@project-ava-supernova/core 0.2.71

package/dist/tools/apply-plan.js

@@ -0,0 +1,119 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { execFile } from 'node:child_process';
+import { validatePath } from './security.js';
+const GIT_TIMEOUT_MS = 15_000;
+export class ApplyPlanTool {
+    name = 'apply_plan';
+    description = 'Apply a batch of file edits atomically with git checkpoint for safe rollback';
+    riskLevel = 'write';
+    requiresConfirmation = true;
+    schema = {
+        name: 'apply_plan',
+        description: 'Apply multiple file edits as a single atomic operation. Creates a git stash checkpoint before ' +
+            'applying changes so the entire batch can be rolled back if any edit fails. ' +
+            'Each change specifies a file path, the old string to find, and the new string to replace it with.',
+        parameters: {
+            type: 'object',
+            properties: {
+                changes: {
+                    type: 'array',
+                    items: {
+                        type: 'object',
+                        properties: {
+                            path: { type: 'string', description: 'File path to edit.' },
+                            old_string: { type: 'string', description: 'Exact string to find in the file.' },
+                            new_string: { type: 'string', description: 'Replacement string.' },
+                        },
+                        required: ['path', 'old_string', 'new_string'],
+                    },
+                    description: 'Array of file edits to apply.',
+                },
+                description: {
+                    type: 'string',
+                    description: 'Brief description of what these changes do (used in checkpoint message).',
+                },
+            },
+            required: ['changes'],
+        },
+    };
+    async execute(args, context) {
+        const changes = args.changes;
+        const description = args.description ?? 'apply_plan batch edit';
+        if (!changes || changes.length === 0) {
+            return { success: false, output: 'No changes provided.' };
+        }
+        // Validate all paths first
+        const validated = [];
+        for (const change of changes) {
+            try {
+                const abs = validatePath(change.path, context.cwd);
+                validated.push({ change, absolutePath: abs });
+            }
+            catch (err) {
+                return { success: false, output: `Invalid path "${change.path}": ${err.message}` };
+            }
+        }
+        // Create git checkpoint (stash)
+        const checkpointId = `apply_plan_${Date.now()}`;
+        await this.runGit(['stash', 'push', '-m', `checkpoint: ${checkpointId} — ${description}`], context.cwd);
+        // Pop the stash immediately (we just want a restore point)
+        await this.runGit(['stash', 'pop'], context.cwd);
+        // Apply changes one by one
+        const applied = [];
+        const errors = [];
+        for (const { change, absolutePath } of validated) {
+            try {
+                const content = await readFile(absolutePath, 'utf-8');
+                const idx = content.indexOf(change.old_string);
+                if (idx === -1) {
+                    errors.push(`${change.path}: old_string not found in file`);
+                    continue;
+                }
+                // Check for multiple occurrences
+                const secondIdx = content.indexOf(change.old_string, idx + 1);
+                if (secondIdx !== -1) {
+                    errors.push(`${change.path}: old_string matches multiple locations — make it more specific`);
+                    continue;
+                }
+                const newContent = content.slice(0, idx) + change.new_string + content.slice(idx + change.old_string.length);
+                await writeFile(absolutePath, newContent, 'utf-8');
+                applied.push(change.path);
+            }
+            catch (err) {
+                errors.push(`${change.path}: ${err.message}`);
+            }
+        }
+        // Report
+        let output = `## Apply Plan Results\n\n`;
+        output += `**${applied.length}/${changes.length}** edits applied`;
+        if (errors.length > 0)
+            output += ` (${errors.length} failed)`;
+        output += '\n\n';
+        if (applied.length > 0) {
+            output += `### Applied\n`;
+            for (const p of applied)
+                output += `- ${p}\n`;
+            output += '\n';
+        }
+        if (errors.length > 0) {
+            output += `### Failed\n`;
+            for (const e of errors)
+                output += `- ${e}\n`;
+            output += '\n';
+            output += `To rollback all changes, run: \`git checkout -- ${applied.join(' ')}\`\n`;
+        }
+        return {
+            success: errors.length === 0,
+            output,
+            metadata: { applied: applied.length, failed: errors.length, total: changes.length, checkpointId },
+        };
+    }
+    runGit(args, cwd) {
+        return new Promise((resolve) => {
+            execFile('git', args, { cwd, timeout: GIT_TIMEOUT_MS }, (error, stdout, stderr) => {
+                resolve({ success: !error, output: (stdout || '') + (stderr || '') });
+            });
+        });
+    }
+}
+//# sourceMappingURL=apply-plan.js.map

