@vascend/talos 0.1.0

package/dist/backend/routes.js

@@ -0,0 +1,169 @@
+// Definizione delle route REST. Collega Router, AuthService, ConversationStore
+// ed EngineBridge. Le risposte sono JSON; gli errori passano da HttpError.
+import { Router, readJson, readBinary, sendJson, sendBinary } from "./http.js";
+import { HttpError, toPublicAsset } from "./types.js";
+import { timingSafeEqual } from "node:crypto";
+function str(body, key) {
+    const v = body[key];
+    if (typeof v !== "string" || !v.trim()) {
+        throw new HttpError(400, `campo "${key}" mancante o non valido`, "invalid_field");
+    }
+    return v;
+}
+// Legge un header HTTP come stringa (primo valore se multiplo).
+function header(req, name) {
+    const v = req.headers[name.toLowerCase()];
+    return Array.isArray(v) ? v[0] : v;
+}
+const ASSET_KINDS = ["image", "file", "snippet"];
+function parseKind(raw, fallback) {
+    if (raw && ASSET_KINDS.includes(raw))
+        return raw;
+    return fallback;
+}
+export function buildRouter(deps) {
+    const { auth, conversations, assets, engine, config } = deps;
+    const r = new Router();
+    // --- Health --------------------------------------------------------------
+    r.get("/api/health", (_req, res) => {
+        sendJson(res, 200, { status: "ok", model: config.model, ts: Date.now() });
+    });
+    // --- Auth ----------------------------------------------------------------
+    r.post("/api/auth/register", async (req, res) => {
+        const supplied = Buffer.from(header(req, "x-talos-registration-token") ?? "");
+        const expected = Buffer.from(config.registrationToken);
+        if (!expected.length || supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
+            throw new HttpError(403, "registration requires the server owner's token", "registration_disabled");
+        }
+        const body = await readJson(req);
+        const result = auth.register(str(body, "email"), str(body, "password"), typeof body["displayName"] === "string" ? body["displayName"] : undefined);
+        sendJson(res, 201, result);
+    });
+    r.post("/api/auth/login", async (req, res) => {
+        const body = await readJson(req);
+        const result = auth.login(str(body, "email"), str(body, "password"));
+        sendJson(res, 200, result);
+    });
+    r.get("/api/auth/me", (req, res) => {
+        const user = auth.requireUser(req);
+        sendJson(res, 200, { id: user.id, email: user.email, displayName: user.displayName, createdAt: user.createdAt });
+    });
+    // --- Conversazioni -------------------------------------------------------
+    r.get("/api/conversations", (req, res) => {
+        const user = auth.requireUser(req);
+        sendJson(res, 200, { conversations: conversations.listFor(user.id) });
+    });
+    r.post("/api/conversations", async (req, res) => {
+        const user = auth.requireUser(req);
+        const body = await readJson(req);
+        const conv = conversations.create(user.id, {
+            title: typeof body["title"] === "string" ? body["title"] : undefined,
+            model: typeof body["model"] === "string" && body["model"] ? body["model"] : config.model,
+        });
+        sendJson(res, 201, conv);
+    });
+    r.get("/api/conversations/:id", (req, res, m) => {
+        const user = auth.requireUser(req);
+        const conv = conversations.require(m.params["id"], user.id);
+        const messages = conversations.messages(conv.id, user.id);
+        sendJson(res, 200, { conversation: conv, messages });
+    });
+    r.patch("/api/conversations/:id", async (req, res, m) => {
+        const user = auth.requireUser(req);
+        const body = await readJson(req);
+        const conv = conversations.rename(m.params["id"], user.id, str(body, "title"));
+        sendJson(res, 200, conv);
+    });
+    r.delete("/api/conversations/:id", (req, res, m) => {
+        const user = auth.requireUser(req);
+        const id = m.params["id"];
+        conversations.delete(id, user.id);
+        engine.evict(id);
+        sendJson(res, 200, { deleted: id });
+    });
+    // --- Messaggi (prompt sincrono: accumula gli eventi del giro) -------------
+    // Per lo streaming in tempo reale usare il WebSocket /ws. Questa rotta esegue
