@lobu/gateway 2.8.0

package/dist/routes/public/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/routes/public/oauth.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAiEH,8CA6EC;AA5ID,mDAAgE;AAEhE,mDAA+D;AAE/D,MAAM,GAAG,GAAG,MAAM,CAAC;AACnB,MAAM,eAAe,GAAG,eAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,eAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAC3D,MAAM,aAAa,GAAG,eAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,eAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAmBtD,MAAM,iBAAiB,GAAG,IAAA,yBAAW,EAAC;IACpC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,CAAC,GAAG,CAAC;IACX,OAAO,EAAE,+BAA+B;IACxC,OAAO,EAAE;QACP,KAAK,EAAE,eAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,eAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACjD,MAAM,EAAE,eAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,EAAE;YACJ,OAAO,EAAE;gBACP,kBAAkB,EAAE;oBAClB,MAAM,EAAE,eAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,eAAC,CAAC,MAAM,EAAE,EAAE,CAAC;iBACvC;aACF;SACF;KACF;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,WAAW;YACxB,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE;SAC7D;QACD,GAAG,EAAE;YACH,WAAW,EAAE,SAAS;YACtB,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;SAC3D;QACD,GAAG,EAAE;YACH,WAAW,EAAE,cAAc;YAC3B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;SAC3D;KACF;CACF,CAAC,CAAC;AAQH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,GAAG,GAAG,IAAI,yBAAW,EAAE,CAAC;IAE9B,uDAAuD;IACvD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;;QACtC,MAAM,OAAO,GAAG,IAAA,4CAA4B,EAAC,CAAC,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,KAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAE3D,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC;QAE/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,kFAAkF;YAClF,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACzE,OAAO,CAAC,CAAC,QAAQ,CACf,kCAAkC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAA,MAAM,CAAC,YAAY,0CAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,eAAe;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAElD,MAAM,YAAY,GAAG,WAAW,CAAC,oBAAoB,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC;YAChD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO;YACP,YAAY;YACZ,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE;SAC5D,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,iCAAiC;IACjC,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAgB,EAAE;;QACvD,MAAM,OAAO,GAAG,IAAA,4CAA4B,EAAC,CAAC,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC;QACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAExE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,MAAA,MAAM,CAAC,YAAY,0CAAG,QAAQ,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,MAAA,MAAM,CAAC,cAAc,0CAAG,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,eAAe;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAElD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,oBAAoB,CACxD,QAAQ,EACR,SAAS,CAAC,YAAY,EACtB,mDAAmD,EACnD,KAAK,CACN,CAAC;YACF,MAAM,eAAe,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAC7D,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/public/settings-auth.d.ts

@@ -0,0 +1,28 @@
+import type { Context } from "hono";
+import type { SettingsTokenPayload } from "../../auth/settings/token-service";
+export type AuthProvider = (c: Context) => SettingsTokenPayload | null;
+export declare const SETTINGS_SESSION_COOKIE_NAME = "lobu_settings_session";
+/**
+ * Set a custom auth provider for embedded mode.
+ * When set, verifySettingsSession delegates to this provider first,
+ * falling back to cookie auth only if it returns null.
+ */
+export declare function setAuthProvider(provider: AuthProvider | null): void;
+/**
+ * Verify settings session.
+ * Checks injected auth provider first (for embedded mode),
+ * then falls back to cookie-based session auth.
+ */
+export declare function verifySettingsSession(c: Context): SettingsTokenPayload | null;
+export declare function verifySettingsToken(token: string | null | undefined): SettingsTokenPayload | null;
+/**
+ * Resolve settings auth from an injected auth provider, cookie session,
+ * or a direct encrypted query token.
+ */
+export declare function verifySettingsSessionOrToken(c: Context, queryKey?: string): SettingsTokenPayload | null;
+/**
+ * Set a settings session cookie from a SettingsTokenPayload.
+ */
+export declare function setSettingsSessionCookie(c: Context, session: SettingsTokenPayload): void;
+export declare function clearSettingsSessionCookie(c: Context): void;
+//# sourceMappingURL=settings-auth.d.ts.map

package/dist/routes/public/settings-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-auth.d.ts","sourceRoot":"","sources":["../../../src/routes/public/settings-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,EAAE,OAAO,KAAK,oBAAoB,GAAG,IAAI,CAAC;AAEvE,eAAO,MAAM,4BAA4B,0BAA0B,CAAC;AAIpE;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAEnE;AA4BD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,OAAO,GAAG,oBAAoB,GAAG,IAAI,CAQ7E;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,oBAAoB,GAAG,IAAI,CAG7B;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,CAAC,EAAE,OAAO,EACV,QAAQ,SAAU,GACjB,oBAAoB,GAAG,IAAI,CAE7B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,OAAO,EACV,OAAO,EAAE,oBAAoB,GAC5B,IAAI,CAcN;AAED,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAE3D"}

