@vascend/talos 0.1.0

package/dist/tui/web-login.js

@@ -0,0 +1,115 @@
+import { createHash, randomBytes } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+import { baseOf } from "./vascend-login.js";
+export class WebLoginError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+async function post(env, path, body, deps, signal) {
+    let response;
+    try {
+        response = await (deps.fetchImpl ?? fetch)(baseOf(deps, env) + "/auth/device/" + path, {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body),
+            redirect: "error", signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(12_000)]) : AbortSignal.timeout(12_000),
+        });
+    }
+    catch {
+        if (signal?.aborted)
+            throw new WebLoginError("cancelled");
+        throw new WebLoginError("temporarily_unavailable");
+    }
+    const raw = await response.text();
+    if (raw.length > 16_384)
+        throw new WebLoginError("invalid_response");
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        throw new WebLoginError("invalid_response");
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        throw new WebLoginError("invalid_response");
+    if (!response.ok) {
+        const known = ["authorization_pending", "slow_down", "expired_token", "access_denied", "invalid_grant", "temporarily_unavailable"];
+        throw new WebLoginError(known.includes(String(data["error"])) ? String(data["error"]) : "authorization_failed");
+    }
+    return data;
+}
+export function verificationUrl(value, code) {
+    if (typeof value !== "string" || value.length > 512)
+        throw new WebLoginError("invalid_response");
+    let u;
+    try {
+        u = new URL(value);
+    }
+    catch {
+        throw new WebLoginError("invalid_response");
+    }
+    // Server-provided link, with an independent allowlist before launching a
+    // local browser. A compromised response must not open another application.
+    if (u.origin !== "https://vascend.it" || u.username || u.password || u.hash ||
+        !/^\/(it|en)\/talos\/connect$/.test(u.pathname) ||
+        u.searchParams.get("code") !== code || [...u.searchParams.keys()].join(",") !== "code") {
+        throw new WebLoginError("invalid_response");
+    }
+    return u.href;
+}
+export async function startWebLogin(env, language, deps = {}, signal) {
+    const verifier = randomBytes(32).toString("base64url");
+    const data = await post(env, "start", {
+        code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+        // The website currently exposes Italian and English routes, as in the
+        // desktop host. Its fallback must not overwrite the local UI preference.
+        code_challenge_method: "S256", language: language === "it" ? "it" : "en",
+    }, deps, signal);
+    const deviceCode = data["device_code"], userCode = data["user_code"];
+    const expiresIn = data["expires_in"], interval = data["interval"];
+    if (typeof deviceCode !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(deviceCode) ||
+        typeof userCode !== "string" || !/^[A-Z2-9]{10}$/.test(userCode) ||
+        typeof expiresIn !== "number" || !Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > 900 ||
+        typeof interval !== "number" || !Number.isInteger(interval) || interval < 1 || interval > 30) {
+        throw new WebLoginError("invalid_response");
+    }
+    return { verifier, deviceCode, userCode, expiresIn, interval, url: verificationUrl(data["verification_uri_complete"], userCode) };
+}
+export async function waitForWebLogin(env, grant, deps = {}, signal) {
+    const now = deps.now ?? Date.now;
+    const deadline = now() + grant.expiresIn * 1000;
+    const wait = deps.wait ?? (async (ms, signal) => { await delay(ms, undefined, { signal }); });
+    let interval = grant.interval;
+    while (now() < deadline) {
+        try {
+            await wait(Math.min(interval * 1000, deadline - now()), signal);
+        }
+        catch {
+            throw new WebLoginError("cancelled");
+        }
+        if (signal?.aborted)
+            throw new WebLoginError("cancelled");
+        if (now() >= deadline)
+            break;
+        try {
+            const data = await post(env, "token", { device_code: grant.deviceCode, code_verifier: grant.verifier }, deps, signal);
+            const token = data["access_token"], email = data["email"], language = data["language"];
+            if (typeof token !== "string" || !/^[A-Za-z0-9._~-]{20,4096}$/.test(token) ||
+                typeof email !== "string" || email.length > 254 || /[\x00-\x20\x7f-\x9f]/.test(email) || !email.includes("@") ||
+                (language !== "en" && language !== "it"))
+                throw new WebLoginError("invalid_response");
+            return { token, email, language,
+                ...(typeof data["tier"] === "string" && /^[a-z0-9_]{1,30}$/.test(data["tier"]) ? { tier: data["tier"] } : {}) };
+        }
+        catch (e) {
+            if (!(e instanceof WebLoginError))
+                throw e;
+            if (e.code === "slow_down" || e.code === "temporarily_unavailable")
+                interval = Math.min(30, interval + 5);
+            else if (e.code !== "authorization_pending")
+                throw e;
+        }
+    }
+    throw new WebLoginError("expired_token");
+}

package/dist/vascend/activity-status.d.ts

@@ -0,0 +1,12 @@
+export interface Activity {
+    readonly id: string;
+    readonly label?: string;
+    readonly since: number;
+    readonly count: number;
+}
+export type EndActivity = () => void;
+export declare function beginActivity(id: string, label?: string): EndActivity;
+export declare function activeActivity(id: string): Activity | null;
+export declare function isActivityActive(id: string): boolean;
+export declare function activeActivities(): readonly Activity[];
+export declare function __resetActivities(): void;