+    // il giro e ritorna gli eventi raccolti + i messaggi finali del dialogo.
+    r.post("/api/conversations/:id/messages", async (req, res, m) => {
+        const user = auth.requireUser(req);
+        const id = m.params["id"];
+        const conv = conversations.require(id, user.id);
+        const body = await readJson(req);
+        const text = str(body, "text");
+        if (engine.isBusy(id))
+            throw new HttpError(409, "giro gia' in corso", "busy");
+        const events = await engine.promptCollect(id, conv.model, text);
+        conversations.touch(id);
+        const messages = conversations.messages(id, user.id);
+        sendJson(res, 200, { events, messages });
+    });
+    // --- Asset di una Vision -------------------------------------------------
+    // Asset di esempio (immagini, file campione, snippet) associati a una Vision.
+    // Lista degli asset di una Vision (solo metadati pubblici).
+    r.get("/api/visions/:visionId/assets", (req, res, m) => {
+        const user = auth.requireUser(req);
+        const visionId = m.params["visionId"];
+        const list = assets.listFor(visionId, user.id).map(toPublicAsset);
+        sendJson(res, 200, { assets: list });
+    });
+    // Upload di un asset. Due modalita':
+    //  - snippet: body JSON { name, snippet, mime?, description? }
+    //  - image/file: body BINARIO grezzo; metadati dagli header:
+    //      X-Asset-Kind (image|file), X-Asset-Name, Content-Type, X-Asset-Description
+    r.post("/api/visions/:visionId/assets", async (req, res, m) => {
+        const user = auth.requireUser(req);
+        const visionId = m.params["visionId"];
+        const contentType = (header(req, "content-type") ?? "").split(";")[0].trim();
+        if (contentType === "application/json") {
+            const body = await readJson(req);
+            const kind = parseKind(typeof body["kind"] === "string" ? body["kind"] : undefined, "snippet");
+            const asset = assets.create(visionId, user.id, {
+                kind,
+                name: str(body, "name"),
+                ...(typeof body["snippet"] === "string" ? { snippet: body["snippet"] } : {}),
+                ...(typeof body["mime"] === "string" ? { mime: body["mime"] } : {}),
+                ...(typeof body["description"] === "string" ? { description: body["description"] } : {}),
+            });
+            sendJson(res, 201, toPublicAsset(asset));
+            return;
+        }
+        // Upload binario.
+        const kind = parseKind(header(req, "x-asset-kind"), "file");
+        if (kind === "snippet") {
+            throw new HttpError(400, "uno snippet va caricato come application/json", "invalid_field");
+        }
+        const name = header(req, "x-asset-name");
+        if (!name)
+            throw new HttpError(400, 'header "X-Asset-Name" mancante', "invalid_field");
+        const data = await readBinary(req);
+        const asset = assets.create(visionId, user.id, {
+            kind,
+            name,
+            data,
+            ...(contentType ? { mime: contentType } : {}),
+            ...(header(req, "x-asset-description") ? { description: header(req, "x-asset-description") } : {}),
+        });
+        sendJson(res, 201, toPublicAsset(asset));
+    });
+    // Metadati di un singolo asset.
+    r.get("/api/assets/:id", (req, res, m) => {
+        const user = auth.requireUser(req);
+        const asset = assets.require(m.params["id"], user.id);
+        sendJson(res, 200, toPublicAsset(asset));
+    });
+    // Download del contenuto binario di un asset image/file.
+    r.get("/api/assets/:id/blob", (req, res, m) => {
+        const user = auth.requireUser(req);
+        const asset = assets.require(m.params["id"], user.id);
+        const data = assets.readBlob(asset.id, user.id);
+        sendBinary(res, 200, data, asset.mime, asset.name);
+    });
+    // Cancellazione di un asset (metadati + eventuale blob).
+    r.delete("/api/assets/:id", (req, res, m) => {
+        const user = auth.requireUser(req);
+        const id = m.params["id"];
+        assets.delete(id, user.id);
+        sendJson(res, 200, { deleted: id });
+    });
+    return r;
+}

