@vascend/talos 0.1.0

package/dist/backend/auth.js

@@ -0,0 +1,59 @@
+// Servizio di autenticazione: lega UserStore e JWT, e fornisce l'estrazione
+// del principale (utente) da una richiesta HTTP/WS. Zero dipendenze.
+import { signToken, verifyToken } from "./crypto.js";
+import { HttpError, toPublicUser } from "./types.js";
+export class AuthService {
+    users;
+    config;
+    constructor(users, config) {
+        this.users = users;
+        this.config = config;
+    }
+    register(email, password, displayName) {
+        const user = this.users.register(email, password, displayName);
+        return this.issue(user);
+    }
+    login(email, password) {
+        const user = this.users.authenticate(email, password);
+        return this.issue(user);
+    }
+    issue(user) {
+        const { token, expiresAt } = signToken({ sub: user.id, email: user.email }, this.config.jwtSecret, this.config.tokenTtlSeconds);
+        return { token, user: toPublicUser(user), expiresAt };
+    }
+    // Verifica un token grezzo e ritorna l'utente, o null se invalido.
+    resolve(token) {
+        if (!token)
+            return null;
+        const payload = verifyToken(token, this.config.jwtSecret);
+        if (!payload)
+            return null;
+        const user = this.users.get(payload.sub);
+        if (!user)
+            return null;
+        return { payload, user };
+    }
+    // Estrae il bearer token dall'header Authorization, o dal query param `token`
+    // (usato dal client WS che non puo' impostare header custom).
+    static extractToken(req) {
+        const auth = req.headers["authorization"];
+        if (typeof auth === "string" && auth.toLowerCase().startsWith("bearer ")) {
+            return auth.slice(7).trim();
+        }
+        try {
+            const url = new URL(req.url ?? "", "http://localhost");
+            const q = url.searchParams.get("token");
+            if (q)
+                return q;
+        }
+        catch { /* url malformata */ }
+        return null;
+    }
+    // Richiede un utente autenticato: lancia 401 se assente/invalido.
+    requireUser(req) {
+        const resolved = this.resolve(AuthService.extractToken(req));
+        if (!resolved)
+            throw new HttpError(401, "autenticazione richiesta", "unauthorized");
+        return resolved.user;
+    }
+}

package/dist/backend/config.d.ts

@@ -0,0 +1,14 @@
+export interface BackendConfig {
+    readonly port: number;
+    readonly host: string;
+    readonly dataDir: string;
+    readonly sessionDir: string;
+    readonly cwd: string;
+    readonly model: string;
+    readonly jwtSecret: string;
+    readonly tokenTtlSeconds: number;
+    readonly corsOrigins: readonly string[];
+    readonly autoApprove: boolean;
+    readonly registrationToken: string;
+}
+export declare function buildBackendConfig(env?: NodeJS.ProcessEnv): BackendConfig;

package/dist/backend/config.js

@@ -0,0 +1,41 @@
+// Configurazione del backend, derivata dall'ambiente. Default ragionevoli per
+// far girare il server in locale senza setup. Zero dipendenze.
+import { homedir } from "node:os";
+import { join, isAbsolute, resolve } from "node:path";
+function resolvePath(p, base) {
+    return isAbsolute(p) ? p : resolve(base, p);
+}
+export function buildBackendConfig(env = process.env) {
+    const cwd = env["TALOS_BACKEND_CWD"] ?? process.cwd();
+    const home = homedir();
+    const dataDir = env["TALOS_BACKEND_DATA_DIR"]
+        ? resolvePath(env["TALOS_BACKEND_DATA_DIR"], cwd)
+        : join(home, ".talos", "backend");
+    const sessionDir = env["TALOS_BACKEND_SESSION_DIR"]
+        ? resolvePath(env["TALOS_BACKEND_SESSION_DIR"], cwd)
+        : join(dataDir, "sessions");
+    const port = Number(env["TALOS_BACKEND_PORT"] ?? env["PORT"] ?? 8787);
+    const ttl = Number(env["TALOS_BACKEND_TOKEN_TTL"] ?? 60 * 60 * 24 * 7); // 7 giorni
+    const corsRaw = env["TALOS_BACKEND_CORS"] ?? "";
+    const corsOrigins = corsRaw === "*" ? ["*"] : corsRaw.split(",").map((s) => s.trim()).filter(Boolean);
+    const host = env["TALOS_BACKEND_HOST"] ?? "127.0.0.1";
+    if (!["127.0.0.1", "::1", "localhost"].includes(host)) {
+        throw new Error("Talos backend shares the host workspace and must bind to loopback. Use an authenticated local tunnel for remote access.");
+    }
+    const registrationToken = env["TALOS_BACKEND_REGISTRATION_TOKEN"] ?? "";
+    if (registrationToken && registrationToken.length < 32)
+        throw new Error("Registration token must contain at least 32 characters");
+    return {
+        port: Number.isFinite(port) && port > 0 ? port : 8787,
+        host,
+        dataDir,
+        sessionDir,
+        cwd,
+        model: env["TALOS_BACKEND_MODEL"] ?? env["TALOS_MODEL"] ?? "anthropic/claude-sonnet-4-6",
+        jwtSecret: env["TALOS_BACKEND_JWT_SECRET"] ?? "",
+        tokenTtlSeconds: Number.isFinite(ttl) && ttl > 0 ? ttl : 60 * 60 * 24 * 7,
+        corsOrigins,
+        autoApprove: env["TALOS_BACKEND_AUTO_APPROVE"] === "1",
+        registrationToken,
+    };
+}