package/dist/tools/apply-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-plan.js","sourceRoot":"","sources":["../../src/tools/apply-plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,MAAM,cAAc,GAAG,MAAM,CAAC;AAQ9B,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,YAAY,CAAC;IACpB,WAAW,GAAG,8EAA8E,CAAC;IAC7F,SAAS,GAAkB,OAAO,CAAC;IACnC,oBAAoB,GAAG,IAAI,CAAC;IAE5B,MAAM,GAAmB;QAChC,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,gGAAgG;YAChG,6EAA6E;YAC7E,mGAAmG;QACrG,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,OAAO,EAAE;oBACP,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE;4BAC3D,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,mCAAmC,EAAE;4BAChF,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;yBACnE;wBACD,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC;qBAC/C;oBACD,WAAW,EAAE,+BAA+B;iBAC7C;gBACD,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,0EAA0E;iBACxF;aACF;YACD,QAAQ,EAAE,CAAC,SAAS,CAAC;SACtB;KACF,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,IAA6B,EAAE,OAA6B;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAuB,CAAC;QAC7C,MAAM,WAAW,GAAI,IAAI,CAAC,WAAsB,IAAI,uBAAuB,CAAC;QAE5E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC5D,CAAC;QAED,2BAA2B;QAC3B,MAAM,SAAS,GAAwD,EAAE,CAAC;QAC1E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnD,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAChG,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,YAAY,GAAG,cAAc,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,YAAY,MAAM,WAAW,EAAE,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAExG,2DAA2D;QAC3D,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAEjD,2BAA2B;QAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,KAAK,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,SAAS,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAE/C,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,gCAAgC,CAAC,CAAC;oBAC5D,SAAS;gBACX,CAAC;gBAED,iCAAiC;gBACjC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC9D,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC;oBACrB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,iEAAiE,CAAC,CAAC;oBAC7F,SAAS;gBACX,CAAC;gBAED,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC7G,MAAM,SAAS,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;gBACnD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,SAAS;QACT,IAAI,MAAM,GAAG,2BAA2B,CAAC;QACzC,MAAM,IAAI,KAAK,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,kBAAkB,CAAC;QAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,MAAM,CAAC,MAAM,UAAU,CAAC;QAC9D,MAAM,IAAI,MAAM,CAAC;QAEjB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,eAAe,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC;YAC9C,MAAM,IAAI,IAAI,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC;YAC7C,MAAM,IAAI,IAAI,CAAC;YACf,MAAM,IAAI,mDAAmD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QACvF,CAAC;QAED,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC5B,MAAM;YACN,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE;SAClG,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,IAAc,EAAE,GAAW;QACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBAChF,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/tools/ask-user.d.ts

@@ -0,0 +1,11 @@
+import type { Tool, ToolResult, ToolExecutionContext, ToolRiskLevel } from './types.js';
+import type { FunctionSchema } from '../providers/types.js';
+export declare class AskUserTool implements Tool {
+    readonly name = "ask_user";
+    readonly description = "Ask the user a question and wait for their response";
+    readonly riskLevel: ToolRiskLevel;
+    readonly requiresConfirmation = true;
+    readonly schema: FunctionSchema;
+    execute(_args: Record<string, unknown>, _context: ToolExecutionContext): Promise<ToolResult>;
+}
+//# sourceMappingURL=ask-user.d.ts.map

package/dist/tools/ask-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ask-user.d.ts","sourceRoot":"","sources":["../../src/tools/ask-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,qBAAa,WAAY,YAAW,IAAI;IACtC,QAAQ,CAAC,IAAI,cAAc;IAC3B,QAAQ,CAAC,WAAW,yDAAyD;IAC7E,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAU;IAC3C,QAAQ,CAAC,oBAAoB,QAAQ;IAErC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAiB7B;IAEI,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC;CAQnG"}

