@vascend/talos 0.1.5 → 0.1.6

package/dist/tui/vascend-id.d.ts

@@ -0,0 +1,49 @@
+export declare const VASCEND_ID_ISSUER = "https://id.vascend.it";
+export declare const VASCEND_ID_CLIENT = "talos";
+export declare const AGENT_RESOURCE = "https://api.vascend.it/agent";
+export declare const RELAY_RESOURCE = "https://relay.vascend.it";
+export declare const LOGIN_RESOURCES: readonly ["https://api.vascend.it/agent", "https://relay.vascend.it"];
+export declare const VASCEND_ID_SCOPE = "openid email offline_access agent sessions";
+type FetchLike = (url: string, init?: RequestInit) => Promise<Response>;
+export interface IdDeps {
+    readonly fetchImpl?: FetchLike;
+    readonly now?: () => number;
+}
+export interface TokenRisorsa {
+    readonly token: string;
+    readonly scade: number;
+}
+export interface SessioneId {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly scade: number;
+    readonly email: string;
+    readonly risorse?: Readonly<Record<string, TokenRisorsa>>;
+}
+export declare class VascendIdError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+export declare function issuerOf(env: NodeJS.ProcessEnv): string;
+export declare function tokenPlausibile(token: unknown, max?: number): token is string;
+export declare function claimNonVerificati(token: string): Record<string, unknown>;
+export declare function chiamaId(env: NodeJS.ProcessEnv, path: string, campi: Record<string, string | readonly string[]>, deps?: IdDeps, signal?: AbortSignal): Promise<Record<string, unknown>>;
+export declare function sessioneDaRisposta(data: Record<string, unknown>, now: number): SessioneId;
+export declare function sessionePath(env: NodeJS.ProcessEnv): string | null;
+export declare function leggiSessione(env: NodeJS.ProcessEnv): SessioneId | null;
+export declare function salvaSessione(env: NodeJS.ProcessEnv, sessione: SessioneId): boolean;
+export declare function rimuoviSessione(env: NodeJS.ProcessEnv): void;
+export interface EsitoToken {
+    readonly token: string;
+    readonly email?: string;
+    readonly errore?: "assente" | "respinta" | "rete";
+}
+export declare function tokenAgente(env: NodeJS.ProcessEnv, deps?: IdDeps): Promise<EsitoToken>;
+export interface EsitoTokenRisorsa {
+    readonly token: string;
+    readonly email?: string;
+    readonly errore?: "assente" | "respinta" | "rete" | "risorsa";
+}
+export declare function tokenRisorsa(env: NodeJS.ProcessEnv, risorsa: string, deps?: IdDeps): Promise<EsitoTokenRisorsa>;
+export declare function revocaSessioneId(env: NodeJS.ProcessEnv, deps?: IdDeps): Promise<void>;
+export {};

package/dist/tui/vascend-id.js

@@ -0,0 +1,321 @@
+// Sessione Vascend ID (https://id.vascend.it), il login unico dell'ecosistema.
+//
+// Talos non riceve piu' un token dal backend agentico: si collega a Vascend ID
+// col device flow (RFC 8628, vedi web-login.ts) e ottiene
+//   - un access token per l'agente (aud https://api.vascend.it/agent, 10 min)
+//   - un refresh token, che RUOTA a ogni uso: il riuso di uno vecchio revoca
+//     l'intera sessione su tutti i dispositivi collegati con quel login.
+// Il login chiede anche la risorsa del relay (controllo remoto, scope
+// `sessions`): col refresh token si ottiene un token per l'una o per l'altra
+// (RFC 8707), sempre sotto lo stesso lock, perche' ogni rinnovo lo ruota.
+//
+// Per la rotazione, il rinnovo va fatto da UN processo alla volta: due Talos
+// aperti che rinnovano insieme presenterebbero lo stesso refresh token e il
+// provider li butterebbe fuori entrambi. Per questo lettura, rinnovo e
+// scrittura stanno sotto lo stesso lock di file.
+//
+// La sessione vive in ~/.talos/vascend-id.json (0600), separata dal config dei
+// provider: il refresh token vale settimane e non deve comparire accanto a
+// chiavi che l'utente incolla, esporta o condivide.
