@foldrun/core 0.2.0

package/dist/src/triggers.d.ts

@@ -0,0 +1,60 @@
+import { type FlowInfo, type FlowStep, type RunRecord } from "./store.ts";
+/** Staple a payload to the first step, the way the run route staples a task. */
+export declare function withTask(steps: FlowStep[], tag: string, body: string): FlowStep[];
+/** The flows a finished run should start, by this workspace's own files. */
+export declare function chainedFlows(tenant: string, workspace: string, finished: RunRecord): FlowInfo[];
+/**
+ * Start every flow chained on a run that just settled. The finished run's
+ * one-line summary and its final result are the task; the run id rides
+ * along so the chained flow can name what it is reacting to. Returns the
+ * run ids started. Never throws: a chained flow that cannot start is a
+ * logged failure of that flow, not of the run that finished.
+ */
+export declare function fireChainedFlows(tenant: string, workspace: string, finished: RunRecord): Promise<string[]>;
+/** Does a stored path fall under a flow's `path:` prefix? A prefix names a
+ *  folder ("leads/") or a file ("leads/latest.csv"); an empty prefix is all
+ *  of storage/. */
+export declare function underPrefix(rel: string, prefix: string | null): boolean;
+/**
+ * Start the flows watching a storage prefix that just gained files. `by`
+ * says who wrote them: a run's own copy-back (`run:<id>`) must not restart
+ * the flow that produced it, or a flow writing to its own trigger folder is
+ * a loop — every other writer counts.
+ */
+export declare function fireStorageTriggers(tenant: string, workspace: string, paths: string[], by: string): Promise<string[]>;
+export interface SignatureVerdict {
+    ok: boolean;
+    reason: string;
+    /** Slack's url_verification handshake: answer with this and start nothing. */
+    challenge?: string;
+}
+/**
+ * Check a webhook delivery against the flow's declared `signature:`. The
+ * secret's VALUE is read here, host-side, from the vault; the flow file only
+ * ever names it. Each provider signs differently, and the four supported
+ * are exactly the four whose scheme is documented and stable:
+ *
+ *   github  X-Hub-Signature-256: sha256=HMAC(body)
+ *   stripe  Stripe-Signature: t=<ts>,v1=HMAC(`${ts}.${body}`), ±5 min
+ *   slack   X-Slack-Signature: v0=HMAC(`v0:${ts}:${body}`), ±5 min,
+ *           plus the url_verification challenge Slack sends when the URL
+ *           is first saved — answered, not run
+ *   hmac    X-Signature: hex HMAC(body) — for anything you sign yourself
+ */
+export declare function verifyWebhookSignature(tenant: string, workspace: string, flow: FlowInfo, rawBody: string, header: (name: string) => string | null, now?: number): SignatureVerdict;
+export interface InboundEmail {
+    from: string;
+    to: string;
+    subject: string;
+    text: string;
+}
+/**
+ * One shape out of the several inbound-email services post. JSON bodies
+ * (Resend, Postmark, Cloudflare Email Workers, anything hand-rolled) and
+ * form-encoded ones (Mailgun, SendGrid's inbound parse) both reduce to
+ * from / to / subject / text; HTML is stripped to text when that is all
+ * there is. Null when nothing in the body looks like a message.
+ */
+export declare function normaliseInboundEmail(contentType: string | null, raw: string): InboundEmail | null;
+/** The task an inbound email becomes. */
+export declare function emailTask(mail: InboundEmail): string;

package/dist/src/triggers.js

@@ -0,0 +1,270 @@
+// The ways a flow starts that are not a person, a clock or a bare POST.
+//
+// Four triggers live here, and they share one shape: something happened,
+// the flow file said it cares, the happening becomes the first step's task.
+//
+//   trigger: flow      another flow of this workspace finished (`after:`, `on:`)
+//   trigger: storage   a file landed under a storage/ prefix (`path:`)
+//   trigger: email     a message arrived at the flow's inbox URL
+//   signature:         a webhook delivery must carry a provider's HMAC
+//
+// None of them evaluates anything. A flow that chains on another does not
+// read that run's fields; it receives what the run concluded, as text, and
+// an agent reads it — the same rule as every other handoff in the format.
