@bastani/atomic 0.9.11-alpha.6 → 0.9.11-alpha.8

package/dist/core/auth-storage.js

@@ -1,32 +1,15 @@
 /**
- * Credential storage for API keys and OAuth tokens.
- * Handles loading, saving, and refreshing credentials from auth.json.
- *
- * Uses file locking to prevent race conditions when multiple pi instances
- * try to refresh tokens simultaneously.
+ * CredentialStore implementation backed by auth.json.
+ * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.
  */
-import { findEnvKeys, getEnvApiKey } from "@earendil-works/pi-ai/compat";
 import { join } from "path";
 import { getAgentConfigPaths, getAgentDir } from "../config.js";
 import { FileAuthStorageBackend, InMemoryAuthStorageBackend } from "./auth-storage-backends.js";
-import { getOAuthProviderDescriptors, loginOAuthProvider, oauthCredentialToAuth, refreshOAuthProvider, } from "./oauth-provider-bridge.js";
 import { resolveConfigValue } from "./resolve-config-value.js";
 export { FileAuthStorageBackend, InMemoryAuthStorageBackend } from "./auth-storage-backends.js";
-/** Read one persisted provider credential using Atomic's layered config paths. */
-export function readStoredCredential(providerId, authPath) {
-    return AuthStorage.create(authPath).get(providerId);
-}
-/**
- * Credential storage backed by a JSON file.
- */
 export class AuthStorage {
     constructor(storage) {
         this.data = {};
-        this.runtimeOverrides = new Map();
-        this.loadError = null;
-        this.errors = [];
-        this.credentialMutationTail = Promise.resolve();
-        this.credentialVersions = new Map();
         this.storage = storage;
         this.reload();
     }
@@ -44,34 +27,6 @@ export class AuthStorage {
         storage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));
         return AuthStorage.fromStorage(storage);
     }
-    /**
-     * Set a runtime API key override (not persisted to disk).
-     * Used for CLI --api-key flag.
-     */
-    setRuntimeApiKey(provider, apiKey) {
-        this.runtimeOverrides.set(provider, apiKey);
-    }
-    /** Read a non-persisted request override without resolving stored credentials. */
-    getRuntimeApiKey(provider) {
-        return this.runtimeOverrides.get(provider);
-    }
-    /**
-     * Remove a runtime API key override.
-     */
-    removeRuntimeApiKey(provider) {
-        this.runtimeOverrides.delete(provider);
-    }
-    /**
-     * Set a fallback resolver for API keys not found in auth.json or env vars.
-     * Used for custom provider keys from models.json.
-     */
-    setFallbackResolver(resolver) {
-        this.fallbackResolver = resolver;
-    }
-    recordError(error) {
-        const normalizedError = error instanceof Error ? error : new Error(String(error));
-        this.errors.push(normalizedError);
-    }
     parseStorageData(content) {
         if (!content) {
             return {};
@@ -83,345 +38,84 @@ export class AuthStorage {
      */
     reload() {
         try {
-            // Pure read: never take the exclusive write lock. Writers replace
-            // auth.json atomically, so a lock-free read always sees a complete
-            // snapshot. This keeps many concurrent sessions from starving each other
-            // on the lock and misreporting configured providers as unreadable under
-            // contention (issue #1431).
-            const content = this.readSnapshot();
+            let content;
+            if (this.storage.read) {
+                content = this.storage.read();
+            }
+            else {
+                this.storage.withLock((current) => {
+                    content = current;
+                    return { result: undefined };
+                });
+            }
             this.data = this.parseStorageData(content);
-            this.loadError = null;
-        }
-        catch (error) {
-            this.loadError = error;
-            this.recordError(error);
-        }
-    }
-    /**
-     * Read the credential snapshot, preferring the backend's lock-free `read()`.
-     * Falls back to a `withLock`-based read for custom backends that predate
-     * `read()` so the released `AuthStorageBackend` interface stays compatible.
-     */
-    readSnapshot() {
-        if (this.storage.read) {
-            return this.storage.read();
         }
-        let content;
-        this.storage.withLock((current) => {
-            content = current;
-            return { result: undefined };
+        catch {
+            // Preserve the last valid in-memory snapshot.
+        }
+    }
+    async read(provider) {
+        const credential = this.data[provider];
+        if (credential?.type !== "api_key")
+            return credential;
+        if (credential.key === undefined)
+            return credential;
+        return { ...credential, key: resolveConfigValue(credential.key, credential.env) };
+    }
+    async modify(provider, fn) {
+        let persistedData;
+        const result = await this.storage.withLockAsync(async (content) => {
+            const currentData = this.parseStorageData(content);
+            const next = await fn(currentData[provider]);
+            if (next === undefined) {
+                persistedData = currentData;
+                return { result: currentData[provider] };
+            }
+            const merged = { ...currentData, [provider]: next };
+            persistedData = merged;
+            return { result: next, next: JSON.stringify(merged, null, 2) };
         });
-        return content;
-    }
-    bumpCredentialVersion(provider) {
-        this.credentialVersions.set(provider, (this.credentialVersions.get(provider) ?? 0) + 1);
-    }
-    persistProviderChange(provider, credential) {
-        if (this.loadError) {
-            this.reload();
-            if (this.loadError)
-                throw this.loadError;
-        }
-        try {
-            const persistedData = this.storage.withLock((current) => {
-                const currentData = this.parseStorageData(current);
-                const merged = { ...currentData };
-                if (credential) {
-                    merged[provider] = credential;
-                }
-                else {
-                    delete merged[provider];
-                }
-                return { result: merged, next: JSON.stringify(merged, null, 2) };
-            });
+        if (persistedData)
             this.data = persistedData;
-            this.bumpCredentialVersion(provider);
-            this.loadError = null;
-        }
-        catch (error) {
-            this.recordError(error);
-            throw error instanceof Error ? error : new Error(String(error));
-        }
-    }
-    /**
-     * Get credential for a provider.
-     */
-    get(provider) {
-        return this.data[provider] ?? undefined;
-    }
-    /**
-     * Set credential for a provider.
-     */
-    set(provider, credential) {
-        this.persistProviderChange(provider, credential);
+        return result;
     }
-    /**
-     * Remove credential for a provider.
-     */
-    remove(provider) {
-        if (!this.storage.deleteProvider) {
-            this.persistProviderChange(provider, undefined);
+    async delete(provider) {
+        if (this.storage.deleteProviderAsync) {
+            const content = await this.storage.deleteProviderAsync(provider);
+            this.data = this.parseStorageData(content);
             return;
         }
-        try {
-            this.data = this.parseStorageData(this.storage.deleteProvider(provider));
-            this.bumpCredentialVersion(provider);
-            this.loadError = null;
-        }
-        catch (error) {
-            this.recordError(error);
-            throw error instanceof Error ? error : new Error(String(error));
-        }
-    }
-    /**
-     * List all providers with credentials.
