/**
 * OAuth Broker Registry
 *
 * Catalog of MCP servers with pre-registered OAuth apps on the
 * `auth.studiograph.com` broker. Two responsibilities, both driven by
 * the same array below:
 *
 *   1. RUNTIME — when a user-imported connector's URL matches one of
 *      these hostnames, OAuth gets routed through the broker (which
 *      holds the client secret) instead of expecting per-instance
 *      credentials. See `getBrokerConnectUrl`.
 *   2. CATALOG — Settings → External Connectors lists these as
 *      "available to one-click add" tiles so an owner doesn't have to
 *      know the canonical URL or paste JSON. See
 *      `listAvailableBrokerConnectors`.
 *
 * Adding a new entry is a deliberate decision, not a default workflow.
 * See docs/agents/agent-system.md § "Broker strategy" for when to do it and the costs
 * involved (provider relationship, rate-limit exposure, single point
 * of compromise).
 */
const BROKER_URL = 'https://auth.studiograph.com';
export const BROKER_CONNECTORS = [
    {
        hostname: 'mcp.asana.com',
        name: 'asana',
        displayName: 'Asana',
        serverUrl: 'https://mcp.asana.com/sse',
    },
    {
        hostname: 'mcp.figma.com',
        name: 'figma',
        displayName: 'Figma',
        serverUrl: 'https://mcp.figma.com/v1/mcp',
        // Figma's MCP server is pending GA; keep the OAuth app registered
        // for early-access workspaces but don't surface the catalog tile
        // until the endpoint is publicly available.
        catalogHidden: true,
    },
];
/** Internal lookup — hostname → slug. Rebuilt from BROKER_CONNECTORS. */
const BROKER_HOSTS = new Map(BROKER_CONNECTORS.map(c => [c.hostname, c.name]));
/**
 * Check if a connector URL has broker support.
 * Returns the broker connect URL, or undefined if not supported.
 */
export function getBrokerConnectUrl(connectorUrl, state) {
    try {
        const hostname = new URL(connectorUrl).hostname;
        const connectorName = BROKER_HOSTS.get(hostname);
        if (!connectorName)
            return undefined;
        return `${BROKER_URL}/connect/${connectorName}?state=${encodeURIComponent(state)}`;
    }
    catch {
        return undefined;
    }
}
/**
 * Check if a connector URL is supported by the broker.
 */
export function hasBrokerSupport(connectorUrl) {
    try {
        return BROKER_HOSTS.has(new URL(connectorUrl).hostname);
    }
    catch {
        return false;
    }
}
/**
 * Catalog entries owners can one-click add. Drops `catalogHidden`
 * connectors and anything callers have already configured (the names
 * passed in are case-normalized — connector names are url-safe slugs
 * but the import form may capitalize the display label).
 */
export function listAvailableBrokerConnectors(configuredNames = new Set()) {
    const normalized = new Set([...configuredNames].map(n => n.toLowerCase()));
    return BROKER_CONNECTORS
        .filter(c => !c.catalogHidden)
        .filter(c => !normalized.has(c.name.toLowerCase()) && !normalized.has(c.displayName.toLowerCase()))
        .map(({ name, displayName, serverUrl }) => ({ name, displayName, serverUrl }));
}
/** Broker base URL for claim retrieval. */
export { BROKER_URL };
//# sourceMappingURL=oauth-registry.js.map