@lobu/gateway 2.8.0

package/dist/auth/oauth/providers.d.ts

@@ -0,0 +1,44 @@
+/**
+ * OAuth 2.0 Provider Configurations
+ *
+ * Centralizes OAuth provider settings for easy addition of new providers.
+ * Each provider defines its endpoints, client credentials, and OAuth-specific settings.
+ */
+export interface OAuthProviderConfig {
+    /** Unique provider identifier */
+    id: string;
+    /** Human-readable provider name */
+    name: string;
+    /** OAuth 2.0 client ID (public identifier) */
+    clientId: string;
+    /** OAuth 2.0 client secret (optional - not used for public clients with PKCE) */
+    clientSecret?: string;
+    /** Authorization endpoint URL */
+    authUrl: string;
+    /** Token exchange endpoint URL */
+    tokenUrl: string;
+    /** OAuth redirect URI */
+    redirectUri: string;
+    /** OAuth scopes (space-separated) */
+    scope: string;
+    /** Use PKCE for public clients (RFC 7636) */
+    usePKCE: boolean;
+    /** Response type (default: "code") */
+    responseType?: string;
+    /** Grant type (default: "authorization_code") */
+    grantType?: string;
+    /** Custom headers to include in token requests */
+    customHeaders?: Record<string, string>;
+    /** Token endpoint auth method */
+    tokenEndpointAuthMethod?: "none" | "client_secret_post" | "client_secret_basic";
+    /** Whether auth-code exchange must include refresh_token */
+    requireRefreshToken?: boolean;
+}
+/**
+ * Claude OAuth Configuration
+ * - Public client (no client secret)
+ * - Uses PKCE for security
+ * - Requires browser-like headers (anti-bot protection)
+ */
+export declare const CLAUDE_PROVIDER: OAuthProviderConfig;
+//# sourceMappingURL=providers.d.ts.map

package/dist/auth/oauth/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/providers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,mBAAmB;IAClC,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,yBAAyB;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,iCAAiC;IACjC,uBAAuB,CAAC,EACpB,MAAM,GACN,oBAAoB,GACpB,qBAAqB,CAAC;IAC1B,4DAA4D;IAC5D,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,mBAqB7B,CAAC"}

package/dist/auth/oauth/providers.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * OAuth 2.0 Provider Configurations
+ *
+ * Centralizes OAuth provider settings for easy addition of new providers.
+ * Each provider defines its endpoints, client credentials, and OAuth-specific settings.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLAUDE_PROVIDER = void 0;
+/**
+ * Claude OAuth Configuration
+ * - Public client (no client secret)
+ * - Uses PKCE for security
+ * - Requires browser-like headers (anti-bot protection)
+ */
+exports.CLAUDE_PROVIDER = {
+    id: "claude",
+    name: "Claude",
+    clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
+    authUrl: "https://claude.ai/oauth/authorize",
+    tokenUrl: "https://console.anthropic.com/v1/oauth/token",
+    redirectUri: "https://console.anthropic.com/oauth/code/callback",
+    scope: "user:inference",
+    usePKCE: true,
+    responseType: "code",
+    grantType: "authorization_code",
+    tokenEndpointAuthMethod: "none",
+    requireRefreshToken: true,
+    customHeaders: {
+        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+        Accept: "application/json, text/plain, */*",
+        "Accept-Language": "en-US,en;q=0.9",
+        Referer: "https://claude.ai/",
+        Origin: "https://claude.ai",
+    },
+};
+//# sourceMappingURL=providers.js.map

package/dist/auth/oauth/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../../src/auth/oauth/providers.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAoCH;;;;;GAKG;AACU,QAAA,eAAe,GAAwB;IAClD,EAAE,EAAE,QAAQ;IACZ,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,sCAAsC;IAChD,OAAO,EAAE,mCAAmC;IAC5C,QAAQ,EAAE,8CAA8C;IACxD,WAAW,EAAE,mDAAmD;IAChE,KAAK,EAAE,gBAAgB;IACvB,OAAO,EAAE,IAAI;IACb,YAAY,EAAE,MAAM;IACpB,SAAS,EAAE,oBAAoB;IAC/B,uBAAuB,EAAE,MAAM;IAC/B,mBAAmB,EAAE,IAAI;IACzB,aAAa,EAAE;QACb,YAAY,EACV,uHAAuH;QACzH,MAAM,EAAE,mCAAmC;QAC3C,iBAAiB,EAAE,gBAAgB;QACnC,OAAO,EAAE,oBAAoB;QAC7B,MAAM,EAAE,mBAAmB;KAC5B;CACF,CAAC"}

