yaver-feedback-react-native 0.7.3 → 0.7.4

package/dist/_core/constants.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Canonical client-side constants shared between:
+ *   - Yaver mobile (`mobile/`)
+ *   - yaver-feedback-react-native (`sdk/feedback/react-native/`)
+ *   - yaver-feedback-web           (`sdk/feedback/web/`)
+ *   - web dashboard                (`web/`)
+ *
+ * This is THE source of truth. If you need to change one of these
+ * values, change it here and re-run `scripts/sync-client-core.sh` so
+ * every consumer picks it up. Each consumer ships its own compiled
+ * copy so the shared/client-core directory never needs to be published
+ * to npm — but the copies MUST remain byte-identical.
+ *
+ * DO NOT edit the copies under `mobile/src/_core/` or
+ * `sdk/feedback/react-native/src/_core/` directly. They will be
+ * overwritten by the sync script, and a CI check fails the build if
+ * they drift.
+ *
+ * See ARCHITECTURE_CLIENT_CORE.md for the full plan.
+ */
+export declare const CONVEX_SITE_URL = "https://perceptive-minnow-557.eu-west-1.convex.site";
+export declare const WEB_BASE_URL = "https://yaver.io";
+/** Default HTTP port `yaver serve` listens on. */
+export declare const DEFAULT_AGENT_HTTP_PORT = 18080;
+/** UDP port the LAN beacon is broadcast on. */
+export declare const DEFAULT_BEACON_UDP_PORT = 19837;
+/**
+ * How old an agent's last heartbeat can be before the device is
+ * considered offline. Mirrors `backend/convex/devices.ts` so
+ * Convex + every client agree on the same threshold.
+ */
+export declare const HEARTBEAT_STALE_MS = 90000;
+/**
+ * How long after the last UDP beacon an agent is still considered
+ * "locally present". Re-broadcast interval is 3 s, so 10 s covers
+ * three missed beats without false offline.
+ */
+export declare const BEACON_STALE_MS = 10000;
+/** Timeout for a direct /health probe over LAN. */
+export declare const PROBE_TIMEOUT_MS = 2500;
+/** Timeout for /health probe routed through a relay server. */
+export declare const RELAY_PROBE_TIMEOUT_MS = 6000;
+/**
+ * OAuth callback URL used by mobile + SDK deep-link flows. The yaver.io
+ * web OAuth endpoints redirect here once the provider returns. Android
+ * consumers must register the matching `<intent-filter>` in their
+ * manifest; iOS consumers inside an `ASWebAuthenticationSession` don't
+ * need to.
+ */
+export declare const OAUTH_REDIRECT = "yaver://oauth-callback";