-     */
-    list() {
-        return Object.keys(this.data);
-    }
-    /**
-     * Check if credentials exist for a provider in auth.json.
-     */
-    has(provider) {
-        return provider in this.data;
-    }
-    /**
-     * Check if any form of auth is configured for a provider.
-     * Unlike getApiKey(), this doesn't refresh OAuth tokens.
-     */
-    hasAuth(provider) {
-        if (this.runtimeOverrides.has(provider))
-            return true;
-        if (this.data[provider])
-            return true;
-        if (findEnvKeys(provider)?.[0])
-            return true;
-        if (this.fallbackResolver?.(provider))
-            return true;
-        return false;
-    }
-    /**
-     * Return auth status without exposing credential values or refreshing tokens.
-     */
-    getAuthStatus(provider) {
-        if (this.data[provider]) {
-            return { configured: true, source: "stored" };
-        }
-        if (this.runtimeOverrides.has(provider)) {
-            return { configured: false, source: "runtime", label: "--api-key" };
-        }
-        const envKeys = findEnvKeys(provider);
-        if (envKeys?.[0]) {
-            return { configured: true, source: "environment", label: envKeys[0] };
-        }
-        if (this.fallbackResolver?.(provider)) {
-            return { configured: false, source: "fallback", label: "custom provider config" };
-        }
-        return { configured: false };
-    }
-    /** Return a copy of all persisted credentials. */
-    getAll() {
-        return { ...this.data };
-    }
-    drainErrors() {
-        const drained = [...this.errors];
-        this.errors = [];
-        return drained;
-    }
-    /**
-     * Returns the error from the most recent failed credential load, or null when
-     * the last reload succeeded.
-     *
-     * A non-null value means stored credentials could NOT be read — e.g. the auth
-     * file was temporarily locked by another process (ELOCKED) or contained
-     * invalid JSON — so an empty/absent credential set is NOT authoritative.
-     * Callers that would otherwise report "No API key found" should surface this
-     * load failure instead of treating the provider as unauthenticated
-     * (issue #1431).
-     */
-    getLoadError() {
-        return this.loadError;
-    }
-    /**
-     * Login to an OAuth provider.
-     */
-    async login(providerId, callbacks) {
-        const credential = await loginOAuthProvider(providerId, callbacks);
-        await this.asCredentialStore().modify(providerId, async () => credential);
-    }
-    /** Logout through the preserved synchronous persistence path. */
-    logout(provider) {
-        this.remove(provider);
+        let persistedData;
+        await this.storage.withLockAsync(async (content) => {
+            const currentData = this.parseStorageData(content);
+            delete currentData[provider];
+            persistedData = currentData;
+            return { result: undefined, next: JSON.stringify(currentData, null, 2) };
+        });
+        if (persistedData)
+            this.data = persistedData;
     }
-    /** Serialized logout for callers that need persistence completion. */
-    async logoutAsync(provider) {
-        await this.asCredentialStore().delete(provider);
+    /** List credential metadata without resolving configured key values. */
+    async list() {
+        return Object.entries(this.data).map(([providerId, credential]) => ({ providerId, type: credential.type }));
     }
-    /**
-     * Refresh OAuth token with backend locking to prevent race conditions.
-     * Multiple pi instances may try to refresh simultaneously when tokens expire.
-     */
-    async refreshOAuthTokenWithLock(providerId) {
-        return this.runCredentialMutation(async () => {
-            let synchronizedData;
-            const credentialVersion = this.credentialVersions.get(providerId) ?? 0;
-            const result = await this.storage.withLockAsync(async (current) => {
-                const currentData = this.parseStorageData(current);
-                synchronizedData = currentData;
-                const cred = currentData[providerId];
-                if (cred?.type !== "oauth")
-                    return { result: null };
-                const oauthCredential = { ...cred, type: "oauth" };
-                if (Date.now() < cred.expires) {
-                    const auth = await oauthCredentialToAuth(providerId, oauthCredential);
-                    return { result: auth ? { auth, newCredentials: cred } : null };
-                }
-                const refreshed = await refreshOAuthProvider(providerId, oauthCredential);
-                if (!refreshed)
-                    return { result: null };
-                if ((this.credentialVersions.get(providerId) ?? 0) !== credentialVersion) {
-                    synchronizedData = undefined;
-                    return { result: null };
-                }
-                const merged = {
-                    ...currentData,
-                    [providerId]: refreshed.credential,
-                };
-                synchronizedData = merged;
-                return {
-                    result: { auth: refreshed.auth, newCredentials: refreshed.credential },
-                    next: JSON.stringify(merged, null, 2),
-                };
-            });
-            if (synchronizedData)
-                this.data = synchronizedData;
-            this.loadError = null;
-            return result;
+}
+/** Read one persisted provider credential using Atomic's layered auth.json paths. */
+export function readStoredCredential(providerId, authPath) {
+    const paths = authPath === undefined
+        ? getAgentConfigPaths("auth.json")
+        : Array.isArray(authPath) ? authPath : [authPath];
+    const storage = new FileAuthStorageBackend(paths[0] ?? join(getAgentDir(), "auth.json"), paths);
+    try {
+        let credential;
+        storage.withLock((content) => {
+            credential = content ? JSON.parse(content)[providerId] : undefined;
+            return { result: undefined };
         });
+        return credential;
     }
-    /**
-     * Get API key for a provider.