package/dist/routes/public/settings-auth.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SETTINGS_SESSION_COOKIE_NAME = void 0;
+exports.setAuthProvider = setAuthProvider;
+exports.verifySettingsSession = verifySettingsSession;
+exports.verifySettingsToken = verifySettingsToken;
+exports.verifySettingsSessionOrToken = verifySettingsSessionOrToken;
+exports.setSettingsSessionCookie = setSettingsSessionCookie;
+exports.clearSettingsSessionCookie = clearSettingsSessionCookie;
+const core_1 = require("@lobu/core");
+const cookie_1 = require("hono/cookie");
+exports.SETTINGS_SESSION_COOKIE_NAME = "lobu_settings_session";
+let _authProvider = null;
+/**
+ * Set a custom auth provider for embedded mode.
+ * When set, verifySettingsSession delegates to this provider first,
+ * falling back to cookie auth only if it returns null.
+ */
+function setAuthProvider(provider) {
+    _authProvider = provider;
+}
+function decodeSettingsPayload(token) {
+    if (!token || token.trim().length === 0)
+        return null;
+    try {
+        const decrypted = (0, core_1.decrypt)(token);
+        const payload = JSON.parse(decrypted);
+        if (!payload.userId || !payload.exp)
+            return null;
+        if (Date.now() > payload.exp)
+            return null;
+        return payload;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+function isSecureRequest(c) {
+    var _a;
+    const forwardedProto = c.req.header("x-forwarded-proto");
+    if (forwardedProto) {
+        return ((_a = forwardedProto.split(",")[0]) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase()) === "https";
+    }
+    return new URL(c.req.url).protocol === "https:";
+}
+/**
+ * Verify settings session.
+ * Checks injected auth provider first (for embedded mode),
+ * then falls back to cookie-based session auth.
+ */
+function verifySettingsSession(c) {
+    if (_authProvider) {
+        const result = _authProvider(c);
+        if (result)
+            return result;
+    }
+    const token = (0, cookie_1.getCookie)(c, exports.SETTINGS_SESSION_COOKIE_NAME);
+    return decodeSettingsPayload(token);
+}
+function verifySettingsToken(token) {
+    if (!token)
+        return null;
+    return decodeSettingsPayload(token);
+}
+/**
+ * Resolve settings auth from an injected auth provider, cookie session,
+ * or a direct encrypted query token.
+ */
+function verifySettingsSessionOrToken(c, queryKey = "token") {
+    var _a;
+    return (_a = verifySettingsSession(c)) !== null && _a !== void 0 ? _a : verifySettingsToken(c.req.query(queryKey));
+}
+/**
+ * Set a settings session cookie from a SettingsTokenPayload.
+ */
+function setSettingsSessionCookie(c, session) {
+    const token = (0, core_1.encrypt)(JSON.stringify(session));
+    const maxAgeSeconds = Math.max(1, Math.floor((session.exp - Date.now()) / 1000));
+    (0, cookie_1.setCookie)(c, exports.SETTINGS_SESSION_COOKIE_NAME, token, {
+        path: "/",
+        httpOnly: true,
+        sameSite: "Lax",
+        secure: isSecureRequest(c),
+        maxAge: maxAgeSeconds,
+    });
+}
+function clearSettingsSessionCookie(c) {
+    (0, cookie_1.deleteCookie)(c, exports.SETTINGS_SESSION_COOKIE_NAME, { path: "/" });
+}
+//# sourceMappingURL=settings-auth.js.map

package/dist/routes/public/settings-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-auth.js","sourceRoot":"","sources":["../../../src/routes/public/settings-auth.ts"],"names":[],"mappings":";;;AAgBA,0CAEC;AAiCD,sDAQC;AAED,kDAKC;AAMD,oEAKC;AAKD,4DAiBC;AAED,gEAEC;AAvGD,qCAA8C;AAE9C,wCAAiE;AAKpD,QAAA,4BAA4B,GAAG,uBAAuB,CAAC;AAEpE,IAAI,aAAa,GAAwB,IAAI,CAAC;AAE9C;;;;GAIG;AACH,SAAgB,eAAe,CAAC,QAA6B;IAC3D,aAAa,GAAG,QAAQ,CAAC;AAC3B,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAgC;IAEhC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAA,cAAO,EAAC,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAyB,CAAC;QAE9D,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAE1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;;IACjC,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzD,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,CAAA,MAAA,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,OAAO,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,CAAU;IAC9C,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,CAAC,EAAE,oCAA4B,CAAC,CAAC;IACzD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,SAAgB,mBAAmB,CACjC,KAAgC;IAEhC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAgB,4BAA4B,CAC1C,CAAU,EACV,QAAQ,GAAG,OAAO;;IAElB,OAAO,MAAA,qBAAqB,CAAC,CAAC,CAAC,mCAAI,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CACtC,CAAU,EACV,OAA6B;IAE7B,MAAM,KAAK,GAAG,IAAA,cAAO,EAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,CAAC,EACD,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAC9C,CAAC;IAEF,IAAA,kBAAS,EAAC,CAAC,EAAE,oCAA4B,EAAE,KAAK,EAAE;QAChD,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;QAC1B,MAAM,EAAE,aAAa;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,0BAA0B,CAAC,CAAU;IACnD,IAAA,qBAAY,EAAC,CAAC,EAAE,oCAA4B,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AAC/D,CAAC"}

