@project-ava-supernova/core 0.2.71

package/dist/remote/schema.d.ts

@@ -0,0 +1,152 @@
+import type { ProposedAction } from '../desktop/types.js';
+interface BaseMessage {
+    /** ISO timestamp when the message was created */
+    ts: string;
+    /** Sender surface */
+    from: 'desktop' | 'companion';
+}
+export type DesktopCapability = 'desktop_mode' | 'creative_studio' | 'memory_sync' | 'browser_control';
+export interface SessionRegister extends BaseMessage {
+    type: 'session.register';
+    from: 'desktop';
+    sessionId: string;
+    deviceName: string;
+    platform: 'windows' | 'macos' | 'linux';
+    version: string;
+    capabilities: DesktopCapability[];
+    trayMode: boolean;
+}
+export interface SessionHeartbeat extends BaseMessage {
+    type: 'session.heartbeat';
+    from: 'desktop';
+    sessionId: string;
+    /** Current desktop state — lets companion show live status */
+    state: 'idle' | 'trajectory_active' | 'awaiting_approval' | 'paused';
+}
+export interface SessionEnd extends BaseMessage {
+    type: 'session.end';
+    from: 'desktop';
+    sessionId: string;
+    reason: 'quit' | 'crash' | 'timeout';
+}
+export interface PairRequest extends BaseMessage {
+    type: 'pair.request';
+    from: 'companion';
+    /** Device fingerprint for the companion — remembered after first grant */
+    deviceFingerprint: string;
+    deviceName: string;
+}
+export interface PairGrant extends BaseMessage {
+    type: 'pair.grant';
+    from: 'desktop';
+    sessionId: string;
+    /** Session-scoped token for this pairing — expires on session end */
+    pairToken: string;
+}
+export interface PairDeny extends BaseMessage {
+    type: 'pair.deny';
+    from: 'desktop';
+    reason: 'user_declined' | 'session_busy' | 'unknown_device';
+}
+export interface PairTakeback extends BaseMessage {
+    type: 'pair.takeback';
+    from: 'desktop';
+    sessionId: string;
+}
+export interface TrajStep extends BaseMessage {
+    type: 'traj.step';
+    from: 'desktop';
+    sessionId: string;
+    stepNumber: number;
+    /** Narrator's one-line summary */
+    narratorLine: string;
+    /** Condensed persona outputs — full audit lives on desktop, not broadcast */
+    personas: {
+        scout: {
+            confidence: string;
+            elementCount: number;
+        };
+        planner: {
+            kind: string;
+            target?: string;
+            riskClass: string;
+        };
+        actor: {
+            ok: boolean;
+            latencyMs: number;
+        };
+        verifier: {
+            status: string;
+            detail: string;
+        };
+    };
+    /** Budget header — "Step 7/30 · 82K / 500K tokens · 01:14" */
+    budgetHeader: string;
+}
+export interface TrajIntent extends BaseMessage {
+    type: 'traj.intent';
+    from: 'companion';
+    /** The user's message / command from the companion chat box */
+    text: string;
+}
+export interface ApprovalRequest extends BaseMessage {
+    type: 'approval.request';
+    from: 'desktop';
+    /** Unique nonce for this approval — prevents replay */
+    nonce: string;
+    sessionId: string;
+    stepNumber: number;
+    /** The action that needs approval */
+    action: ProposedAction;
+    /** Human-readable summary of what will happen */
+    summary: string;
+    /** Whether this action is reversible */
+    reversible: boolean;
+    /** Timeout in ms — if no response, falls back to desktop user */
+    timeoutMs: number;
+}
+export interface ApprovalResponse extends BaseMessage {
+    type: 'approval.response';
+    from: 'companion' | 'desktop';
+    nonce: string;
+    approved: boolean;
+    /** User's reason for rejecting (optional) */
+    reason?: string;
+    /** Edited action params if user chose "Edit first" */
+    editedParams?: Record<string, unknown>;
+}
+export interface KillMessage extends BaseMessage {
+    type: 'kill';
+    from: 'desktop' | 'companion';
+    sessionId: string;
+    /** Which kill level — matches the three-layer spec */
+    level: 'pause' | 'stop' | 'panic';
+}
+export interface NotifyMessage extends BaseMessage {
+    type: 'notify';
+    from: 'desktop';
+    sessionId: string;
+    /** Notification title */
+    title: string;
+    /** Notification body */
+    body: string;
+    /** Severity for display styling */
+    severity: 'info' | 'warning' | 'critical';
+    /** Pre-filled suggested intent — one-tap pair + action */
+    suggestedIntent?: string;
+}
+export type RemoteMessage = SessionRegister | SessionHeartbeat | SessionEnd | PairRequest | PairGrant | PairDeny | PairTakeback | TrajStep | TrajIntent | ApprovalRequest | ApprovalResponse | KillMessage | NotifyMessage;
+/** All valid message type strings — useful for exhaustive switch checks. */
+export type RemoteMessageType = RemoteMessage['type'];
+/** Build the Supabase Realtime channel name for a user. */
+export declare function channelName(userId: string): string;
+/** Heartbeat interval in ms (spec: 20s). */
+export declare const HEARTBEAT_INTERVAL_MS = 20000;
+/** Session timeout if no heartbeat received (spec: 60s). */
+export declare const SESSION_TIMEOUT_MS = 60000;
+/** Approval request timeout before fallback to desktop (spec: 15s). */
+export declare const APPROVAL_FALLBACK_TIMEOUT_MS = 15000;
+/** Short reconnect window — messages queue and replay (spec: 30s). */
+export declare const RECONNECT_SHORT_MS = 30000;
+export {};
+//# sourceMappingURL=schema.d.ts.map

