@bastani/atomic 0.9.13-alpha.1 → 0.9.13-alpha.2

package/dist/cli/auth-command.js

@@ -0,0 +1,150 @@
+import { APP_NAME } from "../config.js";
+export class AuthCommandError extends Error {
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.exitCode = exitCode;
+        this.name = "AuthCommandError";
+    }
+}
+const AUTH_COMMAND_USAGE = {
+    check: `${APP_NAME} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]`,
+    api_key: `${APP_NAME} auth print-api-key --model <model> [--provider <provider>]`,
+    bearer_token: `${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]`,
+};
+export function getAuthCommandName(kind) {
+    return kind === "check" ? "auth check" : kind === "api_key" ? "auth print-api-key" : "auth print-bearer-token";
+}
+export function getAuthCommandUsage(kind) {
+    return AUTH_COMMAND_USAGE[kind];
+}
+export function isAuthCommandHelp(args) {
+    if (args[0] !== "auth")
+        return false;
+    if (args[1] === undefined || args[1] === "help" || args[1] === "--help" || args[1] === "-h")
+        return true;
+    const terminator = args.indexOf("--", 2);
+    const flags = args.slice(2, terminator === -1 ? undefined : terminator);
+    // Checks accept direct help flags. The print commands reserve every extra
+    // parser flag, including --help, as a usage error to keep their export stream narrow.
+    return args[1] === "check" && (flags.includes("--help") || flags.includes("-h"));
+}
+export function printAuthCommandHelp() {
+    console.error(`Usage:
+  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]
+  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]
+  ${APP_NAME} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]
+
+Credential print commands write one configured credential alone on stdout. Everything else —
+warnings, provider selection, refresh notices, and help — goes to stderr. --model is
+required for these exports, so no ambient model can emit a credential you did not name.
+
+Auth checks require at least one of --provider or --model. They print ready, not_ready,
+or invalid on stdout and refresh expired OAuth credentials by default; --no-refresh
+prevents a refresh and any auth.json mutation. --json includes the resolved provider
+when one is found, plus auth type and a reason when it is not ready. --credentials is
+an explicit export that needs --provider or an exact --model target; on a ready check
+it writes the credential, or includes it in JSON. A non-ready raw export leaves stdout
+empty and reports status on stderr.
+
+--min-expiry accepts ms, s, m, or h (for example 30m) and applies only to
+print-bearer-token, where it defaults to 30m. A token with less than that
+remaining is refreshed first. It remains reserved after --, so print-api-key
+still rejects it in either spelling.
+
+Credential-export exit codes:
+  0  credential written to stdout
+  1  usage error
+  2  no credential configured
+  3  provider ambiguous
+  4  credential kind unsupported for that provider
+  5  refresh failed (the stored credential is left untouched)
+  6  provider cannot mint a token that lives long enough
+  7  the provider's OAuth credential could not be used
+  8  the credential could not be written (nothing was emitted)
+  9  the credential was written only in part; stdout holds an unusable
+     fragment, which the caller must discard rather than use
+
+Auth-check exit codes:
+  0  provider is ready
+  1  provider is not ready
+  2  auth state or command is invalid
+  8  with --credentials, the credential could not be written
+  9  with --credentials, only part of the credential was written`);
+}
+function parseDuration(value, exitCode) {
+    const match = value ? /^(\d+)(ms|s|m|h)$/iu.exec(value) : undefined;
+    if (!match)
+        throw new AuthCommandError("--min-expiry must use a duration such as 30m or 1h", exitCode);
+    const unit = match[2].toLowerCase();
+    const scale = unit === "ms" ? 1 : unit === "s" ? 1_000 : unit === "m" ? 60_000 : 3_600_000;
+    return Number(match[1]) * scale;
+}
+/** Parse the `atomic auth` command surface before normal startup. */
+export function parseAuthCommand(args) {
+    if (args[0] !== "auth")
+        return undefined;
+    const kind = args[1] === "check"
+        ? "check"
+        : args[1] === "print-api-key"
+            ? "api_key"
+            : args[1] === "print-bearer-token"
+                ? "bearer_token"
+                : undefined;
+    if (!kind) {
+        throw new AuthCommandError(`Unknown auth command "${args[1] ?? ""}". Use "${APP_NAME} auth print-api-key", "${APP_NAME} auth print-bearer-token", or "${APP_NAME} auth check".`);
+    }
+    const exitCode = kind === "check" ? 2 : 1;
+    const commandArgs = [];
+    let json = false;
+    let credentials = false;
+    let noRefresh = false;
+    let minExpiryMs;
+    let optionsEnded = false;
+    for (let index = 2; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === "--") {
+            optionsEnded = true;