package/dist/auth/oauth/state-store.d.ts

@@ -0,0 +1,62 @@
+import { type Logger } from "@lobu/core";
+import type Redis from "ioredis";
+/**
+ * Generic OAuth state store for CSRF protection
+ * Pattern: {keyPrefix}:{state}
+ * TTL: 5 minutes
+ */
+export declare class OAuthStateStore<T extends object> {
+    private redis;
+    private keyPrefix;
+    private static readonly TTL_SECONDS;
+    protected logger: Logger;
+    constructor(redis: Redis, keyPrefix: string, loggerName: string);
+    /**
+     * Create a new OAuth state with data
+     * Returns the state string to use in OAuth flow
+     */
+    create(data: T): Promise<string>;
+    /**
+     * Validate and consume an OAuth state
+     * Returns the state data if valid, null if invalid or expired
+     * Deletes the state after retrieval (one-time use)
+     */
+    consume(state: string): Promise<(T & {
+        createdAt: number;
+    }) | null>;
+    /**
+     * Generate a cryptographically secure random state string
+     */
+    private generateState;
+    private getKey;
+}
+/**
+ * Context for routing auth completion back to the originating platform.
+ */
+export interface OAuthPlatformContext {
+    platform: string;
+    channelId: string;
+    conversationId?: string;
+}
+export interface ProviderOAuthStateData {
+    userId: string;
+    agentId: string;
+    codeVerifier: string;
+    context?: OAuthPlatformContext;
+}
+export type ProviderOAuthState = ProviderOAuthStateData & {
+    createdAt: number;
+};
+/**
+ * Create a provider OAuth state store for PKCE flow
+ */
+export declare function createOAuthStateStore(providerId: string, redis: Redis): OAuthStateStore<ProviderOAuthStateData>;
+export interface SlackInstallStateData {
+    redirectUri: string;
+}
+export type SlackInstallState = SlackInstallStateData & {
+    createdAt: number;
+};
+export declare function createSlackInstallStateStore(redis: Redis): OAuthStateStore<SlackInstallStateData>;
+export type ProviderOAuthStateStore = OAuthStateStore<ProviderOAuthStateData>;
+//# sourceMappingURL=state-store.d.ts.map