-     * Priority:
-     * 1. Runtime override (CLI --api-key)
-     * 2. API key from auth.json
-     * 3. OAuth token from auth.json (auto-refreshed with locking)
-     * 4. Environment variable
-     * 5. Fallback resolver (models.json custom providers)
-     */
-    async getModelAuth(providerId, options) {
-        const runtimeKey = this.runtimeOverrides.get(providerId);
-        if (runtimeKey)
-            return { apiKey: runtimeKey };
-        const cred = this.data[providerId];
-        if (cred?.type === "api_key" && cred.key)
-            return { apiKey: resolveConfigValue(cred.key) };
-        if (cred?.type === "oauth") {
-            try {
-                if (Date.now() >= cred.expires) {
-                    return (await this.refreshOAuthTokenWithLock(providerId))?.auth;
-                }
-                return await oauthCredentialToAuth(providerId, { ...cred, type: "oauth" });
-            }
-            catch (error) {
-                this.recordError(error);
-                this.reload();
-                const updated = this.data[providerId];
-                if (updated?.type === "oauth" && Date.now() < updated.expires) {
-                    return oauthCredentialToAuth(providerId, { ...updated, type: "oauth" });
-                }
-                return undefined;
-            }
-        }
-        const envKey = getEnvApiKey(providerId);
-        if (envKey)
-            return { apiKey: envKey };
-        if (options?.includeFallback !== false) {
-            const fallback = this.fallbackResolver?.(providerId);
-            if (fallback)
-                return { apiKey: fallback };
-        }
+    catch {
         return undefined;
     }
-    async getApiKey(providerId, options) {
-        return (await this.getModelAuth(providerId, options))?.apiKey;
-    }
-    /**
-     * Get all registered OAuth providers
-     */
-    getOAuthProviders() {
-        return getOAuthProviderDescriptors();
-    }
-    runCredentialMutation(operation) {
-        const result = this.credentialMutationTail.then(operation, operation);
-        this.credentialMutationTail = result.then(() => undefined, () => undefined);
-        return result;
-    }
-    /** Private async adapter for pi-ai's provider-owned Models runtime. */
-    asCredentialStore() {
-        const runtimeCredential = (providerId) => {
-            const key = this.runtimeOverrides.get(providerId);
-            return key === undefined ? undefined : { type: "api_key", key };
-        };
-        return {
-            read: async (providerId) => runtimeCredential(providerId) ?? this.get(providerId),
-            list: async () => {
-                const providers = new Set([...this.list(), ...this.runtimeOverrides.keys()]);
-                return [...providers].map((providerId) => ({
-                    providerId,
-                    type: runtimeCredential(providerId)?.type ?? this.data[providerId].type,
-                }));
-            },
-            modify: (providerId, fn) => this.runCredentialMutation(async () => {
-                let synchronizedData;
-                try {
-                    const result = await this.storage.withLockAsync(async (current) => {
-                        const data = this.parseStorageData(current);
-                        const next = await fn(data[providerId]);
-                        if (next === undefined) {
-                            synchronizedData = data;
-                            return { result: data[providerId] };
-                        }
-                        const merged = { ...data, [providerId]: next };
-                        synchronizedData = merged;
-                        return { result: next, next: JSON.stringify(merged, null, 2) };
-                    });
-                    if (synchronizedData) {
-                        this.data = synchronizedData;
-                        this.bumpCredentialVersion(providerId);
-                    }
-                    this.loadError = null;
-                    return result;
-                }
-                catch (error) {
-                    this.recordError(error);
-                    throw error;
-                }
-            }),
-            delete: (providerId) => this.runCredentialMutation(async () => {
-                try {
-                    if (this.storage.deleteProviderAsync) {
-                        this.data = this.parseStorageData(await this.storage.deleteProviderAsync(providerId));
-                    }
-                    else {
-                        let synchronizedData;
-                        await this.storage.withLockAsync(async (current) => {
-                            const data = this.parseStorageData(current);
-                            delete data[providerId];
-                            synchronizedData = data;
-                            return { result: undefined, next: JSON.stringify(data, null, 2) };
-                        });
-                        if (synchronizedData)
-                            this.data = synchronizedData;
-                    }
-                    this.bumpCredentialVersion(providerId);
-                    this.loadError = null;
-                }
-                catch (error) {
-                    this.recordError(error);
-                    throw error;
-                }
-            }),
-        };
-    }
 }
 //# sourceMappingURL=auth-storage.js.map

package/dist/core/auth-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAA2B,MAAM,4BAA4B,CAAC;AACzH,OAAO,EAEN,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAuB/D,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAA2B,MAAM,4BAA4B,CAAC;AAEzH,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,QAA4B;IACpF,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,UAAU,CAA2B,CAAC;AAC/E,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IAWvB,YAAoB,OAA2B;QAVvC,SAAI,GAAoB,EAAE,CAAC;QAC3B,qBAAgB,GAAwB,IAAI,GAAG,EAAE,CAAC;QAElD,cAAS,GAAiB,IAAI,CAAC;QAC/B,WAAM,GAAY,EAAE,CAAC;QACrB,2BAAsB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1D,uBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAKtD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,QAA4B;QACzC,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS;YACnC,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,WAAW,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B;QAC7C,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE;QACzC,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,QAAgB,EAAE,MAAc;QAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,kFAAkF;IAClF,gBAAgB,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAGD;;OAEG;IACH,mBAAmB,CAAC,QAAgB;QACnC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,QAAkD;QACrE,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC;IAClC,CAAC;IAEO,WAAW,CAAC,KAAc;QACjC,MAAM,eAAe,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;IAEO,gBAAgB,CAAC,OAA2B;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM;QACL,IAAI,CAAC;YACJ,kEAAkE;YAClE,mEAAmE;YACnE,yEAAyE;YACzE,wEAAwE;YACxE,4BAA4B;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,GAAG,KAAc,CAAC;YAChC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACF,CAAC;IAED;;;;OAIG;IACK,YAAY;QACnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,OAAO,GAAG,OAAO,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,qBAAqB,CAAC,QAAgB;QAC7C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzF,CAAC;IAEO,qBAAqB,CAAC,QAAgB,EAAE,UAAsC;QACrF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,CAAC,SAAS,CAAC;QAC1C,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBACvD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC;gBACnD,IAAI,UAAU,EAAE,CAAC;oBAChB,MAAM,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;gBAC/B,CAAC;qBAAM,CAAC;oBACP,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACzB,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB,EAAE,UAA0B;QAC/C,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAClC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAChD,OAAO;QACR,CAAC;QACD,IAAI,CAAC;YACJ,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,CAAC;IACF,CAAC;IAED;;OAEG;IACH,IAAI;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,QAAgB;QACnB,OAAO,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,QAAgB;QACvB,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,KAAK,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,QAAgB;QAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC/C,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QACnF,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,kDAAkD;IAClD,MAAM;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,WAAW;QACV,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,OAAO,OAAO,CAAC;IAChB,CAAC;IAED;;;;;;;;;;OAUG;IACH,YAAY;QACX,OAAO,IAAI,CAAC,SAAS,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,SAAoC;QACnE,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;IAC3E,CAAC;IAED,iEAAiE;IACjE,MAAM,CAAC,QAAgB;QACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,WAAW,CAAC,QAAgB;QACjC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,yBAAyB,CACtC,UAAkB;QAElB,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;YAC5C,IAAI,gBAA6C,CAAC;YAClD,MAAM,iBAAiB,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACnD,gBAAgB,GAAG,WAAW,CAAC;gBAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;gBACrC,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBAEpD,MAAM,eAAe,GAAsB,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBACtE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;oBAC/B,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;oBACtE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjE,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;gBAC1E,IAAI,CAAC,SAAS;oBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,iBAAiB,EAAE,CAAC;oBAC1E,gBAAgB,GAAG,SAAS,CAAC;oBAC7B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACzB,CAAC;gBACD,MAAM,MAAM,GAAoB;oBAC/B,GAAG,WAAW;oBACd,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,UAAU;iBAClC,CAAC;gBACF,gBAAgB,GAAG,MAAM,CAAC;gBAC1B,OAAO;oBACN,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,UAAU,EAAE;oBACtE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACrC,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,gBAAgB;gBAAE,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;YACnD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACtB,OAAO,MAAM,CAAC;QACf,CAAC,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,OAAuC;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,UAAU;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAE9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAE1F,IAAI,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACJ,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBAChC,OAAO,CAAC,MAAM,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC;gBACjE,CAAC;gBACD,OAAO,MAAM,qBAAqB,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtC,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;oBAC/D,OAAO,qBAAqB,CAAC,UAAU,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,IAAI,OAAO,EAAE,eAAe,KAAK,KAAK,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,OAAuC;QAC1E,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,iBAAiB;QAChB,OAAO,2BAA2B,EAAE,CAAC;IACtC,CAAC;IAEO,qBAAqB,CAAI,SAA2B;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,sBAAsB,GAAG,MAAM,CAAC,IAAI,CACxC,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;QACF,OAAO,MAAM,CAAC;IACf,CAAC;IAED,uEAAuE;IACvE,iBAAiB;QAChB,MAAM,iBAAiB,GAAG,CAAC,UAAkB,EAA0B,EAAE;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACjE,CAAC,CAAC;QACF,OAAO;YACN,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAK,IAAI,CAAC,GAAG,CAAC,UAAU,CAA4B;YAC7G,IAAI,EAAE,KAAK,IAAwC,EAAE;gBACpD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC7E,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;oBAC1C,UAAU;oBACV,IAAI,EAAE,iBAAiB,CAAC,UAAU,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI;iBACvE,CAAC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAC1B,IAAI,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;gBACrC,IAAI,gBAA6C,CAAC;gBAClD,IAAI,CAAC;oBACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;wBACjE,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;wBAC5C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAA2B,CAAC,CAAC;wBAClE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;4BACxB,gBAAgB,GAAG,IAAI,CAAC;4BACxB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAA2B,EAAE,CAAC;wBAC/D,CAAC;wBACD,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,IAAsB,EAAE,CAAC;wBACjE,gBAAgB,GAAG,MAAM,CAAC;wBAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;oBAChE,CAAC,CAAC,CAAC;oBACH,IAAI,gBAAgB,EAAE,CAAC;wBACtB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;wBAC7B,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;oBACxC,CAAC;oBACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;oBACtB,OAAO,MAAM,CAAC;gBACf,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;oBACxB,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC,CAAC;YACH,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CACtB,IAAI,CAAC,qBAAqB,CAAC,KAAK,IAAI,EAAE;gBACrC,IAAI,CAAC;oBACJ,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;wBACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;oBACvF,CAAC;yBAAM,CAAC;wBACP,IAAI,gBAA6C,CAAC;wBAClD,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;4BAClD,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;4BAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;4BACxB,gBAAgB,GAAG,IAAI,CAAC;4BACxB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;wBACnE,CAAC,CAAC,CAAC;wBACH,IAAI,gBAAgB;4BAAE,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;oBACpD,CAAC;oBACD,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;oBACvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;gBACvB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;oBACxB,MAAM,KAAK,CAAC;gBACb,CAAC;YACF,CAAC,CAAC;SACH,CAAC;IACH,CAAC;CACD","sourcesContent":["/**\n * Credential storage for API keys and OAuth tokens.