+import { existsSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { readConfigObject, updateConfigObject } from "../core/config-storage.js";
+import { talosConfigDir } from "../core/env-paths.js";
+import { withLock } from "../vascend/file-lock.js";
+export const VASCEND_ID_ISSUER = "https://id.vascend.it";
+export const VASCEND_ID_CLIENT = "talos";
+export const AGENT_RESOURCE = "https://api.vascend.it/agent";
+export const RELAY_RESOURCE = "https://relay.vascend.it";
+// Le risorse chieste al login: una risorsa non chiesta qui non si ottiene piu'
+// col refresh token, serve un nuovo login.
+export const LOGIN_RESOURCES = [AGENT_RESOURCE, RELAY_RESOURCE];
+export const VASCEND_ID_SCOPE = "openid email offline_access agent sessions";
+const TIMEOUT_MS = 12_000;
+// Si rinnova un minuto prima della scadenza: una richiesta partita con un token
+// valido non deve arrivare al server con un token scaduto.
+const MARGINE_S = 60;
+export class VascendIdError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+function issuerValido(url) {
+    try {
+        const u = new URL(url);
+        if (u.username || u.password || u.search || u.hash)
+            return false;
+        if (u.protocol === "https:")
+            return true;
+        return u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1");
+    }
+    catch {
+        return false;
+    }
+}
+// Override solo per sviluppo/collaudo; uno malformato o in chiaro verso un host
+// remoto non degrada il login: si torna al provider di produzione.
+export function issuerOf(env) {
+    const override = String(env["TALOS_VASCEND_ID_URL"] ?? "").trim();
+    return (override && issuerValido(override) ? override : VASCEND_ID_ISSUER).replace(/\/+$/, "");
+}
+export function tokenPlausibile(token, max = 8192) {
+    return typeof token === "string" && token.length >= 20 && token.length <= max && /^[A-Za-z0-9._~-]+$/.test(token);
+}
+// Legge i claim SENZA verificarli: servono solo a mostrare l'email e a sapere
+// quando rinnovare. La verifica vera la fa il server che riceve il token.
+export function claimNonVerificati(token) {
+    const parte = token.split(".")[1];
+    if (!parte)
+        return {};
+    try {
+        const valore = JSON.parse(Buffer.from(parte, "base64url").toString("utf8"));
+        return valore && typeof valore === "object" && !Array.isArray(valore) ? valore : {};
+    }
+    catch {
+        return {};
+    }
+}
+function emailPulita(valore) {
+    const email = typeof valore === "string" ? valore.trim().toLowerCase() : "";
+    return email.length <= 254 && email.includes("@") && !/[\x00-\x20\x7f-\x9f]/.test(email) ? email : "";
+}
+// POST application/x-www-form-urlencoded verso il provider, con le stesse
+// difese di prima: niente redirect, timeout, risposta limitata e validata.
+export async function chiamaId(env, path, campi, deps = {}, signal) {
+    const f = deps.fetchImpl ?? fetch;
+    // Un array diventa un parametro ripetuto (resource=...&resource=...).
+    const corpo = new URLSearchParams();
+    for (const [chiave, valore] of Object.entries(campi)) {
+        for (const v of typeof valore === "string" ? [valore] : valore)
+            corpo.append(chiave, v);
+    }
+    let response;
+    let raw;
+    try {
+        response = await f(issuerOf(env) + path, {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+            body: corpo.toString(),
+            redirect: "error",
+            signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(TIMEOUT_MS)]) : AbortSignal.timeout(TIMEOUT_MS),
+        });
+        raw = await response.text();
+        if (signal?.aborted)
+            throw new VascendIdError("cancelled");
+    }
+    catch {
+        if (signal?.aborted)
+            throw new VascendIdError("cancelled");
+        throw new VascendIdError("temporarily_unavailable");
+    }
+    if (raw.length > 32_768)
+        throw new VascendIdError("invalid_response");
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        throw new VascendIdError("invalid_response");
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data))
+        throw new VascendIdError("invalid_response");
+    if (!response.ok) {
+        const noti = ["authorization_pending", "slow_down", "expired_token", "access_denied", "invalid_grant",
+            "temporarily_unavailable", "invalid_client", "invalid_target"];
+        throw new VascendIdError(noti.includes(String(data["error"])) ? String(data["error"]) : "authorization_failed");
+    }
+    return data;
+}
+// Da una risposta di /token a una sessione, validando tutto quello che arriva.
