@spec any_configured?() :: boolean()

Returns true if any provider has a configured API key.

@spec dashboard_url_for(provider()) :: String.t() | nil

Returns the API key dashboard URL for a provider, or nil if unknown.

@spec env_var_for(provider()) :: String.t() | nil

Returns the environment variable name for a provider, or nil if unknown.

@spec known_providers() :: [provider()]

Returns the list of known provider names.

@spec oauth_configured?() :: boolean()

Returns true if an openai-codex entry exists in oauth.json.

@spec oauth_path() :: String.t()

Returns the path to ~/.config/minga/oauth.json (XDG-aware).

@spec ollama_available?() :: boolean()

Returns true if Ollama appears to be running locally.

Makes a quick HTTP request to the Ollama API tags endpoint. Returns false on connection errors or timeouts.

@spec ollama_host() :: String.t()

Returns the Ollama host URL. Checks OLLAMA_HOST env var first, then falls back to the default localhost URL.

@spec provider_from_model(String.t()) :: provider()

Extracts the provider name from a model string like "anthropic:claude-sonnet-4-20250514".

Returns "anthropic" for bare model names (no prefix), since Anthropic is the default provider.

@spec resolve(provider()) :: {:ok, String.t(), key_source()} | :error

Resolves an API key for the given provider.

Checks the environment variable first, then the credentials file. Returns {:ok, key, source} if found, or :error if no key is configured anywhere.

@spec revoke(provider()) :: :ok | {:error, term()}

Removes a stored API key for a provider.

Only removes from the credentials file. Environment variables are unaffected (and will still be used if set).

@spec status() :: [provider_status()]

Returns the auth status for all known providers plus Ollama and OpenAI OAuth.

Each entry shows whether a key is configured and where it was found (:env, :file, :oauth, :local, or nil). Keys themselves are never exposed.

@spec store(provider(), String.t()) :: :ok | {:error, term()}

Stores an API key for a provider in the credentials file.

Creates the config directory and file if they don't exist. Sets file permissions to 0600 (owner read/write only).