+            commandArgs.push(arg);
+            continue;
+        }
+        const inlineMinExpiry = arg.startsWith("--min-expiry=") ? arg.slice("--min-expiry=".length) : undefined;
+        if (arg === "--min-expiry" || inlineMinExpiry !== undefined) {
+            if (kind !== "bearer_token") {
+                throw new AuthCommandError("--min-expiry is only supported by print-bearer-token", exitCode);
+            }
+            minExpiryMs = parseDuration(inlineMinExpiry ?? args[++index], exitCode);
+            continue;
+        }
+        if (!optionsEnded && (arg === "--json" || arg === "--credentials" || arg === "--no-refresh")) {
+            if (kind !== "check")
+                throw new AuthCommandError(`${arg} is only supported by auth check`, exitCode);
+            if (arg === "--json")
+                json = true;
+            else if (arg === "--credentials")
+                credentials = true;
+            else
+                noRefresh = true;
+            continue;
+        }
+        commandArgs.push(arg);
+    }
+    return minExpiryMs === undefined
+        ? { kind, args: commandArgs, json, credentials, noRefresh }
+        : { kind, args: commandArgs, json, credentials, noRefresh, minExpiryMs };
+}
+export function validateAuthCheckArgs(args) {
+    const provider = args.provider?.trim() || undefined;
+    const model = args.model?.trim() || undefined;
+    if (args.unknownFlags.size > 0) {
+        const option = args.unknownFlags.keys().next().value;
+        throw new AuthCommandError(`Unknown option --${option} for "auth check".`);
+    }
+    if (args.apiKey !== undefined || args.messages.length > 0 || args.fileArgs.length > 0) {
+        throw new AuthCommandError("Auth checks only accept --provider and --model");
+    }
+    if (!provider && !model) {
+        throw new AuthCommandError("Auth checks require --provider <provider> or --model <model>");
+    }
+    return { provider, model };
+}
+//# sourceMappingURL=auth-command.js.map

package/dist/cli/auth-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-command.js","sourceRoot":"","sources":["../../src/cli/auth-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAgBxC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAO1C,YAAY,OAAe,EAAE,QAAQ,GAAG,CAAC;QACxC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IAChC,CAAC;CACD;AAED,MAAM,kBAAkB,GAAoC;IAC3D,KAAK,EAAE,GAAG,QAAQ,+FAA+F;IACjH,OAAO,EAAE,GAAG,QAAQ,6DAA6D;IACjF,YAAY,EAAE,GAAG,QAAQ,4FAA4F;CACrH,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACvD,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACxD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC/C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzG,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACxE,0EAA0E;IAC1E,sFAAsF;IACtF,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,oBAAoB;IACnC,OAAO,CAAC,KAAK,CAAC;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iEAqCqD,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB,EAAE,QAAgB;IACjE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,oDAAoD,EAAE,QAAQ,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AACjC,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC9C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,IAAI,GACT,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO;QAClB,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,oBAAoB;gBACjC,CAAC,CAAC,cAAc;gBAChB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACzB,yBAAyB,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,QAAQ,0BAA0B,QAAQ,kCAAkC,QAAQ,eAAe,CACpJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,WAA+B,CAAC;IACpC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAClB,YAAY,GAAG,IAAI,CAAC;YACpB,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,SAAS;QACV,CAAC;QACD,MAAM,eAAe,GAAG,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,IAAI,GAAG,KAAK,cAAc,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAC7D,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC7B,MAAM,IAAI,gBAAgB,CAAC,sDAAsD,EAAE,QAAQ,CAAC,CAAC;YAC9F,CAAC;YACD,WAAW,GAAG,aAAa,CAAC,eAAe,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;YACxE,SAAS;QACV,CAAC;QACD,IAAI,CAAC,YAAY,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,cAAc,CAAC,EAAE,CAAC;YAC9F,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,GAAG,kCAAkC,EAAE,QAAQ,CAAC,CAAC;YACrG,IAAI,GAAG,KAAK,QAAQ;gBAAE,IAAI,GAAG,IAAI,CAAC;iBAC7B,IAAI,GAAG,KAAK,eAAe;gBAAE,WAAW,GAAG,IAAI,CAAC;;gBAChD,SAAS,GAAG,IAAI,CAAC;YACtB,SAAS;QACV,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,WAAW,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE;QAC3D,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAU;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IAC9C,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACrD,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,MAAM,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,gBAAgB,CAAC,gDAAgD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,8DAA8D,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC","sourcesContent":["import { APP_NAME } from \"../config.ts\";\nimport type { Args } from \"./args.ts\";\n\nexport type AuthCommandKind = \"check\" | \"api_key\" | \"bearer_token\";\n\nexport interface AuthCommand {\n\tkind: AuthCommandKind;\n\t/** Remaining argv for the normal parser. */\n\targs: string[];\n\tjson: boolean;\n\t/** `auth check` emits a resolved credential only with this explicit opt-in. */\n\tcredentials: boolean;\n\tnoRefresh: boolean;\n\tminExpiryMs?: number;\n}\n\nexport class AuthCommandError extends Error {\n\t// Declared and assigned explicitly rather than as a constructor parameter\n\t// property: `tsconfig.base.json` sets `erasableSyntaxOnly`, under which a\n\t// parameter property is TS1294. Root `tsc --noEmit` does not surface it,\n\t// but the shipped build does.\n\treadonly exitCode: number;\n\n\tconstructor(message: string, exitCode = 1) {\n\t\tsuper(message);\n\t\tthis.exitCode = exitCode;\n\t\tthis.name = \"AuthCommandError\";\n\t}\n}\n\nconst AUTH_COMMAND_USAGE: Record<AuthCommandKind, string> = {\n\tcheck: `${APP_NAME} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]`,\n\tapi_key: `${APP_NAME} auth print-api-key --model <model> [--provider <provider>]`,\n\tbearer_token: `${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]`,\n};\n\nexport function getAuthCommandName(kind: AuthCommandKind): string {\n\treturn kind === \"check\" ? \"auth check\" : kind === \"api_key\" ? \"auth print-api-key\" : \"auth print-bearer-token\";\n}\n\nexport function getAuthCommandUsage(kind: AuthCommandKind): string {\n\treturn AUTH_COMMAND_USAGE[kind];\n}\n\nexport function isAuthCommandHelp(args: string[]): boolean {\n\tif (args[0] !== \"auth\") return false;\n\tif (args[1] === undefined || args[1] === \"help\" || args[1] === \"--help\" || args[1] === \"-h\") return true;\n\tconst terminator = args.indexOf(\"--\", 2);\n\tconst flags = args.slice(2, terminator === -1 ? undefined : terminator);\n\t// Checks accept direct help flags. The print commands reserve every extra\n\t// parser flag, including --help, as a usage error to keep their export stream narrow.\n\treturn args[1] === \"check\" && (flags.includes(\"--help\") || flags.includes(\"-h\"));\n}\n\nexport function printAuthCommandHelp(): void {\n\tconsole.error(`Usage:\n  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]\n  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]\n  ${APP_NAME} auth check [--provider <provider>] [--model <model>] [--json] [--credentials] [--no-refresh]\n\nCredential print commands write one configured credential alone on stdout. Everything else —\nwarnings, provider selection, refresh notices, and help — goes to stderr. --model is\nrequired for these exports, so no ambient model can emit a credential you did not name.\n\nAuth checks require at least one of --provider or --model. They print ready, not_ready,\nor invalid on stdout and refresh expired OAuth credentials by default; --no-refresh\nprevents a refresh and any auth.json mutation. --json includes the resolved provider\nwhen one is found, plus auth type and a reason when it is not ready. --credentials is\nan explicit export that needs --provider or an exact --model target; on a ready check\nit writes the credential, or includes it in JSON. A non-ready raw export leaves stdout\nempty and reports status on stderr.\n\n--min-expiry accepts ms, s, m, or h (for example 30m) and applies only to\nprint-bearer-token, where it defaults to 30m. A token with less than that\nremaining is refreshed first. It remains reserved after --, so print-api-key\nstill rejects it in either spelling.\n\nCredential-export exit codes:\n  0  credential written to stdout\n  1  usage error\n  2  no credential configured\n  3  provider ambiguous\n  4  credential kind unsupported for that provider\n  5  refresh failed (the stored credential is left untouched)\n  6  provider cannot mint a token that lives long enough\n  7  the provider's OAuth credential could not be used\n  8  the credential could not be written (nothing was emitted)\n  9  the credential was written only in part; stdout holds an unusable\n     fragment, which the caller must discard rather than use\n\nAuth-check exit codes:\n  0  provider is ready\n  1  provider is not ready\n  2  auth state or command is invalid\n  8  with --credentials, the credential could not be written\n  9  with --credentials, only part of the credential was written`);\n}\n\nfunction parseDuration(value: string | undefined, exitCode: number): number {\n\tconst match = value ? /^(\\d+)(ms|s|m|h)$/iu.exec(value) : undefined;\n\tif (!match) throw new AuthCommandError(\"--min-expiry must use a duration such as 30m or 1h\", exitCode);\n\tconst unit = match[2].toLowerCase();\n\tconst scale = unit === \"ms\" ? 1 : unit === \"s\" ? 1_000 : unit === \"m\" ? 