@runcore-sh/runcore 0.1.2

package/dist/webhooks/types.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Shared types for the webhook system.
+ *
+ * All interfaces used across registry, verification, routing, retry,
+ * and configuration live here to avoid circular dependencies.
+ */
+/** Standard result returned by all webhook handlers. */
+export interface WebhookResult {
+    handled: boolean;
+    message: string;
+    /** Optional extra data (e.g., Slack challenge response). */
+    data?: Record<string, unknown>;
+}
+/** Signature verification context passed to providers. */
+export interface VerifyContext {
+    /** Raw request body (string). */
+    rawBody: string;
+    /** Signature header value. */
+    signature: string;
+    /** Secret/token used for verification. */
+    secret: string;
+    /** Additional headers that some providers need (e.g., Slack timestamp). */
+    headers?: Record<string, string>;
+    /** Full webhook URL (needed by Twilio). */
+    url?: string;
+    /** Parsed form params (needed by Twilio). */
+    params?: Record<string, string>;
+}
+/** A registered webhook provider. */
+export interface WebhookProvider {
+    /** Unique provider name (e.g., "slack", "linear", "twilio"). */
+    name: string;
+    /** Verify a webhook signature. Return true if valid. */
+    verify(ctx: VerifyContext): boolean;
+    /** Process a webhook payload. Called after verification. */
+    process(payload: unknown, ctx?: Record<string, unknown>): Promise<WebhookResult>;
+}
+/** Generic typed envelope that normalizes events across providers. */
+export interface WebhookEvent<T = unknown> {
+    /** Provider name (e.g., "slack", "linear", "twilio"). */
+    source: string;
+    /** ISO 8601 timestamp when the event was received. */
+    receivedAt: string;
+    /** The raw payload from the provider. */
+    payload: T;
+    /** Event type string extracted from the payload. */
+    eventType?: string;
+    /** Delivery/request ID for deduplication. */
+    deliveryId?: string;
+}
+/** Retry options for webhook handler execution. */
+export interface WebhookRetryOpts {
+    /** Maximum number of attempts (including first). Default: 3. */
+    maxAttempts?: number;
+    /** Base delay in ms before first retry. Default: 500. */
+    baseDelayMs?: number;
+    /** Maximum delay in ms. Default: 10000. */
+    maxDelayMs?: number;
+    /** Called when all retry attempts are exhausted. Receives the final error. */
+    onExhausted?: (error: unknown, attempts: number) => void;
+}
+/** Represents an incoming HTTP-like webhook request. */
+export interface WebhookRequestContext {
+    /** HTTP method (POST, GET, etc.). */
+    method: string;
+    /** Full request URL. */
+    url: string;
+    /** Request headers (lowercase keys). */
+    headers: Record<string, string>;
+    /** Raw request body as string. */
+    body: string;
+    /** Parsed body (JSON or form data). */
+    parsed?: unknown;
+    /** Provider name to route to. */
+    provider: string;
+}
+/** Middleware function that can inspect/modify context before processing. */
+export type WebhookMiddleware = (ctx: WebhookRequestContext, next: () => Promise<WebhookResult>) => Promise<WebhookResult>;
+/** Runtime stats for a webhook provider. */
+export interface ProviderStats {
+    name: string;
+    invocations: number;
+    successes: number;
+    failures: number;
+    lastInvokedAt: string | null;
+    lastErrorAt: string | null;
+    lastError: string | null;
+}
+/** Health classification for a provider. */
+export type ProviderHealth = "healthy" | "degraded" | "unknown";
+/** Aggregate health summary for a webhook provider. */
