@framers/agentos 0.1.37 → 0.1.39

package/dist/config/extension-secrets.json

@@ -840,5 +840,43 @@
         "docsUrl": "https://modern.ircdocs.horse/",
         "providers": ["irc"],
         "optional": true
+    },
+    {
+        "id": "github.token",
+        "label": "GitHub Personal Access Token",
+        "description": "PAT for GitHub API access. Used by the GitHub extension for repo search, issues, PRs, and gists.",
+        "envVar": "GITHUB_TOKEN",
+        "docsUrl": "https://github.com/settings/tokens",
+        "providers": ["github"],
+        "optional": true
+    },
+    {
+        "id": "twitter.clientId",
+        "label": "Twitter/X OAuth 2.0 Client ID",
+        "description": "Client ID for Twitter OAuth 2.0 PKCE flow. Used by wunderland login --provider twitter.",
+        "envVar": "TWITTER_CLIENT_ID",
+        "docsUrl": "https://developer.x.com/en/portal/dashboard",
+        "providers": ["twitter"],
+        "optional": true
+    },
+    {
+        "id": "meta.appId",
+        "label": "Meta/Facebook App ID",
+        "description": "App ID for Instagram OAuth via Meta. Used by wunderland login --provider instagram.",
+        "envVar": "META_APP_ID",
+        "aliases": ["FACEBOOK_APP_ID"],
+        "docsUrl": "https://developers.facebook.com/apps/",
+        "providers": ["instagram"],
+        "optional": true
+    },
+    {
+        "id": "meta.appSecret",
+        "label": "Meta/Facebook App Secret",
+        "description": "App secret for Instagram OAuth via Meta. Used by wunderland login --provider instagram.",
+        "envVar": "META_APP_SECRET",
+        "aliases": ["FACEBOOK_APP_SECRET"],
+        "docsUrl": "https://developers.facebook.com/apps/",
+        "providers": ["instagram"],
+        "optional": true
     }
 ]

package/dist/core/llm/auth/BrowserOAuthFlow.d.ts

@@ -0,0 +1,62 @@
+/**
+ * @fileoverview Abstract base class for browser-based OAuth 2.0 authorization code
+ * flows with PKCE support.
+ *
+ * Orchestrates: localhost callback server → browser open → code exchange → token storage.
+ * Subclasses implement provider-specific URL building, code exchange, and token refresh.
+ *
+ * @module agentos/core/llm/auth/BrowserOAuthFlow
+ */
+import type { IOAuthFlow, IOAuthTokenStore, OAuthTokenSet } from './types.js';
+export interface BrowserOAuthConfig {
+    /** Human-readable provider name for CLI output. */
+    displayName: string;
+    /** OAuth authorization endpoint URL. */
+    authorizationEndpoint: string;
+    /** OAuth token endpoint URL. */
+    tokenEndpoint: string;
+    /** Requested OAuth scopes. */
+    scopes: string[];
+    /** OAuth client ID. */
+    clientId: string;
+    /** OAuth client secret (optional — PKCE flows may not need it). */
+    clientSecret?: string;
+    /** Maximum time to wait for user authorization (ms). */
+    timeoutMs?: number;
+    /** Buffer before expiry to trigger auto-refresh (ms). */
+    refreshBufferMs?: number;
+}
+export interface BrowserOAuthFlowOptions {
+    tokenStore?: IOAuthTokenStore;
+    /** Called with the authorization URL (for custom display). */
+    onAuthUrl?: (url: string) => void;
+}
+export declare abstract class BrowserOAuthFlow implements IOAuthFlow {
+    abstract readonly providerId: string;
+    protected readonly store: IOAuthTokenStore;
+    protected readonly onAuthUrl?: (url: string) => void;
+    private refreshPromise;
+    constructor(opts?: BrowserOAuthFlowOptions);
+    /** Return provider-specific OAuth configuration. */
+    protected abstract getConfig(): BrowserOAuthConfig;
+    /**
+     * Exchange an authorization code for tokens.
+     * Called after the callback server receives the code.
+     */
+    protected abstract exchangeCode(code: string, redirectUri: string, codeVerifier: string): Promise<OAuthTokenSet>;
+    /**
+     * Refresh an expired access token using the refresh token.
+     */
+    protected abstract refreshTokens(refreshToken: string): Promise<OAuthTokenSet>;
+    /**
+     * Post-exchange hook for provider-specific processing.
+     * E.g., Instagram exchanges short-lived for long-lived tokens here.
+     * Default: passthrough.
+     */
+    protected postExchange(tokens: OAuthTokenSet): Promise<OAuthTokenSet>;
+    authenticate(): Promise<OAuthTokenSet>;
+    refresh(tokens: OAuthTokenSet): Promise<OAuthTokenSet>;
+    isValid(tokens: OAuthTokenSet): boolean;
+    getAccessToken(): Promise<string>;
+}
+//# sourceMappingURL=BrowserOAuthFlow.d.ts.map

package/dist/core/llm/auth/BrowserOAuthFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserOAuthFlow.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/BrowserOAuthFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAY9E,MAAM,WAAW,kBAAkB;IACjC,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gCAAgC;IAChC,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,8DAA8D;IAC9D,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED,8BAAsB,gBAAiB,YAAW,UAAU;IAC1D,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAErC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IAC3C,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,OAAO,CAAC,cAAc,CAAuC;gBAEjD,IAAI,CAAC,EAAE,uBAAuB;IAO1C,oDAAoD;IACpD,SAAS,CAAC,QAAQ,CAAC,SAAS,IAAI,kBAAkB;IAElD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,CAC7B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,aAAa,CAAC;IAEzB;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAI9E;;;;OAIG;cACa,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAMrE,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC;IAwEtC,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAqB5D,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO;IAKjC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;CAsBxC"}