package/dist/backend/sdk.d.ts

@@ -0,0 +1,12 @@
+export { createBackend } from "./server.js";
+export type { BackendServer } from "./server.js";
+export { buildBackendConfig } from "./config.js";
+export type { BackendConfig } from "./config.js";
+export { UserStore } from "./users.js";
+export { ConversationStore } from "./conversations.js";
+export { AuthService } from "./auth.js";
+export { EngineBridge } from "./engine.js";
+export { buildRouter } from "./routes.js";
+export { Router } from "./http.js";
+export { HttpError, toPublicUser, } from "./types.js";
+export type { User, PublicUser, Conversation, ConversationMessage, AuthResult, AuthTokenPayload, WsClientMessage, WsServerMessage, ApiError, } from "./types.js";

package/dist/backend/sdk.js

@@ -0,0 +1,11 @@
+// Superficie pubblica del backend, per embeddarlo in un altro processo o per
+// i test. Riesporta i servizi e i tipi del protocollo.
+export { createBackend } from "./server.js";
+export { buildBackendConfig } from "./config.js";
+export { UserStore } from "./users.js";
+export { ConversationStore } from "./conversations.js";
+export { AuthService } from "./auth.js";
+export { EngineBridge } from "./engine.js";
+export { buildRouter } from "./routes.js";
+export { Router } from "./http.js";
+export { HttpError, toPublicUser, } from "./types.js";

package/dist/backend/server.d.ts

@@ -0,0 +1,12 @@
+import { type Server } from "node:http";
+import { type BackendConfig } from "./config.js";
+export interface BackendServer {
+    readonly config: BackendConfig;
+    readonly server: Server;
+    listen(): Promise<{
+        host: string;
+        port: number;
+    }>;
+    close(): Promise<void>;
+}
+export declare function createBackend(env?: NodeJS.ProcessEnv): BackendServer;