60_000 : 3_600_000;\n\treturn Number(match[1]) * scale;\n}\n\n/** Parse the `atomic auth` command surface before normal startup. */\nexport function parseAuthCommand(args: string[]): AuthCommand | undefined {\n\tif (args[0] !== \"auth\") return undefined;\n\n\tconst kind: AuthCommandKind | undefined =\n\t\targs[1] === \"check\"\n\t\t\t? \"check\"\n\t\t\t: args[1] === \"print-api-key\"\n\t\t\t\t? \"api_key\"\n\t\t\t\t: args[1] === \"print-bearer-token\"\n\t\t\t\t\t? \"bearer_token\"\n\t\t\t\t\t: undefined;\n\tif (!kind) {\n\t\tthrow new AuthCommandError(\n\t\t\t`Unknown auth command \"${args[1] ?? \"\"}\". Use \"${APP_NAME} auth print-api-key\", \"${APP_NAME} auth print-bearer-token\", or \"${APP_NAME} auth check\".`,\n\t\t);\n\t}\n\n\tconst exitCode = kind === \"check\" ? 2 : 1;\n\tconst commandArgs: string[] = [];\n\tlet json = false;\n\tlet credentials = false;\n\tlet noRefresh = false;\n\tlet minExpiryMs: number | undefined;\n\tlet optionsEnded = false;\n\tfor (let index = 2; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tif (arg === \"--\") {\n\t\t\toptionsEnded = true;\n\t\t\tcommandArgs.push(arg);\n\t\t\tcontinue;\n\t\t}\n\t\tconst inlineMinExpiry = arg.startsWith(\"--min-expiry=\") ? arg.slice(\"--min-expiry=\".length) : undefined;\n\t\tif (arg === \"--min-expiry\" || inlineMinExpiry !== undefined) {\n\t\t\tif (kind !== \"bearer_token\") {\n\t\t\t\tthrow new AuthCommandError(\"--min-expiry is only supported by print-bearer-token\", exitCode);\n\t\t\t}\n\t\t\tminExpiryMs = parseDuration(inlineMinExpiry ?? args[++index], exitCode);\n\t\t\tcontinue;\n\t\t}\n\t\tif (!optionsEnded && (arg === \"--json\" || arg === \"--credentials\" || arg === \"--no-refresh\")) {\n\t\t\tif (kind !== \"check\") throw new AuthCommandError(`${arg} is only supported by auth check`, exitCode);\n\t\t\tif (arg === \"--json\") json = true;\n\t\t\telse if (arg === \"--credentials\") credentials = true;\n\t\t\telse noRefresh = true;\n\t\t\tcontinue;\n\t\t}\n\t\tcommandArgs.push(arg);\n\t}\n\n\treturn minExpiryMs === undefined\n\t\t? { kind, args: commandArgs, json, credentials, noRefresh }\n\t\t: { kind, args: commandArgs, json, credentials, noRefresh, minExpiryMs };\n}\n\nexport function validateAuthCheckArgs(args: Args): { provider?: string; model?: string } {\n\tconst provider = args.provider?.trim() || undefined;\n\tconst model = args.model?.trim() || undefined;\n\tif (args.unknownFlags.size > 0) {\n\t\tconst option = args.unknownFlags.keys().next().value;\n\t\tthrow new AuthCommandError(`Unknown option --${option} for \"auth check\".`);\n\t}\n\tif (args.apiKey !== undefined || args.messages.length > 0 || args.fileArgs.length > 0) {\n\t\tthrow new AuthCommandError(\"Auth checks only accept --provider and --model\");\n\t}\n\tif (!provider && !model) {\n\t\tthrow new AuthCommandError(\"Auth checks require --provider <provider> or --model <model>\");\n\t}\n\treturn { provider, model };\n}\n"]}

package/dist/cli/config-selector.js

@@ -1,7 +1,7 @@
 /**
  * TUI config selector for `pi config` command
  */
-import { ProcessTerminal, TUI } from "@earendil-works/pi-tui";
+import { ProcessTerminal, TuiMainScreen } from "@earendil-works/pi-tui";
 import { ConfigSelectorComponent } from "../modes/interactive/components/config-selector.js";
 import { initTheme, stopThemeWatcher } from "../modes/interactive/theme/theme.js";
 /** Show TUI config selector and return when closed */
@@ -9,7 +9,7 @@ export async function selectConfig(options) {
     // Initialize theme before showing TUI
     initTheme(options.settingsManager.getTheme(), true);
     return new Promise((resolve) => {
-        const ui = new TUI(new ProcessTerminal(), undefined, options.agentDir);
+        const ui = new TuiMainScreen(new ProcessTerminal(), undefined, options.agentDir);
         let resolved = false;
         const selector = new ConfigSelectorComponent(options.resolvedPaths, options.settingsManager, options.cwd, options.agentDir, () => {
             if (!resolved) {

package/dist/cli/config-selector.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-selector.js","sourceRoot":"","sources":["../../src/cli/config-selector.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAA4B,MAAM,oDAAoD,CAAC;AACvH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAWlF,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA8B;IAChE,sCAAsC;IACtC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;IAEpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,IAAI,eAAe,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,QAAQ,GAAG,IAAI,uBAAuB,CAC3C,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,QAAQ,EAChB,GAAG,EAAE;YACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,CAAC;gBAChB,EAAE,CAAC,IAAI,EAAE,CAAC;gBACV,gBAAgB,EAAE,CAAC;gBACnB,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC,EACD,GAAG,EAAE;YACJ,EAAE,CAAC,IAAI,EAAE,CAAC;YACV,gBAAgB,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,EACD,GAAG,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EACxB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAChB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,oBAAoB,CAC5B,CAAC;QAEF,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC;QACxC,EAAE,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * TUI