package/dist/core/llm/auth/BrowserOAuthFlow.js

@@ -0,0 +1,134 @@
+/**
+ * @fileoverview Abstract base class for browser-based OAuth 2.0 authorization code
+ * flows with PKCE support.
+ *
+ * Orchestrates: localhost callback server → browser open → code exchange → token storage.
+ * Subclasses implement provider-specific URL building, code exchange, and token refresh.
+ *
+ * @module agentos/core/llm/auth/BrowserOAuthFlow
+ */
+import { FileTokenStore } from './FileTokenStore.js';
+import { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce.js';
+import { startCallbackServer } from './callback-server.js';
+import { isTokenValid, openBrowser } from './utils.js';
+/** Default timeout for user authorization (5 minutes). */
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+/** Default refresh buffer (5 minutes before expiry). */
+const DEFAULT_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+export class BrowserOAuthFlow {
+    constructor(opts) {
+        this.refreshPromise = null;
+        this.store = opts?.tokenStore ?? new FileTokenStore();
+        this.onAuthUrl = opts?.onAuthUrl;
+    }
+    // ── Optional hooks ──
+    /**
+     * Post-exchange hook for provider-specific processing.
+     * E.g., Instagram exchanges short-lived for long-lived tokens here.
+     * Default: passthrough.
+     */
+    async postExchange(tokens) {
+        return tokens;
+    }
+    // ── IOAuthFlow implementation ──
+    async authenticate() {
+        const config = this.getConfig();
+        const timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        // 1. Generate PKCE pair + state
+        const codeVerifier = generateCodeVerifier();
+        const codeChallenge = generateCodeChallenge(codeVerifier);
+        const state = generateState();
+        // 2. Start callback server (port 0 = OS-assigned)
+        let assignedPort = 0;
+        const { promise: callbackPromise, shutdown } = startCallbackServer({
+            expectedState: state,
+            timeoutMs,
+            onListening: (port) => { assignedPort = port; },
+        });
+        // Wait briefly for the server to start listening
+        await new Promise((resolve) => {
+            const check = () => {
+                if (assignedPort > 0) {
+                    resolve();
+                    return;
+                }
+                setTimeout(check, 10);
+            };
+            check();
+        });
+        const redirectUri = `http://localhost:${assignedPort}/callback`;
+        // 3. Build authorization URL
+        const params = new URLSearchParams({
+            response_type: 'code',
+            client_id: config.clientId,
+            redirect_uri: redirectUri,
+            scope: config.scopes.join(' '),
+            state,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+        });
+        const authUrl = `${config.authorizationEndpoint}?${params.toString()}`;
+        // 4. Open browser (or print URL)
+        if (this.onAuthUrl) {
+            this.onAuthUrl(authUrl);
+        }
+        const opened = await openBrowser(authUrl);
+        if (!opened && !this.onAuthUrl) {
+            console.log(`\n  Open this URL in your browser to authorize:\n  ${authUrl}\n`);
+        }
+        // 5. Wait for callback
+        let result;
+        try {
+            result = await callbackPromise;
+        }
+        catch (err) {
+            shutdown();
+            throw err;
+        }
+        // 6. Exchange code for tokens
+        let tokens = await this.exchangeCode(result.code, redirectUri, codeVerifier);
+        // 7. Post-exchange hook
+        tokens = await this.postExchange(tokens);
+        // 8. Store
+        await this.store.save(this.providerId, tokens);
+        return tokens;
+    }
+    async refresh(tokens) {
+        if (!tokens.refreshToken) {
+            throw new Error(`No refresh token available for ${this.providerId}. Run \`wunderland login --provider ${this.providerId}\` to re-authenticate.`);
+        }
+        const refreshed = await this.refreshTokens(tokens.refreshToken);
+        // Preserve refresh token if the provider omits it in the response
+        if (!refreshed.refreshToken && tokens.refreshToken) {
+            refreshed.refreshToken = tokens.refreshToken;
+        }
+        // Preserve metadata
+        if (!refreshed.metadata && tokens.metadata) {
+            refreshed.metadata = tokens.metadata;
+        }
+        await this.store.save(this.providerId, refreshed);
+        return refreshed;
+    }
+    isValid(tokens) {
+        const config = this.getConfig();
+        return isTokenValid(tokens, config.refreshBufferMs ?? DEFAULT_REFRESH_BUFFER_MS);
+    }
+    async getAccessToken() {
+        const tokens = await this.store.load(this.providerId);
+        if (!tokens) {
+            throw new Error(`No ${this.providerId} OAuth tokens found. Run \`wunderland login --provider ${this.providerId}\` to authenticate.`);
+        }
+        if (this.isValid(tokens)) {
+            return tokens.accessToken;
+        }
+        // Need refresh — use mutex to prevent concurrent refreshes
+        if (!this.refreshPromise) {
+            this.refreshPromise = this.refresh(tokens).finally(() => {
+                this.refreshPromise = null;
+            });
+        }
+        const refreshed = await this.refreshPromise;
+        return refreshed.accessToken;
+    }
+}
+//# sourceMappingURL=BrowserOAuthFlow.js.map

