/**
 * OwlCoda Native McpAuth Tool
 *
 * Authenticates with an MCP server that requires credentials.
 *
 * Upstream parity notes:
 * - Upstream handles OAuth/token-based MCP auth
 * - Our version: stores auth tokens per server in memory
 */
const authStore = new Map();
export function getAuthStatus(serverName) {
    return authStore.get(serverName);
}
export function resetAuthStore() {
    authStore.clear();
}
export function createMcpAuthTool() {
    return {
        name: 'McpAuth',
        description: 'Write an entry into an in-memory auth Map marking the given server_name as authenticated=true ' +
            'and recording the auth_type and timestamp. The token / client_id / client_secret are NOT validated, ' +
            'NOT exchanged with any server, NOT used for an OAuth round-trip, and NOT attached to subsequent MCP calls — ' +
            'any input rubber-stamps the server as authenticated. The entry is also lost when the process exits. ' +
            'Use this only if the user is testing the auth-status API or stubbing out a flow. ' +
            'For real MCP authentication, configure the server\'s credentials in .mcp.json (env vars, headers, ' +
            'or whatever the MCP server expects) and let the MCP client handle the handshake.',
        async execute(input) {
            const { server_name, auth_type, token } = input;
            if (!server_name)
                return { output: 'Error: server_name is required.', isError: true };
            if (!auth_type)
                return { output: 'Error: auth_type is required (token or oauth).', isError: true };
            if (auth_type === 'token') {
                if (!token)
                    return { output: 'Error: token is required for token auth.', isError: true };
                authStore.set(server_name, {
                    auth_type: 'token',
                    authenticated: true,
                    timestamp: new Date().toISOString(),
                });
                return {
                    output: `Authenticated with MCP server "${server_name}" via token.`,
                    isError: false,
                    metadata: { server_name, auth_type },
                };
            }
            if (auth_type === 'oauth') {
                // Simplified OAuth — in real implementation would redirect to auth URL
                authStore.set(server_name, {
                    auth_type: 'oauth',
                    authenticated: true,
                    timestamp: new Date().toISOString(),
                });
                return {
                    output: `OAuth authentication initiated for MCP server "${server_name}".`,
                    isError: false,
                    metadata: { server_name, auth_type },
                };
            }
            return { output: `Unknown auth_type "${auth_type}".`, isError: true };
        },
    };
}
//# sourceMappingURL=mcp-auth.js.map