package/dist/auth/oauth/state-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-store.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth/state-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAEjC;;;;GAIG;AACH,qBAAa,eAAe,CAAC,CAAC,SAAS,MAAM;IAKzC,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,SAAS;IALnB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAU;IAC7C,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;gBAGf,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACzB,UAAU,EAAE,MAAM;IAKpB;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IA0BtC;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IA+BzE;;OAEG;IACH,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,MAAM;CAGf;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,oBAAoB,CAAC;CAChC;AAED,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,GAAG;IACxD,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,KAAK,GACX,eAAe,CAAC,sBAAsB,CAAC,CAMzC;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,KAAK,GACX,eAAe,CAAC,qBAAqB,CAAC,CAExC;AAED,MAAM,MAAM,uBAAuB,GAAG,eAAe,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/auth/oauth/state-store.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthStateStore = void 0;
+exports.createOAuthStateStore = createOAuthStateStore;
+exports.createSlackInstallStateStore = createSlackInstallStateStore;
+const node_crypto_1 = require("node:crypto");
+const core_1 = require("@lobu/core");
+/**
+ * Generic OAuth state store for CSRF protection
+ * Pattern: {keyPrefix}:{state}
+ * TTL: 5 minutes
+ */
+class OAuthStateStore {
+    constructor(redis, keyPrefix, loggerName) {
+        this.redis = redis;
+        this.keyPrefix = keyPrefix;
+        this.logger = (0, core_1.createLogger)(loggerName);
+    }
+    /**
+     * Create a new OAuth state with data
+     * Returns the state string to use in OAuth flow
+     */
+    async create(data) {
+        const state = this.generateState();
+        const key = this.getKey(state);
+        const stateData = Object.assign(Object.assign({}, data), { createdAt: Date.now() });
+        await this.redis.setex(key, OAuthStateStore.TTL_SECONDS, JSON.stringify(stateData));
+        const userId = typeof data.userId === "string"
+            ? data.userId
+            : undefined;
+        this.logger.info(userId ? `Created OAuth state for user ${userId}` : "Created OAuth state", { state });
+        return state;
+    }
+    /**
+     * Validate and consume an OAuth state
+     * Returns the state data if valid, null if invalid or expired
+     * Deletes the state after retrieval (one-time use)
+     */
+    async consume(state) {
+        const key = this.getKey(state);
+        // Get and delete in one operation
+        const data = await this.redis.getdel(key);
+        if (!data) {
+            this.logger.warn(`Invalid or expired OAuth state: ${state}`);
+            return null;
+        }
+        try {
+            const stateData = JSON.parse(data);
+            const stateDataWithUser = stateData;
+            const userId = typeof stateDataWithUser.userId === "string"
+                ? stateDataWithUser.userId
+                : undefined;
+            this.logger.info(userId
+                ? `Consumed OAuth state for user ${userId}`
+                : "Consumed OAuth state", { state });
+            return stateData;
+        }
+        catch (error) {
+            this.logger.error(`Failed to parse OAuth state: ${state}`, { error });
+            return null;
+        }
+    }
+    /**
+     * Generate a cryptographically secure random state string
+     */
+    generateState() {
+        return (0, node_crypto_1.randomBytes)(32).toString("base64url");
+    }
+    getKey(state) {
+        return `${this.keyPrefix}:${state}`;
+    }
+}
+exports.OAuthStateStore = OAuthStateStore;
+OAuthStateStore.TTL_SECONDS = 5 * 60; // 5 minutes
+/**
+ * Create a provider OAuth state store for PKCE flow
+ */
+function createOAuthStateStore(providerId, redis) {
+    return new OAuthStateStore(redis, `${providerId}:oauth_state`, `${providerId}-oauth-state`);
+}
+function createSlackInstallStateStore(redis) {
+    return new OAuthStateStore(redis, "slack:oauth:state", "slack-install-state");
+}
+//# sourceMappingURL=state-store.js.map

package/dist/auth/oauth/state-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../../../src/auth/oauth/state-store.ts"],"names":[],"mappings":";;;AA8HA,sDASC;AAQD,oEAIC;AAnJD,6CAA0C;AAC1C,qCAAuD;AAGvD;;;;GAIG;AACH,MAAa,eAAe;IAI1B,YACU,KAAY,EACZ,SAAiB,EACzB,UAAkB;QAFV,UAAK,GAAL,KAAK,CAAO;QACZ,cAAS,GAAT,SAAS,CAAQ;QAGzB,IAAI,CAAC,MAAM,GAAG,IAAA,mBAAY,EAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,IAAO;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE/B,MAAM,SAAS,mCACV,IAAI,KACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GACtB,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CACpB,GAAG,EACH,eAAe,CAAC,WAAW,EAC3B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAC1B,CAAC;QAEF,MAAM,MAAM,GACV,OAAQ,IAA6B,CAAC,MAAM,KAAK,QAAQ;YACvD,CAAC,CAAE,IAA2B,CAAC,MAAM;YACrC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,MAAM,CAAC,CAAC,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC,CAAC,qBAAqB,EACzE,EAAE,KAAK,EAAE,CACV,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE/B,kCAAkC;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAE1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8B,CAAC;YAChE,MAAM,iBAAiB,GAAG,SAA4C,CAAC;YACvE,MAAM,MAAM,GACV,OAAO,iBAAiB,CAAC,MAAM,KAAK,QAAQ;gBAC1C,CAAC,CAAC,iBAAiB,CAAC,MAAM;gBAC1B,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,MAAM;gBACJ,CAAC,CAAC,iCAAiC,MAAM,EAAE;gBAC3C,CAAC,CAAC,sBAAsB,EAC1B,EAAE,KAAK,EAAE,CACV,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;IACtC,CAAC;;AAvFH,0CAwFC;AAvFyB,2BAAW,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,YAAY;AAiH5D;;GAEG;AACH,SAAgB,qBAAqB,CACnC,UAAkB,EAClB,KAAY;IAEZ,OAAO,IAAI,eAAe,CACxB,KAAK,EACL,GAAG,UAAU,cAAc,EAC3B,GAAG,UAAU,cAAc,CAC5B,CAAC;AACJ,CAAC;AAQD,SAAgB,4BAA4B,CAC1C,KAAY;IAEZ,OAAO,IAAI,eAAe,CAAC,KAAK,EAAE,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;AAChF,CAAC"}

