@kya-os/mcp-i-core 1.7.0 → 1.8.1

package/dist/services/delegation-error-formatter.d.ts

@@ -1,124 +0,0 @@
-/**
- * DelegationErrorFormatter - Formats delegation error messages for MCP clients
- *
- * This service provides a single source of truth for formatting delegation
- * required error messages. It supports:
- * - Default message templates
- * - Client-specific message customization (claude, chatgpt, cursor, etc.)
- * - Template interpolation with placeholders
- * - Markdown support toggle per client
- *
- * @module @kya-os/mcp-i-core/services/delegation-error-formatter
- */
-import type { ClientMessageTemplate, ClientMessagesConfig } from "@kya-os/contracts/config";
-export type { ClientMessageTemplate, ClientMessagesConfig };
-/**
- * Options for formatting a delegation error message
- */
-export interface DelegationErrorFormatOptions {
-    /** Name of the tool that requires delegation */
-    toolName: string;
-    /** URL where user can provide consent/delegation */
-    consentUrl?: string;
-    /** Scopes required for the tool */
-    scopes?: string[];
-    /** Client ID (e.g., "claude", "chatgpt", "cursor") - used for client-specific messages */
-    clientId?: string;
-}
-/**
- * Options for formatting an OAuth error message
- */
-export interface OAuthErrorFormatOptions {
-    /** Name of the tool that requires OAuth */
-    toolName: string;
-    /** OAuth authorization URL */
-    oauthUrl?: string;
-    /** OAuth provider name (e.g., "GitHub", "Google") */
-    provider?: string;
-    /** Scopes required for the tool */
-    scopes?: string[];
-    /** Client ID (e.g., "claude", "chatgpt", "cursor") - used for client-specific messages */
-    clientId?: string;
-}
-/**
- * Result of formatting a delegation error
- */
-export interface DelegationErrorResult {
-    /** Formatted message to display to the user */
-    message: string;
-    /** Consent URL (may be modified with extra params) */
-    consentUrl?: string;
-}
-/**
- * Result of formatting an OAuth error
- */
-export interface OAuthErrorResult {
-    /** Formatted message to display to the user */
-    message: string;
-    /** OAuth URL (may be modified with extra params) */
-    oauthUrl?: string;
-}
-/**
- * Service for formatting delegation error messages
- *
- * Provides consistent message formatting across different deployment patterns
- * (agent, adapter) while supporting client-specific customization.
- *
- * @example
- * ```typescript
- * const formatter = new DelegationErrorFormatter();
- * const { message } = formatter.format({
- *   toolName: "checkout",
- *   consentUrl: "https://example.com/consent",
- *   clientId: "claude"
- * });
- * ```
- */
-export declare class DelegationErrorFormatter {
-    private config?;
-    constructor(config?: ClientMessagesConfig);
-    /**
-     * Update the configuration
-     */
-    setConfig(config: ClientMessagesConfig): void;
-    /**
-     * Format a delegation error message
-     *
-     * @param options - Formatting options including toolName, consentUrl, and clientId
-     * @returns Formatted message and potentially modified consent URL
-     */
-    format(options: DelegationErrorFormatOptions): DelegationErrorResult;
-    /**
-     * Format an OAuth error message
-     *
-     * @param options - Formatting options including toolName, oauthUrl, provider, and clientId
-     * @returns Formatted message and potentially modified OAuth URL
-     */
-    formatOAuth(options: OAuthErrorFormatOptions): OAuthErrorResult;
-    /**
-     * Get the template for a specific client, merging with defaults
-     */
-    private getTemplate;
-    /**
-     * Build URL with extra parameters if configured
-     * Used for both consent URLs and OAuth URLs
-     */
-    private buildUrl;
-    /**
-     * Interpolate placeholders in a template string
-     *
-     * Uses a function replacement to avoid special pattern interpretation.
-     * JavaScript's String.replace() interprets patterns like $&, $', $` in the
-     * replacement string. Using () => value prevents this.
-     */
-    private interpolate;
-    /**
-     * Strip markdown links, converting [text](url) to plain "text: url"
-     */
-    private stripMarkdownLinks;
-}
-/**
- * Create a delegation error formatter with optional configuration
- */
-export declare function createDelegationErrorFormatter(config?: ClientMessagesConfig): DelegationErrorFormatter;
-//# sourceMappingURL=delegation-error-formatter.d.ts.map