+export function sessioneDaRisposta(data, now) {
+    const accessToken = data["access_token"], refreshToken = data["refresh_token"], expiresIn = data["expires_in"];
+    if (!tokenPlausibile(accessToken) || !tokenPlausibile(refreshToken, 2048) ||
+        typeof expiresIn !== "number" || !Number.isInteger(expiresIn) || expiresIn < 30 || expiresIn > 86_400) {
+        throw new VascendIdError("invalid_response");
+    }
+    const email = emailPulita(claimNonVerificati(accessToken)["email"]);
+    if (!email)
+        throw new VascendIdError("invalid_response");
+    return { accessToken, refreshToken, scade: Math.floor(now / 1000) + expiresIn, email };
+}
+// --- Persistenza -------------------------------------------------------------
+export function sessionePath(env) {
+    if (env["TALOS_NO_GLOBAL_CONFIG"] === "1")
+        return null;
+    return join(talosConfigDir(env), "vascend-id.json");
+}
+function leggiDaFile(path) {
+    if (!existsSync(path))
+        return null;
+    let raw;
+    try {
+        raw = readConfigObject(path);
+    }
+    catch {
+        return null;
+    }
+    const scade = Number(raw["scade"]);
+    const email = emailPulita(raw["email"]);
+    if (!tokenPlausibile(raw["accessToken"]) || !tokenPlausibile(raw["refreshToken"], 2048) ||
+        !Number.isFinite(scade) || !email)
+        return null;
+    return { accessToken: raw["accessToken"], refreshToken: raw["refreshToken"], scade, email, risorse: risorseDa(raw["risorse"]) };
+}
+// Solo le voci ben formate: una voce rovinata costa un rinnovo, non la sessione.
+function risorseDa(valore) {
+    if (!valore || typeof valore !== "object" || Array.isArray(valore))
+        return undefined;
+    const voci = {};
+    for (const [risorsa, v] of Object.entries(valore)) {
+        const t = v && typeof v === "object" ? v : {};
+        const scade = Number(t["scade"]);
+        if (risorsa.startsWith("https://") && tokenPlausibile(t["token"]) && Number.isFinite(scade)) {
+            voci[risorsa] = { token: t["token"], scade };
+        }
+    }
+    return Object.keys(voci).length ? voci : undefined;
+}
+export function leggiSessione(env) {
+    const path = sessionePath(env);
+    return path ? leggiDaFile(path) : null;
+}
+export function salvaSessione(env, sessione) {
+    const path = sessionePath(env);
+    if (!path)
+        return false;
+    try {
+        mkdirSync(talosConfigDir(env), { recursive: true });
+        updateConfigObject(path, () => ({ ...sessione }));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function rimuoviSessione(env) {
+    const path = sessionePath(env);
+    if (!path || !existsSync(path))
+        return;
+    try {
+        updateConfigObject(path, () => ({}));
+    }
+    catch { /* best-effort */ }
+}
+// Token per l'agente, rinnovato se sta per scadere. Mai due rinnovi in
+// parallelo: il secondo processo trova gia' la sessione nuova e la usa.
+export async function tokenAgente(env, deps = {}) {
+    const path = sessionePath(env);
+    if (!path)
+        return { token: "", errore: "assente" };
+    const now = deps.now ?? Date.now;
+    const valida = (s) => s.scade - MARGINE_S > Math.floor(now() / 1000);
+    const prima = leggiDaFile(path);
+    if (!prima)
+        return { token: "", errore: "assente" };
+    if (valida(prima))
+        return { token: prima.accessToken, email: prima.email };
+    mkdirSync(talosConfigDir(env), { recursive: true });
+    // Lock dedicato al rinnovo: la scrittura del file prende gia' il suo (non
+    // rientrante), quindi qui ne serve uno diverso che copra lettura+rinnovo.
+    return withLock(`${path}.rinnovo`, async () => {
+        const attuale = leggiDaFile(path);
+        if (!attuale)
+            return { token: "", errore: "assente" };
+        if (valida(attuale))
+            return { token: attuale.accessToken, email: attuale.email };
+        try {
+            const data = await chiamaId(env, "/token", {
+                grant_type: "refresh_token",
+                refresh_token: attuale.refreshToken,
+                client_id: VASCEND_ID_CLIENT,
+                resource: AGENT_RESOURCE,
+            }, deps);
+            const nuova = sessioneDaRisposta(data, now());
+            updateConfigObject(path, () => ({ ...nuova, risorse: attuale.risorse }));
+            return { token: nuova.accessToken, email: nuova.email };
+        }
+        catch (e) {
+            const code = e instanceof VascendIdError ? e.code : "";
+            if (code === "temporarily_unavailable")
+                return { token: "", errore: "rete" };
+            // Refresh respinto (revocato, scaduto, riusato): la sessione non vale piu'.