package/dist/remote/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/remote/schema.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAI1D,UAAU,WAAW;IACnB,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,qBAAqB;IACrB,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;CAC/B;AAID,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,iBAAiB,GACjB,aAAa,GACb,iBAAiB,CAAC;AAEtB,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,QAAQ,CAAC;CACtE;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACtC;AAID,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,0EAA0E;IAC1E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAU,SAAQ,WAAW;IAC5C,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,QAAS,SAAQ,WAAW;IAC3C,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,gBAAgB,CAAC;CAC7D;AAED,MAAM,WAAW,YAAa,SAAQ,WAAW;IAC/C,IAAI,EAAE,eAAe,CAAC;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,QAAS,SAAQ,WAAW;IAC3C,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,EAAE;QACR,KAAK,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;QACpD,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAC9D,KAAK,EAAE;YAAE,EAAE,EAAE,OAAO,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAC1C,QAAQ,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;KAC9C,CAAC;IACF,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;CACd;AAID,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,SAAS,CAAC;IAChB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,MAAM,EAAE,cAAc,CAAC;IACvB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,wCAAwC;IACxC,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,IAAI,EAAE,mBAAmB,CAAC;IAC1B,IAAI,EAAE,WAAW,GAAG,SAAS,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAID,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;CACnC;AAID,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,yBAAyB;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;IAC1C,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,MAAM,MAAM,aAAa,GACrB,eAAe,GACf,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,eAAe,GACf,gBAAgB,GAChB,WAAW,GACX,aAAa,CAAC;AAElB,4EAA4E;AAC5E,MAAM,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;AAItD,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAE5C,4DAA4D;AAC5D,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC,uEAAuE;AACvE,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,QAAS,CAAC"}

