@bastani/atomic 0.9.11-alpha.7 → 0.9.11-alpha.8

package/dist/core/auth-storage.d.ts

@@ -1,156 +1,29 @@
 /**
- * Credential storage for API keys and OAuth tokens.
- * Handles loading, saving, and refreshing credentials from auth.json.
- *
- * Uses file locking to prevent race conditions when multiple pi instances
- * try to refresh tokens simultaneously.
+ * CredentialStore implementation backed by auth.json.
+ * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.
  */
-import { type Credential, type CredentialStore, type ModelAuth, type OAuthCredentials } from "@earendil-works/pi-ai";
+import type { Credential, CredentialInfo, CredentialStore } from "@earendil-works/pi-ai";
 import { type AuthStorageBackend } from "./auth-storage-backends.ts";
-import { type AtomicOAuthLoginCallbacks } from "./oauth-provider-bridge.ts";
-export type ApiKeyCredential = {
-    type: "api_key";
-    key?: string;
-    /** Provider-scoped configuration persisted alongside the credential. */
-    env?: Record<string, string>;
-};
-export type OAuthCredential = {
-    type: "oauth";
-} & OAuthCredentials;
-export type AuthCredential = ApiKeyCredential | OAuthCredential;
-export type AuthStorageData = Record<string, AuthCredential>;
-export type AuthStatus = {
-    configured: boolean;
-    source?: "stored" | "runtime" | "environment" | "fallback" | "models_json_key" | "models_json_command";
-    label?: string;
-};
 export { FileAuthStorageBackend, InMemoryAuthStorageBackend, type AuthStorageBackend } from "./auth-storage-backends.ts";
-/** Read one persisted provider credential using Atomic's layered config paths. */
-export declare function readStoredCredential(providerId: string, authPath?: string | string[]): Credential | undefined;
-/**
- * Credential storage backed by a JSON file.
- */
-export declare class AuthStorage {
+export type AuthStorageData = Record<string, Credential>;
+export declare class AuthStorage implements CredentialStore {
     private data;
-    private runtimeOverrides;
-    private fallbackResolver?;
-    private loadError;
-    private errors;
-    private credentialMutationTail;
-    private credentialVersions;
     private storage;
     private constructor();
     static create(authPath?: string | string[]): AuthStorage;
     static fromStorage(storage: AuthStorageBackend): AuthStorage;
     static inMemory(data?: AuthStorageData): AuthStorage;
-    /**
-     * Set a runtime API key override (not persisted to disk).
-     * Used for CLI --api-key flag.
-     */
-    setRuntimeApiKey(provider: string, apiKey: string): void;
-    /** Read a non-persisted request override without resolving stored credentials. */
-    getRuntimeApiKey(provider: string): string | undefined;
-    /**
-     * Remove a runtime API key override.
-     */
-    removeRuntimeApiKey(provider: string): void;
-    /**
-     * Set a fallback resolver for API keys not found in auth.json or env vars.
-     * Used for custom provider keys from models.json.
-     */
-    setFallbackResolver(resolver: (provider: string) => string | undefined): void;
-    private recordError;
     private parseStorageData;
     /**
      * Reload credentials from storage.
      */
     reload(): void;
-    /**
-     * Read the credential snapshot, preferring the backend's lock-free `read()`.
-     * Falls back to a `withLock`-based read for custom backends that predate
-     * `read()` so the released `AuthStorageBackend` interface stays compatible.
-     */
-    private readSnapshot;
-    private bumpCredentialVersion;
-    private persistProviderChange;
-    /**
-     * Get credential for a provider.
-     */
-    get(provider: string): AuthCredential | undefined;
-    /**
-     * Set credential for a provider.
-     */
-    set(provider: string, credential: AuthCredential): void;
-    /**
-     * Remove credential for a provider.
-     */
-    remove(provider: string): void;
-    /**
-     * List all providers with credentials.
