@ashx-j/lunr 0.1.0

package/dist/gateway/approval.js

@@ -0,0 +1,152 @@
+/**
+ * lunR: gateway approval prompt for manual permission mode.
+ *
+ * The gateway runs headless sessions. When a mutating tool call arrives in
+ * manual mode, this module posts an inline-button approve/reject prompt to
+ * the originating chat and awaits the callback. If no chat context is present
+ * the request is rejected (fail-closed).
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { randomBytes } from "node:crypto";
+import { NO_HANDLER_REASON, registerApprovalHandler, } from "../core/permissions.js";
+const CALLBACK_PREFIX = "ap:";
+const ID_LENGTH = 8;
+const CODE_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+const approvalContext = new AsyncLocalStorage();
+const pending = new Map();
+function generateId() {
+    let id = "";
+    const bytes = randomBytes(ID_LENGTH);
+    for (let i = 0; i < ID_LENGTH; i++) {
+        id += CODE_ALPHABET[bytes[i] % CODE_ALPHABET.length];
+    }
+    return id;
+}
+function makeCallbackData(id, action) {
+    return `${CALLBACK_PREFIX}${id}:${action}`;
+}
+function parseCallbackData(data) {
+    if (!data.startsWith(CALLBACK_PREFIX))
+        return null;
+    const rest = data.slice(CALLBACK_PREFIX.length);
+    const colon = rest.indexOf(":");
+    if (colon === -1)
+        return null;
+    const id = rest.slice(0, colon);
+    const action = rest.slice(colon + 1);
+    if (action === "once" || action === "session" || action === "reject" || action === "cancel") {
+        return { id, action };
+    }
+    return null;
+}
+/** Run code with the gateway approval context available to tool-call gates. */
+export function runWithApprovalContext(ctx, fn) {
+    return approvalContext.run(ctx, fn);
+}
+async function createApprovalPrompt(adapter, source, req, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    const id = generateId();
+    // lunr: auto-activated agent swarms get the "agent swarm" title; buttons stay
+    // once/session/reject (inline buttons cannot capture reject feedback).
+    const title = req.kind === "swarm" ? `▶ Approve agent swarm?\n${req.detail}` : `Approve ${req.toolName}?\n${req.detail}`;
+    const rows = [
+        [
+            { label: "✓ Approve once", data: makeCallbackData(id, "once") },
+            { label: "✓ Approve session", data: makeCallbackData(id, "session") },
+        ],
+        [{ label: "✗ Reject", data: makeCallbackData(id, "reject") }],
+    ];
+    return new Promise((resolve, reject) => {
+        let messageId;
+        const timeout = setTimeout(() => {
+            pending.delete(id);
+            reject(new Error("Approval request timed out"));
+            if (messageId) {
+                void adapter.editMessage(source.chatId, messageId, "⏱ Approval expired.", []).catch(() => { });
+            }
+        }, timeoutMs);
+        void (async () => {
+            try {
+                const result = await adapter.sendButtons(source.chatId, title, rows, { threadId: source.threadId });
+                if (!result.success || !result.messageId) {
+                    clearTimeout(timeout);
+                    reject(new Error(result.error ?? "Failed to send approval prompt"));
+                    return;
+                }
+                messageId = result.messageId;
+                pending.set(id, {
+                    resolve,
+                    reject,
+                    timeout,
+                    messageId,
+                    adapter,
+                    chatId: source.chatId,
+                    threadId: source.threadId,
+                    userId: source.userId,
+                });
+            }
+            catch (err) {
+                clearTimeout(timeout);
+                reject(err);
+            }
+        })();
+    });
+}
+/** Approval handler passed to core permissions. */
+export async function createGatewayApprovalRequest(req) {
+    const ctx = approvalContext.getStore();
+    if (!ctx) {
+        throw new Error(NO_HANDLER_REASON);
+    }
+    return createApprovalPrompt(ctx.adapter, ctx.source, req, ctx.timeoutMs);
+}
+/** Register the gateway approval handler with the core permission gate. */
+export function registerGatewayApprovalHandler() {
+    registerApprovalHandler(createGatewayApprovalRequest);
+}
+/**
+ * Dispatch a callback event to an outstanding approval prompt.
+ * Returns true when the data matched the approval prefix (whether or not a
+ * pending prompt existed).
+ */
+export async function handleApprovalCallback(event, adapter) {
+    const parsed = parseCallbackData(event.data);
+    if (!parsed)
+        return false;
+    const entry = pending.get(parsed.id);
+    if (!entry) {
+        // Best-effort answer for stale callbacks.
+        await adapter?.answerCallback(event.id, "Approval expired.").catch(() => { });
+        return true;
+    }
+    if (event.userId !== entry.userId) {
+        await entry.adapter.answerCallback(event.id, "⛔ Not your approval.").catch(() => { });
+        return true;
+    }
+    clearTimeout(entry.timeout);
+    pending.delete(parsed.id);
+    const response = parsed.action === "reject" || parsed.action === "cancel" ? "reject" : parsed.action;
+    entry.resolve(response);
+    const label = parsed.action === "reject" || parsed.action === "cancel" ? "Rejected." : `Approved (${parsed.action}).`;
+    await entry.adapter.editMessage(entry.chatId, entry.messageId ?? "", label, []).catch(() => { });
+    await entry.adapter.answerCallback(event.id).catch(() => { });
+    return true;
+}
+/** Test hook: clear all pending approvals and stop their timeouts. */
+export function resetApprovalRegistry() {
+    for (const entry of pending.values()) {
+        clearTimeout(entry.timeout);
+        try {
+            entry.reject(new Error("Approval registry reset"));
+        }
+        catch {
+            // ignore settled promise
+        }
+    }
+    pending.clear();
+}
+/** Test hook: number of outstanding approval prompts. */
+export function activeApprovalCount() {
+    return pending.size;
+}
+//# sourceMappingURL=approval.js.map