package/dist/tools/ask-user.js

@@ -0,0 +1,32 @@
+export class AskUserTool {
+    name = 'ask_user';
+    description = 'Ask the user a question and wait for their response';
+    riskLevel = 'safe';
+    requiresConfirmation = true;
+    schema = {
+        name: 'ask_user',
+        description: 'Ask the user a question and wait for their response. ' +
+            'Use this when you need clarification, a decision, or input that you cannot determine from the code alone. ' +
+            'The user will see the question and can type a free-text response. ' +
+            'Do not overuse this — only ask when genuinely uncertain.',
+        parameters: {
+            type: 'object',
+            properties: {
+                question: {
+                    type: 'string',
+                    description: 'The question to ask the user',
+                },
+            },
+            required: ['question'],
+        },
+    };
+    async execute(_args, _context) {
+        // Normally bypassed — the confirmation handler returns the user's response as a string.
+        // This fallback runs only if the handler returns true instead of a string.
+        return {
+            success: true,
+            output: 'User response received.',
+        };
+    }
+}
+//# sourceMappingURL=ask-user.js.map

package/dist/tools/ask-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ask-user.js","sourceRoot":"","sources":["../../src/tools/ask-user.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,WAAW;IACb,IAAI,GAAG,UAAU,CAAC;IAClB,WAAW,GAAG,qDAAqD,CAAC;IACpE,SAAS,GAAkB,MAAM,CAAC;IAClC,oBAAoB,GAAG,IAAI,CAAC;IAE5B,MAAM,GAAmB;QAChC,IAAI,EAAE,UAAU;QAChB,WAAW,EACT,uDAAuD;YACvD,4GAA4G;YAC5G,oEAAoE;YACpE,0DAA0D;QAC5D,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,8BAA8B;iBAC5C;aACF;YACD,QAAQ,EAAE,CAAC,UAAU,CAAC;SACvB;KACF,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,KAA8B,EAAE,QAA8B;QAC1E,wFAAwF;QACxF,2EAA2E;QAC3E,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,yBAAyB;SAClC,CAAC;IACJ,CAAC;CACF"}

package/dist/tools/audit-dependencies.d.ts

@@ -0,0 +1,13 @@
+import type { Tool, ToolResult, ToolExecutionContext, ToolRiskLevel } from './types.js';
+import type { FunctionSchema } from '../providers/types.js';
+export declare class AuditDependenciesTool implements Tool {
+    readonly name = "audit_dependencies";
+    readonly description = "Run a security audit on project dependencies and report vulnerabilities";
+    readonly riskLevel: ToolRiskLevel;
+    readonly requiresConfirmation = false;
+    readonly schema: FunctionSchema;
+    execute(args: Record<string, unknown>, context: ToolExecutionContext): Promise<ToolResult>;
+    private detectPackageManager;
+    private parseAuditOutput;
+}
+//# sourceMappingURL=audit-dependencies.d.ts.map

package/dist/tools/audit-dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-dependencies.d.ts","sourceRoot":"","sources":["../../src/tools/audit-dependencies.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,qBAAa,qBAAsB,YAAW,IAAI;IAChD,QAAQ,CAAC,IAAI,wBAAwB;IACrC,QAAQ,CAAC,WAAW,6EAA6E;IACjG,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAU;IAC3C,QAAQ,CAAC,oBAAoB,SAAS;IAEtC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAoB7B;IAEI,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC;YAmElF,oBAAoB;IA4ClC,OAAO,CAAC,gBAAgB;CAmBzB"}