-     */
-    list(): string[];
-    /**
-     * Check if credentials exist for a provider in auth.json.
-     */
-    has(provider: string): boolean;
-    /**
-     * Check if any form of auth is configured for a provider.
-     * Unlike getApiKey(), this doesn't refresh OAuth tokens.
-     */
-    hasAuth(provider: string): boolean;
-    /**
-     * Return auth status without exposing credential values or refreshing tokens.
-     */
-    getAuthStatus(provider: string): AuthStatus;
-    /** Return a copy of all persisted credentials. */
-    getAll(): AuthStorageData;
-    drainErrors(): Error[];
-    /**
-     * Returns the error from the most recent failed credential load, or null when
-     * the last reload succeeded.
-     *
-     * A non-null value means stored credentials could NOT be read — e.g. the auth
-     * file was temporarily locked by another process (ELOCKED) or contained
-     * invalid JSON — so an empty/absent credential set is NOT authoritative.
-     * Callers that would otherwise report "No API key found" should surface this
-     * load failure instead of treating the provider as unauthenticated
-     * (issue #1431).
-     */
-    getLoadError(): Error | null;
-    /**
-     * Login to an OAuth provider.
-     */
-    login(providerId: string, callbacks: AtomicOAuthLoginCallbacks): Promise<void>;
-    /** Logout through the preserved synchronous persistence path. */
-    logout(provider: string): void;
-    /** Serialized logout for callers that need persistence completion. */
-    logoutAsync(provider: string): Promise<void>;
-    /**
-     * Refresh OAuth token with backend locking to prevent race conditions.
-     * Multiple pi instances may try to refresh simultaneously when tokens expire.
-     */
-    private refreshOAuthTokenWithLock;
-    /**
-     * Get API key for a provider.
-     * Priority:
-     * 1. Runtime override (CLI --api-key)
-     * 2. API key from auth.json
-     * 3. OAuth token from auth.json (auto-refreshed with locking)
-     * 4. Environment variable
-     * 5. Fallback resolver (models.json custom providers)
-     */
-    getModelAuth(providerId: string, options?: {
-        includeFallback?: boolean;
-    }): Promise<ModelAuth | undefined>;
-    getApiKey(providerId: string, options?: {
-        includeFallback?: boolean;
-    }): Promise<string | undefined>;
-    /**
-     * Get all registered OAuth providers
-     */
-    getOAuthProviders(): import("./oauth-provider-bridge.ts").OAuthProviderDescriptor[];
-    private runCredentialMutation;
-    /** Private async adapter for pi-ai's provider-owned Models runtime. */
-    asCredentialStore(): CredentialStore;
+    read(provider: string): Promise<Credential | undefined>;
+    modify(provider: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
+    delete(provider: string): Promise<void>;
+    /** List credential metadata without resolving configured key values. */
+    list(): Promise<readonly CredentialInfo[]>;
 }
+/** Read one persisted provider credential using Atomic's layered auth.json paths. */
+export declare function readStoredCredential(providerId: string, authPath?: string | string[]): Credential | undefined;
 //# sourceMappingURL=auth-storage.d.ts.map

package/dist/core/auth-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACN,KAAK,UAAU,EAEf,KAAK,eAAe,EACpB,KAAK,SAAS,EAEd,KAAK,gBAAgB,EACrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAsD,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACzH,OAAO,EACN,KAAK,yBAAyB,EAK9B,MAAM,4BAA4B,CAAC;AAGpC,MAAM,MAAM,gBAAgB,GAAG;IAC9B,IAAI,EAAE,SAAS,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,OAAO,CAAC;CACd,GAAG,gBAAgB,CAAC;AAErB,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,eAAe,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE7D,MAAM,MAAM,UAAU,GAAG;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;IACvG,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEzH,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,UAAU,GAAG,SAAS,CAE7G;AAED;;GAEG;AACH,qBAAa,WAAW;IACvB,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,gBAAgB,CAAkC;IAC1D,OAAO,CAAC,gBAAgB,CAAC,CAA2C;IACpE,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,sBAAsB,