package/dist/core/llm/auth/BrowserOAuthFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserOAuthFlow.js","sourceRoot":"","sources":["../../../../src/core/llm/auth/BrowserOAuthFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEvD,0DAA0D;AAC1D,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,wDAAwD;AACxD,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AA2BhD,MAAM,OAAgB,gBAAgB;IAOpC,YAAY,IAA8B;QAFlC,mBAAc,GAAkC,IAAI,CAAC;QAG3D,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,UAAU,IAAI,IAAI,cAAc,EAAE,CAAC;QACtD,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IACnC,CAAC;IAsBD,uBAAuB;IAEvB;;;;OAIG;IACO,KAAK,CAAC,YAAY,CAAC,MAAqB;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kCAAkC;IAElC,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QAEzD,gCAAgC;QAChC,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAE9B,kDAAkD;QAClD,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC;YACjE,aAAa,EAAE,KAAK;YACpB,SAAS;YACT,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;SAChD,CAAC,CAAC;QAEH,iDAAiD;QACjD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,GAAG,EAAE;gBACjB,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;oBAAC,OAAO,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC5C,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxB,CAAC,CAAC;YACF,KAAK,EAAE,CAAC;QACV,CAAC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,oBAAoB,YAAY,WAAW,CAAC;QAEhE,6BAA6B;QAC7B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,aAAa,EAAE,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,KAAK;YACL,cAAc,EAAE,aAAa;YAC7B,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;QAEvE,iCAAiC;QACjC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,sDAAsD,OAAO,IAAI,CAAC,CAAC;QACjF,CAAC;QAED,uBAAuB;QACvB,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,eAAe,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;YACX,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,8BAA8B;QAC9B,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;QAE7E,wBAAwB;QACxB,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAEzC,WAAW;QACX,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAqB;QACjC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,UAAU,uCAAuC,IAAI,CAAC,UAAU,wBAAwB,CAChI,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChE,kEAAkE;QAClE,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACnD,SAAS,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QAC/C,CAAC;QACD,oBAAoB;QACpB,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3C,SAAS,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,MAAqB;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,MAAM,IAAI,CAAC,UAAU,0DAA0D,IAAI,CAAC,UAAU,qBAAqB,CACpH,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,2DAA2D;QAC3D,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACtD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;QAC5C,OAAO,SAAS,CAAC,WAAW,CAAC;IAC/B,CAAC;CACF"}

package/dist/core/llm/auth/FileTokenStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FileTokenStore.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/FileTokenStore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,qBAAa,cAAe,YAAW,gBAAgB;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,OAAO,CAAC,EAAE,MAAM;IAI5B,OAAO,CAAC,SAAS;IAMX,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAmBvD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAW9D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM/C"}
+{"version":3,"file":"FileTokenStore.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/FileTokenStore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAElE,qBAAa,cAAe,YAAW,gBAAgB;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,OAAO,CAAC,EAAE,MAAM;IAI5B,OAAO,CAAC,SAAS;IAMX,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAoBvD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAW9D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAM/C"}

package/dist/core/llm/auth/FileTokenStore.js

@@ -30,6 +30,7 @@ export class FileTokenStore {
                 accessToken: data.accessToken,
                 refreshToken: typeof data.refreshToken === 'string' ? data.refreshToken : undefined,
                 expiresAt: data.expiresAt,
+                metadata: typeof data.metadata === 'object' && data.metadata !== null ? data.metadata : undefined,
             };
         }
         catch {

package/dist/core/llm/auth/FileTokenStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"FileTokenStore.js","sourceRoot":"","sources":["../../../../src/core/llm/auth/FileTokenStore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,MAAM,OAAO,cAAc;IAGzB,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAEO,SAAS,CAAC,UAAkB;QAClC,iDAAiD;QACjD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB;QAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC/E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACnF,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,MAAqB;QAClD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"FileTokenStore.js","sourceRoot":"","sources":["../../../../src/core/llm/auth/FileTokenStore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC,MAAM,OAAO,cAAc;IAGzB,YAAY,OAAgB;QAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAEO,SAAS,CAAC,UAAkB;QAClC,iDAAiD;QACjD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB;QAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC/E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACnF,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;aAClG,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,UAAkB,EAAE,MAAqB;QAClD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;CACF"}

package/dist/core/llm/auth/InstagramOAuthFlow.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @fileoverview Instagram/Meta OAuth 2.0 authorization code flow.
+ *
+ * Uses Facebook's OAuth 2.0 to obtain an Instagram Graph API access token.
+ * After the initial code exchange, the short-lived token is swapped for a
+ * long-lived token (60 days). The IG Business Account ID is resolved and
+ * stored in token metadata.
+ *
+ * @module agentos/core/llm/auth/InstagramOAuthFlow
+ */
+import type { OAuthTokenSet } from './types.js';
+import { BrowserOAuthFlow, type BrowserOAuthConfig, type BrowserOAuthFlowOptions } from './BrowserOAuthFlow.js';
+export interface InstagramOAuthFlowOptions extends BrowserOAuthFlowOptions {
+    /** Meta/Facebook App ID. Falls back to META_APP_ID or FACEBOOK_APP_ID env var. */
+    appId?: string;
+    /** Meta/Facebook App Secret. Falls back to META_APP_SECRET or FACEBOOK_APP_SECRET env var. */
+    appSecret?: string;
+    /** Override scopes. */
+    scopes?: string[];
+}
+export declare class InstagramOAuthFlow extends BrowserOAuthFlow {
+    readonly providerId = "instagram";
+    private readonly appId;
+    private readonly appSecret;
+    private readonly scopes;
+    constructor(opts?: InstagramOAuthFlowOptions);
+    protected getConfig(): BrowserOAuthConfig;
+    protected exchangeCode(code: string, redirectUri: string, _codeVerifier: string): Promise<OAuthTokenSet>;
+    /**
+     * Exchange short-lived token for long-lived token (60 days),
+     * then resolve the IG Business Account ID.
+     */
+    protected postExchange(tokens: OAuthTokenSet): Promise<OAuthTokenSet>;
+    protected refreshTokens(refreshToken: string): Promise<OAuthTokenSet>;
+    /**
+     * Resolve the Instagram Business Account ID from the user's Facebook pages.
+     */
+    private resolveIgUserId;
+}
+//# sourceMappingURL=InstagramOAuthFlow.d.ts.map

package/dist/core/llm/auth/InstagramOAuthFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InstagramOAuthFlow.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/InstagramOAuthFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAoB,aAAa,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAehH,MAAM,WAAW,yBAA0B,SAAQ,uBAAuB;IACxE,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qBAAa,kBAAmB,SAAQ,gBAAgB;IACtD,QAAQ,CAAC,UAAU,eAAe;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;gBAEtB,IAAI,CAAC,EAAE,yBAAyB;IAqB5C,SAAS,CAAC,SAAS,IAAI,kBAAkB;cAWzB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC;IA4BzB;;;OAGG;cACsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;cAkCpE,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IA6B3E;;OAEG;YACW,eAAe;CA4B9B"}