package/dist/_core/constants.js

@@ -0,0 +1,75 @@
+"use strict";
+// AUTO-SYNCED from shared/client-core/src/constants.ts.
+// DO NOT EDIT IN PLACE. Edit the source and re-run
+// scripts/sync-client-core.sh. CI checks drift via `--check`.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_REDIRECT = exports.RELAY_PROBE_TIMEOUT_MS = exports.PROBE_TIMEOUT_MS = exports.BEACON_STALE_MS = exports.HEARTBEAT_STALE_MS = exports.DEFAULT_BEACON_UDP_PORT = exports.DEFAULT_AGENT_HTTP_PORT = exports.WEB_BASE_URL = exports.CONVEX_SITE_URL = void 0;
+/**
+ * Canonical client-side constants shared between:
+ *   - Yaver mobile (`mobile/`)
+ *   - yaver-feedback-react-native (`sdk/feedback/react-native/`)
+ *   - yaver-feedback-web           (`sdk/feedback/web/`)
+ *   - web dashboard                (`web/`)
+ *
+ * This is THE source of truth. If you need to change one of these
+ * values, change it here and re-run `scripts/sync-client-core.sh` so
+ * every consumer picks it up. Each consumer ships its own compiled
+ * copy so the shared/client-core directory never needs to be published
+ * to npm — but the copies MUST remain byte-identical.
+ *
+ * DO NOT edit the copies under `mobile/src/_core/` or
+ * `sdk/feedback/react-native/src/_core/` directly. They will be
+ * overwritten by the sync script, and a CI check fails the build if
+ * they drift.
+ *
+ * See ARCHITECTURE_CLIENT_CORE.md for the full plan.
+ */
+// ── Yaver.io production Convex deployment ────────────────────────────
+//
+// This is the Convex site every yaver.io client signs in against and
+// every Go agent validates tokens against. If yaver.io migrates the
+// deployment (as it did from shocking-echidna-394 → perceptive-minnow-
+// 557 in early 2026), bump this constant and every client — mobile,
+// both Feedback SDKs, web dashboard — picks it up on the next rebuild.
+// No more "invalid token" 403s from clients sitting on a stale URL.
+exports.CONVEX_SITE_URL = 'https://perceptive-minnow-557.eu-west-1.convex.site';
+// Public web origin. Used for OAuth redirect URL building, the account
+// merge approval page, and SDK deep-links. Separate from CONVEX_SITE_URL
+// because the web app and Convex live on different origins.
+exports.WEB_BASE_URL = 'https://yaver.io';
+// ── Transport ─────────────────────────────────────────────────────────
+/** Default HTTP port `yaver serve` listens on. */
+exports.DEFAULT_AGENT_HTTP_PORT = 18080;
+/** UDP port the LAN beacon is broadcast on. */
+exports.DEFAULT_BEACON_UDP_PORT = 19837;
+// ── Freshness windows ─────────────────────────────────────────────────
+//
+// All three of these must match the corresponding constants on the
+// backend (`backend/convex/devices.ts::HEARTBEAT_STALE_MS`) and the
+// desktop agent. Drift between clients and backend produces "green on
+// one, yellow on the other" UX glitches from clock-skew alone.
+/**
+ * How old an agent's last heartbeat can be before the device is
+ * considered offline. Mirrors `backend/convex/devices.ts` so
+ * Convex + every client agree on the same threshold.
+ */
+exports.HEARTBEAT_STALE_MS = 90000;
+/**
+ * How long after the last UDP beacon an agent is still considered
+ * "locally present". Re-broadcast interval is 3 s, so 10 s covers
+ * three missed beats without false offline.
+ */
+exports.BEACON_STALE_MS = 10000;
+/** Timeout for a direct /health probe over LAN. */
+exports.PROBE_TIMEOUT_MS = 2500;
+/** Timeout for /health probe routed through a relay server. */
+exports.RELAY_PROBE_TIMEOUT_MS = 6000;
+// ── Auth ──────────────────────────────────────────────────────────────
+/**
+ * OAuth callback URL used by mobile + SDK deep-link flows. The yaver.io
+ * web OAuth endpoints redirect here once the provider returns. Android
+ * consumers must register the matching `<intent-filter>` in their
+ * manifest; iOS consumers inside an `ASWebAuthenticationSession` don't
+ * need to.
+ */
+exports.OAUTH_REDIRECT = 'yaver://oauth-callback';