package/dist/routes/public/slack.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from "hono";
+import type { ChatInstanceManager } from "../../connections/chat-instance-manager";
+export declare function createSlackRoutes(manager: ChatInstanceManager): Hono;
+//# sourceMappingURL=slack.d.ts.map

package/dist/routes/public/slack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/routes/public/slack.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAoEnF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAgGpE"}

package/dist/routes/public/slack.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSlackRoutes = createSlackRoutes;
+const promises_1 = require("node:fs/promises");
+const core_1 = require("@lobu/core");
+const hono_1 = require("hono");
+const state_store_1 = require("../../auth/oauth/state-store");
+const oauth_templates_1 = require("../../auth/oauth-templates");
+const public_url_1 = require("../../utils/public-url");
+const logger = (0, core_1.createLogger)("slack-routes");
+const DEFAULT_SLACK_BOT_SCOPES = [
+    "app_mentions:read",
+    "assistant:write",
+    "channels:history",
+    "channels:read",
+    "chat:write",
+    "chat:write.public",
+    "commands",
+    "files:read",
+    "files:write",
+    "groups:history",
+    "groups:read",
+    "im:history",
+    "im:read",
+    "im:write",
+    "mpim:read",
+    "reactions:read",
+    "reactions:write",
+    "users:read",
+];
+function splitScopes(scopes) {
+    return scopes
+        .split(",")
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+}
+async function loadSlackBotScopes() {
+    var _a, _b;
+    const envScopes = process.env.SLACK_OAUTH_SCOPES || process.env.SLACK_BOT_SCOPES;
+    if (envScopes) {
+        return splitScopes(envScopes);
+    }
+    const manifestPath = process.env.SLACK_MANIFEST_PATH ||
+        "config/slack-app-manifest.community.json";
+    try {
+        const raw = await (0, promises_1.readFile)(manifestPath, "utf8");
+        const manifest = JSON.parse(raw);
+        const scopes = (_b = (_a = manifest.oauth_config) === null || _a === void 0 ? void 0 : _a.scopes) === null || _b === void 0 ? void 0 : _b.bot;
+        if (Array.isArray(scopes) && scopes.length > 0) {
+            return scopes;
+        }
+    }
+    catch (error) {
+        logger.warn({ manifestPath, error: String(error) }, "Failed to load Slack scopes from manifest, using defaults");
+    }
+    return DEFAULT_SLACK_BOT_SCOPES;
+}
+function createSlackRoutes(manager) {
+    const router = new hono_1.Hono();
+    router.get("/slack/install", async (c) => {
+        var _a, _b;
+        const clientId = process.env.SLACK_CLIENT_ID;
+        if (!clientId) {
+            return c.html((0, oauth_templates_1.renderOAuthErrorPage)("slack_not_configured", "Slack OAuth is not configured on this gateway. Set SLACK_CLIENT_ID and try again."), 503);
+        }
+        const redis = manager.getServices().getQueue().getRedisClient();
+        const stateStore = (0, state_store_1.createSlackInstallStateStore)(redis);
+        const redirectUri = (0, public_url_1.resolvePublicUrl)("/slack/oauth_callback", {
+            configuredUrl: (_b = (_a = manager.getServices()).getPublicGatewayUrl) === null || _b === void 0 ? void 0 : _b.call(_a),
+            requestUrl: c.req.url,
+        });
+        const scopes = await loadSlackBotScopes();
+        const state = await stateStore.create({ redirectUri });
+        const oauthUrl = new URL("https://slack.com/oauth/v2/authorize");
+        oauthUrl.searchParams.set("client_id", clientId);
+        oauthUrl.searchParams.set("scope", scopes.join(","));
+        oauthUrl.searchParams.set("redirect_uri", redirectUri);
+        oauthUrl.searchParams.set("state", state);
+        return c.redirect(oauthUrl.toString(), 302);
+    });
+    router.get("/slack/oauth_callback", async (c) => {
+        const state = c.req.query("state");
+        const code = c.req.query("code");
+        if (!state || !code) {
+            return c.html((0, oauth_templates_1.renderOAuthErrorPage)("invalid_request", "The Slack OAuth callback is missing the required state or code parameter."), 400);
+        }
+        const redis = manager.getServices().getQueue().getRedisClient();
+        const stateStore = (0, state_store_1.createSlackInstallStateStore)(redis);
+        const oauthState = await stateStore.consume(state);
+        if (!oauthState) {
+            return c.html((0, oauth_templates_1.renderOAuthErrorPage)("invalid_state", "This Slack install link is invalid or has expired."), 400);
+        }
+        try {
+            const result = await manager.completeSlackOAuthInstall(c.req.raw, oauthState.redirectUri);
+            return c.html((0, oauth_templates_1.renderOAuthSuccessPage)(result.teamName || result.teamId, undefined, {
+                title: "Slack installed",
+                description: "Workspace connected to Lobu:",
+                details: `Connection ID: ${result.connectionId}`,
+            }));
+        }
+        catch (error) {
+            logger.error({ error: String(error) }, "Slack OAuth callback failed");
+            return c.html((0, oauth_templates_1.renderOAuthErrorPage)("slack_install_failed", error instanceof Error
+                ? error.message
+                : "Slack OAuth callback failed."), 500);
+        }
+    });
+    router.post("/slack/events", async (c) => {
+        try {
+            return await manager.handleSlackAppWebhook(c.req.raw);
+        }
+        catch (error) {
+            logger.error({ error: String(error) }, "Slack event handling failed");
+            return c.text("Slack webhook processing failed", 500);
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=slack.js.map