package/dist/tools/audit-dependencies.js

@@ -0,0 +1,156 @@
+import { exec } from 'node:child_process';
+import { access } from 'node:fs/promises';
+import { join } from 'node:path';
+const AUDIT_TIMEOUT_MS = 120_000;
+const MAX_OUTPUT_LENGTH = 30_000;
+export class AuditDependenciesTool {
+    name = 'audit_dependencies';
+    description = 'Run a security audit on project dependencies and report vulnerabilities';
+    riskLevel = 'safe';
+    requiresConfirmation = false;
+    schema = {
+        name: 'audit_dependencies',
+        description: 'Detect the package manager and run its native security audit (npm audit, pnpm audit, yarn audit, ' +
+            'pip-audit, cargo audit). Returns vulnerabilities grouped by severity with fix recommendations.',
+        parameters: {
+            type: 'object',
+            properties: {
+                fix: {
+                    type: 'boolean',
+                    description: 'Attempt to auto-fix vulnerabilities (runs npm audit fix or equivalent). Default: false.',
+                },
+                severity: {
+                    type: 'string',
+                    enum: ['low', 'moderate', 'high', 'critical'],
+                    description: 'Minimum severity to report. Default: all.',
+                },
+            },
+            required: [],
+        },
+    };
+    async execute(args, context) {
+        const fix = args.fix ?? false;
+        const minSeverity = args.severity;
+        // Detect package manager
+        const pm = await this.detectPackageManager(context.cwd);
+        if (!pm) {
+            return { success: false, output: 'No supported package manager detected (npm, pnpm, yarn, pip, cargo).' };
+        }
+        // Run audit
+        const auditCmd = fix ? pm.fixCommand : pm.auditCommand;
+        if (minSeverity && pm.severityFlag) {
+            // Some PMs support severity filtering
+        }
+        return new Promise((resolve) => {
+            exec(auditCmd, {
+                cwd: context.cwd,
+                timeout: AUDIT_TIMEOUT_MS,
+                maxBuffer: 1024 * 1024 * 10,
+                env: { ...process.env, FORCE_COLOR: '0' },
+            }, (error, stdout, stderr) => {
+                let output = '';
+                if (stdout)
+                    output += stdout;
+                if (stderr)
+                    output += (output ? '\n' : '') + stderr;
+                if (output.length > MAX_OUTPUT_LENGTH) {
+                    output = output.slice(0, MAX_OUTPUT_LENGTH) + '\n... (output truncated)';
+                }
+                // Parse vulnerability counts
+                const parsed = this.parseAuditOutput(output, pm.name);
+                let summary = `## Dependency Audit (${pm.name})\n\n`;
+                summary += `Command: \`${auditCmd}\`\n\n`;
+                if (parsed) {
+                    summary += `### Summary\n`;
+                    if (parsed.critical > 0)
+                        summary += `- **Critical:** ${parsed.critical}\n`;
+                    if (parsed.high > 0)
+                        summary += `- **High:** ${parsed.high}\n`;
+                    if (parsed.moderate > 0)
+                        summary += `- **Moderate:** ${parsed.moderate}\n`;
+                    if (parsed.low > 0)
+                        summary += `- **Low:** ${parsed.low}\n`;
+                    if (parsed.total === 0)
+                        summary += `No vulnerabilities found.\n`;
+                    summary += '\n';
+                }
+                summary += `### Full Output\n\n${output}`;
+                // audit commands exit with non-zero when vulnerabilities are found
+                // that's expected, not an error
+                const hasVulns = parsed ? parsed.total > 0 : !!error;
+                resolve({
+                    success: true, // Always succeed — the audit itself ran fine
+                    output: summary,
+                    metadata: {
+                        packageManager: pm.name,
+                        ...(parsed || {}),
+                        hasVulnerabilities: hasVulns,
+                        fix,
+                    },
+                });
+            });
+        });
+    }
+    async detectPackageManager(cwd) {
+        // pnpm
+        try {
+            await access(join(cwd, 'pnpm-lock.yaml'));
+            return { name: 'pnpm', auditCommand: 'pnpm audit', fixCommand: 'pnpm audit --fix', severityFlag: '--severity' };
+        }
+        catch { /* ignore */ }
+        // yarn
+        try {
+            await access(join(cwd, 'yarn.lock'));
+            return { name: 'yarn', auditCommand: 'yarn audit', fixCommand: 'yarn audit', severityFlag: '--level' };
+        }
+        catch { /* ignore */ }
+        // npm
+        try {
+            await access(join(cwd, 'package-lock.json'));
+            return { name: 'npm', auditCommand: 'npm audit', fixCommand: 'npm audit fix', severityFlag: '--audit-level' };
+        }
+        catch { /* ignore */ }
+        // npm fallback (package.json without lockfile)
+        try {
+            await access(join(cwd, 'package.json'));
+            return { name: 'npm', auditCommand: 'npm audit', fixCommand: 'npm audit fix', severityFlag: '--audit-level' };
+        }
+        catch { /* ignore */ }
+        // pip
+        try {
+            await access(join(cwd, 'requirements.txt'));
+            return { name: 'pip', auditCommand: 'pip-audit', fixCommand: 'pip-audit --fix' };
+        }
+        catch { /* ignore */ }
+        try {
+            await access(join(cwd, 'pyproject.toml'));
+            return { name: 'pip', auditCommand: 'pip-audit', fixCommand: 'pip-audit --fix' };
+        }
+        catch { /* ignore */ }
+        // cargo
+        try {
+            await access(join(cwd, 'Cargo.toml'));
+            return { name: 'cargo', auditCommand: 'cargo audit', fixCommand: 'cargo audit fix' };
+        }
+        catch { /* ignore */ }
+        return null;
+    }
+    parseAuditOutput(output, _pm) {
+        // npm/pnpm: "X vulnerabilities (Y low, Z moderate, W high, V critical)"
+        const npmMatch = output.match(/(\d+)\s+vulnerabilit/i);
+        if (npmMatch) {
+            const total = +npmMatch[1];
+            const critical = +(output.match(/(\d+)\s+critical/i)?.[1] || 0);
+            const high = +(output.match(/(\d+)\s+high/i)?.[1] || 0);
+            const moderate = +(output.match(/(\d+)\s+moderate/i)?.[1] || 0);
+            const low = +(output.match(/(\d+)\s+low/i)?.[1] || 0);
+            return { critical, high, moderate, low, total };
+        }
+        // "found 0 vulnerabilities"
+        if (output.includes('found 0 vulnerabilities') || output.includes('No known vulnerabilities')) {
+            return { critical: 0, high: 0, moderate: 0, low: 0, total: 0 };
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=audit-dependencies.js.map