+import crypto from "node:crypto";
+import { platform } from "./platform.js";
+import { listFlows, readRun } from "./store.js";
+import { getSecret } from "./secrets.js";
+/** The last step's result — the same reading runner.ts makes, kept local so
+ *  this module never imports the runner (the queue imports both). */
+function runResult(run) {
+    for (let i = run.steps.length - 1; i >= 0; i--) {
+        const r = run.steps[i].result;
+        if (r && r.trim())
+            return r;
+    }
+    return null;
+}
+/** Staple a payload to the first step, the way the run route staples a task. */
+export function withTask(steps, tag, body) {
+    const text = body.trim();
+    if (!text)
+        return steps;
+    return steps.map((s, i) => (i === 0 ? { ...s, instruction: `${s.instruction}\n\n<${tag}>\n${text}\n</${tag}>` } : s));
+}
+// ------------------------------------------------------------ trigger: flow
+/** The flows a finished run should start, by this workspace's own files. */
+export function chainedFlows(tenant, workspace, finished) {
+    if (finished.status !== "completed" && finished.status !== "failed")
+        return [];
+    if (finished.flow.startsWith("adhoc:") || finished.flow.startsWith("eval:"))
+        return [];
+    return listFlows(tenant, workspace).filter((f) => f.trigger === "flow" &&
+        f.after === finished.flow &&
+        f.steps.length > 0 &&
+        // A flow chained on itself is a loop with no bound — refused here and
+        // by foldrun check, never started.
+        f.name !== finished.flow &&
+        (f.on === "any" || f.on === finished.status));
+}
+/**
+ * Start every flow chained on a run that just settled. The finished run's
+ * one-line summary and its final result are the task; the run id rides
+ * along so the chained flow can name what it is reacting to. Returns the
+ * run ids started. Never throws: a chained flow that cannot start is a
+ * logged failure of that flow, not of the run that finished.
+ */
+export async function fireChainedFlows(tenant, workspace, finished) {
+    const flows = chainedFlows(tenant, workspace, finished);
+    if (flows.length === 0)
+        return [];
+    const started = [];
+    const result = (runResult(finished) ?? "").slice(0, 20_000);
+    const body = `run: ${finished.id}\nflow: ${finished.flow}\nstatus: ${finished.status}\n` +
+        (finished.summary ? `summary: ${finished.summary}\n` : "") +
+        (result ? `\n${result}` : "");
+    for (const flow of flows) {
+        try {
+            const run = await platform.enqueueFlowRun(tenant, workspace, withTask(flow.steps, "previous_run", body), flow.name, flow.model, [
+                `after:${finished.flow}`,
+            ]);
+            started.push(run.id);
+            console.log(`[foldrun] trigger: flow — ${tenant}/${workspace}/${flow.name} started after ${finished.flow} ${finished.status}`);
+        }
+        catch (err) {
+            console.error(`[foldrun] trigger: flow — ${tenant}/${workspace}/${flow.name}:`, err instanceof Error ? err.message : err);
+        }
+    }
+    return started;
+}
+// --------------------------------------------------------- trigger: storage
+/** Does a stored path fall under a flow's `path:` prefix? A prefix names a
+ *  folder ("leads/") or a file ("leads/latest.csv"); an empty prefix is all
+ *  of storage/. */
+export function underPrefix(rel, prefix) {
+    const p = (prefix ?? "").replace(/^\/+/, "");
+    if (!p)
+        return true;
+    return rel === p || rel.startsWith(p.endsWith("/") ? p : `${p}/`) || (p.endsWith("/") && rel.startsWith(p));
+}
+/**
+ * Start the flows watching a storage prefix that just gained files. `by`
+ * says who wrote them: a run's own copy-back (`run:<id>`) must not restart
+ * the flow that produced it, or a flow writing to its own trigger folder is
+ * a loop — every other writer counts.