package/dist/backend/conversations.d.ts

@@ -0,0 +1,21 @@
+import { Session } from "../core/session.js";
+import { type Conversation, type ConversationMessage } from "./types.js";
+export declare class ConversationStore {
+    private readonly file;
+    private readonly sessionDir;
+    private readonly byId;
+    private constructor();
+    static open(dataDir: string, sessionDir: string): ConversationStore;
+    create(userId: string, opts: {
+        title?: string;
+        model: string;
+    }): Conversation;
+    listFor(userId: string): Conversation[];
+    require(id: string, userId: string): Conversation;
+    rename(id: string, userId: string, title: string): Conversation;
+    touch(id: string): void;
+    delete(id: string, userId: string): void;
+    openSession(id: string): Session;
+    messages(id: string, userId: string): ConversationMessage[];
+    private persist;
+}

package/dist/backend/conversations.js

@@ -0,0 +1,141 @@
+// Store delle conversazioni: metadati (titolo, proprietario, modello) su file
+// JSONL append-only, mentre il CONTENUTO del dialogo vive nelle Session
+// dell'engine (sessionDir/<id>.jsonl). La conversazione e la Session
+// condividono lo stesso id. Zero dipendenze.
+import { appendFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { Session } from "../core/session.js";
+import { newId } from "./crypto.js";
+import { HttpError } from "./types.js";
+function isDelete(e) {
+    return e.op === "delete";
+}
+export class ConversationStore {
+    file;
+    sessionDir;
+    byId = new Map();
+    constructor(file, sessionDir) {
+        this.file = file;
+        this.sessionDir = sessionDir;
+    }
+    static open(dataDir, sessionDir) {
+        mkdirSync(dataDir, { recursive: true });
+        mkdirSync(sessionDir, { recursive: true });
+        const store = new ConversationStore(join(dataDir, "conversations.jsonl"), sessionDir);
+        if (existsSync(store.file)) {
+            const raw = readFileSync(store.file, "utf8");
+            for (const line of raw.split("\n")) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const e = JSON.parse(line);
+                    if (isDelete(e))
+                        store.byId.delete(e.id);
+                    else
+                        store.byId.set(e.id, stripOp(e));
+                }
+                catch { /* riga corrotta */ }
+            }
+        }
+        return store;
+    }
+    // Crea una conversazione per l'utente e la Session sottostante.
+    create(userId, opts) {
+        const id = `s-${newId("conv").split("_")[1]}`;
+        Session.create(this.sessionDir, id); // garantisce il file della sessione
+        const now = Date.now();
+        const conv = {
+            id,
+            userId,
+            title: (opts.title ?? "Nuova conversazione").slice(0, 200),
+            model: opts.model,
+            createdAt: now,
+            updatedAt: now,
+        };
+        this.persist(conv);
+        return conv;
+    }
+    // Conversazioni di un utente, dalla piu' recente.
+    listFor(userId) {
+        return [...this.byId.values()]
+            .filter((c) => c.userId === userId)
+            .sort((a, b) => b.updatedAt - a.updatedAt);
+    }