package/dist/core/llm/auth/InstagramOAuthFlow.js

@@ -0,0 +1,143 @@
+/**
+ * @fileoverview Instagram/Meta OAuth 2.0 authorization code flow.
+ *
+ * Uses Facebook's OAuth 2.0 to obtain an Instagram Graph API access token.
+ * After the initial code exchange, the short-lived token is swapped for a
+ * long-lived token (60 days). The IG Business Account ID is resolved and
+ * stored in token metadata.
+ *
+ * @module agentos/core/llm/auth/InstagramOAuthFlow
+ */
+import { BrowserOAuthFlow } from './BrowserOAuthFlow.js';
+const META_AUTH_URL = 'https://www.facebook.com/v21.0/dialog/oauth';
+const META_TOKEN_URL = 'https://graph.facebook.com/v21.0/oauth/access_token';
+const GRAPH_API = 'https://graph.facebook.com/v21.0';
+const DEFAULT_SCOPES = [
+    'instagram_basic',
+    'instagram_content_publish',
+    'instagram_manage_comments',
+    'instagram_manage_insights',
+    'pages_read_engagement',
+    'pages_show_list',
+];
+export class InstagramOAuthFlow extends BrowserOAuthFlow {
+    constructor(opts) {
+        super(opts);
+        this.providerId = 'instagram';
+        this.appId = opts?.appId ?? process.env.META_APP_ID ?? process.env.FACEBOOK_APP_ID ?? '';
+        this.appSecret = opts?.appSecret ?? process.env.META_APP_SECRET ?? process.env.FACEBOOK_APP_SECRET ?? '';
+        this.scopes = opts?.scopes ?? DEFAULT_SCOPES;
+        if (!this.appId) {
+            throw new Error('Meta/Facebook App ID is required for Instagram OAuth. '
+                + 'Pass it via --app-id flag, set META_APP_ID env var, '
+                + 'or create an app at https://developers.facebook.com/apps/');
+        }
+        if (!this.appSecret) {
+            throw new Error('Meta/Facebook App Secret is required for Instagram OAuth. '
+                + 'Pass it via --app-secret flag or set META_APP_SECRET env var.');
+        }
+    }
+    getConfig() {
+        return {
+            displayName: 'Instagram',
+            authorizationEndpoint: META_AUTH_URL,
+            tokenEndpoint: META_TOKEN_URL,
+            scopes: this.scopes,
+            clientId: this.appId,
+            clientSecret: this.appSecret,
+        };
+    }
+    async exchangeCode(code, redirectUri, _codeVerifier) {
+        // Meta uses query params (not POST body) for the token exchange
+        const params = new URLSearchParams({
+            client_id: this.appId,
+            client_secret: this.appSecret,
+            redirect_uri: redirectUri,
+            code,
+        });
+        const res = await fetch(`${META_TOKEN_URL}?${params.toString()}`);
+        if (!res.ok) {
+            const body = await res.text();
+            throw new Error(`Instagram token exchange failed: ${res.status} ${body}`);
+        }
+        const data = await res.json();
+        return {
+            accessToken: data.access_token,
+            expiresAt: Date.now() + (data.expires_in ?? 3600) * 1000,
+        };
+    }
+    /**
+     * Exchange short-lived token for long-lived token (60 days),
+     * then resolve the IG Business Account ID.
+     */
+    async postExchange(tokens) {
+        // 1. Exchange for long-lived token
+        const llParams = new URLSearchParams({
+            grant_type: 'fb_exchange_token',
+            client_id: this.appId,
+            client_secret: this.appSecret,
+            fb_exchange_token: tokens.accessToken,
+        });
+        const llRes = await fetch(`${META_TOKEN_URL}?${llParams.toString()}`);
+        if (llRes.ok) {
+            const llData = await llRes.json();
+            tokens = {
+                accessToken: llData.access_token,
+                // Long-lived tokens don't have traditional refresh tokens;
+                // they're refreshed by calling the same endpoint before expiry
+                refreshToken: llData.access_token,
+                expiresAt: Date.now() + (llData.expires_in ?? 5184000) * 1000, // ~60 days
+            };
+        }
+        // 2. Resolve IG Business Account ID
+        const igUserId = await this.resolveIgUserId(tokens.accessToken);
+        if (igUserId) {
+            tokens.metadata = { ...tokens.metadata, igUserId };
+        }
+        return tokens;
+    }
+    async refreshTokens(refreshToken) {
+        // For Meta long-lived tokens, "refresh" means exchanging the current
+        // long-lived token for a new one (must be done before expiry)
+        const params = new URLSearchParams({
+            grant_type: 'fb_exchange_token',
+            client_id: this.appId,
+            client_secret: this.appSecret,
+            fb_exchange_token: refreshToken,
+        });
+        const res = await fetch(`${META_TOKEN_URL}?${params.toString()}`);
+        if (!res.ok) {
+            const body = await res.text();
+            throw new Error(`Instagram token refresh failed: ${res.status} ${body}`);
+        }
+        const data = await res.json();
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.access_token,
+            expiresAt: Date.now() + (data.expires_in ?? 5184000) * 1000,
+        };
+    }
+    /**
+     * Resolve the Instagram Business Account ID from the user's Facebook pages.
+     */
+    async resolveIgUserId(accessToken) {
+        try {
+            // Get user's pages
+            const pagesRes = await fetch(`${GRAPH_API}/me/accounts?fields=id,name,instagram_business_account&access_token=${accessToken}`);
+            if (!pagesRes.ok)
+                return undefined;
+            const pagesData = await pagesRes.json();
+            // Find first page with an Instagram business account
+            for (const page of pagesData.data) {
+                if (page.instagram_business_account?.id) {
+                    return page.instagram_business_account.id;
+                }
+            }
+            return undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+//# sourceMappingURL=InstagramOAuthFlow.js.map