package/dist/gateway/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/gateway/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAGN,iBAAiB,EACjB,uBAAuB,GACvB,MAAM,wBAAwB,CAAC;AAGhC,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAoBzC,MAAM,eAAe,GAAG,IAAI,iBAAiB,EAAmB,CAAC;AACjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEnD,SAAS,UAAU,GAAW;IAC7B,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,EAAE,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,EAAE,CAAC;AAAA,CACV;AAED,SAAS,gBAAgB,CAAC,EAAU,EAAE,MAAmC,EAAU;IAClF,OAAO,GAAG,eAAe,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;AAAA,CAC3C;AAED,SAAS,iBAAiB,CAAC,IAAY,EAA8D;IACpG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7F,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,+EAA+E;AAC/E,MAAM,UAAU,sBAAsB,CAAI,GAAoB,EAAE,EAAoB,EAAc;IACjG,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAAA,CACpC;AAED,KAAK,UAAU,oBAAoB,CAClC,OAAwB,EACxB,MAAqB,EACrB,GAAoB,EACpB,SAAS,GAAG,kBAAkB,EACF;IAC5B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,8EAA8E;IAC9E,uEAAuE;IACvE,MAAM,KAAK,GACV,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,6BAA2B,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5G,MAAM,IAAI,GAAmB;QAC5B;YACC,EAAE,KAAK,EAAE,kBAAgB,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE;YAC/D,EAAE,KAAK,EAAE,qBAAmB,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE;SACrE;QACD,CAAC,EAAE,KAAK,EAAE,YAAU,EAAE,IAAI,EAAE,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;KAC7D,CAAC;IAEF,OAAO,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACzD,IAAI,SAA6B,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;YAChC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnB,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAChD,IAAI,SAAS,EAAE,CAAC;gBACf,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,uBAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;YAC/F,CAAC;QAAA,CACD,EAAE,SAAS,CAAC,CAAC;QAEd,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;oBAC1C,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,gCAAgC,CAAC,CAAC,CAAC;oBACpE,OAAO;gBACR,CAAC;gBACD,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE;oBACf,OAAO;oBACP,MAAM;oBACN,OAAO;oBACP,SAAS;oBACT,OAAO;oBACP,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;iBACrB,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,CAAC;YACb,CAAC;QAAA,CACD,CAAC,EAAE,CAAC;IAAA,CACL,CAAC,CAAC;AAAA,CACH;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,GAAoB,EAA6B;IACnG,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,EAAE,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;AAAA,CACzE;AAED,2EAA2E;AAC3E,MAAM,UAAU,8BAA8B,GAAS;IACtD,uBAAuB,CAAC,4BAA4B,CAAC,CAAC;AAAA,CACtD;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAoB,EAAE,OAAyB,EAAoB;IAC/G,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,0CAA0C;QAC1C,MAAM,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,wBAAsB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE1B,MAAM,QAAQ,GACb,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IACrF,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExB,MAAM,KAAK,GACV,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,MAAM,IAAI,CAAC;IACzG,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;IAChG,MAAM,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB,GAAS;IAC7C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC;YACJ,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACR,yBAAyB;QAC1B,CAAC;IACF,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,CAAC;AAAA,CAChB;AAED,yDAAyD;AACzD,MAAM,UAAU,mBAAmB,GAAW;IAC7C,OAAO,OAAO,CAAC,IAAI,CAAC;AAAA,CACpB","sourcesContent":["/**\n * lunR: gateway approval prompt for manual permission mode.\n *\n * The gateway runs headless sessions. When a mutating tool call arrives in\n * manual mode, this module posts an inline-button approve/reject prompt to\n * the originating chat and awaits the callback. If no chat context is present\n * the request is rejected (fail-closed).\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { randomBytes } from \"node:crypto\";\nimport {\n\ttype ApprovalRequest,\n\ttype ApprovalResponse,\n\tNO_HANDLER_REASON,\n\tregisterApprovalHandler,\n} from \"../core/permissions.ts\";\nimport type { ButtonSpec, CallbackEvent, PlatformAdapter, SessionSource } from \"./types.ts\";\n\nconst CALLBACK_PREFIX = \"ap:\";\nconst ID_LENGTH = 8;\nconst CODE_ALPHABET = \"ABCDEFGHJKMNPQRSTUVWXYZ23456789\";\nconst DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;\n\ninterface ApprovalContext {\n\tkey: string;\n\tadapter: PlatformAdapter;\n\tsource: SessionSource;\n\ttimeoutMs?: number;\n}\n\ninterface PendingApproval {\n\tresolve: (value: ApprovalResponse) => void;\n\treject: (reason?: unknown) => void;\n\ttimeout: ReturnType<typeof setTimeout>;\n\tmessageId?: string;\n\tadapter: PlatformAdapter;\n\tchatId: string;\n\tthreadId?: string;\n\tuserId: string;\n}\n\nconst approvalContext = new AsyncLocalStorage<ApprovalContext>();\nconst pending = new Map<string, PendingApproval>();\n\nfunction generateId(): string {\n\tlet id = \"\";\n\tconst bytes = randomBytes(ID_LENGTH);\n\tfor (let i = 0; i < ID_LENGTH; i++) {\n\t\tid += CODE_ALPHABET[bytes[i] % CODE_ALPHABET.length];\n\t}\n\treturn id;\n}\n\nfunction makeCallbackData(id: string, action: ApprovalResponse | \"cancel\"): string {\n\treturn `${CALLBACK_PREFIX}${id}:${action}`;\n}\n\nfunction parseCallbackData(data: string): { id: string; action: ApprovalResponse | \"cancel\" } | null {\n\tif (!data.startsWith(CALLBACK_PREFIX)) return null;\n\tconst rest = data.slice(CALLBACK_PREFIX.length);\n\tconst colon = rest.indexOf(\":\");\n\tif (colon === -1) return null;\n\tconst id = rest.slice(0, colon);\n\tconst action = rest.slice(colon + 1);\n\tif (action === \"once\" || action === \"session\" || action === \"reject\" || action === \"cancel\") {\n\t\treturn { id, action };\n\t}\n\treturn null;\n}\n\n/** Run code with the gateway approval context available to tool-call gates. */\nexport function runWithApprovalContext<T>(ctx: ApprovalContext, fn: () => Promise<T>): Promise<T> {\n\treturn approvalContext.run(ctx, fn);\n}\n\nasync function createApprovalPrompt(\n\tadapter: PlatformAdapter,\n\tsource: SessionSource,\n\treq: ApprovalRequest,\n\ttimeoutMs = DEFAULT_TIMEOUT_MS,\n): Promise<ApprovalResponse> {\n\tconst id = generateId();\n\t// lunr: auto-activated agent swarms get the \"agent swarm\" title; buttons stay\n\t// once/session/reject (inline buttons cannot capture reject feedback).\n\tconst title =\n\t\treq.kind === \"swarm\" ? `▶ Approve agent swarm?\\n${req.detail}` : `Approve ${req.toolName}?