package/dist/routes/public/slack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.js","sourceRoot":"","sources":["../../../src/routes/public/slack.ts"],"names":[],"mappings":";;AA4EA,8CAgGC;AA5KD,+CAA4C;AAC5C,qCAA0C;AAC1C,+BAA4B;AAC5B,8DAA4E;AAC5E,gEAGoC;AAEpC,uDAA0D;AAE1D,MAAM,MAAM,GAAG,IAAA,mBAAY,EAAC,cAAc,CAAC,CAAC;AAE5C,MAAM,wBAAwB,GAAG;IAC/B,mBAAmB;IACnB,iBAAiB;IACjB,kBAAkB;IAClB,eAAe;IACf,YAAY;IACZ,mBAAmB;IACnB,UAAU;IACV,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,SAAS;IACT,UAAU;IACV,WAAW;IACX,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;CACb,CAAC;AASF,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,kBAAkB;;IAC/B,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,YAAY,GAChB,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAC/B,0CAA0C,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;QAClD,MAAM,MAAM,GAAG,MAAA,MAAA,QAAQ,CAAC,YAAY,0CAAE,MAAM,0CAAE,GAAG,CAAC;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EACtC,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO,wBAAwB,CAAC;AAClC,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAA4B;IAC5D,MAAM,MAAM,GAAG,IAAI,WAAI,EAAE,CAAC;IAE1B,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CACX,IAAA,sCAAoB,EAClB,sBAAsB,EACtB,mFAAmF,CACpF,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC;QAChE,MAAM,UAAU,GAAG,IAAA,0CAA4B,EAAC,KAAK,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,IAAA,6BAAgB,EAAC,uBAAuB,EAAE;YAC5D,aAAa,EAAE,MAAA,MAAA,OAAO,CAAC,WAAW,EAAE,EAAC,mBAAmB,kDAAI;YAC5D,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG;SACtB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACjE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACvD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE1C,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CACX,IAAA,sCAAoB,EAClB,iBAAiB,EACjB,2EAA2E,CAC5E,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,cAAc,EAAE,CAAC;QAChE,MAAM,UAAU,GAAG,IAAA,0CAA4B,EAAC,KAAK,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,CAAC,IAAI,CACX,IAAA,sCAAoB,EAClB,eAAe,EACf,oDAAoD,CACrD,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,yBAAyB,CACpD,CAAC,CAAC,GAAG,CAAC,GAAG,EACT,UAAU,CAAC,WAAW,CACvB,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CACX,IAAA,wCAAsB,EAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE;gBAClE,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,8BAA8B;gBAC3C,OAAO,EAAE,kBAAkB,MAAM,CAAC,YAAY,EAAE;aACjD,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACtE,OAAO,CAAC,CAAC,IAAI,CACX,IAAA,sCAAoB,EAClB,sBAAsB,EACtB,KAAK,YAAY,KAAK;gBACpB,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,8BAA8B,CACnC,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACtE,OAAO,CAAC,CAAC,IAAI,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/routes/shared/agent-ownership.d.ts

