@runcore-sh/runcore 0.4.0 → 0.5.0

package/dist/extensions/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/extensions/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOtE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,+CAA+C;IAC/C,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,qBAAqB;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,4BAA4B;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAkFhF;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,aAAa,EACnB,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBzD;AAED,2CAA2C;AAC3C,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,EAAE,MAAM,GACnB,OAAO,CAYT;AAED,mDAAmD;AACnD,qBAAa,oBAAqB,SAAQ,KAAK;aAG3B,IAAI,EAChB,aAAa,GACb,mBAAmB,GACnB,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,kBAAkB;gBAPtB,OAAO,EAAE,MAAM,EACC,IAAI,EAChB,aAAa,GACb,mBAAmB,GACnB,WAAW,GACX,eAAe,GACf,kBAAkB,GAClB,kBAAkB;CAKzB"}

package/dist/extensions/client.js

@@ -0,0 +1,120 @@
+/**
+ * Extension streaming client — fetches extension tarballs from runcore.sh.
+ *
+ * Protocol:
+ *   GET https://runcore.sh/api/extensions/:name
+ *   Authorization: Bearer <activation-jwt>
+ *   X-Runcore-Version: 0.4.0
+ *   X-Bond-Signature: <sign("ext-byok:0.4.0", bondPrivateKey)>
+ *
+ * Returns gzipped tarball with manifest + module files.
+ * 403 if tier insufficient, 401 if token invalid.
+ */
+import { createVerify } from "node:crypto";
+import { createLogger } from "../utils/logger.js";
+import { signMessage } from "../tier/bond.js";
+const log = createLogger("ext-client");
+const REGISTRY_BASE = "https://runcore.sh/api/extensions";
+/**
+ * Stream an extension from runcore.sh.
+ *
+ * Downloads the extension tarball, extracts manifest + files.
+ * Throws on auth failure, network error, or invalid response.
+ */
+export async function streamExtension(opts) {
+    const { jwt, name, version, root, registryUrl = REGISTRY_BASE, timeoutMs = 30_000, } = opts;
+    const url = `${registryUrl}/${name}`;
+    // Sign the request with bond key for mutual authentication
+    const signPayload = `${name}:${version}`;
+    const bondSignature = await signMessage(root, signPayload);
+    const headers = {
+        Authorization: `Bearer ${jwt}`,
+        "X-Runcore-Version": version,
+        Accept: "application/json",
+    };
+    if (bondSignature) {
+        headers["X-Bond-Signature"] = bondSignature;
+    }
+    log.info(`Streaming ${name}@${version}...`);
+    const res = await fetch(url, {
+        method: "GET",
+        headers,
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        if (res.status === 401) {
+            throw new ExtensionStreamError(`Authentication failed for ${name}. Run \`runcore activate <token>\` to re-authenticate.`, "AUTH_FAILED");
+        }
+        if (res.status === 403) {
+            throw new ExtensionStreamError(`Tier insufficient for ${name}. Run \`runcore register\` to upgrade.`, "TIER_INSUFFICIENT");
+        }
+        if (res.status === 404) {
+            throw new ExtensionStreamError(`Extension ${name}@${version} not found. Run \`runcore update\` for latest version.`, "NOT_FOUND");
+        }
+        throw new ExtensionStreamError(`Failed to stream ${name}: ${res.status} ${body}`, "STREAM_FAILED");
+    }
+    // Parse JSON response containing manifest + base64-encoded files
+    const payload = (await res.json());
+    if (!payload.manifest || !payload.files) {
+        throw new ExtensionStreamError(`Invalid response for ${name} — missing manifest or files`, "INVALID_RESPONSE");
+    }
+    // Decode files
+    const files = new Map();
+    for (const [path, b64] of Object.entries(payload.files)) {
+        files.set(path, Buffer.from(b64, "base64"));
+    }
+    log.info(`Downloaded ${name}@${version} (${files.size} modules)`);
+    return { manifest: payload.manifest, files };
+}
+/**
+ * Check if a newer version of an extension is available.
+ * Lightweight HEAD request — doesn't download anything.
+ */
+export async function checkForUpdate(name, currentVersion, jwt) {
+    try {
+        const res = await fetch(`${REGISTRY_BASE}/${name}/check`, {
+            method: "GET",
+            headers: {
+                Authorization: `Bearer ${jwt}`,
+                "X-Runcore-Version": currentVersion,
+            },
+            signal: AbortSignal.timeout(5_000),
+        });
+        if (!res.ok)
+            return { available: false };
+        const data = (await res.json());