CAAoC;IAClE,OAAO,CAAC,kBAAkB,CAA6B;IAEvD,QAAgB,OAAO,CAAqB;IAE5C,OAAO,eAGN;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,WAAW,CAKvD;IAED,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE3D;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,WAAW,CAIvD;IAED;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAEvD;IACD,kFAAkF;IAClF,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAErD;IAGD;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE1C;IAED;;;OAGG;IACH,mBAAmB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAE5E;IAED,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,gBAAgB;IAOxB;;OAEG;IACH,MAAM,IAAI,IAAI,CAcb;IAED;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,qBAAqB;IA0B7B;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAEhD;IAED;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,GAAG,IAAI,CAEtD;IAED;;OAEG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAa7B;IAED;;OAEG;IACH,IAAI,IAAI,MAAM,EAAE,CAEf;IAED;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED;;;OAGG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMjC;IAED;;OAEG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAmB1C;IAED,kDAAkD;IAClD,MAAM,IAAI,eAAe,CAExB;IAED,WAAW,IAAI,KAAK,EAAE,CAIrB;IAED;;;;;;;;;;OAUG;IACH,YAAY,IAAI,KAAK,GAAG,IAAI,CAE3B;IAED;;OAEG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnF;IAED,iEAAiE;IACjE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE7B;IAED,sEAAsE;IAChE,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjD;IAED;;;OAGG;YACW,yBAAyB;IAyCvC;;;;;;;;OAQG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CA+B9G;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAExG;IAED;;OAEG;IACH,iBAAiB,mEAEhB;IAED,OAAO,CAAC,qBAAqB;IAS7B,uEAAuE;IACvE,iBAAiB,IAAI,eAAe,CA+DnC;CACD"}
+{"version":3,"file":"auth-storage.d.ts","sourceRoot":"","sources":["../../src/core/auth-storage.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGzF,OAAO,EAAsD,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGzH,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,KAAK,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEzH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAGzD,qBAAa,WAAY,YAAW,eAAe;IAClD,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,OAAO,CAAqB;IAEpC,OAAO,eAGN;IAED,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,WAAW,CAKvD;IAED,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CAE3D;IAED,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,WAAW,CAIvD;IAED,OAAO,CAAC,gBAAgB;IAOxB;;OAEG;IACH,MAAM,IAAI,IAAI,CAeb;IAEK,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAK5D;IAEK,MAAM,CACX,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GACtE,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAgBjC;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5C;IAED,wEAAwE;IAClE,IAAI,IAAI,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAE/C;CAED;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,UAAU,GAAG,SAAS,CAe7G"}

package/dist/core/auth-storage.js

@@ -1,32 +1,15 @@
 /**
- * Credential storage for API keys and OAuth tokens.
- * Handles loading, saving, and refreshing credentials from auth.json.
- *
- * Uses file locking to prevent race conditions when multiple pi instances
- * try to refresh tokens simultaneously.
+ * CredentialStore implementation backed by auth.json.
+ * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.
  */
-import { findEnvKeys, getEnvApiKey } from "@earendil-works/pi-ai/compat";
 import { join } from "path";
 import { getAgentConfigPaths, getAgentDir } from "../config.js";
 import { FileAuthStorageBackend, InMemoryAuthStorageBackend } from "./auth-storage-backends.js";
-import { getOAuthProviderDescriptors, loginOAuthProvider, oauthCredentialToAuth, refreshOAuthProvider, } from "./oauth-provider-bridge.js";
 import { resolveConfigValue } from "./resolve-config-value.js";
 export { FileAuthStorageBackend, InMemoryAuthStorageBackend } from "./auth-storage-backends.js";
-/** Read one persisted provider credential using Atomic's layered config paths. */
-export function readStoredCredential(providerId, authPath) {
-    return AuthStorage.create(authPath).get(providerId);
-}
-/**
- * Credential storage backed by a JSON file.
