@tanstack/ai/dist/esm/byok/stored-keys.js

Type-safe TypeScript AI SDK for streaming chat, tool calling, agents, structured outputs, and multimodal generation.

import { resolveProviderId } from "./providers.js";
import { providerKeys } from "./env-keys.js";
//#region src/byok/stored-keys.ts
/**
* The tenant scope of a user scope: the same tenant, no user. `undefined` for
* a scope with no user or no tenant, so a user without a tenant never reads
* the bucket shared by every scope with neither.
*/
function tenantScopeOf({ userId, tenantId }) {
	return userId === void 0 || tenantId === void 0 ? void 0 : { tenantId };
}
/**
* The credential `id` of `scope`: the user's own first, then the tenant's
* (saved without a `userId`). A save or a delete changes the user's own only.
*/
async function readCredential(store, scope, id) {
	return (await readCredentialEntry(store, scope, id))?.credential ?? null;
}
/**
* Like {@link readCredential}, but also gives the scope where the credential
* was found (`scope` itself, or its tenant scope) and its `revision` when the
* store has `getVersioned`. Write a refreshed credential back to that scope,
* with `setIf` and that revision.
*/
async function readCredentialEntry(store, scope, id) {
	const tenant = tenantScopeOf(scope);
	for (const candidate of tenant ? [scope, tenant] : [scope]) if (store.getVersioned) {
		const found = await store.getVersioned({
			scope: candidate,
			id
		});
		if (found) return {
			...found,
			scope: candidate
		};
	} else {
		const credential = await store.get({
			scope: candidate,
			id
		});
		if (credential) return {
			credential,
			scope: candidate
		};
	}
	return null;
}
/**
* Provider keys saved on the server: the `api_key` credential stored under
* the provider id for `scope` (the user's, else the tenant's), else the
* provider's `env` names.
*
* @example
* ```ts
* const gpt = keyedAdapter(openaiByok, (key) =>
*   createOpenaiChat('gpt-6.1-sol', key),
* )
* const keys = storedProviderKeys(credentials, { userId, tenantId })
* chat({
*   adapter: await keys.adapter(gpt),
*   subagents: { agents, keys: keys.get },
* })
* ```
*/
function storedProviderKeys(store, scope) {
	return providerKeys(async (provider) => {
		const saved = await readCredential(store, scope, resolveProviderId(provider));
		return saved?.type === "api_key" ? saved.value : null;
	});
}
//#endregion
export { readCredential, readCredentialEntry, storedProviderKeys, tenantScopeOf };

//# sourceMappingURL=stored-keys.js.map