package/dist/tools/audit-dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-dependencies.js","sourceRoot":"","sources":["../../src/tools/audit-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,oBAAoB,CAAC;IAC5B,WAAW,GAAG,yEAAyE,CAAC;IACxF,SAAS,GAAkB,MAAM,CAAC;IAClC,oBAAoB,GAAG,KAAK,CAAC;IAE7B,MAAM,GAAmB;QAChC,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,mGAAmG;YACnG,gGAAgG;QAClG,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,GAAG,EAAE;oBACH,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,yFAAyF;iBACvG;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC;oBAC7C,WAAW,EAAE,2CAA2C;iBACzD;aACF;YACD,QAAQ,EAAE,EAAE;SACb;KACF,CAAC;IAEF,KAAK,CAAC,OAAO,CAAC,IAA6B,EAAE,OAA6B;QACxE,MAAM,GAAG,GAAI,IAAI,CAAC,GAAe,IAAI,KAAK,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,QAA8B,CAAC;QAExD,yBAAyB;QACzB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sEAAsE,EAAE,CAAC;QAC5G,CAAC;QAED,YAAY;QACZ,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC;QACvD,IAAI,WAAW,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;YACnC,sCAAsC;QACxC,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,QAAQ,EAAE;gBACb,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,OAAO,EAAE,gBAAgB;gBACzB,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,EAAE;gBAC3B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;aAC1C,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBAC3B,IAAI,MAAM,GAAG,EAAE,CAAC;gBAChB,IAAI,MAAM;oBAAE,MAAM,IAAI,MAAM,CAAC;gBAC7B,IAAI,MAAM;oBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;gBAEpD,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;oBACtC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,0BAA0B,CAAC;gBAC3E,CAAC;gBAED,6BAA6B;gBAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAEtD,IAAI,OAAO,GAAG,wBAAwB,EAAE,CAAC,IAAI,OAAO,CAAC;gBACrD,OAAO,IAAI,cAAc,QAAQ,QAAQ,CAAC;gBAE1C,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,IAAI,eAAe,CAAC;oBAC3B,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC;wBAAE,OAAO,IAAI,mBAAmB,MAAM,CAAC,QAAQ,IAAI,CAAC;oBAC3E,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;wBAAE,OAAO,IAAI,eAAe,MAAM,CAAC,IAAI,IAAI,CAAC;oBAC/D,IAAI,MAAM,CAAC,QAAQ,GAAG,CAAC;wBAAE,OAAO,IAAI,mBAAmB,MAAM,CAAC,QAAQ,IAAI,CAAC;oBAC3E,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC;wBAAE,OAAO,IAAI,cAAc,MAAM,CAAC,GAAG,IAAI,CAAC;oBAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;wBAAE,OAAO,IAAI,6BAA6B,CAAC;oBACjE,OAAO,IAAI,IAAI,CAAC;gBAClB,CAAC;gBAED,OAAO,IAAI,sBAAsB,MAAM,EAAE,CAAC;gBAE1C,mEAAmE;gBACnE,gCAAgC;gBAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAErD,OAAO,CAAC;oBACN,OAAO,EAAE,IAAI,EAAE,6CAA6C;oBAC5D,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE;wBACR,cAAc,EAAE,EAAE,CAAC,IAAI;wBACvB,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;wBACjB,kBAAkB,EAAE,QAAQ;wBAC5B,GAAG;qBACJ;iBACF,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,GAAW;QAC5C,OAAO;QACP,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;QAClH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAExB,OAAO;QACP,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QACzG,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAExB,MAAM;QACN,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAExB,+CAA+C;QAC/C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;QAChH,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAExB,MAAM;QACN,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC;YAC5C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAExB,QAAQ;QACR,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;YACtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAExB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB,CAAC,MAAc,EAAE,GAAW;QAClD,wEAAwE;QACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QAED,4BAA4B;QAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/tools/authoring/doc-model.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Canonical document model for Ava's authoring engine.
+ *
+ * This is the rich AST that sits between Markdown (the editable source of
