@multiplayer-app/ai-agent-node 0.1.0-beta.70 → 0.1.0-beta.72

package/dist/esm/services/ProviderClientFactory.d.ts

@@ -0,0 +1,9 @@
+import type { LanguageModel } from 'ai';
+import type { ModelOption } from '@multiplayer-app/ai-agent-types';
+export declare class ProviderClientFactory {
+    createLanguageModel(model: ModelOption, params: {
+        apiKey: string;
+        baseUrl?: string;
+    }, websearchEnabled?: boolean): LanguageModel;
+}
+//# sourceMappingURL=ProviderClientFactory.d.ts.map

package/dist/esm/services/ProviderClientFactory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProviderClientFactory.d.ts","sourceRoot":"","sources":["../../../src/services/ProviderClientFactory.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEnE,qBAAa,qBAAqB;IAChC,mBAAmB,CACjB,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5C,gBAAgB,UAAQ,GACvB,aAAa;CAsBjB"}

package/dist/esm/services/ProviderClientFactory.js

@@ -0,0 +1,25 @@
+import { createOpenAI } from '@ai-sdk/openai';
+import { createAnthropic } from '@ai-sdk/anthropic';
+import { createGoogleGenerativeAI } from '@ai-sdk/google';
+import { createOpenRouter } from '@openrouter/ai-sdk-provider';
+export class ProviderClientFactory {
+    createLanguageModel(model, params, websearchEnabled = false) {
+        const provider = model.provider || 'openai';
+        const providerConfig = params.baseUrl
+            ? { apiKey: params.apiKey, baseURL: params.baseUrl }
+            : { apiKey: params.apiKey };
+        switch (provider) {
+            case 'openai':
+                return createOpenAI(providerConfig)(model.id);
+            case 'anthropic':
+                return createAnthropic(providerConfig)(model.id);
+            case 'google':
+                return createGoogleGenerativeAI(providerConfig)(model.id);
+            case 'openrouter':
+                return createOpenRouter(providerConfig)(model.id, { plugins: websearchEnabled ? [{ id: 'web', engine: undefined, max_results: 2 }] : [] });
+            default:
+                throw new Error(`Unsupported provider: ${provider}`);
+        }
+    }
+}
+//# sourceMappingURL=ProviderClientFactory.js.map

package/dist/esm/services/ProviderClientFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProviderClientFactory.js","sourceRoot":"","sources":["../../../src/services/ProviderClientFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAI/D,MAAM,OAAO,qBAAqB;IAChC,mBAAmB,CACjB,KAAkB,EAClB,MAA4C,EAC5C,gBAAgB,GAAG,KAAK;QAExB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC;QAC5C,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO;YACnC,CAAC,CAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAY;YAC/D,CAAC,CAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAY,CAAC;QAEzC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,QAAQ;gBACX,OAAO,YAAY,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChD,KAAK,WAAW;gBACd,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnD,KAAK,QAAQ;gBACX,OAAO,wBAAwB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5D,KAAK,YAAY;gBACf,OAAO,gBAAgB,CAAC,cAAc,CAAC,CACrC,KAAK,CAAC,EAAE,EACR,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5D,CAAC;YAChC;gBACE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;CACF"}

package/dist/esm/services/TenantCredentialResolver.d.ts

@@ -0,0 +1,32 @@
+import type { AIProvider } from '@multiplayer-app/ai-agent-types';
+import type { TenantAICredentialRepository } from '@multiplayer-app/ai-agent-db';
+import type { Config } from '../config';
+export type AICredentials = Partial<Pick<Config['ai'], 'openaiApiKey' | 'anthropicApiKey' | 'googleApiKey' | 'openrouterApiKey' | 'openaiBaseUrl' | 'anthropicBaseUrl' | 'googleBaseUrl' | 'openrouterBaseUrl'>>;
+export declare function getTenantKey(tenants: Record<string, string>): string;
+export declare class TenantCredentialResolver {
+    private readonly repository;
+    private readonly baseConfig;
+    constructor(repository: TenantAICredentialRepository | undefined, baseConfig: Config['ai']);
+    private getKeyMaterial;
+    encryptApiKey(apiKey: string): string;
+    decryptApiKey(encryptedApiKey: string): string;
+    resolveCredentials(tenants?: Record<string, string>): Promise<AICredentials>;
+    upsertCredential(params: {
+        tenants: Record<string, string>;
+        provider: AIProvider;
+        apiKey: string;
+        baseUrl?: string;
+    }): Promise<{
+        tenantKey: string;
+        provider: AIProvider;
+    }>;
+    listProviders(tenants: Record<string, string>): Promise<{
+        tenantKey: string;
+        providers: AIProvider[];
+    }>;
+    deleteCredential(params: {
+        tenants: Record<string, string>;
+        provider: AIProvider;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=TenantCredentialResolver.d.ts.map