- */
 export class AuthStorage {
     constructor(storage) {
         this.data = {};
-        this.runtimeOverrides = new Map();
-        this.loadError = null;
-        this.errors = [];
-        this.credentialMutationTail = Promise.resolve();
-        this.credentialVersions = new Map();
         this.storage = storage;
         this.reload();
     }
@@ -44,34 +27,6 @@ export class AuthStorage {
         storage.withLock(() => ({ result: undefined, next: JSON.stringify(data, null, 2) }));
         return AuthStorage.fromStorage(storage);
     }
-    /**
-     * Set a runtime API key override (not persisted to disk).
-     * Used for CLI --api-key flag.
-     */
-    setRuntimeApiKey(provider, apiKey) {
-        this.runtimeOverrides.set(provider, apiKey);
-    }
-    /** Read a non-persisted request override without resolving stored credentials. */
-    getRuntimeApiKey(provider) {
-        return this.runtimeOverrides.get(provider);
-    }
-    /**
-     * Remove a runtime API key override.
-     */
-    removeRuntimeApiKey(provider) {
-        this.runtimeOverrides.delete(provider);
-    }
-    /**
-     * Set a fallback resolver for API keys not found in auth.json or env vars.
-     * Used for custom provider keys from models.json.
-     */
-    setFallbackResolver(resolver) {
-        this.fallbackResolver = resolver;
-    }
-    recordError(error) {
-        const normalizedError = error instanceof Error ? error : new Error(String(error));
-        this.errors.push(normalizedError);
-    }
     parseStorageData(content) {
         if (!content) {
             return {};
@@ -83,345 +38,84 @@ export class AuthStorage {
      */
     reload() {
         try {
-            // Pure read: never take the exclusive write lock. Writers replace
-            // auth.json atomically, so a lock-free read always sees a complete
-            // snapshot. This keeps many concurrent sessions from starving each other
-            // on the lock and misreporting configured providers as unreadable under
-            // contention (issue #1431).
-            const content = this.readSnapshot();
+            let content;
+            if (this.storage.read) {
+                content = this.storage.read();
+            }
+            else {
+                this.storage.withLock((current) => {
+                    content = current;
+                    return { result: undefined };
+                });
+            }
             this.data = this.parseStorageData(content);
-            this.loadError = null;
-        }
-        catch (error) {
-            this.loadError = error;
-            this.recordError(error);
-        }
-    }
-    /**
-     * Read the credential snapshot, preferring the backend's lock-free `read()`.
-     * Falls back to a `withLock`-based read for custom backends that predate
-     * `read()` so the released `AuthStorageBackend` interface stays compatible.
-     */
-    readSnapshot() {
-        if (this.storage.read) {
-            return this.storage.read();
         }
-        let content;
-        this.storage.withLock((current) => {
-            content = current;
-            return { result: undefined };
+        catch {
+            // Preserve the last valid in-memory snapshot.
+        }
+    }
+    async read(provider) {
+        const credential = this.data[provider];
+        if (credential?.type !== "api_key")
+            return credential;
+        if (credential.key === undefined)
+            return credential;
+        return { ...credential, key: resolveConfigValue(credential.key, credential.env) };
+    }
+    async modify(provider, fn) {
+        let persistedData;
+        const result = await this.storage.withLockAsync(async (content) => {
+            const currentData = this.parseStorageData(content);
+            const next = await fn(currentData[provider]);
+            if (next === undefined) {
+                persistedData = currentData;
+                return { result: currentData[provider] };
+            }
+            const merged = { ...currentData, [provider]: next };
+            persistedData = merged;
+            return { result: next, next: JSON.stringify(merged, null, 2) };
         });
-        return content;
-    }
-    bumpCredentialVersion(provider) {
-        this.credentialVersions.set(provider, (this.credentialVersions.get(provider) ?? 0) + 1);
-    }
-    persistProviderChange(provider, credential) {
-        if (this.loadError) {
-            this.reload();
-            if (this.loadError)
-                throw this.loadError;
-        }
-        try {
-            const persistedData = this.storage.withLock((current) => {
-                const currentData = this.parseStorageData(current);
-                const merged = { ...currentData };
-                if (credential) {
-                    merged[provider] = credential;
-                }
-                else {
-                    delete merged[provider];
-                }
-                return { result: merged, next: JSON.stringify(merged, null, 2) };
-            });
+        if (persistedData)
             this.data = persistedData;
-            this.bumpCredentialVersion(provider);
-            this.loadError = null;
-        }
-        catch (error) {
-            this.recordError(error);
-            throw error instanceof Error ? error : new Error(String(error));
-        }
-    }
-    /**
-     * Get credential for a provider.