+ */
+export async function fireStorageTriggers(tenant, workspace, paths, by) {
+    if (paths.length === 0)
+        return [];
+    let flows;
+    try {
+        flows = listFlows(tenant, workspace).filter((f) => f.trigger === "storage" && f.steps.length > 0);
+    }
+    catch {
+        return [];
+    }
+    if (flows.length === 0)
+        return [];
+    const writerFlow = by.startsWith("run:") ? readRun(tenant, workspace, by.slice(4))?.flow ?? null : null;
+    const started = [];
+    for (const flow of flows) {
+        if (writerFlow === flow.name)
+            continue;
+        const hits = paths.filter((p) => underPrefix(p, flow.path));
+        if (hits.length === 0)
+            continue;
+        try {
+            const body = `by: ${by}\n${hits.map((h) => `- storage/${h}`).join("\n")}`;
+            const run = await platform.enqueueFlowRun(tenant, workspace, withTask(flow.steps, "storage_event", body), flow.name, flow.model, [
+                "storage",
+            ]);
+            started.push(run.id);
+        }
+        catch (err) {
+            console.error(`[foldrun] trigger: storage — ${tenant}/${workspace}/${flow.name}:`, err instanceof Error ? err.message : err);
+        }
+    }
+    return started;
+}
+function safeEqual(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && crypto.timingSafeEqual(x, y);
+}
+/**
+ * Check a webhook delivery against the flow's declared `signature:`. The
+ * secret's VALUE is read here, host-side, from the vault; the flow file only
+ * ever names it. Each provider signs differently, and the four supported
+ * are exactly the four whose scheme is documented and stable:
+ *
+ *   github  X-Hub-Signature-256: sha256=HMAC(body)
+ *   stripe  Stripe-Signature: t=<ts>,v1=HMAC(`${ts}.${body}`), ±5 min
+ *   slack   X-Slack-Signature: v0=HMAC(`v0:${ts}:${body}`), ±5 min,
+ *           plus the url_verification challenge Slack sends when the URL
+ *           is first saved — answered, not run
+ *   hmac    X-Signature: hex HMAC(body) — for anything you sign yourself
+ */
+export function verifyWebhookSignature(tenant, workspace, flow, rawBody, header, now = Date.now()) {
+    if (!flow.signature)
+        return { ok: true, reason: "no signature required" };
+    if (!flow.signingSecret)
+        return { ok: false, reason: `signature: ${flow.signature} needs signing_secret: \${NAME}` };
+    const secret = getSecret(tenant, flow.signingSecret, workspace);
+    if (!secret)
+        return { ok: false, reason: `signing secret ${flow.signingSecret} is not set` };
+    const hmac = (data) => crypto.createHmac("sha256", secret.value).update(data).digest("hex");
+    const fresh = (ts) => Math.abs(now / 1000 - ts) <= 300;
+    switch (flow.signature) {
+        case "github": {
+            const sig = header("x-hub-signature-256") ?? "";
+            const ok = sig.startsWith("sha256=") && safeEqual(sig.slice(7), hmac(rawBody));
+            return { ok, reason: ok ? "github signature verified" : "X-Hub-Signature-256 did not match" };
+        }
+        case "stripe": {
+            const sig = header("stripe-signature") ?? "";
+            const parts = Object.fromEntries(sig.split(",").map((p) => p.trim().split("=")));
+            const ts = Number(parts.t);
+            if (!Number.isFinite(ts) || !parts.v1)
+                return { ok: false, reason: "Stripe-Signature is missing t= or v1=" };
+            if (!fresh(ts))
+                return { ok: false, reason: "Stripe-Signature timestamp is outside the 5-minute window" };
+            const ok = safeEqual(parts.v1, hmac(`${ts}.${rawBody}`));
+            return { ok, reason: ok ? "stripe signature verified" : "Stripe-Signature v1 did not match" };
+        }
+        case "slack": {
+            // The handshake is unsigned in effect — Slack signs it, but a URL that
+            // cannot answer it is never saved, so answer before anything else.