+        return {
+            available: data.updateAvailable,
+            latestVersion: data.latest,
+        };
+    }
+    catch {
+        return { available: false };
+    }
+}
+/** Verify an Ed25519 manifest signature */
+export function verifyManifestSignature(manifest, publicKeyPem) {
+    const { signature, ...body } = manifest;
+    if (!signature)
+        return false;
+    try {
+        const data = JSON.stringify(body, Object.keys(body).sort());
+        const verifier = createVerify("Ed25519");
+        verifier.update(data);
+        return verifier.verify(publicKeyPem, Buffer.from(signature, "base64url"));
+    }
+    catch {
+        return false;
+    }
+}
+/** Typed error for extension streaming failures */
+export class ExtensionStreamError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = "ExtensionStreamError";
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/extensions/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/extensions/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;AAEvC,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAuB1D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAmB;IACvD,MAAM,EACJ,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,EACJ,WAAW,GAAG,aAAa,EAC3B,SAAS,GAAG,MAAM,GACnB,GAAG,IAAI,CAAC;IAET,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;IAErC,2DAA2D;IAC3D,MAAM,WAAW,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAE3D,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,GAAG,EAAE;QAC9B,mBAAmB,EAAE,OAAO;QAC5B,MAAM,EAAE,kBAAkB;KAC3B,CAAC;IAEF,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,kBAAkB,CAAC,GAAG,aAAa,CAAC;IAC9C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,OAAO,KAAK,CAAC,CAAC;IAE5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,OAAO;QACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAC5B,6BAA6B,IAAI,wDAAwD,EACzF,aAAa,CACd,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAC5B,yBAAyB,IAAI,wCAAwC,EACrE,mBAAmB,CACpB,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAC5B,aAAa,IAAI,IAAI,OAAO,wDAAwD,EACpF,WAAW,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,oBAAoB,CAC5B,oBAAoB,IAAI,KAAK,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,EACjD,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAGhC,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,oBAAoB,CAC5B,wBAAwB,IAAI,8BAA8B,EAC1D,kBAAkB,CACnB,CAAC;IACJ,CAAC;IAED,eAAe;IACf,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,OAAO,KAAK,KAAK,CAAC,IAAI,WAAW,CAAC,CAAC;IAElE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAmB,EACnB,cAAsB,EACtB,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,IAAI,IAAI,QAAQ,EAAE;YACxD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,mBAAmB,EAAE,cAAc;aACpC;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAEzC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiD,CAAC;QAChF,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,eAAe;YAC/B,aAAa,EAAE,IAAI,CAAC,MAAM;SAC3B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,uBAAuB,CACrC,QAA2B,EAC3B,YAAoB;IAEpB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACzC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAG3B;IAFlB,YACE,OAAe,EACC,IAMM;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QARC,SAAI,GAAJ,IAAI,CAME;QAGtB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/extensions/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Extensions — capability delivery system.
+ *
+ * The npm package ships local-tier modules only. Higher-tier code
+ * (integrations, agent spawning, browser automation) streams from
+ * runcore.sh on activation and caches locally.
+ */
+export { loadExtensionModule, ensureExtension, setCoreVersion, getCoreVersion, ExtensionLoadError } from "./loader.js";
+export { isCached, verifyExtension, listCached, purge, purgeAll, cacheRoot } from "./cache.js";
+export { streamExtension, checkForUpdate, verifyManifestSignature, ExtensionStreamError } from "./client.js";
+export type { ExtensionManifest, ExtensionName, ExtensionModule } from "./manifest.js";
+export { EXTENSION_TIERS, extensionTier } from "./manifest.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/extensions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/extensions/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACvH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC7G,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/extensions/index.js