package/dist/esm/services/TenantCredentialResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantCredentialResolver.d.ts","sourceRoot":"","sources":["../../../src/services/TenantCredentialResolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGxC,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CACtC,MAAM,CAAC,IAAI,CAAC,EACV,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,kBAAkB,GAClB,eAAe,GACf,kBAAkB,GAClB,eAAe,GACf,mBAAmB,CACtB,CAAC,CAAC;AAIH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAKpE;AA4BD,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,UAAU,EAAE,4BAA4B,GAAG,SAAS,EACpD,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;IAG3C,OAAO,CAAC,cAAc;IAQtB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAQrC,aAAa,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM;IAkBxC,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;IAgC5E,gBAAgB,CAAC,MAAM,EAAE;QAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,QAAQ,EAAE,UAAU,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,UAAU,CAAA;KAAE,CAAC;IAmBlD,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAevG,gBAAgB,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,QAAQ,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAU5G"}

package/dist/esm/services/TenantCredentialResolver.js

@@ -0,0 +1,133 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'crypto';
+import { logger } from '../libs/logger';
+const ENCRYPTION_VERSION = 'v1';
+export function getTenantKey(tenants) {
+    const entries = Object.entries(tenants)
+        .filter(([key, value]) => key.trim().length > 0 && value.trim().length > 0)
+        .sort(([left], [right]) => left.localeCompare(right));
+    return entries.map(([key, value]) => `${key}=${value}`).join('|');
+}
+function mapProviderToConfigField(provider) {
+    switch (provider) {
+        case 'openai':
+            return 'openaiApiKey';
+        case 'anthropic':
+            return 'anthropicApiKey';
+        case 'google':
+            return 'googleApiKey';
+        case 'openrouter':
+            return 'openrouterApiKey';
+    }
+}
+function mapProviderToBaseUrlField(provider) {
+    switch (provider) {
+        case 'openai':
+            return 'openaiBaseUrl';
+        case 'anthropic':
+            return 'anthropicBaseUrl';
+        case 'google':
+            return 'googleBaseUrl';
+        case 'openrouter':
+            return 'openrouterBaseUrl';
+    }
+}
+export class TenantCredentialResolver {
+    repository;
+    baseConfig;
+    constructor(repository, baseConfig) {
+        this.repository = repository;
+        this.baseConfig = baseConfig;
+    }
+    getKeyMaterial() {
+        const secret = this.baseConfig.credentialsEncryptionKey;
+        if (!secret || secret.length < 16) {
+            throw new Error('Missing MP_AI_CREDENTIALS_ENCRYPTION_KEY. Set at least 16 characters.');
+        }
+        return createHash('sha256').update(secret).digest();
+    }
+    encryptApiKey(apiKey) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv('aes-256-gcm', this.getKeyMaterial(), iv);
+        const encrypted = Buffer.concat([cipher.update(apiKey, 'utf8'), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return `${ENCRYPTION_VERSION}:${iv.toString('base64')}:${tag.toString('base64')}:${encrypted.toString('base64')}`;
+    }
+    decryptApiKey(encryptedApiKey) {
+        const [version, iv64, tag64, payload64] = encryptedApiKey.split(':');
+        if (version !== ENCRYPTION_VERSION || !iv64 || !tag64 || !payload64) {
+            throw new Error('Unsupported credential encryption format');
+        }
+        const decipher = createDecipheriv('aes-256-gcm', this.getKeyMaterial(), Buffer.from(iv64, 'base64'));
+        decipher.setAuthTag(Buffer.from(tag64, 'base64'));
+        const decrypted = Buffer.concat([
+            decipher.update(Buffer.from(payload64, 'base64')),
+            decipher.final(),
+        ]);
+        return decrypted.toString('utf8');
+    }
+    async resolveCredentials(tenants) {
+        if (!this.repository || !tenants || Object.keys(tenants).length === 0) {
+            return {};
+        }
+        const tenantKey = getTenantKey(tenants);
+        if (!tenantKey) {
+            return {};
+        }
+        const credentials = await this.repository.findByTenantKey(tenantKey);
+        return credentials.reduce((acc, credential) => {
+            try {
+                const field = mapProviderToConfigField(credential.provider);
+                acc[field] = this.decryptApiKey(credential.encryptedApiKey);
+                if (credential.baseUrl) {
+                    const baseUrlField = mapProviderToBaseUrlField(credential.provider);
+                    acc[baseUrlField] = credential.baseUrl;
+                }
+            }
+            catch (error) {
+                logger.warn({
+                    error: error instanceof Error ? error.message : 'Unknown error',
+                    provider: credential.provider,
+                    tenantKey,
+                }, 'Failed to decrypt tenant credential; skipping provider');
+            }
+            return acc;
+        }, {});
+    }
+    async upsertCredential(params) {
+        if (!this.repository) {
+            throw new Error('Tenant credential repository is not configured');
+        }
+        const tenantKey = getTenantKey(params.tenants);
+        if (!tenantKey) {
+            throw new Error('tenants must include at least one non-empty key/value');
+        }
+        const encryptedApiKey = this.encryptApiKey(params.apiKey);
+        await this.repository.upsertByTenantKeyAndProvider(tenantKey, params.tenants, params.provider, encryptedApiKey, params.baseUrl);
+        return { tenantKey, provider: params.provider };
+    }
+    async listProviders(tenants) {
+        if (!this.repository) {
+            return { tenantKey: '', providers: [] };
+        }
+        const tenantKey = getTenantKey(tenants);
+        if (!tenantKey) {
+            return { tenantKey: '', providers: [] };
+        }
+        const credentials = await this.repository.findByTenantKey(tenantKey);
+        return {
+            tenantKey,
+            providers: credentials.map((credential) => credential.provider),
+        };
+    }
+    async deleteCredential(params) {
+        if (!this.repository) {
+            return false;
+        }
+        const tenantKey = getTenantKey(params.tenants);
+        if (!tenantKey) {
+            return false;
+        }
+        return this.repository.deleteByTenantKeyAndProvider(tenantKey, params.provider);
+    }
+}
+//# sourceMappingURL=TenantCredentialResolver.js.map