+            try {
+                const parsed = JSON.parse(rawBody);
+                if (parsed?.type === "url_verification" && typeof parsed.challenge === "string") {
+                    return { ok: true, reason: "slack url_verification", challenge: parsed.challenge };
+                }
+            }
+            catch {
+                // not JSON — an ordinary signed delivery (form-encoded slash command)
+            }
+            const ts = Number(header("x-slack-request-timestamp"));
+            const sig = header("x-slack-signature") ?? "";
+            if (!Number.isFinite(ts))
+                return { ok: false, reason: "X-Slack-Request-Timestamp is missing" };
+            if (!fresh(ts))
+                return { ok: false, reason: "X-Slack-Request-Timestamp is outside the 5-minute window" };
+            const ok = sig.startsWith("v0=") && safeEqual(sig.slice(3), hmac(`v0:${ts}:${rawBody}`));
+            return { ok, reason: ok ? "slack signature verified" : "X-Slack-Signature did not match" };
+        }
+        case "hmac": {
+            const sig = (header("x-signature") ?? "").replace(/^sha256=/, "");
+            const ok = safeEqual(sig, hmac(rawBody));
+            return { ok, reason: ok ? "signature verified" : "X-Signature did not match" };
+        }
+    }
+    return { ok: false, reason: `unknown signature scheme ${String(flow.signature)}` };
+}
+/**
+ * One shape out of the several inbound-email services post. JSON bodies
+ * (Resend, Postmark, Cloudflare Email Workers, anything hand-rolled) and
+ * form-encoded ones (Mailgun, SendGrid's inbound parse) both reduce to
+ * from / to / subject / text; HTML is stripped to text when that is all
+ * there is. Null when nothing in the body looks like a message.
+ */
+export function normaliseInboundEmail(contentType, raw) {
+    let fields = {};
+    const ct = (contentType ?? "").toLowerCase();
+    if (ct.includes("application/json") || raw.trim().startsWith("{")) {
+        try {
+            fields = JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+        // Resend wraps the message in `data`; Postmark and others do not.
+        if (fields.data && typeof fields.data === "object")
+            fields = { ...fields, ...fields.data };
+    }
+    else if (ct.includes("application/x-www-form-urlencoded") || ct.includes("multipart/form-data")) {
+        if (ct.includes("multipart/form-data")) {
+            // SendGrid's inbound parse is multipart; the parts we need are plain
+            // text fields, so a minimal reader is enough and avoids a dependency.
+            const boundary = ct.match(/boundary=("?)([^";]+)\1/)?.[2];
+            if (!boundary)
+                return null;
+            for (const part of raw.split(`--${boundary}`)) {
+                const m = part.match(/name="([^"]+)"\r?\n\r?\n([\s\S]*?)\r?\n$/);
+                if (m)
+                    fields[m[1]] = m[2];
+            }
+        }
+        else {
+            for (const [k, v] of new URLSearchParams(raw))
+                fields[k] = v;
+        }
+    }
+    else {
+        return null;
+    }
+    const pick = (...names) => {
+        for (const n of names) {
+            const v = fields[n];
+            if (typeof v === "string" && v.trim())
+                return v.trim();
+            if (Array.isArray(v) && v.length && typeof v[0] === "string")
+                return v.join(", ");
+            if (v && typeof v === "object" && typeof v.email === "string") {
+                return String(v.email);
+            }
+        }
+        return "";
+    };
+    const from = pick("from", "From", "sender", "FromFull", "envelope_from");
+    const subject = pick("subject", "Subject");
+    const html = pick("html", "HtmlBody", "body-html");
+    const text = pick("text", "TextBody", "body-plain", "stripped-text", "plain") ||
+        html.replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+    if (!from && !subject && !text)
+        return null;
+    return { from, to: pick("to", "To", "recipient", "ToFull"), subject, text };
+}
+/** The task an inbound email becomes. */
+export function emailTask(mail) {
+    return `from: ${mail.from}\nto: ${mail.to}\nsubject: ${mail.subject}\n\n${mail.text}`.slice(0, 20_000);
+}

package/dist/src/webhook.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The install's secret key. Every derived token — flow hooks, git secrets —
+ * hangs off this one value, so rotating it invalidates all of them together.
