@namzu/cli 0.0.3 → 0.1.0

package/dist/integrations/providers/schema.d.ts

@@ -0,0 +1,73 @@
+/**
+ * `ProviderProfile` discriminated union.
+ *
+ * Each provider type mirrors a `@namzu/<type>` package the SDK ships. The
+ * shapes are the *minimum* the CLI persists; richer per-type knobs (Bedrock
+ * IAM role assumption, OpenRouter routing rules, Anthropic `maxTokens`,
+ * etc.) come in as additive optional fields when M3+ surface needs them.
+ *
+ * Validation is intentionally hand-rolled (no Zod) — we want zero-runtime-dep
+ * config IO in M2; a future session can introduce a schema library when
+ * provider-package-specific knobs start to collide.
+ */
+export type ProviderType = 'openai' | 'anthropic' | 'openrouter' | 'ollama' | 'bedrock' | 'http' | 'lmstudio';
+export declare const PROVIDER_TYPES: readonly ProviderType[];
+/**
+ * Per-type API-key env-var fallback. Order checked: `NAMZU_<NAME>_API_KEY`
+ * (per-profile override) → entry below (per-type vendor default) → empty.
+ * Mirrors what users already have set in CI / shells for other tools.
+ */
+export declare const TYPE_ENV_FALLBACK: Readonly<Record<ProviderType, string | null>>;
+export interface BaseProfile {
+    readonly name: string;
+    readonly default?: boolean;
+    readonly model?: string;
+}
+export interface OpenAIProfile extends BaseProfile {
+    readonly type: 'openai';
+    readonly apiKey?: string;
+    readonly baseUrl?: string;
+    readonly organization?: string;
+    readonly project?: string;
+}
+export interface AnthropicProfile extends BaseProfile {
+    readonly type: 'anthropic';
+    readonly apiKey?: string;
+    readonly baseUrl?: string;
+}
+export interface OpenRouterProfile extends BaseProfile {
+    readonly type: 'openrouter';
+    readonly apiKey?: string;
+    readonly baseUrl?: string;
+}
+export interface OllamaProfile extends BaseProfile {
+    readonly type: 'ollama';
+    readonly host?: string;
+}
+export interface BedrockProfile extends BaseProfile {
+    readonly type: 'bedrock';
+    readonly region?: string;
+}
+export interface HttpProfile extends BaseProfile {
+    readonly type: 'http';
+    readonly baseUrl: string;
+    readonly apiKey?: string;
+    readonly dialect?: 'openai' | 'anthropic';
+}
+export interface LMStudioProfile extends BaseProfile {
+    readonly type: 'lmstudio';
+    readonly host?: string;
+}
+export type ProviderProfile = OpenAIProfile | AnthropicProfile | OpenRouterProfile | OllamaProfile | BedrockProfile | HttpProfile | LMStudioProfile;
+export interface ProvidersFile {
+    readonly version: 1;
+    readonly profiles: readonly ProviderProfile[];
+}
+export declare const PROVIDERS_FILE_VERSION: 1;
+export declare class ProfileValidationError extends Error {
+    constructor(message: string);
+}
+/** Strict at-the-boundary validator. Throws `ProfileValidationError` on bad input. */
+export declare function validateProfile(value: unknown): ProviderProfile;
+export declare function isProviderType(value: unknown): value is ProviderType;
+//# sourceMappingURL=schema.d.ts.map

package/dist/integrations/providers/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,YAAY,GACrB,QAAQ,GACR,WAAW,GACX,YAAY,GACZ,QAAQ,GACR,SAAS,GACT,MAAM,GACN,UAAU,CAAA;AAEb,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAQxC,CAAA;AAEV;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAQ1E,CAAA;AAEF,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACpD,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACrD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IACjD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IAClD,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAA;CACzC;AAED,MAAM,WAAW,eAAgB,SAAQ,WAAW;IACnD,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,MAAM,eAAe,GACxB,aAAa,GACb,gBAAgB,GAChB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,WAAW,GACX,eAAe,CAAA;AAElB,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAA;CAC7C;AAED,eAAO,MAAM,sBAAsB,EAAG,CAAU,CAAA;AAEhD,qBAAa,sBAAuB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI3B;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAsB/D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAEpE"}