@@ -0,0 +1,12 @@
+/**
+ * Extensions — capability delivery system.
+ *
+ * The npm package ships local-tier modules only. Higher-tier code
+ * (integrations, agent spawning, browser automation) streams from
+ * runcore.sh on activation and caches locally.
+ */
+export { loadExtensionModule, ensureExtension, setCoreVersion, getCoreVersion, ExtensionLoadError } from "./loader.js";
+export { isCached, verifyExtension, listCached, purge, purgeAll, cacheRoot } from "./cache.js";
+export { streamExtension, checkForUpdate, verifyManifestSignature, ExtensionStreamError } from "./client.js";
+export { EXTENSION_TIERS, extensionTier } from "./manifest.js";
+//# sourceMappingURL=index.js.map

package/dist/extensions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/extensions/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACvH,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE7G,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/extensions/loader.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Extension loader — the core of the capability delivery system.
+ *
+ * Resolves module imports through: cache check → integrity verify → stream if missing.
+ * Same pattern as the 91 existing `await import()` calls in the codebase,
+ * but routed through cache + stream instead of static file paths.
+ *
+ * Usage:
+ *   const { AgentInstanceManager } = await loadExtensionModule<
+ *     typeof import("./agents/instance-manager.js")
+ *   >("ext-spawn", "agents/instance-manager.js");
+ */
+import type { ExtensionName } from "./manifest.js";
+/** Set the core version (called at startup from package.json) */
+export declare function setCoreVersion(version: string): void;
+/** Get the current core version */
+export declare function getCoreVersion(): string;
+/**
+ * Load a module from an extension.
+ *
+ * Resolution order:
+ * 1. Check if extension is cached for current version
+ * 2. Verify file integrity (SHA-256)
+ * 3. If missing or corrupt, stream from runcore.sh
+ * 4. Dynamic import the resolved file
+ *
+ * @param extension - Extension name (e.g. "ext-spawn")
+ * @param module - Module path within extension (e.g. "agents/spawn.js")
+ * @param root - Brain root directory (for token + bond key access)
+ * @returns The imported module
+ */
+export declare function loadExtensionModule<T = unknown>(extension: ExtensionName, module: string, root?: string): Promise<T>;
+/**
+ * Ensure an entire extension is cached.
+ * Used by `runcore sync` to pre-pull extensions.
+ */
+export declare function ensureExtension(extension: ExtensionName, root: string, options?: {
+    force?: boolean;
+}): Promise<{
+    cached: boolean;
+    modules: number;
+}>;
+/** Typed error for extension loading failures */
+export declare class ExtensionLoadError extends Error {
+    readonly code: "TIER_INSUFFICIENT" | "NOT_CACHED" | "MODULE_NOT_FOUND" | "IMPORT_FAILED" | "INTEGRITY_FAILED";
+    readonly extension: ExtensionName;
+    readonly module: string;
+    constructor(message: string, code: "TIER_INSUFFICIENT" | "NOT_CACHED" | "MODULE_NOT_FOUND" | "IMPORT_FAILED" | "INTEGRITY_FAILED", extension: ExtensionName, module: string);
+}
+//# sourceMappingURL=loader.d.ts.map

package/dist/extensions/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/extensions/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAsBnD,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEpD;AAED,mCAAmC;AACnC,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,GAAG,OAAO,EACnD,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CA6EZ;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,aAAa,EACxB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAC5B,OAAO,CAAC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA6C/C;AAuBD,iDAAiD;AACjD,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,IAAI,EAChB,mBAAmB,GACnB,YAAY,GACZ,kBAAkB,GAClB,eAAe,GACf,kBAAkB;aACN,SAAS,EAAE,aAAa;aACxB,MAAM,EAAE,MAAM;gBAR9B,OAAO,EAAE,MAAM,EACC,IAAI,EAChB,mBAAmB,GACnB,YAAY,GACZ,kBAAkB,GAClB,eAAe,GACf,kBAAkB,EACN,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,MAAM;CAKjC"}