package/dist/core/llm/auth/InstagramOAuthFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InstagramOAuthFlow.js","sourceRoot":"","sources":["../../../../src/core/llm/auth/InstagramOAuthFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,gBAAgB,EAAyD,MAAM,uBAAuB,CAAC;AAEhH,MAAM,aAAa,GAAG,6CAA6C,CAAC;AACpE,MAAM,cAAc,GAAG,qDAAqD,CAAC;AAC7E,MAAM,SAAS,GAAG,kCAAkC,CAAC;AAErD,MAAM,cAAc,GAAG;IACrB,iBAAiB;IACjB,2BAA2B;IAC3B,2BAA2B;IAC3B,2BAA2B;IAC3B,uBAAuB;IACvB,iBAAiB;CAClB,CAAC;AAWF,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IAMtD,YAAY,IAAgC;QAC1C,KAAK,CAAC,IAAI,CAAC,CAAC;QANL,eAAU,GAAG,WAAW,CAAC;QAOhC,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QACzF,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACzG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,cAAc,CAAC;QAE7C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,wDAAwD;kBACtD,sDAAsD;kBACtD,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,4DAA4D;kBAC1D,+DAA+D,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAES,SAAS;QACjB,OAAO;YACL,WAAW,EAAE,WAAW;YACxB,qBAAqB,EAAE,aAAa;YACpC,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,KAAK;YACpB,YAAY,EAAE,IAAI,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,IAAY,EACZ,WAAmB,EACnB,aAAqB;QAErB,gEAAgE;QAChE,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,YAAY,EAAE,WAAW;YACzB,IAAI;SACL,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAElE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAI1B,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;SACzD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACgB,KAAK,CAAC,YAAY,CAAC,MAAqB;QACzD,mCAAmC;QACnC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;YACnC,UAAU,EAAE,mBAAmB;YAC/B,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,iBAAiB,EAAE,MAAM,CAAC,WAAW;SACtC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,IAAI,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAI9B,CAAC;YACF,MAAM,GAAG;gBACP,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,2DAA2D;gBAC3D,+DAA+D;gBAC/D,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,IAAI,EAAE,WAAW;aAC3E,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,QAAQ,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACrD,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,YAAoB;QAChD,qEAAqE;QACrE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,UAAU,EAAE,mBAAmB;YAC/B,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,iBAAiB,EAAE,YAAY;SAChC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAI1B,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,IAAI;SAC5D,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe,CAAC,WAAmB;QAC/C,IAAI,CAAC;YACH,mBAAmB;YACnB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,SAAS,uEAAuE,WAAW,EAAE,CACjG,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YAEnC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAMpC,CAAC;YAEF,qDAAqD;YACrD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,0BAA0B,EAAE,EAAE,EAAE,CAAC;oBACxC,OAAO,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC;gBAC5C,CAAC;YACH,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/core/llm/auth/TwitterOAuthFlow.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @fileoverview Twitter/X OAuth 2.0 authorization code flow with PKCE.
+ *
+ * Uses Twitter API v2 OAuth 2.0 endpoints. PKCE is required (public client,
+ * no client secret needed). Supports offline.access scope for refresh tokens.
+ *
+ * @module agentos/core/llm/auth/TwitterOAuthFlow
+ */
+import type { OAuthTokenSet } from './types.js';
+import { BrowserOAuthFlow, type BrowserOAuthConfig, type BrowserOAuthFlowOptions } from './BrowserOAuthFlow.js';
+export interface TwitterOAuthFlowOptions extends BrowserOAuthFlowOptions {
+    /** Twitter OAuth 2.0 Client ID. Falls back to TWITTER_CLIENT_ID env var. */
+    clientId?: string;
+    /** Override scopes (default includes tweet.read/write, users.read, follows, offline.access). */
+    scopes?: string[];
+}
+export declare class TwitterOAuthFlow extends BrowserOAuthFlow {
+    readonly providerId = "twitter";
+    private readonly clientId;
+    private readonly scopes;
+    constructor(opts?: TwitterOAuthFlowOptions);
+    protected getConfig(): BrowserOAuthConfig;
+    protected exchangeCode(code: string, redirectUri: string, codeVerifier: string): Promise<OAuthTokenSet>;
+    protected refreshTokens(refreshToken: string): Promise<OAuthTokenSet>;
+}
+//# sourceMappingURL=TwitterOAuthFlow.d.ts.map

package/dist/core/llm/auth/TwitterOAuthFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwitterOAuthFlow.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/TwitterOAuthFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAoB,aAAa,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAchH,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACtE,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qBAAa,gBAAiB,SAAQ,gBAAgB;IACpD,QAAQ,CAAC,UAAU,aAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;gBAEtB,IAAI,CAAC,EAAE,uBAAuB;IAc1C,SAAS,CAAC,SAAS,IAAI,kBAAkB;cAUzB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,aAAa,CAAC;cAgCT,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CA4B5E"}