package/dist/_core/endpoints.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Endpoint paths for every service the Yaver clients talk to.
+ *
+ * Kept here so a typo in one consumer doesn't cause a subtle 404 that
+ * only shows up in one client. Any new agent endpoint added to
+ * `desktop/agent/httpserver.go` should get a matching entry here.
+ *
+ * Source of truth — see ARCHITECTURE_CLIENT_CORE.md. Copies in
+ * `mobile/src/_core/` and `sdk/feedback/react-native/src/_core/`
+ * must remain byte-identical; do not edit those directly.
+ */
+/** Routes on the user's Go agent (http://<host>:18080). */
+export declare const AGENT_ENDPOINTS: {
+    readonly health: "/health";
+    readonly info: "/info";
+    readonly agentStatus: "/agent/status";
+    readonly runners: "/agent/runners";
+    readonly feedback: "/feedback";
+    readonly feedbackFix: (id: string) => string;
+    readonly feedbackStream: "/feedback/stream";
+    readonly devReload: "/dev/reload";
+    readonly devReloadApp: "/dev/reload-app";
+    readonly devStart: "/dev/start";
+    readonly devStop: "/dev/stop";
+    readonly devStatus: "/dev/status";
+    readonly devEvents: "/dev/events";
+    readonly devBuildNative: "/dev/build-native";
+    readonly builds: "/builds";
+    readonly buildArtifact: (id: string) => string;
+    readonly tasks: "/tasks";
+    readonly taskById: (id: string) => string;
+    readonly taskStop: (id: string) => string;
+    readonly vibing: "/vibing";
+    readonly vibingExecute: "/vibing/execute";
+    readonly voiceStatus: "/voice/status";
+    readonly voiceTranscribe: "/voice/transcribe";
+    readonly blackboxEvents: "/blackbox/events";
+    readonly blackboxCommandStream: "/blackbox/command-stream";
+    readonly sdkTokenRotate: "/sdk/token/rotate";
+    readonly testAppStart: "/test-app/start";
+    readonly testAppStop: "/test-app/stop";
+    readonly testAppStatus: "/test-app/status";
+};
+/** Routes on the yaver.io Convex deployment. */
+export declare const CONVEX_ENDPOINTS: {
+    readonly devicesList: "/devices/list";
+    readonly deviceRemove: "/devices/remove";
+    readonly authValidate: "/auth/validate";
+    readonly authAppleNative: "/auth/apple-native";
+    readonly authSignup: "/auth/signup";
+    readonly authLogin: "/auth/login";
+    readonly userSettings: "/settings";
+    readonly platformConfig: "/config";
+    readonly guestsList: "/guests/list";
+    readonly guestsHosts: "/guests/hosts";
+    readonly guestsAllowed: "/guests/allowed";
+    readonly guestsInvite: "/guests/invite";
+    readonly guestsAccept: "/guests/accept";
+    readonly guestsAcceptCode: "/guests/accept-code";
+    readonly guestsRevoke: "/guests/revoke";
+};
+/** Routes on a relay server. */
+export declare const RELAY_ENDPOINTS: {
+    readonly presence: "/presence";
+    readonly forDevice: (deviceId: string) => string;
+};

