
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@rotorsoft/act-diagram
Advanced tools
Act domain model diagram — extract, visualize, and navigate Act event-sourced models
Interactive domain model diagram for @rotorsoft/act event-sourced apps. Extracts states, actions, events, reactions, slices, and projections from TypeScript source code and renders them as an interactive SVG.
file:line:col locationnpm install @rotorsoft/act-diagram
# or
pnpm add @rotorsoft/act-diagram
Peer dependencies: react >= 18, react-dom >= 18
TypeScript files (.ts)
|
v
topoSort() ← order files by import dependencies
|
v
extractModel() ← transpile + execute with mock builders → DomainModel
| inventory scan → per-state validation → per-slice error isolation
v
validate() ← check for missing emits, orphan reactions, etc.
|
v
computeLayout() ← pure layout: positions nodes, edges, slice boxes, projections
|
v
<Diagram /> ← SVG rendering with pan/zoom/model tree/errors section
|
v
navigateToCode() ← click element → { file, line, col }
The extraction uses mock versions of state(), slice(), projection(), and act() that capture the builder structure without needing the real framework runtime. Code is transpiled with Sucrase and evaluated in an isolated scope.
Bottom-up model building:
state(), slice(), projection(), act() declarationsEvery item from the inventory is always displayed — with a diagram on success, or an error box on failure.
import { ActDiagram } from "@rotorsoft/act-diagram";
function App() {
return (
<ActDiagram
files={[
{ path: "src/states.ts", content: "..." },
{ path: "src/app.ts", content: "..." },
]}
onNavigate={(file, line, col) => {
console.log(`Navigate to ${file}:${line}:${col}`);
}}
/>
);
}
// In the webview
<ActDiagram usePostMessage onNavigate={handleNavigate} />
// From the IDE extension host
webview.postMessage({ type: "files", files: [...] });
webview.postMessage({ type: "fileChanged", path: "src/app.ts", content: "..." });
import { Diagram, extractModel, validate } from "@rotorsoft/act-diagram";
const { model } = extractModel(files);
const warnings = validate(model);
<Diagram
model={model}
warnings={warnings}
onClickElement={(name, type, file) => { /* ... */ }}
/>
import { navigateToCode } from "@rotorsoft/act-diagram";
const result = navigateToCode(files, "OpenTicket", "action");
// → { file: "src/states.ts", line: 24, col: 7 }
| Component | Props | Description |
|---|---|---|
ActDiagram | files?, onNavigate?, usePostMessage?, onAiRequest?, generating? | Standalone wrapper: pipeline + diagram + optional AI bar |
Diagram | model, warnings, onClickElement?, onFixWithAi?, toolbarExtra? | Raw SVG diagram with pan/zoom/model tree/warnings |
AiBar | onSubmit, generating? | Resizable prompt input with model and token controls |
Logo | size? | Act logo SVG |
Tooltip | title, description?, details?, children, position?, align? | Hover tooltip |
| Function | Signature | Description |
|---|---|---|
extractModel | (files: FileTab[]) => { model: DomainModel; error?: string } | Extract domain model from TypeScript source files |
validate | (model: DomainModel) => ValidationWarning[] | Validate model for missing emits, etc. |
navigateToCode | (files, name, type?, targetFile?) => { file, line, col } | undefined | Find source location of a named element |
topoSort | (files: FileTab[]) => FileTab[] | Sort files by import dependency order |
computeLayout | (model: DomainModel) => Layout | Pure layout computation — positions all nodes, edges, and slice boxes |
emptyModel | () => DomainModel | Create an empty domain model |
type FileTab = { path: string; content: string };
type DomainModel = {
entries: EntryPoint[];
states: StateNode[];
slices: SliceNode[];
projections: ProjectionNode[];
reactions: ReactionNode[];
orchestrator?: ActNode;
};
type StateNode = { name, varName, events: EventNode[], actions: ActionNode[], file?, line? };
type ActionNode = { name, emits: string[], invariants: string[], line? };
type EventNode = { name, hasCustomPatch: boolean, line? };
type SliceNode = { name, states: string[], stateVars: string[], projections: string[], reactions: ReactionNode[], error?, file?, line? };
type ProjectionNode = { name, varName, handles: string[], line? };
type ReactionNode = { event, handlerName, dispatches: string[], isVoid: boolean, line? };
// Layout types
type Box = { x, y, w, h, label, error? };
type Layout = { ns: N[], es: E[], boxes: Box[], minX, minY, width, height };
// Host → Diagram
type HostMessage =
| { type: "files"; files: FileTab[] }
| { type: "fileAdded"; path: string; content: string }
| { type: "fileChanged"; path: string; content: string }
| { type: "fileDeleted"; path: string };
// Diagram → Host
type DiagramMessage =
| { type: "navigate"; file: string; line: number; col: number }
| { type: "aiRequest"; prompt: string; files: FileTab[] };
See @rotorsoft/act-nvim — a Neovim plugin that renders act-diagram in the browser with bidirectional navigation, live refresh, and LSP diagnostic forwarding.
# Visual dev server with sample diagram
pnpm -F @rotorsoft/act-diagram dev
# Run tests (315+ tests, 100% coverage)
pnpm -F @rotorsoft/act-diagram test
# Build library
pnpm -F @rotorsoft/act-diagram build
MIT
FAQs
Act domain model diagram — extract, visualize, and navigate Act event-sourced models
We found that @rotorsoft/act-diagram demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.