\\n${req.detail}`;\n\tconst rows: ButtonSpec[][] = [\n\t\t[\n\t\t\t{ label: \"✓ Approve once\", data: makeCallbackData(id, \"once\") },\n\t\t\t{ label: \"✓ Approve session\", data: makeCallbackData(id, \"session\") },\n\t\t],\n\t\t[{ label: \"✗ Reject\", data: makeCallbackData(id, \"reject\") }],\n\t];\n\n\treturn new Promise<ApprovalResponse>((resolve, reject) => {\n\t\tlet messageId: string | undefined;\n\t\tconst timeout = setTimeout(() => {\n\t\t\tpending.delete(id);\n\t\t\treject(new Error(\"Approval request timed out\"));\n\t\t\tif (messageId) {\n\t\t\t\tvoid adapter.editMessage(source.chatId, messageId, \"⏱ Approval expired.\", []).catch(() => {});\n\t\t\t}\n\t\t}, timeoutMs);\n\n\t\tvoid (async () => {\n\t\t\ttry {\n\t\t\t\tconst result = await adapter.sendButtons(source.chatId, title, rows, { threadId: source.threadId });\n\t\t\t\tif (!result.success || !result.messageId) {\n\t\t\t\t\tclearTimeout(timeout);\n\t\t\t\t\treject(new Error(result.error ?? \"Failed to send approval prompt\"));\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tmessageId = result.messageId;\n\t\t\t\tpending.set(id, {\n\t\t\t\t\tresolve,\n\t\t\t\t\treject,\n\t\t\t\t\ttimeout,\n\t\t\t\t\tmessageId,\n\t\t\t\t\tadapter,\n\t\t\t\t\tchatId: source.chatId,\n\t\t\t\t\tthreadId: source.threadId,\n\t\t\t\t\tuserId: source.userId,\n\t\t\t\t});\n\t\t\t} catch (err) {\n\t\t\t\tclearTimeout(timeout);\n\t\t\t\treject(err);\n\t\t\t}\n\t\t})();\n\t});\n}\n\n/** Approval handler passed to core permissions. */\nexport async function createGatewayApprovalRequest(req: ApprovalRequest): Promise<ApprovalResponse> {\n\tconst ctx = approvalContext.getStore();\n\tif (!ctx) {\n\t\tthrow new Error(NO_HANDLER_REASON);\n\t}\n\treturn createApprovalPrompt(ctx.adapter, ctx.source, req, ctx.timeoutMs);\n}\n\n/** Register the gateway approval handler with the core permission gate. */\nexport function registerGatewayApprovalHandler(): void {\n\tregisterApprovalHandler(createGatewayApprovalRequest);\n}\n\n/**\n * Dispatch a callback event to an outstanding approval prompt.\n * Returns true when the data matched the approval prefix (whether or not a\n * pending prompt existed).\n */\nexport async function handleApprovalCallback(event: CallbackEvent, adapter?: PlatformAdapter): Promise<boolean> {\n\tconst parsed = parseCallbackData(event.data);\n\tif (!parsed) return false;\n\n\tconst entry = pending.get(parsed.id);\n\tif (!entry) {\n\t\t// Best-effort answer for stale callbacks.\n\t\tawait adapter?.answerCallback(event.id, \"Approval expired.\").catch(() => {});\n\t\treturn true;\n\t}\n\n\tif (event.userId !== entry.userId) {\n\t\tawait entry.adapter.answerCallback(event.id, \"⛔ Not your approval.\").catch(() => {});\n\t\treturn true;\n\t}\n\n\tclearTimeout(entry.timeout);\n\tpending.delete(parsed.id);\n\n\tconst response: ApprovalResponse =\n\t\tparsed.action === \"reject\" || parsed.action === \"cancel\" ? \"reject\" : parsed.action;\n\tentry.resolve(response);\n\n\tconst label =\n\t\tparsed.action === \"reject\" || parsed.action === \"cancel\" ? \"Rejected.\" : `Approved (${parsed.action}).`;\n\tawait entry.adapter.editMessage(entry.chatId, entry.messageId ?? \"\", label, []).catch(() => {});\n\tawait entry.adapter.answerCallback(event.id).catch(() => {});\n\treturn true;\n}\n\n/** Test hook: clear all pending approvals and stop their timeouts. */\nexport function resetApprovalRegistry(): void {\n\tfor (const entry of pending.values()) {\n\t\tclearTimeout(entry.timeout);\n\t\ttry {\n\t\t\tentry.reject(new Error(\"Approval registry reset\"));\n\t\t} catch {\n\t\t\t// ignore settled promise\n\t\t}\n\t}\n\tpending.clear();\n}\n\n/** Test hook: number of outstanding approval prompts. */\nexport function activeApprovalCount(): number {\n\treturn pending.size;\n}\n"]}

package/dist/gateway/authz.d.ts

@@ -0,0 +1,21 @@
+/**
+ * lunR: gateway authorization — fail-closed, layered:
+ *   1. LUNR_GATEWAY_ALLOW_ALL_USERS=true env (escape hatch)
+ *   2. chatId in the platform's allowedChats (chat-scoped grant)
+ *   3. adapter-asserted roleAuthorized
+ *   4. paired via the pairing store
+ *   5. userId in the platform's allowedUsers or global
+ *      LUNR_GATEWAY_ALLOWED_USERS (comma-separated env)
+ *   6. denied
+ */
+import { type GatewayConfig } from "./config.ts";
+import type { PairingStore } from "./pairing.ts";
+import type { SessionSource } from "./types.ts";
+export declare function isAuthorized(source: SessionSource, cfg: GatewayConfig, pairing: PairingStore): boolean;
+/**
+ * Append a user to a platform's allowedUsers in the saved gateway.json
+ * (used after a pairing approval so the grant survives pairing-store resets).
+ * No-op when already present.
+ */
+export declare function addAllowedUser(platform: string, userId: string): void;
+//# sourceMappingURL=authz.d.ts.map

package/dist/gateway/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/gateway/authz.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,aAAa,EAA2D,MAAM,aAAa,CAAC;AAC1G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAiBhD,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAWtG;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAUrE","sourcesContent":["/**\n * lunR: gateway authorization — fail-closed, layered:\n *   1. LUNR_GATEWAY_ALLOW_ALL_USERS=true env (escape hatch)\n *   2. chatId in the platform's allowedChats (chat-scoped grant)\n *   3. adapter-asserted roleAuthorized\n *   4. paired via the pairing store\n *   5. userId in the platform's allowedUsers or global\n *      LUNR_GATEWAY_ALLOWED_USERS (comma-separated env)\n *   6. denied\n */\n\nimport { type GatewayConfig, loadGatewayConfig, platformConfigFor, saveGatewayConfig } from \"./config.ts\";\nimport type { PairingStore } from \"./pairing.ts\";\nimport type { SessionSource } from \"./types.ts\";\n\nfunction envFlagEnabled(name: string): boolean {\n\tconst raw = process.env[name];\n\tif (raw === undefined) return false;\n\treturn [\"1\", \"true\", \"yes\", \"on\"].includes(raw.toLowerCase());\n}\n\nfunction globalAllowedUsers(): string[] {\n\tconst raw = process.env.LUNR_GATEWAY_ALLOWED_USERS;\n\tif (!raw) return [];\n\treturn raw\n\t\t.split(\",\")\n\t\t.map((u) => u.trim())\n\t\t.filter((u) => u.length > 0);\n}\n\nexport function isAuthorized(source: SessionSource, cfg: GatewayConfig, pairing: PairingStore): boolean {\n\tif (envFlagEnabled(\"LUNR_GATEWAY_ALLOW_ALL_USERS\")) return true;\n\tconst platformCfg = platformConfigFor(cfg, source.platform);\n\tif (platformCfg?.allowedChats.includes(source.chatId)) return true;\n\tif (source.roleAuthorized === true) return true;\n\tif (source.userId && pairing.isPaired(source.platform, source.userId)) return true;\n\tif (source.userId) {\n\t\tif (platformCfg?.allowedUsers.includes(source.userId)) return true;\n\t\tif (globalAllowedUsers().includes(source.userId)) return true;\n\t}\n\treturn false;\n}\n\n/**\n * Append a user to a platform's allowedUsers in the saved gateway.json\n * (used after a pairing approval so the grant survives pairing-store resets).