package/dist/_core/endpoints.js

@@ -0,0 +1,72 @@
+"use strict";
+// AUTO-SYNCED from shared/client-core/src/endpoints.ts.
+// DO NOT EDIT IN PLACE. Edit the source and re-run
+// scripts/sync-client-core.sh. CI checks drift via `--check`.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RELAY_ENDPOINTS = exports.CONVEX_ENDPOINTS = exports.AGENT_ENDPOINTS = void 0;
+/**
+ * Endpoint paths for every service the Yaver clients talk to.
+ *
+ * Kept here so a typo in one consumer doesn't cause a subtle 404 that
+ * only shows up in one client. Any new agent endpoint added to
+ * `desktop/agent/httpserver.go` should get a matching entry here.
+ *
+ * Source of truth — see ARCHITECTURE_CLIENT_CORE.md. Copies in
+ * `mobile/src/_core/` and `sdk/feedback/react-native/src/_core/`
+ * must remain byte-identical; do not edit those directly.
+ */
+/** Routes on the user's Go agent (http://<host>:18080). */
+exports.AGENT_ENDPOINTS = {
+    health: '/health',
+    info: '/info',
+    agentStatus: '/agent/status',
+    runners: '/agent/runners',
+    feedback: '/feedback',
+    feedbackFix: (id) => `/feedback/${encodeURIComponent(id)}/fix`,
+    feedbackStream: '/feedback/stream',
+    devReload: '/dev/reload',
+    devReloadApp: '/dev/reload-app',
+    devStart: '/dev/start',
+    devStop: '/dev/stop',
+    devStatus: '/dev/status',
+    devEvents: '/dev/events',
+    devBuildNative: '/dev/build-native',
+    builds: '/builds',
+    buildArtifact: (id) => `/builds/${encodeURIComponent(id)}/artifact`,
+    tasks: '/tasks',
+    taskById: (id) => `/tasks/${encodeURIComponent(id)}`,
+    taskStop: (id) => `/tasks/${encodeURIComponent(id)}/stop`,
+    vibing: '/vibing',
+    vibingExecute: '/vibing/execute',
+    voiceStatus: '/voice/status',
+    voiceTranscribe: '/voice/transcribe',
+    blackboxEvents: '/blackbox/events',
+    blackboxCommandStream: '/blackbox/command-stream',
+    sdkTokenRotate: '/sdk/token/rotate',
+    testAppStart: '/test-app/start',
+    testAppStop: '/test-app/stop',
+    testAppStatus: '/test-app/status',
+};
+/** Routes on the yaver.io Convex deployment. */
+exports.CONVEX_ENDPOINTS = {
+    devicesList: '/devices/list',
+    deviceRemove: '/devices/remove',
+    authValidate: '/auth/validate',
+    authAppleNative: '/auth/apple-native',
+    authSignup: '/auth/signup',
+    authLogin: '/auth/login',
+    userSettings: '/settings',
+    platformConfig: '/config',
+    guestsList: '/guests/list',
+    guestsHosts: '/guests/hosts',
+    guestsAllowed: '/guests/allowed',
+    guestsInvite: '/guests/invite',
+    guestsAccept: '/guests/accept',
+    guestsAcceptCode: '/guests/accept-code',
+    guestsRevoke: '/guests/revoke',
+};
+/** Routes on a relay server. */
+exports.RELAY_ENDPOINTS = {
+    presence: '/presence',
+    forDevice: (deviceId) => `/d/${encodeURIComponent(deviceId)}`,
+};

package/dist/_core/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @yaver/client-core — shared constants + endpoint paths used by every
+ * Yaver client (mobile, feedback SDKs, web dashboard, desktop app).
+ *
+ * Phase 1 of the extraction documented in ARCHITECTURE_CLIENT_CORE.md.
+ * Later phases add dedup helpers, Discovery, OAuth, BlackBox, etc. —
+ * see that doc for the full roadmap.
+ *
+ * Not published to npm. Consumers mirror this directory as `_core/`
+ * under their own `src/` and re-export. `scripts/sync-client-core.sh`
+ * keeps the mirrors byte-identical; CI verifies it.
+ */
+export * from './constants';
+export * from './endpoints';

package/dist/_core/index.js

@@ -0,0 +1,33 @@
+"use strict";
+// AUTO-SYNCED from shared/client-core/src/index.ts.
+// DO NOT EDIT IN PLACE. Edit the source and re-run
+// scripts/sync-client-core.sh. CI checks drift via `--check`.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * @yaver/client-core — shared constants + endpoint paths used by every
+ * Yaver client (mobile, feedback SDKs, web dashboard, desktop app).
+ *
+ * Phase 1 of the extraction documented in ARCHITECTURE_CLIENT_CORE.md.
+ * Later phases add dedup helpers, Discovery, OAuth, BlackBox, etc. —
+ * see that doc for the full roadmap.
+ *
+ * Not published to npm. Consumers mirror this directory as `_core/`
+ * under their own `src/` and re-export. `scripts/sync-client-core.sh`
+ * keeps the mirrors byte-identical; CI verifies it.
+ */
+__exportStar(require("./constants"), exports);
+__exportStar(require("./endpoints"), exports);