+ * truth) and the rendered artifacts (.docx / .pdf / normalized .md). It mirrors
+ * the structure of a `marked` token stream — block-level nodes that each carry
+ * inline-level children — so the parser maps onto it cleanly, and the renderers
+ * walk it without re-parsing.
+ *
+ * It deliberately replaces the old flat `DocumentContent` ({ title, sections:
+ * [{ heading, text, list, table }] }) which had no inline formatting, capped
+ * headings at H2, and could not express ordered/nested lists, callouts, images,
+ * footnotes, or page breaks. `legacyToDocModel` bridges the old shape so
+ * existing callers (e.g. report_generate) keep working during migration.
+ */
+import type { DocumentContent } from '../document-templates.js';
+export type Inline = {
+    type: 'text';
+    text: string;
+} | {
+    type: 'strong';
+    inlines: Inline[];
+} | {
+    type: 'em';
+    inlines: Inline[];
+} | {
+    type: 'code';
+    text: string;
+} | {
+    type: 'link';
+    href: string;
+    inlines: Inline[];
+} | {
+    type: 'footnoteRef';
+    id: string;
+} | {
+    type: 'break';
+};
+export type Align = 'left' | 'center' | 'right';
+export type CalloutVariant = 'note' | 'tip' | 'warning' | 'important' | 'quote';
+export interface ListItem {
+    inlines: Inline[];
+    /** Nested blocks (sub-lists, paragraphs) under this item. */
+    children?: Block[];
+}
+export type Block = {
+    type: 'heading';
+    level: 1 | 2 | 3 | 4;
+    inlines: Inline[];
+} | {
+    type: 'paragraph';
+    inlines: Inline[];
+} | {
+    type: 'list';
+    ordered: boolean;
+    items: ListItem[];
+} | {
+    type: 'table';
+    headers: Inline[][];
+    rows: Inline[][][];
+    align?: Align[];
+} | {
+    type: 'blockquote';
+    blocks: Block[];
+} | {
+    type: 'callout';
+    variant: CalloutVariant;
+    title?: string;
+    blocks: Block[];
+} | {
+    type: 'image';
+    src: string;
+    alt?: string;
+    width?: number;
+} | {
+    type: 'code';
+    lang?: string;
+    text: string;
+} | {
+    type: 'pagebreak';
+} | {
+    type: 'hr';
+} | {
+    type: 'toc';
+};
+/** Per-document brand overrides ("house style"). Anything omitted falls back
+ *  to the Ava brand defaults in document-styling.ts. Colours are 6-digit hex
+ *  WITHOUT the leading '#', matching the document-styling token convention. */
+export interface BrandTokens {
+    font?: string;
+    headingColor?: string;
+    bodyColor?: string;
+    subtitleColor?: string;
+}
+export interface DocMeta {
+    title?: string;
+    subtitle?: string;
+    author?: string;
+    date?: string;
+    /** Selects a DocumentStyleProfile (e.g. 'proposal', 'letter') for margins,
+     *  cover page, footer. Defaults to the standard profile. */
+    styleProfile?: string;
+    /** House-style brand overrides merged over the Ava defaults. */
+    brand?: BrandTokens;
+    /** Render a table of contents where a `toc` block (or the front-matter flag)
+     *  asks for one. */
+    toc?: boolean;
+    /** Footnote definitions, keyed by id, collected by the parser pre-pass. */
+    footnotes?: Record<string, Inline[]>;
+}
+export interface DocModel {
+    meta: DocMeta;
+    blocks: Block[];
+}
+/** Wrap a plain string as a single text inline. */
+export declare function textInline(text: string): Inline[];
+/** Flatten an inline tree back to plain text (for TOC entries, alt text,
+ *  headings used as anchors, etc.). */
+export declare function inlineToPlainText(inlines: Inline[]): string;
+/**
+ * Bridge the legacy flat `DocumentContent` shape onto the rich model so existing
+ * producers (report_generate, the old document_manage create path) can render
+ * through the new engine unchanged. Each legacy section's `text` is split on
+ * blank lines into paragraphs; `list` becomes an unordered list; `table` carries
+ * straight across. No inline formatting is inferred — legacy text was plain.
+ */
+export declare function legacyToDocModel(content?: DocumentContent): DocModel;
+//# sourceMappingURL=doc-model.d.ts.map

