refactor(byok): drop vendor branding from wire and storage identifiers

The BYOK header prefix, IndexedDB name, passkey relying-party name, and
HKDF label all hardcoded "tanstack". None of these need the vendor name:
the header is a private protocol between this package's own client and
server (both resolve it via byokHeaderName), and the storage identifiers
are already overridable per instance. Neutral defaults let the toolkit
read as reusable rather than TanStack-specific.

- header prefix:      x-tanstack-byok-        -> x-byok-
- IndexedDB default:  tanstack-byok           -> byok
- passkey rpName:     "TanStack AI BYOK"      -> "BYOK"
- HKDF info label:    tanstack-byok:keyring:v1 -> byok:keyring:v1

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: tombeckenham

.changeset/byok-package.md

@@ -2,7 +2,7 @@
 '@tanstack/ai-byok': minor
 ---
 
-Add `@tanstack/ai-byok`: a bring-your-own-key toolkit for TanStack AI. Keys live client-side and travel to the relay in a per-provider header (`x-tanstack-byok-<provider>`), never the request body or message history.
+Add `@tanstack/ai-byok`: a bring-your-own-key toolkit for TanStack AI. Keys live client-side and travel to the relay in a per-provider header (`x-byok-<provider>`), never the request body or message history.
 
 - **Client** (`@tanstack/ai-byok`): `byokHeaders`, `withByok`/`byokFetch` (attach BYOK headers to a connection and detect the relay's `byokMissing` 401 so the UI can prompt for or unlock the missing key), a typed provider registry, pluggable storage (session-only memory by default, opt-in passkey-encrypted persistence — WebAuthn PRF → HKDF → AES-256-GCM in IndexedDB, no plaintext option), and `validateKey`. Storage may expose `peek()` to report `provider → last-4` presence without decrypting.
 - **React** (`@tanstack/ai-byok/react`): `<ByokProvider storage={…}>`, `useByok()` (with `locked`/`unlock` for encrypted storage), and a drop-in `<ByokKeyManager>` settings UI that only ever shows the last 4 characters of a saved key. After a refresh, saved keys from encrypted storage surface as a `locked` status (with last-4) before the biometric unlock.

packages/ai-byok/README.md

@@ -14,7 +14,7 @@ ever persisting or logging them**.
 - **No central endpoint.** The server helper is trivially self-hostable; there
   is no hardcoded relay URL.
 
-Keys travel in the `x-tanstack-byok-<provider>` header — never the request body
+Keys travel in the `x-byok-<provider>` header — never the request body
 or message history — so they stay out of persisted conversations and the
 event/observability stream.
 

packages/ai-byok/src/client/passkey.ts

@@ -18,8 +18,8 @@ import type { ProviderId } from '../shared/providers'
 
 const STORE_NAME = 'keyring'
 const RECORD_ID = 'default'
-const HKDF_INFO = 'tanstack-byok:keyring:v1'
-const DEFAULT_DB = 'tanstack-byok'
+const HKDF_INFO = 'byok:keyring:v1'
+const DEFAULT_DB = 'byok'
 
 interface StoredRecord {
   id: string
@@ -270,7 +270,7 @@ export interface PasskeyStorageOptions {
    * domains.
    */
   rpId?: string
-  /** IndexedDB database name. Defaults to `tanstack-byok`. */
+  /** IndexedDB database name. Defaults to `byok`. */
   dbName?: string
 }
 
@@ -283,7 +283,7 @@ export interface PasskeyStorageOptions {
 export function passkeyStorage(
   options: PasskeyStorageOptions = {},
 ): KeyringStorage {
-  const rpName = options.rpName ?? 'TanStack AI BYOK'
+  const rpName = options.rpName ?? 'BYOK'
   const userName = options.userName ?? 'byok-keyring'
   const { rpId } = options
   const dbName = options.dbName ?? DEFAULT_DB

packages/ai-byok/src/shared/providers.ts

@@ -128,7 +128,7 @@ export function providerValidateConfig(
 }
 
 /** Prefix for every per-provider BYOK header. */
-export const BYOK_HEADER_PREFIX = 'x-tanstack-byok-'
+export const BYOK_HEADER_PREFIX = 'x-byok-'
 
 /**
  * The HTTP header name that carries the key for a given provider. Keys always

packages/ai-byok/tests/byok.test.ts

@@ -23,8 +23,8 @@ describe('byokHeaders', () => {
       gemini: 'g-1',
     })
     expect(headers).toEqual({
-      'x-tanstack-byok-openai': 'sk-abc',
-      'x-tanstack-byok-gemini': 'g-1',
+      'x-byok-openai': 'sk-abc',
+      'x-byok-gemini': 'g-1',
     })
   })
 })
@@ -33,11 +33,11 @@ describe('withByok / byokFetch', () => {
   it('withByok attaches BYOK headers read fresh at request time', () => {
     let keys: Keyring = { openai: 'sk-a' }
     const build = withByok(() => keys)
-    expect(build().headers).toEqual({ 'x-tanstack-byok-openai': 'sk-a' })
+    expect(build().headers).toEqual({ 'x-byok-openai': 'sk-a' })
     keys = { openai: 'sk-b', gemini: 'g-1' }
     expect(build().headers).toEqual({
-      'x-tanstack-byok-openai': 'sk-b',
-      'x-tanstack-byok-gemini': 'g-1',
+      'x-byok-openai': 'sk-b',
+      'x-byok-gemini': 'g-1',
     })
   })
 

packages/ai-byok/tests/react.test.tsx

@@ -45,7 +45,7 @@ describe('useByok', () => {
       await result.current.setKey('openai', 'sk-live-1234')
     })
     expect(byokHeaders(result.current.keys)).toEqual({
-      'x-tanstack-byok-openai': 'sk-live-1234',
+      'x-byok-openai': 'sk-live-1234',
     })
     // Only the last 4 are exposed as status.
     expect(result.current.status.openai).toEqual({

testing/e2e/tests/byok.spec.ts

@@ -35,7 +35,7 @@ test.describe('byok', () => {
     await sendMessage(page, '[chat] recommend a guitar')
 
     const request = await requestPromise
-    expect(request.headers()['x-tanstack-byok-openai']).toBe(KEY)
+    expect(request.headers()['x-byok-openai']).toBe(KEY)
     expect(request.postData() ?? '').not.toContain(KEY)
 
     await waitForResponse(page)