+    // Recupera una conversazione assicurando che appartenga all'utente.
+    require(id, userId) {
+        const conv = this.byId.get(id);
+        if (!conv)
+            throw new HttpError(404, "conversazione non trovata", "not_found");
+        if (conv.userId !== userId)
+            throw new HttpError(403, "accesso negato", "forbidden");
+        return conv;
+    }
+    rename(id, userId, title) {
+        const conv = this.require(id, userId);
+        const next = { ...conv, title: title.slice(0, 200), updatedAt: Date.now() };
+        this.persist(next);
+        return next;
+    }
+    touch(id) {
+        const conv = this.byId.get(id);
+        if (!conv)
+            return;
+        this.persist({ ...conv, updatedAt: Date.now() });
+    }
+    delete(id, userId) {
+        this.require(id, userId);
+        this.byId.delete(id);
+        appendFileSync(this.file, JSON.stringify({ op: "delete", id }) + "\n", "utf8");
+    }
+    // Apre (o ricarica) la Session dell'engine per questa conversazione.
+    openSession(id) {
+        return Session.load(this.sessionDir, id);
+    }
+    // Proiezione dei messaggi del dialogo per il client (storia lineare).
+    messages(id, userId) {
+        this.require(id, userId);
+        const session = Session.load(this.sessionDir, id);
+        return session.history().map(projectMessage).filter((m) => m !== null);
+    }
+    persist(conv) {
+        this.byId.set(conv.id, conv);
+        appendFileSync(this.file, JSON.stringify({ ...conv, op: "upsert" }) + "\n", "utf8");
+    }
+}
+function stripOp(e) {
+    const { op, ...conv } = e;
+    void op;
+    return conv;
+}
+// Converte un Message dell'engine nella proiezione del client. Salta i messaggi
+// di sistema/riepilogo che non aggiungono valore al dialogo.
+function projectMessage(m) {
+    if (m.role === "system")
+        return null;
+    const text = m.content
+        .filter((p) => p.type === "text")
+        .map((p) => p.text)
+        .join("")
+        .trim();
+    const toolCalls = m.content
+        .filter((p) => p.type === "tool_call")
+        .map((p) => {
+        const c = p;
+        return { id: c.id, name: c.name, input: c.input };
+    });
+    const toolResults = m.content
+        .filter((p) => p.type === "tool_result")
+        .map((p) => {
+        const r = p;
+        return { callId: r.callId, output: r.output, isError: r.isError };
+    });
+    if (!text && !toolCalls.length && !toolResults.length)
+        return null;
+    return {
+        role: m.role,
+        text,
+        ...(toolCalls.length ? { toolCalls } : {}),
+        ...(toolResults.length ? { toolResults } : {}),
+        ts: Date.now(),
+    };
+}

package/dist/backend/crypto.d.ts

@@ -0,0 +1,9 @@
+import type { AuthTokenPayload } from "./types.js";
+export declare function hashPassword(password: string): string;
+export declare function verifyPassword(password: string, stored: string): boolean;
+export declare function newId(prefix: string): string;
+export declare function signToken(payload: Omit<AuthTokenPayload, "iat" | "exp">, secret: string, ttlSeconds: number): {
+    token: string;
+    expiresAt: number;
+};
+export declare function verifyToken(token: string, secret: string): AuthTokenPayload | null;