package/dist/auth/oauth-templates.d.ts

@@ -0,0 +1,15 @@
+/**
+ * HTML templates for OAuth flow
+ */
+/**
+ * Render a success page that auto-closes the tab (for in-app browsers)
+ * and provides a fallback link to agent configuration when available.
+ */
+export declare function renderOAuthSuccessPage(name: string, settingsUrl?: string, options?: {
+    title?: string;
+    description?: string;
+    details?: string;
+    closeNote?: string;
+}): string;
+export declare function renderOAuthErrorPage(error: string, description?: string): string;
+//# sourceMappingURL=oauth-templates.d.ts.map

package/dist/auth/oauth-templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-templates.d.ts","sourceRoot":"","sources":["../../src/auth/oauth-templates.ts"],"names":[],"mappings":"AAAA;;GAEG;AAuBH;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;IACR,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,MAAM,CAwER;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CA+DR"}

package/dist/auth/oauth-templates.js

@@ -0,0 +1,161 @@
+"use strict";
+/**
+ * HTML templates for OAuth flow
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderOAuthSuccessPage = renderOAuthSuccessPage;
+exports.renderOAuthErrorPage = renderOAuthErrorPage;
+function escapeHtml(value) {
+    return value.replace(/[&<>"'`]/g, (char) => {
+        switch (char) {
+            case "&":
+                return "&amp;";
+            case "<":
+                return "&lt;";
+            case ">":
+                return "&gt;";
+            case '"':
+                return "&quot;";
+            case "'":
+                return "&#39;";
+            case "`":
+                return "&#96;";
+            default:
+                return char;
+        }
+    });
+}
+/**
+ * Render a success page that auto-closes the tab (for in-app browsers)
+ * and provides a fallback link to agent configuration when available.
+ */
+function renderOAuthSuccessPage(name, settingsUrl, options) {
+    const safeName = escapeHtml(name);
+    const safeSettingsUrl = settingsUrl ? escapeHtml(settingsUrl) : "";
+    const safeTitle = escapeHtml((options === null || options === void 0 ? void 0 : options.title) || "Connected!");
+    const safeDescription = escapeHtml((options === null || options === void 0 ? void 0 : options.description) || `Successfully authenticated with ${name}`);
+    const safeDetails = (options === null || options === void 0 ? void 0 : options.details) ? escapeHtml(options.details) : "";
+    const safeCloseNote = escapeHtml((options === null || options === void 0 ? void 0 : options.closeNote) || "You can close this tab and return to your chat.");
+    return `
+    <!DOCTYPE html>
+    <html>
+      <head>
+        <title>Connected</title>
+        <style>
+          body {
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            height: 100vh;
+            margin: 0;
+            background: linear-gradient(135deg, #334155 0%, #0f172a 100%);
+          }
+          .container {
+            background: white;
+            padding: 2.5rem;
+            border-radius: 12px;
+            text-align: center;
+            box-shadow: 0 20px 60px rgba(0,0,0,0.3);
+            max-width: 360px;
+          }
+          .icon { font-size: 3rem; margin-bottom: 0.75rem; }
+          h1 { color: #2d3748; margin: 0 0 0.5rem 0; font-size: 1.25rem; }
+          p { color: #718096; line-height: 1.5; font-size: 0.875rem; margin: 0 0 1rem 0; }
+          .btn {
+            display: inline-block;
+            padding: 0.625rem 1.25rem;
+            background: linear-gradient(to right, #334155, #1e293b);
+            color: white;
+            text-decoration: none;
+            border-radius: 8px;
+            font-size: 0.875rem;
+            font-weight: 600;
+          }
+          .btn:hover { opacity: 0.9; }
+          .close-note { color: #94a3b8; font-size: 0.75rem; margin-top: 1rem; }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <div class="icon">&#9989;</div>
+          <h1>${safeTitle}</h1>
+          <p>${safeDescription.includes(safeName) ? safeDescription : `${safeDescription} <strong>${safeName}</strong>`}</p>
