/**
 * Tenant credential store.
 * Reads from /workspace/credentials.json (mounted read-only from host).
 * Writes go via IPC tasks (host daemon writes the file).
 */
import path from "path";
import { readJsonFile, writeIpcFile } from "../ipc.js";
import { getContext } from "../client.js";
function credentialsPath(workspaceDir) {
    return path.join(workspaceDir, "credentials.json");
}
function tasksDir(ipcDir) {
    return path.join(ipcDir, "tasks");
}
function groupFolder() {
    return process.env.NANOCLAW_GROUP_FOLDER ?? "";
}
export async function listCredentials(workspaceDir = "/workspace/shared") {
    const data = readJsonFile(credentialsPath(workspaceDir));
    return data ?? [];
}
export async function getCredential(name, workspaceDir = "/workspace/shared") {
    const creds = await listCredentials(workspaceDir);
    const cred = creds.find((c) => c.name === name);
    if (!cred)
        throw new Error(`Credential not found: ${name}`);
    return cred;
}
export async function setCredential(name, value, opts, ipcDir) {
    const dir = ipcDir ?? getContext().ipcDir;
    writeIpcFile(tasksDir(dir), {
        type: "creds_set",
        name,
        value,
        description: opts?.description,
        groupFolder: groupFolder(),
    });
}
export async function removeCredential(name, ipcDir) {
    const dir = ipcDir ?? getContext().ipcDir;
    writeIpcFile(tasksDir(dir), {
        type: "creds_remove",
        name,
        groupFolder: groupFolder(),
    });
}
//# sourceMappingURL=credentials.js.map