@runcore-sh/runcore 0.1.2

package/dist/vault/store.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Encrypted key vault.
+ * Stores API keys as AES-256-GCM encrypted JSON, same key used for sessions.
+ * After loading, hydrates process.env so consumer modules need zero changes.
+ */
+/**
+ * Load vault from encrypted file, populate cache and hydrate process.env.
+ * Safe to call when file doesn't exist (starts empty).
+ */
+export declare function loadVault(key: Buffer): Promise<void>;
+/**
+ * Add or update a key in the vault. Persists immediately.
+ */
+export declare function setVaultKey(name: string, value: string, key: Buffer, label?: string): Promise<void>;
+/**
+ * Remove a key from the vault. Persists immediately.
+ */
+export declare function deleteVaultKey(name: string, key: Buffer): Promise<void>;
+/**
+ * List vault keys — names and labels only, no values.
+ */
+export declare function listVaultKeys(): Array<{
+    name: string;
+    label?: string;
+}>;
+/**
+ * Get all vault entries with values. Used for migration to credential store.
+ */
+export declare function getVaultEntries(): Array<{
+    name: string;
+    value: string;
+    label?: string;
+}>;
+export declare function getDashReadableVault(): Array<{
+    name: string;
+    value: string;
+    label?: string;
+}>;
+//# sourceMappingURL=store.d.ts.map

package/dist/vault/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/vault/store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0BH;;;GAGG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB1D;AAkBD;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7E;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAKvE;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAMxF;AAaD,wBAAgB,oBAAoB,IAAI,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAI7F"}

package/dist/vault/store.js

@@ -0,0 +1,111 @@
+/**
+ * Encrypted key vault.
+ * Stores API keys as AES-256-GCM encrypted JSON, same key used for sessions.
+ * After loading, hydrates process.env so consumer modules need zero changes.
+ */
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { encrypt, decrypt } from "../auth/crypto.js";
+const VAULT_DIR = join(process.cwd(), "brain", "vault");
+const VAULT_FILE = join(VAULT_DIR, "keys.json");
+// In-memory cache — populated by loadVault, read by list/hydrate
+let vaultCache = {};
+/**
+ * Load vault from encrypted file, populate cache and hydrate process.env.
+ * Safe to call when file doesn't exist (starts empty).
+ */
+export async function loadVault(key) {
+    try {
+        const raw = await readFile(VAULT_FILE, "utf-8");
+        const file = JSON.parse(raw);
+        const payload = {
+            ciphertext: file.ciphertext,
+            iv: file.iv,
+            authTag: file.authTag,
+        };
+        const plaintext = decrypt(payload, key);
+        vaultCache = JSON.parse(plaintext);
+    }
+    catch {
+        // File missing, corrupt, or wrong key — start fresh
+        vaultCache = {};
+    }
+    hydrateEnv();
+}
+/**
+ * Encrypt and save the vault cache to disk. Fresh IV on every write.
+ */
+async function saveVault(key) {
+    await mkdir(VAULT_DIR, { recursive: true });
+    const plaintext = JSON.stringify(vaultCache);
+    const payload = encrypt(plaintext, key);
+    const file = {
+        v: 1,
+        ciphertext: payload.ciphertext,
+        iv: payload.iv,
+        authTag: payload.authTag,
+    };
+    await writeFile(VAULT_FILE, JSON.stringify(file), "utf-8");
+}
+/**
+ * Add or update a key in the vault. Persists immediately.
+ */
+export async function setVaultKey(name, value, key, label) {
+    vaultCache[name] = { value, label };
+    await saveVault(key);
+    // Keep process.env in sync
+    process.env[name] = value;
+}
+/**
+ * Remove a key from the vault. Persists immediately.
+ */
+export async function deleteVaultKey(name, key) {
+    delete vaultCache[name];
+    await saveVault(key);
+    // Remove from process.env (reverts to .env value on next restart)
+    delete process.env[name];
+}
+/**
+ * List vault keys — names and labels only, no values.
+ */
+export function listVaultKeys() {
+    return Object.entries(vaultCache).map(([name, entry]) => ({
+        name,
+        label: entry.label,
+    }));
+}
+/**
+ * Get all vault entries with values. Used for migration to credential store.
+ */
+export function getVaultEntries() {
+    return Object.entries(vaultCache).map(([name, entry]) => ({
+        name,
+        value: entry.value,
+        label: entry.label,
+    }));
+}
+/**
+ * Get vault entries that the agent (the chat LLM) is allowed to see in conversation.