+          ${safeDetails ? `<p>${safeDetails}</p>` : ""}
+          ${safeSettingsUrl ? `<a class="btn" href="${safeSettingsUrl}">Open Configuration</a>` : ""}
+          <p class="close-note">${safeCloseNote}</p>
+        </div>
+        <script>
+          // Auto-close for Telegram in-app browser
+          if (window.Telegram && window.Telegram.WebApp) {
+            window.Telegram.WebApp.close();
+          }
+          // Try to close the window/tab after a brief moment
+          setTimeout(function() { window.close(); }, 1500);
+        </script>
+      </body>
+    </html>
+  `;
+}
+function renderOAuthErrorPage(error, description) {
+    const safeError = escapeHtml(error);
+    const safeDescription = escapeHtml(description || "An error occurred during authentication");
+    return `
+    <!DOCTYPE html>
+    <html>
+      <head>
+        <title>Authentication Failed</title>
+        <style>
+          body {
+            font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            height: 100vh;
+            margin: 0;
+            background: linear-gradient(135deg, #f093fb 0%, #f5576c 100%);
+          }
+          .container {
+            background: white;
+            padding: 3rem;
+            border-radius: 12px;
+            text-align: center;
+            box-shadow: 0 20px 60px rgba(0,0,0,0.3);
+            max-width: 400px;
+          }
+          .error-icon {
+            font-size: 4rem;
+            margin-bottom: 1rem;
+          }
+          h1 {
+            color: #2d3748;
+            margin: 0 0 1rem 0;
+          }
+          p {
+            color: #718096;
+            line-height: 1.6;
+          }
+          .error-code {
+            background: #f7fafc;
+            padding: 0.5rem;
+            border-radius: 6px;
+            font-family: monospace;
+            font-size: 0.875rem;
+            color: #e53e3e;
+            margin-top: 1rem;
+          }
+        </style>
+      </head>
+      <body>
+        <div class="container">
+          <div class="error-icon">❌</div>
+          <h1>Authentication Failed</h1>
+          <p>${safeDescription}</p>
+          <div class="error-code">${safeError}</div>
+          <p style="margin-top: 2rem;">Please close this window and try again.</p>
+        </div>
+      </body>
+    </html>
+  `;
+}
+//# sourceMappingURL=oauth-templates.js.map

package/dist/auth/oauth-templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-templates.js","sourceRoot":"","sources":["../../src/auth/oauth-templates.ts"],"names":[],"mappings":";AAAA;;GAEG;;AA2BH,wDAiFC;AAED,oDAkEC;AA9KD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;QACzC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,OAAO,CAAC;YACjB,KAAK,GAAG;gBACN,OAAO,MAAM,CAAC;YAChB,KAAK,GAAG;gBACN,OAAO,MAAM,CAAC;YAChB,KAAK,GAAG;gBACN,OAAO,QAAQ,CAAC;YAClB,KAAK,GAAG;gBACN,OAAO,OAAO,CAAC;YACjB,KAAK,GAAG;gBACN,OAAO,OAAO,CAAC;YACjB;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CACpC,IAAY,EACZ,WAAoB,EACpB,OAKC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,MAAM,SAAS,GAAG,UAAU,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,KAAI,YAAY,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,UAAU,CAChC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,KAAI,mCAAmC,IAAI,EAAE,CAClE,CAAC;IACF,MAAM,WAAW,GAAG,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,EAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,aAAa,GAAG,UAAU,CAC9B,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,KAAI,iDAAiD,CACxE,CAAC;IAEF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBA2CO,SAAS;eACV,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,eAAe,YAAY,QAAQ,WAAW;YAC3G,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE;YAC1C,eAAe,CAAC,CAAC,CAAC,wBAAwB,eAAe,0BAA0B,CAAC,CAAC,CAAC,EAAE;kCAClE,aAAa;;;;;;;;;;;;GAY5C,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAClC,KAAa,EACb,WAAoB;IAEpB,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,eAAe,GAAG,UAAU,CAChC,WAAW,IAAI,yCAAyC,CACzD,CAAC;IAEF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAkDM,eAAe;oCACM,SAAS;;;;;GAK1C,CAAC;AACJ,CAAC"}