@@ -0,0 +1,15 @@
+import type { AgentConfigStore } from "@lobu/core";
+import type { SettingsTokenPayload } from "../../auth/settings/token-service";
+import type { UserAgentsStore } from "../../auth/user-agents-store";
+export interface AgentOwnershipConfig {
+    userAgentsStore?: UserAgentsStore;
+    agentMetadataStore?: Pick<AgentConfigStore, "getMetadata">;
+}
+export interface AgentOwnershipResult {
+    authorized: boolean;
+    ownerPlatform?: string;
+    ownerUserId?: string;
+}
+export declare function resolveSettingsLookupUserId(session: SettingsTokenPayload): string;
+export declare function verifyOwnedAgentAccess(session: SettingsTokenPayload, agentId: string, config: AgentOwnershipConfig): Promise<AgentOwnershipResult>;
+//# sourceMappingURL=agent-ownership.d.ts.map

package/dist/routes/shared/agent-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-ownership.d.ts","sourceRoot":"","sources":["../../../src/routes/shared/agent-ownership.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,MAAM,WAAW,oBAAoB;IACnC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kBAAkB,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CASR;AAeD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAsD/B"}

package/dist/routes/shared/agent-ownership.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSettingsLookupUserId = resolveSettingsLookupUserId;
+exports.verifyOwnedAgentAccess = verifyOwnedAgentAccess;
+const platform_auth_methods_1 = require("../../connections/platform-auth-methods");
+function resolveSettingsLookupUserId(session) {
+    if (session.platform === "external") {
+        return session.oauthUserId || session.userId;
+    }
+    const isDeterministic = (0, platform_auth_methods_1.getAuthMethod)(session.platform).type !== "oauth";
+    return isDeterministic
+        ? session.userId
+        : session.oauthUserId || session.userId;
+}
+function sessionMatchesMetadataOwner(session, ownerPlatform, ownerUserId) {
+    const lookupUserId = resolveSettingsLookupUserId(session);
+    if (!lookupUserId || ownerUserId !== lookupUserId) {
+        return false;
+    }
+    return ownerPlatform === session.platform || session.platform === "external";
+}
+async function verifyOwnedAgentAccess(session, agentId, config) {
+    if (session.isAdmin) {
+        return { authorized: true };
+    }
+    if (session.agentId) {
+        return { authorized: session.agentId === agentId };
+    }
+    const lookupUserId = resolveSettingsLookupUserId(session);
+    if (config.userAgentsStore) {
+        const owns = await config.userAgentsStore.ownsAgent(session.platform, lookupUserId, agentId);
+        if (owns) {
+            return {
+                authorized: true,
+                ownerPlatform: session.platform,
+                ownerUserId: lookupUserId,
+            };
+        }
+    }
+    if (!config.agentMetadataStore) {
+        return { authorized: false };
+    }
+    const metadata = await config.agentMetadataStore.getMetadata(agentId);
+    if (!(metadata === null || metadata === void 0 ? void 0 : metadata.owner) ||
+        !sessionMatchesMetadataOwner(session, metadata.owner.platform, metadata.owner.userId)) {
+        return { authorized: false };
+    }
+    if (config.userAgentsStore) {
+        config.userAgentsStore
+            .addAgent(session.platform, lookupUserId, agentId)
+            .catch(() => {
+            /* best-effort reconciliation */
+        });
+    }
+    return {
+        authorized: true,
+        ownerPlatform: metadata.owner.platform,
+        ownerUserId: metadata.owner.userId,
+    };
+}
+//# sourceMappingURL=agent-ownership.js.map

package/dist/routes/shared/agent-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-ownership.js","sourceRoot":"","sources":["../../../src/routes/shared/agent-ownership.ts"],"names":[],"mappings":";;AAgBA,kEAWC;AAeD,wDA0DC;AAjGD,mFAAwE;AAaxE,SAAgB,2BAA2B,CACzC,OAA6B;IAE7B,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAC/C,CAAC;IAED,MAAM,eAAe,GAAG,IAAA,qCAAa,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;IACzE,OAAO,eAAe;QACpB,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED,SAAS,2BAA2B,CAClC,OAA6B,EAC7B,aAAqB,EACrB,WAAmB;IAEnB,MAAM,YAAY,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,CAAC,YAAY,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,aAAa,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC/E,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,OAA6B,EAC7B,OAAe,EACf,MAA4B;IAE5B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,YAAY,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,SAAS,CACjD,OAAO,CAAC,QAAQ,EAChB,YAAY,EACZ,OAAO,CACR,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,OAAO,CAAC,QAAQ;gBAC/B,WAAW,EAAE,YAAY;aAC1B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACtE,IACE,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,CAAA;QAChB,CAAC,2BAA2B,CAC1B,OAAO,EACP,QAAQ,CAAC,KAAK,CAAC,QAAQ,EACvB,QAAQ,CAAC,KAAK,CAAC,MAAM,CACtB,EACD,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,MAAM,CAAC,eAAe;aACnB,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC;aACjD,KAAK,CAAC,GAAG,EAAE;YACV,gCAAgC;QAClC,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;QACtC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;KACnC,CAAC;AACJ,CAAC"}