+ */
+export declare function installKey(): string;
+export declare function hookGeneration(tenant: string, workspace: string, flow: string): number;
+/** Invalidate a hook's URL and mint the next one. Returns the new path. */
+export declare function rotateWebhook(tenant: string, workspace: string, flow: string): string;
+export declare function webhookToken(tenant: string, workspace: string, flow: string): string;
+export declare function webhookPath(tenant: string, workspace: string, flow: string): string;
+/**
+ * The token in an emailed approve/reject link. Same shape as a hook token:
+ * derived from the run's identity under the install key, never stored, so
+ * a link keeps working across restarts and dies with a key rotation. A run
+ * id is unique, so there is no generation counter — a leaked link is dealt
+ * with by deciding the run, after which the link does nothing.
+ *
+ * The `approve:` prefix keeps this HMAC family apart from the hook family:
+ * without it a run id that happened to spell `tenant/ws/flow` would mint a
+ * working hook token.
+ */
+export declare function approveToken(tenant: string, workspace: string, runId: string): string;
+/**
+ * The token that releases a run parked on `wait: event`. Its own HMAC
+ * family, so an approval link cannot double as an event URL or the reverse.
+ */
+export declare function eventToken(tenant: string, workspace: string, runId: string): string;
+/** The URL a `wait: event` step is released at — absolute when the install
+ *  knows its origin, a path otherwise. */
+export declare function eventUrl(tenant: string, workspace: string, runId: string): string;
+/**
+ * Where this install can be reached from outside, or null. The platform has
+ * never needed to know its own address — every URL it hands out has been a
+ * path, completed by whoever pasted it. A link in an email has no such
+ * reader, so this is the one place an absolute origin is required.
+ */
+export declare function publicUrl(): string | null;
+export interface HookDelivery {
+    t: string;
+    flow: string;
+    outcome: "accepted" | "invalid-token" | "invalid-signature" | "not-webhook" | "no-flow" | "error";
+    runId?: string;
+    bytes?: number;
+    detail?: string;
+}
+export declare function recordDelivery(tenant: string, workspace: string, delivery: HookDelivery): void;
+export declare function readDeliveries(tenant: string, workspace: string, limit?: number): HookDelivery[];

package/dist/src/webhook.js

@@ -0,0 +1,148 @@
+// Per-flow webhook tokens, derived rather than stored: HMAC of the flow's
+// identity under the install's secret key. Stable across restarts, unique
+// per flow, and rotating FOLDRUN_SECRET_KEY invalidates every hook at once.
+import fs from "node:fs";
+import path from "node:path";
+import { dataRoot } from "./paths.js";
+import { workspaceDir } from "./store.js";
+import crypto from "node:crypto";
+const keyFile = () => path.join(dataRoot(), ".secret-key");
+/**
+ * The install's secret key. Every derived token — flow hooks, git secrets —
+ * hangs off this one value, so rotating it invalidates all of them together.
+ */
+export function installKey() {
+    if (process.env.FOLDRUN_SECRET_KEY)
+        return process.env.FOLDRUN_SECRET_KEY;
+    if (fs.existsSync(keyFile()))
+        return fs.readFileSync(keyFile(), "utf8");
+    // secrets.ts creates this on first use; fall back to a fixed dev value so
+    // hook URLs stay stable before any secret has been set.