package/dist/backend/server.js

@@ -0,0 +1,91 @@
+// Assemblaggio del backend: HTTP server (node:http) con router REST e upgrade
+// WebSocket sullo stesso listener. Costruisce tutti i servizi e li collega.
+// Zero dipendenze a runtime.
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { buildBackendConfig } from "./config.js";
+import { UserStore } from "./users.js";
+import { ConversationStore } from "./conversations.js";
+import { AssetStore } from "./assets.js";
+import { RoomMemoryAssetSink } from "./asset-events.js";
+import { AuthService } from "./auth.js";
+import { EngineBridge } from "./engine.js";
+import { buildRouter } from "./routes.js";
+import { applyCors, sendError, sendJson } from "./http.js";
+import { handleUpgrade, isChatUpgrade } from "./ws-handler.js";
+export function createBackend(env = process.env) {
+    const config = buildBackendConfig(env);
+    if (!config.jwtSecret) {
+        // Segreto effimero: i token non sopravvivono al riavvio. Avviso esplicito.
+        config.jwtSecret = randomSecret();
+        process.stderr.write("[backend] TALOS_BACKEND_JWT_SECRET non impostato: uso un segreto effimero (i token non sopravvivono al riavvio)\n");
+    }
+    const users = UserStore.open(config.dataDir);
+    const conversations = ConversationStore.open(config.dataDir, config.sessionDir);
+    // Sink degli eventi asset: ogni upload/link/analisi/versione diventa una
+    // stanza di memoria (RoomMemory) richiamabile via recall, in uno store
+    // dedicato "assets" sotto sessionDir.
+    const assetSink = RoomMemoryAssetSink.open(config.sessionDir, "assets");
+    const assets = AssetStore.open(config.dataDir, assetSink);
+    const auth = new AuthService(users, config);
+    const engine = new EngineBridge(config);
+    const router = buildRouter({ auth, conversations, assets, engine, config });
+    const server = createServer((req, res) => {
+        const origin = req.headers["origin"];
+        if (origin && !config.corsOrigins.includes(origin)) {
+            sendJson(res, 403, { error: "origin not allowed" });
+            return;
+        }
+        applyCors(res, typeof origin === "string" ? origin : undefined, config);
+        if (req.method === "OPTIONS") {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        void handleRequest(req, res, router);
+    });
+    // Upgrade WebSocket sullo stesso listener (path /ws).
+    server.on("upgrade", (req, socket) => {
+        const origin = req.headers["origin"];
+        if (origin && !config.corsOrigins.includes(origin)) {
+            socket.end("HTTP/1.1 403 Forbidden\r\n\r\n");
+            return;
+        }
+        if (!isChatUpgrade(req)) {
+            socket.end("HTTP/1.1 404 Not Found\r\n\r\n");
+            return;
+        }
+        handleUpgrade(req, socket, { auth, conversations, engine });
+    });
+    return {
+        config,
+        server,
+        listen() {
+            return new Promise((resolve) => {
+                server.listen(config.port, config.host, () => resolve({ host: config.host, port: config.port }));
+            });
+        },
+        close() {
+            return new Promise((resolve, reject) => {
+                server.close((err) => (err ? reject(err) : resolve()));
+            });
+        },
+    };
+}
+async function handleRequest(req, res, router) {
+    try {
+        const url = new URL(req.url ?? "", "http://localhost");
+        const resolved = router.resolve(req.method ?? "GET", url.pathname);
+        if (!resolved) {
+            sendJson(res, 404, { error: "rotta non trovata", code: "not_found" });
+            return;
+        }
+        await resolved.handler(req, res, resolved.match);
+    }
+    catch (err) {
+        sendError(res, err);
+    }
+}
+function randomSecret() {
+    return randomBytes(32).toString("base64url");
+}

package/dist/backend/temp-image-store.d.ts

@@ -0,0 +1,46 @@
+export declare const DEFAULT_TTL_MS: number;
+export declare const DEFAULT_MAX_BYTES: number;
+export interface TempImageStoreOptions {
+    readonly dir?: string;
+    readonly ttlMs?: number;
+    readonly maxBytes?: number;
+    readonly sweepIntervalMs?: number;
+    readonly now?: () => number;
+}
+export interface StoreInput {
+    readonly mime?: string;
+    readonly ttlMs?: number;
+}
+export interface TempImageRef {
+    readonly id: string;
+    readonly path: string;
+    readonly size: number;
+    readonly mime: string;
+    readonly createdAt: number;
+    readonly expiresAt: number;
+}
+export declare class TempStorageError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+export declare class TempImageStore {
+    private readonly dir;
+    private readonly ttlMs;
+    private readonly maxBytes;
+    private readonly now;
+    private readonly byId;
+    private sweeper;
+    private constructor();
+    static open(opts?: TempImageStoreOptions): TempImageStore;
+    store(bytes: Buffer | Uint8Array, input?: StoreInput): TempImageRef;
+    getPath(id: string): string | null;
+    get(id: string): TempImageRef | null;
+    read(id: string): Buffer;
+    delete(id: string): boolean;
+    sweep(): number;
+    clear(): number;
+    get size(): number;
+    startSweeper(intervalMs: number): void;
+    stopSweeper(): void;
+    private resolveLive;
+}