-     */
-    get(provider) {
-        return this.data[provider] ?? undefined;
-    }
-    /**
-     * Set credential for a provider.
-     */
-    set(provider, credential) {
-        this.persistProviderChange(provider, credential);
+        return result;
     }
-    /**
-     * Remove credential for a provider.
-     */
-    remove(provider) {
-        if (!this.storage.deleteProvider) {
-            this.persistProviderChange(provider, undefined);
+    async delete(provider) {
+        if (this.storage.deleteProviderAsync) {
+            const content = await this.storage.deleteProviderAsync(provider);
+            this.data = this.parseStorageData(content);
             return;
         }
-        try {
-            this.data = this.parseStorageData(this.storage.deleteProvider(provider));
-            this.bumpCredentialVersion(provider);
-            this.loadError = null;
-        }
-        catch (error) {
-            this.recordError(error);
-            throw error instanceof Error ? error : new Error(String(error));
-        }
-    }
-    /**
-     * List all providers with credentials.
-     */
-    list() {
-        return Object.keys(this.data);
-    }
-    /**
-     * Check if credentials exist for a provider in auth.json.
-     */
-    has(provider) {
-        return provider in this.data;
-    }
-    /**
-     * Check if any form of auth is configured for a provider.
-     * Unlike getApiKey(), this doesn't refresh OAuth tokens.
-     */
-    hasAuth(provider) {
-        if (this.runtimeOverrides.has(provider))
-            return true;
-        if (this.data[provider])
-            return true;
-        if (findEnvKeys(provider)?.[0])
-            return true;
-        if (this.fallbackResolver?.(provider))
-            return true;
-        return false;
-    }
-    /**
-     * Return auth status without exposing credential values or refreshing tokens.
-     */
-    getAuthStatus(provider) {
-        if (this.data[provider]) {
-            return { configured: true, source: "stored" };
-        }
-        if (this.runtimeOverrides.has(provider)) {
-            return { configured: false, source: "runtime", label: "--api-key" };
-        }
-        const envKeys = findEnvKeys(provider);
-        if (envKeys?.[0]) {
-            return { configured: true, source: "environment", label: envKeys[0] };
-        }
-        if (this.fallbackResolver?.(provider)) {
-            return { configured: false, source: "fallback", label: "custom provider config" };
-        }
-        return { configured: false };
-    }
-    /** Return a copy of all persisted credentials. */
-    getAll() {
-        return { ...this.data };
-    }
-    drainErrors() {
-        const drained = [...this.errors];
-        this.errors = [];
-        return drained;
-    }
-    /**
-     * Returns the error from the most recent failed credential load, or null when
-     * the last reload succeeded.
-     *
-     * A non-null value means stored credentials could NOT be read — e.g. the auth
-     * file was temporarily locked by another process (ELOCKED) or contained
-     * invalid JSON — so an empty/absent credential set is NOT authoritative.
-     * Callers that would otherwise report "No API key found" should surface this
-     * load failure instead of treating the provider as unauthenticated
-     * (issue #1431).