+export interface ProviderHealthSummary {
+    name: string;
+    health: ProviderHealth;
+    failureRate: number;
+    stats: ProviderStats;
+}
+/** Options for the deduplication middleware. */
+export interface DeduplicationOpts {
+    /** Maximum number of delivery IDs to track. Default: 1000. */
+    maxSize?: number;
+    /** Time-to-live in ms for tracked IDs. Default: 300_000 (5 minutes). */
+    ttlMs?: number;
+}
+/** Handler function for a specific event type. */
+export type EventHandler<T = unknown> = (data: T, ctx?: Record<string, unknown>) => Promise<WebhookResult>;
+/** Signature verification algorithm. */
+export type SignatureAlgorithm = "hmac-sha256-hex" | "hmac-sha256-base64" | "hmac-sha1-base64" | "slack-v0" | "twilio" | "custom";
+/** Configuration for a webhook provider. */
+export interface WebhookProviderConfig {
+    /** Provider name (must match the registered provider name). */
+    name: string;
+    /** Whether this provider is enabled. Default: true. */
+    enabled?: boolean;
+    /** Environment variable name or literal secret for signature verification. */
+    secret?: string;
+    /** Header name containing the signature (lowercase). */
+    signatureHeader?: string;
+    /** Signature algorithm used by this provider. */
+    algorithm?: SignatureAlgorithm;
+    /** URL path where this provider's webhooks are received. */
+    path?: string;
+    /** Maximum timestamp age in seconds for replay protection. */
+    maxTimestampAge?: number;
+    /** Retry options for this provider's handlers. */
+    retry?: WebhookRetryOpts;
+    /** Provider-specific extra configuration. */
+    metadata?: Record<string, unknown>;
+}
+/** Top-level webhook system configuration. */
+export interface WebhookSystemConfig {
+    /** Global defaults applied to all providers unless overridden. */
+    defaults?: {
+        /** Default retry options. */
+        retry?: WebhookRetryOpts;
+        /** Default max timestamp age in seconds. */
+        maxTimestampAge?: number;
+    };
+    /** Per-provider configurations. */
+    providers: Record<string, WebhookProviderConfig>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/webhooks/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/webhooks/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAID,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAID,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC;IACpC,4DAA4D;IAC5D,OAAO,CACL,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAID,sEAAsE;AACtE,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,OAAO,EAAE,CAAC,CAAC;IACX,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1D;AAID,wDAAwD;AACxD,MAAM,WAAW,qBAAqB;IACpC,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,qBAAqB,EAC1B,IAAI,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,KAC/B,OAAO,CAAC,aAAa,CAAC,CAAC;AAI5B,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAEhE,uDAAuD;AACvD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;CACtB;AAID,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,kDAAkD;AAClD,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,OAAO,IAAI,CACtC,IAAI,EAAE,CAAC,EACP,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC1B,OAAO,CAAC,aAAa,CAAC,CAAC;AAI5B,wCAAwC;AACxC,MAAM,MAAM,kBAAkB,GAC1B,iBAAiB,GACjB,oBAAoB,GACpB,kBAAkB,GAClB,UAAU,GACV,QAAQ,GACR,QAAQ,CAAC;AAEb,4CAA4C;AAC5C,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iDAAiD;IACjD,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC,kEAAkE;IAClE,QAAQ,CAAC,EAAE;QACT,6BAA6B;QAC7B,KAAK,CAAC,EAAE,gBAAgB,CAAC;QACzB,4CAA4C;QAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAClD"}