package/dist/esm/services/TenantCredentialResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantCredentialResolver.js","sourceRoot":"","sources":["../../../src/services/TenantCredentialResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAInF,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAcxC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,MAAM,UAAU,YAAY,CAAC,OAA+B;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACpC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SAC1E,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAoB;IACpD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC;QACxB,KAAK,WAAW;YACd,OAAO,iBAAiB,CAAC;QAC3B,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC;QACxB,KAAK,YAAY;YACf,OAAO,kBAAkB,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAoB;IACrD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC;QACzB,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC;QAC5B,KAAK,QAAQ;YACX,OAAO,eAAe,CAAC;QACzB,KAAK,YAAY;YACf,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,OAAO,wBAAwB;IAEhB;IACA;IAFnB,YACmB,UAAoD,EACpD,UAAwB;QADxB,eAAU,GAAV,UAAU,CAA0C;QACpD,eAAU,GAAV,UAAU,CAAc;IACxC,CAAC;IAEI,cAAc;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC;QACxD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IAED,aAAa,CAAC,MAAc;QAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,GAAG,kBAAkB,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpH,CAAC;IAED,aAAa,CAAC,eAAuB;QACnC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,OAAO,KAAK,kBAAkB,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,IAAI,CAAC,cAAc,EAAE,EACrB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAC5B,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACjD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAgC;QACvD,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;YAC5C,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,wBAAwB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC5D,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBAC5D,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;oBACvB,MAAM,YAAY,GAAG,yBAAyB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;oBACpE,GAAG,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC;gBACzC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CACT;oBACE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;oBAC/D,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,SAAS;iBACV,EACD,wDAAwD,CACzD,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAAmB,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAKtB;QACC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,UAAU,CAAC,4BAA4B,CAChD,SAAS,EACT,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,QAAQ,EACf,eAAe,EACf,MAAM,CAAC,OAAO,CACf,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAA+B;QACjD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACrE,OAAO;YACL,SAAS;YACT,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAiE;QACtF,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,4BAA4B,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClF,CAAC;CACF"}

package/dist/esm/services/TenantCredentialResolver.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=TenantCredentialResolver.test.d.ts.map