package/dist/integrations/providers/schema.js

@@ -0,0 +1,70 @@
+/**
+ * `ProviderProfile` discriminated union.
+ *
+ * Each provider type mirrors a `@namzu/<type>` package the SDK ships. The
+ * shapes are the *minimum* the CLI persists; richer per-type knobs (Bedrock
+ * IAM role assumption, OpenRouter routing rules, Anthropic `maxTokens`,
+ * etc.) come in as additive optional fields when M3+ surface needs them.
+ *
+ * Validation is intentionally hand-rolled (no Zod) — we want zero-runtime-dep
+ * config IO in M2; a future session can introduce a schema library when
+ * provider-package-specific knobs start to collide.
+ */
+export const PROVIDER_TYPES = [
+    'openai',
+    'anthropic',
+    'openrouter',
+    'ollama',
+    'bedrock',
+    'http',
+    'lmstudio',
+];
+/**
+ * Per-type API-key env-var fallback. Order checked: `NAMZU_<NAME>_API_KEY`
+ * (per-profile override) → entry below (per-type vendor default) → empty.
+ * Mirrors what users already have set in CI / shells for other tools.
+ */
+export const TYPE_ENV_FALLBACK = Object.freeze({
+    openai: 'OPENAI_API_KEY',
+    anthropic: 'ANTHROPIC_API_KEY',
+    openrouter: 'OPENROUTER_API_KEY',
+    ollama: null, // local server; no API key concept
+    bedrock: null, // AWS SDK credential chain; handled in M3
+    http: null, // generic; user supplies via apiKey or per-profile env
+    lmstudio: null, // local server
+});
+export const PROVIDERS_FILE_VERSION = 1;
+export class ProfileValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ProfileValidationError';
+    }
+}
+/** Strict at-the-boundary validator. Throws `ProfileValidationError` on bad input. */
+export function validateProfile(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new ProfileValidationError('profile must be a JSON object');
+    }
+    const v = value;
+    if (typeof v.name !== 'string' || v.name.length === 0) {
+        throw new ProfileValidationError('profile.name is required');
+    }
+    if (!isProviderType(v.type)) {
+        throw new ProfileValidationError(`profile.type must be one of: ${PROVIDER_TYPES.join(', ')}`);
+    }
+    if (v.default !== undefined && typeof v.default !== 'boolean') {
+        throw new ProfileValidationError('profile.default must be a boolean');
+    }
+    if (v.model !== undefined && typeof v.model !== 'string') {
+        throw new ProfileValidationError('profile.model must be a string');
+    }
+    // http requires baseUrl; others optional. We trust the discriminator.
+    if (v.type === 'http' && (typeof v.baseUrl !== 'string' || v.baseUrl.length === 0)) {
+        throw new ProfileValidationError('profile.baseUrl is required when type=http');
+    }
+    return v;
+}
+export function isProviderType(value) {
+    return typeof value === 'string' && PROVIDER_TYPES.includes(value);
+}
+//# sourceMappingURL=schema.js.map

package/dist/integrations/providers/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/integrations/providers/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,MAAM,CAAC,MAAM,cAAc,GAA4B;IACtD,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,SAAS;IACT,MAAM;IACN,UAAU;CACD,CAAA;AAEV;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAkD,MAAM,CAAC,MAAM,CAAC;IAC7F,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,mBAAmB;IAC9B,UAAU,EAAE,oBAAoB;IAChC,MAAM,EAAE,IAAI,EAAE,mCAAmC;IACjD,OAAO,EAAE,IAAI,EAAE,0CAA0C;IACzD,IAAI,EAAE,IAAI,EAAE,uDAAuD;IACnE,QAAQ,EAAE,IAAI,EAAE,eAAe;CAC/B,CAAC,CAAA;AAgEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAU,CAAA;AAEhD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAChD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACrC,CAAC;CACD;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,sBAAsB,CAAC,+BAA+B,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,sBAAsB,CAAC,gCAAgC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/D,MAAM,IAAI,sBAAsB,CAAC,mCAAmC,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,sBAAsB,CAAC,gCAAgC,CAAC,CAAA;IACnE,CAAC;IACD,sEAAsE;IACtE,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,sBAAsB,CAAC,4CAA4C,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,CAA+B,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC1F,CAAC"}

