/**
 * Thin HTTP client for the mcp-auth-service.
 *
 * Reads OLAM_MCP_AUTH_SERVICE_URL (default http://127.0.0.1:9998) and
 * OLAM_MCP_AUTH_SECRET from the environment.
 *
 * This URL contract is the Phase C integration point — Phase C reads from
 * mcp-auth at OLAM_MCP_AUTH_SERVICE_URL.
 */
const BASE_URL = process.env['OLAM_MCP_AUTH_SERVICE_URL'] ?? 'http://127.0.0.1:9998';
const SECRET = process.env['OLAM_MCP_AUTH_SECRET'] ?? '';
function authHeaders() {
    return SECRET ? { 'X-Olam-Mcp-Secret': SECRET } : {};
}
async function apiFetch(path, init = {}) {
    const res = await fetch(`${BASE_URL}${path}`, {
        ...init,
        headers: {
            'Content-Type': 'application/json',
            ...authHeaders(),
            ...init.headers,
        },
    });
    if (!res.ok) {
        let msg = `HTTP ${res.status}`;
        try {
            const body = await res.json();
            if (body.error)
                msg = body.error;
        }
        catch { /* ignore */ }
        return { ok: false, error: msg };
    }
    return res.json();
}
export function getMcpAuthClient() {
    return {
        async status() {
            const res = await apiFetch('/credentials/status');
            return res;
        },
        async getCredential(service) {
            return apiFetch(`/credentials/${encodeURIComponent(service)}`);
        },
        async staticAdd({ service, token, label, envName }) {
            return apiFetch('/credentials/static/add', {
                method: 'POST',
                body: JSON.stringify({ service, token, label, envName }),
            });
        },
        async oauthStart({ service, label }) {
            return apiFetch('/credentials/oauth/start', {
                method: 'POST',
                body: JSON.stringify({ service, label }),
            });
        },
        async oauthComplete({ state, accessToken, refreshToken }) {
            return apiFetch('/credentials/oauth/complete', {
                method: 'POST',
                body: JSON.stringify({ state, accessToken, refreshToken }),
            });
        },
        async remove(id) {
            return apiFetch(`/credentials/${encodeURIComponent(id)}`, {
                method: 'DELETE',
            });
        },
    };
}
//# sourceMappingURL=client.js.map