package/dist/auth.js

@@ -63,13 +63,15 @@ catch {
 const TOKEN_KEY = 'yaver_feedback_auth_token';
 const USER_KEY = 'yaver_feedback_user';
 const DEVICE_KEY = 'yaver_feedback_selected_device';
-// Source of truth: mobile/src/lib/constants.ts → CONVEX_SITE_URL.
-// The yaver-io Convex deployment was migrated from shocking-echidna-394
-// to perceptive-minnow-557; sessions minted against the old deployment
-// don't validate on agents that point at the new one, producing a 403
-// "invalid token" from the agent's authSDK middleware.
-exports.DEFAULT_CONVEX_SITE_URL = 'https://perceptive-minnow-557.eu-west-1.convex.site';
-exports.DEFAULT_WEB_BASE_URL = 'https://yaver.io';
+// Source of truth: `shared/client-core/src/constants.ts`, mirrored to
+// `./_core/constants` via `scripts/sync-client-core.sh`. Keeps the
+// SDK, mobile app, and web dashboard on the same Convex deployment
+// string at all times — previously this drifted and produced 403
+// "invalid token" from the agent's authSDK middleware. See
+// ARCHITECTURE_CLIENT_CORE.md.
+const constants_1 = require("./_core/constants");
+exports.DEFAULT_CONVEX_SITE_URL = constants_1.CONVEX_SITE_URL;
+exports.DEFAULT_WEB_BASE_URL = constants_1.WEB_BASE_URL;
 let convexSiteUrl = exports.DEFAULT_CONVEX_SITE_URL;
 let webBaseUrl = exports.DEFAULT_WEB_BASE_URL;
 let strictNativeAuth = false;
@@ -266,7 +268,7 @@ async function signInWithApple() {
  * register the scheme on iOS. On Android, add an `<intent-filter>` for
  * `yaver://oauth-callback` in the host app's AndroidManifest.xml.
  */
-exports.DEFAULT_OAUTH_REDIRECT = 'yaver://oauth-callback';
+exports.DEFAULT_OAUTH_REDIRECT = constants_1.OAUTH_REDIRECT;
 /**
  * Sign in through the in-app browser via yaver.io. Opens
  * `https://yaver.io/api/auth/oauth/<provider>?client=mobile`, the user picks

package/dist/deviceDedup.d.ts

@@ -24,10 +24,11 @@ import type { RemoteDevice } from './auth';
 export declare function collapseRemoteDevices(devices: RemoteDevice[]): RemoteDevice[];
 /**
  * Threshold for "online" based on heartbeat age, in milliseconds.
- * Matches the mobile app (HEARTBEAT_STALE_MS = 90 s). The SDK used
- * 60 s, which flashed yellow on single missed beats.
+ * Re-exported from `@yaver/client-core` so mobile + SDK + backend
+ * agree on one number at all times.
  */
-export declare const HEARTBEAT_STALE_MS = 90000;
+import { HEARTBEAT_STALE_MS } from './_core/constants';
+export { HEARTBEAT_STALE_MS };
 /**
  * Returns a freshness flag consistent with the mobile app. A device is
  * "fresh" when it was online per Convex AND its heartbeat is within

package/dist/deviceDedup.js

@@ -141,10 +141,11 @@ function collapseRemoteDevices(devices) {
 }
 /**
  * Threshold for "online" based on heartbeat age, in milliseconds.
- * Matches the mobile app (HEARTBEAT_STALE_MS = 90 s). The SDK used
- * 60 s, which flashed yellow on single missed beats.
+ * Re-exported from `@yaver/client-core` so mobile + SDK + backend
+ * agree on one number at all times.
  */
-exports.HEARTBEAT_STALE_MS = 90000;
+const constants_1 = require("./_core/constants");
+Object.defineProperty(exports, "HEARTBEAT_STALE_MS", { enumerable: true, get: function () { return constants_1.HEARTBEAT_STALE_MS; } });
 /**
  * Returns a freshness flag consistent with the mobile app. A device is
  * "fresh" when it was online per Convex AND its heartbeat is within
@@ -155,7 +156,7 @@ function isDeviceFresh(d) {
         return false;
     if (!d.lastHeartbeat)
         return true;
-    return Date.now() - d.lastHeartbeat < exports.HEARTBEAT_STALE_MS;
+    return Date.now() - d.lastHeartbeat < constants_1.HEARTBEAT_STALE_MS;
 }
 /**
  * Pick the best candidate for an auto-connect attempt. Preference:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yaver-feedback-react-native",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Visual feedback SDK for Yaver — bug reports, screen recording, voice annotations, and local-first developer workflows",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/_core/constants.ts