package/dist/backend/crypto.js

@@ -0,0 +1,68 @@
+// Primitive crittografiche del backend: hashing password (scrypt) e JWT
+// (HS256) implementati con il solo modulo `node:crypto`. Zero dipendenze.
+import { scryptSync, randomBytes, timingSafeEqual, createHmac, randomUUID } from "node:crypto";
+const SCRYPT_KEYLEN = 64;
+// Hash di una password: "salt:hash" in hex. scrypt e' deliberatamente lento.
+export function hashPassword(password) {
+    const salt = randomBytes(16);
+    const hash = scryptSync(password, salt, SCRYPT_KEYLEN);
+    return `${salt.toString("hex")}:${hash.toString("hex")}`;
+}
+// Verifica una password contro l'hash memorizzato, in tempo costante.
+export function verifyPassword(password, stored) {
+    const [saltHex, hashHex] = stored.split(":");
+    if (!saltHex || !hashHex)
+        return false;
+    const salt = Buffer.from(saltHex, "hex");
+    const expected = Buffer.from(hashHex, "hex");
+    const actual = scryptSync(password, salt, expected.length);
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+export function newId(prefix) {
+    return `${prefix}_${randomUUID().replace(/-/g, "").slice(0, 24)}`;
+}
+// --- JWT HS256 ---------------------------------------------------------------
+function base64url(input) {
+    return Buffer.from(input).toString("base64url");
+}
+function sign(data, secret) {
+    return createHmac("sha256", secret).update(data).digest("base64url");
+}
+// Emette un JWT firmato HS256. `payload` senza iat/exp: li calcoliamo qui.
+export function signToken(payload, secret, ttlSeconds) {
+    const iat = Math.floor(Date.now() / 1000);
+    const exp = iat + ttlSeconds;
+    const full = { ...payload, iat, exp };
+    const header = base64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+    const body = base64url(JSON.stringify(full));
+    const signature = sign(`${header}.${body}`, secret);
+    return { token: `${header}.${body}.${signature}`, expiresAt: exp * 1000 };
+}
+// Verifica firma e scadenza; ritorna il payload o null se invalido/scaduto.
+export function verifyToken(token, secret) {
+    if (token.length > 8192 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token))
+        return null;
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    const [header, body, signature] = parts;
+    const expected = sign(`${header}.${body}`, secret);
+    const a = Buffer.from(signature);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length || !timingSafeEqual(a, b))
+        return null;
+    try {
+        const metadata = JSON.parse(Buffer.from(header, "base64url").toString("utf8"));
+        if (metadata?.alg !== "HS256" || metadata?.typ !== "JWT")
+            return null;
+        const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+        if (!payload || typeof payload.exp !== "number" || !Number.isFinite(payload.exp)
+            || payload.exp * 1000 <= Date.now() || typeof payload.sub !== "string" || !payload.sub
+            || typeof payload.iat !== "number" || !Number.isFinite(payload.iat))
+            return null;
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/backend/engine.d.ts

@@ -0,0 +1,13 @@
+import type { AgentEvent, EventSink } from "../core/types.js";
+import type { BackendConfig } from "./config.js";
+export declare class EngineBridge {
+    private readonly config;
+    private readonly live;
+    constructor(config: BackendConfig);
+    private ensure;
+    isBusy(conversationId: string): boolean;
+    prompt(conversationId: string, model: string, text: string, sink: EventSink): Promise<void>;
+    abort(conversationId: string): boolean;
+    promptCollect(conversationId: string, model: string, text: string): Promise<AgentEvent[]>;
+    evict(conversationId: string): void;
+}