package/dist/routes/shared/token-verifier.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Shared token verification utility for public routes.
+ *
+ * Verifies a settings token against an agentId by checking direct agentId match,
+ * user ownership via UserAgentsStore, or canonical metadata owner fallback.
+ */
+import type { AgentConfigStore } from "@lobu/core";
+import type { SettingsTokenPayload } from "../../auth/settings/token-service";
+import type { UserAgentsStore } from "../../auth/user-agents-store";
+export interface TokenVerifierConfig {
+    userAgentsStore?: UserAgentsStore;
+    agentMetadataStore?: Pick<AgentConfigStore, "getMetadata">;
+}
+/**
+ * Create a token verifier function scoped to a given config.
+ *
+ * The returned async function accepts a decoded settings token payload and an
+ * agentId, then returns the payload if the caller is authorised, or null.
+ */
+export declare function createTokenVerifier(config: TokenVerifierConfig): (payload: SettingsTokenPayload | null, agentId: string) => Promise<SettingsTokenPayload | null>;
+//# sourceMappingURL=token-verifier.d.ts.map

package/dist/routes/shared/token-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.d.ts","sourceRoot":"","sources":["../../../src/routes/shared/token-verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAGpE,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kBAAkB,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;CAC5D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,IAE3D,SAAS,oBAAoB,GAAG,IAAI,EACpC,SAAS,MAAM,KACd,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAMxC"}

package/dist/routes/shared/token-verifier.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * Shared token verification utility for public routes.
+ *
+ * Verifies a settings token against an agentId by checking direct agentId match,
+ * user ownership via UserAgentsStore, or canonical metadata owner fallback.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTokenVerifier = createTokenVerifier;
+const agent_ownership_1 = require("./agent-ownership");
+/**
+ * Create a token verifier function scoped to a given config.
+ *
+ * The returned async function accepts a decoded settings token payload and an
+ * agentId, then returns the payload if the caller is authorised, or null.
+ */
+function createTokenVerifier(config) {
+    return async (payload, agentId) => {
+        if (!payload)
+            return null;
+        const result = await (0, agent_ownership_1.verifyOwnedAgentAccess)(payload, agentId, config);
+        return result.authorized ? payload : null;
+    };
+}
+//# sourceMappingURL=token-verifier.js.map

package/dist/routes/shared/token-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-verifier.js","sourceRoot":"","sources":["../../../src/routes/shared/token-verifier.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAkBH,kDAUC;AAvBD,uDAA2D;AAO3D;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,MAA2B;IAC7D,OAAO,KAAK,EACV,OAAoC,EACpC,OAAe,EACuB,EAAE;QACxC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAA,wCAAsB,EAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC"}