@@ -0,0 +1,86 @@
+// AUTO-SYNCED from shared/client-core/src/constants.ts.
+// DO NOT EDIT IN PLACE. Edit the source and re-run
+// scripts/sync-client-core.sh. CI checks drift via `--check`.
+
+/**
+ * Canonical client-side constants shared between:
+ *   - Yaver mobile (`mobile/`)
+ *   - yaver-feedback-react-native (`sdk/feedback/react-native/`)
+ *   - yaver-feedback-web           (`sdk/feedback/web/`)
+ *   - web dashboard                (`web/`)
+ *
+ * This is THE source of truth. If you need to change one of these
+ * values, change it here and re-run `scripts/sync-client-core.sh` so
+ * every consumer picks it up. Each consumer ships its own compiled
+ * copy so the shared/client-core directory never needs to be published
+ * to npm — but the copies MUST remain byte-identical.
+ *
+ * DO NOT edit the copies under `mobile/src/_core/` or
+ * `sdk/feedback/react-native/src/_core/` directly. They will be
+ * overwritten by the sync script, and a CI check fails the build if
+ * they drift.
+ *
+ * See ARCHITECTURE_CLIENT_CORE.md for the full plan.
+ */
+
+// ── Yaver.io production Convex deployment ────────────────────────────
+//
+// This is the Convex site every yaver.io client signs in against and
+// every Go agent validates tokens against. If yaver.io migrates the
+// deployment (as it did from shocking-echidna-394 → perceptive-minnow-
+// 557 in early 2026), bump this constant and every client — mobile,
+// both Feedback SDKs, web dashboard — picks it up on the next rebuild.
+// No more "invalid token" 403s from clients sitting on a stale URL.
+export const CONVEX_SITE_URL =
+  'https://perceptive-minnow-557.eu-west-1.convex.site';
+
+// Public web origin. Used for OAuth redirect URL building, the account
+// merge approval page, and SDK deep-links. Separate from CONVEX_SITE_URL
+// because the web app and Convex live on different origins.
+export const WEB_BASE_URL = 'https://yaver.io';
+
+// ── Transport ─────────────────────────────────────────────────────────
+
+/** Default HTTP port `yaver serve` listens on. */
+export const DEFAULT_AGENT_HTTP_PORT = 18080;
+
+/** UDP port the LAN beacon is broadcast on. */
+export const DEFAULT_BEACON_UDP_PORT = 19837;
+
+// ── Freshness windows ─────────────────────────────────────────────────
+//
+// All three of these must match the corresponding constants on the
+// backend (`backend/convex/devices.ts::HEARTBEAT_STALE_MS`) and the
+// desktop agent. Drift between clients and backend produces "green on
+// one, yellow on the other" UX glitches from clock-skew alone.
+
+/**
+ * How old an agent's last heartbeat can be before the device is
+ * considered offline. Mirrors `backend/convex/devices.ts` so
+ * Convex + every client agree on the same threshold.
+ */
+export const HEARTBEAT_STALE_MS = 90_000;
+
+/**
+ * How long after the last UDP beacon an agent is still considered
+ * "locally present". Re-broadcast interval is 3 s, so 10 s covers
+ * three missed beats without false offline.
+ */
+export const BEACON_STALE_MS = 10_000;
+
+/** Timeout for a direct /health probe over LAN. */
+export const PROBE_TIMEOUT_MS = 2_500;
+
+/** Timeout for /health probe routed through a relay server. */
+export const RELAY_PROBE_TIMEOUT_MS = 6_000;
+
+// ── Auth ──────────────────────────────────────────────────────────────
+
+/**
+ * OAuth callback URL used by mobile + SDK deep-link flows. The yaver.io
+ * web OAuth endpoints redirect here once the provider returns. Android
+ * consumers must register the matching `<intent-filter>` in their
+ * manifest; iOS consumers inside an `ASWebAuthenticationSession` don't
+ * need to.
+ */
+export const OAUTH_REDIRECT = 'yaver://oauth-callback';

