +1597,7 @@ var SqliteProviderProfileStore = class {
         validated.base_url,
         validated.auth_mode,
         validated.model,
+        validated.pi_model === void 0 ? null : JSON.stringify(validated.pi_model),
         JSON.stringify(validated.capabilities),
         validated.enabled ? 1 : 0,
         validated.created_at,
@@ -1582,6 +1636,7 @@ function parseRow(row) {
   }
   return parseModelProviderProfile({
     ...row,
+    pi_model: row.pi_model === null ? void 0 : JSON.parse(row.pi_model),
     capabilities,
     enabled: row.enabled === 1
   });
@@ -1717,6 +1772,7 @@ function encodeRegistry(profiles) {
       enabled: profile.enabled,
       kind: profile.kind,
       model: profile.model,
+      ...profile.pi_model === void 0 ? {} : { pi_model: profile.pi_model },
       profile_ref: profile.profile_ref,
       provider_kind: profile.provider_kind,
       updated_at: profile.updated_at
@@ -1756,7 +1812,10 @@ function decodeRegistryRecord(record, tenant) {
   let profiles;
   try {
     profiles = raw.profiles.map((candidate) => {
-      if (!isPlainRecord(candidate) || !hasExactKeys(candidate, PROFILE_KEYS)) {
+      if (!isPlainRecord(candidate) || !hasExactKeys(
+        candidate,
+        Object.hasOwn(candidate, "pi_model") ? [...PROFILE_KEYS, "pi_model"] : PROFILE_KEYS
+      )) {
         throw invalidTruth("Provider profile TruthStore body contains an unknown profile field");
       }
       return parseModelProviderProfile(candidate);
@@ -1944,6 +2003,7 @@ var ProviderRegistry = class {
       display_name: profile.display_name,
       enabled: profile.enabled,
       model: profile.model,
+      ...profile.pi_model === void 0 ? {} : { pi_model: profile.pi_model },
       profile_ref: profile.profile_ref,
       profile_revision: binding.profileRevision,
       profile_hash: binding.profileHash,
@@ -1955,13 +2015,12 @@ var ProviderRegistry = class {
     };
   }
 };
-
-// src/pi-provider-projection.ts
 var PI_PROJECTED_KEY_ENV = "PI_PROVIDER_API_KEY";
 function piProjectionProviderId(profileRef) {
   return `byok-sdk-${profileRef}`;
 }
 function buildPiProviderProjection(profile) {
+  const { thinkingLevel: _, ...modelSettings } = requirePiModelConfig(profile);
   const projectedProviderId = piProjectionProviderId(profile.profile_ref);
   return {
     providers: {
@@ -1972,6 +2031,7 @@ function buildPiProviderProjection(profile) {
         ...profile.auth_mode === "bearer" ? { authHeader: true } : {},
         models: [
           {
+            ...modelSettings,
             id: profile.model,
             name: profile.display_name,
             input: [
@@ -1984,7 +2044,11 @@ function buildPiProviderProjection(profile) {
     }
   };
 }
+function requirePiModelConfig(profile) {
+  if (profile.pi_model === void 0) throw new Error("Pi execution requires explicit pi_model configuration");
+  return PiModelConfigSchema.parse(profile.pi_model);
+}
 
-export { AnthropicMessagesClient, BYOK_KEYS_ERROR_CODES, ByokKeysError, DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX, DEFAULT_SECRET_ENVELOPE_PREFIX, DEFAULT_SECRET_SERVICE_PREFIX, EnvelopeScopedSecretStore, InMemoryProviderProfileStore, InMemorySecretStore, MODEL_PROVIDER_ADAPTERS, MODEL_PROVIDER_KINDS, MODEL_PROVIDER_VENDORS, MODEL_PROVIDER_VENDOR_IDS, MacOsKeychainSecretStore, ModelProviderProfileSchema, OpenAiCompatibleChatClient, PI_PROJECTED_KEY_ENV, PROVIDER_AUTH_MODES, PROVIDER_MODEL_CAPABILITIES, PROVIDER_PROFILE_TRUTH_RECORD_KEY, PROVIDER_RESPONSE_MAX_BYTES, PROVIDER_TIMEOUT_MS, ProviderModelCapabilitySchema, ProviderProfileRefSchema, ProviderRegistry, SECRET_NAMESPACE_PATTERN, SECRET_NAME_PATTERN, SqliteProviderProfileStore, TruthStoreProviderProfileStore, WindowsCredentialManagerSecretStore, anthropicMessageText, assertExactProviderProfileBinding, assertLiveModelResponse, assertSecretName, assertSecretNamespace, assertSharedSecretValue, buildPiProviderProjection, chatCompletionText, classifyModelProviderHttpError, decodeStrictBase64Utf8, exactProviderProfileBinding, fetchWithProviderGuards, isLoopbackHost, isLoopbackProviderUrl, isPrivateNetworkLiteral, isSqliteAvailable, loadSqliteModule, modelApiUrl, modelMessageText, modelProviderSecretName, modelProviderVendor, normalizeProviderUrl, objectValue, openSqliteDatabase, parseBoundedJsonResponse, parseModelProviderProfile, providerHeaders, readModelProviderResponse, requiredProviderSecret, runCommand, scopeSecretStore, secretScopeId, secureSqliteFilePermissions };
+export { AnthropicMessagesClient, BYOK_KEYS_ERROR_CODES, ByokKeysError, DEFAULT_KEYCHAIN_SECRET_STORAGE_PREFIX, DEFAULT_SECRET_ENVELOPE_PREFIX, DEFAULT_SECRET_SERVICE_PREFIX, EnvelopeScopedSecretStore, InMemoryProviderProfileStore, InMemorySecretStore, MODEL_PROVIDER_ADAPTERS, MODEL_PROVIDER_KINDS, MODEL_PROVIDER_VENDORS, MODEL_PROVIDER_VENDOR_IDS, MacOsKeychainSecretStore, ModelProviderProfileSchema, OpenAiCompatibleChatClient, PI_PROJECTED_KEY_ENV, PI_THINKING_LEVELS, PROVIDER_AUTH_MODES, PROVIDER_MODEL_CAPABILITIES, PROVIDER_PROFILE_TRUTH_RECORD_KEY, PROVIDER_RESPONSE_MAX_BYTES, PROVIDER_TIMEOUT_MS, PiModelConfigSchema, ProviderModelCapabilitySchema, ProviderProfileRefSchema, ProviderRegistry, SECRET_NAMESPACE_PATTERN, SECRET_NAME_PATTERN, SqliteProviderProfileStore, TruthStoreProviderProfileStore, WindowsCredentialManagerSecretStore, anthropicMessageText, assertExactProviderProfileBinding, assertLiveModelResponse, assertSecretName, assertSecretNamespace, assertSharedSecretValue, buildPiProviderProjection, chatCompletionText, classifyModelProviderHttpError, decodeStrictBase64Utf8, exactProviderProfileBinding, fetchWithProviderGuards, isLoopbackHost, isLoopbackProviderUrl, isPrivateNetworkLiteral, isSqliteAvailable, loadSqliteModule, modelApiUrl, modelMessageText, modelProviderSecretName, modelProviderVendor, normalizeProviderUrl, objectValue, openSqliteDatabase, parseBoundedJsonResponse, parseModelProviderProfile, providerHeaders, readModelProviderResponse, requiredProviderSecret, runCommand, scopeSecretStore, secretScopeId, secureSqliteFilePermissions };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map