package/dist/webhooks/types.js

@@ -0,0 +1,8 @@
+/**
+ * Shared types for the webhook system.
+ *
+ * All interfaces used across registry, verification, routing, retry,
+ * and configuration live here to avoid circular dependencies.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/webhooks/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/webhooks/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/webhooks/verify.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Signature verification utilities for webhooks.
+ *
+ * Provides cryptographic primitives and timing-safe comparison
+ * used by all webhook providers for request authentication.
+ */
+/**
+ * HMAC-SHA256 hex digest. Used by Linear and similar services.
+ */
+export declare function hmacSha256Hex(data: string, secret: string): string;
+/**
+ * HMAC-SHA256 base64 digest.
+ */
+export declare function hmacSha256Base64(data: string, secret: string): string;
+/**
+ * HMAC-SHA1 base64 digest. Used by Twilio.
+ */
+export declare function hmacSha1Base64(data: string, secret: string): string;
+/**
+ * Timing-safe string comparison. Returns false on length mismatch.
+ */
+export declare function timingSafeCompare(a: string, b: string): boolean;
+/**
+ * Check that a timestamp is within an acceptable window (replay attack prevention).
+ * @param timestamp Unix timestamp in seconds
+ * @param maxAgeSeconds Maximum age allowed. Default: 300 (5 minutes).
+ */
+export declare function isTimestampFresh(timestamp: number, maxAgeSeconds?: number): boolean;
+import type { VerifyContext } from "./types.js";
+/**
+ * Verify an HMAC-SHA256 hex signature (Linear-style).
+ * Compares `HMAC-SHA256(rawBody, secret)` against the provided signature.
+ */
+export declare function verifyHmacSha256Hex(ctx: VerifyContext): boolean;
+/**
+ * Verify an HMAC-SHA256 base64 signature.
+ * Optionally strips a "sha256=" prefix (GitHub-style).
+ */
+export declare function verifyHmacSha256Base64(ctx: VerifyContext, stripPrefix?: boolean): boolean;
+/**
+ * Verify a Slack v0 signature.
+ * Format: `v0={HMAC-SHA256("v0:{timestamp}:{body}", secret)}`
+ * Also validates timestamp freshness.
+ */
+export declare function verifySlackV0(ctx: VerifyContext, maxAgeSeconds?: number): boolean;
+/**
+ * Verify a Twilio signature.
+ * HMAC-SHA1 of URL + sorted POST params, base64 encoded.
+ */
+export declare function verifyTwilio(ctx: VerifyContext): boolean;
+//# sourceMappingURL=verify.d.ts.map

package/dist/webhooks/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnE;AAID;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAM/D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,aAAa,SAAM,GAClB,OAAO,CAIT;AAID,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAG/D;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,aAAa,EAClB,WAAW,UAAQ,GAClB,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,aAAa,EAClB,aAAa,SAAM,GAClB,OAAO,CAQT;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAUxD"}

package/dist/webhooks/verify.js

@@ -0,0 +1,98 @@
+/**
+ * Signature verification utilities for webhooks.
+ *
+ * Provides cryptographic primitives and timing-safe comparison
+ * used by all webhook providers for request authentication.
+ */
+import * as crypto from "node:crypto";
+// ── HMAC digest helpers ──────────────────────────────────────────────────────
+/**
+ * HMAC-SHA256 hex digest. Used by Linear and similar services.
+ */
+export function hmacSha256Hex(data, secret) {
+    return crypto.createHmac("sha256", secret).update(data).digest("hex");
+}
+/**
+ * HMAC-SHA256 base64 digest.
+ */
+export function hmacSha256Base64(data, secret) {
+    return crypto.createHmac("sha256", secret).update(data).digest("base64");
+}
+/**
+ * HMAC-SHA1 base64 digest. Used by Twilio.
+ */
+export function hmacSha1Base64(data, secret) {
+    return crypto.createHmac("sha1", secret).update(data).digest("base64");
+}
+// ── Comparison & freshness ───────────────────────────────────────────────────
+/**
+ * Timing-safe string comparison. Returns false on length mismatch.
+ */
+export function timingSafeCompare(a, b) {
+    try {
+        return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    }
+    catch {
+        return false; // Different lengths
+    }
+}
+/**
+ * Check that a timestamp is within an acceptable window (replay attack prevention).
+ * @param timestamp Unix timestamp in seconds
+ * @param maxAgeSeconds Maximum age allowed. Default: 300 (5 minutes).
+ */
+export function isTimestampFresh(timestamp, maxAgeSeconds = 300) {
+    if (isNaN(timestamp))
+        return false;
+    const now = Math.floor(Date.now() / 1000);
+    return Math.abs(now - timestamp) <= maxAgeSeconds;
+}
+/**
+ * Verify an HMAC-SHA256 hex signature (Linear-style).
+ * Compares `HMAC-SHA256(rawBody, secret)` against the provided signature.
+ */
+export function verifyHmacSha256Hex(ctx) {
+    const expected = hmacSha256Hex(ctx.rawBody, ctx.secret);
+    return timingSafeCompare(ctx.signature, expected);
+}
+/**
+ * Verify an HMAC-SHA256 base64 signature.
+ * Optionally strips a "sha256=" prefix (GitHub-style).
+ */
+export function verifyHmacSha256Base64(ctx, stripPrefix = false) {
+    const sig = stripPrefix
+        ? ctx.signature.replace(/^sha256=/, "")
+        : ctx.signature;
+    const expected = hmacSha256Base64(ctx.rawBody, ctx.secret);
+    return timingSafeCompare(sig, expected);
+}
+/**
+ * Verify a Slack v0 signature.
+ * Format: `v0={HMAC-SHA256("v0:{timestamp}:{body}", secret)}`
+ * Also validates timestamp freshness.
+ */
+export function verifySlackV0(ctx, maxAgeSeconds = 300) {
+    const timestamp = ctx.headers?.["timestamp"] ?? "";
+    const ts = parseInt(timestamp, 10);
+    if (!isTimestampFresh(ts, maxAgeSeconds))
+        return false;
+    const baseString = `v0:${timestamp}:${ctx.rawBody}`;
+    const computed = `v0=${hmacSha256Hex(baseString, ctx.secret)}`;
+    return timingSafeCompare(ctx.signature, computed);
+}
+/**
+ * Verify a Twilio signature.
+ * HMAC-SHA1 of URL + sorted POST params, base64 encoded.
+ */
+export function verifyTwilio(ctx) {
+    if (!ctx.url || !ctx.params)
+        return false;
+    const sortedKeys = Object.keys(ctx.params).sort();
+    let data = ctx.url;
+    for (const key of sortedKeys) {
+        data += key + ctx.params[key];
+    }
+    const expected = hmacSha1Base64(data, ctx.secret);
+    return timingSafeCompare(ctx.signature, expected);
+}
+//# sourceMappingURL=verify.js.map