package/dist/integrations/providers/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/integrations/providers/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/schema.test.ts"],"names":[],"mappings":""}

package/dist/integrations/providers/schema.test.js

@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest';
+import { PROVIDER_TYPES, ProfileValidationError, isProviderType, validateProfile, } from './schema.js';
+describe('isProviderType', () => {
+    it('accepts every shipped type', () => {
+        for (const t of PROVIDER_TYPES)
+            expect(isProviderType(t)).toBe(true);
+    });
+    it('rejects unknown types', () => {
+        expect(isProviderType('gemini')).toBe(false);
+        expect(isProviderType(undefined)).toBe(false);
+        expect(isProviderType(42)).toBe(false);
+    });
+});
+describe('validateProfile', () => {
+    it('passes a minimal anthropic profile', () => {
+        const p = validateProfile({ name: 'work', type: 'anthropic' });
+        expect(p.name).toBe('work');
+        expect(p.type).toBe('anthropic');
+    });
+    it('rejects missing name', () => {
+        expect(() => validateProfile({ type: 'anthropic' })).toThrow(ProfileValidationError);
+    });
+    it('rejects unknown type with a helpful message', () => {
+        expect(() => validateProfile({ name: 'x', type: 'gpt-5-pro' })).toThrowError(/must be one of/);
+    });
+    it('rejects non-boolean default', () => {
+        expect(() => validateProfile({ name: 'x', type: 'openai', default: 'yes' })).toThrow(ProfileValidationError);
+    });
+    it('requires baseUrl when type=http', () => {
+        expect(() => validateProfile({ name: 'h', type: 'http' })).toThrowError(/baseUrl is required/);
+        const ok = validateProfile({ name: 'h', type: 'http', baseUrl: 'https://example.com' });
+        expect(ok.type).toBe('http');
+    });
+    it('rejects non-string model', () => {
+        expect(() => validateProfile({ name: 'x', type: 'openai', model: 42 })).toThrow(ProfileValidationError);
+    });
+    it('rejects non-object inputs', () => {
+        expect(() => validateProfile(null)).toThrow(ProfileValidationError);
+        expect(() => validateProfile('string')).toThrow(ProfileValidationError);
+        expect(() => validateProfile([])).toThrow(ProfileValidationError);
+    });
+});
+//# sourceMappingURL=schema.test.js.map