package/dist/services/delegation-error-formatter.js

@@ -1,214 +0,0 @@
-"use strict";
-/**
- * DelegationErrorFormatter - Formats delegation error messages for MCP clients
- *
- * This service provides a single source of truth for formatting delegation
- * required error messages. It supports:
- * - Default message templates
- * - Client-specific message customization (claude, chatgpt, cursor, etc.)
- * - Template interpolation with placeholders
- * - Markdown support toggle per client
- *
- * @module @kya-os/mcp-i-core/services/delegation-error-formatter
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DelegationErrorFormatter = void 0;
-exports.createDelegationErrorFormatter = createDelegationErrorFormatter;
-/**
- * Default message template (matches original adapter/agent behavior)
- */
-const DEFAULT_TEMPLATE = {
-    message: `Authorization required for "{toolName}".
-
-Authorization URL: {consentUrl}
-
-Share this URL with the user so they can authorize in their browser, then retry.`,
-    noUrlMessage: `Authorization required for "{toolName}" but no consent URL is available.
-
-Please contact the administrator to configure delegation for this tool.`,
-    oauthMessage: `Authorization required for "{toolName}".
-
-Sign in with {provider}: {oauthUrl}
-
-Share this URL with the user so they can sign in with {provider}, then retry.`,
-    noOAuthUrlMessage: `Authorization required for "{toolName}" but no {provider} URL is available.
-
-Please contact the administrator to configure OAuth for this tool.`,
-    supportsMarkdown: true,
-};
-/**
- * Service for formatting delegation error messages
- *
- * Provides consistent message formatting across different deployment patterns
- * (agent, adapter) while supporting client-specific customization.
- *
- * @example
- * ```typescript
- * const formatter = new DelegationErrorFormatter();
- * const { message } = formatter.format({
- *   toolName: "checkout",
- *   consentUrl: "https://example.com/consent",
- *   clientId: "claude"
- * });
- * ```
- */
-class DelegationErrorFormatter {
-    config;
-    constructor(config) {
-        this.config = config;
-    }
-    /**
-     * Update the configuration
-     */
-    setConfig(config) {
-        this.config = config;
-    }
-    /**
-     * Format a delegation error message
-     *
-     * @param options - Formatting options including toolName, consentUrl, and clientId
-     * @returns Formatted message and potentially modified consent URL
-     */
-    format(options) {
-        const { toolName, consentUrl, scopes, clientId } = options;
-        // Get the appropriate template for this client
-        const template = this.getTemplate(clientId);
-        // Build the final consent URL with any extra params
-        const finalUrl = this.buildUrl(consentUrl, template);
-        // Choose message based on whether we have a consent URL
-        let message;
-        if (finalUrl) {
-            const messageTemplate = template.message ?? DEFAULT_TEMPLATE.message;
-            message = this.interpolate(messageTemplate, {
-                toolName,
-                consentUrl: finalUrl,
-                scopes: scopes?.join(", ") ?? "",
-            });
-            // If client doesn't support markdown, convert markdown links to plain text
-            if (template.supportsMarkdown === false) {
-                message = this.stripMarkdownLinks(message);
-            }
-        }
-        else {
-            const noUrlTemplate = template.noUrlMessage ?? DEFAULT_TEMPLATE.noUrlMessage;
-            message = this.interpolate(noUrlTemplate, {
-                toolName,
-                consentUrl: "",
-                scopes: scopes?.join(", ") ?? "",
-            });
-        }
-        return { message, consentUrl: finalUrl };
-    }
-    /**
-     * Format an OAuth error message
-     *
-     * @param options - Formatting options including toolName, oauthUrl, provider, and clientId
-     * @returns Formatted message and potentially modified OAuth URL
-     */
-    formatOAuth(options) {
