Credentials are owned by a CredentialStore; login interaction is owned by
a LoginIO. Reads, refreshes, writes, prompts, and notifications are explicit
async operations. RhoModels owns provider selection and serialized refresh
gates instead of relying on process-global auth state.
Details
rho_memory_credential_store() keeps credentials for one R process.
rho_file_credential_store() persists them as a versioned JSON document at
an explicitly supplied path. rho_encrypted_file_credential_store() encrypts
that document with an explicitly supplied passphrase or 32-byte key using
Argon2id and XChaCha20-Poly1305. rho_keychain_credential_store() keeps each
provider credential in the operating system's native keychain and rejects
keyring's environment and file backends. File updates are serialized, replace
the prior document, and use owner-only permissions where the platform supports
them. rho_user_credential_path() returns R's platform-specific user
configuration path without creating it.