package/dist/extensions/loader.js

@@ -0,0 +1,166 @@
+/**
+ * Extension loader — the core of the capability delivery system.
+ *
+ * Resolves module imports through: cache check → integrity verify → stream if missing.
+ * Same pattern as the 91 existing `await import()` calls in the codebase,
+ * but routed through cache + stream instead of static file paths.
+ *
+ * Usage:
+ *   const { AgentInstanceManager } = await loadExtensionModule<
+ *     typeof import("./agents/instance-manager.js")
+ *   >("ext-spawn", "agents/instance-manager.js");
+ */
+import { pathToFileURL } from "node:url";
+import { createLogger } from "../utils/logger.js";
+import { EXTENSION_TIERS } from "./manifest.js";
+import { isCached, verifyModule, modulePath, loadCachedManifest, writeModule, writeManifest, writeIntegrity, purge, sha256, } from "./cache.js";
+import { streamExtension } from "./client.js";
+import { loadActivationToken } from "../tier/token.js";
+import { meetsMinimum } from "../tier/gate.js";
+const log = createLogger("ext-loader");
+/** Version of the core package — used for cache keying */
+let _coreVersion = "0.4.0";
+/** Set the core version (called at startup from package.json) */
+export function setCoreVersion(version) {
+    _coreVersion = version;
+}
+/** Get the current core version */
+export function getCoreVersion() {
+    return _coreVersion;
+}
+/**
+ * Load a module from an extension.
+ *
+ * Resolution order:
+ * 1. Check if extension is cached for current version
+ * 2. Verify file integrity (SHA-256)
+ * 3. If missing or corrupt, stream from runcore.sh
+ * 4. Dynamic import the resolved file
+ *
+ * @param extension - Extension name (e.g. "ext-spawn")
+ * @param module - Module path within extension (e.g. "agents/spawn.js")
+ * @param root - Brain root directory (for token + bond key access)
+ * @returns The imported module
+ */
+export async function loadExtensionModule(extension, module, root) {
+    const resolvedRoot = root ?? process.cwd();
+    const version = _coreVersion;
+    // Check tier before attempting load
+    const activation = await loadActivationToken(resolvedRoot);
+    const currentTier = activation?.token.tier ?? "local";
+    const requiredTier = EXTENSION_TIERS[extension];
+    if (!meetsMinimum(currentTier, requiredTier)) {
+        throw new ExtensionLoadError(`Extension "${extension}" requires tier "${requiredTier}" (current: "${currentTier}"). ` +
+            `Run \`runcore register\` to upgrade.`, "TIER_INSUFFICIENT", extension, module);
+    }
+    // Try loading from cache
+    const cached = await isCached(extension, version);
+    if (cached) {
+        const manifest = await loadCachedManifest(extension, version);
+        if (manifest) {
+            const modEntry = manifest.modules.find((m) => m.path === module);
+            if (modEntry) {
+                // Verify integrity
+                const valid = await verifyModule(extension, version, module, modEntry.hash);
+                if (valid) {
+                    return dynamicImport(extension, version, module);
+                }
+                // Corrupted — purge and re-stream
+                log.warn(`Integrity check failed for ${extension}/${module} — re-downloading`);
+                await purge(extension, version);
+            }
+        }
+    }
+    // Stream from runcore.sh
+    if (!activation) {
+        throw new ExtensionLoadError(`Extension "${extension}" not cached and no activation token found. ` +
+            `Run \`runcore activate <token>\` first.`, "NOT_CACHED", extension, module);
+    }
+    log.info(`Streaming ${extension}@${version} for module ${module}...`);
+    const result = await streamExtension({
+        jwt: activation.raw,
+        name: extension,
+        version,
+        root: resolvedRoot,
+    });
+    // Write all files to cache
+    const hashes = {};
+    for (const [path, content] of result.files) {
+        await writeModule(extension, version, path, content);
+        hashes[path] = sha256(content);
+    }
+    await writeManifest(extension, version, result.manifest);
+    await writeIntegrity(extension, version, hashes);
+    // Verify the target module exists in the downloaded set
+    if (!result.files.has(module)) {
+        throw new ExtensionLoadError(`Module "${module}" not found in extension "${extension}@${version}".`, "MODULE_NOT_FOUND", extension, module);
+    }
+    return dynamicImport(extension, version, module);
+}
+/**
+ * Ensure an entire extension is cached.
+ * Used by `runcore sync` to pre-pull extensions.
+ */
+export async function ensureExtension(extension, root, options) {
+    const version = _coreVersion;
+    // Check tier
+    const activation = await loadActivationToken(root);
+    const currentTier = activation?.token.tier ?? "local";
+    const requiredTier = EXTENSION_TIERS[extension];
+    if (!meetsMinimum(currentTier, requiredTier)) {
+        return { cached: false, modules: 0 };
+    }
+    // Already cached (and not forcing)?
+    if (!options?.force && (await isCached(extension, version))) {
+        const manifest = await loadCachedManifest(extension, version);
+        return { cached: true, modules: manifest?.modules.length ?? 0 };
+    }
+    if (!activation) {
+        return { cached: false, modules: 0 };
+    }
+    // Force purge if requested
+    if (options?.force) {
+        await purge(extension, version);
+    }
+    // Stream
+    const result = await streamExtension({
+        jwt: activation.raw,
+        name: extension,
+        version,
+        root,
+    });
+    // Write to cache
+    const hashes = {};
+    for (const [path, content] of result.files) {
+        await writeModule(extension, version, path, content);
+        hashes[path] = sha256(content);
+    }
+    await writeManifest(extension, version, result.manifest);
+    await writeIntegrity(extension, version, hashes);
+    return { cached: true, modules: result.files.size };
+}
+/** Dynamic import from the cache directory */
+async function dynamicImport(extension, version, module) {
+    const filePath = modulePath(extension, version, module);
+    const fileUrl = pathToFileURL(filePath).href;
+    try {
+        return (await import(fileUrl));
+    }
+    catch (err) {
+        throw new ExtensionLoadError(`Failed to import ${extension}/${module}: ${err instanceof Error ? err.message : String(err)}`, "IMPORT_FAILED", extension, module);
+    }
+}
+/** Typed error for extension loading failures */
+export class ExtensionLoadError extends Error {
+    code;
+    extension;
+    module;
+    constructor(message, code, extension, module) {
+        super(message);
+        this.code = code;
+        this.extension = extension;
+        this.module = module;
+        this.name = "ExtensionLoadError";
+    }
+}
+//# sourceMappingURL=loader.js.map