+            updateConfigObject(path, () => ({}));
+            return { token: "", errore: "respinta" };
+        }
+    }, { timeoutMs: 20_000, staleMs: 30_000 });
+}
+// Token per una risorsa diversa dall'agente (il relay). Stesso lock di
+// tokenAgente: ogni rinnovo ruota il refresh token, e due rinnovi in parallelo
+// butterebbero fuori la sessione.
+export async function tokenRisorsa(env, risorsa, deps = {}) {
+    const path = sessionePath(env);
+    if (!path)
+        return { token: "", errore: "assente" };
+    const now = deps.now ?? Date.now;
+    const valido = (t) => !!t && t.scade - MARGINE_S > Math.floor(now() / 1000);
+    const prima = leggiDaFile(path);
+    if (!prima)
+        return { token: "", errore: "assente" };
+    const giaPronto = prima.risorse?.[risorsa];
+    if (valido(giaPronto))
+        return { token: giaPronto.token, email: prima.email };
+    mkdirSync(talosConfigDir(env), { recursive: true });
+    return withLock(`${path}.rinnovo`, async () => {
+        const attuale = leggiDaFile(path);
+        if (!attuale)
+            return { token: "", errore: "assente" };
+        const pronto = attuale.risorse?.[risorsa];
+        if (valido(pronto))
+            return { token: pronto.token, email: attuale.email };
+        let data;
+        try {
+            data = await chiamaId(env, "/token", {
+                grant_type: "refresh_token",
+                refresh_token: attuale.refreshToken,
+                client_id: VASCEND_ID_CLIENT,
+                resource: risorsa,
+            }, deps);
+        }
+        catch (e) {
+            const code = e instanceof VascendIdError ? e.code : "";
+            // Risorsa fuori dal login: il refresh token non e' stato consumato, la
+            // sessione per l'agente resta valida.
+            if (code === "invalid_target")
+                return { token: "", errore: "risorsa" };
+            // Solo un refresh respinto chiude la sessione: una funzione facoltativa
+            // come il controllo remoto non deve scollegare l'utente per un errore
+            // temporaneo o una risposta strana.
+            if (code !== "invalid_grant")
+                return { token: "", errore: "rete" };
+            updateConfigObject(path, () => ({}));
+            return { token: "", errore: "respinta" };
+        }
+        const accessToken = data["access_token"], refreshToken = data["refresh_token"], expiresIn = data["expires_in"];
+        if (!tokenPlausibile(accessToken) || !tokenPlausibile(refreshToken, 2048) ||
+            typeof expiresIn !== "number" || !Number.isInteger(expiresIn) || expiresIn < 30 || expiresIn > 86_400) {
+            // Il refresh token e' gia' stato ruotato dal provider: quello vecchio non vale piu'.
+            updateConfigObject(path, () => ({}));
+            return { token: "", errore: "respinta" };
+        }
+        const voce = { token: accessToken, scade: Math.floor(now() / 1000) + expiresIn };
+        updateConfigObject(path, () => ({ ...attuale, refreshToken, risorse: { ...attuale.risorse, [risorsa]: voce } }));
+        return { token: voce.token, email: attuale.email };
+    }, { timeoutMs: 20_000, staleMs: 30_000 });
+}
+// Logout: revoca il refresh token sul provider (best-effort), poi il chiamante
+// cancella la sessione locale.