+ * Only keys starting with "CORE_" or "DASH_" are returned — these are non-secret values
+ * the user explicitly wants the agent to reference (e.g. preferences, nicknames).
+ *
+ * SECURITY: Authentication secrets (SAFE_WORD, RECOVERY_QUESTION) are NEVER
+ * exposed to the LLM. The safe word is verified at the crypto layer via its
+ * SHA-256 hash in human.json — the LLM must never know or repeat it.
+ */
+const NEVER_EXPOSE = new Set(["SAFE_WORD", "RECOVERY_QUESTION"]);
+export function getDashReadableVault() {
+    return Object.entries(vaultCache)
+        .filter(([name]) => (name.startsWith("CORE_") || name.startsWith("DASH_")) && !NEVER_EXPOSE.has(name))
+        .map(([name, entry]) => ({ name, value: entry.value, label: entry.label }));
+}
+/**
+ * Push all vault values into process.env.
+ * Called after loadVault so consumer modules (LLM, search) pick them up.
+ */
+function hydrateEnv() {
+    for (const [name, entry] of Object.entries(vaultCache)) {
+        process.env[name] = entry.value;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/vault/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/vault/store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAyB,MAAM,mBAAmB,CAAC;AAE5E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAgBhD,iEAAiE;AACjE,IAAI,UAAU,GAAc,EAAE,CAAC;AAE/B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAkB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAqB;YAChC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QACF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAc,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;QACpD,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,UAAU,EAAE,CAAC;AACf,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAkB;QAC1B,CAAC,EAAE,CAAC;QACJ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,KAAa,EACb,GAAW,EACX,KAAc;IAEd,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,2BAA2B;IAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IAC5D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,kEAAkE;IAClE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI;QACJ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACrG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU;IACjB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/webhooks/config.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Webhook configuration management.
+ *
+ * Loads, validates, and resolves webhook provider configurations.
+ * Secrets can reference environment variables or be provided as literals.
+ * Configuration can be loaded from a file or constructed programmatically.
+ */
+import type { WebhookProviderConfig, WebhookSystemConfig, WebhookRetryOpts } from "./types.js";
+/** Get the current webhook system configuration. */
+export declare function getConfig(): WebhookSystemConfig;
+/** Replace the entire system configuration. */
+export declare function setConfig(config: WebhookSystemConfig): void;
+/** Get configuration for a specific provider. */
+export declare function getProviderConfig(name: string): WebhookProviderConfig | undefined;
+/** Set configuration for a specific provider. Merges with existing config. */
+export declare function setProviderConfig(config: WebhookProviderConfig): void;
+/**
+ * Set multiple provider configs in one call.
+ * Avoids repeated object spread overhead when configuring all providers at startup.
+ */
+export declare function setProviderConfigs(configs: WebhookProviderConfig[]): void;
+/** Remove configuration for a provider. */
+export declare function removeProviderConfig(name: string): boolean;
+/** List all configured provider names. */
+export declare function listConfiguredProviders(): string[];
+/**
+ * Resolve a secret value. If the value looks like an environment variable
+ * name (all uppercase, underscores, digits), read from process.env.
+ * Otherwise, treat it as a literal secret.
+ */
+export declare function resolveSecret(secretRef: string): string | undefined;
+/**
+ * Get the resolved secret for a provider.
+ * Returns undefined if no secret is configured or the env var is not set.
+ */
+export declare function getProviderSecret(name: string): string | undefined;
+/**
+ * Get the effective retry options for a provider.
+ * Provider-specific config overrides system defaults.
+ */
+export declare function getProviderRetryOpts(name: string): WebhookRetryOpts;
+/** Check if a provider is enabled in the configuration. */
+export declare function isProviderEnabled(name: string): boolean;
+/**
+ * Validate the configuration for a specific provider.
+ * Returns a list of issues found.
+ */
+export declare function validateProviderConfig(name: string): string[];
+/**
+ * Validate the entire system configuration.
+ * Returns a map of provider name → issues.
+ */
+export declare function validateConfig(): Record<string, string[]>;
+/**
+ * Load webhook configuration from a JSON file.
+ * Returns true if the file was loaded successfully.
+ */
+export declare function loadConfigFromFile(filePath: string): boolean;
+/**
+ * Save the current webhook configuration to a JSON file.
+ * Secrets that reference env vars are saved as-is (the reference, not the resolved value).