-        const { toolName, oauthUrl, provider = "OAuth", scopes, clientId } = options;
-        // Get the appropriate template for this client
-        const template = this.getTemplate(clientId);
-        // Build the final OAuth URL with any extra params
-        const finalUrl = this.buildUrl(oauthUrl, template);
-        // Choose message based on whether we have an OAuth URL
-        let message;
-        if (finalUrl) {
-            const messageTemplate = template.oauthMessage ?? DEFAULT_TEMPLATE.oauthMessage;
-            message = this.interpolate(messageTemplate, {
-                toolName,
-                oauthUrl: finalUrl,
-                provider,
-                scopes: scopes?.join(", ") ?? "",
-            });
-            // If client doesn't support markdown, convert markdown links to plain text
-            if (template.supportsMarkdown === false) {
-                message = this.stripMarkdownLinks(message);
-            }
-        }
-        else {
-            const noUrlTemplate = template.noOAuthUrlMessage ?? DEFAULT_TEMPLATE.noOAuthUrlMessage;
-            message = this.interpolate(noUrlTemplate, {
-                toolName,
-                oauthUrl: "",
-                provider,
-                scopes: scopes?.join(", ") ?? "",
-            });
-        }
-        return { message, oauthUrl: finalUrl };
-    }
-    /**
-     * Get the template for a specific client, merging with defaults
-     */
-    getTemplate(clientId) {
-        const defaultTemplate = this.config?.default ?? {};
-        // If no client ID or no client-specific config, use default
-        if (!clientId || !this.config?.clients?.[clientId]) {
-            return {
-                ...DEFAULT_TEMPLATE,
-                ...defaultTemplate,
-            };
-        }
-        // Merge: DEFAULT_TEMPLATE < config.default < config.clients[clientId]
-        return {
-            ...DEFAULT_TEMPLATE,
-            ...defaultTemplate,
-            ...this.config.clients[clientId],
-        };
-    }
-    /**
-     * Build URL with extra parameters if configured
-     * Used for both consent URLs and OAuth URLs
-     */
-    buildUrl(baseUrl, template) {
-        if (!baseUrl)
-            return undefined;
-        // If no extra params, return as-is
-        if (!template.extraParams || Object.keys(template.extraParams).length === 0) {
-            return baseUrl;
-        }
-        // Add extra params to URL
-        try {
-            const url = new URL(baseUrl);
-            for (const [key, value] of Object.entries(template.extraParams)) {
-                url.searchParams.set(key, value);
-            }
-            return url.toString();
-        }
-        catch {
-            // If URL parsing fails, return original
-            return baseUrl;
-        }
-    }
-    /**
-     * Interpolate placeholders in a template string
-     *
-     * Uses a function replacement to avoid special pattern interpretation.
-     * JavaScript's String.replace() interprets patterns like $&, $', $` in the
-     * replacement string. Using () => value prevents this.
-     */
-    interpolate(template, values) {
-        let result = template;
-        for (const [key, value] of Object.entries(values)) {
-            // Use function replacement to prevent special pattern interpretation
-            // e.g., URLs containing $& would otherwise get corrupted
-            result = result.replace(new RegExp(`\\{${key}\\}`, "g"), () => value);
-        }
-        return result;
-    }
-    /**
-     * Strip markdown links, converting [text](url) to plain "text: url"
-     */
-    stripMarkdownLinks(text) {
-        // Match [link text](url) and convert to "link text: url"
-        return text.replace(/\[([^\]]+)\]\(([^)]+)\)/g, "$1: $2");
-    }
-}
-exports.DelegationErrorFormatter = DelegationErrorFormatter;
-/**
- * Create a delegation error formatter with optional configuration
- */
-function createDelegationErrorFormatter(config) {
-    return new DelegationErrorFormatter(config);
-}
-//# sourceMappingURL=delegation-error-formatter.js.map