\n * No-op when already present.\n */\nexport function addAllowedUser(platform: string, userId: string): void {\n\tconst cfg = loadGatewayConfig();\n\tconst platformCfg = platformConfigFor(cfg, platform);\n\tif (!platformCfg) {\n\t\tthrow new Error(`Unknown platform \"${platform}\"`);\n\t}\n\tif (!platformCfg.allowedUsers.includes(userId)) {\n\t\tplatformCfg.allowedUsers.push(userId);\n\t\tsaveGatewayConfig(cfg);\n\t}\n}\n"]}

package/dist/gateway/authz.js

@@ -0,0 +1,61 @@
+/**
+ * lunR: gateway authorization — fail-closed, layered:
+ *   1. LUNR_GATEWAY_ALLOW_ALL_USERS=true env (escape hatch)
+ *   2. chatId in the platform's allowedChats (chat-scoped grant)
+ *   3. adapter-asserted roleAuthorized
+ *   4. paired via the pairing store
+ *   5. userId in the platform's allowedUsers or global
+ *      LUNR_GATEWAY_ALLOWED_USERS (comma-separated env)
+ *   6. denied
+ */
+import { loadGatewayConfig, platformConfigFor, saveGatewayConfig } from "./config.js";
+function envFlagEnabled(name) {
+    const raw = process.env[name];
+    if (raw === undefined)
+        return false;
+    return ["1", "true", "yes", "on"].includes(raw.toLowerCase());
+}
+function globalAllowedUsers() {
+    const raw = process.env.LUNR_GATEWAY_ALLOWED_USERS;
+    if (!raw)
+        return [];
+    return raw
+        .split(",")
+        .map((u) => u.trim())
+        .filter((u) => u.length > 0);
+}
+export function isAuthorized(source, cfg, pairing) {
+    if (envFlagEnabled("LUNR_GATEWAY_ALLOW_ALL_USERS"))
+        return true;
+    const platformCfg = platformConfigFor(cfg, source.platform);
+    if (platformCfg?.allowedChats.includes(source.chatId))
+        return true;
+    if (source.roleAuthorized === true)
+        return true;
+    if (source.userId && pairing.isPaired(source.platform, source.userId))
+        return true;
+    if (source.userId) {
+        if (platformCfg?.allowedUsers.includes(source.userId))
+            return true;
+        if (globalAllowedUsers().includes(source.userId))
+            return true;
+    }
+    return false;
+}
+/**
+ * Append a user to a platform's allowedUsers in the saved gateway.json
+ * (used after a pairing approval so the grant survives pairing-store resets).
+ * No-op when already present.
+ */
+export function addAllowedUser(platform, userId) {
+    const cfg = loadGatewayConfig();
+    const platformCfg = platformConfigFor(cfg, platform);
+    if (!platformCfg) {
+        throw new Error(`Unknown platform "${platform}"`);
+    }
+    if (!platformCfg.allowedUsers.includes(userId)) {
+        platformCfg.allowedUsers.push(userId);
+        saveGatewayConfig(cfg);
+    }
+}
+//# sourceMappingURL=authz.js.map

package/dist/gateway/authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../../src/gateway/authz.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAsB,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAI1G,SAAS,cAAc,CAAC,IAAY,EAAW;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAAA,CAC9D;AAED,SAAS,kBAAkB,GAAa;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAAA,CAC9B;AAED,MAAM,UAAU,YAAY,CAAC,MAAqB,EAAE,GAAkB,EAAE,OAAqB,EAAW;IACvG,IAAI,cAAc,CAAC,8BAA8B,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACnE,IAAI,kBAAkB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc,EAAQ;IACtE,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,GAAG,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;AAAA,CACD","sourcesContent":["/**\n * lunR: gateway authorization — fail-closed, layered:\n *   1. LUNR_GATEWAY_ALLOW_ALL_USERS=true env (escape hatch)\n *   2. chatId in the platform's allowedChats (chat-scoped grant)\n *   3. adapter-asserted roleAuthorized\n *   4. paired via the pairing store\n *   5. userId in the platform's allowedUsers or global\n *      LUNR_GATEWAY_ALLOWED_USERS (comma-separated env)\n *   6. denied\n */\n\nimport { type GatewayConfig, loadGatewayConfig, platformConfigFor, saveGatewayConfig } from \"./config.ts\";\nimport type { PairingStore } from \"./pairing.ts\";\nimport type { SessionSource } from \"./types.ts\";\n\nfunction envFlagEnabled(name: string): boolean {\n\tconst raw = process.env[name];\n\tif (raw === undefined) return false;\n\treturn [\"1\", \"true\", \"yes\", \"on\"].includes(raw.toLowerCase());\n}\n\nfunction globalAllowedUsers(): string[] {\n\tconst raw = process.env.LUNR_GATEWAY_ALLOWED_USERS;\n\tif (!raw) return [];\n\treturn raw\n\t\t.split(\",\")\n\t\t.map((u) => u.trim())\n\t\t.filter((u) => u.length > 0);\n}\n\nexport function isAuthorized(source: SessionSource, cfg: GatewayConfig, pairing: PairingStore): boolean {\n\tif (envFlagEnabled(\"LUNR_GATEWAY_ALLOW_ALL_USERS\")) return true;\n\tconst platformCfg = platformConfigFor(cfg, source.platform);\n\tif (platformCfg?.allowedChats.includes(source.chatId)) return true;\n\tif (source.roleAuthorized === true) return true;\n\tif (source.userId && pairing.isPaired(source.platform, source.userId)) return true;\n\tif (source.userId) {\n\t\tif (platformCfg?.allowedUsers.includes(source.userId)) return true;\n\t\tif (globalAllowedUsers().includes(source.userId)) return true;\n\t}\n\treturn false;\n}\n\n/**\n * Append a user to a platform's allowedUsers in the saved gateway.json\n * (used after a pairing approval so the grant survives pairing-store resets).\n * No-op when already present.\n */\nexport function addAllowedUser(platform: string, userId: string): void {\n\tconst cfg = loadGatewayConfig();\n\tconst platformCfg = platformConfigFor(cfg, platform);\n\tif (!platformCfg) {\n\t\tthrow new Error(`Unknown platform \"${platform}\"`);\n\t}\n\tif (!platformCfg.allowedUsers.includes(userId)) {\n\t\tplatformCfg.allowedUsers.push(userId);\n\t\tsaveGatewayConfig(cfg);\n\t}\n}\n"]}

package/dist/gateway/buttons.d.ts

@@ -0,0 +1,58 @@
+/**
+ * lunR: gateway inline-button picker registry.