+    return "foldrun-dev-install";
+}
+function hooksFile(tenant, workspace) {
+    return path.join(workspaceDir(tenant, workspace), "hooks.json");
+}
+function readHooks(tenant, workspace) {
+    const file = hooksFile(tenant, workspace);
+    if (!fs.existsSync(file))
+        return {};
+    try {
+        return JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+export function hookGeneration(tenant, workspace, flow) {
+    return readHooks(tenant, workspace)[flow]?.gen ?? 0;
+}
+/** Invalidate a hook's URL and mint the next one. Returns the new path. */
+export function rotateWebhook(tenant, workspace, flow) {
+    const hooks = readHooks(tenant, workspace);
+    hooks[flow] = { gen: (hooks[flow]?.gen ?? 0) + 1, rotatedAt: new Date().toISOString() };
+    const file = hooksFile(tenant, workspace);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(hooks, null, 2));
+    return webhookPath(tenant, workspace, flow);
+}
+export function webhookToken(tenant, workspace, flow) {
+    const gen = hookGeneration(tenant, workspace, flow);
+    const identity = gen === 0 ? `${tenant}/${workspace}/${flow}` : `${tenant}/${workspace}/${flow}#${gen}`;
+    return crypto.createHmac("sha256", installKey()).update(identity).digest("hex").slice(0, 32);
+}
+export function webhookPath(tenant, workspace, flow) {
+    return `/api/hooks/${tenant}/${workspace}/${flow}?token=${webhookToken(tenant, workspace, flow)}`;
+}
+// ---------- one-click approval ----------
+/**
+ * The token in an emailed approve/reject link. Same shape as a hook token:
+ * derived from the run's identity under the install key, never stored, so
+ * a link keeps working across restarts and dies with a key rotation. A run
+ * id is unique, so there is no generation counter — a leaked link is dealt
+ * with by deciding the run, after which the link does nothing.
+ *
+ * The `approve:` prefix keeps this HMAC family apart from the hook family:
+ * without it a run id that happened to spell `tenant/ws/flow` would mint a
+ * working hook token.
+ */
+export function approveToken(tenant, workspace, runId) {
+    return crypto
+        .createHmac("sha256", installKey())
+        .update(`approve:${tenant}/${workspace}/${runId}`)
+        .digest("hex")
+        .slice(0, 32);
+}
+/**
+ * The token that releases a run parked on `wait: event`. Its own HMAC
+ * family, so an approval link cannot double as an event URL or the reverse.
+ */
+export function eventToken(tenant, workspace, runId) {
+    return crypto
+        .createHmac("sha256", installKey())
+        .update(`event:${tenant}/${workspace}/${runId}`)
+        .digest("hex")
+        .slice(0, 32);
+}
+/** The URL a `wait: event` step is released at — absolute when the install
+ *  knows its origin, a path otherwise. */
+export function eventUrl(tenant, workspace, runId) {
+    const p = `/api/events/${tenant}/${workspace}/${runId}?token=${eventToken(tenant, workspace, runId)}`;
+    const base = publicUrl();
+    return base ? `${base}${p}` : p;
+}
+/**
+ * Where this install can be reached from outside, or null. The platform has
+ * never needed to know its own address — every URL it hands out has been a
+ * path, completed by whoever pasted it. A link in an email has no such
+ * reader, so this is the one place an absolute origin is required.
+ */
+export function publicUrl() {
+    const raw = process.env.FOLDRUN_PUBLIC_URL?.trim();
+    if (!raw)
+        return null;
+    return raw.replace(/\/+$/, "");
+}
+function deliveriesFile(tenant, workspace) {
+    return path.join(workspaceDir(tenant, workspace), "hook-deliveries.jsonl");
+}
+const KEEP_DELIVERIES = 500;
+export function recordDelivery(tenant, workspace, delivery) {
+    const file = deliveriesFile(tenant, workspace);
+    if (!fs.existsSync(path.dirname(file)))
+        return; // no workspace, nothing to log against
+    fs.appendFileSync(file, JSON.stringify(delivery) + "\n");
+    // Bounded: compact to the newest KEEP when it doubles. Amortised cheap,
+    // and a log that grows forever is a disk-full incident with a delay.