package/dist/core/llm/auth/TwitterOAuthFlow.js

@@ -0,0 +1,86 @@
+/**
+ * @fileoverview Twitter/X OAuth 2.0 authorization code flow with PKCE.
+ *
+ * Uses Twitter API v2 OAuth 2.0 endpoints. PKCE is required (public client,
+ * no client secret needed). Supports offline.access scope for refresh tokens.
+ *
+ * @module agentos/core/llm/auth/TwitterOAuthFlow
+ */
+import { BrowserOAuthFlow } from './BrowserOAuthFlow.js';
+const TWITTER_AUTH_URL = 'https://twitter.com/i/oauth2/authorize';
+const TWITTER_TOKEN_URL = 'https://api.twitter.com/2/oauth2/token';
+const DEFAULT_SCOPES = [
+    'tweet.read',
+    'tweet.write',
+    'users.read',
+    'follows.read',
+    'follows.write',
+    'offline.access',
+];
+export class TwitterOAuthFlow extends BrowserOAuthFlow {
+    constructor(opts) {
+        super(opts);
+        this.providerId = 'twitter';
+        this.clientId = opts?.clientId ?? process.env.TWITTER_CLIENT_ID ?? '';
+        this.scopes = opts?.scopes ?? DEFAULT_SCOPES;
+        if (!this.clientId) {
+            throw new Error('Twitter OAuth 2.0 Client ID is required. '
+                + 'Pass it via --client-id flag, set TWITTER_CLIENT_ID env var, '
+                + 'or create one at https://developer.x.com/en/portal/dashboard');
+        }
+    }
+    getConfig() {
+        return {
+            displayName: 'Twitter/X',
+            authorizationEndpoint: TWITTER_AUTH_URL,
+            tokenEndpoint: TWITTER_TOKEN_URL,
+            scopes: this.scopes,
+            clientId: this.clientId,
+        };
+    }
+    async exchangeCode(code, redirectUri, codeVerifier) {
+        const res = await fetch(TWITTER_TOKEN_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'authorization_code',
+                code,
+                redirect_uri: redirectUri,
+                client_id: this.clientId,
+                code_verifier: codeVerifier,
+            }).toString(),
+        });
+        if (!res.ok) {
+            const body = await res.text();
+            throw new Error(`Twitter token exchange failed: ${res.status} ${body}`);
+        }
+        const data = await res.json();
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresAt: Date.now() + (data.expires_in ?? 7200) * 1000,
+        };
+    }
+    async refreshTokens(refreshToken) {
+        const res = await fetch(TWITTER_TOKEN_URL, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'refresh_token',
+                refresh_token: refreshToken,
+                client_id: this.clientId,
+            }).toString(),
+        });
+        if (!res.ok) {
+            const body = await res.text();
+            throw new Error(`Twitter token refresh failed: ${res.status} ${body}`);
+        }
+        const data = await res.json();
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            expiresAt: Date.now() + (data.expires_in ?? 7200) * 1000,
+        };
+    }
+}
+//# sourceMappingURL=TwitterOAuthFlow.js.map

package/dist/core/llm/auth/TwitterOAuthFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwitterOAuthFlow.js","sourceRoot":"","sources":["../../../../src/core/llm/auth/TwitterOAuthFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,gBAAgB,EAAyD,MAAM,uBAAuB,CAAC;AAEhH,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;AAClE,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AAEnE,MAAM,cAAc,GAAG;IACrB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,cAAc;IACd,eAAe;IACf,gBAAgB;CACjB,CAAC;AASF,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB;IAKpD,YAAY,IAA8B;QACxC,KAAK,CAAC,IAAI,CAAC,CAAC;QALL,eAAU,GAAG,SAAS,CAAC;QAM9B,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,cAAc,CAAC;QAE7C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,2CAA2C;kBACzC,+DAA+D;kBAC/D,8DAA8D,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAES,SAAS;QACjB,OAAO;YACL,WAAW,EAAE,WAAW;YACxB,qBAAqB,EAAE,gBAAgB;YACvC,aAAa,EAAE,iBAAiB;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,YAAY,CAC1B,IAAY,EACZ,WAAmB,EACnB,YAAoB;QAEpB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,SAAS,EAAE,IAAI,CAAC,QAAQ;gBACxB,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAK1B,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;SACzD,CAAC;IACJ,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,YAAoB;QAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iBAAiB,EAAE;YACzC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAI1B,CAAC;QAEF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI;SACzD,CAAC;IACJ,CAAC;CACF"}

package/dist/core/llm/auth/callback-server.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @fileoverview Ephemeral localhost HTTP server for OAuth 2.0 authorization code callbacks.
+ *
+ * Listens on an OS-assigned port, waits for a single GET /callback with
+ * code + state query params, validates the state, and resolves.
+ *
+ * @module agentos/core/llm/auth/callback-server
+ */
+export interface CallbackResult {
+    code: string;
+    state: string;
+}
+export interface CallbackServerOptions {
+    /** Expected state value for CSRF validation. */
+    expectedState: string;
+    /** Maximum time (ms) to wait for the callback before timing out. */
+    timeoutMs: number;
+    /** Called once the server is listening, with the assigned port. */
+    onListening?: (port: number) => void;
+}
+/**
+ * Start an ephemeral localhost HTTP server to receive the OAuth callback.
+ *
+ * @returns An object with:
+ *  - `promise` — resolves with `{ code, state }` on success, rejects on timeout/error
+ *  - `shutdown()` — forcibly close the server
+ */
+export declare function startCallbackServer(opts: CallbackServerOptions): {
+    promise: Promise<CallbackResult>;
+    shutdown: () => void;
+};
+//# sourceMappingURL=callback-server.d.ts.map

package/dist/core/llm/auth/callback-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-server.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,gDAAgD;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC;AAkCD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,qBAAqB,GAAG;IAChE,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB,CAsEA"}