\n * Handles loading, saving, and refreshing credentials from auth.json.\n *\n * Uses file locking to prevent race conditions when multiple pi instances\n * try to refresh tokens simultaneously.\n */\n\nimport {\n\ttype Credential,\n\ttype CredentialInfo,\n\ttype CredentialStore,\n\ttype ModelAuth,\n\ttype OAuthCredential as PiOAuthCredential,\n\ttype OAuthCredentials,\n} from \"@earendil-works/pi-ai\";\nimport { findEnvKeys, getEnvApiKey } from \"@earendil-works/pi-ai/compat\";\nimport { join } from \"path\";\nimport { getAgentConfigPaths, getAgentDir } from \"../config.ts\";\nimport { FileAuthStorageBackend, InMemoryAuthStorageBackend, type AuthStorageBackend } from \"./auth-storage-backends.ts\";\nimport {\n\ttype AtomicOAuthLoginCallbacks,\n\tgetOAuthProviderDescriptors,\n\tloginOAuthProvider,\n\toauthCredentialToAuth,\n\trefreshOAuthProvider,\n} from \"./oauth-provider-bridge.ts\";\nimport { resolveConfigValue } from \"./resolve-config-value.ts\";\n\nexport type ApiKeyCredential = {\n\ttype: \"api_key\";\n\tkey?: string;\n\t/** Provider-scoped configuration persisted alongside the credential. */\n\tenv?: Record<string, string>;\n};\n\nexport type OAuthCredential = {\n\ttype: \"oauth\";\n} & OAuthCredentials;\n\nexport type AuthCredential = ApiKeyCredential | OAuthCredential;\n\nexport type AuthStorageData = Record<string, AuthCredential>;\n\nexport type AuthStatus = {\n\tconfigured: boolean;\n\tsource?: \"stored\" | \"runtime\" | \"environment\" | \"fallback\" | \"models_json_key\" | \"models_json_command\";\n\tlabel?: string;\n};\n\nexport { FileAuthStorageBackend, InMemoryAuthStorageBackend, type AuthStorageBackend } from \"./auth-storage-backends.ts\";\n\n/** Read one persisted provider credential using Atomic's layered config paths. */\nexport function readStoredCredential(providerId: string, authPath?: string | string[]): Credential | undefined {\n\treturn AuthStorage.create(authPath).get(providerId) as Credential | undefined;\n}\n\n/**\n * Credential storage backed by a JSON file.\n */\nexport class AuthStorage {\n\tprivate data: AuthStorageData = {};\n\tprivate runtimeOverrides: Map<string, string> = new Map();\n\tprivate fallbackResolver?: (provider: string) => string | undefined;\n\tprivate loadError: Error | null = null;\n\tprivate errors: Error[] = [];\n\tprivate credentialMutationTail: Promise<void> = Promise.resolve();\n\tprivate credentialVersions = new Map<string, number>();\n\n\tdeclare private storage: AuthStorageBackend;\n\n\tprivate constructor(storage: AuthStorageBackend) {\n\t\tthis.storage = storage;\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath?: string | string[]): AuthStorage {\n\t\tconst paths = authPath === undefined\n\t\t\t? getAgentConfigPaths(\"auth.json\")\n\t\t\t: Array.isArray(authPath) ? authPath : [authPath];\n\t\treturn new AuthStorage(new FileAuthStorageBackend(paths[0] ?? join(getAgentDir(), \"auth.json\"), paths));\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\t/**\n\t * Set a runtime API key override (not persisted to disk).\n\t * Used for CLI --api-key flag.\n\t */\n\tsetRuntimeApiKey(provider: string, apiKey: string): void {\n\t\tthis.runtimeOverrides.set(provider, apiKey);\n\t}\n\t/** Read a non-persisted request override without resolving stored credentials. */\n\tgetRuntimeApiKey(provider: string): string | undefined {\n\t\treturn this.runtimeOverrides.get(provider);\n\t}\n\n\n\t/**\n\t * Remove a runtime API key override.\n\t */\n\tremoveRuntimeApiKey(provider: string): void {\n\t\tthis.runtimeOverrides.delete(provider);\n\t}\n\n\t/**\n\t * Set a fallback resolver for API keys not found in auth.json or env vars.\n\t * Used for custom provider keys from models.json.\n\t */\n\tsetFallbackResolver(resolver: (provider: string) => string | undefined): void {\n\t\tthis.fallbackResolver = resolver;\n\t}\n\n\tprivate recordError(error: unknown): void {\n\t\tconst normalizedError = error instanceof Error ? error : new Error(String(error));\n\t\tthis.errors.push(normalizedError);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(content) as AuthStorageData;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\ttry {\n\t\t\t// Pure read: never take the exclusive write lock. Writers replace\n\t\t\t// auth.json atomically, so a lock-free read always sees a complete\n\t\t\t// snapshot. This keeps many concurrent sessions from starving each other\n\t\t\t// on the lock and misreporting configured providers as unreadable under\n\t\t\t// contention (issue #1431).\n\t\t\tconst content = this.readSnapshot();\n\t\t\tthis.data = this.parseStorageData(content);\n\t\t\tthis.loadError = null;\n\t\t} catch (error) {\n\t\t\tthis.loadError = error as Error;\n\t\t\tthis.recordError(error);\n\t\t}\n\t}\n\n\t/**\n\t * Read the credential snapshot, preferring the backend's lock-free `read()`.\n\t * Falls back to a `withLock`-based read for custom backends that predate\n\t * `read()` so the released `AuthStorageBackend` interface stays compatible.\n\t */\n\tprivate readSnapshot(): string | undefined {\n\t\tif (this.storage.read) {\n\t\t\treturn this.storage.read();\n\t\t}\n\t\tlet content: string | undefined;\n\t\tthis.storage.withLock((current) => {\n\t\t\tcontent = current;\n\t\t\treturn { result: undefined };\n\t\t});\n\t\treturn content;\n\t}\n\n\tprivate bumpCredentialVersion(provider: string): void {\n\t\tthis.credentialVersions.set(provider, (this.credentialVersions.get(provider) ?? 0) + 1);\n\t}\n\n\tprivate persistProviderChange(provider: string, credential: AuthCredential | undefined): void {\n\t\tif (this.loadError) {\n\t\t\tthis.reload();\n\t\t\tif (this.loadError) throw this.loadError;\n\t\t}\n\n\t\ttry {\n\t\t\tconst persistedData = this.storage.withLock((current) => {\n\t\t\t\tconst currentData = this.parseStorageData(current);\n\t\t\t\tconst merged: AuthStorageData = { ...currentData };\n\t\t\t\tif (credential) {\n\t\t\t\t\tmerged[provider] = credential;\n\t\t\t\t} else {\n\t\t\t\t\tdelete merged[provider];\n\t\t\t\t}\n\t\t\t\treturn { result: merged, next: JSON.stringify(merged, null, 2) };\n\t\t\t});\n\t\t\tthis.data = persistedData;\n\t\t\tthis.bumpCredentialVersion(provider);\n\t\t\tthis.loadError = null;\n\t\t} catch (error) {\n\t\t\tthis.recordError(error);\n\t\t\tthrow error instanceof Error ? error : new Error(String(error));\n\t\t}\n\t}\n\n\t/**\n\t * Get credential for a provider.\n\t */\n\tget(provider: string): AuthCredential | undefined {\n\t\treturn this.data[provider] ?? undefined;\n\t}\n\n\t/**\n\t * Set credential for a provider.\n\t */\n\tset(provider: string, credential: AuthCredential): void {\n\t\tthis.persistProviderChange(provider, credential);\n\t}\n\n\t/**\n\t * Remove credential for a provider.