package/src/_core/endpoints.ts

@@ -0,0 +1,81 @@
+// AUTO-SYNCED from shared/client-core/src/endpoints.ts.
+// DO NOT EDIT IN PLACE. Edit the source and re-run
+// scripts/sync-client-core.sh. CI checks drift via `--check`.
+
+/**
+ * Endpoint paths for every service the Yaver clients talk to.
+ *
+ * Kept here so a typo in one consumer doesn't cause a subtle 404 that
+ * only shows up in one client. Any new agent endpoint added to
+ * `desktop/agent/httpserver.go` should get a matching entry here.
+ *
+ * Source of truth — see ARCHITECTURE_CLIENT_CORE.md. Copies in
+ * `mobile/src/_core/` and `sdk/feedback/react-native/src/_core/`
+ * must remain byte-identical; do not edit those directly.
+ */
+
+/** Routes on the user's Go agent (http://<host>:18080). */
+export const AGENT_ENDPOINTS = {
+  health: '/health',
+  info: '/info',
+  agentStatus: '/agent/status',
+  runners: '/agent/runners',
+
+  feedback: '/feedback',
+  feedbackFix: (id: string) => `/feedback/${encodeURIComponent(id)}/fix`,
+  feedbackStream: '/feedback/stream',
+
+  devReload: '/dev/reload',
+  devReloadApp: '/dev/reload-app',
+  devStart: '/dev/start',
+  devStop: '/dev/stop',
+  devStatus: '/dev/status',
+  devEvents: '/dev/events',
+  devBuildNative: '/dev/build-native',
+
+  builds: '/builds',
+  buildArtifact: (id: string) => `/builds/${encodeURIComponent(id)}/artifact`,
+
+  tasks: '/tasks',
+  taskById: (id: string) => `/tasks/${encodeURIComponent(id)}`,
+  taskStop: (id: string) => `/tasks/${encodeURIComponent(id)}/stop`,
+
+  vibing: '/vibing',
+  vibingExecute: '/vibing/execute',
+
+  voiceStatus: '/voice/status',
+  voiceTranscribe: '/voice/transcribe',
+
+  blackboxEvents: '/blackbox/events',
+  blackboxCommandStream: '/blackbox/command-stream',
+
+  sdkTokenRotate: '/sdk/token/rotate',
+  testAppStart: '/test-app/start',
+  testAppStop: '/test-app/stop',
+  testAppStatus: '/test-app/status',
+} as const;
+
+/** Routes on the yaver.io Convex deployment. */
+export const CONVEX_ENDPOINTS = {
+  devicesList: '/devices/list',
+  deviceRemove: '/devices/remove',
+  authValidate: '/auth/validate',
+  authAppleNative: '/auth/apple-native',
+  authSignup: '/auth/signup',
+  authLogin: '/auth/login',
+  userSettings: '/settings',
+  platformConfig: '/config',
+  guestsList: '/guests/list',
+  guestsHosts: '/guests/hosts',
+  guestsAllowed: '/guests/allowed',
+  guestsInvite: '/guests/invite',
+  guestsAccept: '/guests/accept',
+  guestsAcceptCode: '/guests/accept-code',
+  guestsRevoke: '/guests/revoke',
+} as const;
+
+/** Routes on a relay server. */
+export const RELAY_ENDPOINTS = {
+  presence: '/presence',
+  forDevice: (deviceId: string) => `/d/${encodeURIComponent(deviceId)}`,
+} as const;