package/dist/auth/provider-catalog.d.ts

@@ -0,0 +1,52 @@
+import { type InstalledProvider } from "@lobu/core";
+import { type ModelProviderModule } from "../modules/module-system";
+import type { AgentSettingsStore } from "./settings/agent-settings-store";
+import type { AuthProfilesManager } from "./settings/auth-profiles-manager";
+/**
+ * Resolve an agent's installed providers, falling back to the base agent's
+ * providers for sandbox agents that have none of their own.
+ */
+export declare function resolveInstalledProviders(agentSettingsStore: AgentSettingsStore, agentId: string): Promise<InstalledProvider[]>;
+/**
+ * ProviderCatalogService wraps the module registry to provide
+ * per-agent provider install/uninstall/reorder operations.
+ *
+ * Providers are registered globally in the module registry,
+ * but each agent chooses which providers to install from the catalog.
+ */
+export declare class ProviderCatalogService {
+    private agentSettingsStore;
+    private authProfilesManager;
+    constructor(agentSettingsStore: AgentSettingsStore, authProfilesManager: AuthProfilesManager);
+    /**
+     * List all catalog-visible providers from the module registry.
+     */
+    listCatalogProviders(): ModelProviderModule[];
+    /**
+     * Resolve an agent's installedProviders to their module instances.
+     * Returns modules in the agent's install order.
+     */
+    getInstalledModules(agentId: string): Promise<ModelProviderModule[]>;
+    /**
+     * Get raw installed provider entries for an agent.
+     */
+    getInstalledProviders(agentId: string): Promise<InstalledProvider[]>;
+    /**
+     * Install a provider for an agent. Appends to the end of the list.
+     */
+    installProvider(agentId: string, providerId: string, config?: InstalledProvider["config"]): Promise<void>;
+    /**
+     * Uninstall a provider from an agent. Also cleans up auth profiles.
+     */
+    uninstallProvider(agentId: string, providerId: string): Promise<void>;
+    /**
+     * Find the provider module whose model options include the given model string.
+     */
+    findProviderForModel(model: string, providers?: ModelProviderModule[]): Promise<ModelProviderModule | undefined>;
+    /**
+     * Reorder installed providers. The orderedIds must contain
+     * exactly the same provider IDs as currently installed.
+     */
+    reorderProviders(agentId: string, orderedIds: string[]): Promise<void>;
+}
+//# sourceMappingURL=provider-catalog.d.ts.map

package/dist/auth/provider-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-catalog.d.ts","sourceRoot":"","sources":["../../src/auth/provider-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAK5E;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,kBAAkB,EAAE,kBAAkB,EACtC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAG9B;AAED;;;;;;GAMG;AACH,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,kBAAkB;IAC1B,OAAO,CAAC,mBAAmB;gBADnB,kBAAkB,EAAE,kBAAkB,EACtC,mBAAmB,EAAE,mBAAmB;IAGlD;;OAEG;IACH,oBAAoB,IAAI,mBAAmB,EAAE;IAI7C;;;OAGG;IACG,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAe1E;;OAEG;IACG,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAI1E;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC;IA0ChB;;OAEG;IACG,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiC3E;;OAEG;IACG,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,mBAAmB,EAAE,GAChC,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAY3C;;;OAGG;IACG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CA2C7E"}