package/dist/services/core-services.d.ts

@@ -0,0 +1,133 @@
+#!/usr/bin/env bun
+import { type AgentAccessStore, type AgentConfigStore, type AgentConnectionStore, CommandRegistry, type SystemSkillEntry } from "@lobu/core";
+import { AgentMetadataStore } from "../auth/agent-metadata-store";
+import { ExternalAuthClient } from "../auth/external/client";
+import { McpConfigService } from "../auth/mcp/config-service";
+import { McpProxy } from "../auth/mcp/proxy";
+import { type ProviderOAuthStateStore } from "../auth/oauth/state-store";
+import { ProviderCatalogService } from "../auth/provider-catalog";
+import { AgentSettingsStore, AuthProfilesManager } from "../auth/settings";
+import { ModelPreferenceStore } from "../auth/settings/model-preference-store";
+import { UserAgentsStore } from "../auth/user-agents-store";
+import { ChannelBindingService } from "../channels";
+import type { AgentConfig, GatewayConfig } from "../config";
+import { type FileLoadedAgent } from "../config/file-loader";
+import { WorkerGateway } from "../gateway";
+import type { IMessageQueue } from "../infrastructure/queue";
+import { QueueProducer } from "../infrastructure/queue";
+import { InteractionService } from "../interactions";
+import { ScheduledWakeupService } from "../orchestration/scheduled-wakeup";
+import { GrantStore } from "../permissions/grant-store";
+import { SecretProxy } from "../proxy/secret-proxy";
+import { ImageGenerationService } from "./image-generation-service";
+import { InstructionService } from "./instruction-service";
+import { SessionManager } from "./session-manager";
+import { SettingsResolver } from "./settings-resolver";
+import { SystemConfigResolver } from "./system-config-resolver";
+import { SystemSkillsService } from "./system-skills-service";
+import { TranscriptionService } from "./transcription-service";
+/**
+ * Core Services - Centralized service initialization and lifecycle management
+ */
+export declare class CoreServices {
+    private readonly config;
+    private queue?;
+    private queueProducer?;
+    private sessionManager?;
+    private instructionService?;
+    private interactionService?;
+    private authProfilesManager?;
+    private modelPreferenceStore?;
+    private oauthStateStore?;
+    private secretProxy?;
+    private tokenRefreshJob?;
+    private mcpConfigService?;
+    private mcpProxy?;
+    private grantStore?;
+    private systemSkillsService?;
+    private systemConfigResolver?;
+    private workerGateway?;
+    private agentSettingsStore?;
+    private channelBindingService?;
+    private transcriptionService?;
+    private imageGenerationService?;
+    private userAgentsStore?;
+    private agentMetadataStore?;
+    private externalAuthClient?;
+    private providerCatalogService?;
+    private commandRegistry?;
+    private scheduledWakeupService?;
+    private configStore?;
+    private connectionStore?;
+    private accessStore?;
+    private settingsResolver?;
+    private fileLoadedAgents;
+    private projectPath;
+    private configAgents;
+    private options?;
+    constructor(config: GatewayConfig, options?: {
+        configStore?: AgentConfigStore;
+        connectionStore?: AgentConnectionStore;
+        accessStore?: AgentAccessStore;
+        systemSkills?: SystemSkillEntry[];
+    });
+    getConfigStore(): AgentConfigStore | undefined;
+    getConnectionStore(): AgentConnectionStore | undefined;
+    getAccessStore(): AgentAccessStore | undefined;
+    getSettingsResolver(): SettingsResolver | undefined;
+    /**
+     * Initialize all core services in dependency order
+     */
+    initialize(): Promise<void>;
+    private initializeQueue;
+    private initializeQueueProducer;
+    private initializeScheduledWakeupService;
+    private initializeSessionServices;
+    private initializeClaudeServices;
+    private initializeMcpServices;
+    private initializeCommandRegistry;
+    private populateStoreFromFiles;
+    private buildSettingsFromAgentConfig;
+    private syncAgentSettingsToRuntimeStore;
+    private populateStoreFromAgentConfigs;
+    /**
+     * Reload agent config from files (dev mode only).
+     * Re-reads lobu.toml + markdown, clears and re-populates the in-memory store.
+     */
+    reloadFromFiles(): Promise<{
+        reloaded: boolean;
+        agents: string[];
+    }>;
+    getFileLoadedAgents(): FileLoadedAgent[];
+    getConfigAgents(): AgentConfig[];
+    getProjectPath(): string | null;
+    isFileFirstMode(): boolean;
+    shutdown(): Promise<void>;
+    getQueue(): IMessageQueue;
+    getQueueProducer(): QueueProducer;
+    getSecretProxy(): SecretProxy | undefined;
+    getWorkerGateway(): WorkerGateway | undefined;
+    getMcpProxy(): McpProxy | undefined;
+    getMcpConfigService(): McpConfigService | undefined;
+    getModelPreferenceStore(): ModelPreferenceStore | undefined;
+    getOAuthStateStore(): ProviderOAuthStateStore | undefined;
+    getPublicGatewayUrl(): string;
+    getSessionManager(): SessionManager;
+    getInstructionService(): InstructionService | undefined;
+    getInteractionService(): InteractionService;
+    getAgentSettingsStore(): AgentSettingsStore;
+    getChannelBindingService(): ChannelBindingService;
+    getScheduledWakeupService(): ScheduledWakeupService | undefined;
+    getTranscriptionService(): TranscriptionService | undefined;
+    getImageGenerationService(): ImageGenerationService | undefined;
+    getUserAgentsStore(): UserAgentsStore;
+    getAgentMetadataStore(): AgentMetadataStore;
+    getCommandRegistry(): CommandRegistry;
+    getProviderCatalogService(): ProviderCatalogService;
+    getAuthProfilesManager(): AuthProfilesManager | undefined;
+    getGrantStore(): GrantStore | undefined;
+    getSystemSkillsService(): SystemSkillsService | undefined;
+    getSystemConfigResolver(): SystemConfigResolver | undefined;
+    getExternalAuthClient(): ExternalAuthClient | undefined;
+}
+//# sourceMappingURL=core-services.d.ts.map