+export async function revocaSessioneId(env, deps = {}) {
+    const sessione = leggiSessione(env);
+    if (!sessione)
+        return;
+    try {
+        await chiamaId(env, "/token/revocation", {
+            token: sessione.refreshToken,
+            token_type_hint: "refresh_token",
+            client_id: VASCEND_ID_CLIENT,
+        }, deps);
+    }
+    catch { /* best-effort: il logout locale prosegue */ }
+}

package/dist/tui/web-login-screen.js

@@ -22,10 +22,11 @@ export function renderWebLoginScreen(grant, options = {}) {
     add(tr("Collega il tuo account e inizia.", "Connect your account and get started."), "muted");
     lines.push("");
     add(tr("1. Accedi nel browser", "1. Sign in in your browser"));
-    add(tr("Si aprirà vascend.it per continuare.", "vascend.it will open to continue."), "muted", 5);
+    add(tr("Si aprirà id.vascend.it per continuare.", "id.vascend.it will open to continue."), "muted", 5);
     lines.push("");
     add(tr("2. Confronta il codice e conferma", "2. Match the code and approve"));
-    const code = plainText(grant.userCode).replace(/^(.{5})(.+)$/, "$1-$2");
+    // Vascend ID manda il codice gia' diviso (XXXX-XXXX): lo si mostra com'e'.
+    const code = plainText(grant.userCode);
     const edge = options.unicode === false ? ["+", "-", "+", "|", "+", "+"] : ["╭", "─", "╮", "│", "╰", "╯"];
     const codeWidth = Math.min(25, width - 5);
     const padding = Math.max(0, Math.floor((codeWidth - code.length) / 2));
@@ -57,7 +58,7 @@ export function showWebLoginScreen(grant, abort, options = {}) {
     const output = options.output ?? stdout;
     const env = options.env ?? process.env;
     const now = options.now ?? Date.now;
-    const url = verificationUrl(grant.url, grant.userCode);
+    const url = verificationUrl(grant.url, grant.userCode, env);
     const animated = Boolean(output.isTTY) && env.TERM !== "dumb";
     const appearance = () => ({ columns: output.columns, color: animated && env.NO_COLOR === undefined,
         unicode: env.TERM !== "dumb", theme: options.theme });

package/dist/tui/web-login.d.ts

@@ -1,28 +1,20 @@
-import { type LoginDeps } from "./vascend-login.js";
 import type { Lingua } from "./onboarding.js";
-export declare class WebLoginError extends Error {
-    readonly code: string;
-    constructor(code: string);
-}
+import { VascendIdError, type IdDeps, type SessioneId } from "./vascend-id.js";
+export { VascendIdError as WebLoginError };
 export interface WebGrant {
     readonly deviceCode: string;
-    readonly verifier: string;
     readonly userCode: string;
     readonly url: string;
     readonly expiresIn: number;
     readonly interval: number;
 }
-export interface WebSession {
+export interface WebSession extends SessioneId {
     readonly token: string;
-    readonly email: string;
     readonly language: Lingua;
-    readonly tier?: string;
 }
-type Deps = LoginDeps & {
+type Deps = IdDeps & {
     readonly wait?: (ms: number, signal?: AbortSignal) => Promise<void>;
-    readonly now?: () => number;
 };
-export declare function verificationUrl(value: unknown, code: string): string;
-export declare function startWebLogin(env: NodeJS.ProcessEnv, language: Lingua, deps?: Deps, signal?: AbortSignal): Promise<WebGrant>;
-export declare function waitForWebLogin(env: NodeJS.ProcessEnv, grant: WebGrant, deps?: Deps, signal?: AbortSignal): Promise<WebSession>;
-export {};
+export declare function verificationUrl(value: unknown, code: string, env?: NodeJS.ProcessEnv): string;
+export declare function startWebLogin(env: NodeJS.ProcessEnv, _language: Lingua, deps?: Deps, signal?: AbortSignal): Promise<WebGrant>;
+export declare function waitForWebLogin(env: NodeJS.ProcessEnv, grant: WebGrant, language: Lingua, deps?: Deps, signal?: AbortSignal): Promise<WebSession>;

package/dist/tui/web-login.js

@@ -1,85 +1,45 @@
-import { createHash, randomBytes } from "node:crypto";
 import { setTimeout as delay } from "node:timers/promises";