package/dist/backend/engine.js

@@ -0,0 +1,78 @@
+// Bridge verso l'engine vascend-talos. Per ogni conversazione costruisce un
+// Harness (bootstrap) legato alla Session di quella conversazione, ed esegue i
+// turni dell'agente (runTurn) inoltrando gli AgentEvent ai sink registrati
+// (WebSocket o accumulatore HTTP). Zero dipendenze a runtime: tutto via SDK.
+import { bootstrap } from "../core/bootstrap.js";
+import { runTurn } from "../core/agent.js";
+export class EngineBridge {
+    config;
+    live = new Map();
+    constructor(config) {
+        this.config = config;
+    }
+    async ensure(conversationId, model) {
+        const existing = this.live.get(conversationId);
+        if (existing)
+            return existing;
+        const harness = await bootstrap({
+            cwd: this.config.cwd,
+            model,
+            sessionId: conversationId,
+            env: { ...process.env, TALOS_BACKEND_SESSION_DIR: this.config.sessionDir },
+        });
+        // La Session vive in sessionDir del backend: forziamo la config a puntarci
+        // cosi' bootstrap carica/persiste la conversazione giusta.
+        if (harness.config.sessionDir !== this.config.sessionDir) {
+            harness.config = { ...harness.config, sessionDir: this.config.sessionDir };
+            harness.loadSession(conversationId);
+        }
+        const live = { harness, controller: null };
+        this.live.set(conversationId, live);
+        return live;
+    }
+    // True se un giro e' gia' in corso per la conversazione.
+    isBusy(conversationId) {
+        return this.live.get(conversationId)?.controller != null;
+    }
+    // Esegue un prompt e fa lo streaming degli eventi al sink. Risolve a giro
+    // concluso (done/error). Rifiuta se un altro giro e' attivo.
+    async prompt(conversationId, model, text, sink) {
+        const live = await this.ensure(conversationId, model);
+        if (live.controller) {
+            sink({ type: "error", message: "un giro e' gia' in corso per questa conversazione" });
+            return;
+        }
+        const controller = new AbortController();
+        live.controller = controller;
+        const deps = live.harness.deps(async () => this.config.autoApprove);
+        try {
+            await runTurn(deps, text, sink, controller.signal);
+        }
+        catch (err) {
+            sink({ type: "error", message: err.message });
+        }
+        finally {
+            live.controller = null;
+        }
+    }
+    // Interrompe il giro in corso (se presente).
+    abort(conversationId) {
+        const live = this.live.get(conversationId);
+        if (live?.controller) {
+            live.controller.abort();
+            return true;
+        }
+        return false;
+    }
+    // Esegue un prompt accumulando tutti gli eventi (uso HTTP sincrono).
+    async promptCollect(conversationId, model, text) {
+        const events = [];
+        await this.prompt(conversationId, model, text, (e) => events.push(e));
+        return events;
+    }
+    // Rilascia lo stato caldo di una conversazione (es. dopo delete).
+    evict(conversationId) {
+        this.abort(conversationId);
+        this.live.delete(conversationId);
+    }
+}

package/dist/backend/http.d.ts

@@ -0,0 +1,25 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { BackendConfig } from "./config.js";
+export interface RouteMatch {
+    readonly params: Record<string, string>;
+}
+export declare function readJson<T = unknown>(req: IncomingMessage): Promise<T>;
+export declare function readBinary(req: IncomingMessage, maxBytes?: number): Promise<Buffer>;
+export declare function applyCors(res: ServerResponse, origin: string | undefined, config: BackendConfig): void;
+export declare function sendJson(res: ServerResponse, status: number, body: unknown): void;
+export declare function sendBinary(res: ServerResponse, status: number, data: Buffer, mime: string, filename?: string): void;
+export declare function sendError(res: ServerResponse, err: unknown): void;
+export type Method = "GET" | "POST" | "PATCH" | "DELETE";
+export type Handler = (req: IncomingMessage, res: ServerResponse, match: RouteMatch) => Promise<void> | void;
+export declare class Router {
+    private readonly routes;
+    add(method: Method, pattern: string, handler: Handler): this;
+    get(p: string, h: Handler): this;
+    post(p: string, h: Handler): this;
+    patch(p: string, h: Handler): this;
+    delete(p: string, h: Handler): this;
+    resolve(method: string, path: string): {
+        handler: Handler;
+        match: RouteMatch;
+    } | null;
+}