-     */
-    getLoadError() {
-        return this.loadError;
-    }
-    /**
-     * Login to an OAuth provider.
-     */
-    async login(providerId, callbacks) {
-        const credential = await loginOAuthProvider(providerId, callbacks);
-        await this.asCredentialStore().modify(providerId, async () => credential);
-    }
-    /** Logout through the preserved synchronous persistence path. */
-    logout(provider) {
-        this.remove(provider);
+        let persistedData;
+        await this.storage.withLockAsync(async (content) => {
+            const currentData = this.parseStorageData(content);
+            delete currentData[provider];
+            persistedData = currentData;
+            return { result: undefined, next: JSON.stringify(currentData, null, 2) };
+        });
+        if (persistedData)
+            this.data = persistedData;
     }
-    /** Serialized logout for callers that need persistence completion. */
-    async logoutAsync(provider) {
-        await this.asCredentialStore().delete(provider);
+    /** List credential metadata without resolving configured key values. */
+    async list() {
+        return Object.entries(this.data).map(([providerId, credential]) => ({ providerId, type: credential.type }));
     }
-    /**
-     * Refresh OAuth token with backend locking to prevent race conditions.
-     * Multiple pi instances may try to refresh simultaneously when tokens expire.
-     */
-    async refreshOAuthTokenWithLock(providerId) {
-        return this.runCredentialMutation(async () => {
-            let synchronizedData;
-            const credentialVersion = this.credentialVersions.get(providerId) ?? 0;
-            const result = await this.storage.withLockAsync(async (current) => {
-                const currentData = this.parseStorageData(current);
-                synchronizedData = currentData;
-                const cred = currentData[providerId];
-                if (cred?.type !== "oauth")
-                    return { result: null };
-                const oauthCredential = { ...cred, type: "oauth" };
-                if (Date.now() < cred.expires) {
-                    const auth = await oauthCredentialToAuth(providerId, oauthCredential);
-                    return { result: auth ? { auth, newCredentials: cred } : null };
-                }
-                const refreshed = await refreshOAuthProvider(providerId, oauthCredential);
-                if (!refreshed)
-                    return { result: null };
-                if ((this.credentialVersions.get(providerId) ?? 0) !== credentialVersion) {
-                    synchronizedData = undefined;
-                    return { result: null };
-                }
-                const merged = {
-                    ...currentData,
-                    [providerId]: refreshed.credential,
-                };
-                synchronizedData = merged;
-                return {
-                    result: { auth: refreshed.auth, newCredentials: refreshed.credential },
-                    next: JSON.stringify(merged, null, 2),
-                };
-            });
-            if (synchronizedData)
-                this.data = synchronizedData;
-            this.loadError = null;
-            return result;
+}
+/** Read one persisted provider credential using Atomic's layered auth.json paths. */
+export function readStoredCredential(providerId, authPath) {
+    const paths = authPath === undefined
+        ? getAgentConfigPaths("auth.json")
+        : Array.isArray(authPath) ? authPath : [authPath];
+    const storage = new FileAuthStorageBackend(paths[0] ?? join(getAgentDir(), "auth.json"), paths);
+    try {
+        let credential;
+        storage.withLock((content) => {
+            credential = content ? JSON.parse(content)[providerId] : undefined;
+            return { result: undefined };
         });
+        return credential;
     }
-    /**
-     * Get API key for a provider.