package/dist/extensions/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/extensions/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,cAAc,EACd,KAAK,EACL,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAwB,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;AAEvC,0DAA0D;AAC1D,IAAI,YAAY,GAAG,OAAO,CAAC;AAE3B,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,YAAY,GAAG,OAAO,CAAC;AACzB,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAwB,EACxB,MAAc,EACd,IAAa;IAEb,MAAM,YAAY,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,YAAY,CAAC;IAE7B,oCAAoC;IACpC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,UAAU,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC;IACtD,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAEhD,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,kBAAkB,CAC1B,cAAc,SAAS,oBAAoB,YAAY,gBAAgB,WAAW,MAAM;YACtF,sCAAsC,EACxC,mBAAmB,EACnB,SAAS,EACT,MAAM,CACP,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YACjE,IAAI,QAAQ,EAAE,CAAC;gBACb,mBAAmB;gBACnB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC5E,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,aAAa,CAAI,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBACtD,CAAC;gBACD,kCAAkC;gBAClC,GAAG,CAAC,IAAI,CAAC,8BAA8B,SAAS,IAAI,MAAM,mBAAmB,CAAC,CAAC;gBAC/E,MAAM,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,kBAAkB,CAC1B,cAAc,SAAS,8CAA8C;YACnE,yCAAyC,EAC3C,YAAY,EACZ,SAAS,EACT,MAAM,CACP,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,aAAa,SAAS,IAAI,OAAO,eAAe,MAAM,KAAK,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,IAAI,EAAE,SAAS;QACf,OAAO;QACP,IAAI,EAAE,YAAY;KACnB,CAAC,CAAC;IAEH,2BAA2B;IAC3B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjD,wDAAwD;IACxD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,kBAAkB,CAC1B,WAAW,MAAM,6BAA6B,SAAS,IAAI,OAAO,IAAI,EACtE,kBAAkB,EAClB,SAAS,EACT,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,aAAa,CAAI,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAwB,EACxB,IAAY,EACZ,OAA6B;IAE7B,MAAM,OAAO,GAAG,YAAY,CAAC;IAE7B,aAAa;IACb,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,UAAU,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC;IACtD,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAEhD,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,oCAAoC;IACpC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9D,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,MAAM,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,SAAS;IACT,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,GAAG,EAAE,UAAU,CAAC,GAAG;QACnB,IAAI,EAAE,SAAS;QACf,OAAO;QACP,IAAI;KACL,CAAC,CAAC;IAEH,iBAAiB;IACjB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,8CAA8C;AAC9C,KAAK,UAAU,aAAa,CAC1B,SAAwB,EACxB,OAAe,EACf,MAAc;IAEd,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAM,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,SAAS,IAAI,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC9F,eAAe,EACf,SAAS,EACT,MAAM,CACP,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGzB;IAMA;IACA;IATlB,YACE,OAAe,EACC,IAKM,EACN,SAAwB,EACxB,MAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QATC,SAAI,GAAJ,IAAI,CAKE;QACN,cAAS,GAAT,SAAS,CAAe;QACxB,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF"}