package/dist/integrations/providers/schema.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.js","sourceRoot":"","sources":["../../../src/integrations/providers/schema.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EACN,cAAc,EACd,sBAAsB,EACtB,cAAc,EACd,eAAe,GACf,MAAM,aAAa,CAAA;AAEpB,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACrC,KAAK,MAAM,CAAC,IAAI,cAAc;YAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7C,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;QAC9D,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACjC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CACnF,sBAAsB,CACtB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAA;QAC9F,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAA;QACvF,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAC9E,sBAAsB,CACtB,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/integrations/providers/secrets.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Reader for clawtool's `~/.config/clawtool/secrets.toml`.
+ *
+ * Schema (per clawtool's `internal/config/portals_io.go`):
+ *
+ *   [secrets.work]
+ *   ANTHROPIC_API_KEY = "sk-ant-..."
+ *   OPENAI_API_KEY    = "sk-..."
+ *
+ *   [secrets.personal]
+ *   OPENROUTER_API_KEY = "..."
+ *
+ * Namzu treats each `[secrets.X]` section as a candidate credential
+ * bundle — the env-var keys inside are the same names as native env
+ * vars (e.g. `ANTHROPIC_API_KEY`). We flatten every section into a
+ * single `Map<envVarName, value[]>` so the discoverer can ask "does any
+ * source have ANTHROPIC_API_KEY?" without caring which scope it came
+ * from. Multiple sections can carry the same key; we keep all values
+ * so the picker can present them as distinct candidates if the user
+ * has multiple Anthropic accounts.
+ */
+export interface SecretCandidate {
+    /** Env-var name as it would appear at runtime (e.g. `ANTHROPIC_API_KEY`). */
+    readonly envName: string;
+    readonly value: string;
+    /** Which `[secrets.X]` section it came from (e.g. `work`, `personal`). */
+    readonly scope: string;
+}
+export declare function clawtoolSecretsPath(home?: string): string;
+/**
+ * Read clawtool's secrets.toml and return a flat array of every
+ * env-var-style credential it carries, tagged by scope. Returns `[]`
+ * when the file is missing or unparseable — never throws (this is an
+ * optional discovery source).
+ */
+export declare function readClawtoolSecrets(home?: string): readonly SecretCandidate[];
+//# sourceMappingURL=secrets.d.ts.map

package/dist/integrations/providers/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,MAAM,WAAW,eAAe;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAAkB,GAAG,SAAS,eAAe,EAAE,CA4BxF"}

package/dist/integrations/providers/secrets.js

@@ -0,0 +1,69 @@
+/**
+ * Reader for clawtool's `~/.config/clawtool/secrets.toml`.
+ *
+ * Schema (per clawtool's `internal/config/portals_io.go`):
+ *
+ *   [secrets.work]
+ *   ANTHROPIC_API_KEY = "sk-ant-..."
+ *   OPENAI_API_KEY    = "sk-..."
+ *
+ *   [secrets.personal]
+ *   OPENROUTER_API_KEY = "..."
+ *
+ * Namzu treats each `[secrets.X]` section as a candidate credential
+ * bundle — the env-var keys inside are the same names as native env
+ * vars (e.g. `ANTHROPIC_API_KEY`). We flatten every section into a
+ * single `Map<envVarName, value[]>` so the discoverer can ask "does any
+ * source have ANTHROPIC_API_KEY?" without caring which scope it came
+ * from. Multiple sections can carry the same key; we keep all values
+ * so the picker can present them as distinct candidates if the user
+ * has multiple Anthropic accounts.
+ */
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { parse as tomlParse } from 'smol-toml';
+export function clawtoolSecretsPath(home = homedir()) {
+    return join(home, '.config', 'clawtool', 'secrets.toml');
+}
+/**
+ * Read clawtool's secrets.toml and return a flat array of every
+ * env-var-style credential it carries, tagged by scope. Returns `[]`
+ * when the file is missing or unparseable — never throws (this is an
+ * optional discovery source).
+ */
+export function readClawtoolSecrets(home = homedir()) {
+    const path = clawtoolSecretsPath(home);
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = tomlParse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return [];
+    const root = parsed;
+    const secrets = root.secrets;
+    if (typeof secrets !== 'object' || secrets === null)
+        return [];
+    const out = [];
+    for (const [scope, section] of Object.entries(secrets)) {
+        if (typeof section !== 'object' || section === null)
+            continue;
+        for (const [envName, value] of Object.entries(section)) {
+            if (typeof value === 'string' && value.length > 0) {
+                out.push({ envName, value, scope });
+            }
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/integrations/providers/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/integrations/providers/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAA;AAU9C,MAAM,UAAU,mBAAmB,CAAC,OAAe,OAAO,EAAE;IAC3D,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC,CAAA;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,OAAO,EAAE;IAC3D,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC5D,MAAM,IAAI,GAAG,MAAiC,CAAA;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC9D,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;QACnF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,SAAQ;QAC7D,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;YACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;YACpC,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC"}