package/dist/services/errors.d.ts

@@ -1,49 +0,0 @@
-/**
- * Proof Verification Error Codes and Types
- *
- * Specific error codes for proof verification failures to enable
- * better error handling and debugging.
- */
-/**
- * Error codes for proof verification
- */
-export declare const PROOF_VERIFICATION_ERROR_CODES: {
-    readonly INVALID_PROOF_STRUCTURE: "INVALID_PROOF_STRUCTURE";
-    readonly MISSING_REQUIRED_FIELD: "MISSING_REQUIRED_FIELD";
-    readonly NONCE_REPLAY_DETECTED: "NONCE_REPLAY_DETECTED";
-    readonly TIMESTAMP_SKEW_EXCEEDED: "TIMESTAMP_SKEW_EXCEEDED";
-    readonly TIMESTAMP_INVALID: "TIMESTAMP_INVALID";
-    readonly INVALID_JWS_SIGNATURE: "INVALID_JWS_SIGNATURE";
-    readonly INVALID_JWS_FORMAT: "INVALID_JWS_FORMAT";
-    readonly INVALID_JWS_HEADER: "INVALID_JWS_HEADER";
-    readonly INVALID_JWS_PAYLOAD: "INVALID_JWS_PAYLOAD";
-    readonly INVALID_JWS_SIGNATURE_BASE64: "INVALID_JWS_SIGNATURE_BASE64";
-    readonly UNSUPPORTED_ALGORITHM: "UNSUPPORTED_ALGORITHM";
-    readonly INVALID_JWK_FORMAT: "INVALID_JWK_FORMAT";
-    readonly INVALID_JWK_KTY: "INVALID_JWK_KTY";
-    readonly INVALID_JWK_CRV: "INVALID_JWK_CRV";
-    readonly INVALID_JWK_X_FIELD: "INVALID_JWK_X_FIELD";
-    readonly INVALID_JWK_KEY_LENGTH: "INVALID_JWK_KEY_LENGTH";
-    readonly JWK_KID_MISMATCH: "JWK_KID_MISMATCH";
-    readonly DID_RESOLUTION_FAILED: "DID_RESOLUTION_FAILED";
-    readonly DID_DOCUMENT_NOT_FOUND: "DID_DOCUMENT_NOT_FOUND";
-    readonly VERIFICATION_METHOD_NOT_FOUND: "VERIFICATION_METHOD_NOT_FOUND";
-    readonly PUBLIC_KEY_NOT_FOUND: "PUBLIC_KEY_NOT_FOUND";
-    readonly UNSUPPORTED_DID_METHOD: "UNSUPPORTED_DID_METHOD";
-    readonly VERIFICATION_ERROR: "VERIFICATION_ERROR";
-    readonly INTERNAL_ERROR: "INTERNAL_ERROR";
-};
-export type ProofVerificationErrorCode = typeof PROOF_VERIFICATION_ERROR_CODES[keyof typeof PROOF_VERIFICATION_ERROR_CODES];
-/**
- * Proof verification error with specific error code
- */
-export declare class ProofVerificationError extends Error {
-    readonly code: ProofVerificationErrorCode;
-    readonly details?: Record<string, unknown> | undefined;
-    constructor(code: ProofVerificationErrorCode, message: string, details?: Record<string, unknown> | undefined);
-}
-/**
- * Create a proof verification error
- */
-export declare function createProofVerificationError(code: ProofVerificationErrorCode, message: string, details?: Record<string, unknown>): ProofVerificationError;
-//# sourceMappingURL=errors.d.ts.map