package/dist/extensions/manifest.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Extension manifest types — describes a streamed capability bundle.
+ *
+ * Each extension is a tier-gated set of modules that don't ship in the
+ * npm package. They stream from runcore.sh on activation and cache locally.
+ */
+import type { TierName } from "../tier/types.js";
+/** Individual module within an extension */
+export interface ExtensionModule {
+    /** Relative path within extension (e.g. "vault/store.js") */
+    path: string;
+    /** SHA-256 hash of the file contents */
+    hash: string;
+}
+/** Extension manifest — shipped inside each extension tarball */
+export interface ExtensionManifest {
+    /** Extension identifier (e.g. "ext-byok", "ext-spawn", "ext-hosted") */
+    name: ExtensionName;
+    /** Semver, locked to core package version */
+    version: string;
+    /** Minimum core version required */
+    minCoreVersion: string;
+    /** Tier required to activate this extension */
+    tier: TierName;
+    /** All modules in this extension */
+    modules: ExtensionModule[];
+    /** npm dependencies this extension needs (informational — installed by sync) */
+    dependencies?: Record<string, string>;
+    /** Ed25519 signature of the manifest (excluding this field) */
+    signature?: string;
+}
+/** Known extension names */
+export type ExtensionName = "ext-byok" | "ext-spawn" | "ext-hosted";
+/** Extension tier mapping */
+export declare const EXTENSION_TIERS: Record<ExtensionName, TierName>;
+/** Map extension name to required tier level */
+export declare function extensionTier(name: ExtensionName): TierName;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/extensions/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/extensions/manifest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjD,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,IAAI,EAAE,aAAa,CAAC;IACpB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,IAAI,EAAE,QAAQ,CAAC;IACf,oCAAoC;IACpC,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,gFAAgF;IAChF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,WAAW,GAAG,YAAY,CAAC;AAEpE,6BAA6B;AAC7B,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,CAI3D,CAAC;AAEF,gDAAgD;AAChD,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,QAAQ,CAE3D"}

package/dist/extensions/manifest.js

@@ -0,0 +1,17 @@
+/**
+ * Extension manifest types — describes a streamed capability bundle.
+ *
+ * Each extension is a tier-gated set of modules that don't ship in the
+ * npm package. They stream from runcore.sh on activation and cache locally.
+ */
+/** Extension tier mapping */
+export const EXTENSION_TIERS = {
+    "ext-byok": "byok",
+    "ext-spawn": "spawn",
+    "ext-hosted": "hosted",
+};
+/** Map extension name to required tier level */
+export function extensionTier(name) {
+    return EXTENSION_TIERS[name];
+}
+//# sourceMappingURL=manifest.js.map

package/dist/extensions/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/extensions/manifest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiCH,6BAA6B;AAC7B,MAAM,CAAC,MAAM,eAAe,GAAoC;IAC9D,UAAU,EAAE,MAAM;IAClB,WAAW,EAAE,OAAO;IACpB,YAAY,EAAE,QAAQ;CACvB,CAAC;AAEF,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}

package/dist/extensions/stubs.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Stub exports for gated modules.
+ *
+ * These provide clean error messages when someone tries to use
+ * a gated feature without the required tier. Type stubs (.d.ts)
+ * ship for autocomplete; these runtime stubs throw on access.
+ */
+import type { TierName } from "../tier/types.js";
+import type { ExtensionName } from "./manifest.js";
+/**
+ * Create a proxy that throws a tier upgrade message on any property access.
+ * Used as a drop-in replacement for gated module exports.
+ */
+export declare function createTierStub<T extends object>(moduleName: string, extension: ExtensionName, requiredTier: TierName): T;
+/** Vault stub (BYOK tier) */
+export declare const VaultStub: object;
+/** Notifications stub (BYOK tier) */
+export declare const NotificationsStub: object;
+/** Agent spawn stub (Spawn tier) */
+export declare const AgentSpawnStub: object;
+/** Governed spawn stub (Spawn tier) */
+export declare const GovernedSpawnStub: object;
+/** Browser stub (Hosted tier) */
+export declare const BrowserStub: object;
+/** Tracing stub (Hosted tier) */
+export declare const TracingStub: object;
+//# sourceMappingURL=stubs.d.ts.map