package/dist/integrations/providers/store.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `~/.namzu/providers.json` store.
+ *
+ * - Reads return `[]` (not error) when the file is missing — first-run UX.
+ * - Writes are atomic: temp file + rename. Mode 0600 enforced on every write.
+ * - `resolveApiKey(profile, env)` cascades `NAMZU_<NAME>_API_KEY` (per-
+ *   profile override) → per-type vendor default (`OPENAI_API_KEY` etc.)
+ *   → profile.apiKey on-disk → null. Hermes-style ergonomics.
+ * - Uniqueness invariants enforced on write: no duplicate `name`; at most
+ *   one profile with `default: true`.
+ */
+import { type ProviderProfile } from './schema.js';
+export declare class ProvidersStoreError extends Error {
+    constructor(message: string);
+}
+export interface StoreLocation {
+    readonly path: string;
+}
+export declare function providersPath(home?: string): string;
+export declare function readProfiles(home?: string): ProviderProfile[];
+export declare function writeProfiles(profiles: readonly ProviderProfile[], home?: string): void;
+export declare function assertInvariants(profiles: readonly ProviderProfile[]): void;
+/**
+ * Resolve the live API key for a profile, honoring overrides:
+ *   1. `NAMZU_<UPPERCASE_NAME>_API_KEY` (per-profile override)
+ *   2. Per-type vendor default (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, etc.)
+ *   3. `profile.apiKey` (on-disk)
+ *   4. `null` (no key — caller decides whether that's fatal)
+ */
+export declare function resolveApiKey(profile: ProviderProfile, env?: NodeJS.ProcessEnv): string | null;
+export declare function findDefault(profiles: readonly ProviderProfile[]): ProviderProfile | null;
+//# sourceMappingURL=store.d.ts.map

package/dist/integrations/providers/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,EAGN,KAAK,eAAe,EAIpB,MAAM,aAAa,CAAA;AAKpB,qBAAa,mBAAoB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI3B;AAED,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE9D;AAED,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAkB,GAAG,eAAe,EAAE,CA2CxE;AAED,wBAAgB,aAAa,CAC5B,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,IAAI,GAAE,MAAkB,GACtB,IAAI,CAmBN;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,GAAG,IAAI,CAa3E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC5B,OAAO,EAAE,eAAe,EACxB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,GAAG,IAAI,CAWf;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE,GAAG,eAAe,GAAG,IAAI,CAExF"}