package/src/_core/index.ts

@@ -0,0 +1,19 @@
+// AUTO-SYNCED from shared/client-core/src/index.ts.
+// DO NOT EDIT IN PLACE. Edit the source and re-run
+// scripts/sync-client-core.sh. CI checks drift via `--check`.
+
+/**
+ * @yaver/client-core — shared constants + endpoint paths used by every
+ * Yaver client (mobile, feedback SDKs, web dashboard, desktop app).
+ *
+ * Phase 1 of the extraction documented in ARCHITECTURE_CLIENT_CORE.md.
+ * Later phases add dedup helpers, Discovery, OAuth, BlackBox, etc. —
+ * see that doc for the full roadmap.
+ *
+ * Not published to npm. Consumers mirror this directory as `_core/`
+ * under their own `src/` and re-export. `scripts/sync-client-core.sh`
+ * keeps the mirrors byte-identical; CI verifies it.
+ */
+
+export * from './constants';
+export * from './endpoints';

package/src/auth.ts

@@ -67,14 +67,15 @@ const TOKEN_KEY = 'yaver_feedback_auth_token';
 const USER_KEY = 'yaver_feedback_user';
 const DEVICE_KEY = 'yaver_feedback_selected_device';
 
-// Source of truth: mobile/src/lib/constants.ts → CONVEX_SITE_URL.
-// The yaver-io Convex deployment was migrated from shocking-echidna-394
-// to perceptive-minnow-557; sessions minted against the old deployment
-// don't validate on agents that point at the new one, producing a 403
-// "invalid token" from the agent's authSDK middleware.
-export const DEFAULT_CONVEX_SITE_URL =
-  'https://perceptive-minnow-557.eu-west-1.convex.site';
-export const DEFAULT_WEB_BASE_URL = 'https://yaver.io';
+// Source of truth: `shared/client-core/src/constants.ts`, mirrored to
+// `./_core/constants` via `scripts/sync-client-core.sh`. Keeps the
+// SDK, mobile app, and web dashboard on the same Convex deployment
+// string at all times — previously this drifted and produced 403
+// "invalid token" from the agent's authSDK middleware. See
+// ARCHITECTURE_CLIENT_CORE.md.
+import { CONVEX_SITE_URL, WEB_BASE_URL, OAUTH_REDIRECT } from './_core/constants';
+export const DEFAULT_CONVEX_SITE_URL = CONVEX_SITE_URL;
+export const DEFAULT_WEB_BASE_URL = WEB_BASE_URL;
 
 let convexSiteUrl = DEFAULT_CONVEX_SITE_URL;
 let webBaseUrl = DEFAULT_WEB_BASE_URL;
@@ -294,7 +295,7 @@ export async function signInWithApple(): Promise<{ token: string; userId: string
  * register the scheme on iOS. On Android, add an `<intent-filter>` for
  * `yaver://oauth-callback` in the host app's AndroidManifest.xml.
  */
-export const DEFAULT_OAUTH_REDIRECT = 'yaver://oauth-callback';
+export const DEFAULT_OAUTH_REDIRECT = OAUTH_REDIRECT;
 
 /**
  * Sign in through the in-app browser via yaver.io. Opens

package/src/deviceDedup.ts

@@ -141,10 +141,11 @@ export function collapseRemoteDevices(devices: RemoteDevice[]): RemoteDevice[] {
 
 /**
  * Threshold for "online" based on heartbeat age, in milliseconds.
- * Matches the mobile app (HEARTBEAT_STALE_MS = 90 s). The SDK used
- * 60 s, which flashed yellow on single missed beats.
+ * Re-exported from `@yaver/client-core` so mobile + SDK + backend
+ * agree on one number at all times.
  */
-export const HEARTBEAT_STALE_MS = 90_000;
+import { HEARTBEAT_STALE_MS } from './_core/constants';
+export { HEARTBEAT_STALE_MS };
 
 /**
  * Returns a freshness flag consistent with the mobile app. A device is