package/dist/core/llm/auth/callback-server.js

@@ -0,0 +1,111 @@
+/**
+ * @fileoverview Ephemeral localhost HTTP server for OAuth 2.0 authorization code callbacks.
+ *
+ * Listens on an OS-assigned port, waits for a single GET /callback with
+ * code + state query params, validates the state, and resolves.
+ *
+ * @module agentos/core/llm/auth/callback-server
+ */
+import { createServer } from 'node:http';
+import { URL } from 'node:url';
+const SUCCESS_HTML = `<!DOCTYPE html>
+<html><head><title>Authorization Complete</title>
+<style>
+  body { font-family: -apple-system, BlinkMacSystemFont, sans-serif; display: flex;
+    justify-content: center; align-items: center; height: 100vh; margin: 0;
+    background: #0a0a0a; color: #e0e0e0; }
+  .card { text-align: center; padding: 3rem; border-radius: 12px;
+    background: #1a1a1a; border: 1px solid #333; }
+  h1 { color: #4ade80; margin-bottom: 0.5rem; }
+  p { color: #888; }
+</style></head>
+<body><div class="card">
+  <h1>Authorized</h1>
+  <p>You can close this tab and return to the terminal.</p>
+</div></body></html>`;
+const ERROR_HTML = (msg) => `<!DOCTYPE html>
+<html><head><title>Authorization Failed</title>
+<style>
+  body { font-family: -apple-system, BlinkMacSystemFont, sans-serif; display: flex;
+    justify-content: center; align-items: center; height: 100vh; margin: 0;
+    background: #0a0a0a; color: #e0e0e0; }
+  .card { text-align: center; padding: 3rem; border-radius: 12px;
+    background: #1a1a1a; border: 1px solid #333; }
+  h1 { color: #f87171; margin-bottom: 0.5rem; }
+  p { color: #888; }
+</style></head>
+<body><div class="card">
+  <h1>Authorization Failed</h1>
+  <p>${msg}</p>
+</div></body></html>`;
+/**
+ * Start an ephemeral localhost HTTP server to receive the OAuth callback.
+ *
+ * @returns An object with:
+ *  - `promise` — resolves with `{ code, state }` on success, rejects on timeout/error
+ *  - `shutdown()` — forcibly close the server
+ */
+export function startCallbackServer(opts) {
+    let server;
+    let timer;
+    const promise = new Promise((resolve, reject) => {
+        server = createServer((req, res) => {
+            if (!req.url || !req.url.startsWith('/callback')) {
+                res.writeHead(404, { 'Content-Type': 'text/plain' });
+                res.end('Not found');
+                return;
+            }
+            const url = new URL(req.url, `http://localhost`);
+            const code = url.searchParams.get('code');
+            const state = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            const errorDescription = url.searchParams.get('error_description');
+            if (error) {
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end(ERROR_HTML(errorDescription || error));
+                cleanup();
+                reject(new Error(`OAuth error: ${errorDescription || error}`));
+                return;
+            }
+            if (!code || !state) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(ERROR_HTML('Missing code or state parameter.'));
+                return;
+            }
+            if (state !== opts.expectedState) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(ERROR_HTML('State mismatch — possible CSRF attack.'));
+                return;
+            }
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(SUCCESS_HTML);
+            cleanup();
+            resolve({ code, state });
+        });
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            const port = typeof addr === 'object' && addr ? addr.port : 0;
+            opts.onListening?.(port);
+        });
+        server.on('error', (err) => {
+            cleanup();
+            reject(err);
+        });
+        timer = setTimeout(() => {
+            cleanup();
+            reject(new Error(`OAuth callback timed out after ${Math.round(opts.timeoutMs / 1000)}s. Please try again.`));
+        }, opts.timeoutMs);
+    });
+    function cleanup() {
+        clearTimeout(timer);
+        try {
+            server?.close();
+        }
+        catch { /* ignore */ }
+    }
+    return {
+        promise,
+        shutdown: cleanup,
+    };
+}
+//# sourceMappingURL=callback-server.js.map

package/dist/core/llm/auth/callback-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callback-server.js","sourceRoot":"","sources":["../../../../src/core/llm/auth/callback-server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAgB/B,MAAM,YAAY,GAAG;;;;;;;;;;;;;;qBAcA,CAAC;AAEtB,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC;;;;;;;;;;;;;OAa7B,GAAG;qBACW,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA2B;IAI7D,IAAI,MAAc,CAAC;IACnB,IAAI,KAAoC,CAAC;IAEzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9D,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAEnE,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC,CAAC;gBAC/C,OAAO,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,gBAAgB,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YAED,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,wCAAwC,CAAC,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACtB,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/G,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,OAAO;QACd,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,CAAC;YAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC;IAED,OAAO;QACL,OAAO;QACP,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC"}

package/dist/core/llm/auth/index.d.ts

@@ -6,4 +6,14 @@ export type { AuthMethod, OAuthTokenSet, OAuthProviderConfig, IOAuthTokenStore,
 export { FileTokenStore } from './FileTokenStore.js';
 export { OpenAIOAuthFlow } from './OpenAIOAuthFlow.js';
 export type { OpenAIOAuthFlowOptions } from './OpenAIOAuthFlow.js';
+export { BrowserOAuthFlow } from './BrowserOAuthFlow.js';
+export type { BrowserOAuthConfig, BrowserOAuthFlowOptions } from './BrowserOAuthFlow.js';
+export { TwitterOAuthFlow } from './TwitterOAuthFlow.js';
+export type { TwitterOAuthFlowOptions } from './TwitterOAuthFlow.js';
+export { InstagramOAuthFlow } from './InstagramOAuthFlow.js';
+export type { InstagramOAuthFlowOptions } from './InstagramOAuthFlow.js';
+export { isTokenValid, openBrowser } from './utils.js';
+export { startCallbackServer } from './callback-server.js';
+export type { CallbackResult, CallbackServerOptions } from './callback-server.js';
+export { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/llm/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,YAAY,EACV,UAAU,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,YAAY,EACV,UAAU,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAGnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAGzE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/core/llm/auth/index.js

