# Copy to ~/.secrets.zsh and fill in. chmod 600. Never committed.
# Sourced at the end of zshenv, so non-interactive shells get these too.
#
# Back up edits by hand as ~/.secrets.zsh.pre-<thing>, matching the convention
# used across ~/config.

export LASTFM_API_KEY=""
export LASTFM_API_SECRET=""

# Read by the opencode profiles as {env:LITELLM_KEY}. opencode has no fallback
# syntax, so an unset value becomes an empty string and every request 401s.
export LITELLM_KEY=""

# ------------------------------------------------------------------------------
# nvim FIM autocomplete (minuet-ai -> LiteLLM -> qwen3-coder-30b)
# ------------------------------------------------------------------------------
# ⚠ WHICH KEY DEPENDS ON THE MACHINE, and on the work laptop it is the policy
# boundary, not a preference. `litellm-key-work` is enforced server-side to 403
# Anthropic and PRC-origin models; a personal key here would silently remove
# that guarantee for anything nvim sends.
#
#   sctfw004 (work)          rbw get litellm-key-work
#   mainframe / system76     rbw get litellm-key-personal
#
# The NAS does not need it -- nvim disables the plugin silently when unset.
export LITELLM_KEY_NVIM="$(rbw get litellm-key-work 2>/dev/null)"

# Where the proxy lives. Mainframe talks to itself; every other machine uses
# the internal name, which has no public A record and is source-IP gated.
# export LITELLM_BASE="https://llm.rcjohnstone.com"