import { b as getCredentialPool, R as REMOVAL_REGISTRY, d as addSuppression, e as removeCredential } from './credential-pool-B04qO8at.js';
import { e as err, o as ok } from './_lafs-C3_fBF_X.js';
import { json } from '@sveltejs/kit';
import './paths-2M_UxD_H.js';
import 'node:fs';
import 'node:path';
import 'node:os';
import 'node:events';
import 'node:diagnostics_channel';
import 'fs';
import 'events';
import 'util';
import 'path';
import 'assert';
import 'worker_threads';
import 'module';
import 'node:url';
import 'url';
import 'buffer';
import 'node:module';
import 'node:child_process';
import 'node:crypto';
import 'node:process';
import 'node:async_hooks';
import './index-IVoIz4D5.js';
import 'constants';
import 'stream';
import './config-B0nEjgSh.js';
import './json-DXl7iDYg.js';
import './lock-BoHF25mx.js';
import 'node:fs/promises';
import './index-Ca4C2M45.js';

//#region src/routes/api/credentials/[provider]/[label]/+server.ts
/**
* DELETE /api/credentials/:provider/:label — remove a credential.
*
* Mirrors `cleo auth remove` (T9416):
*
*   1. Resolve the pool entry by `(provider, label)` so we can dispatch
*      on its `source`.
*   2. Look up the per-source `RemovalStep` via `REMOVAL_REGISTRY.find`.
*   3. Invoke `step.remove({ provider, label })` to clean up any
*      filesystem state owned by that source.
*   4. If `result.suppress` is true, call `addSuppression(provider,
*      sourceId)` so the next `seed()` pass skips that source.
*   5. Drop the entry from `llm-credentials.json` via `removeCredential`.
*
* The response carries `cleaned[]` (absolute paths the removal step
* touched) and `hints[]` (operator-facing follow-ups) so the Studio UI
* can surface them in a toast. NO secret material is included.
*
* @task T9426
* @epic E-CONFIG-AUTH-UNIFY (E3 §5.3 T-E3-7)
*/
/**
* Source ids accepted as `RemovalRegistry` keys.
*
* Mirrors `SeederSourceId` from `@cleocode/core/llm/credential-seeders` —
* kept as a closed runtime set so an unknown source id from a legacy
* entry fails fast with `E_REMOVAL_NOT_REGISTERED` rather than coercing
* into a wrong handler.
*
* @task T9426
*/
var ALLOWED_SOURCE_IDS = new Set([
	"env",
	"claude-code",
	"cleo-pkce",
	"codex-cli",
	"gemini-cli",
	"gh-cli",
	"manual"
]);
/**
* DELETE /api/credentials/:provider/:label — see file-level docstring.
*
* @task T9426
*/
var DELETE = async ({ params }) => {
	const provider = params["provider"];
	const label = params["label"];
	if (!provider || provider.trim().length === 0) return json(err("E_VALIDATION", "provider path segment is required"), { status: 400 });
	if (!label || label.trim().length === 0) return json(err("E_VALIDATION", "label path segment is required"), { status: 400 });
	const entry = (await getCredentialPool().list()).find((c) => c.provider === provider && c.label === label);
	if (!entry) return json(err("E_NOT_FOUND", `No credential found for provider='${provider}' label='${label}'`), { status: 404 });
	const sourceId = entry.source ?? "manual";
	if (!ALLOWED_SOURCE_IDS.has(sourceId)) return json(err("E_REMOVAL_NOT_REGISTERED", `Credential has unknown sourceId='${sourceId}' — cannot dispatch removal.`), { status: 500 });
	const step = REMOVAL_REGISTRY.find(sourceId);
	if (!step) return json(err("E_REMOVAL_NOT_REGISTERED", `No RemovalStep registered for source='${sourceId}' — cannot safely remove '${provider}/${label}'.`), { status: 500 });
	const stepResult = await step.remove({
		provider,
		label
	});
	let suppressed = false;
	if (stepResult.suppress) {
		addSuppression(provider, sourceId);
		suppressed = true;
	}
	return json(ok({
		provider,
		label,
		source: sourceId,
		removed: await removeCredential(entry.provider, label),
		cleaned: stepResult.cleaned,
		hints: stepResult.hints,
		suppressed
	}));
};

export { DELETE };
//# sourceMappingURL=_server.ts-S6hqJ8Xn.js.map
