@oh-my-pi/pi-ai 15.10.0 → 15.10.1

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## [Unreleased]
 
+## [15.10.1] - 2026-06-07
+
+### Breaking Changes
+
+- Removed the `onAuthError` option from stream request options and shifted auth retry handling to resolver-based `apiKey` behavior, requiring callers using custom auth-retry hooks to migrate
+
+### Added
+
+- Added `ApiKeyResolver` and `ApiKey` auth helpers, including `isApiKeyResolver`, `isAuthRetryableError`, `resolveApiKeyOnce`, and `withAuth`, and exported them from the package root
+- Added support for a function-valued `apiKey` in `SimpleStreamOptions` so a single stream request can refresh or rotate credentials during retry
+- Added `forceRefresh` credential option to `AuthStorage.getApiKey` and `rotateSessionCredential` support for session-level credential rotation after auth failures
+- Added `AuthStorage.resolver(provider, options)` method that builds an `ApiKeyResolver` implementing the a/b/c auth-retry policy directly on the storage instance
+
+### Changed
+
+- Changed gateway and stream auth flows to share the a/b/c retry policy, refreshing the same session credential first and then switching to a sibling credential on repeated auth failures
+
+### Fixed
+
+- Fixed streaming auth retries to handle `401` and usage-limit errors before replay-unsafe content is emitted, including failures surfaced only via `errorStatus`
+- Fixed tool argument validation to coerce singleton non-string values into arrays when the schema expects an array, preventing Anthropic-compatible models that emit `todo.ops` as an object from getting stuck in repeated validation-error loops. ([#2026](https://github.com/can1357/oh-my-pi/issues/2026))
+- Fixed streaming retries to buffer and suppress partial `start` events from failed auth attempts so only clean retried events are delivered
+- Fixed the HTTP 400 raw-request dumper (`appendRawHttpRequestDumpFor400`) littering the real `~/.omp/logs/http-400-requests` directory during tests. Provider suites exercise the 400 error path with mocked `fetch` responses, which the dumper could not distinguish from genuine failures; it now skips persistence under the Bun test runner (`isBunTestRuntime()`).
+- Fixed Anthropic Opus requests unnecessarily forcing `tool_choice.disable_parallel_tool_use`, allowing Claude Opus to use the provider's default parallel tool-calling behavior again.
+- Fixed parallel `function_call` items losing arguments against llama.cpp's OpenAI Responses endpoint (`/v1/responses`), where every call but the last finalized with `{}` and the agent rejected them with `path: Invalid input: expected string, received undefined`. llama.cpp's `to_json_oaicompat_resp` emits `output_item.added` with only `item.call_id` (no `item.id`, no `output_index`) while the matching `function_call_arguments.delta` carries `item_id: "fc_<call_id>"`. `processResponsesStream` now registers function-call and custom-tool-call items under `item.call_id` as a secondary lookup key (alongside `item.id`/`output_index`) so identifier-deviant hosts route deltas and done events to the right block. ([#2015](https://github.com/can1357/oh-my-pi/issues/2015))
+- Fixed `PI_REQ_DEBUG` response recording truncating the captured body when a streamed response was cancelled mid-flight. The response tee in `wrapResponse` could call `FileRequestDebugResponseLog.close()` from both the `cancel` callback and the resumed `pull` (which observes `done` once the source reader is cancelled); the second caller saw the handle already nulled and returned before the first caller's pending write flushed, so the `.res.log` lost the already-buffered chunk. `close()` now memoizes its flush-and-close promise so every caller awaits the same completion.
+
 ## [15.10.0] - 2026-06-06
 
