cadrumo.entrypoints.tui.launcher module

Concrete runtime composition for installed and diagnostic TUI sessions.

class TuiOperationCompositionV1(services, public_contracts, authority_operation, event_loop=None)[source]

Bases: object

One operation service graph and its same-registry public contracts.

Parameters:
services: OperationComposedServices
public_contracts: OperationPublicContractSetV1
authority_operation: PinnedAuthorityOperation
event_loop: AbstractEventLoop | None

The loop the session’s screens read shared state on; captures publish to it.

compose_secure_profile_workbench_generation_provider(*, profile_id, profile_label, operation, operation_contracts)[source]

Bind the installed provider to the current secure profile session.

Repository instances stay inside the application read door; neither the root nor any screen receives a repository/service locator. Calling the returned provider is the explicit local-I/O boundary for a fresh session generation and never initiates network work.

Return type:

TypeAliasType

Parameters:
compose_local_reader_page(services)[source]

Bind the document reader page to this session’s operation platform.

Setup, install, start, pull, load, verify and remove are submitted into the same journal and leases the rest of the session uses, so an action running here is one config provision would see, not a second inventory’s.

Return type:

Callable[[], Screen[None]]

Parameters:

services (OperationComposedServices)

live_account_session_reader(*, profile_id, profile_label)[source]

Bind a check of the live secure session that reads its deadlines and nothing else.

It opens no secure object, so calling it never rolls the idle deadline forward: a timer may call it without keeping the session alive.

Return type:

Callable[[], HomeAccountSession]

Parameters:

  • profile_id (str)

  • profile_label (str)

class InstalledWorkbenchRootInputsV1(home_projection, refresh_home, admissions, account_factories, ledger_factory, declarations_factory, aeat_sync_factory, search_inputs, refresh_search_inputs, refresh_destinations=None, action_candidates=(), read_account_session=None)[source]

Bases: object

Explicit safe inputs needed to compose one installed workbench root.

Projection sourcing is deliberately outside this value object: its caller has already loaded the current authoritative generation and supplied the existing area factories. The launcher may join those facts, but it never reads a repository, opens a notification, acquires credentials, or starts an operation merely to make a screen available.

Parameters:
home_projection: HomeProjectionV1
refresh_home: Callable[[], HomeProjectionV1]
admissions: Mapping[str, WorkbenchDestinationAdmission]
account_factories: AccountFactoriesV1
ledger_factory: TuiScreenFactoryV1 | None
declarations_factory: TuiScreenFactoryV1 | None
aeat_sync_factory: TuiScreenFactoryV1 | None
search_inputs: InstalledWorkbenchSearchInputsV1 | None
refresh_search_inputs: TypeAliasType
refresh_destinations: TypeAliasType | None

Re-derive admissions and factories from the CURRENT generation.

Without this the root would hold admissions from the first generation while every factory resolved its projection from the latest one, so a refresh that legitimately changed availability would leave the two disagreeing – offering a destination whose projection is gone, or refusing one that has since become readable.

action_candidates: Iterable[TuiActionCandidateV1]
read_account_session: Callable[[], HomeAccountSession] | None

Check the live session without touching it, for the root’s expiry watch.

class InstalledWorkbenchRootCompositionV1(destination_catalogue, admissions, refresh_home, search_inputs, refresh_search_inputs, refresh_destination_catalogue, account_factories, read_account_session=None)[source]

Bases: object

One closed root catalogue and explicit refresh doors for a session.

Parameters:
destination_catalogue: TuiDestinationCatalogueV1
admissions: Mapping[str, WorkbenchDestinationAdmission]
refresh_home: Callable[[], HomeProjectionV1]
search_inputs: InstalledWorkbenchSearchInputsV1 | None
refresh_search_inputs: TypeAliasType
refresh_destination_catalogue: Callable[[], TuiDestinationCatalogueV1] | None
account_factories: AccountFactoriesV1
read_account_session: Callable[[], HomeAccountSession] | None
class InstalledWorkbenchAccountInputsV1(profile_id, profile_overview, persist_profile_field, login_choices, authenticate, assess_password, rotate_password, complete_setup=None)[source]

Bases: object

Non-secret account doors the launcher binds to the current session.

Parameters:
profile_id: str
profile_overview: ProfileOverview
persist_profile_field: Callable[[str, str], ProfileOverview]
login_choices: Sequence[ProfileLoginChoice]
authenticate: Callable[[str, str], ProfileLoginAttempt]
assess_password: Callable[[str], ProfilePasswordAssessment]
rotate_password: Callable[[str, str, str], PassphraseChangeAttempt]
complete_setup: Callable[[], ProfileOverview] | None
factories(services)[source]

Compose existing account owners without reading or retaining secrets.

Return type:

AccountFactoriesV1

Parameters:

services (OperationComposedServices)

class InstalledWorkbenchFactoryDependenciesV1(account, profile_admission, ledger_review_action, ledger_evidence_action, ledger_classify_action, ledger_link_action, declarations_work_action, declarations_revisions_action, declarations_filing_action, attachment_review_queue=None)[source]

Bases: object

TUI-owned factories and public action contracts for one session.

No repository or service locator crosses this value. The generation provider has already reduced secure source reads to safe application projections; these values only bind those projections to their existing screen owners.