package/dist/backend/temp-image-store.js

@@ -0,0 +1,197 @@
+// Servizio di storage TEMPORANEO per i bytes di un'immagine. Salva i byte in un
+// file con path univoco sotto una directory temporanea dedicata e ne restituisce
+// il path; gestisce scadenza (TTL) e cleanup. Pensato per dati effimeri (es.
+// immagini intercettate/incollate da trasformare prima dell'uso), NON per
+// persistenza durevole.
+//
+// Stile allineato a AssetStore: zero dipendenze a runtime, solo API native di
+// Node (node:fs, node:os, node:path, node:crypto). Immutabilita' verso l'esterno:
+// i metadati restituiti sono oggetti freschi.
+import { mkdirSync, writeFileSync, readFileSync, existsSync, rmSync, readdirSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+// TTL di default: 10 minuti. Sufficiente per un round-trip di elaborazione.
+export const DEFAULT_TTL_MS = 10 * 60 * 1000;
+// Limite per un singolo file temporaneo (16 MB).
+export const DEFAULT_MAX_BYTES = 16 * 1024 * 1024;
+// Prefisso del nome dei file temporanei: facilita lo sweep e l'isolamento.
+const FILE_PREFIX = "tmpimg_";
+// Mappa minima da mime a estensione, solo per leggibilita' del path (il
+// contenuto resta autoritativo). Sconosciuti -> ".bin".
+const EXT_BY_MIME = {
+    "image/png": "png",
+    "image/jpeg": "jpg",
+    "image/jpg": "jpg",
+    "image/gif": "gif",
+    "image/webp": "webp",
+    "image/svg+xml": "svg",
+    "image/avif": "avif",
+    "image/bmp": "bmp",
+    "image/x-icon": "ico",
+    "image/tiff": "tiff",
+};
+export class TempStorageError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "TempStorageError";
+    }
+}
+function extForMime(mime) {
+    if (!mime)
+        return "bin";
+    return EXT_BY_MIME[mime.toLowerCase()] ?? "bin";
+}
+export class TempImageStore {
+    dir;
+    ttlMs;
+    maxBytes;
+    now;
+    // Indice in memoria dei file vivi, per id. La fonte di verita' del contenuto
+    // resta il filesystem; questo accelera lookup e scadenza.
+    byId = new Map();
+    sweeper = null;
+    constructor(dir, ttlMs, maxBytes, now) {
+        this.dir = dir;
+        this.ttlMs = ttlMs;
+        this.maxBytes = maxBytes;
+        this.now = now;
+    }
+    // Apre (e crea) lo store. Avvia opzionalmente lo sweeper periodico.
+    static open(opts = {}) {
+        const dir = opts.dir ?? join(tmpdir(), "talos-temp-images");
+        mkdirSync(dir, { recursive: true });
+        const store = new TempImageStore(dir, opts.ttlMs && opts.ttlMs > 0 ? opts.ttlMs : DEFAULT_TTL_MS, opts.maxBytes && opts.maxBytes > 0 ? opts.maxBytes : DEFAULT_MAX_BYTES, opts.now ?? Date.now);
+        if (opts.sweepIntervalMs && opts.sweepIntervalMs > 0) {
+            store.startSweeper(opts.sweepIntervalMs);
+        }
+        return store;
+    }
+    // Salva i bytes in un path temporaneo univoco e ritorna i metadati (incluso
+    // il path). Questo e' il punto centrale del servizio.
+    store(bytes, input = {}) {
+        const data = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
+        if (data.length === 0) {
+            throw new TempStorageError("nessun byte da salvare", "empty");
+        }
+        if (data.length > this.maxBytes) {
+            throw new TempStorageError("immagine troppo grande", "payload_too_large");
+        }
+        const id = randomUUID().replace(/-/g, "");
+        const mime = input.mime ?? "application/octet-stream";
+        const ext = extForMime(input.mime);
+        const path = join(this.dir, `${FILE_PREFIX}${id}.${ext}`);
+        const now = this.now();
+        const ttl = input.ttlMs && input.ttlMs > 0 ? input.ttlMs : this.ttlMs;
+        writeFileSync(path, data);
+        const ref = {
+            id,
+            path,