package/dist/tools/authoring/doc-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doc-model.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/doc-model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAIhE,MAAM,MAAM,MAAM,GACd;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAItB,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAChD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAEhF,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,KAAK,GACb;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,QAAQ,EAAE,CAAA;CAAE,GACrD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,KAAK,EAAE,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,cAAc,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,EAAE,CAAA;CAAE,GAC7E;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACd;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAIpB;;+EAE+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;gEAC4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;wBACoB;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAID,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAEjD;AAED;uCACuC;AACvC,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAqB3D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,QAAQ,CA4BpE"}

package/dist/tools/authoring/doc-model.js

@@ -0,0 +1,82 @@
+/**
+ * Canonical document model for Ava's authoring engine.
+ *
+ * This is the rich AST that sits between Markdown (the editable source of
+ * truth) and the rendered artifacts (.docx / .pdf / normalized .md). It mirrors
+ * the structure of a `marked` token stream — block-level nodes that each carry
+ * inline-level children — so the parser maps onto it cleanly, and the renderers
+ * walk it without re-parsing.
+ *
+ * It deliberately replaces the old flat `DocumentContent` ({ title, sections:
+ * [{ heading, text, list, table }] }) which had no inline formatting, capped
+ * headings at H2, and could not express ordered/nested lists, callouts, images,
+ * footnotes, or page breaks. `legacyToDocModel` bridges the old shape so
+ * existing callers (e.g. report_generate) keep working during migration.
+ */
+// ── Helpers ──────────────────────────────────────────────────────────────────
+/** Wrap a plain string as a single text inline. */
+export function textInline(text) {
+    return text ? [{ type: 'text', text }] : [];
+}
+/** Flatten an inline tree back to plain text (for TOC entries, alt text,
+ *  headings used as anchors, etc.). */
+export function inlineToPlainText(inlines) {
+    let out = '';
+    for (const n of inlines) {
+        switch (n.type) {
+            case 'text':
+            case 'code':
+                out += n.text;
+                break;
+            case 'strong':
+            case 'em':
+            case 'link':
+                out += inlineToPlainText(n.inlines);
+                break;
+            case 'break':
+                out += ' ';
+                break;
+            case 'footnoteRef':
+                break;
+        }
+    }
+    return out;
+}
+/**
+ * Bridge the legacy flat `DocumentContent` shape onto the rich model so existing
+ * producers (report_generate, the old document_manage create path) can render
+ * through the new engine unchanged. Each legacy section's `text` is split on
+ * blank lines into paragraphs; `list` becomes an unordered list; `table` carries
+ * straight across. No inline formatting is inferred — legacy text was plain.
+ */
+export function legacyToDocModel(content) {
+    const blocks = [];
+    for (const section of content?.sections ?? []) {
+        if (section.heading) {
+            blocks.push({ type: 'heading', level: 1, inlines: textInline(section.heading) });
+        }
+        if (section.text) {
+            for (const para of section.text.split(/\n{2,}/)) {
+                const trimmed = para.trim();
+                if (trimmed)
+                    blocks.push({ type: 'paragraph', inlines: textInline(trimmed) });
+            }
+        }
+        if (section.list) {
+            blocks.push({
+                type: 'list',
+                ordered: false,
+                items: section.list.map(item => ({ inlines: textInline(item) })),
+            });
+        }
+        if (section.table) {
+            blocks.push({
+                type: 'table',
+                headers: section.table.headers.map(h => textInline(h)),
+                rows: section.table.rows.map(row => row.map(cell => textInline(cell))),
+            });
+        }
+    }
+    return { meta: { title: content?.title }, blocks };
+}
+//# sourceMappingURL=doc-model.js.map