package/dist/auth/provider-catalog.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderCatalogService = void 0;
+exports.resolveInstalledProviders = resolveInstalledProviders;
+const core_1 = require("@lobu/core");
+const module_system_1 = require("../modules/module-system");
+const model_selection_1 = require("./settings/model-selection");
+const logger = (0, core_1.createLogger)("provider-catalog");
+/**
+ * Resolve an agent's installed providers, falling back to the base agent's
+ * providers for sandbox agents that have none of their own.
+ */
+async function resolveInstalledProviders(agentSettingsStore, agentId) {
+    const settings = await agentSettingsStore.getEffectiveSettings(agentId);
+    return (settings === null || settings === void 0 ? void 0 : settings.installedProviders) || [];
+}
+/**
+ * ProviderCatalogService wraps the module registry to provide
+ * per-agent provider install/uninstall/reorder operations.
+ *
+ * Providers are registered globally in the module registry,
+ * but each agent chooses which providers to install from the catalog.
+ */
+class ProviderCatalogService {
+    constructor(agentSettingsStore, authProfilesManager) {
+        this.agentSettingsStore = agentSettingsStore;
+        this.authProfilesManager = authProfilesManager;
+    }
+    /**
+     * List all catalog-visible providers from the module registry.
+     */
+    listCatalogProviders() {
+        return (0, module_system_1.getModelProviderModules)().filter((m) => m.catalogVisible !== false);
+    }
+    /**
+     * Resolve an agent's installedProviders to their module instances.
+     * Returns modules in the agent's install order.
+     */
+    async getInstalledModules(agentId) {
+        const installed = await resolveInstalledProviders(this.agentSettingsStore, agentId);
+        if (installed.length === 0)
+            return [];
+        const allModules = (0, module_system_1.getModelProviderModules)();
+        const moduleMap = new Map(allModules.map((m) => [m.providerId, m]));
+        return installed
+            .map((ip) => moduleMap.get(ip.providerId))
+            .filter((m) => m !== undefined);
+    }
+    /**
+     * Get raw installed provider entries for an agent.
+     */
+    async getInstalledProviders(agentId) {
+        return resolveInstalledProviders(this.agentSettingsStore, agentId);
+    }
+    /**
+     * Install a provider for an agent. Appends to the end of the list.
+     */
+    async installProvider(agentId, providerId, config) {
+        var _a, _b, _c;
+        const allModules = (0, module_system_1.getModelProviderModules)();
+        const module = allModules.find((m) => m.providerId === providerId);
+        if (!module) {
+            throw new Error(`Unknown provider: ${providerId}`);
+        }
+        const { localSettings, effectiveSettings } = await this.agentSettingsStore.getSettingsContext(agentId);
+        const installed = (effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.installedProviders) || [];
+        if (installed.some((ip) => ip.providerId === providerId)) {
+            logger.info(`Provider ${providerId} already installed for agent ${agentId}`);
+            return;
+        }
+        const entry = Object.assign({ providerId, installedAt: Date.now() }, (config ? { config } : {}));
+        const nextInstalledProviders = [...installed, entry];
+        const reconciled = (0, model_selection_1.reconcileModelSelectionForInstalledProviders)({
+            model: (_a = localSettings === null || localSettings === void 0 ? void 0 : localSettings.model) !== null && _a !== void 0 ? _a : effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.model,
+            modelSelection: (_b = localSettings === null || localSettings === void 0 ? void 0 : localSettings.modelSelection) !== null && _b !== void 0 ? _b : effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.modelSelection,
+            providerModelPreferences: (_c = localSettings === null || localSettings === void 0 ? void 0 : localSettings.providerModelPreferences) !== null && _c !== void 0 ? _c : effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.providerModelPreferences,
+            installedProviders: nextInstalledProviders,
+        });
+        await this.agentSettingsStore.updateSettings(agentId, Object.assign({ installedProviders: nextInstalledProviders }, reconciled));
+        logger.info(`Installed provider ${providerId} for agent ${agentId}`);
+    }
+    /**
+     * Uninstall a provider from an agent. Also cleans up auth profiles.
+     */
+    async uninstallProvider(agentId, providerId) {
+        var _a, _b, _c;