package/dist/extensions/stubs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stubs.d.ts","sourceRoot":"","sources":["../../src/extensions/stubs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,EAC7C,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,aAAa,EACxB,YAAY,EAAE,QAAQ,GACrB,CAAC,CAoBH;AAID,6BAA6B;AAC7B,eAAO,MAAM,SAAS,QAA8C,CAAC;AAErE,qCAAqC;AACrC,eAAO,MAAM,iBAAiB,QAAsD,CAAC;AAErF,oCAAoC;AACpC,eAAO,MAAM,cAAc,QAAuD,CAAC;AAEnF,uCAAuC;AACvC,eAAO,MAAM,iBAAiB,QAAgE,CAAC;AAE/F,iCAAiC;AACjC,eAAO,MAAM,WAAW,QAAoD,CAAC;AAE7E,iCAAiC;AACjC,eAAO,MAAM,WAAW,QAAoD,CAAC"}

package/dist/extensions/stubs.js

@@ -0,0 +1,45 @@
+/**
+ * Stub exports for gated modules.
+ *
+ * These provide clean error messages when someone tries to use
+ * a gated feature without the required tier. Type stubs (.d.ts)
+ * ship for autocomplete; these runtime stubs throw on access.
+ */
+/**
+ * Create a proxy that throws a tier upgrade message on any property access.
+ * Used as a drop-in replacement for gated module exports.
+ */
+export function createTierStub(moduleName, extension, requiredTier) {
+    const message = `"${moduleName}" requires the "${requiredTier}" tier. ` +
+        `Run \`runcore register\` to upgrade, then \`runcore sync\` to download.`;
+    return new Proxy({}, {
+        get(_target, prop) {
+            if (prop === Symbol.toPrimitive || prop === "toString" || prop === "valueOf") {
+                return () => `[Stub: ${moduleName}]`;
+            }
+            if (typeof prop === "symbol")
+                return undefined;
+            throw new Error(message);
+        },
+        apply() {
+            throw new Error(message);
+        },
+        construct() {
+            throw new Error(message);
+        },
+    });
+}
+// ── Pre-built stubs for common gated modules ──
+/** Vault stub (BYOK tier) */
+export const VaultStub = createTierStub("vault", "ext-byok", "byok");
+/** Notifications stub (BYOK tier) */
+export const NotificationsStub = createTierStub("notifications", "ext-byok", "byok");
+/** Agent spawn stub (Spawn tier) */
+export const AgentSpawnStub = createTierStub("agents/spawn", "ext-spawn", "spawn");
+/** Governed spawn stub (Spawn tier) */
+export const GovernedSpawnStub = createTierStub("agents/governed-spawn", "ext-spawn", "spawn");
+/** Browser stub (Hosted tier) */
+export const BrowserStub = createTierStub("browser", "ext-hosted", "hosted");
+/** Tracing stub (Hosted tier) */
+export const TracingStub = createTierStub("tracing", "ext-hosted", "hosted");
+//# sourceMappingURL=stubs.js.map

package/dist/extensions/stubs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stubs.js","sourceRoot":"","sources":["../../src/extensions/stubs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,SAAwB,EACxB,YAAsB;IAEtB,MAAM,OAAO,GACX,IAAI,UAAU,mBAAmB,YAAY,UAAU;QACvD,yEAAyE,CAAC;IAE5E,OAAO,IAAI,KAAK,CAAC,EAAO,EAAE;QACxB,GAAG,CAAC,OAAO,EAAE,IAAI;YACf,IAAI,IAAI,KAAK,MAAM,CAAC,WAAW,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC7E,OAAO,GAAG,EAAE,CAAC,UAAU,UAAU,GAAG,CAAC;YACvC,CAAC;YACD,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,KAAK;YACH,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,SAAS;YACP,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,iDAAiD;AAEjD,6BAA6B;AAC7B,MAAM,CAAC,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAErE,qCAAqC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAErF,oCAAoC;AACpC,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAEnF,uCAAuC;AACvC,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC,uBAAuB,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAE/F,iCAAiC;AACjC,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AAE7E,iCAAiC;AACjC,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC"}