+ *
+ * Single registry for all interactive prompts (model/thinking/sessions pickers
+ * now; approvals later). Callback payloads stay tiny so they fit Telegram's
+ * 64-byte callback_data limit; all picker state lives server-side in this module.
+ */
+import type { GatewayConfig } from "./config.ts";
+import type { PairingStore } from "./pairing.ts";
+import type { BridgeLike } from "./router.ts";
+import type { CallbackEvent, PlatformAdapter, SendOptions, SendResult, SessionSource } from "./types.ts";
+export interface PickerItem {
+    label: string;
+    value: string;
+}
+export type PickerResolveResult = {
+    done: true;
+    text: string;
+} | {
+    done: false;
+    items: PickerItem[];
+    title: string;
+    breadcrumbs?: string;
+};
+export interface PickerSpec {
+    kind: "model" | "thinking" | "sessions";
+    sessionKey: string;
+    invokerId: string;
+    items: PickerItem[];
+    perPage?: number;
+    title: string;
+    breadcrumbs?: string;
+    resolve(item: PickerItem): Promise<PickerResolveResult>;
+}
+export interface ButtonDeps {
+    adapters: Map<string, PlatformAdapter>;
+    cfg: GatewayConfig;
+    pairing: PairingStore;
+    bridge: BridgeLike;
+}
+/**
+ * Create and send a paginated inline-button picker. On send failure the caller
+ * should fall back to a text-based list.
+ */
+export declare function createPicker(adapter: PlatformAdapter, source: SessionSource, spec: PickerSpec, opts?: SendOptions): Promise<SendResult>;
+/** Dispatch a CallbackEvent to the matching picker entry. */
+export declare function handleCallback(cb: CallbackEvent, deps: ButtonDeps & {
+    adapter: PlatformAdapter;
+}): Promise<void>;
+/** Start the periodic TTL sweeper. Idempotent. */
+export declare function startButtonSweeper(): void;
+/** Stop the TTL sweeper. */
+export declare function stopButtonSweeper(): void;
+/** Test hook: reset the registry and stop the sweeper. */
+export declare function resetButtonRegistry(): void;
+/** Test hook: expose active picker ids. */
+export declare function activePickerIds(): string[];
+//# sourceMappingURL=buttons.d.ts.map

package/dist/gateway/buttons.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buttons.d.ts","sourceRoot":"","sources":["../../src/gateway/buttons.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAc,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAUrH,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAC5B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACxD;AAaD,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvC,GAAG,EAAE,aAAa,CAAC;IACnB,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC;CACnB;AA0FD;;;GAGG;AACH,wBAAsB,YAAY,CACjC,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,UAAU,EAChB,IAAI,CAAC,EAAE,WAAW,GAChB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAcD,6DAA6D;AAC7D,wBAAsB,cAAc,CACnC,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,UAAU,GAAG;IAAE,OAAO,EAAE,eAAe,CAAA;CAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAkGf;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,IAAI,IAAI,CAezC;AAED,4BAA4B;AAC5B,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C;AAED,2CAA2C;AAC3C,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAE1C","sourcesContent":["/**\n * lunR: gateway inline-button picker registry.\n *\n * Single registry for all interactive prompts (model/thinking/sessions pickers\n * now; approvals later). Callback payloads stay tiny so they fit Telegram's\n * 64-byte callback_data limit; all picker state lives server-side in this module.\n */\n\nimport { randomBytes } from \"node:crypto\";\nimport { isAuthorized } from \"./authz.ts\";\nimport type { GatewayConfig } from \"./config.ts\";\nimport type { PairingStore } from \"./pairing.ts\";\nimport type { BridgeLike } from \"./router.ts\";\nimport type { ButtonSpec, CallbackEvent, PlatformAdapter, SendOptions, SendResult, SessionSource } from \"./types.ts\";\n\nconst PICKER_TTL_MS = 15 * 60 * 1000;\nconst SWEEP_INTERVAL_MS = 60 * 1000;\nconst DEFAULT_PER_PAGE = 8;\nconst BUTTONS_PER_ROW = 2;\nconst CODE_ALPHABET = \"ABCDEFGHJKMNPQRSTUVWXYZ23456789\";\nconst CODE_LENGTH = 8;\nconst CALLBACK_PREFIX = \"cp:\";\n\nexport interface PickerItem {\n\tlabel: string;\n\tvalue: string;\n}\n\nexport type PickerResolveResult =\n\t| { done: true; text: string }\n\t| { done: false; items: PickerItem[]; title: string; breadcrumbs?: string };\n\nexport interface PickerSpec {\n\tkind: \"model\" | \"thinking\" | \"sessions\";\n\tsessionKey: string;\n\tinvokerId: string;\n\titems: PickerItem[];\n\tperPage?: number;\n\ttitle: string;\n\tbreadcrumbs?: string;\n\tresolve(item: PickerItem): Promise<PickerResolveResult>;\n}\n\ninterface PendingPicker extends PickerSpec {\n\tid: string;\n\tchatId: string;\n\tmessageId: string;\n\tsource: SessionSource;\n\tadapter: PlatformAdapter;\n\tpage: number;\n\tperPage: number;\n\tcreatedAt: number;\n}\n\nexport interface ButtonDeps {\n\tadapters: Map<string, PlatformAdapter>;\n\tcfg: GatewayConfig;\n\tpairing: PairingStore;\n\tbridge: BridgeLike;\n}\n\nconst registry = new Map<string, PendingPicker>();\nlet sweeper: ReturnType<typeof setInterval> | undefined;\n\nfunction generatePickerId(): string {\n\tlet id = \"\";\n\tconst bytes = randomBytes(CODE_LENGTH);\n\tfor (let i = 0; i < CODE_LENGTH; i++) {\n\t\tid += CODE_ALPHABET[bytes[i] % CODE_ALPHABET.length];\n\t}\n\treturn id;\n}\n\nfunction makeCallbackData(id: string, action: \"select\" | \"page\" | \"cancel\" | \"noop\", payload?: string): string {\n\tif (action === \"noop\") return `${CALLBACK_PREFIX}${id}:`;\n\tif (action === \"cancel\") return `${CALLBACK_PREFIX}${id}:x`;\n\tif (action === \"page\") return `${CALLBACK_PREFIX}${id}:p${payload ?? \"0\"}`;\n\treturn `${CALLBACK_PREFIX}${id}:${payload ?? \"\"}`;\n}\n\nfunction parseCallbackData(\n\tdata: string,\n): { id: string; action: \"select\" | \"page\" | \"cancel\" | \"noop\"; payload?: string } | null {\n\tif (!data.startsWith(CALLBACK_PREFIX)) return null;\n\tconst rest = data.slice(CALLBACK_PREFIX.length);\n\tconst colon = rest.indexOf(\":\");\n\tif (colon === -1) return null;\n\tconst id = rest.slice(0, colon);\n\tconst tail = rest.slice(colon + 1);\n\tif (tail === \"\") return { id, action: \"noop\" };\n\tif (tail === \"x\") return { id, action: \"cancel\" };\n\tif (tail.startsWith(\"p\")) return { id, action: \"page\", payload: tail.slice(1) };\n\treturn { id, action: \"select\", payload: tail };\n}\n\nfunction isSameChat(a: SessionSource, b: SessionSource): boolean {\n\treturn a.platform === b.platform && a.chatId === b.chatId && a.threadId === b.threadId;\n}\n\nfunction sourceForAuth(picker: PendingPicker, cb: CallbackEvent): SessionSource {\n\treturn {\n\t\tplatform: picker.source.platform,\n\t\tchatId: cb.chatId,\n\t\tchatType: picker.source.chatType,\n\t\tuserId: cb.userId,\n\t\tuserName: cb.userName,\n\t\tthreadId: cb.threadId,\n\t\t// Do NOT inherit the original invoker's role authorization.\n\t\troleAuthorized: undefined,\n\t};\n}\n\nfunction renderPage(picker: PendingPicker): { text: string; buttons: ButtonSpec[][] } {\n\tconst { id, title, breadcrumbs, items, page, perPage } = picker;\n\tconst totalPages = Math.max(1, Math.ceil(items.length / perPage));\n\tconst clampedPage = Math.max(0, Math.min(page, totalPages - 1));\n\tconst start = clampedPage * perPage;\n\tconst pageItems = items.slice(start, start + perPage);\n\n\tconst rows: ButtonSpec[][] = [];\n\tfor (let i = 0; i < pageItems.length; i += BUTTONS_PER_ROW) {\n\t\tconst row: ButtonSpec[] = [];\n\t\tfor (let j = 0; j < BUTTONS_PER_ROW && i + j < pageItems.length; j++) {\n\t\t\tconst index = start + i + j;\n\t\t\trow.push({ label: pageItems[i + j].label, data: makeCallbackData(id, \"select\", String(index)) });\n\t\t}\n\t\trows.push(row);\n\t}\n\n\tif (totalPages > 1) {\n\t\tconst nav: ButtonSpec[] = [];\n\t\tif (clampedPage > 0) {\n\t\t\tnav.push({ label: \"◀ Prev\", data: makeCallbackData(id, \"page\", String(clampedPage - 1)) });\n\t\t}\n\t\tnav.push({ label: `${clampedPage + 1}/${totalPages}`, data: makeCallbackData(id, \"noop\") });\n\t\tif (clampedPage < totalPages - 1) {\n\t\t\tnav.push({ label: \"Next ▶\", data: makeCallbackData(id, \"page\", String(clampedPage + 1)) });\n\t\t}\n\t\trows.push(nav);\n\t}\n\n\trows.push([{ label: \"✗ Cancel\", data: makeCallbackData(id, \"cancel\") }]);\n\n\tconst header = breadcrumbs ? `${title} · ${breadcrumbs}` : title;\n\tconst text =\n\t\titems.length === 0 ? `${header}\\n\\nNo options available.` : `${header} (${clampedPage + 1}/${totalPages}):`;\n\treturn { text, buttons: rows };\n}\n\n/**\n * Create and send a paginated inline-button picker. On send failure the caller\n * should fall back to a text-based list.\n */\nexport async function createPicker(\n\tadapter: PlatformAdapter,\n\tsource: SessionSource,\n\tspec: PickerSpec,\n\topts?: SendOptions,\n): Promise<SendResult> {\n\tconst id = generatePickerId();\n\tconst pending: PendingPicker = {\n\t\t...spec,\n\t\tid,\n\t\tchatId: source.chatId,\n\t\tsource,\n\t\tadapter,\n\t\tmessageId: \"\",\n\t\tpage: 0,\n\t\tperPage: spec.perPage ?? DEFAULT_PER_PAGE,\n\t\tcreatedAt: Date.now(),\n\t};\n\tconst { text, buttons } = renderPage(pending);\n\tconst result = await adapter.sendButtons(source.chatId, text, buttons, opts);\n\tif (!result.success) return result;\n\tif (result.messageId) {\n\t\tpending.messageId = result.messageId;\n\t\tregistry.set(id, pending);\n\t}\n\treturn result;\n}\n\nasync function answerExpired(adapter: PlatformAdapter, cb: CallbackEvent): Promise<void> {\n\tawait adapter.answerCallback(cb.id, \"Picker expired — run the command again.\").catch(() => {});\n}\n\nasync function answerUnauthorized(adapter: PlatformAdapter, cb: CallbackEvent): Promise<void> {\n\tawait adapter.answerCallback(cb.id, \"⛔ Not authorized.\").catch(() => {});\n}\n\nasync function answerNotYourPicker(adapter: PlatformAdapter, cb: CallbackEvent): Promise<void> {\n\tawait adapter.answerCallback(cb.id, \"⛔ Not your picker.\").catch(() => {});\n}\n\n/** Dispatch a CallbackEvent to the matching picker entry. */\nexport async function handleCallback(\n\tcb: CallbackEvent,\n\tdeps: ButtonDeps & { adapter: PlatformAdapter },\n): Promise<void> {\n\tconst { adapter, cfg, pairing } = deps;\n\tconst parsed = parseCallbackData(cb.data);\n\tif (!parsed) return;\n\n\tconst picker = registry.get(parsed.id);\n\tif (!picker) {\n\t\tawait answerExpired(adapter, cb);\n\t\treturn;\n\t}\n\n\tif (Date.now() > picker.createdAt + PICKER_TTL_MS) {\n\t\tregistry.delete(parsed.id);\n\t\ttry {\n\t\t\tawait picker.adapter.editMessage(picker.chatId, picker.messageId, \"⏱ Expired — run the command again.\", []);\n\t\t} catch {\n\t\t\t// best-effort expiry message\n\t\t}\n\t\tawait answerExpired(adapter, cb);\n\t\treturn;\n\t}\n\n\tif (!isSameChat(picker.source, sourceForAuth(picker, cb))) {\n\t\tawait answerExpired(adapter, cb);\n\t\treturn;\n\t}\n\n\tif (cb.userId !