 ### Added

package/dist/types/auth-retry.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Context passed to an {@link ApiKeyResolver} on each resolution attempt.
+ *
+ * The `error`/`lastChance` pair drives the central a/b/c retry policy shared by
+ * the streaming ({@link streamSimple}) and non-streaming ({@link withAuth})
+ * drivers:
+ * - `error === undefined` → **initial resolve** (no force-refresh; cheap, may
+ *   return a locally-cached not-yet-expired token).
+ * - `error !== undefined && !lastChance` → **step (b): refresh the SAME
+ *   account** (force a token re-mint / await an in-flight broker refresh).
+ * - `error !== undefined && lastChance` → **step (c): switch account**
+ *   (invalidate/usage-limit the current credential and rotate to a sibling).
+ *
+ * The resolver returns the bearer to send, or `undefined` to stop retrying and
+ * surface the last error to the caller.
+ */
+export interface ApiKeyResolveContext {
+    /** True on the final retry step — the resolver should rotate to a sibling credential. */
+    lastChance: boolean;
+    /** The auth error that triggered this re-resolution, or `undefined` on the initial resolve. */
+    error: unknown;
+    /** Caller cancel signal, threaded into any credential refresh / rotation work. */
+    signal?: AbortSignal;
+}
+/**
+ * Resolves the API key to send for a request, retried through the a/b/c policy
+ * described on {@link ApiKeyResolveContext}.
+ */
+export type ApiKeyResolver = (ctx: ApiKeyResolveContext) => Promise<string | undefined> | string | undefined;
+/** A static bearer string, or a {@link ApiKeyResolver} that mints/rotates one. */
+export type ApiKey = string | ApiKeyResolver;
+/** Narrows {@link ApiKey} to its resolver form. */
+export declare function isApiKeyResolver(key: ApiKey | undefined): key is ApiKeyResolver;
+/**
+ * Performs the initial resolve of an {@link ApiKey} (`error: undefined`,
+ * `lastChance: false`). Static keys pass through unchanged.
+ */
+export declare function resolveApiKeyOnce(key: ApiKey | undefined, signal?: AbortSignal): Promise<string | undefined>;
+/**
+ * Classifies whether an error should trigger a credential refresh/rotation
+ * retry: a hard `401`, or a rotatable usage-limit ("usage_limit_reached",
+ * Codex's "you have hit your ChatGPT usage limit", etc.).
+ */
+export declare function isAuthRetryableError(error: unknown): boolean;
+/**
+ * The ordered `lastChance` values for the retry steps after the initial
+ * attempt fails: `false` → step (b) refresh-same, `true` → step (c) switch.
+ * Shared by {@link withAuth} and the streaming retry driver so both run the
+ * same policy.
+ */
+export declare const AUTH_RETRY_STEPS: readonly boolean[];
+/** Resolve a single retry step, swallowing resolver failures into `undefined`. */
+export declare function resolveRetryKey(resolver: ApiKeyResolver, lastChance: boolean, error: unknown, signal?: AbortSignal): Promise<string | undefined>;
+/**
+ * Runs an auth-protected operation through the central a/b/c retry policy.
+ *
+ * - A static string key (or any non-resolver) → a single `attempt` with no
+ *   retry (identical to the legacy static-key path).
+ * - A resolver → initial `attempt`, then on a retryable auth error up to two
+ *   more attempts (refresh-same, then switch). A step is skipped when the
+ *   resolver returns the same key it just tried or `undefined`; non-auth errors
+ *   propagate immediately.
+ *
+ * Used by non-streaming consumers (image generation, web search, completion
+ * helpers). The streaming driver in `stream.ts` implements the same policy with
+ * its replay-safe buffering machinery.
+ */
+export declare function withAuth<T>(key: ApiKey | undefined, attempt: (key: string) => Promise<T>, opts?: {
+    isAuthError?: (error: unknown) => boolean;
+    signal?: AbortSignal;
+    missingKeyMessage?: string;
+}): Promise<T>;