-import { baseOf } from "./vascend-login.js";
-export class WebLoginError extends Error {
-    code;
-    constructor(code) {
-        super(code);
-        this.code = code;
-    }
-}
-async function post(env, path, body, deps, signal) {
-    let response;
-    let raw;
-    try {
-        response = await (deps.fetchImpl ?? fetch)(baseOf(deps, env) + "/auth/device/" + path, {
-            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(body),
-            redirect: "error", signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(12_000)]) : AbortSignal.timeout(12_000),
-        });
-        raw = await response.text();
-        if (signal?.aborted)
-            throw new WebLoginError("cancelled");
-    }
-    catch {
-        if (signal?.aborted)
-            throw new WebLoginError("cancelled");
-        throw new WebLoginError("temporarily_unavailable");
-    }
-    if (raw.length > 16_384)
-        throw new WebLoginError("invalid_response");
-    let data;
-    try {
-        data = JSON.parse(raw);
-    }
-    catch {
-        throw new WebLoginError("invalid_response");
-    }
-    if (!data || typeof data !== "object" || Array.isArray(data))
-        throw new WebLoginError("invalid_response");
-    if (!response.ok) {
-        const known = ["authorization_pending", "slow_down", "expired_token", "access_denied", "invalid_grant", "temporarily_unavailable"];
-        throw new WebLoginError(known.includes(String(data["error"])) ? String(data["error"]) : "authorization_failed");
-    }
-    return data;
-}
-export function verificationUrl(value, code) {
+import { AGENT_RESOURCE, LOGIN_RESOURCES, VASCEND_ID_CLIENT, VASCEND_ID_SCOPE, VascendIdError, chiamaId, issuerOf, sessioneDaRisposta, } from "./vascend-id.js";
+// Collegamento di Talos a Vascend ID col device flow (RFC 8628): Talos mostra
+// un codice, l'utente lo conferma su id.vascend.it (login col codice via email
+// e, se attivo, il secondo fattore), Talos riceve i token.
+export { VascendIdError as WebLoginError };
+// Alfabeto base-20 di Vascend ID (niente vocali ne' lettere ambigue), a gruppi di 4.
+const USER_CODE = /^[BCDFGHJKLMNPQRSTVWXZ]{4}-[BCDFGHJKLMNPQRSTVWXZ]{4}$/;
+export function verificationUrl(value, code, env = {}) {
     if (typeof value !== "string" || value.length > 512)
-        throw new WebLoginError("invalid_response");
+        throw new VascendIdError("invalid_response");
     let u;
     try {
         u = new URL(value);
     }
     catch {
-        throw new WebLoginError("invalid_response");
+        throw new VascendIdError("invalid_response");
     }
-    // Server-provided link, with an independent allowlist before launching a
-    // local browser. A compromised response must not open another application.
-    if (u.origin !== "https://vascend.it" || u.username || u.password || u.hash ||
-        !/^\/(it|en)\/talos\/connect$/.test(u.pathname) ||
-        u.searchParams.get("code") !== code || [...u.searchParams.keys()].join(",") !== "code") {
-        throw new WebLoginError("invalid_response");
+    // Link fornito dal server, controllato in modo indipendente prima di aprire
+    // il browser locale: una risposta manomessa non deve aprire altro.
+    if (u.origin !== new URL(issuerOf(env)).origin || u.username || u.password || u.hash ||
+        u.pathname !== "/device" || u.searchParams.get("user_code") !== code ||
+        [...u.searchParams.keys()].join(",") !== "user_code") {
+        throw new VascendIdError("invalid_response");
     }
     return u.href;
 }
-export async function startWebLogin(env, language, deps = {}, signal) {
-    const verifier = randomBytes(32).toString("base64url");
-    const data = await post(env, "start", {
-        code_challenge: createHash("sha256").update(verifier).digest("base64url"),
-        // The website currently exposes Italian and English routes, as in the
-        // desktop host. Its fallback must not overwrite the local UI preference.