package/dist/integrations/providers/store.js

@@ -0,0 +1,133 @@
+/**
+ * `~/.namzu/providers.json` store.
+ *
+ * - Reads return `[]` (not error) when the file is missing — first-run UX.
+ * - Writes are atomic: temp file + rename. Mode 0600 enforced on every write.
+ * - `resolveApiKey(profile, env)` cascades `NAMZU_<NAME>_API_KEY` (per-
+ *   profile override) → per-type vendor default (`OPENAI_API_KEY` etc.)
+ *   → profile.apiKey on-disk → null. Hermes-style ergonomics.
+ * - Uniqueness invariants enforced on write: no duplicate `name`; at most
+ *   one profile with `default: true`.
+ */
+import { randomBytes } from 'node:crypto';
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { PROVIDERS_FILE_VERSION, ProfileValidationError, TYPE_ENV_FALLBACK, validateProfile, } from './schema.js';
+const FILE_MODE = 0o600;
+const DIR_MODE = 0o700;
+export class ProvidersStoreError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ProvidersStoreError';
+    }
+}
+export function providersPath(home = homedir()) {
+    return join(home, '.namzu', 'providers.json');
+}
+export function readProfiles(home = homedir()) {
+    const path = providersPath(home);
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw new ProvidersStoreError(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new ProvidersStoreError(`${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        throw new ProvidersStoreError(`${path} top-level must be an object`);
+    }
+    const file = parsed;
+    if (file.version !== PROVIDERS_FILE_VERSION) {
+        throw new ProvidersStoreError(`${path} has unsupported version ${String(file.version)}; expected ${PROVIDERS_FILE_VERSION}. Upgrade @namzu/cli, or back up the file and re-create your profiles with \`namzu providers add\`.`);
+    }
+    if (!Array.isArray(file.profiles)) {
+        throw new ProvidersStoreError(`${path}.profiles must be an array`);
+    }
+    const validated = [];
+    for (const entry of file.profiles) {
+        try {
+            validated.push(validateProfile(entry));
+        }
+        catch (err) {
+            if (err instanceof ProfileValidationError) {
+                throw new ProvidersStoreError(`${path}: invalid profile — ${err.message}`);
+            }
+            throw err;
+        }
+    }
+    return validated;
+}
+export function writeProfiles(profiles, home = homedir()) {
+    assertInvariants(profiles);
+    const path = providersPath(home);
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true, mode: DIR_MODE });
+    const payload = { version: PROVIDERS_FILE_VERSION, profiles: [...profiles] };
+    const body = `${JSON.stringify(payload, null, 2)}\n`;
+    // PID alone is not enough — two concurrent writes in the same process
+    // (Promise.all on `providers add` from a script, for example) would
+    // collide on the temp file and one mutation could be lost. Append a
+    // random suffix so each writer has its own temp path; the final
+    // `renameSync` is atomic per-rename so the last successful rename
+    // wins (caller's responsibility to serialize semantically distinct
+    // mutations — see assertInvariants for the in-memory check).
+    const tmp = `${path}.tmp.${process.pid}.${randomBytes(4).toString('hex')}`;
+    writeFileSync(tmp, body, { mode: FILE_MODE });
+    // Ensure mode even when umask interfered.
+    chmodSync(tmp, FILE_MODE);
+    renameSync(tmp, path);
+}
+export function assertInvariants(profiles) {
+    const seen = new Set();
+    let defaults = 0;
+    for (const p of profiles) {
+        if (seen.has(p.name)) {
+            throw new ProvidersStoreError(`duplicate profile name: ${p.name}`);
+        }
+        seen.add(p.name);
+        if (p.default === true)
+            defaults += 1;
+    }
+    if (defaults > 1) {
+        throw new ProvidersStoreError(`at most one profile may have default: true (got ${defaults})`);
+    }
+}
+/**
+ * Resolve the live API key for a profile, honoring overrides:
+ *   1. `NAMZU_<UPPERCASE_NAME>_API_KEY` (per-profile override)
+ *   2. Per-type vendor default (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, etc.)
+ *   3. `profile.apiKey` (on-disk)
+ *   4. `null` (no key — caller decides whether that's fatal)
+ */
+export function resolveApiKey(profile, env = process.env) {
+    const namedEnv = env[`NAMZU_${nameToEnv(profile.name)}_API_KEY`];
+    if (namedEnv && namedEnv.length > 0)
+        return namedEnv;
+    const fallbackName = TYPE_ENV_FALLBACK[profile.type];
+    if (fallbackName) {
+        const v = env[fallbackName];
+        if (v && v.length > 0)
+            return v;
+    }
+    const onDisk = profile.apiKey;
+    if (onDisk && onDisk.length > 0)
+        return onDisk;
+    return null;
+}
+export function findDefault(profiles) {
+    return profiles.find((p) => p.default === true) ?? null;
+}
+function nameToEnv(name) {
+    return name.toUpperCase().replace(/[^A-Z0-9]/g, '_');
+}
+//# sourceMappingURL=store.js.map