package/dist/types/auth-storage.d.ts

@@ -8,6 +8,7 @@
  * - `SqliteAuthCredentialStore`: concrete SQLite-backed implementation
  */
 import { Database } from "bun:sqlite";
+import type { ApiKeyResolver } from "./auth-retry";
 import type { Provider } from "./types";
 import type { CredentialRankingStrategy, UsageLogger, UsageProvider, UsageReport } from "./usage";
 import type { OAuthController, OAuthCredentials, OAuthProviderId } from "./utils/oauth/types";
@@ -366,6 +367,13 @@ type AuthApiKeyOptions = {
      * stranding the caller for `timeoutMs * (maxRetries + 1)`.
      */
     signal?: AbortSignal;
+    /**
+     * Force a re-mint of the session-preferred OAuth credential's access token,
+     * bypassing the not-yet-expired short-circuit. Powers step (b) of the
+     * auth-retry policy ("refresh the SAME account") so a locally-cached token
+     * that a peer/broker rotated out from under us is replaced before retrying.
+     */
+    forceRefresh?: boolean;
 };
 /**
  * Refreshed OAuth access plus identity metadata returned by
@@ -647,6 +655,41 @@ export declare class AuthStorage {
     getOAuthAccesses(provider: string, options?: AuthApiKeyOptions): Promise<OAuthAccessResolution[]>;
     invalidateCredentialMatching(provider: string, apiKey: string, options?: InvalidateCredentialMatchingOptions): Promise<boolean>;
     invalidateCredentialMatching(provider: string, apiKey: string, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Rotate away from the session's current credential after a retryable auth
+     * error — step (c) of the auth-retry policy. Stateless: looks up the
+     * session-sticky credential (no API-key matching needed), applies the
+     * storage action for the error class, then clears the sticky so the next
+     * {@link AuthStorage.getApiKey} for this session picks a sibling.
+     *
+     * - usage-limit / account-rate-limit error → {@link AuthStorage.markUsageLimitReached}
+     *   (temporary block via its own backoff — default plus server usage-report
+     *   reset; sticky left intact so the next resolve re-ranks around the block).
+     * - otherwise (hard 401 / auth failure) → mark the credential suspect (or
+     *   reload when no broker hook is wired) and block it, then drop the sticky.
+     *
+     * Returns whether another usable credential of the same type remains.
+     */
+    rotateSessionCredential(provider: string, sessionId: string | undefined, options?: {
+        error?: unknown;
+        signal?: AbortSignal;
+    }): Promise<boolean>;
+    /**
+     * Build an {@link ApiKeyResolver} backed by this storage, implementing the
+     * central a/b/c auth-retry policy:
+     *
+     * - initial (`error: undefined`) → resolve the session credential.
+     * - step (b) `!lastChance` → force-refresh the SAME session-sticky credential.
+     * - step (c) `lastChance` → rotate to a sibling credential, then re-resolve.
+     *
+     * Used by web-search providers and other consumers that hold an AuthStorage
+     * directly (no ModelRegistry in scope).
+     */
+    resolver(provider: string, options?: {
+        sessionId?: string;
+        baseUrl?: string;
+        modelId?: string;
+    }): ApiKeyResolver;
     /**
      * Build a redacted snapshot of all loaded credentials for the auth-broker
      * wire. OAuth refresh tokens are replaced with {@link REMOTE_REFRESH_SENTINEL}

package/dist/types/index.d.ts

@@ -3,6 +3,7 @@ export * from "./api-registry";
 export * from "./auth-broker";
 export { type AuthGatewayBootOptions, type ModelResolver, startAuthGateway } from "./auth-gateway/server";
 export * from "./auth-gateway/types";
+export * from "./auth-retry";
 export * from "./auth-storage";
 export * from "./effort";
 export * from "./model-cache";

package/dist/types/model-thinking.d.ts

@@ -83,10 +83,3 @@ export declare function hasOpus47ApiRestrictions(modelId: string): boolean;
  * @see https://platform.claude.com/docs/en/build-with-claude/mid-conversation-system-messages
  */
 export declare function supportsMidConversationSystemMessages(modelId: string): boolean;
-/**
- * Claude Opus 4.8 must emit at most one tool call per turn: the Anthropic
- * Messages provider sends `tool_choice.disable_parallel_tool_use = true` for
- * this model. Scoped to exactly 4.8 — earlier and later Opus versions keep
- * Anthropic's default parallel tool-calling.
- */
-export declare function disablesParallelToolUse(modelId: string): boolean;

package/dist/types/provider-models/openai-compat.d.ts

@@ -131,6 +131,11 @@ export declare function isFireworksKimiK2ModelId(modelId: string): boolean;
  * on Fireworks-backed providers, leaving every other model untouched.
  */
 export declare function clampFireworksKimiMaxTokens(modelId: string, candidate: number): number;
+/**
+ * Fireworks DeepSeek V4 accepts effort via `reasoning_effort` but rejects the
+ * DeepSeek-native binary `thinking` toggle when both are present.
+ */
+export declare function stripFireworksDeepSeekThinkingToggle(model: Model<"openai-completions">, publicModelId: string): Model<"openai-completions">;
 export interface FireworksModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/types.d.ts

