import { L as deleteUserEnvKey, X as ensureAkmUserEnv, aM as readUserEnvFile, H as createLogger, A as AKM_USER_ENV_REF, bd as writeUserEnvKey } from './src-CidJbygh.js';
import { g as getState } from './state-fxN45gBp.js';
import { d as getRequestId, r as requireAdmin, e as errorResponse, k as jsonResponse, w as withAdminBody } from './helpers-kzwksNq1.js';
import './chunk-CLZ62Ad-.js';
import 'node:module';
import './provider-constants-DPrj3yBX.js';
import './dist-DOFcG0Zp.js';
import 'node:fs';
import 'node:path';
import 'buffer';
import 'fs';
import 'path';
import 'node:child_process';
import 'node:url';
import 'node:crypto';
import 'events';
import 'node:events';
import 'node:stream';
import 'node:string_decoder';
import 'assert';
import 'zlib';
import 'node:assert';
import 'node:fs/promises';
import 'node:os';
import './endpoints-UdQGgKsR.js';

//#region src/routes/admin/secrets/user-env/+server.ts
var logger = createLogger("admin.secrets.user-env");
var KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
/**
* GET — list keys in the akm env:user store. Values are NEVER returned.
*/
var GET = async (event) => {
	const requestId = getRequestId(event);
	const authError = requireAdmin(event, requestId);
	if (authError) return authError;
	const envPath = ensureAkmUserEnv(getState());
	return jsonResponse(200, {
		provider: "akm",
		envRef: AKM_USER_ENV_REF,
		keys: Object.keys(readUserEnvFile(envPath)).sort()
	}, requestId);
};
/**
* POST — write a key into the user env file. The value is shell-quoted and
* written directly to `knowledge/env/user.env` (mode 0600); it never appears on
* a process argv. The assistant sources the env file at startup, so a key
* written here is visible to OpenCode after the next assistant restart.
*/
var POST = (event) => withAdminBody(event, async ({ requestId, body }) => {
	const state = getState();
	const key = typeof body.key === "string" ? body.key.trim() : "";
	const value = typeof body.value === "string" ? body.value : null;
	if (!key || value === null) return errorResponse(400, "bad_request", "key and value are required", {}, requestId);
	if (!KEY_RE.test(key)) return errorResponse(400, "invalid_key", "key must match [A-Za-z_][A-Za-z0-9_]*", {}, requestId);
	if (value.length === 0) return errorResponse(400, "bad_request", "value must be non-empty; use DELETE to remove a key", {}, requestId);
	if (/[\x00-\x08\x0a-\x1f\x7f]/.test(value)) return errorResponse(400, "invalid_value", "value must not contain newlines or control characters", {}, requestId);
	try {
		writeUserEnvKey(state, key, value);
	} catch (err) {
		const reason = err instanceof Error ? err.message : String(err);
		logger.warn("user env write failed", {
			key,
			reason,
			requestId
		});
		return errorResponse(500, "write_failed", `Failed to write user env key: ${reason}`, {}, requestId);
	}
	return jsonResponse(200, {
		ok: true,
		key
	}, requestId);
});
/** DELETE — remove a key from the user env file. */
var DELETE = async (event) => {
	const requestId = getRequestId(event);
	const authError = requireAdmin(event, requestId);
	if (authError) return authError;
	const state = getState();
	const key = new URL(event.request.url).searchParams.get("key")?.trim() ?? "";
	if (!key || !KEY_RE.test(key)) return errorResponse(400, "bad_request", "valid key query parameter is required", {}, requestId);
	try {
		deleteUserEnvKey(state, key);
	} catch (err) {
		const reason = err instanceof Error ? err.message : String(err);
		logger.warn("user env delete failed", {
			key,
			reason,
			requestId
		});
		return errorResponse(500, "delete_failed", `Failed to remove user env key: ${reason}`, {}, requestId);
	}
	return jsonResponse(200, {
		ok: true,
		key
	}, requestId);
};

export { DELETE, GET, POST };
//# sourceMappingURL=_server.ts-DTlf1C5O.js.map