package/dist/integrations/providers/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/integrations/providers/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EACN,sBAAsB,EACtB,sBAAsB,EAGtB,iBAAiB,EACjB,eAAe,GACf,MAAM,aAAa,CAAA;AAEpB,MAAM,SAAS,GAAG,KAAK,CAAA;AACvB,MAAM,QAAQ,GAAG,KAAK,CAAA;AAEtB,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IAClC,CAAC;CACD;AAMD,MAAM,UAAU,aAAa,CAAC,OAAe,OAAO,EAAE;IACrD,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe,OAAO,EAAE;IACpD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAA;QAC/D,MAAM,IAAI,mBAAmB,CAC5B,kBAAkB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7E,CAAA;IACF,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,mBAAmB,CAC5B,GAAG,IAAI,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAChF,CAAA;IACF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,MAAgC,CAAA;IAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,sBAAsB,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAC5B,GAAG,IAAI,4BAA4B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,sBAAsB,qGAAqG,CAChM,CAAA;IACF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,SAAS,GAAsB,EAAE,CAAA;IACvC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,CAAC;YACJ,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;gBAC3C,MAAM,IAAI,mBAAmB,CAAC,GAAG,IAAI,uBAAuB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC3E,CAAC;YACD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAC5B,QAAoC,EACpC,OAAe,OAAO,EAAE;IAExB,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IAC1B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnD,MAAM,OAAO,GAAkB,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAA;IAC3F,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA;IACpD,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,gEAAgE;IAChE,kEAAkE;IAClE,mEAAmE;IACnE,6DAA6D;IAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAC1E,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IAC7C,0CAA0C;IAC1C,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACzB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAoC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAChB,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI;YAAE,QAAQ,IAAI,CAAC,CAAA;IACtC,CAAC;IACD,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,mDAAmD,QAAQ,GAAG,CAAC,CAAA;IAC9F,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC5B,OAAwB,EACxB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAChE,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAA;IACpD,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,CAAA;IAChC,CAAC;IACD,MAAM,MAAM,GAAI,OAA+B,CAAC,MAAM,CAAA;IACtD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAA;IAC9C,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAoC;IAC/D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,IAAI,CAAA;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;AACrD,CAAC"}

package/dist/integrations/providers/store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store.test.d.ts.map

package/dist/integrations/providers/store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.test.d.ts","sourceRoot":"","sources":["../../../src/integrations/providers/store.test.ts"],"names":[],"mappings":""}