-     * Priority:
-     * 1. Runtime override (CLI --api-key)
-     * 2. API key from auth.json
-     * 3. OAuth token from auth.json (auto-refreshed with locking)
-     * 4. Environment variable
-     * 5. Fallback resolver (models.json custom providers)
-     */
-    async getModelAuth(providerId, options) {
-        const runtimeKey = this.runtimeOverrides.get(providerId);
-        if (runtimeKey)
-            return { apiKey: runtimeKey };
-        const cred = this.data[providerId];
-        if (cred?.type === "api_key" && cred.key)
-            return { apiKey: resolveConfigValue(cred.key) };
-        if (cred?.type === "oauth") {
-            try {
-                if (Date.now() >= cred.expires) {
-                    return (await this.refreshOAuthTokenWithLock(providerId))?.auth;
-                }
-                return await oauthCredentialToAuth(providerId, { ...cred, type: "oauth" });
-            }
-            catch (error) {
-                this.recordError(error);
-                this.reload();
-                const updated = this.data[providerId];
-                if (updated?.type === "oauth" && Date.now() < updated.expires) {
-                    return oauthCredentialToAuth(providerId, { ...updated, type: "oauth" });
-                }
-                return undefined;
-            }
-        }
-        const envKey = getEnvApiKey(providerId);
-        if (envKey)
-            return { apiKey: envKey };
-        if (options?.includeFallback !== false) {
-            const fallback = this.fallbackResolver?.(providerId);
-            if (fallback)
-                return { apiKey: fallback };
-        }
+    catch {
         return undefined;
     }
-    async getApiKey(providerId, options) {
-        return (await this.getModelAuth(providerId, options))?.apiKey;
-    }
-    /**
-     * Get all registered OAuth providers
-     */
-    getOAuthProviders() {
-        return getOAuthProviderDescriptors();
-    }
-    runCredentialMutation(operation) {
-        const result = this.credentialMutationTail.then(operation, operation);
-        this.credentialMutationTail = result.then(() => undefined, () => undefined);
-        return result;
-    }
-    /** Private async adapter for pi-ai's provider-owned Models runtime. */
-    asCredentialStore() {
-        const runtimeCredential = (providerId) => {
-            const key = this.runtimeOverrides.get(providerId);
-            return key === undefined ? undefined : { type: "api_key", key };
-        };
-        return {
-            read: async (providerId) => runtimeCredential(providerId) ?? this.get(providerId),
-            list: async () => {
-                const providers = new Set([...this.list(), ...this.runtimeOverrides.keys()]);
-                return [...providers].map((providerId) => ({
-                    providerId,
-                    type: runtimeCredential(providerId)?.type ?? this.data[providerId].type,
-                }));
-            },
-            modify: (providerId, fn) => this.runCredentialMutation(async () => {
-                let synchronizedData;
-                try {
-                    const result = await this.storage.withLockAsync(async (current) => {
-                        const data = this.parseStorageData(current);
-                        const next = await fn(data[providerId]);
-                        if (next === undefined) {
-                            synchronizedData = data;
-                            return { result: data[providerId] };
-                        }
-                        const merged = { ...data, [providerId]: next };
-                        synchronizedData = merged;
-                        return { result: next, next: JSON.stringify(merged, null, 2) };
-                    });
-                    if (synchronizedData) {
-                        this.data = synchronizedData;
-                        this.bumpCredentialVersion(providerId);
-                    }
-                    this.loadError = null;
-                    return result;
-                }
-                catch (error) {
-                    this.recordError(error);
-                    throw error;
-                }
-            }),
-            delete: (providerId) => this.runCredentialMutation(async () => {
-                try {
-                    if (this.storage.deleteProviderAsync) {
-                        this.data = this.parseStorageData(await this.storage.deleteProviderAsync(providerId));
-                    }
-                    else {
-                        let synchronizedData;
-                        await this.storage.withLockAsync(async (current) => {
-                            const data = this.parseStorageData(current);
-                            delete data[providerId];
-                            synchronizedData = data;
-                            return { result: undefined, next: JSON.stringify(data, null, 2) };
-                        });
-                        if (synchronizedData)
-                            this.data = synchronizedData;
-                    }
-                    this.bumpCredentialVersion(providerId);
-                    this.loadError = null;
-                }
-                catch (error) {
-                    this.recordError(error);
-                    throw error;
-                }
-            }),
-        };
-    }
 }
 //# sourceMappingURL=auth-storage.js.map