package/dist/webhooks/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/webhooks/verify.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAc;IACxD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAc;IAC3D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAc;IACzD,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,oBAAoB;IACpC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,aAAa,GAAG,GAAG;IAEnB,IAAI,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,IAAI,aAAa,CAAC;AACpD,CAAC;AAMD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAkB;IACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAkB,EAClB,WAAW,GAAG,KAAK;IAEnB,MAAM,GAAG,GAAG,WAAW;QACrB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;IAClB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAkB,EAClB,aAAa,GAAG,GAAG;IAEnB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvD,MAAM,UAAU,GAAG,MAAM,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/D,OAAO,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAkB;IAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,OAAO,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACpD,CAAC"}

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@runcore-sh/runcore",
+  "version": "0.1.2",
+  "description": "Local-first AI agent runtime. One command, your machine, your data.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "runcore": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "public/*.html",
+    "public/*.js",
+    "public/*.css",
+    "skills",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "start": "node dist/cli.js",
+    "prepublishOnly": "npm run build",
+    "test": "vitest run",
+    "test:ui": "vitest --ui",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage"
+  },
+  "keywords": [
+    "agent",
+    "ai",
+    "local-first",
+    "sovereign",
+    "context-engineering",
+    "memory",
+    "coala",
+    "llm"
+  ],
+  "author": "The Herrman Group LLC",
+  "license": "MIT",
+  "homepage": "https://runcore.sh",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/XDM-ZSBW/core"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "@vitest/ui": "^4.0.18",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2",
+    "vitest": "^4.0.18"
+  },
+  "dependencies": {
+    "@browserbasehq/stagehand": "^3.1.0",
+    "@hono/node-server": "^1.19.9",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentelemetry/core": "^1.30.0",
+    "@opentelemetry/resources": "^1.30.0",
+    "@opentelemetry/sdk-trace-base": "^1.30.0",
+    "@opentelemetry/sdk-trace-node": "^1.30.0",
+    "@opentelemetry/semantic-conventions": "^1.28.0",
+    "hono": "^4.12.3",
+    "mammoth": "^1.11.0",
+    "pdf-parse": "^2.4.5",
+    "playwright": "^1.58.2",
+    "tesseract.js": "^7.0.0",
+    "unpdf": "^1.4.0"
+  }
+}