@@ -1,4 +1,5 @@
 import type { ZodType, z } from "zod/v4";
+import type { ApiKey } from "./auth-retry";
 import type { BedrockOptions } from "./providers/amazon-bedrock";
 import type { AnthropicOptions } from "./providers/anthropic";
 import type { AzureOpenAIResponsesOptions } from "./providers/azure-openai-responses";
@@ -159,12 +160,6 @@ export interface StreamOptions {
     maxTokens?: number;
     signal?: AbortSignal;
     apiKey?: string;
-    /**
-     * Called when a provider returns 401 before any replay-unsafe assistant
-     * event has been emitted. Returning a different key retries the provider
-     * request once.
-     */
-    onAuthError?: (provider: string, apiKey: string, error: unknown) => Promise<string | undefined>;
     cacheRetention?: CacheRetention;
     /**
      * Additional headers to include in provider requests.
@@ -274,7 +269,15 @@ export interface StreamOptions {
     /** Cursor exec/MCP tool handlers (cursor-agent only). */
     execHandlers?: CursorExecHandlers;
 }
-export interface SimpleStreamOptions extends StreamOptions {
+export interface SimpleStreamOptions extends Omit<StreamOptions, "apiKey"> {
+    /**
+     * API key for the request: either a static bearer string, or an
+     * {@link ApiKeyResolver} that mints/rotates the key across the central
+     * a/b/c auth-retry policy. `streamSimple`/`completeSimple` resolve a
+     * resolver to a string before per-provider dispatch, so providers only
+     * ever see the resolved {@link StreamOptions.apiKey} string.
+     */
+    apiKey?: ApiKey;
     reasoning?: Effort;
     /**
      * Force-disable reasoning for the request even when the model supports it.

package/dist/types/utils/schema/json-schema-validator.d.ts

@@ -3,6 +3,14 @@ export interface JsonSchemaValidationIssue {
     message: string;
     expectedTypes?: string[];
     keyword?: string;
+    /**
+     * Marks issues that originate inside a failed `anyOf` / `oneOf` branch.
+     * Consumers such as the tool-argument coercion layer use this to avoid
+     * applying type repairs (e.g. singleton-array wrapping) that would be
+     * authoritative outside of a combinator but are only one candidate
+     * branch's expectation here.
+     */
+    fromUnionBranch?: boolean;
 }
 export interface JsonSchemaValidationResult {
     success: boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-ai",
-	"version": "15.10.0",
+	"version": "15.10.1",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -39,7 +39,7 @@
 	},
 	"dependencies": {
 		"@bufbuild/protobuf": "^2.12.0",
-		"@oh-my-pi/pi-utils": "15.10.0",
+		"@oh-my-pi/pi-utils": "15.10.1",
 		"openai": "^6.39.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-gateway/server.ts

@@ -18,6 +18,7 @@
  *   POST /v1/responses                     → OpenAI Responses in/out
  */
 import { extractRetryHint, logger } from "@oh-my-pi/pi-utils";
+import type { ApiKeyResolver } from "../auth-retry";
 import type { AuthStorage } from "../auth-storage";
 import { Effort } from "../effort";
 import * as anthropicMessages from "../providers/anthropic-messages-server";
@@ -340,6 +341,60 @@ async function refreshGatewayApiKeyAfterAuthError(
 	return storage.getApiKey(provider, sessionId, { modelId: model.id, signal });
 }
 
+/**
+ * Build the {@link ApiKeyResolver} handed to `streamSimple` for a gateway
+ * request. Drives the central a/b/c auth-retry policy server-side:
+ *
+ * - initial resolve → the credential already resolved for this request.
+ * - step (b) `!lastChance` → force-refresh the SAME session-sticky credential
+ *   (a peer/broker may have rotated its token out from under our cached copy).
+ * - step (c) `lastChance` → {@link refreshGatewayApiKeyAfterAuthError} switches
+ *   to a sibling (usage-limit block vs credential invalidation by error class).
+ *
+ * `lastKey` tracks the most recent bearer so the switch step invalidates the
+ * credential that actually failed.
+ */
+function buildGatewayApiKeyResolver(
+	storage: AuthStorage,
+	model: Model<Api>,
+	sessionId: string,
+	initialKey: string,
+	requestSignal: AbortSignal,
+	format: string,
+	peer: string,
+): ApiKeyResolver {
+	let lastKey = initialKey;
+	return async ({ lastChance, error, signal }) => {
+		const sig = signal ?? requestSignal;
+		if (error === undefined) {
+			lastKey = initialKey;
+			return initialKey;
+		}
+		if (!lastChance) {
+			const refreshed = await storage.getApiKey(model.provider, sessionId, {
+				modelId: model.id,
+				signal: sig,
+				forceRefresh: true,
+			});
+			lastKey = refreshed ?? lastKey;
+			return refreshed;
+		}
+		const next = await refreshGatewayApiKeyAfterAuthError(
+			storage,
+			model,
+			sessionId,
+			model.provider,
+			lastKey,
+			error,
+			sig,
+			format,
+			peer,
+		);
+		lastKey = next ?? lastKey;
+		return next;
+	};
+}
+
 function clientClosedResponse(route: { module: FormatModule }): Response {
 	return route.module.formatError(499, "request_aborted", "client closed request");
 }
@@ -447,19 +502,15 @@ async function handleFormatEndpoint(
 	}
 