\n\t */\n\tremove(provider: string): void {\n\t\tif (!this.storage.deleteProvider) {\n\t\t\tthis.persistProviderChange(provider, undefined);\n\t\t\treturn;\n\t\t}\n\t\ttry {\n\t\t\tthis.data = this.parseStorageData(this.storage.deleteProvider(provider));\n\t\t\tthis.bumpCredentialVersion(provider);\n\t\t\tthis.loadError = null;\n\t\t} catch (error) {\n\t\t\tthis.recordError(error);\n\t\t\tthrow error instanceof Error ? error : new Error(String(error));\n\t\t}\n\t}\n\n\t/**\n\t * List all providers with credentials.\n\t */\n\tlist(): string[] {\n\t\treturn Object.keys(this.data);\n\t}\n\n\t/**\n\t * Check if credentials exist for a provider in auth.json.\n\t */\n\thas(provider: string): boolean {\n\t\treturn provider in this.data;\n\t}\n\n\t/**\n\t * Check if any form of auth is configured for a provider.\n\t * Unlike getApiKey(), this doesn't refresh OAuth tokens.\n\t */\n\thasAuth(provider: string): boolean {\n\t\tif (this.runtimeOverrides.has(provider)) return true;\n\t\tif (this.data[provider]) return true;\n\t\tif (findEnvKeys(provider)?.[0]) return true;\n\t\tif (this.fallbackResolver?.(provider)) return true;\n\t\treturn false;\n\t}\n\n\t/**\n\t * Return auth status without exposing credential values or refreshing tokens.\n\t */\n\tgetAuthStatus(provider: string): AuthStatus {\n\t\tif (this.data[provider]) {\n\t\t\treturn { configured: true, source: \"stored\" };\n\t\t}\n\n\t\tif (this.runtimeOverrides.has(provider)) {\n\t\t\treturn { configured: false, source: \"runtime\", label: \"--api-key\" };\n\t\t}\n\n\t\tconst envKeys = findEnvKeys(provider);\n\t\tif (envKeys?.[0]) {\n\t\t\treturn { configured: true, source: \"environment\", label: envKeys[0] };\n\t\t}\n\n\t\tif (this.fallbackResolver?.(provider)) {\n\t\t\treturn { configured: false, source: \"fallback\", label: \"custom provider config\" };\n\t\t}\n\n\t\treturn { configured: false };\n\t}\n\n\t/** Return a copy of all persisted credentials. */\n\tgetAll(): AuthStorageData {\n\t\treturn { ...this.data };\n\t}\n\n\tdrainErrors(): Error[] {\n\t\tconst drained = [...this.errors];\n\t\tthis.errors = [];\n\t\treturn drained;\n\t}\n\n\t/**\n\t * Returns the error from the most recent failed credential load, or null when\n\t * the last reload succeeded.\n\t *\n\t * A non-null value means stored credentials could NOT be read — e.g. the auth\n\t * file was temporarily locked by another process (ELOCKED) or contained\n\t * invalid JSON — so an empty/absent credential set is NOT authoritative.\n\t * Callers that would otherwise report \"No API key found\" should surface this\n\t * load failure instead of treating the provider as unauthenticated\n\t * (issue #1431).\n\t */\n\tgetLoadError(): Error | null {\n\t\treturn this.loadError;\n\t}\n\n\t/**\n\t * Login to an OAuth provider.\n\t */\n\tasync login(providerId: string, callbacks: AtomicOAuthLoginCallbacks): Promise<void> {\n\t\tconst credential = await loginOAuthProvider(providerId, callbacks);\n\t\tawait this.asCredentialStore().modify(providerId, async () => credential);\n\t}\n\n\t/** Logout through the preserved synchronous persistence path. */\n\tlogout(provider: string): void {\n\t\tthis.remove(provider);\n\t}\n\n\t/** Serialized logout for callers that need persistence completion. */\n\tasync logoutAsync(provider: string): Promise<void> {\n\t\tawait this.asCredentialStore().delete(provider);\n\t}\n\n\t/**\n\t * Refresh OAuth token with backend locking to prevent race conditions.\n\t * Multiple pi instances may try to refresh simultaneously when tokens expire.\n\t */\n\tprivate async refreshOAuthTokenWithLock(\n\t\tproviderId: string,\n\t): Promise<{ auth: ModelAuth; newCredentials: OAuthCredentials } | null> {\n\t\treturn this.runCredentialMutation(async () => {\n\t\t\tlet synchronizedData: AuthStorageData | undefined;\n\t\t\tconst credentialVersion = this.credentialVersions.get(providerId) ?? 0;\n\t\t\tconst result = await this.storage.withLockAsync(async (current) => {\n\t\t\t\tconst currentData = this.parseStorageData(current);\n\t\t\t\tsynchronizedData = currentData;\n\t\t\t\tconst cred = currentData[providerId];\n\t\t\t\tif (cred?.type !== \"oauth\") return { result: null };\n\n\t\t\t\tconst oauthCredential: PiOAuthCredential = { ...cred, type: \"oauth\" };\n\t\t\t\tif (Date.now() < cred.expires) {\n\t\t\t\t\tconst auth = await oauthCredentialToAuth(providerId, oauthCredential);\n\t\t\t\t\treturn { result: auth ? { auth, newCredentials: cred } : null };\n\t\t\t\t}\n\n\t\t\t\tconst refreshed = await refreshOAuthProvider(providerId, oauthCredential);\n\t\t\t\tif (!refreshed) return { result: null };\n\t\t\t\tif ((this.credentialVersions.get(providerId) ?? 0) !== credentialVersion) {\n\t\t\t\t\tsynchronizedData = undefined;\n\t\t\t\t\treturn { result: null };\n\t\t\t\t}\n\t\t\t\tconst merged: AuthStorageData = {\n\t\t\t\t\t...currentData,\n\t\t\t\t\t[providerId]: refreshed.credential,\n\t\t\t\t};\n\t\t\t\tsynchronizedData = merged;\n\t\t\t\treturn {\n\t\t\t\t\tresult: { auth: refreshed.auth, newCredentials: refreshed.credential },\n\t\t\t\t\tnext: JSON.stringify(merged, null, 2),\n\t\t\t\t};\n\t\t\t});\n\n\t\t\tif (synchronizedData) this.data = synchronizedData;\n\t\t\tthis.loadError = null;\n\t\t\treturn result;\n\t\t});\n\t}\n\n\t/**\n\t * Get API key for a provider.\n\t * Priority:\n\t * 1. Runtime override (CLI --api-key)\n\t * 2. API key from auth.json\n\t * 3. OAuth token from auth.json (auto-refreshed with locking)\n\t * 4. Environment variable\n\t * 5. Fallback resolver (models.json custom providers)\n\t */\n\tasync getModelAuth(providerId: string, options?: { includeFallback?: boolean }): Promise<ModelAuth | undefined> {\n\t\tconst runtimeKey = this.runtimeOverrides.get(providerId);\n\t\tif (runtimeKey) return { apiKey: runtimeKey };\n\n\t\tconst cred = this.data[providerId];\n\t\tif (cred?.type === \"api_key\" && cred.key) return { apiKey: resolveConfigValue(cred.key) };\n\n\t\tif (cred?.type === \"oauth\") {\n\t\t\ttry {\n\t\t\t\tif (Date.now() >= cred.expires) {\n\t\t\t\t\treturn (await this.refreshOAuthTokenWithLock(providerId))?.auth;\n\t\t\t\t}\n\t\t\t\treturn await oauthCredentialToAuth(providerId, { ...cred, type: \"oauth\" });\n\t\t\t} catch (error) {\n\t\t\t\tthis.recordError(error);\n\t\t\t\tthis.reload();\n\t\t\t\tconst updated = this.data[providerId];\n\t\t\t\tif (updated?.type === \"oauth\" && Date.now() < updated.expires) {\n\t\t\t\t\treturn oauthCredentialToAuth(providerId, { ...updated, type: \"oauth\" });\n\t\t\t\t}\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\tconst envKey = getEnvApiKey(providerId);\n\t\tif (envKey) return { apiKey: envKey };\n\t\tif (options?.includeFallback !== false) {\n\t\t\tconst fallback = this.fallbackResolver?.