config selector for `pi config` command\n */\n\nimport { ProcessTerminal, TUI } from \"@earendil-works/pi-tui\";\nimport type { SettingsManager } from \"../core/settings-manager.ts\";\nimport { ConfigSelectorComponent, type ScopedResolvedPaths } from \"../modes/interactive/components/config-selector.ts\";\nimport { initTheme, stopThemeWatcher } from \"../modes/interactive/theme/theme.ts\";\n\nexport interface ConfigSelectorOptions {\n\tresolvedPaths: ScopedResolvedPaths;\n\tsettingsManager: SettingsManager;\n\tcwd: string;\n\tagentDir: string;\n\twriteScope: \"global\" | \"project\";\n\tprojectModeAvailable: boolean;\n}\n\n/** Show TUI config selector and return when closed */\nexport async function selectConfig(options: ConfigSelectorOptions): Promise<void> {\n\t// Initialize theme before showing TUI\n\tinitTheme(options.settingsManager.getTheme(), true);\n\n\treturn new Promise((resolve) => {\n\t\tconst ui = new TUI(new ProcessTerminal(), undefined, options.agentDir);\n\t\tlet resolved = false;\n\n\t\tconst selector = new ConfigSelectorComponent(\n\t\t\toptions.resolvedPaths,\n\t\t\toptions.settingsManager,\n\t\t\toptions.cwd,\n\t\t\toptions.agentDir,\n\t\t\t() => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tstopThemeWatcher();\n\t\t\t\t\tresolve();\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tui.stop();\n\t\t\t\tstopThemeWatcher();\n\t\t\t\tprocess.exit(0);\n\t\t\t},\n\t\t\t() => ui.requestRender(),\n\t\t\tui.terminal.rows,\n\t\t\toptions.writeScope,\n\t\t\toptions.projectModeAvailable,\n\t\t);\n\n\t\tui.addChild(selector);\n\t\tui.setFocus(selector.getResourceList());\n\t\tui.start();\n\t});\n}\n"]}
+{"version":3,"file":"config-selector.js","sourceRoot":"","sources":["../../src/cli/config-selector.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAExE,OAAO,EAAE,uBAAuB,EAA4B,MAAM,oDAAoD,CAAC;AACvH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAWlF,sDAAsD;AACtD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA8B;IAChE,sCAAsC;IACtC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;IAEpD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC,IAAI,eAAe,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjF,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,QAAQ,GAAG,IAAI,uBAAuB,CAC3C,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,QAAQ,EAChB,GAAG,EAAE;YACJ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,QAAQ,GAAG,IAAI,CAAC;gBAChB,EAAE,CAAC,IAAI,EAAE,CAAC;gBACV,gBAAgB,EAAE,CAAC;gBACnB,OAAO,EAAE,CAAC;YACX,CAAC;QACF,CAAC,EACD,GAAG,EAAE;YACJ,EAAE,CAAC,IAAI,EAAE,CAAC;YACV,gBAAgB,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,EACD,GAAG,EAAE,CAAC,EAAE,CAAC,aAAa,EAAE,EACxB,EAAE,CAAC,QAAQ,CAAC,IAAI,EAChB,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,oBAAoB,CAC5B,CAAC;QAEF,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACtB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC;QACxC,EAAE,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * TUI config selector for `pi config` command\n */\n\nimport { ProcessTerminal, TuiMainScreen } from \"@earendil-works/pi-tui\";\nimport type { SettingsManager } from \"../core/settings-manager.ts\";\nimport { ConfigSelectorComponent, type ScopedResolvedPaths } from \"../modes/interactive/components/config-selector.ts\";\nimport { initTheme, stopThemeWatcher } from \"../modes/interactive/theme/theme.ts\";\n\nexport interface ConfigSelectorOptions {\n\tresolvedPaths: ScopedResolvedPaths;\n\tsettingsManager: SettingsManager;\n\tcwd: string;\n\tagentDir: string;\n\twriteScope: \"global\" | \"project\";\n\tprojectModeAvailable: boolean;\n}\n\n/** Show TUI config selector and return when closed */\nexport async function selectConfig(options: ConfigSelectorOptions): Promise<void> {\n\t// Initialize theme before showing TUI\n\tinitTheme(options.settingsManager.getTheme(), true);\n\n\treturn new Promise((resolve) => {\n\t\tconst ui = new TuiMainScreen(new ProcessTerminal(), undefined, options.agentDir);\n\t\tlet resolved = false;\n\n\t\tconst selector = new ConfigSelectorComponent(\n\t\t\toptions.resolvedPaths,\n\t\t\toptions.settingsManager,\n\t\t\toptions.cwd,\n\t\t\toptions.agentDir,\n\t\t\t() => {\n\t\t\t\tif (!resolved) {\n\t\t\t\t\tresolved = true;\n\t\t\t\t\tui.stop();\n\t\t\t\t\tstopThemeWatcher();\n\t\t\t\t\tresolve();\n\t\t\t\t}\n\t\t\t},\n\t\t\t() => {\n\t\t\t\tui.stop();\n\t\t\t\tstopThemeWatcher();\n\t\t\t\tprocess.exit(0);\n\t\t\t},\n\t\t\t() => ui.requestRender(),\n\t\t\tui.terminal.rows,\n\t\t\toptions.writeScope,\n\t\t\toptions.projectModeAvailable,\n\t\t);\n\n\t\tui.addChild(selector);\n\t\tui.setFocus(selector.getResourceList());\n\t\tui.start();\n\t});\n}\n"]}

package/dist/cli/credential-print.d.ts

@@ -1,13 +1,14 @@
 /**
- * `atomic auth print-api-key` / `atomic auth print-bearer-token`.