package/dist/integrations/providers/store.test.js

@@ -0,0 +1,127 @@
+import { mkdirSync, mkdtempSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import { ProvidersStoreError, assertInvariants, findDefault, providersPath, readProfiles, resolveApiKey, writeProfiles, } from './store.js';
+function tmpHome() {
+    return mkdtempSync(join(tmpdir(), 'namzu-providers-'));
+}
+const anthropic = (over = {}) => ({
+    name: 'a',
+    type: 'anthropic',
+    apiKey: 'sk-ant-deadbeef',
+    ...over,
+});
+const openai = (over = {}) => ({
+    name: 'o',
+    type: 'openai',
+    apiKey: 'sk-openai-cafebabe',
+    ...over,
+});
+describe('readProfiles', () => {
+    it('returns an empty array when the file is missing', () => {
+        expect(readProfiles(tmpHome())).toEqual([]);
+    });
+    it('throws ProvidersStoreError on malformed JSON', () => {
+        const home = tmpHome();
+        mkdirSync(join(home, '.namzu'));
+        writeFileSync(join(home, '.namzu', 'providers.json'), '{not json}');
+        expect(() => readProfiles(home)).toThrow(ProvidersStoreError);
+    });
+    it('throws on wrong version', () => {
+        const home = tmpHome();
+        mkdirSync(join(home, '.namzu'));
+        writeFileSync(join(home, '.namzu', 'providers.json'), JSON.stringify({ version: 99, profiles: [] }));
+        expect(() => readProfiles(home)).toThrowError(/unsupported version/);
+    });
+});
+describe('writeProfiles', () => {
+    it('round-trips a profile through disk', () => {
+        const home = tmpHome();
+        writeProfiles([anthropic()], home);
+        expect(readProfiles(home)).toEqual([anthropic()]);
+    });
+    it('enforces mode 0600 on the file and 0700 on the directory', () => {
+        const home = tmpHome();
+        writeProfiles([anthropic()], home);
+        const fileStat = statSync(providersPath(home));
+        const dirStat = statSync(join(home, '.namzu'));
+        expect(fileStat.mode & 0o777).toBe(0o600);
+        expect(dirStat.mode & 0o777).toBe(0o700);
+    });
+    it('writes valid JSON that includes the version header', () => {
+        const home = tmpHome();
+        writeProfiles([anthropic()], home);
+        const raw = readFileSync(providersPath(home), 'utf8');
+        const parsed = JSON.parse(raw);
+        expect(parsed.version).toBe(1);
+        expect(Array.isArray(parsed.profiles)).toBe(true);
+    });
+    it('rejects duplicate names', () => {
+        expect(() => writeProfiles([anthropic(), anthropic()], tmpHome())).toThrowError(/duplicate profile name/);
+    });
+    it('rejects more than one default', () => {
+        expect(() => writeProfiles([anthropic({ default: true }), openai({ name: 'o', default: true })], tmpHome())).toThrowError(/at most one/);
+    });
+});
+describe('concurrent writes', () => {
+    it('two simultaneous writeProfiles calls do not collide on the temp file', async () => {
+        const home = tmpHome();
+        // Fire two writes in parallel. Each carries a different profile set
+        // so we can tell which one won the final rename — the important
+        // guarantee is that NEITHER throws (no temp-path collision) and
+        // the final on-disk state is exactly one of the two valid inputs
+        // (no half-written, no merged garbage).
+        const a = anthropic({ name: 'one' });
+        const b = openai({ name: 'two' });
+        await Promise.all([
+            Promise.resolve().then(() => writeProfiles([a], home)),
+            Promise.resolve().then(() => writeProfiles([b], home)),
+        ]);
+        const final = readProfiles(home);
+        expect(final.length).toBe(1);
+        expect(['one', 'two']).toContain(final[0]?.name);
+    });
+});
+describe('assertInvariants', () => {
+    it('passes for an empty store', () => {
+        expect(() => assertInvariants([])).not.toThrow();
+    });
+    it('passes for a single profile with default=true', () => {
+        expect(() => assertInvariants([anthropic({ default: true })])).not.toThrow();
+    });
+});
+describe('resolveApiKey', () => {
+    it('returns null when no key is anywhere', () => {
+        const p = { name: 'x', type: 'anthropic' };
+        expect(resolveApiKey(p, {})).toBeNull();
+    });
+    it('reads from profile.apiKey when no env override', () => {
+        expect(resolveApiKey(anthropic(), {})).toBe('sk-ant-deadbeef');
+    });
+    it('per-type env (ANTHROPIC_API_KEY) wins over file', () => {
+        expect(resolveApiKey(anthropic(), { ANTHROPIC_API_KEY: 'env-key' })).toBe('env-key');
+    });
+    it('per-profile env (NAMZU_<NAME>_API_KEY) wins over per-type', () => {
+        expect(resolveApiKey(anthropic({ name: 'work' }), {
+            ANTHROPIC_API_KEY: 'type-key',
+            NAMZU_WORK_API_KEY: 'profile-key',
+        })).toBe('profile-key');
+    });
+    it('normalizes profile names with non-alphanumerics in env lookup', () => {
+        expect(resolveApiKey(anthropic({ name: 'work-1' }), { NAMZU_WORK_1_API_KEY: 'normalized' })).toBe('normalized');
+    });
+    it('returns null for ollama (no api-key concept) when nothing is set', () => {
+        expect(resolveApiKey({ name: 'local', type: 'ollama' }, {})).toBeNull();
+    });
+});
+describe('findDefault', () => {
+    it('returns the profile with default=true', () => {
+        const list = [anthropic(), openai({ default: true })];
+        expect(findDefault(list)?.name).toBe('o');
+    });
+    it('returns null when nothing is marked default', () => {
+        expect(findDefault([anthropic(), openai()])).toBeNull();
+    });
+});
+//# sourceMappingURL=store.test.js.map