+ */
+export declare function saveConfigToFile(filePath: string): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/webhooks/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/webhooks/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAMpB,oDAAoD;AACpD,wBAAgB,SAAS,IAAI,mBAAmB,CAE/C;AAED,+CAA+C;AAC/C,wBAAgB,SAAS,CAAC,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAE3D;AAID,iDAAiD;AACjD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GACX,qBAAqB,GAAG,SAAS,CAEnC;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAKrE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,IAAI,CAWzE;AAED,2CAA2C;AAC3C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAI1D;AAED,0CAA0C;AAC1C,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAID;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMnE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIlE;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAInE;AAID,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIvD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAyB7D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAoBzD;AAID;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAoC5D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAqB1D"}

package/dist/webhooks/config.js

@@ -0,0 +1,214 @@
+/**
+ * Webhook configuration management.
+ *
+ * Loads, validates, and resolves webhook provider configurations.
+ * Secrets can reference environment variables or be provided as literals.
+ * Configuration can be loaded from a file or constructed programmatically.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { logActivity } from "../activity/log.js";
+import { createLogger } from "../utils/logger.js";
+import { getProvider, listProviders } from "./registry.js";
+const log = createLogger("webhooks.config");
+// ── In-memory config store ───────────────────────────────────────────────────
+let systemConfig = { providers: {} };
+/** Get the current webhook system configuration. */
+export function getConfig() {
+    return systemConfig;
+}
+/** Replace the entire system configuration. */
+export function setConfig(config) {
+    systemConfig = config;
+}
+// ── Provider config CRUD ─────────────────────────────────────────────────────
+/** Get configuration for a specific provider. */
+export function getProviderConfig(name) {
+    return systemConfig.providers[name];
+}
+/** Set configuration for a specific provider. Merges with existing config. */
+export function setProviderConfig(config) {
+    const existing = systemConfig.providers[config.name];
+    systemConfig.providers[config.name] = existing
+        ? { ...existing, ...config }
+        : config;
+}
+/**
+ * Set multiple provider configs in one call.
+ * Avoids repeated object spread overhead when configuring all providers at startup.
+ */
+export function setProviderConfigs(configs) {
+    const start = performance.now();
+    for (const config of configs) {
+        setProviderConfig(config);
+    }
+    const ms = performance.now() - start;
+    // Use debug log instead of logActivity to avoid polluting the insight engine
+    // with routine startup perf data (was causing feedback loop — DASH-70)
+    if (ms > 5) {
+        log.debug(`setProviderConfigs took ${ms.toFixed(1)}ms for ${configs.length} providers`);
+    }
+}
+/** Remove configuration for a provider. */
+export function removeProviderConfig(name) {
+    if (!(name in systemConfig.providers))
+        return false;
+    delete systemConfig.providers[name];
+    return true;
+}
+/** List all configured provider names. */
+export function listConfiguredProviders() {
+    return Object.keys(systemConfig.providers);
+}
+// ── Secret resolution ────────────────────────────────────────────────────────
+/**
+ * Resolve a secret value. If the value looks like an environment variable
+ * name (all uppercase, underscores, digits), read from process.env.
+ * Otherwise, treat it as a literal secret.
+ */
+export function resolveSecret(secretRef) {
+    // Env var pattern: all uppercase letters, digits, underscores
+    if (/^[A-Z][A-Z0-9_]*$/.test(secretRef)) {
+        return process.env[secretRef];
+    }
+    return secretRef;
+}
+/**
+ * Get the resolved secret for a provider.
+ * Returns undefined if no secret is configured or the env var is not set.
+ */
+export function getProviderSecret(name) {
+    const config = systemConfig.providers[name];
+    if (!config?.secret)
+        return undefined;
+    return resolveSecret(config.secret);
+}
+// ── Retry config resolution ──────────────────────────────────────────────────
+/**
+ * Get the effective retry options for a provider.
+ * Provider-specific config overrides system defaults.
+ */
+export function getProviderRetryOpts(name) {
+    const defaults = systemConfig.defaults?.retry ?? {};
+    const providerOpts = systemConfig.providers[name]?.retry ?? {};
+    return { ...defaults, ...providerOpts };
+}
+// ── Provider status ──────────────────────────────────────────────────────────
+/** Check if a provider is enabled in the configuration. */
+export function isProviderEnabled(name) {
+    const config = systemConfig.providers[name];
+    if (!config)
+        return true; // Unconfigured providers default to enabled
+    return config.enabled !== false;
+}
+/**
+ * Validate the configuration for a specific provider.
+ * Returns a list of issues found.