+ * `atomic auth print-api-key` / `atomic auth print-bearer-token` and the
+ * explicit `atomic auth check --credentials` export path.
  *
  * The only door in Atomic whose purpose is emitting a secret. Everything here
  * exists to keep that egress narrow:
- *
  * - the secret leaves as a `Secret`, which cannot be interpolated, serialized,
  *   or inspected, and is consumed exactly once by the stdout writer;
- * - `--model` is required, so no ambient "current model" can emit a credential
- *   the caller did not name;
+ * - every export has an explicit target: the print commands require `--model`,
+ *   and auth checks require `--provider` or an exact `--model` plus
+ *   `--credentials`;
  * - there is no `--output <file>` and no clipboard path — stdout only;
  * - every failure is a distinct exit code, and stdout stays empty on all of
  *   them but one — `CredentialTruncated` (exit 9) exists to report the case
@@ -73,14 +74,21 @@ export declare class Secret {
     [Symbol.toPrimitive](): never;
     [inspect.custom](): string;
 }
+/** Public readiness fields emitted with a credential under `auth check --json --credentials`. */
+export interface CredentialJsonFields {
+    status: string;
+    provider: string;
+    authType?: string;
+}
 /**
  * The single credential egress in `src`.
  *
- * `Secret.take()` is called here and nowhere else in the source tree, so this
- * is the one statement that can turn a configured credential back into a string
- * and the one that hands it to the real stdout. A caller — `main.ts` included —
- * receives a `Secret` it cannot read, print, or serialize, so a second export
- * path cannot be grafted on without moving this function.
+ * `credentialPayload` opens the secret only while building this one payload,
+ * and this guarded write is the only path that hands it to real stdout. A
+ * caller — `main.ts` included — receives a `Secret` it cannot read, print, or
+ * serialize, so it cannot add a second export path without crossing this door.
+ * `test/credential-print.test.ts` pins both the `take()` sites and every
+ * data-bearing real-stdout write in `packages/coding-agent/src`.
  *
  * A failed payload write is answered from the stream rather than from the shape
  * of the error, because `bytesWritten` says how much of the credential actually
@@ -103,11 +111,8 @@ export declare class Secret {
  * the one code in this taxonomy whose contract is *not* an empty stdout —
  * stated as such in `EXIT_CODES` and asserted through `STDOUT_EMPTY_ON_EXIT`,
  * rather than left for a caller to discover.
- *
- * `test/credential-print.test.ts` asserts that chokepoint against the whole of
- * `packages/coding-agent/src`.
  */
-export declare function emitCredential(secret: Secret): Promise<void>;
+export declare function emitCredential(secret: Secret, jsonFields: CredentialJsonFields | undefined): Promise<void>;
 /**
  * The single place a thrown value becomes an exit code for this door.
  *
@@ -115,16 +120,6 @@ export declare function emitCredential(secret: Secret): Promise<void>;
  * stdout empty, so an exit code from this door never contradicts the stream.
  */
 export declare function toCredentialPrintError(error: unknown): CredentialPrintError;
-export interface CredentialPrintCommand {
-    kind: CredentialPrintKind;
-    /** Remaining argv for the normal parser (`--model`, `--provider`). */
-    args: string[];
-    minExpiryMs?: number;
-}
-export declare function isCredentialPrintHelp(args: string[]): boolean;
-export declare function printCredentialPrintHelp(): void;
-/** Parse the `auth` command surface before normal startup. */
-export declare function parseCredentialPrintCommand(args: string[]): CredentialPrintCommand | undefined;
 export declare function validateCredentialPrintArgs(args: Args): void;
 export declare function redactCredentialShapes(text: string): string;
 /**

package/dist/cli/credential-print.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-print.d.ts","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,cAAc,CAAC;AAE7D,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC,QAAc,CAAC;AAE9D;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC,OAAO,GACP,wBAAwB,GACxB,mBAAmB,GACnB,4BAA4B,GAC5B,eAAe,GACf,wBAAwB,GACxB,kBAAkB,GAClB,sBAAsB,GACtB,qBAAqB,CAAC;AAEzB;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAU/D,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,wBAAwB,CAEtE,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,YAAY,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAKzF;CACD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,MAAM;;IAGlB,YAAY,KAAK,EAAE,MAAM,EAExB;IAED,qEAAqE;IACrE,IAAI,IAAI,MAAM,CAOb;IAED,QAAQ,IAAI,KAAK,CAEhB;IAED,MAAM,IAAI,KAAK,CAEd;IAED,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,CAE5B;IAED,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAEzB;CACD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoClE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAO3E;AAED,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,sEAAsE;IACtE,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAI7D;AAED,wBAAgB,wBAAwB,IAAI,IAAI,CA8B/C;AAYD,8DAA8D;AAC9D,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,sBAAsB,GAAG,SAAS,CAiC9F;AA6BD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAiB5D;AAsDD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY3D;AAED;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,6BAA6B,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,oBAAoB,CAe7E;AA8CD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,mBAAmB,EACzB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CA6GjB"}