(providerId);\n\t\t\tif (fallback) return { apiKey: fallback };\n\t\t}\n\t\treturn undefined;\n\t}\n\n\tasync getApiKey(providerId: string, options?: { includeFallback?: boolean }): Promise<string | undefined> {\n\t\treturn (await this.getModelAuth(providerId, options))?.apiKey;\n\t}\n\n\t/**\n\t * Get all registered OAuth providers\n\t */\n\tgetOAuthProviders() {\n\t\treturn getOAuthProviderDescriptors();\n\t}\n\n\tprivate runCredentialMutation<T>(operation: () => Promise<T>): Promise<T> {\n\t\tconst result = this.credentialMutationTail.then(operation, operation);\n\t\tthis.credentialMutationTail = result.then(\n\t\t\t() => undefined,\n\t\t\t() => undefined,\n\t\t);\n\t\treturn result;\n\t}\n\n\t/** Private async adapter for pi-ai's provider-owned Models runtime. */\n\tasCredentialStore(): CredentialStore {\n\t\tconst runtimeCredential = (providerId: string): Credential | undefined => {\n\t\t\tconst key = this.runtimeOverrides.get(providerId);\n\t\t\treturn key === undefined ? undefined : { type: \"api_key\", key };\n\t\t};\n\t\treturn {\n\t\t\tread: async (providerId) => runtimeCredential(providerId) ?? (this.get(providerId) as Credential | undefined),\n\t\t\tlist: async (): Promise<readonly CredentialInfo[]> => {\n\t\t\t\tconst providers = new Set([...this.list(), ...this.runtimeOverrides.keys()]);\n\t\t\t\treturn [...providers].map((providerId) => ({\n\t\t\t\t\tproviderId,\n\t\t\t\t\ttype: runtimeCredential(providerId)?.type ?? this.data[providerId].type,\n\t\t\t\t}));\n\t\t\t},\n\t\t\tmodify: (providerId, fn) =>\n\t\t\t\tthis.runCredentialMutation(async () => {\n\t\t\t\t\tlet synchronizedData: AuthStorageData | undefined;\n\t\t\t\t\ttry {\n\t\t\t\t\t\tconst result = await this.storage.withLockAsync(async (current) => {\n\t\t\t\t\t\t\tconst data = this.parseStorageData(current);\n\t\t\t\t\t\t\tconst next = await fn(data[providerId] as Credential | undefined);\n\t\t\t\t\t\t\tif (next === undefined) {\n\t\t\t\t\t\t\t\tsynchronizedData = data;\n\t\t\t\t\t\t\t\treturn { result: data[providerId] as Credential | undefined };\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tconst merged = { ...data, [providerId]: next as AuthCredential };\n\t\t\t\t\t\t\tsynchronizedData = merged;\n\t\t\t\t\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t\t\t\t\t});\n\t\t\t\t\t\tif (synchronizedData) {\n\t\t\t\t\t\t\tthis.data = synchronizedData;\n\t\t\t\t\t\t\tthis.bumpCredentialVersion(providerId);\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthis.loadError = null;\n\t\t\t\t\t\treturn result;\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tthis.recordError(error);\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\tdelete: (providerId) =>\n\t\t\t\tthis.runCredentialMutation(async () => {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tif (this.storage.deleteProviderAsync) {\n\t\t\t\t\t\t\tthis.data = this.parseStorageData(await this.storage.deleteProviderAsync(providerId));\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tlet synchronizedData: AuthStorageData | undefined;\n\t\t\t\t\t\t\tawait this.storage.withLockAsync(async (current) => {\n\t\t\t\t\t\t\t\tconst data = this.parseStorageData(current);\n\t\t\t\t\t\t\t\tdelete data[providerId];\n\t\t\t\t\t\t\t\tsynchronizedData = data;\n\t\t\t\t\t\t\t\treturn { result: undefined, next: JSON.stringify(data, null, 2) };\n\t\t\t\t\t\t\t});\n\t\t\t\t\t\t\tif (synchronizedData) this.data = synchronizedData;\n\t\t\t\t\t\t}\n\t\t\t\t\t\tthis.bumpCredentialVersion(providerId);\n\t\t\t\t\t\tthis.loadError = null;\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\tthis.recordError(error);\n\t\t\t\t\t\tthrow error;\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t};\n\t}\n}\n"]}
+{"version":3,"file":"auth-storage.js","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAA2B,MAAM,4BAA4B,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAA2B,MAAM,4BAA4B,CAAC;AAKzH,MAAM,OAAO,WAAW;IAIvB,YAAoB,OAA2B;QAHvC,SAAI,GAAoB,EAAE,CAAC;QAIlC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,QAA4B;QACzC,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS;YACnC,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,WAAW,CAAC,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACzG,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,OAA2B;QAC7C,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAoB,EAAE;QACzC,MAAM,OAAO,GAAG,IAAI,0BAA0B,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrF,OAAO,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAEO,gBAAgB,CAAC,OAA2B;QACnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM;QACL,IAAI,CAAC;YACJ,IAAI,OAA2B,CAAC;YAChC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACP,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;oBACjC,OAAO,GAAG,OAAO,CAAC;oBAClB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9B,CAAC,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACR,8CAA8C;QAC/C,CAAC;IACF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgB;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACtD,IAAI,UAAU,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC;QACpD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,MAAM,CACX,QAAgB,EAChB,EAAwE;QAExE,IAAI,aAA0C,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjE,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACxB,aAAa,GAAG,WAAW,CAAC;gBAC5B,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,CAAC;YAED,MAAM,MAAM,GAAoB,EAAE,GAAG,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACrE,aAAa,GAAG,MAAM,CAAC;YACvB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;QACH,IAAI,aAAa;YAAE,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC7C,OAAO,MAAM,CAAC;IACf,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC5B,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YACjE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAO;QACR,CAAC;QACD,IAAI,aAA0C,CAAC;QAC/C,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACnD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7B,aAAa,GAAG,WAAW,CAAC;YAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,IAAI,aAAa;YAAE,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9C,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,IAAI;QACT,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7G,CAAC;CAED;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,QAA4B;IACpF,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS;QACnC,CAAC,CAAC,mBAAmB,CAAC,WAAW,CAAC;QAClC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;IAChG,IAAI,CAAC;QACJ,IAAI,UAAkC,CAAC;QACvC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YAC5B,UAAU,GAAG,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC","sourcesContent":["/**\n * CredentialStore implementation backed by auth.json.\n * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.