+ */
+export function validateProviderConfig(name) {
+    const issues = [];
+    const config = systemConfig.providers[name];
+    if (!config) {
+        issues.push(`No configuration found for provider "${name}"`);
+        return issues;
+    }
+    if (config.secret) {
+        const resolved = resolveSecret(config.secret);
+        if (!resolved) {
+            issues.push(`Secret for "${name}" references env var "${config.secret}" which is not set`);
+        }
+    }
+    if (!getProvider(name)) {
+        issues.push(`Provider "${name}" is configured but not registered in the registry`);
+    }
+    return issues;
+}
+/**
+ * Validate the entire system configuration.
+ * Returns a map of provider name → issues.
+ */
+export function validateConfig() {
+    const result = {};
+    for (const name of Object.keys(systemConfig.providers)) {
+        const issues = validateProviderConfig(name);
+        if (issues.length > 0) {
+            result[name] = issues;
+        }
+    }
+    // Check for registered providers missing configuration
+    for (const name of listProviders()) {
+        if (!systemConfig.providers[name]) {
+            result[name] = [
+                `Provider "${name}" is registered but has no configuration`,
+            ];
+        }
+    }
+    return result;
+}
+// ── File-based config loading ────────────────────────────────────────────────
+/**
+ * Load webhook configuration from a JSON file.
+ * Returns true if the file was loaded successfully.
+ */
+export function loadConfigFromFile(filePath) {
+    const start = performance.now();
+    try {
+        const resolved = path.resolve(filePath);
+        const readStart = performance.now();
+        const content = fs.readFileSync(resolved, "utf-8");
+        const readMs = performance.now() - readStart;
+        const parseStart = performance.now();
+        const parsed = JSON.parse(content);
+        const parseMs = performance.now() - parseStart;
+        if (!parsed.providers || typeof parsed.providers !== "object") {
+            logActivity({
+                source: "system",
+                summary: `Webhook config file missing "providers" object: ${filePath}`,
+            });
+            return false;
+        }
+        systemConfig = parsed;
+        const totalMs = performance.now() - start;
+        logActivity({
+            source: "system",
+            summary: `Loaded webhook config from ${filePath} (${Object.keys(parsed.providers).length} providers, read:${readMs.toFixed(1)}ms, parse:${parseMs.toFixed(1)}ms, total:${totalMs.toFixed(1)}ms)`,
+        });
+        return true;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logActivity({
+            source: "system",
+            summary: `Failed to load webhook config from ${filePath}: ${msg}`,
+        });
+        return false;
+    }
+}
+/**
+ * Save the current webhook configuration to a JSON file.
+ * Secrets that reference env vars are saved as-is (the reference, not the resolved value).
+ */
+export function saveConfigToFile(filePath) {
+    try {
+        const resolved = path.resolve(filePath);
+        const dir = path.dirname(resolved);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        fs.writeFileSync(resolved, JSON.stringify(systemConfig, null, 2), "utf-8");
+        logActivity({
+            source: "system",
+            summary: `Saved webhook config to ${filePath}`,
+        });
+        return true;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        logActivity({
+            source: "system",
+            summary: `Failed to save webhook config to ${filePath}: ${msg}`,
+        });
+        return false;
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/webhooks/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/webhooks/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE3D,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAO5C,gFAAgF;AAEhF,IAAI,YAAY,GAAwB,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAE1D,oDAAoD;AACpD,MAAM,UAAU,SAAS;IACvB,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,SAAS,CAAC,MAA2B;IACnD,YAAY,GAAG,MAAM,CAAC;AACxB,CAAC;AAED,gFAAgF;AAEhF,iDAAiD;AACjD,MAAM,UAAU,iBAAiB,CAC/B,IAAY;IAEZ,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB,CAAC,MAA6B;IAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ;QAC5C,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE;QAC5B,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgC;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;IACrC,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC,CAAC,IAAI,IAAI,YAAY,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,uBAAuB;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,8DAA8D;IAC9D,IAAI,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,MAAM;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;IACpD,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IAC/D,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,YAAY,EAAE,CAAC;AAC1C,CAAC;AAED,gFAAgF;AAEhF,2DAA2D;AAC3D,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,4CAA4C;IACtE,OAAO,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAE5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CACT,eAAe,IAAI,yBAAyB,MAAM,CAAC,MAAM,oBAAoB,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CACT,aAAa,IAAI,oDAAoD,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAA6B,EAAE,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QACxB,CAAC;IACH,CAAC;IAED,uDAAuD;IACvD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,GAAG;gBACb,aAAa,IAAI,0CAA0C;aAC5D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE7C,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;QAC1D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;QAE/C,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC9D,WAAW,CAAC;gBACV,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,mDAAmD,QAAQ,EAAE;aACvE,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,YAAY,GAAG,MAAM,CAAC;QACtB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAC1C,WAAW,CAAC;YACV,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,8BAA8B,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,oBAAoB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK;SACjM,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,WAAW,CAAC;YACV,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,sCAAsC,QAAQ,KAAK,GAAG,EAAE;SAClE,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3E,WAAW,CAAC;YACV,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,2BAA2B,QAAQ,EAAE;SAC/C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,WAAW,CAAC;YACV,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,oCAAoC,QAAQ,KAAK,GAAG,EAAE;SAChE,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/webhooks/event-log.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Webhook event log — ring buffer of recent webhook events for debugging.