package/dist/backend/http.js

@@ -0,0 +1,112 @@
+// Utilita' HTTP minimali sopra node:http: parsing del body JSON, risposta
+// JSON, gestione CORS e matching di route con parametri. Zero dipendenze.
+import { HttpError } from "./types.js";
+// Legge e parsa il body come JSON (limite anti-abuso 1MB). {} se vuoto.
+export async function readJson(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > 1_000_000)
+            throw new HttpError(413, "body troppo grande", "payload_too_large");
+        chunks.push(chunk);
+    }
+    const raw = Buffer.concat(chunks).toString("utf8").trim();
+    if (!raw)
+        return {};
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        throw new HttpError(400, "JSON non valido", "invalid_json");
+    }
+}
+// Legge il body raw come Buffer binario (per upload di asset). Il limite e'
+// parametrico (default 10MB) per non bloccare asset di esempio piu' grandi del
+// limite JSON. Ritorna un Buffer vuoto se non c'e' body.
+export async function readBinary(req, maxBytes = 10 * 1024 * 1024) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > maxBytes)
+            throw new HttpError(413, "body troppo grande", "payload_too_large");
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks);
+}
+export function applyCors(res, origin, config) {
+    const allowed = config.corsOrigins.includes("*")
+        ? "*"
+        : origin && config.corsOrigins.includes(origin)
+            ? origin
+            : config.corsOrigins[0] ?? "";
+    if (allowed)
+        res.setHeader("Access-Control-Allow-Origin", allowed);
+    res.setHeader("Access-Control-Allow-Methods", "GET,POST,PATCH,DELETE,OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+    res.setHeader("Access-Control-Max-Age", "86400");
+}
+export function sendJson(res, status, body) {
+    const payload = JSON.stringify(body);
+    res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
+    res.end(payload);
+}
+// Invia un body binario (download di asset) con MIME e nome file opzionali.
+export function sendBinary(res, status, data, mime, filename) {
+    const headers = {
+        "Content-Type": mime || "application/octet-stream",
+        "Content-Length": String(data.length),
+    };
+    if (filename) {
+        const safe = filename.replace(/["\\\r\n]/g, "_");
+        headers["Content-Disposition"] = `attachment; filename="${safe}"`;
+    }
+    res.writeHead(status, headers);
+    res.end(data);
+}
+export function sendError(res, err) {
+    if (err instanceof HttpError) {
+        sendJson(res, err.status, { error: err.message, code: err.code });
+        return;
+    }
+    const message = err instanceof Error ? err.message : "errore interno";
+    sendJson(res, 500, { error: message, code: "internal_error" });
+}
+// Router minimale: pattern come "/api/conversations/:id". Niente regex esotiche.
+export class Router {
+    routes = [];
+    add(method, pattern, handler) {
+        this.routes.push({ method, pattern, segments: pattern.split("/").filter(Boolean), handler });
+        return this;
+    }
+    get(p, h) { return this.add("GET", p, h); }
+    post(p, h) { return this.add("POST", p, h); }
+    patch(p, h) { return this.add("PATCH", p, h); }
+    delete(p, h) { return this.add("DELETE", p, h); }
+    // Trova la route corrispondente a metodo+path, estraendo i parametri.
+    resolve(method, path) {
+        const parts = path.split("/").filter(Boolean);
+        for (const route of this.routes) {
+            if (route.method !== method)
+                continue;
+            if (route.segments.length !== parts.length)
+                continue;
+            const params = {};
+            let ok = true;
+            for (let i = 0; i < route.segments.length; i += 1) {
+                const seg = route.segments[i];
+                const val = parts[i];
+                if (seg.startsWith(":"))
+                    params[seg.slice(1)] = decodeURIComponent(val);
+                else if (seg !== val) {
+                    ok = false;
+                    break;
+                }
+            }
+            if (ok)
+                return { handler: route.handler, match: { params } };
+        }
+        return null;
+    }
+}

package/dist/backend/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/backend/index.js

@@ -0,0 +1,24 @@
+// Entrypoint del backend: avvia il server e gestisce lo shutdown pulito.
+// Esegui con: bun run src/backend/index.ts  (o tramite lo script npm).
+import { createBackend } from "./server.js";
+async function main() {
+    const backend = createBackend(process.env);
+    const { host, port } = await backend.listen();
+    process.stdout.write(`[backend] in ascolto su http://${host}:${port}  (WS: ws://${host}:${port}/ws)\n`);
+    process.stdout.write(`[backend] modello di default: ${backend.config.model}\n`);
+    const shutdown = async (sig) => {
+        process.stdout.write(`\n[backend] ${sig}: chiusura...\n`);
+        try {
+            await backend.close();
+        }
+        finally {
+            process.exit(0);
+        }
+    };
+    process.on("SIGINT", () => void shutdown("SIGINT"));
+    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+}
+main().catch((err) => {
+    process.stderr.write(`[backend] errore fatale: ${err.message}\n`);
+    process.exit(1);
+});

package/dist/backend/routes.d.ts

@@ -0,0 +1,14 @@
+import { Router } from "./http.js";
+import type { AuthService } from "./auth.js";
+import type { ConversationStore } from "./conversations.js";
+import type { AssetStore } from "./assets.js";
+import type { EngineBridge } from "./engine.js";
+import type { BackendConfig } from "./config.js";
+export interface RouteDeps {
+    readonly auth: AuthService;
+    readonly conversations: ConversationStore;
+    readonly assets: AssetStore;
+    readonly engine: EngineBridge;
+    readonly config: BackendConfig;
+}
+export declare function buildRouter(deps: RouteDeps): Router;