package/dist/services/errors.js

@@ -1,66 +0,0 @@
-"use strict";
-/**
- * Proof Verification Error Codes and Types
- *
- * Specific error codes for proof verification failures to enable
- * better error handling and debugging.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProofVerificationError = exports.PROOF_VERIFICATION_ERROR_CODES = void 0;
-exports.createProofVerificationError = createProofVerificationError;
-/**
- * Error codes for proof verification
- */
-exports.PROOF_VERIFICATION_ERROR_CODES = {
-    // Proof structure errors
-    INVALID_PROOF_STRUCTURE: "INVALID_PROOF_STRUCTURE",
-    MISSING_REQUIRED_FIELD: "MISSING_REQUIRED_FIELD",
-    // Security errors
-    NONCE_REPLAY_DETECTED: "NONCE_REPLAY_DETECTED",
-    TIMESTAMP_SKEW_EXCEEDED: "TIMESTAMP_SKEW_EXCEEDED",
-    TIMESTAMP_INVALID: "TIMESTAMP_INVALID",
-    // Signature errors
-    INVALID_JWS_SIGNATURE: "INVALID_JWS_SIGNATURE",
-    INVALID_JWS_FORMAT: "INVALID_JWS_FORMAT",
-    INVALID_JWS_HEADER: "INVALID_JWS_HEADER",
-    INVALID_JWS_PAYLOAD: "INVALID_JWS_PAYLOAD",
-    INVALID_JWS_SIGNATURE_BASE64: "INVALID_JWS_SIGNATURE_BASE64",
-    UNSUPPORTED_ALGORITHM: "UNSUPPORTED_ALGORITHM",
-    // JWK errors
-    INVALID_JWK_FORMAT: "INVALID_JWK_FORMAT",
-    INVALID_JWK_KTY: "INVALID_JWK_KTY",
-    INVALID_JWK_CRV: "INVALID_JWK_CRV",
-    INVALID_JWK_X_FIELD: "INVALID_JWK_X_FIELD",
-    INVALID_JWK_KEY_LENGTH: "INVALID_JWK_KEY_LENGTH",
-    JWK_KID_MISMATCH: "JWK_KID_MISMATCH",
-    // DID resolution errors
-    DID_RESOLUTION_FAILED: "DID_RESOLUTION_FAILED",
-    DID_DOCUMENT_NOT_FOUND: "DID_DOCUMENT_NOT_FOUND",
-    VERIFICATION_METHOD_NOT_FOUND: "VERIFICATION_METHOD_NOT_FOUND",
-    PUBLIC_KEY_NOT_FOUND: "PUBLIC_KEY_NOT_FOUND",
-    UNSUPPORTED_DID_METHOD: "UNSUPPORTED_DID_METHOD",
-    // Generic errors
-    VERIFICATION_ERROR: "VERIFICATION_ERROR",
-    INTERNAL_ERROR: "INTERNAL_ERROR",
-};
-/**
- * Proof verification error with specific error code
- */
-class ProofVerificationError extends Error {
-    code;
-    details;
-    constructor(code, message, details) {
-        super(message);
-        this.code = code;
-        this.details = details;
-        this.name = "ProofVerificationError";
-    }
-}
-exports.ProofVerificationError = ProofVerificationError;
-/**
- * Create a proof verification error
- */
-function createProofVerificationError(code, message, details) {
-    return new ProofVerificationError(code, message, details);
-}
-//# sourceMappingURL=errors.js.map

package/dist/services/index.d.ts

@@ -1,9 +0,0 @@
-export { CryptoService } from './crypto.service.js';
-export type { Ed25519JWK, ParsedJWS } from './crypto.service.js';
-export { AccessControlApiService, authorizationMatches, } from './access-control.service.js';
-export type { AccessControlApiServiceConfig, AccessControlApiServiceMetrics, } from './access-control.service.js';
-export { SessionRegistrationService, createSessionRegistrationService, } from './session-registration.service.js';
-export type { SessionRegistrationServiceConfig, SessionRegistrationResult, } from './session-registration.service.js';
-export { DelegationErrorFormatter, createDelegationErrorFormatter, } from './delegation-error-formatter.js';
-export type { DelegationErrorFormatOptions, DelegationErrorResult, OAuthErrorFormatOptions, OAuthErrorResult, ClientMessageTemplate, ClientMessagesConfig, } from './delegation-error-formatter.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/services/index.js

@@ -1,15 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createDelegationErrorFormatter = exports.DelegationErrorFormatter = exports.createSessionRegistrationService = exports.SessionRegistrationService = exports.authorizationMatches = exports.AccessControlApiService = exports.CryptoService = void 0;
-var crypto_service_js_1 = require("./crypto.service.js");
-Object.defineProperty(exports, "CryptoService", { enumerable: true, get: function () { return crypto_service_js_1.CryptoService; } });
-var access_control_service_js_1 = require("./access-control.service.js");
-Object.defineProperty(exports, "AccessControlApiService", { enumerable: true, get: function () { return access_control_service_js_1.AccessControlApiService; } });
-Object.defineProperty(exports, "authorizationMatches", { enumerable: true, get: function () { return access_control_service_js_1.authorizationMatches; } });
-var session_registration_service_js_1 = require("./session-registration.service.js");
-Object.defineProperty(exports, "SessionRegistrationService", { enumerable: true, get: function () { return session_registration_service_js_1.SessionRegistrationService; } });
-Object.defineProperty(exports, "createSessionRegistrationService", { enumerable: true, get: function () { return session_registration_service_js_1.createSessionRegistrationService; } });
-var delegation_error_formatter_js_1 = require("./delegation-error-formatter.js");
-Object.defineProperty(exports, "DelegationErrorFormatter", { enumerable: true, get: function () { return delegation_error_formatter_js_1.DelegationErrorFormatter; } });
-Object.defineProperty(exports, "createDelegationErrorFormatter", { enumerable: true, get: function () { return delegation_error_formatter_js_1.createDelegationErrorFormatter; } });
-//# sourceMappingURL=index.js.map