package/dist/tools/authoring/doc-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doc-model.js","sourceRoot":"","sources":["../../../src/tools/authoring/doc-model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAyEH,gFAAgF;AAEhF,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED;uCACuC;AACvC,MAAM,UAAU,iBAAiB,CAAC,OAAiB;IACjD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;YACf,KAAK,MAAM,CAAC;YACZ,KAAK,MAAM;gBACT,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC;gBACd,MAAM;YACR,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI,CAAC;YACV,KAAK,MAAM;gBACT,GAAG,IAAI,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM;YACR,KAAK,OAAO;gBACV,GAAG,IAAI,GAAG,CAAC;gBACX,MAAM;YACR,KAAK,aAAa;gBAChB,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAyB;IACxD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,OAAO;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACtD,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;aACvE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC;AACrD,CAAC"}

package/dist/tools/authoring/frontmatter.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Front-matter + directive pre-pass for the authoring engine.
+ *
+ * Markdown can't express document metadata, callouts, page breaks, or
+ * footnotes, so we layer a deliberately small extended syntax on top (the
+ * pandoc/MyST playbook) and strip it here BEFORE `marked` sees the body:
+ *
+ *   ---                         YAML-lite front-matter (flat keys + one inline
+ *   title: Q3 Proposal            map for `brand`). No js-yaml dependency.
+ *   style: proposal
+ *   ---
+ *
+ *   :::callout{type=warning title="Heads up"}   fenced directive → a callout
+ *   Payment due in **30 days**.                  block (inner is real markdown)
+ *   :::
+ *
+ *   :::pagebreak                                 a hard page break
+ *
+ *   [^1]: A footnote definition.                 collected → DocMeta.footnotes
+ *
+ * Everything else is plain markdown handled by md-parse.ts. These helpers are
+ * pure string/structure transforms with no marked dependency, so they're
+ * trivially unit-testable.
+ */
+import type { DocMeta, CalloutVariant } from './doc-model.js';
+/** Strip a leading `---\n…\n---` block and parse it into DocMeta. Returns the
+ *  remaining body untouched when there's no front-matter. */
+export declare function parseFrontMatter(raw: string): {
+    meta: DocMeta;
+    body: string;
+};
+/** Pull `[^id]: text` definition lines out of the body into a map; references
+ *  `[^id]` are left in place for the inline parser. */
+export declare function extractFootnoteDefs(body: string): {
+    body: string;
+    defs: Record<string, string>;
+};
+export interface Segment {
+    kind: 'markdown' | 'callout' | 'pagebreak';
+    /** kind==='markdown' */
+    text?: string;
+    /** kind==='callout' */
+    variant?: CalloutVariant;
+    title?: string;
+    body?: string;
+}
+/** Split a body into directive segments and plain-markdown runs. Callout fences
+ *  (`:::callout{…}` or `:::warning` … `:::`) and `:::pagebreak` become their own
+ *  segments; everything between is markdown for the lexer. */
+export declare function splitDirectives(body: string): Segment[];
+//# sourceMappingURL=frontmatter.d.ts.map

package/dist/tools/authoring/frontmatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../../src/tools/authoring/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAe,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAI3E;6DAC6D;AAC7D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAO7E;AAkED;uDACuD;AACvD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAUhG;AAID,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;IAC3C,wBAAwB;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;8DAE8D;AAC9D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,EAAE,CA0CvD"}