+            size: data.length,
+            mime,
+            createdAt: now,
+            expiresAt: now + ttl,
+        };
+        this.byId.set(id, ref);
+        return { ...ref };
+    }
+    // Ritorna il path del file se ancora vivo (non scaduto e presente su disco).
+    // Se scaduto, lo elimina e ritorna null.
+    getPath(id) {
+        const ref = this.resolveLive(id);
+        return ref ? ref.path : null;
+    }
+    // Ritorna i metadati del file se vivo, altrimenti null (cleanup se scaduto).
+    get(id) {
+        const ref = this.resolveLive(id);
+        return ref ? { ...ref } : null;
+    }
+    // Legge i bytes del file se vivo. Lancia se mancante/scaduto.
+    read(id) {
+        const ref = this.resolveLive(id);
+        if (!ref)
+            throw new TempStorageError("file temporaneo non trovato o scaduto", "not_found");
+        return readFileSync(ref.path);
+    }
+    // Cancella un singolo file (idempotente). Ritorna true se qualcosa e' stato
+    // rimosso dall'indice.
+    delete(id) {
+        const ref = this.byId.get(id);
+        this.byId.delete(id);
+        if (ref && existsSync(ref.path))
+            rmSync(ref.path, { force: true });
+        return ref !== undefined;
+    }
+    // Elimina tutti i file scaduti rispetto a `now`. Ritorna il numero rimosso.
+    // Considera sia l'indice in memoria sia eventuali orfani su disco col prefisso.
+    sweep() {
+        const now = this.now();
+        let removed = 0;
+        for (const [id, ref] of this.byId) {
+            if (ref.expiresAt <= now) {
+                this.byId.delete(id);
+                if (existsSync(ref.path))
+                    rmSync(ref.path, { force: true });
+                removed += 1;
+            }
+        }
+        return removed;
+    }
+    // Cancella TUTTI i file temporanei gestiti (indice + file col prefisso nella
+    // dir). Ritorna il numero di file rimossi dal disco.
+    clear() {
+        let removed = 0;
+        for (const ref of this.byId.values()) {
+            if (existsSync(ref.path)) {
+                rmSync(ref.path, { force: true });
+                removed += 1;
+            }
+        }
+        this.byId.clear();
+        // Rimuove anche eventuali orfani col nostro prefisso.
+        if (existsSync(this.dir)) {
+            for (const name of readdirSync(this.dir)) {
+                if (name.startsWith(FILE_PREFIX)) {
+                    rmSync(join(this.dir, name), { force: true });
+                    removed += 1;
+                }
+            }
+        }
+        return removed;
+    }
+    // Numero di file vivi nell'indice (senza tener conto della scadenza).
+    get size() {
+        return this.byId.size;
+    }
+    // Avvia lo sweeper periodico. unref() per non tenere vivo il processo.
+    startSweeper(intervalMs) {
+        if (this.sweeper)
+            return;
+        this.sweeper = setInterval(() => this.sweep(), intervalMs);
+        if (typeof this.sweeper.unref === "function")
+            this.sweeper.unref();
+    }
+    // Ferma lo sweeper periodico (se attivo).
+    stopSweeper() {
+        if (this.sweeper) {
+            clearInterval(this.sweeper);
+            this.sweeper = null;
+        }
+    }
+    // Risolve un id a un ref VIVO: se scaduto o mancante su disco, fa cleanup e
+    // ritorna undefined.
+    resolveLive(id) {
+        const ref = this.byId.get(id);
+        if (!ref)
+            return undefined;
+        if (ref.expiresAt <= this.now() || !existsSync(ref.path)) {
+            this.byId.delete(id);
+            if (existsSync(ref.path))
+                rmSync(ref.path, { force: true });
+            return undefined;
+        }
+        return ref;
+    }
+}