package/dist/services/oauth-config.service.d.ts

@@ -1,53 +0,0 @@
-/**
- * OAuth Config Service
- *
- * Fetches and caches OAuth provider configurations from AgentShield API.
- * Provides caching with TTL to reduce API calls.
- *
- * @package @kya-os/mcp-i-core
- */
-import type { FetchProvider } from "../providers/base.js";
-import type { OAuthConfig } from "@kya-os/contracts/config";
-import type { OAuthConfigCache } from "../cache/oauth-config-cache.js";
-export interface OAuthConfigServiceConfig {
-    /** Base URL for AgentShield API (e.g., "https://kya.vouched.id") */
-    baseUrl: string;
-    /** API key for authentication */
-    apiKey: string;
-    /** Fetch provider for making HTTP requests */
-    fetchProvider: FetchProvider;
-    /** Cache implementation (defaults to in-memory) */
-    cache?: OAuthConfigCache;
-    /** Cache TTL in milliseconds (default: 5 minutes) */
-    cacheTtl?: number;
-    /** Optional logger callback for diagnostics */
-    logger?: (message: string, data?: unknown) => void;
-}
-/**
- * Service for fetching OAuth provider configurations from AgentShield API
- */
-export declare class OAuthConfigService {
-    private config;
-    constructor(config: OAuthConfigServiceConfig);
-    /**
-     * Get OAuth configuration for a project
-     *
-     * Fetches from AgentShield API: GET /api/v1/bouncer/projects/{projectId}/providers
-     * Caches responses with TTL to reduce API calls.
-     *
-     * @param projectId - Project ID to fetch config for
-     * @returns OAuth configuration with providers object
-     */
-    getOAuthConfig(projectId: string): Promise<OAuthConfig>;
-    /**
-     * Clear cached config for a project
-     *
-     * @param projectId - Project ID to clear cache for
-     */
-    clearCache(projectId: string): Promise<void>;
-    /**
-     * Clear all cached configs
-     */
-    clearAllCache(): Promise<void>;
-}
-//# sourceMappingURL=oauth-config.service.d.ts.map