package/dist/lib/audit.js

@@ -25,8 +25,8 @@ export function getAuditContext() {
     return auditContextStore.getStore();
 }
 // ── File setup ───────────────────────────────────────────────────────────────
-import { BRAIN_DIR } from "./paths.js";
-const OPS_DIR = join(BRAIN_DIR, "ops");
+import { BRAIN_DIR, resolveBrainDir } from "./paths.js";
+const OPS_DIR = resolveBrainDir("ops");
 const AUDIT_FILE = join(OPS_DIR, "audit.jsonl");
 const SCHEMA_LINE = JSON.stringify({
     _schema: "audit",

package/dist/lib/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/lib/audit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAS,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAW,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAyBlC,gFAAgF;AAEhF,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAgB,CAAC;AAEhE;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAI,GAAiB,EAAE,EAAW;IACnE,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,eAAe;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,gFAAgF;AAEhF,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACvC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,sCAAsC;CAChD,CAAC,CAAC;AAEH,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,UAAU;IACjB,IAAI,WAAW;QAAE,OAAO;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,cAAc,CAAC,UAAU,EAAE,WAAW,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC1C,2DAA2D;QAC3D,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QACjE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,QAAgB,EAChB,MAA4B;IAE5B,4CAA4C;IAC5C,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO;IAEpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;IACzC,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC;QAC/B,MAAM;QACN,MAAM,EAAE,GAAG,EAAE,MAAM;QACnB,OAAO,EAAE,GAAG,EAAE,OAAO;KACtB,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,iCAAiC;QACjC,UAAU,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACzD,GAAG,CAAC,KAAK,CAAC,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,MAA4B;IAE5B,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO;IAEpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;IACzC,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC;QAC/B,MAAM;QACN,MAAM,EAAE,GAAG,EAAE,MAAM;QACnB,OAAO,EAAE,GAAG,EAAE,OAAO;KACtB,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,EAAE,CAAC;QACb,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/lib/audit.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAS,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAW,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAyBlC,gFAAgF;AAEhF,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,EAAgB,CAAC;AAEhE;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAI,GAAiB,EAAE,EAAW;IACnE,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,eAAe;IAC7B,OAAO,iBAAiB,CAAC,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,gFAAgF;AAEhF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACxD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;AACvC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAChD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,sCAAsC;CAChD,CAAC,CAAC;AAEH,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,SAAS,UAAU;IACjB,IAAI,WAAW;QAAE,OAAO;IACxB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,cAAc,CAAC,UAAU,EAAE,WAAW,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC1C,2DAA2D;QAC3D,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;QACjE,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,QAAgB,EAChB,MAA4B;IAE5B,4CAA4C;IAC5C,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO;IAEpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;IACzC,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC;QAC/B,MAAM;QACN,MAAM,EAAE,GAAG,EAAE,MAAM;QACnB,OAAO,EAAE,GAAG,EAAE,OAAO;KACtB,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,iCAAiC;QACjC,UAAU,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACzD,GAAG,CAAC,KAAK,CAAC,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,MAA4B;IAE5B,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO;IAEpC,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;IACzC,MAAM,KAAK,GAAe;QACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC;QAC/B,MAAM;QACN,MAAM,EAAE,GAAG,EAAE,MAAM;QACnB,OAAO,EAAE,GAAG,EAAE,OAAO;KACtB,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,EAAE,CAAC;QACb,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}

package/dist/lib/brain-migrate.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Brain v2 migration — moves from 30+ top-level directories to 3:
+ *   log/    ← append-only JSONL (memory, ops, metrics, ledger)
+ *   files/  ← everything else (knowledge, identity, content, etc.)
+ *   .config/ ← settings, access, locked paths
+ *
+ * Safe to run multiple times. Moves directories, doesn't copy.
+ * Creates symlinks from old paths to new locations for backward compat.
+ */
+export interface MigrationResult {
+    migrated: string[];
+    skipped: string[];
+    errors: string[];
+    alreadyV2: boolean;
+}
+/**
+ * Migrate a brain directory from legacy layout to v2.
+ * Safe to run multiple times — skips already-migrated items.
+ */
+export declare function migrateBrainToV2(): Promise<MigrationResult>;
+//# sourceMappingURL=brain-migrate.d.ts.map

package/dist/lib/brain-migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-migrate.d.ts","sourceRoot":"","sources":["../../src/lib/brain-migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4DH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,eAAe,CAAC,CA8DjE"}