+{"version":3,"file":"credential-print.d.ts","sourceRoot":"","sources":["../../src/cli/credential-print.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,cAAc,CAAC;AAE7D,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC,QAAc,CAAC;AAE9D;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC,OAAO,GACP,wBAAwB,GACxB,mBAAmB,GACnB,4BAA4B,GAC5B,eAAe,GACf,wBAAwB,GACxB,kBAAkB,GAClB,sBAAsB,GACtB,qBAAqB,CAAC;AAEzB;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAU/D,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,wBAAwB,CAEtE,CAAC;AAEF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,YAAY,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAKzF;CACD;AAED;;;;;;;;;;GAUG;AACH,qBAAa,MAAM;;IAGlB,YAAY,KAAK,EAAE,MAAM,EAExB;IAED,qEAAqE;IACrE,IAAI,IAAI,MAAM,CAOb;IAED,QAAQ,IAAI,KAAK,CAEhB;IAED,MAAM,IAAI,KAAK,CAEd;IAED,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,KAAK,CAE5B;IAED,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAEzB;CACD;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAO3E;AA6BD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAiB5D;AAsDD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY3D;AAED;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,6BAA6B,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,oBAAoB,CAe7E;AA8CD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,mBAAmB,EACzB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CA6GjB"}

package/dist/cli/credential-print.js

@@ -1,13 +1,14 @@
 /**
- * `atomic auth print-api-key` / `atomic auth print-bearer-token`.
+ * `atomic auth print-api-key` / `atomic auth print-bearer-token` and the
+ * explicit `atomic auth check --credentials` export path.
  *
  * The only door in Atomic whose purpose is emitting a secret. Everything here
  * exists to keep that egress narrow:
- *
  * - the secret leaves as a `Secret`, which cannot be interpolated, serialized,
  *   or inspected, and is consumed exactly once by the stdout writer;
- * - `--model` is required, so no ambient "current model" can emit a credential
- *   the caller did not name;
+ * - every export has an explicit target: the print commands require `--model`,
+ *   and auth checks require `--provider` or an exact `--model` plus
+ *   `--credentials`;
  * - there is no `--output <file>` and no clipboard path — stdout only;
  * - every failure is a distinct exit code, and stdout stays empty on all of
  *   them but one — `CredentialTruncated` (exit 9) exists to report the case
@@ -22,7 +23,6 @@
  */
 import { inspect } from "node:util";
 import { ModelsError } from "@earendil-works/pi-ai";
-import { APP_NAME } from "../config.js";
 import { resolveCliModel } from "../core/model-resolver.js";
 import { flushRawStdout, RawStdoutWriteError, writeRawStdoutOnce } from "../core/output-guard.js";
 /** Bearer tokens are refreshed unless they still have this much life left. */
@@ -96,14 +96,44 @@ export class Secret {
         return "[Secret]";
     }
 }
+/**
+ * The only function in `src` that opens a `Secret`.
+ *
+ * Its two `Secret.take()` calls are the only call sites in `src`, and the
+ * source-wide credential-egress test pins that list. This function builds one
+ * payload and returns it only to `emitCredential`; no caller receives a plain
+ * credential string.
+ */
+function credentialPayload(secret, jsonFields) {
+    if (jsonFields === undefined)
+        return `${secret.take()}\n`;
+    const { status, provider, authType } = jsonFields;
+    if (typeof status !== "string" ||
+        typeof provider !== "string" ||
+        (authType !== undefined && typeof authType !== "string")) {
+        throw new Error("Invalid credential JSON fields");
+    }
+    // Allowlist the non-secret envelope before opening the Secret. That leaves no
+    // formatter, logger, or error path between take() and the guarded stdout write.
+    const fields = JSON.stringify({
+        status,
+        provider,
+        ...(authType === undefined ? {} : { authType }),
+    });
+    if (fields === undefined || !fields.startsWith("{") || !fields.endsWith("}")) {
+        throw new Error("Invalid credential JSON envelope");
+    }
+    return `${fields.slice(0, -1)},"credentials":${JSON.stringify(secret.take())}}\n`;
+}
 /**
  * The single credential egress in `src`.
  *
- * `Secret.take()` is called here and nowhere else in the source tree, so this
- * is the one statement that can turn a configured credential back into a string
- * and the one that hands it to the real stdout. A caller — `main.ts` included —
- * receives a `Secret` it cannot read, print, or serialize, so a second export
- * path cannot be grafted on without moving this function.
+ * `credentialPayload` opens the secret only while building this one payload,
+ * and this guarded write is the only path that hands it to real stdout. A
+ * caller — `main.ts` included — receives a `Secret` it cannot read, print, or
+ * serialize, so it cannot add a second export path without crossing this door.