 	const streamOpts = buildStreamOptions(parsed, model.api, controller.signal);
-	streamOpts.apiKey = apiKey;
-	streamOpts.onAuthError = (provider, oldKey, error) =>
-		refreshGatewayApiKeyAfterAuthError(
-			bootOpts.storage,
-			model,
-			sessionId,
-			provider,
-			oldKey,
-			error,
-			controller.signal,
-			route.label,
-			peer,
-		);
+	streamOpts.apiKey = buildGatewayApiKeyResolver(
+		bootOpts.storage,
+		model,
+		sessionId,
+		apiKey,
+		controller.signal,
+		route.label,
+		peer,
+	);
 
 	logger.info("auth-gateway request", {
 		format: route.label,
@@ -604,18 +655,15 @@ async function handlePiNative(bootOpts: AuthGatewayBootOptions, req: Request, pe
 	// only inject server-controlled fields. The codex temperature/topP strip
 	// matches `buildStreamOptions` — Codex rejects them with a 400.
 	const streamOpts: SimpleStreamOptions = { ...parsed.options, apiKey, signal: controller.signal };
-	streamOpts.onAuthError = (provider, oldKey, error) =>
-		refreshGatewayApiKeyAfterAuthError(
-			bootOpts.storage,
-			model,
-			sessionId,
-			provider,
-			oldKey,
-			error,
-			controller.signal,
-			"pi-native",
-			peer,
-		);
+	streamOpts.apiKey = buildGatewayApiKeyResolver(
+		bootOpts.storage,
+		model,
+		sessionId,
+		apiKey,
+		controller.signal,
+		"pi-native",
+		peer,
+	);
 	if (model.api === "openai-codex-responses") {
 		delete streamOpts.temperature;
 		delete streamOpts.topP;

