export const mcpAuthenticateDependencyDeclarations = [
    {
        dependencyId: "runtime.execEngine.mcp.authenticate",
        kind: "service",
        required: true,
        description: "Runtime-owned MCP authentication support. BaseTool passes credentialRef and never handles raw credential material.",
    },
    {
        dependencyId: "runtime.governancePlane.mcpApproval",
        kind: "permission",
        required: true,
        description: "dryRun:false requires explicit guard/governance approval before asking runtime to authenticate.",
    },
    {
        dependencyId: "runtime.mcp.authStore",
        kind: "runtime",
        required: true,
        description: "OAuth/token/session material and refresh lifecycle remain with runtime.",
    },
];
export function createHostExecutorMcpAuthenticateProvider(executor) {
    const authenticate = executor?.mcp?.authenticate;
    if (authenticate === undefined)
        return undefined;
    return async (request, context) => {
        const result = await authenticate({ ...request, context });
        if (!result.ok)
            throw new Error(result.error.message);
        return result.output;
    };
}