\n */\n\nimport type { Credential, CredentialInfo, CredentialStore } from \"@earendil-works/pi-ai\";\nimport { join } from \"path\";\nimport { getAgentConfigPaths, getAgentDir } from \"../config.ts\";\nimport { FileAuthStorageBackend, InMemoryAuthStorageBackend, type AuthStorageBackend } from \"./auth-storage-backends.ts\";\nimport { resolveConfigValue } from \"./resolve-config-value.ts\";\n\nexport { FileAuthStorageBackend, InMemoryAuthStorageBackend, type AuthStorageBackend } from \"./auth-storage-backends.ts\";\n\nexport type AuthStorageData = Record<string, Credential>;\n\n\nexport class AuthStorage implements CredentialStore {\n\tprivate data: AuthStorageData = {};\n\tprivate storage: AuthStorageBackend;\n\n\tprivate constructor(storage: AuthStorageBackend) {\n\t\tthis.storage = storage;\n\t\tthis.reload();\n\t}\n\n\tstatic create(authPath?: string | string[]): AuthStorage {\n\t\tconst paths = authPath === undefined\n\t\t\t? getAgentConfigPaths(\"auth.json\")\n\t\t\t: Array.isArray(authPath) ? authPath : [authPath];\n\t\treturn new AuthStorage(new FileAuthStorageBackend(paths[0] ?? join(getAgentDir(), \"auth.json\"), paths));\n\t}\n\n\tstatic fromStorage(storage: AuthStorageBackend): AuthStorage {\n\t\treturn new AuthStorage(storage);\n\t}\n\n\tstatic inMemory(data: AuthStorageData = {}): AuthStorage {\n\t\tconst storage = new InMemoryAuthStorageBackend();\n\t\tstorage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));\n\t\treturn AuthStorage.fromStorage(storage);\n\t}\n\n\tprivate parseStorageData(content: string | undefined): AuthStorageData {\n\t\tif (!content) {\n\t\t\treturn {};\n\t\t}\n\t\treturn JSON.parse(content) as AuthStorageData;\n\t}\n\n\t/**\n\t * Reload credentials from storage.\n\t */\n\treload(): void {\n\t\ttry {\n\t\t\tlet content: string | undefined;\n\t\t\tif (this.storage.read) {\n\t\t\t\tcontent = this.storage.read();\n\t\t\t} else {\n\t\t\t\tthis.storage.withLock((current) => {\n\t\t\t\t\tcontent = current;\n\t\t\t\t\treturn { result: undefined };\n\t\t\t\t});\n\t\t\t}\n\t\t\tthis.data = this.parseStorageData(content);\n\t\t} catch {\n\t\t\t// Preserve the last valid in-memory snapshot.\n\t\t}\n\t}\n\n\tasync read(provider: string): Promise<Credential | undefined> {\n\t\tconst credential = this.data[provider];\n\t\tif (credential?.type !== \"api_key\") return credential;\n\t\tif (credential.key === undefined) return credential;\n\t\treturn { ...credential, key: resolveConfigValue(credential.key, credential.env) };\n\t}\n\n\tasync modify(\n\t\tprovider: string,\n\t\tfn: (current: Credential | undefined) => Promise<Credential | undefined>,\n\t): Promise<Credential | undefined> {\n\t\tlet persistedData: AuthStorageData | undefined;\n\t\tconst result = await this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tconst next = await fn(currentData[provider]);\n\t\t\tif (next === undefined) {\n\t\t\t\tpersistedData = currentData;\n\t\t\t\treturn { result: currentData[provider] };\n\t\t\t}\n\n\t\t\tconst merged: AuthStorageData = { ...currentData, [provider]: next };\n\t\t\tpersistedData = merged;\n\t\t\treturn { result: next, next: JSON.stringify(merged, null, 2) };\n\t\t});\n\t\tif (persistedData) this.data = persistedData;\n\t\treturn result;\n\t}\n\n\tasync delete(provider: string): Promise<void> {\n\t\tif (this.storage.deleteProviderAsync) {\n\t\t\tconst content = await this.storage.deleteProviderAsync(provider);\n\t\t\tthis.data = this.parseStorageData(content);\n\t\t\treturn;\n\t\t}\n\t\tlet persistedData: AuthStorageData | undefined;\n\t\tawait this.storage.withLockAsync(async (content) => {\n\t\t\tconst currentData = this.parseStorageData(content);\n\t\t\tdelete currentData[provider];\n\t\t\tpersistedData = currentData;\n\t\t\treturn { result: undefined, next: JSON.stringify(currentData, null, 2) };\n\t\t});\n\t\tif (persistedData) this.data = persistedData;\n\t}\n\n\t/** List credential metadata without resolving configured key values. */\n\tasync list(): Promise<readonly CredentialInfo[]> {\n\t\treturn Object.entries(this.data).map(([providerId, credential]) => ({ providerId, type: credential.type }));\n\t}\n\n}\n\n/** Read one persisted provider credential using Atomic's layered auth.json paths. */\nexport function readStoredCredential(providerId: string, authPath?: string | string[]): Credential | undefined {\n\tconst paths = authPath === undefined\n\t\t? getAgentConfigPaths(\"auth.json\")\n\t\t: Array.isArray(authPath) ? authPath : [authPath];\n\tconst storage = new FileAuthStorageBackend(paths[0] ?? join(getAgentDir(), \"auth.json\"), paths);\n\ttry {\n\t\tlet credential: Credential | undefined;\n\t\tstorage.withLock((content) => {\n\t\t\tcredential = content ? (JSON.parse(content) as AuthStorageData)[providerId] : undefined;\n\t\t\treturn { result: undefined };\n\t\t});\n\t\treturn credential;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n"]}

package/dist/core/copilot-env-routing.d.ts

@@ -0,0 +1,36 @@
+import type { Provider } from "@earendil-works/pi-ai";
+/**
+ * GitHub Copilot host routing for `COPILOT_GITHUB_TOKEN` (PAT) auth.
+ *
+ * Upstream pi pins `github-copilot` to `https://api.individual.githubcopilot.com`
+ * and only derives a per-tenant host inside the OAuth loader, which returns an
+ * `auth.baseUrl` from the token's `proxy-ep` segment. `envApiKeyAuth` resolves
+ * `COPILOT_GITHUB_TOKEN` without a base URL, so business/enterprise tokens are
+ * sent to the individual CAPI host and GitHub answers `421 Misdirected Request`.
+ *
+ * This module restores the routing precedence for the env-token path only; the
+ * OAuth path stays exactly upstream. A `models.json` provider `baseUrl` still
+ * wins, because it is applied as a later overlay in `applyModelsJson`.
+ */
+export type CopilotRoutingEnv = Readonly<Record<string, string | undefined>>;
+/**
+ * Resolve the Copilot API base URL for env-token auth, highest precedence first:
+ *
+ * 1. `COPILOT_API_TARGET` / `GITHUB_COPILOT_BASE_URL` explicit override
+ * 2. the `proxy-ep` segment embedded in `COPILOT_GITHUB_TOKEN`
+ * 3. an explicit `enterpriseDomain`
+ * 4. `GITHUB_SERVER_URL` (`*.ghe.com` tenant host, else the enterprise host)
+ * 5. the public Copilot routing hub when `COPILOT_GITHUB_TOKEN` is set
+ *
+ * Returns `undefined` when nothing applies, leaving pi's individual-host default.
+ */
+export declare function resolveCopilotEnvBaseUrl(env: CopilotRoutingEnv, enterpriseDomain?: string): string | undefined;
+/**
+ * Rewrite the builtin Copilot provider's host when `COPILOT_GITHUB_TOKEN` is set.
+ *
+ * Applied to the builtin layer so a `models.json` `baseUrl` override, which is
+ * composed afterwards, still takes precedence. Providers without the env token
+ * are returned untouched so OAuth logins keep pi's exact behavior.
+ */
+export declare function withCopilotEnvBaseUrl(provider: Provider, env: CopilotRoutingEnv): Provider;
+//# sourceMappingURL=copilot-env-routing.d.ts.map

package/dist/core/copilot-env-routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"copilot-env-routing.d.ts","sourceRoot":"","sources":["../../src/core/copilot-env-routing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAElE;;;;;;;;;;;;GAYG;AAEH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAyC7E;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACvC,GAAG,EAAE,iBAAiB,EACtB,gBAAgB,CAAC,EAAE,MAAM,GACvB,MAAM,GAAG,SAAS,CAoBpB;AASD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,iBAAiB,GAAG,QAAQ,CAU1F"}