package/dist/remote/schema.js

@@ -0,0 +1,26 @@
+// ─── Remote Pairing Protocol Schema ────────────────────────────────────────
+//
+// Message types for Supabase Realtime broadcast between the IDE (desktop)
+// and the companion app (mobile). Every message over the wire is one of
+// the discriminated union members below.
+//
+// Channel: `ava:remote:{user_id}` — RLS enforces JWT subject matches user_id.
+// Transport: JSON over Supabase Realtime broadcast. Latency ~100-200ms.
+//
+// Both surfaces import from this file — it's the single source of truth.
+// If you add a message type here, both surfaces need a handler or they'll
+// silently drop it (which is fine during rollout, but log it).
+// ── Channel helpers ───────────────────────────────────────────────────────
+/** Build the Supabase Realtime channel name for a user. */
+export function channelName(userId) {
+    return `ava:remote:${userId}`;
+}
+/** Heartbeat interval in ms (spec: 20s). */
+export const HEARTBEAT_INTERVAL_MS = 20_000;
+/** Session timeout if no heartbeat received (spec: 60s). */
+export const SESSION_TIMEOUT_MS = 60_000;
+/** Approval request timeout before fallback to desktop (spec: 15s). */
+export const APPROVAL_FALLBACK_TIMEOUT_MS = 15_000;
+/** Short reconnect window — messages queue and replay (spec: 30s). */
+export const RECONNECT_SHORT_MS = 30_000;
+//# sourceMappingURL=schema.js.map

package/dist/remote/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/remote/schema.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,0EAA0E;AAC1E,wEAAwE;AACxE,yCAAyC;AACzC,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AACxE,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,+DAA+D;AAoL/D,6EAA6E;AAE7E,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,OAAO,cAAc,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,4DAA4D;AAC5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAEzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC"}

package/dist/security/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Security module — automated scanning and vulnerability detection
+ */
+export { scanDependencies, scanSecrets, scanCodeVulns, runFullScan, } from './scanner.js';
+export type { DependencyVuln, SecretFinding, CodeVuln, ScanReport, } from './scanner.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,cAAc,EACd,aAAa,EACb,QAAQ,EACR,UAAU,GACX,MAAM,cAAc,CAAC"}

package/dist/security/index.js

@@ -0,0 +1,5 @@
+/**
+ * Security module — automated scanning and vulnerability detection
+ */
+export { scanDependencies, scanSecrets, scanCodeVulns, runFullScan, } from './scanner.js';
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,WAAW,GACZ,MAAM,cAAc,CAAC"}

package/dist/security/scanner.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Security Scanner — automated vulnerability detection
+ *
+ * Scans for:
+ * 1. Dependency vulnerabilities (npm audit equivalent)
+ * 2. Hardcoded secrets (API keys, tokens, passwords)
+ * 3. Common code vulnerabilities (SQL injection, XSS, command injection)
+ *
+ * Pure TypeScript — no native dependencies.
+ */
+export interface DependencyVuln {
+    package: string;
+    version: string;
+    severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
+    cve: string;
+    description: string;
+    fix: string;
+}
+export interface SecretFinding {
+    file: string;
+    line: number;
+    type: string;
+    preview: string;
+}
+export interface CodeVuln {
+    file: string;
+    line: number;
+    type: string;
+    severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
+    description: string;
+    code: string;
+}
+export interface ScanReport {
+    dependencies: DependencyVuln[];
+    secrets: SecretFinding[];
+    codeVulns: CodeVuln[];
+    summary: {
+        totalFindings: number;
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+        scannedAt: string;
+        durationMs: number;
+    };
+}
+/**
+ * Scan dependencies for known vulnerabilities.
+ * Reads package.json and checks against known patterns.
+ * For full CVE database checking, use `npm audit` — this provides fast heuristic checks.
+ */
+export declare function scanDependencies(projectPath: string): Promise<DependencyVuln[]>;
+/**
+ * Scan source files for hardcoded secrets, API keys, tokens, and passwords.
+ */
+export declare function scanSecrets(projectPath: string, filePatterns?: string[]): Promise<SecretFinding[]>;
+/**
+ * Scan source code for common vulnerability patterns:
+ * SQL injection, XSS, command injection, path traversal, etc.
+ */
+export declare function scanCodeVulns(projectPath: string): Promise<CodeVuln[]>;
+/**
+ * Run all scanners and return a combined report.
+ */
+export declare function runFullScan(projectPath: string): Promise<ScanReport>;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/security/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/security/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,OAAO,EAAE;QACP,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AA8LD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CA0FrF;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,EAAE,GACtB,OAAO,CAAC,aAAa,EAAE,CAAC,CA2F1B;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAiD5E;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA4B1E"}