package/dist/services/core-services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-services.d.ts","sourceRoot":"","sources":["../../src/services/core-services.ts"],"names":[],"mappings":";AAEA,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,eAAe,EAGf,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAIlE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAI7C,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,KAAK,eAAe,EAErB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,aAAa,EAGd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EACL,sBAAsB,EAEvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAQpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAqB,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAI/D;;GAEG;AACH,qBAAa,YAAY;IAiGrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IA7FzB,OAAO,CAAC,KAAK,CAAC,CAAgB;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAgB;IAKtC,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAChD,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAKhD,OAAO,CAAC,mBAAmB,CAAC,CAAsB;IAClD,OAAO,CAAC,oBAAoB,CAAC,CAAuB;IACpD,OAAO,CAAC,eAAe,CAAC,CAA0B;IAClD,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,eAAe,CAAC,CAAkB;IAK1C,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,CAAW;IAK5B,OAAO,CAAC,UAAU,CAAC,CAAa;IAKhC,OAAO,CAAC,mBAAmB,CAAC,CAAsB;IAClD,OAAO,CAAC,oBAAoB,CAAC,CAAuB;IAKpD,OAAO,CAAC,aAAa,CAAC,CAAgB;IAKtC,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAChD,OAAO,CAAC,qBAAqB,CAAC,CAAwB;IACtD,OAAO,CAAC,oBAAoB,CAAC,CAAuB;IACpD,OAAO,CAAC,sBAAsB,CAAC,CAAyB;IACxD,OAAO,CAAC,eAAe,CAAC,CAAkB;IAC1C,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAKhD,OAAO,CAAC,kBAAkB,CAAC,CAAqB;IAKhD,OAAO,CAAC,sBAAsB,CAAC,CAAyB;IAKxD,OAAO,CAAC,eAAe,CAAC,CAAkB;IAK1C,OAAO,CAAC,sBAAsB,CAAC,CAAyB;IAKxD,OAAO,CAAC,WAAW,CAAC,CAAmB;IACvC,OAAO,CAAC,eAAe,CAAC,CAAuB;IAC/C,OAAO,CAAC,WAAW,CAAC,CAAmB;IACvC,OAAO,CAAC,gBAAgB,CAAC,CAAmB;IAG5C,OAAO,CAAC,gBAAgB,CAAyB;IACjD,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,YAAY,CAAqB;IAGzC,OAAO,CAAC,OAAO,CAAC,CAKd;gBAGiB,MAAM,EAAE,aAAa,EACtC,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,gBAAgB,CAAC;QAC/B,eAAe,CAAC,EAAE,oBAAoB,CAAC;QACvC,WAAW,CAAC,EAAE,gBAAgB,CAAC;QAC/B,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;KACnC;IASH,cAAc,IAAI,gBAAgB,GAAG,SAAS;IAI9C,kBAAkB,IAAI,oBAAoB,GAAG,SAAS;IAItD,cAAc,IAAI,gBAAgB,GAAG,SAAS;IAI9C,mBAAmB,IAAI,gBAAgB,GAAG,SAAS;IAInD;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;YAsCnB,eAAe;YAyBf,uBAAuB;YAcvB,gCAAgC;YAkBhC,yBAAyB;YA0HzB,wBAAwB;YAsOxB,qBAAqB;IA2DnC,OAAO,CAAC,yBAAyB;YAiBnB,sBAAsB;IAmBpC,OAAO,CAAC,4BAA4B;YA0CtB,+BAA+B;YAgB/B,6BAA6B;IAsB3C;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAwDzE,mBAAmB,IAAI,eAAe,EAAE;IAIxC,eAAe,IAAI,WAAW,EAAE;IAIhC,cAAc,IAAI,MAAM,GAAG,IAAI;IAI/B,eAAe,IAAI,OAAO;IAQpB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B/B,QAAQ,IAAI,aAAa;IAKzB,gBAAgB,IAAI,aAAa;IAKjC,cAAc,IAAI,WAAW,GAAG,SAAS;IAIzC,gBAAgB,IAAI,aAAa,GAAG,SAAS;IAI7C,WAAW,IAAI,QAAQ,GAAG,SAAS;IAInC,mBAAmB,IAAI,gBAAgB,GAAG,SAAS;IAInD,uBAAuB,IAAI,oBAAoB,GAAG,SAAS;IAI3D,kBAAkB,IAAI,uBAAuB,GAAG,SAAS;IAIzD,mBAAmB,IAAI,MAAM;IAI7B,iBAAiB,IAAI,cAAc;IAMnC,qBAAqB,IAAI,kBAAkB,GAAG,SAAS;IAIvD,qBAAqB,IAAI,kBAAkB;IAM3C,qBAAqB,IAAI,kBAAkB;IAM3C,wBAAwB,IAAI,qBAAqB;IAMjD,yBAAyB,IAAI,sBAAsB,GAAG,SAAS;IAI/D,uBAAuB,IAAI,oBAAoB,GAAG,SAAS;IAI3D,yBAAyB,IAAI,sBAAsB,GAAG,SAAS;IAI/D,kBAAkB,IAAI,eAAe;IAMrC,qBAAqB,IAAI,kBAAkB;IAM3C,kBAAkB,IAAI,eAAe;IAMrC,yBAAyB,IAAI,sBAAsB;IAMnD,sBAAsB,IAAI,mBAAmB,GAAG,SAAS;IAIzD,aAAa,IAAI,UAAU,GAAG,SAAS;IAIvC,sBAAsB,IAAI,mBAAmB,GAAG,SAAS;IAIzD,uBAAuB,IAAI,oBAAoB,GAAG,SAAS;IAI3D,qBAAqB,IAAI,kBAAkB,GAAG,SAAS;CAGxD"}