+        const { localSettings, effectiveSettings } = await this.agentSettingsStore.getSettingsContext(agentId);
+        const installed = (effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.installedProviders) || [];
+        const filtered = installed.filter((ip) => ip.providerId !== providerId);
+        if (filtered.length === installed.length) {
+            logger.info(`Provider ${providerId} not installed for agent ${agentId}, nothing to uninstall`);
+            return;
+        }
+        // Clean up auth profiles for this provider
+        await this.authProfilesManager.deleteProviderProfiles(agentId, providerId);
+        const reconciled = (0, model_selection_1.reconcileModelSelectionForInstalledProviders)({
+            model: (_a = localSettings === null || localSettings === void 0 ? void 0 : localSettings.model) !== null && _a !== void 0 ? _a : effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.model,
+            modelSelection: (_b = localSettings === null || localSettings === void 0 ? void 0 : localSettings.modelSelection) !== null && _b !== void 0 ? _b : effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.modelSelection,
+            providerModelPreferences: (_c = localSettings === null || localSettings === void 0 ? void 0 : localSettings.providerModelPreferences) !== null && _c !== void 0 ? _c : effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.providerModelPreferences,
+            installedProviders: filtered,
+        });
+        await this.agentSettingsStore.updateSettings(agentId, Object.assign({ installedProviders: filtered }, reconciled));
+        logger.info(`Uninstalled provider ${providerId} for agent ${agentId}`);
+    }
+    /**
+     * Find the provider module whose model options include the given model string.
+     */
+    async findProviderForModel(model, providers) {
+        const candidates = providers || (0, module_system_1.getModelProviderModules)();
+        for (const provider of candidates) {
+            if (!provider.getModelOptions)
+                continue;
+            const options = await provider.getModelOptions("", "");
+            if (options.some((opt) => opt.value === model)) {
+                return provider;
+            }
+        }
+        return undefined;
+    }
+    /**
+     * Reorder installed providers. The orderedIds must contain
+     * exactly the same provider IDs as currently installed.
+     */
+    async reorderProviders(agentId, orderedIds) {
+        var _a, _b, _c;
+        const { localSettings, effectiveSettings } = await this.agentSettingsStore.getSettingsContext(agentId);
+        const installed = (effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.installedProviders) || [];
+        const installedMap = new Map(installed.map((ip) => [ip.providerId, ip]));
+        // Validate all ordered IDs exist in installed
+        for (const id of orderedIds) {
+            if (!installedMap.has(id)) {
+                throw new Error(`Provider ${id} is not installed`);
+            }
+        }
+        const reordered = orderedIds
+            .map((id) => installedMap.get(id))
+            .filter((ip) => ip !== undefined);
+        // Append any installed providers not in orderedIds (shouldn't happen but safety)
+        for (const ip of installed) {
+            if (!orderedIds.includes(ip.providerId)) {
+                reordered.push(ip);
+            }
+        }
+        const reconciled = (0, model_selection_1.reconcileModelSelectionForInstalledProviders)({
+            model: (_a = localSettings === null || localSettings === void 0 ? void 0 : localSettings.model) !== null && _a !== void 0 ? _a : effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.model,
+            modelSelection: (_b = localSettings === null || localSettings === void 0 ? void 0 : localSettings.modelSelection) !== null && _b !== void 0 ? _b : effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.modelSelection,
+            providerModelPreferences: (_c = localSettings === null || localSettings === void 0 ? void 0 : localSettings.providerModelPreferences) !== null && _c !== void 0 ? _c : effectiveSettings === null || effectiveSettings === void 0 ? void 0 : effectiveSettings.providerModelPreferences,
+            installedProviders: reordered,
+        });
+        await this.agentSettingsStore.updateSettings(agentId, Object.assign({ installedProviders: reordered }, reconciled));
+        logger.info(`Reordered providers for agent ${agentId}: ${orderedIds.join(", ")}`);
+    }
+}
+exports.ProviderCatalogService = ProviderCatalogService;
+//# sourceMappingURL=provider-catalog.js.map