Parameters:
account: InstalledWorkbenchAccountInputsV1
profile_admission: WorkbenchDestinationAdmission
ledger_review_action: ActionReference
ledger_evidence_action: ActionReference
ledger_classify_action: ActionReference
declarations_work_action: ActionReference
declarations_revisions_action: ActionReference
declarations_filing_action: ActionReference
attachment_review_queue: Callable[[], tuple[AttachmentReviewItem, ...]] | None

Lists the attachments awaiting review; absent, the evidence area is refused.

compose_installed_workbench_generation_provider(generation_provider, dependencies)[source]

Adapt child-owned generations to the installed root input contract.

The provider is invoked only at an explicit session refresh boundary. Search refresh captures the next whole generation and Home consumes that exact capture on the immediately following child return. Destination wrappers resolve their projection from the same current generation.

Return type:

TypeAliasType

Parameters:
read_attachment_review_queue(profile_id)[source]

List the attachments awaiting review; it decrypts every manifest, so only captures call it.

Return type:

tuple[AttachmentReviewItem, ...]

Parameters:

profile_id (str)

resolve_modelo_workspace_static_inspection(unit, *, operation, output_language)[source]

Assemble the workspace read result for one already-resolved unit.

The unit is addressed by its exact identity rather than by its visible modelo/year/period coordinates. A profile that discarded a declaration and created a new one at the same address holds two units there, and a coordinate request is ambiguous across them — which would refuse a read the caller had already resolved. The catalogue is opened on the unit’s own bucket rather than the active-profile pointer, so the read cannot drift to another profile.

Return type:

ModeloWorkspaceStaticInspectionResultV1

Parameters:
profile_storage_scope(root)[source]

Bind persistent profile infrastructure rooted at root for one TUI run.

This is the sole TUI composition seam permitted to construct persistence adapters. Screens and devtools receive application contracts after this scope has bound them; neither needs to know which concrete adapter serves the session.

Return type:

Generator[Path]

Parameters:

root (Path)

operation_services_scope()[source]

Compose the operation platform for one TUI run and settle it after.

This is the sole TUI composition seam permitted to build the operation registry, journal, leases and supervisor. Screens and controllers receive the composed services; none of them constructs the graph, so a TUI session has exactly one place where that inventory comes into being.

The factory itself lives one level up, shared with the CLI. Moving it into this package would oblige every other frontend to import the TUI to reach it, which is the dependency the TUI boundary exists to forbid.

Return type:

AsyncGenerator[TuiOperationCompositionV1]

Assemble preloaded public projections through the application boundary.

The input bundle is injected by the installed-session composition. This function performs no reads: the application-owned provider derives the immutable redacted snapshot from that one already-authoritative generation.

Return type:

WorkbenchSearchDoorV1

Parameters:

inputs (InstalledWorkbenchSearchInputsV1)

compose_installed_workbench_root(inputs)[source]

Join one already-authoritative session generation into the root shell.

The inputs deliberately carry the application-owned projections, action admissions, and existing area factories. This boundary only checks that the search and navigation views name the same authoritative admissions, then builds the closed TUI catalogue. It neither creates a second screen implementation nor performs storage or network I/O.

Return type:

InstalledWorkbenchRootCompositionV1

Parameters:

inputs (InstalledWorkbenchRootInputsV1)

async run_authenticated_workbench_sessions(*, headless, auto_pilot, workbench_root_inputs_provider, recompose_authenticated_session=None)[source]

Run fresh roots until the outer authenticated-session owner declines one.

Each root has its own operation-service scope. A handover, password rotation, sign-out, or expiry first settles and discards that scope, then gives only its non-secret recompose result to the injected outer owner. The owner must select a new bootstrap/session generation and return a new provider; returning None fails closed rather than reusing the former profile-bound root.

Return type:

AccountRecomposeRequiredV1 | None

Parameters:

  • headless (bool)

  • auto_pilot (AutopilotCallbackType | None)

  • workbench_root_inputs_provider (InstalledWorkbenchRootInputsProviderV1)

  • recompose_authenticated_session (AuthenticatedSessionRecomposeDoorV1 | None)

exception TuiModuleArgumentError(message=None, *, context=None, translated_message=None)[source]

Bases: CadrumoError

Arguments outside the independent TUI root’s closed invocation surface.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

Return type:

None

code
run_module(arguments, *, workbench_root_inputs_provider=None)[source]

Start the root session from python -m, retaining only the self-test flag.

The argument surface and its refusal live here rather than in __main__.py: a module executed as __main__ carries that module name, so an error class defined there could never resolve the error code the registry declares for it.

Return type:

int

Parameters:

  • arguments (list[str])

  • workbench_root_inputs_provider (InstalledWorkbenchRootInputsProviderV1 | None)

main(*, headless=False, auto_pilot=None, workbench_root_inputs_provider=None, recompose_authenticated_session=None)[source]

Start one dedicated TUI session and report its process exit status.

This is the sole entry point for module execution and for the installed console script; neither reaches past it into the composition seams, and neither imports the CLI. headless and auto_pilot are Textual’s own run parameters, carried so a caller can drive a real session to completion without a terminal rather than assert against an import.

Without an injected provider this composes the production installed session: adapters, one truthful profile-inventory observation, whichever existing credential journey that observation names, and the authenticated generation the root shell consumes. A caller that injects a provider has already made those choices, so its session is run exactly as given.

Return type:

int

Parameters:

  • headless (bool)

  • auto_pilot (AutopilotCallbackType | None)

  • workbench_root_inputs_provider (InstalledWorkbenchRootInputsProviderV1 | None)

  • recompose_authenticated_session (AuthenticatedSessionRecomposeDoorV1 | None)