package/dist/backend/types.d.ts

@@ -0,0 +1,103 @@
+import type { AgentEvent } from "../core/types.js";
+export interface User {
+    readonly id: string;
+    readonly email: string;
+    readonly displayName: string;
+    readonly passwordHash: string;
+    readonly createdAt: number;
+}
+export interface PublicUser {
+    readonly id: string;
+    readonly email: string;
+    readonly displayName: string;
+    readonly createdAt: number;
+}
+export declare function toPublicUser(u: User): PublicUser;
+export interface Conversation {
+    readonly id: string;
+    readonly userId: string;
+    readonly title: string;
+    readonly model: string;
+    readonly createdAt: number;
+    readonly updatedAt: number;
+}
+export interface ConversationMessage {
+    readonly role: "user" | "assistant" | "tool";
+    readonly text: string;
+    readonly toolCalls?: ReadonlyArray<{
+        id: string;
+        name: string;
+        input: unknown;
+    }>;
+    readonly toolResults?: ReadonlyArray<{
+        callId: string;
+        output: string;
+        isError: boolean;
+    }>;
+    readonly ts: number;
+}
+export type AssetKind = "image" | "file" | "snippet";
+export interface Asset {
+    readonly id: string;
+    readonly visionId: string;
+    readonly userId: string;
+    readonly kind: AssetKind;
+    readonly name: string;
+    readonly mime: string;
+    readonly size: number;
+    readonly snippet?: string;
+    readonly description?: string;
+    readonly createdAt: number;
+}
+export interface PublicAsset {
+    readonly id: string;
+    readonly visionId: string;
+    readonly kind: AssetKind;
+    readonly name: string;
+    readonly mime: string;
+    readonly size: number;
+    readonly snippet?: string;
+    readonly description?: string;
+    readonly createdAt: number;
+}
+export declare function toPublicAsset(a: Asset): PublicAsset;
+export interface AuthTokenPayload {
+    readonly sub: string;
+    readonly email: string;
+    readonly iat: number;
+    readonly exp: number;
+}
+export interface AuthResult {
+    readonly token: string;
+    readonly user: PublicUser;
+    readonly expiresAt: number;
+}
+export type WsClientMessage = {
+    readonly type: "prompt";
+    readonly text: string;
+} | {
+    readonly type: "abort";
+} | {
+    readonly type: "ping";
+};
+export type WsServerMessage = {
+    readonly type: "ready";
+    readonly conversationId: string;
+} | {
+    readonly type: "agent";
+    readonly event: AgentEvent;
+} | {
+    readonly type: "pong";
+} | {
+    readonly type: "error";
+    readonly message: string;
+};
+export interface ApiError {
+    readonly error: string;
+    readonly code?: string;
+}
+export declare class HttpError extends Error {
+    readonly status: number;
+    readonly code?: string | undefined;
+    constructor(status: number, message: string, code?: string | undefined);
+}

package/dist/backend/types.js

@@ -0,0 +1,29 @@
+// Tipi condivisi del backend della piattaforma vascend-talos.
+// Immutabili per convenzione (come il resto del harness): si creano nuovi
+// oggetti, non si muta. Zero dipendenze a runtime.
+export function toPublicUser(u) {
+    return { id: u.id, email: u.email, displayName: u.displayName, createdAt: u.createdAt };
+}
+export function toPublicAsset(a) {
+    return {
+        id: a.id,
+        visionId: a.visionId,
+        kind: a.kind,
+        name: a.name,
+        mime: a.mime,
+        size: a.size,
+        ...(a.snippet !== undefined ? { snippet: a.snippet } : {}),
+        ...(a.description !== undefined ? { description: a.description } : {}),
+        createdAt: a.createdAt,
+    };
+}
+export class HttpError extends Error {
+    status;
+    code;
+    constructor(status, message, code) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "HttpError";
+    }
+}