package/dist/esm/services/TenantCredentialResolver.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantCredentialResolver.test.d.ts","sourceRoot":"","sources":["../../../src/services/TenantCredentialResolver.test.ts"],"names":[],"mappings":""}

package/dist/esm/services/TenantCredentialResolver.test.js

@@ -0,0 +1,111 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { TenantCredentialResolver, getTenantKey } from './TenantCredentialResolver';
+describe('TenantCredentialResolver', () => {
+    let repository;
+    let resolver;
+    beforeEach(() => {
+        repository = {
+            findByTenantKey: vi.fn(),
+            findByTenantKeyAndProvider: vi.fn(),
+            upsertByTenantKeyAndProvider: vi.fn(),
+            deleteByTenantKeyAndProvider: vi.fn(),
+            findById: vi.fn(),
+            find: vi.fn(),
+            findOne: vi.fn(),
+            create: vi.fn(),
+            update: vi.fn(),
+            delete: vi.fn(),
+            exists: vi.fn(),
+            count: vi.fn(),
+        };
+        resolver = new TenantCredentialResolver(repository, {
+            credentialsEncryptionKey: '0123456789abcdef0123456789abcdef',
+        });
+    });
+    it('creates stable tenantKey from sorted non-empty entries', () => {
+        const tenantKey = getTenantKey({
+            accountId: 'acme',
+            orgId: 'north',
+            ignored: '',
+        });
+        expect(tenantKey).toBe('accountId=acme|orgId=north');
+    });
+    it('upserts encrypted api key with optional baseUrl', async () => {
+        repository.upsertByTenantKeyAndProvider.mockResolvedValue({
+            id: 'cred-1',
+        });
+        await resolver.upsertCredential({
+            tenants: { accountId: 'acme' },
+            provider: 'openai',
+            apiKey: 'raw-openai-key',
+            baseUrl: 'https://tenant.openai.local',
+        });
+        expect(repository.upsertByTenantKeyAndProvider).toHaveBeenCalledTimes(1);
+        const callArgs = repository.upsertByTenantKeyAndProvider.mock.calls[0];
+        expect(callArgs[0]).toBe('accountId=acme');
+        expect(callArgs[1]).toEqual({ accountId: 'acme' });
+        expect(callArgs[2]).toBe('openai');
+        expect(callArgs[3]).not.toBe('raw-openai-key');
+        expect(String(callArgs[3])).toMatch(/^v1:/);
+        expect(callArgs[4]).toBe('https://tenant.openai.local');
+    });
+    it('resolves api keys and optional baseUrls by provider', async () => {
+        const encryptedOpenAIKey = resolver.encryptApiKey('tenant-openai-key');
+        const encryptedAnthropicKey = resolver.encryptApiKey('tenant-anthropic-key');
+        repository.findByTenantKey.mockResolvedValue([
+            {
+                id: 'cred-openai',
+                tenantKey: 'accountId=acme',
+                tenants: { accountId: 'acme' },
+                provider: 'openai',
+                encryptedApiKey: encryptedOpenAIKey,
+                baseUrl: 'https://tenant.openai.local',
+                createdAt: new Date().toISOString(),
+                updatedAt: new Date().toISOString(),
+            },
+            {
+                id: 'cred-anthropic',
+                tenantKey: 'accountId=acme',
+                tenants: { accountId: 'acme' },
+                provider: 'anthropic',
+                encryptedApiKey: encryptedAnthropicKey,
+                createdAt: new Date().toISOString(),
+                updatedAt: new Date().toISOString(),
+            },
+        ]);
+        const result = await resolver.resolveCredentials({ accountId: 'acme' });
+        expect(result).toEqual({
+            openaiApiKey: 'tenant-openai-key',
+            openaiBaseUrl: 'https://tenant.openai.local',
+            anthropicApiKey: 'tenant-anthropic-key',
+        });
+    });
+    it('skips malformed encrypted records and still resolves valid credentials', async () => {
+        const encryptedOpenAIKey = resolver.encryptApiKey('tenant-openai-key');
+        repository.findByTenantKey.mockResolvedValue([
+            {
+                id: 'cred-bad',
+                tenantKey: 'accountId=acme',
+                tenants: { accountId: 'acme' },
+                provider: 'google',
+                encryptedApiKey: 'malformed',
+                createdAt: new Date().toISOString(),
+                updatedAt: new Date().toISOString(),
+            },
+            {
+                id: 'cred-good',
+                tenantKey: 'accountId=acme',
+                tenants: { accountId: 'acme' },
+                provider: 'openai',
+                encryptedApiKey: encryptedOpenAIKey,
+                createdAt: new Date().toISOString(),
+                updatedAt: new Date().toISOString(),
+            },
+        ]);
+        const result = await resolver.resolveCredentials({ accountId: 'acme' });
+        expect(result).toEqual({
+            openaiApiKey: 'tenant-openai-key',
+        });
+    });
+});
+//# sourceMappingURL=TenantCredentialResolver.test.js.map