-        code_challenge_method: "S256", language: language === "it" ? "it" : "en",
+export async function startWebLogin(env, _language, deps = {}, signal) {
+    const data = await chiamaId(env, "/device/auth", {
+        client_id: VASCEND_ID_CLIENT, scope: VASCEND_ID_SCOPE, resource: LOGIN_RESOURCES,
     }, deps, signal);
     const deviceCode = data["device_code"], userCode = data["user_code"];
-    const expiresIn = data["expires_in"], interval = data["interval"];
-    if (typeof deviceCode !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(deviceCode) ||
-        typeof userCode !== "string" || !/^[A-Z2-9]{10}$/.test(userCode) ||
-        typeof expiresIn !== "number" || !Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > 900 ||
+    const expiresIn = data["expires_in"], interval = data["interval"] ?? 5;
+    if (typeof deviceCode !== "string" || !/^[A-Za-z0-9_-]{20,128}$/.test(deviceCode) ||
+        typeof userCode !== "string" || !USER_CODE.test(userCode) ||
+        typeof expiresIn !== "number" || !Number.isInteger(expiresIn) || expiresIn < 1 || expiresIn > 1800 ||
         typeof interval !== "number" || !Number.isInteger(interval) || interval < 1 || interval > 30) {
-        throw new WebLoginError("invalid_response");
+        throw new VascendIdError("invalid_response");
     }
-    return { verifier, deviceCode, userCode, expiresIn, interval, url: verificationUrl(data["verification_uri_complete"], userCode) };
+    return { deviceCode, userCode, expiresIn, interval, url: verificationUrl(data["verification_uri_complete"], userCode, env) };
 }
-export async function waitForWebLogin(env, grant, deps = {}, signal) {
+export async function waitForWebLogin(env, grant, language, deps = {}, signal) {
     const now = deps.now ?? Date.now;
     const deadline = now() + grant.expiresIn * 1000;
     const wait = deps.wait ?? (async (ms, signal) => { await delay(ms, undefined, { signal }); });
@@ -89,24 +49,24 @@ export async function waitForWebLogin(env, grant, deps = {}, signal) {
             await wait(Math.min(interval * 1000, deadline - now()), signal);
         }
         catch {
-            throw new WebLoginError("cancelled");
+            throw new VascendIdError("cancelled");
         }
         if (signal?.aborted)
-            throw new WebLoginError("cancelled");
+            throw new VascendIdError("cancelled");
         if (now() >= deadline)
             break;
         try {
-            const data = await post(env, "token", { device_code: grant.deviceCode, code_verifier: grant.verifier }, deps, signal);
-            const token = data["access_token"], email = data["email"], language = data["language"];
-            if (typeof token !== "string" || !/^[A-Za-z0-9._~-]{20,4096}$/.test(token) ||
-                typeof email !== "string" || email.length > 254 || /[\x00-\x20\x7f-\x9f]/.test(email) || !email.includes("@") ||
-                (language !== "en" && language !== "it"))
-                throw new WebLoginError("invalid_response");
-            return { token, email, language,
-                ...(typeof data["tier"] === "string" && /^[a-z0-9_]{1,30}$/.test(data["tier"]) ? { tier: data["tier"] } : {}) };
+            const data = await chiamaId(env, "/token", {
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                device_code: grant.deviceCode,
+                client_id: VASCEND_ID_CLIENT,
+                resource: AGENT_RESOURCE,
+            }, deps, signal);
+            const sessione = sessioneDaRisposta(data, now());
+            return { ...sessione, token: sessione.accessToken, language };
         }
         catch (e) {
-            if (!(e instanceof WebLoginError))
+            if (!(e instanceof VascendIdError))
                 throw e;
             if (e.code === "slow_down" || e.code === "temporarily_unavailable")
                 interval = Math.min(30, interval + 5);
@@ -114,5 +74,5 @@ export async function waitForWebLogin(env, grant, deps = {}, signal) {
                 throw e;
         }
     }
-    throw new WebLoginError("expired_token");
+    throw new VascendIdError("expired_token");
 }

package/dist/tui/worker-transcripts.d.ts

@@ -0,0 +1,31 @@
+import type { AgentEvent } from "../core/types.js";
+export interface TranscriptBuffer {
+    write(text: string): void;
+    logLength(): number;
+    setLogLine(index: number, text: string): void;
+    getLogLine(index: number): string | undefined;
+}
+export interface TranscriptSink {
+    (event: AgentEvent): void;
+    preview?(): string;
+}
+export type WorkerSinkFactory = (buffer: TranscriptBuffer, width: number) => TranscriptSink;
+export interface TranscriptLayout {
+    readonly length: number;
+    slice(start: number, end: number): readonly string[];
+}
+export declare class WorkerTranscripts {
+    private readonly events;
+    private readonly rendered;
+    private factory?;
+    private revision?;
+    private renderedRevision?;
+    invalidate(): void;
+    configure(factory: WorkerSinkFactory, revision?: () => unknown): void;
+    reset(): void;
+    delete(id: string): void;
+    record(id: string, event: AgentEvent): void;
+    layout(id: string, width: number): TranscriptLayout | undefined;
+    lines(id: string, width: number): readonly string[] | undefined;
+    private render;
+}