@@ -4,4 +4,12 @@
  */
 export { FileTokenStore } from './FileTokenStore.js';
 export { OpenAIOAuthFlow } from './OpenAIOAuthFlow.js';
+// Browser-based OAuth 2.0 flows
+export { BrowserOAuthFlow } from './BrowserOAuthFlow.js';
+export { TwitterOAuthFlow } from './TwitterOAuthFlow.js';
+export { InstagramOAuthFlow } from './InstagramOAuthFlow.js';
+// Utilities
+export { isTokenValid, openBrowser } from './utils.js';
+export { startCallbackServer } from './callback-server.js';
+export { generateCodeVerifier, generateCodeChallenge, generateState } from './pkce.js';
 //# sourceMappingURL=index.js.map

package/dist/core/llm/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/llm/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/llm/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,gCAAgC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAG7D,YAAY;AACZ,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/core/llm/auth/pkce.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @fileoverview PKCE (Proof Key for Code Exchange) utilities for OAuth 2.0.
+ * @module agentos/core/llm/auth/pkce
+ */
+/**
+ * Generate a cryptographically random code verifier for PKCE.
+ * @param length Number of random bytes (output will be base64url-encoded, up to 128 chars).
+ */
+export declare function generateCodeVerifier(length?: number): string;
+/**
+ * Derive a S256 code challenge from a code verifier.
+ */
+export declare function generateCodeChallenge(verifier: string): string;
+/**
+ * Generate a random state parameter for CSRF protection.
+ */
+export declare function generateState(): string;
+//# sourceMappingURL=pkce.d.ts.map

package/dist/core/llm/auth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/pkce.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,SAAK,GAAG,MAAM,CAExD;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC"}

package/dist/core/llm/auth/pkce.js

@@ -0,0 +1,25 @@
+/**
+ * @fileoverview PKCE (Proof Key for Code Exchange) utilities for OAuth 2.0.
+ * @module agentos/core/llm/auth/pkce
+ */
+import { randomBytes, createHash } from 'node:crypto';
+/**
+ * Generate a cryptographically random code verifier for PKCE.
+ * @param length Number of random bytes (output will be base64url-encoded, up to 128 chars).
+ */
+export function generateCodeVerifier(length = 64) {
+    return randomBytes(length).toString('base64url').slice(0, 128);
+}
+/**
+ * Derive a S256 code challenge from a code verifier.
+ */
+export function generateCodeChallenge(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+/**
+ * Generate a random state parameter for CSRF protection.
+ */
+export function generateState() {
+    return randomBytes(32).toString('hex');
+}
+//# sourceMappingURL=pkce.js.map

package/dist/core/llm/auth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../../../src/core/llm/auth/pkce.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAM,GAAG,EAAE;IAC9C,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC"}

package/dist/core/llm/auth/types.d.ts

@@ -10,6 +10,8 @@ export interface OAuthTokenSet {
     refreshToken?: string;
     /** Unix epoch milliseconds when the access token expires. */
     expiresAt: number;
+    /** Provider-specific metadata (e.g., igUserId for Instagram). */
+    metadata?: Record<string, string>;
 }
 /** Provider-specific OAuth configuration. */
 export interface OAuthProviderConfig {

package/dist/core/llm/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAE7C,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,iEAAiE;IACjE,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvC,sEAAsE;IACtE,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvD,sEAAsE;IACtE,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;IAExC;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAE7C,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+DAA+D;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,2CAA2C;AAC3C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,iEAAiE;IACjE,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvC,sEAAsE;IACtE,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAEvD,sEAAsE;IACtE,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;IAExC;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACnC"}

package/dist/core/llm/auth/utils.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @fileoverview Shared OAuth utilities.
+ * @module agentos/core/llm/auth/utils
+ */
+import type { OAuthTokenSet } from './types.js';
+/**
+ * Check whether an OAuth token set is still valid (not expired, with buffer).
+ * Provider-agnostic — works with any OAuthTokenSet.
+ */
+export declare function isTokenValid(tokens: OAuthTokenSet, bufferMs?: number): boolean;
+/**
+ * Attempt to open a URL in the user's default browser.
+ * Returns true if the command was launched, false on failure (e.g., headless environment).
+ */
+export declare function openBrowser(url: string): Promise<boolean>;
+//# sourceMappingURL=utils.d.ts.map

package/dist/core/llm/auth/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../../src/core/llm/auth/utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,SAA4B,GAAG,OAAO,CAEjG;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBzD"}

package/dist/core/llm/auth/utils.js

@@ -0,0 +1,38 @@
+/**
+ * @fileoverview Shared OAuth utilities.
+ * @module agentos/core/llm/auth/utils
+ */
+import { exec } from 'node:child_process';
+import { platform } from 'node:os';
+/** Default buffer in ms before expiry to consider token invalid (5 minutes). */
+const DEFAULT_REFRESH_BUFFER_MS = 5 * 60 * 1000;
+/**
+ * Check whether an OAuth token set is still valid (not expired, with buffer).
+ * Provider-agnostic — works with any OAuthTokenSet.
+ */
+export function isTokenValid(tokens, bufferMs = DEFAULT_REFRESH_BUFFER_MS) {
+    return Date.now() < tokens.expiresAt - bufferMs;
+}
+/**
+ * Attempt to open a URL in the user's default browser.
+ * Returns true if the command was launched, false on failure (e.g., headless environment).
+ */
+export function openBrowser(url) {
+    return new Promise((resolve) => {
+        const os = platform();
+        let cmd;
+        if (os === 'darwin') {
+            cmd = `open "${url}"`;
+        }
+        else if (os === 'win32') {
+            cmd = `start "" "${url}"`;
+        }
+        else {
+            cmd = `xdg-open "${url}"`;
+        }
+        exec(cmd, { timeout: 5000 }, (err) => {
+            resolve(!err);
+        });
+    });
+}
+//# sourceMappingURL=utils.js.map

package/dist/core/llm/auth/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../../src/core/llm/auth/utils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,gFAAgF;AAChF,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAqB,EAAE,QAAQ,GAAG,yBAAyB;IACtF,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;QACtB,IAAI,GAAW,CAAC;QAEhB,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,GAAG,GAAG,SAAS,GAAG,GAAG,CAAC;QACxB,CAAC;aAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YAC1B,GAAG,GAAG,aAAa,GAAG,GAAG,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,aAAa,GAAG,GAAG,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YACnC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@framers/agentos",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Modular AgentOS orchestration library",
   "type": "module",
   "main": "dist/index.js",