package/dist/esm/services/TenantCredentialResolver.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantCredentialResolver.test.js","sourceRoot":"","sources":["../../../src/services/TenantCredentialResolver.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAGpF,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,UAAwC,CAAC;IAC7C,IAAI,QAAkC,CAAC;IAEvC,UAAU,CAAC,GAAG,EAAE;QACd,UAAU,GAAG;YACX,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;YACxB,0BAA0B,EAAE,EAAE,CAAC,EAAE,EAAE;YACnC,4BAA4B,EAAE,EAAE,CAAC,EAAE,EAAE;YACrC,4BAA4B,EAAE,EAAE,CAAC,EAAE,EAAE;YACrC,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;YACjB,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;YACb,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;YAChB,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;YACf,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;YACf,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;YACf,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;YACf,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;SAC4B,CAAC;QAE7C,QAAQ,GAAG,IAAI,wBAAwB,CAAC,UAAU,EAAE;YAClD,wBAAwB,EAAE,kCAAkC;SAC7D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,SAAS,GAAG,YAAY,CAAC;YAC7B,SAAS,EAAE,MAAM;YACjB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC9D,UAAU,CAAC,4BAAoE,CAAC,iBAAiB,CAAC;YACjG,EAAE,EAAE,QAAQ;SACb,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,gBAAgB,CAAC;YAC9B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,6BAA6B;SACvC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAI,UAAU,CAAC,4BAAoE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChH,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,kBAAkB,GAAG,QAAQ,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;QACvE,MAAM,qBAAqB,GAAG,QAAQ,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;QAE5E,UAAU,CAAC,eAAuD,CAAC,iBAAiB,CAAC;YACpF;gBACE,EAAE,EAAE,aAAa;gBACjB,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;gBAC9B,QAAQ,EAAE,QAAQ;gBAClB,eAAe,EAAE,kBAAkB;gBACnC,OAAO,EAAE,6BAA6B;gBACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;YACD;gBACE,EAAE,EAAE,gBAAgB;gBACpB,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;gBAC9B,QAAQ,EAAE,WAAW;gBACrB,eAAe,EAAE,qBAAqB;gBACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAExE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,YAAY,EAAE,mBAAmB;YACjC,aAAa,EAAE,6BAA6B;YAC5C,eAAe,EAAE,sBAAsB;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,kBAAkB,GAAG,QAAQ,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;QAEtE,UAAU,CAAC,eAAuD,CAAC,iBAAiB,CAAC;YACpF;gBACE,EAAE,EAAE,UAAU;gBACd,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;gBAC9B,QAAQ,EAAE,QAAQ;gBAClB,eAAe,EAAE,WAAW;gBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;YACD;gBACE,EAAE,EAAE,WAAW;gBACf,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;gBAC9B,QAAQ,EAAE,QAAQ;gBAClB,eAAe,EAAE,kBAAkB;gBACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAExE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,YAAY,EAAE,mBAAmB;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/esm/services/index.d.ts

@@ -1,6 +1,11 @@
 export * from './AIService';
+export * from './ExecutionContext';
+export * from './CredentialProvider';
+export * from './ProviderClientFactory';
+export * from './ModelAccessPolicy';
 export * from './RedisService';
 export * from './SocketService';
 export * from './ModelFetcher';
 export * from './InternalEventsHandler';
+export * from './TenantCredentialResolver';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC"}

package/dist/esm/services/index.js

@@ -1,6 +1,11 @@
 export * from './AIService';
+export * from './ExecutionContext';
+export * from './CredentialProvider';
+export * from './ProviderClientFactory';
+export * from './ModelAccessPolicy';
 export * from './RedisService';
 export * from './SocketService';
 export * from './ModelFetcher';
 export * from './InternalEventsHandler';
+export * from './TenantCredentialResolver';
 //# sourceMappingURL=index.js.map

package/dist/esm/services/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC"}