package/src/auth-retry.ts

@@ -0,0 +1,141 @@
+import { extractHttpStatusFromError } from "@oh-my-pi/pi-utils";
+import { isUsageLimitError } from "./rate-limit-utils";
+
+/**
+ * Context passed to an {@link ApiKeyResolver} on each resolution attempt.
+ *
+ * The `error`/`lastChance` pair drives the central a/b/c retry policy shared by
+ * the streaming ({@link streamSimple}) and non-streaming ({@link withAuth})
+ * drivers:
+ * - `error === undefined` → **initial resolve** (no force-refresh; cheap, may
+ *   return a locally-cached not-yet-expired token).
+ * - `error !== undefined && !lastChance` → **step (b): refresh the SAME
+ *   account** (force a token re-mint / await an in-flight broker refresh).
+ * - `error !== undefined && lastChance` → **step (c): switch account**
+ *   (invalidate/usage-limit the current credential and rotate to a sibling).
+ *
+ * The resolver returns the bearer to send, or `undefined` to stop retrying and
+ * surface the last error to the caller.
+ */
+export interface ApiKeyResolveContext {
+	/** True on the final retry step — the resolver should rotate to a sibling credential. */
+	lastChance: boolean;
+	/** The auth error that triggered this re-resolution, or `undefined` on the initial resolve. */
+	error: unknown;
+	/** Caller cancel signal, threaded into any credential refresh / rotation work. */
+	signal?: AbortSignal;
+}
+
+/**
+ * Resolves the API key to send for a request, retried through the a/b/c policy
+ * described on {@link ApiKeyResolveContext}.
+ */
+export type ApiKeyResolver = (ctx: ApiKeyResolveContext) => Promise<string | undefined> | string | undefined;
+
+/** A static bearer string, or a {@link ApiKeyResolver} that mints/rotates one. */
+export type ApiKey = string | ApiKeyResolver;
+
+/** Narrows {@link ApiKey} to its resolver form. */
+export function isApiKeyResolver(key: ApiKey | undefined): key is ApiKeyResolver {
+	return typeof key === "function";
+}
+
+/**
+ * Performs the initial resolve of an {@link ApiKey} (`error: undefined`,
+ * `lastChance: false`). Static keys pass through unchanged.
+ */
+export async function resolveApiKeyOnce(key: ApiKey | undefined, signal?: AbortSignal): Promise<string | undefined> {
+	if (key === undefined) return undefined;
+	if (isApiKeyResolver(key)) return (await key({ lastChance: false, error: undefined, signal })) || undefined;
+	return key;
+}
+
+/**
+ * Classifies whether an error should trigger a credential refresh/rotation
+ * retry: a hard `401`, or a rotatable usage-limit ("usage_limit_reached",
+ * Codex's "you have hit your ChatGPT usage limit", etc.).
+ */
+export function isAuthRetryableError(error: unknown): boolean {
+	if (extractHttpStatusFromError(error) === 401) return true;
+	const message = error instanceof Error ? error.message : typeof error === "string" ? error : undefined;
+	if (!message) return false;
+	if (extractHttpStatusFromError({ message }) === 401) return true;
+	return isUsageLimitError(message);
+}
+
+/**
+ * The ordered `lastChance` values for the retry steps after the initial
+ * attempt fails: `false` → step (b) refresh-same, `true` → step (c) switch.
+ * Shared by {@link withAuth} and the streaming retry driver so both run the
+ * same policy.
+ */
+export const AUTH_RETRY_STEPS: readonly boolean[] = [false, true];
+
+/** Resolve a single retry step, swallowing resolver failures into `undefined`. */
+export async function resolveRetryKey(
+	resolver: ApiKeyResolver,
+	lastChance: boolean,
+	error: unknown,
+	signal?: AbortSignal,
+): Promise<string | undefined> {
+	try {
+		return (await resolver({ lastChance, error, signal })) || undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+/**
+ * Runs an auth-protected operation through the central a/b/c retry policy.
+ *
+ * - A static string key (or any non-resolver) → a single `attempt` with no
+ *   retry (identical to the legacy static-key path).
+ * - A resolver → initial `attempt`, then on a retryable auth error up to two
+ *   more attempts (refresh-same, then switch). A step is skipped when the
+ *   resolver returns the same key it just tried or `undefined`; non-auth errors
+ *   propagate immediately.
+ *
+ * Used by non-streaming consumers (image generation, web search, completion
+ * helpers). The streaming driver in `stream.ts` implements the same policy with
+ * its replay-safe buffering machinery.
+ */
+export async function withAuth<T>(
+	key: ApiKey | undefined,
+	attempt: (key: string) => Promise<T>,
+	opts?: { isAuthError?: (error: unknown) => boolean; signal?: AbortSignal; missingKeyMessage?: string },
+): Promise<T> {
+	const isAuthError = opts?.isAuthError ?? isAuthRetryableError;
+	const missingKey = (): Error => new Error(opts?.missingKeyMessage ?? "No API key available");
+
+	if (!isApiKeyResolver(key)) {
+		if (key === undefined) throw missingKey();
+		return attempt(key);
+	}
+
+	const resolver = key;
+	const signal = opts?.signal;
+	let lastKey = await resolveRetryKey(resolver, false, undefined, signal);
+	if (lastKey === undefined) throw missingKey();
+
+	let lastError: unknown;
+	try {
+		return await attempt(lastKey);
+	} catch (error) {
+		if (!isAuthError(error)) throw error;
+		lastError = error;
+	}
+
+	for (let i = 0; i < AUTH_RETRY_STEPS.length; i++) {
+		const nextKey = await resolveRetryKey(resolver, AUTH_RETRY_STEPS[i]!, lastError, signal);
+		if (nextKey === undefined || nextKey === lastKey) continue;
+		lastKey = nextKey;
+		try {
+			return await attempt(nextKey);
+		} catch (error) {
+			if (!isAuthError(error)) throw error;
+			lastError = error;
+		}
+	}
+
+	throw lastError;
+}