+ *
+ * Tracks the last N webhook events (successes and failures) with timing data,
+ * provider info, and error details. Useful for debugging webhook integrations
+ * without needing to dig through activity logs.
+ *
+ * Usage:
+ *   import { logWebhookEvent, getRecentEvents } from "./event-log.js";
+ *   logWebhookEvent({ provider: "slack-events", eventType: "message", ... });
+ *   const recent = getRecentEvents({ provider: "slack-events", limit: 10 });
+ */
+/** A recorded webhook event for debugging. */
+export interface WebhookEventLogEntry {
+    id: string;
+    provider: string;
+    eventType?: string;
+    deliveryId?: string;
+    receivedAt: string;
+    /** Processing duration in ms. */
+    durationMs: number;
+    success: boolean;
+    message: string;
+    /** HTTP status code returned (if applicable). */
+    statusCode?: number;
+    /** Error details on failure. */
+    error?: string;
+    /** Signature verification result. */
+    signatureValid?: boolean;
+}
+/** Filter options for querying the event log. */
+export interface EventLogFilter {
+    /** Filter by provider name. */
+    provider?: string;
+    /** Filter by success/failure. */
+    success?: boolean;
+    /** Maximum number of entries to return (most recent first). Default: 50. */
+    limit?: number;
+    /** Only return entries after this ISO timestamp. */
+    since?: string;
+}
+/** Summary statistics from the event log. */
+export interface EventLogSummary {
+    total: number;
+    successes: number;
+    failures: number;
+    avgDurationMs: number;
+    byProvider: Record<string, {
+        count: number;
+        failures: number;
+        avgDurationMs: number;
+    }>;
+    oldestEntry: string | null;
+    newestEntry: string | null;
+}
+/** Configure the maximum number of entries to keep. */
+export declare function setEventLogMaxSize(size: number): void;
+/** Get current max size. */
+export declare function getEventLogMaxSize(): number;
+/**
+ * Record a webhook event in the log.
+ * Automatically generates an ID and trims the buffer if over capacity.
+ */
+export declare function logWebhookEvent(entry: Omit<WebhookEventLogEntry, "id">): WebhookEventLogEntry;
+/**
+ * Create a timing wrapper that records start time and returns a function
+ * to finalize the log entry with duration and result.
+ *
+ * Usage:
+ *   const finish = startEventTimer("slack-events", { eventType: "message" });
+ *   // ... process webhook ...
+ *   finish({ success: true, message: "OK" });
+ */
+export declare function startEventTimer(provider: string, meta?: {
+    eventType?: string;
+    deliveryId?: string;
+    signatureValid?: boolean;
+}): (result: {
+    success: boolean;
+    message: string;
+    error?: string;
+    statusCode?: number;
+}) => WebhookEventLogEntry;
+/** Get recent webhook events, most recent first. */
+export declare function getRecentEvents(filter?: EventLogFilter): WebhookEventLogEntry[];
+/** Get a summary of the event log. */
+export declare function getEventLogSummary(): EventLogSummary;
+/** Clear the event log. Optionally filter by provider. */
+export declare function clearEventLog(provider?: string): number;
+//# sourceMappingURL=event-log.d.ts.map

package/dist/webhooks/event-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-log.d.ts","sourceRoot":"","sources":["../../src/webhooks/event-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,8CAA8C;AAC9C,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,6CAA6C;AAC7C,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAQD,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKrD;AAED,4BAA4B;AAC5B,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,GACtC,oBAAoB,CAatB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3E,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,oBAAoB,CAgB9G;AAID,oDAAoD;AACpD,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,oBAAoB,EAAE,CAoB/E;AAED,sCAAsC;AACtC,wBAAgB,kBAAkB,IAAI,eAAe,CAoCpD;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CASvD"}