package/dist/services/oauth-config.service.js

@@ -1,141 +0,0 @@
-"use strict";
-/**
- * OAuth Config Service
- *
- * Fetches and caches OAuth provider configurations from AgentShield API.
- * Provides caching with TTL to reduce API calls.
- *
- * @package @kya-os/mcp-i-core
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAuthConfigService = void 0;
-const oauth_config_cache_js_1 = require("../cache/oauth-config-cache.js");
-/**
- * Service for fetching OAuth provider configurations from AgentShield API
- */
-class OAuthConfigService {
-    config;
-    constructor(config) {
-        this.config = {
-            baseUrl: config.baseUrl,
-            apiKey: config.apiKey,
-            fetchProvider: config.fetchProvider,
-            cacheTtl: config.cacheTtl ?? 5 * 60 * 1000, // Default 5 minutes
-            logger: config.logger || (() => { }),
-            cache: config.cache || new oauth_config_cache_js_1.InMemoryOAuthConfigCache(),
-        };
-    }
-    /**
-     * Get OAuth configuration for a project
-     *
-     * Fetches from AgentShield API: GET /api/v1/bouncer/projects/{projectId}/providers
-     * Caches responses with TTL to reduce API calls.
-     *
-     * @param projectId - Project ID to fetch config for
-     * @returns OAuth configuration with providers object
-     */
-    async getOAuthConfig(projectId) {
-        // Check cache
-        const cached = await this.config.cache.get(projectId);
-        if (cached) {
-            this.config.logger("[OAuthConfigService] Cache hit", {
-                projectId,
-            });
-            return cached;
-        }
-        // Fetch from AgentShield API
-        const url = `${this.config.baseUrl}/api/v1/bouncer/projects/${encodeURIComponent(projectId)}/providers`;
-        this.config.logger("[OAuthConfigService] Fetching config from API", {
-            projectId,
-            url,
-        });
-        try {
-            const response = await this.config.fetchProvider.fetch(url, {
-                method: "GET",
-                headers: {
-                    Authorization: `Bearer ${this.config.apiKey}`,
-                    "Content-Type": "application/json",
-                },
-            });
-            if (!response.ok) {
-                const errorText = await response.text().catch(() => "Unknown error");
-                throw new Error(`Failed to fetch OAuth config: ${response.status} ${response.statusText} - ${errorText}`);
-            }
-            const result = await response.json();
-            // Validate response structure
-            if (!result.success || !result.data) {
-                throw new Error("Invalid API response: missing success or data field");
-            }
-            // Parse providers object with snake_case → camelCase mapping
-            // AgentShield API may return snake_case fields, but OAuthProvider interface uses camelCase
-            const rawProviders = result.data.providers || {};
-            if (typeof rawProviders !== "object" || Array.isArray(rawProviders)) {
-                throw new Error("Invalid API response: providers must be an object, not an array");
-            }
-            // Map each provider's fields from snake_case to camelCase
-            const providers = {};
-            for (const [name, raw] of Object.entries(rawProviders)) {
-                const p = raw;
-                providers[name] = {
-                    clientId: (p.clientId ?? p.client_id ?? ""),
-                    clientSecret: (p.clientSecret ?? p.client_secret ?? null),
-                    authorizationUrl: (p.authorizationUrl ?? p.authorization_url ?? ""),
-                    tokenUrl: (p.tokenUrl ?? p.token_url ?? ""),
-                    userInfoUrl: (p.userInfoUrl ?? p.user_info_url),
-                    supportsPKCE: (p.supportsPKCE ?? p.supports_pkce ?? false),
-                    requiresClientSecret: (p.requiresClientSecret ?? p.requires_client_secret ?? true),
-                    scopes: (p.scopes ?? []),
-                    defaultScopes: (p.defaultScopes ?? p.default_scopes),
-                    proxyMode: (p.proxyMode ?? p.proxy_mode ?? false),
-                    customParams: (p.customParams ?? p.custom_params),
-                    tokenEndpointAuthMethod: (p.tokenEndpointAuthMethod ?? p.token_endpoint_auth_method),
-                    responseType: (p.responseType ?? p.response_type),
-                    grantType: (p.grantType ?? p.grant_type),
-                };
-            }
-            // Build OAuthConfig object
-            // Extract configuredProvider from API response - this indicates which provider
-            // the user has actually configured in AgentShield dashboard
-            const configuredProvider = result.data.configuredProvider ?? result.data.configured_provider ?? null;
-            const config = {
-                providers,
-                configuredProvider,
-            };
-            // Cache config
-            await this.config.cache.set(projectId, config, this.config.cacheTtl);
-            this.config.logger("[OAuthConfigService] Config fetched and cached", {
-                projectId,
-                providerCount: Object.keys(providers).length,
-                providers: Object.keys(providers),
-                configuredProvider,
-                expiresAt: new Date(Date.now() + this.config.cacheTtl).toISOString(),
-            });
-            return config;
-        }
-        catch (error) {
-            this.config.logger("[OAuthConfigService] API fetch failed", {
-                projectId,
-                error: error instanceof Error ? error.message : String(error),
-            });
-            throw error;
-        }
-    }
-    /**
-     * Clear cached config for a project
-     *
-     * @param projectId - Project ID to clear cache for
-     */
-    async clearCache(projectId) {
-        await this.config.cache.delete(projectId);
-        this.config.logger("[OAuthConfigService] Cache cleared", { projectId });
-    }
-    /**
-     * Clear all cached configs
-     */
-    async clearAllCache() {
-        await this.config.cache.clear();
-        this.config.logger("[OAuthConfigService] All cache cleared");
-    }
-}
-exports.OAuthConfigService = OAuthConfigService;
-//# sourceMappingURL=oauth-config.service.js.map