+    try {
+        const lines = fs.readFileSync(file, "utf8").split("\n").filter(Boolean);
+        if (lines.length > KEEP_DELIVERIES * 2) {
+            const tmp = `${file}.tmp`;
+            fs.writeFileSync(tmp, lines.slice(-KEEP_DELIVERIES).join("\n") + "\n");
+            fs.renameSync(tmp, file);
+        }
+    }
+    catch {
+        // compaction is best-effort; the append already landed
+    }
+}
+export function readDeliveries(tenant, workspace, limit = 20) {
+    const file = deliveriesFile(tenant, workspace);
+    if (!fs.existsSync(file))
+        return [];
+    return fs
+        .readFileSync(file, "utf8")
+        .split("\n")
+        .filter(Boolean)
+        .slice(-limit)
+        .reverse()
+        .map((line) => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((d) => d !== null);
+}

package/index.ts

@@ -0,0 +1,44 @@
+// @foldrun/core — the open-source runtime.
+//
+// Everything needed to read a workspace of markdown files and run the agents
+// in it. No server, no database, no account: point it at a folder.
+//
+// The hosted platform imports these same modules. That is deliberate — if the
+// open version were a reduced copy it would rot, and self-hosting would feel
+// like a downgrade instead of a choice. What the platform adds — a queue and
+// its worker, metering and billing, pods on a cluster, per-account keys in a
+// database, previews, share links, tenancy — lives in its own private package
+// and plugs in through platform.ts. Nothing here imports it.
+
+export * from "./src/paths.ts";
+export * from "./src/store.ts";
+export * from "./src/starter.ts";
+export * from "./src/runner.ts";
+export * from "./src/okf.ts";
+export * from "./src/evals.ts";
+export * from "./src/flow-lint.ts";
+export * from "./src/catalog.ts";
+export * from "./src/model-probe.ts";
+export * from "./src/providers.ts";
+export * from "./src/translator.ts";
+export * from "./src/arrange.ts";
+export * from "./src/completions.ts";
+export * from "./src/confine.ts";
+export * from "./src/platform.ts";
+export * from "./src/library.ts";
+export * from "./src/tool-programs.ts";
+export * from "./src/linkable.ts";
+export * from "./src/refs.ts";
+export * from "./src/tool-names.ts";
+export * from "./src/history.ts";
+export * from "./src/gitrepo.ts";
+export * from "./src/storage.ts";
+export * from "./src/secrets.ts";
+export * from "./src/oauth-presets.ts";
+export * from "./src/secret-files.ts";
+export * from "./src/notify.ts";
+export * from "./src/webhook.ts";
+export * from "./src/approvals.ts";
+export * from "./src/deploy.ts";
+export * from "./src/tar.ts";
+export * from "./src/git.ts";

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@foldrun/core",
+  "version": "0.2.0",
+  "description": "Agents are just folders. The format, the runner, the checks.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./git-hook": "./dist/src/git-hook.js",
+    "./*": {
+      "types": "./dist/src/*.d.ts",
+      "default": "./dist/src/*.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "src",
+    "index.ts",
+    "templates",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run build",
+    "test": "FOLDRUN_DATA=$(mktemp -d /tmp/foldrun-test-XXXXXX) node --test *.test.ts $(ls tests/*.test.ts | grep -v e2e)",
+    "container": "FOLDRUN_CONTAINER_E2E=1 node scripts/ts-test.mjs tests/container-e2e.test.ts --test-timeout=600000"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "@anthropic-ai/claude-agent-sdk": "0.3.220",
+    "gray-matter": "^4.0.3",
+    "zod": "4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "typescript": "^5"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/foldrun-io/foldrun-core.git"
+  },
+  "homepage": "https://foldrun.io",
+  "bugs": {
+    "url": "https://github.com/foldrun-io/foldrun-core/issues"
+  },
+  "keywords": [
+    "agents",
+    "llm",
+    "markdown",
+    "workflows",
+    "claude"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}