package/dist/vascend/activity-status.js

@@ -0,0 +1,68 @@
+// Activity status -- registro SINGLETON delle attivita' di lungo corso che la
+// status line deve poter mostrare come "attive" (es. auto-miglioramento DEEP).
+//
+// Perche' un singleton di processo: l'attivita' viene avviata da un tool (che
+// gira nel motore dell'agente) ma deve essere VISTA dalla status line della TUI,
+// ricalcolata a ogni frame. I due punti non si conoscono: condividono solo
+// questo modulo. Niente eventi, niente accoppiamento -- una mappa di token attivi.
+//
+// Uso tipico (in un handler di tool):
+//   const end = beginActivity("improve", "auto-miglioramento");
+//   try { ...lavoro lungo... } finally { end(); }
+// e nella status line:
+//   const a = activeActivity("improve");  // -> { id, label, since } | null
+const registry = new Map();
+// Avvia un'attivita' con un certo id; ritorna un terminatore idempotente.
+// Riavviare lo stesso id mentre e' gia' attivo incrementa il contatore e
+// mantiene il `since` originale (cosi' il cronometro non si azzera).
+export function beginActivity(id, label) {
+    const key = id.trim();
+    if (!key)
+        return () => { };
+    const prev = registry.get(key);
+    if (prev) {
+        prev.count += 1;
+        if (label && !prev.label)
+            prev.label = label;
+    }
+    else {
+        registry.set(key, { label, since: Date.now(), count: 1 });
+    }
+    let done = false;
+    return () => {
+        if (done)
+            return;
+        done = true;
+        const cur = registry.get(key);
+        if (!cur)
+            return;
+        cur.count -= 1;
+        if (cur.count <= 0)
+            registry.delete(key);
+    };
+}
+// Ritorna lo snapshot dell'attivita' con quell'id se viva, altrimenti null.
+export function activeActivity(id) {
+    const e = registry.get(id.trim());
+    if (!e || e.count <= 0)
+        return null;
+    return { id: id.trim(), label: e.label, since: e.since, count: e.count };
+}
+// true se almeno un'attivita' con quell'id e' viva.
+export function isActivityActive(id) {
+    const e = registry.get(id.trim());
+    return Boolean(e && e.count > 0);
+}
+// Snapshot di TUTTE le attivita' vive (per status line generiche / debug).
+export function activeActivities() {
+    const out = [];
+    for (const [id, e] of registry) {
+        if (e.count > 0)
+            out.push({ id, label: e.label, since: e.since, count: e.count });
+    }
+    return out;
+}
+// Solo per i test: azzera il registro.
+export function __resetActivities() {
+    registry.clear();
+}

package/dist/vascend/architecture-map.d.ts

@@ -0,0 +1,73 @@
+export interface ArchModuleStat {
+    readonly id: string;
+    readonly files: number;
+    readonly loc: number;
+    readonly exports: number;
+    readonly testFiles: number;
+}
+export interface ArchDependency {
+    readonly from: string;
+    readonly to: string;
+    readonly count: number;
+}
+export interface ArchEntryPoint {
+    readonly file: string;
+    readonly reason: string;
+}
+export interface ArchHotspot {
+    readonly file: string;
+    readonly loc: number;
+}
+export interface ArchExternal {
+    readonly module: string;
+    readonly count: number;
+}
+export interface ArchitectureMap {
+    readonly rootName: string;
+    readonly files: number;
+    readonly loc: number;
+    readonly modules: readonly ArchModuleStat[];
+    readonly dependencies: readonly ArchDependency[];
+    readonly cycles: readonly (readonly string[])[];
+    readonly entryPoints: readonly ArchEntryPoint[];
+    readonly hotspots: readonly ArchHotspot[];
+    readonly externals: readonly ArchExternal[];
+    readonly truncated: boolean;
+}
+export interface ArchSourceFile {
+    readonly path: string;
+    readonly source: string;
+}
+export interface BuildArchitectureOptions {
+    readonly rootName?: string;
+    /** Profondita' del raggruppamento in moduli (segmenti di path, default 2). */
+    readonly moduleDepth?: number;
+    /** package.json (gia' parsato) per gli entry point dichiarati. */
+    readonly packageJson?: Record<string, unknown> | null;
+    readonly truncated?: boolean;
+    /** Quanti hotspot/esterni tenere (default 10). */
+    readonly top?: number;
+}
+export declare function isArchSourceFile(path: string): boolean;
+export declare function moduleIdOf(path: string, depth: number): string;
+export declare function externalPackageName(module: string): string;
+export declare function normalizeRelPath(path: string): string;
+export declare function resolveRelativeImport(fromFile: string, spec: string, known: ReadonlySet<string>): string | null;
+export declare function parsePythonImports(source: string): {
+    externals: string[];
+    relative: boolean;
+};
+export declare function findModuleCycles(nodes: readonly string[], edges: ReadonlyMap<string, ReadonlySet<string>>): readonly (readonly string[])[];
+export declare function buildArchitectureMap(files: readonly ArchSourceFile[], options?: BuildArchitectureOptions): ArchitectureMap;
+export declare function renderArchitectureMap(map: ArchitectureMap, options?: {
+    readonly maxModules?: number;
+}): string;
+export interface ScanArchitectureOptions {
+    readonly moduleDepth?: number;
+    readonly top?: number;
+    /** Massimo numero di file sorgente letti (default 4000). */
+    readonly maxFiles?: number;
+    /** Dimensione massima per file in bytes (default 1 MiB). */
+    readonly maxFileBytes?: number;
+}
+export declare function scanArchitectureMap(root: string, options?: ScanArchitectureOptions): ArchitectureMap;