== picker.invokerId) {\n\t\tawait answerNotYourPicker(adapter, cb);\n\t\treturn;\n\t}\n\n\tif (!isAuthorized(sourceForAuth(picker, cb), cfg, pairing)) {\n\t\tawait answerUnauthorized(adapter, cb);\n\t\treturn;\n\t}\n\n\tif (parsed.action === \"cancel\") {\n\t\tregistry.delete(parsed.id);\n\t\ttry {\n\t\t\tawait picker.adapter.editMessage(picker.chatId, picker.messageId, \"Cancelled.\", []);\n\t\t} catch {}\n\t\tawait adapter.answerCallback(cb.id).catch(() => {});\n\t\treturn;\n\t}\n\n\tif (parsed.action === \"noop\") {\n\t\tawait adapter.answerCallback(cb.id).catch(() => {});\n\t\treturn;\n\t}\n\n\tif (parsed.action === \"page\") {\n\t\tconst page = Number.parseInt(parsed.payload ?? \"0\", 10);\n\t\tconst totalPages = Math.max(1, Math.ceil(picker.items.length / picker.perPage));\n\t\tpicker.page = Math.max(0, Math.min(page, totalPages - 1));\n\t\tconst { text, buttons } = renderPage(picker);\n\t\ttry {\n\t\t\tawait picker.adapter.editMessage(picker.chatId, picker.messageId, text, buttons);\n\t\t} catch {}\n\t\tawait adapter.answerCallback(cb.id).catch(() => {});\n\t\treturn;\n\t}\n\n\t// select\n\tconst index = Number.parseInt(parsed.payload ?? \"\", 10);\n\tconst item = picker.items[index];\n\tif (!item) {\n\t\tawait adapter.answerCallback(cb.id, \"Invalid selection.\").catch(() => {});\n\t\treturn;\n\t}\n\n\ttry {\n\t\tconst result = await picker.resolve(item);\n\t\tif (!result.done) {\n\t\t\tpicker.items = result.items;\n\t\t\tpicker.title = result.title;\n\t\t\tpicker.breadcrumbs = result.breadcrumbs;\n\t\t\tpicker.page = 0;\n\t\t\tconst { text, buttons } = renderPage(picker);\n\t\t\ttry {\n\t\t\t\tawait picker.adapter.editMessage(picker.chatId, picker.messageId, text, buttons);\n\t\t\t} catch {}\n\t\t\tawait adapter.answerCallback(cb.id).catch(() => {});\n\t\t\treturn;\n\t\t}\n\t\tregistry.delete(parsed.id);\n\t\ttry {\n\t\t\tawait picker.adapter.editMessage(picker.chatId, picker.messageId, result.text, []);\n\t\t} catch {}\n\t\tawait adapter.answerCallback(cb.id).catch(() => {});\n\t} catch (err) {\n\t\tregistry.delete(parsed.id);\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\ttry {\n\t\t\tawait picker.adapter.editMessage(picker.chatId, picker.messageId, `⚠ ${message}`, []);\n\t\t} catch {}\n\t\tawait adapter.answerCallback(cb.id).catch(() => {});\n\t}\n}\n\n/** Start the periodic TTL sweeper. Idempotent. */\nexport function startButtonSweeper(): void {\n\tif (sweeper) return;\n\tsweeper = setInterval(() => {\n\t\tconst cutoff = Date.now() - PICKER_TTL_MS;\n\t\tfor (const [id, entry] of registry) {\n\t\t\tif (entry.createdAt > cutoff) continue;\n\t\t\tregistry.delete(id);\n\t\t\ttry {\n\t\t\t\tvoid entry.adapter.editMessage(entry.chatId, entry.messageId, \"⏱ Expired — run the command again.\", []);\n\t\t\t} catch {\n\t\t\t\t// best-effort expiry edit\n\t\t\t}\n\t\t}\n\t}, SWEEP_INTERVAL_MS);\n\tsweeper.unref?.();\n}\n\n/** Stop the TTL sweeper. */\nexport function stopButtonSweeper(): void {\n\tif (sweeper) {\n\t\tclearInterval(sweeper);\n\t\tsweeper = undefined;\n\t}\n}\n\n/** Test hook: reset the registry and stop the sweeper. */\nexport function resetButtonRegistry(): void {\n\tregistry.clear();\n\tstopButtonSweeper();\n}\n\n/** Test hook: expose active picker ids. */\nexport function activePickerIds(): string[] {\n\treturn [...registry.keys()];\n}\n"]}

package/dist/gateway/buttons.js

@@ -0,0 +1,269 @@
+/**
+ * lunR: gateway inline-button picker registry.
+ *
+ * Single registry for all interactive prompts (model/thinking/sessions pickers
+ * now; approvals later). Callback payloads stay tiny so they fit Telegram's
+ * 64-byte callback_data limit; all picker state lives server-side in this module.
+ */
+import { randomBytes } from "node:crypto";
+import { isAuthorized } from "./authz.js";
+const PICKER_TTL_MS = 15 * 60 * 1000;
+const SWEEP_INTERVAL_MS = 60 * 1000;
+const DEFAULT_PER_PAGE = 8;
+const BUTTONS_PER_ROW = 2;
+const CODE_ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+const CODE_LENGTH = 8;
+const CALLBACK_PREFIX = "cp:";
+const registry = new Map();
+let sweeper;
+function generatePickerId() {
+    let id = "";
+    const bytes = randomBytes(CODE_LENGTH);
+    for (let i = 0; i < CODE_LENGTH; i++) {
+        id += CODE_ALPHABET[bytes[i] % CODE_ALPHABET.length];
+    }
+    return id;
+}
+function makeCallbackData(id, action, payload) {
+    if (action === "noop")
+        return `${CALLBACK_PREFIX}${id}:`;
+    if (action === "cancel")
+        return `${CALLBACK_PREFIX}${id}:x`;
+    if (action === "page")
+        return `${CALLBACK_PREFIX}${id}:p${payload ?? "0"}`;
+    return `${CALLBACK_PREFIX}${id}:${payload ?? ""}`;
+}
+function parseCallbackData(data) {
+    if (!data.startsWith(CALLBACK_PREFIX))
+        return null;
+    const rest = data.slice(CALLBACK_PREFIX.length);
+    const colon = rest.indexOf(":");
+    if (colon === -1)
+        return null;
+    const id = rest.slice(0, colon);
+    const tail = rest.slice(colon + 1);
+    if (tail === "")
+        return { id, action: "noop" };
+    if (tail === "x")
+        return { id, action: "cancel" };
+    if (tail.startsWith("p"))
+        return { id, action: "page", payload: tail.slice(1) };
+    return { id, action: "select", payload: tail };
+}
+function isSameChat(a, b) {
+    return a.platform === b.platform && a.chatId === b.chatId && a.threadId === b.threadId;
+}
+function sourceForAuth(picker, cb) {
+    return {
+        platform: picker.source.platform,
+        chatId: cb.chatId,
+        chatType: picker.source.chatType,
+        userId: cb.userId,
+        userName: cb.userName,
+        threadId: cb.threadId,
+        // Do NOT inherit the original invoker's role authorization.