+ * `test/credential-print.test.ts` pins both the `take()` sites and every
+ * data-bearing real-stdout write in `packages/coding-agent/src`.
  *
  * A failed payload write is answered from the stream rather than from the shape
  * of the error, because `bytesWritten` says how much of the credential actually
@@ -126,13 +156,9 @@ export class Secret {
  * the one code in this taxonomy whose contract is *not* an empty stdout —
  * stated as such in `EXIT_CODES` and asserted through `STDOUT_EMPTY_ON_EXIT`,
  * rather than left for a caller to discover.
- *
- * `test/credential-print.test.ts` asserts that chokepoint against the whole of
- * `packages/coding-agent/src`.
  */
-export async function emitCredential(secret) {
-    // take() returns a plain string; the Secret itself is never interpolated.
-    const payload = `${secret.take()}\n`;
+export async function emitCredential(secret, jsonFields) {
+    const payload = credentialPayload(secret, jsonFields);
     try {
         await writeRawStdoutOnce(payload);
     }
@@ -166,78 +192,6 @@ export function toCredentialPrintError(error) {
         return error;
     return new CredentialPrintError("NoCredentialConfigured", error instanceof Error ? error.message : "Failed to resolve credential", { cause: error });
 }
-export function isCredentialPrintHelp(args) {
-    return (args[0] === "auth" && (args[1] === undefined || args[1] === "help" || args[1] === "--help" || args[1] === "-h"));
-}
-export function printCredentialPrintHelp() {
-    // Branded through APP_NAME: Atomic's binary is `atomic`, and help output must
-    // never render upstream's `pi`.
-    console.error(`Usage:
-  ${APP_NAME} auth print-api-key --model <model> [--provider <provider>]
-  ${APP_NAME} auth print-bearer-token --model <model> [--provider <provider>] [--min-expiry <duration>]
-
-Prints one configured credential alone on stdout. Everything else — warnings,
-provider selection, refresh notices — goes to stderr, and stdout stays empty on
-every failure but exit 9, which reports that it could not be.
-
---model is required: there is no ambient "current model". Provider inference
-uses configured credentials; pass --provider to select one explicitly.
-
---min-expiry accepts ms, s, m, or h (for example 30m) and applies only to
-print-bearer-token, where it defaults to 30m. A token with less than that
-remaining is refreshed first.
-
-Exit codes:
-  0  credential written to stdout
-  1  usage error
-  2  no credential configured
-  3  provider ambiguous
-  4  credential kind unsupported for that provider
-  5  refresh failed (the stored credential is left untouched)
-  6  provider cannot mint a token that lives long enough
-  7  the provider's OAuth credential could not be used
-  8  the credential could not be written (nothing was emitted)
-  9  the credential was written only in part; stdout holds an unusable
-     fragment, which the caller must discard rather than use`);
-}
-function parseDuration(value) {
-    const match = value ? /^(\d+)(ms|s|m|h)$/iu.exec(value) : undefined;
-    if (!match) {
-        throw new CredentialPrintError("Usage", "--min-expiry must use a duration such as 30m or 1h");
-    }
-    const unit = match[2].toLowerCase();
-    const scale = unit === "ms" ? 1 : unit === "s" ? 1_000 : unit === "m" ? 60_000 : 3_600_000;
-    return Number(match[1]) * scale;
-}
-/** Parse the `auth` command surface before normal startup. */
-export function parseCredentialPrintCommand(args) {
-    if (args[0] !== "auth")
-        return undefined;
-    const kind = args[1] === "print-api-key" ? "api_key" : args[1] === "print-bearer-token" ? "bearer_token" : undefined;
-    if (!kind) {
-        throw new CredentialPrintError("Usage", `Unknown auth command "${args[1] ?? ""}". Use "${APP_NAME} auth print-api-key" or "${APP_NAME} auth print-bearer-token".`);
-    }
-    const INLINE_MIN_EXPIRY = "--min-expiry=";
-    const commandArgs = [];
-    let minExpiryMs;
-    for (let index = 2; index < args.length; index++) {
-        const arg = args[index];
-        const inline = arg.startsWith(INLINE_MIN_EXPIRY) ? arg.slice(INLINE_MIN_EXPIRY.length) : undefined;
-        if (arg !== "--min-expiry" && inline === undefined) {
-            commandArgs.push(arg);
-            continue;
-        }
-        // An API key has no expiry, so the option is an error rather than a
-        // silently ignored no-op that would imply a guarantee it cannot give.
-        // Both spellings are refused: `--min-expiry=30m` reaching the ordinary
-        // parser as an unknown flag would report the wrong cause.
-        if (kind !== "bearer_token") {
-            throw new CredentialPrintError("Usage", "--min-expiry is only supported by print-bearer-token");
-        }
-        minExpiryMs = parseDuration(inline ?? args[++index]);
-    }
-    return minExpiryMs === undefined ? { kind, args: commandArgs } : { kind, args: commandArgs, minExpiryMs };
-}
 /**
  * The only two fields of `Args` this door accepts.
  *