+        roleAuthorized: undefined,
+    };
+}
+function renderPage(picker) {
+    const { id, title, breadcrumbs, items, page, perPage } = picker;
+    const totalPages = Math.max(1, Math.ceil(items.length / perPage));
+    const clampedPage = Math.max(0, Math.min(page, totalPages - 1));
+    const start = clampedPage * perPage;
+    const pageItems = items.slice(start, start + perPage);
+    const rows = [];
+    for (let i = 0; i < pageItems.length; i += BUTTONS_PER_ROW) {
+        const row = [];
+        for (let j = 0; j < BUTTONS_PER_ROW && i + j < pageItems.length; j++) {
+            const index = start + i + j;
+            row.push({ label: pageItems[i + j].label, data: makeCallbackData(id, "select", String(index)) });
+        }
+        rows.push(row);
+    }
+    if (totalPages > 1) {
+        const nav = [];
+        if (clampedPage > 0) {
+            nav.push({ label: "◀ Prev", data: makeCallbackData(id, "page", String(clampedPage - 1)) });
+        }
+        nav.push({ label: `${clampedPage + 1}/${totalPages}`, data: makeCallbackData(id, "noop") });
+        if (clampedPage < totalPages - 1) {
+            nav.push({ label: "Next ▶", data: makeCallbackData(id, "page", String(clampedPage + 1)) });
+        }
+        rows.push(nav);
+    }
+    rows.push([{ label: "✗ Cancel", data: makeCallbackData(id, "cancel") }]);
+    const header = breadcrumbs ? `${title} · ${breadcrumbs}` : title;
+    const text = items.length === 0 ? `${header}\n\nNo options available.` : `${header} (${clampedPage + 1}/${totalPages}):`;
+    return { text, buttons: rows };
+}
+/**
+ * Create and send a paginated inline-button picker. On send failure the caller
+ * should fall back to a text-based list.
+ */
+export async function createPicker(adapter, source, spec, opts) {
+    const id = generatePickerId();
+    const pending = {
+        ...spec,
+        id,
+        chatId: source.chatId,
+        source,
+        adapter,
+        messageId: "",
+        page: 0,
+        perPage: spec.perPage ?? DEFAULT_PER_PAGE,
+        createdAt: Date.now(),
+    };
+    const { text, buttons } = renderPage(pending);
+    const result = await adapter.sendButtons(source.chatId, text, buttons, opts);
+    if (!result.success)
+        return result;
+    if (result.messageId) {
+        pending.messageId = result.messageId;
+        registry.set(id, pending);
+    }
+    return result;
+}
+async function answerExpired(adapter, cb) {
+    await adapter.answerCallback(cb.id, "Picker expired — run the command again.").catch(() => { });
+}
+async function answerUnauthorized(adapter, cb) {
+    await adapter.answerCallback(cb.id, "⛔ Not authorized.").catch(() => { });
+}
+async function answerNotYourPicker(adapter, cb) {
+    await adapter.answerCallback(cb.id, "⛔ Not your picker.").catch(() => { });
+}
+/** Dispatch a CallbackEvent to the matching picker entry. */
+export async function handleCallback(cb, deps) {
+    const { adapter, cfg, pairing } = deps;
+    const parsed = parseCallbackData(cb.data);
+    if (!parsed)
+        return;
+    const picker = registry.get(parsed.id);
+    if (!picker) {
+        await answerExpired(adapter, cb);
+        return;
+    }
+    if (Date.now() > picker.createdAt + PICKER_TTL_MS) {
+        registry.delete(parsed.id);
+        try {
+            await picker.adapter.editMessage(picker.chatId, picker.messageId, "⏱ Expired — run the command again.", []);
+        }
+        catch {
+            // best-effort expiry message
+        }
+        await answerExpired(adapter, cb);
+        return;
+    }
+    if (!isSameChat(picker.source, sourceForAuth(picker, cb))) {
+        await answerExpired(adapter, cb);
+        return;
+    }
+    if (cb.userId !== picker.invokerId) {
+        await answerNotYourPicker(adapter, cb);
+        return;
+    }
+    if (!isAuthorized(sourceForAuth(picker, cb), cfg, pairing)) {
+        await answerUnauthorized(adapter, cb);
+        return;
+    }
+    if (parsed.action === "cancel") {
+        registry.delete(parsed.id);
+        try {
+            await picker.adapter.editMessage(picker.chatId, picker.messageId, "Cancelled.", []);
+        }
+        catch { }
+        await adapter.answerCallback(cb.id).catch(() => { });
+        return;
+    }
+    if (parsed.action === "noop") {
+        await adapter.answerCallback(cb.id).catch(() => { });
+        return;
+    }
+    if (parsed.action === "page") {
+        const page = Number.parseInt(parsed.payload ?? "0", 10);
+        const totalPages = Math.max(1, Math.ceil(picker.items.length / picker.perPage));
+        picker.page = Math.max(0, Math.min(page, totalPages - 1));
+        const { text, buttons } = renderPage(picker);
+        try {
+            await picker.adapter.editMessage(picker.chatId, picker.messageId, text, buttons);
+        }
+        catch { }
+        await adapter.answerCallback(cb.id).catch(() => { });
+        return;
+    }
+    // select
+    const index = Number.parseInt(parsed.payload ?? "", 10);
+    const item = picker.items[index];
+    if (!item) {
+        await adapter.answerCallback(cb.id, "Invalid selection.").catch(() => { });
+        return;
+    }
+    try {
+        const result = await picker.resolve(item);
+        if (!result.done) {
+            picker.items = result.items;
+            picker.title = result.title;
+            picker.breadcrumbs = result.breadcrumbs;
+            picker.page = 0;
+            const { text, buttons } = renderPage(picker);
+            try {
+                await picker.adapter.editMessage(picker.chatId, picker.messageId, text, buttons);
+            }
+            catch { }
+            await adapter.answerCallback(cb.id).catch(() => { });
+            return;
+        }
+        registry.delete(parsed.id);
+        try {
+            await picker.adapter.editMessage(picker.chatId, picker.messageId, result.text, []);
+        }
+        catch { }
+        await adapter.answerCallback(cb.id).catch(() => { });
+    }
+    catch (err) {
+        registry.delete(parsed.id);
+        const message = err instanceof Error ? err.message : String(err);
+        try {
+            await picker.adapter.editMessage(picker.chatId, picker.messageId, `⚠ ${message}`, []);
+        }
+        catch { }
+        await adapter.answerCallback(cb.id).catch(() => { });
+    }
+}
+/** Start the periodic TTL sweeper. Idempotent. */
+export function startButtonSweeper() {
+    if (sweeper)
+        return;
+    sweeper = setInterval(() => {
+        const cutoff = Date.now() - PICKER_TTL_MS;
+        for (const [id, entry] of registry) {
+            if (entry.createdAt > cutoff)
+                continue;
+            registry.delete(id);
+            try {
+                void entry.adapter.editMessage(entry.chatId, entry.messageId, "⏱ Expired — run the command again.", []);
+            }
+            catch {
+                // best-effort expiry edit
+            }
+        }
+    }, SWEEP_INTERVAL_MS);
+    sweeper.unref?.();
+}
+/** Stop the TTL sweeper. */
+export function stopButtonSweeper() {
+    if (sweeper) {
+        clearInterval(sweeper);
+        sweeper = undefined;
+    }
+}
+/** Test hook: reset the registry and stop the sweeper. */
+export function resetButtonRegistry() {
+    registry.clear();
+    stopButtonSweeper();
+}
+/** Test hook: expose active picker ids. */
+export function activePickerIds() {
+    return [...registry.keys()];
+}
+//# sourceMappingURL=buttons.js.map