# Runtime dependency inventory

Generated by `node scripts/export-source.mjs` from `package-lock.json` (SHA-256 `02c3a6a234505075fee8468d38abbd52cb1a24cf173cbbbc18167487fe0f059e`). Regenerate after dependency changes.

The graph starts from the runtime dependencies of `@agentrun/dsl`, `@agentrun/jev`, and `@agentrun/pi`, follows their dependencies and peers, and includes optional platform packages recorded in the lockfile. Development-only tooling is excluded. Versions are the exact locked versions, not the ranges in package manifests. “Optional” identifies entries marked optional at every recorded installation location; package use still depends on platform and adapter configuration.

142 distinct third-party package/version pairs across 143 lockfile locations. Declared licenses: `0BSD`, `Apache-2.0`, `BSD-3-Clause`, `BlueOak-1.0.0`, `ISC`, `MIT`.

## Release review

No missing, restrictive, reciprocal, or unrecognized license identifiers were found in this runtime lockfile graph.

AgentRun's own license is declared in its package manifests, separately from this third-party inventory. This table records package metadata, not an approval to redistribute. The release owner must confirm source rights, inspect applicable license texts, and preserve required notices. Website assets outside npm require their own provenance and attribution check.

Optional peer/dependency names absent from this lockfile: `bufferutil`, `utf-8-validate`, `@modelcontextprotocol/sdk`. These are not counted as inventoried packages; adding them requires regenerating this inventory.

## Locked packages

| Package | Version | Declared license | Used by | Optional | Lock locations |
| --- | --- | --- | --- | --- | --- |
| @anthropic-ai/sdk | 0.91.1 | MIT | pi | no | 1 |
| @aws-crypto/crc32 | 5.2.0 | Apache-2.0 | pi | no | 1 |
| @aws-crypto/sha256-browser | 5.2.0 | Apache-2.0 | pi | no | 1 |
| @aws-crypto/sha256-js | 5.2.0 | Apache-2.0 | pi | no | 1 |
| @aws-crypto/supports-web-crypto | 5.2.0 | Apache-2.0 | pi | no | 1 |
| @aws-crypto/util | 5.2.0 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/client-bedrock-runtime | 3.1048.0 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/core | 3.974.11 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-env | 3.972.37 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-http | 3.972.39 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-ini | 3.972.41 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-login | 3.972.41 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-node | 3.972.42 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-process | 3.972.37 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-sso | 3.972.41 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-web-identity | 3.972.41 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/eventstream-handler-node | 3.972.16 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/middleware-eventstream | 3.972.12 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/middleware-websocket | 3.972.19 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/nested-clients | 3.997.9 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/signature-v4-multi-region | 3.996.27 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/token-providers | 3.1048.0 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/types | 3.973.8 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/util-locate-window | 3.965.5 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/xml-builder | 3.972.24 | Apache-2.0 | pi | no | 1 |
| @aws/lambda-invoke-store | 0.2.4 | Apache-2.0 | pi | no | 1 |
| @babel/runtime | 7.29.2 | MIT | pi | no | 1 |
| @earendil-works/pi-agent-core | 0.84.2 | MIT | pi | no | 1 |
| @earendil-works/pi-ai | 0.84.2 | MIT | pi | no | 1 |
| @earendil-works/pi-client | 0.84.2 | MIT | pi | no | 1 |
| @earendil-works/pi-coding-agent | 0.84.2 | MIT | pi | no | 1 |
| @earendil-works/pi-protocol | 0.84.2 | MIT | pi | no | 1 |
| @earendil-works/pi-telemetry | 0.84.2 | MIT | pi | no | 1 |
| @earendil-works/pi-tui | 0.84.2 | MIT | pi | no | 1 |
| @google/genai | 1.52.0 | Apache-2.0 | pi | no | 1 |
| @mariozechner/clipboard-darwin-arm64 | 0.3.9 | MIT | pi | yes | 1 |
| @mariozechner/clipboard-darwin-universal | 0.3.9 | MIT | pi | yes | 1 |
| @mariozechner/clipboard-darwin-x64 | 0.3.9 | MIT | pi | yes | 1 |
| @mariozechner/clipboard-linux-arm64-gnu | 0.3.9 | MIT | pi | yes | 1 |
| @mariozechner/clipboard-linux-arm64-musl | 0.3.9 | MIT | pi | yes | 1 |
| @mariozechner/clipboard-linux-riscv64-gnu | 0.3.9 | MIT | pi | yes | 1 |
| @mariozechner/clipboard-linux-x64-gnu | 0.3.9 | MIT | pi | yes | 1 |
| @mariozechner/clipboard-linux-x64-musl | 0.3.9 | MIT | pi | yes | 1 |
| @mariozechner/clipboard-win32-arm64-msvc | 0.3.9 | MIT | pi | yes | 1 |
| @mariozechner/clipboard-win32-x64-msvc | 0.3.9 | MIT | pi | yes | 1 |
| @mariozechner/clipboard | 0.3.9 | MIT | pi | yes | 1 |
| @nodable/entities | 2.1.0 | MIT | pi | no | 1 |
| @opentelemetry/api | 1.9.0 | Apache-2.0 | pi | no | 1 |
| @protobufjs/aspromise | 1.1.2 | BSD-3-Clause | pi | no | 1 |
| @protobufjs/base64 | 1.1.2 | BSD-3-Clause | pi | no | 1 |
| @protobufjs/codegen | 2.0.5 | BSD-3-Clause | pi | no | 1 |
| @protobufjs/eventemitter | 1.1.1 | BSD-3-Clause | pi | no | 1 |
| @protobufjs/fetch | 1.1.1 | BSD-3-Clause | pi | no | 1 |
| @protobufjs/float | 1.0.2 | BSD-3-Clause | pi | no | 1 |
| @protobufjs/path | 1.1.2 | BSD-3-Clause | pi | no | 1 |
| @protobufjs/pool | 1.1.0 | BSD-3-Clause | pi | no | 1 |
| @protobufjs/utf8 | 1.1.1 | BSD-3-Clause | pi | no | 1 |
| @silvia-odwyer/photon-node | 0.3.4 | Apache-2.0 | pi | no | 1 |
| @smithy/core | 3.24.3 | Apache-2.0 | pi | no | 1 |
| @smithy/credential-provider-imds | 4.3.3 | Apache-2.0 | pi | no | 1 |
| @smithy/fetch-http-handler | 5.4.3 | Apache-2.0 | pi | no | 1 |
| @smithy/is-array-buffer | 2.2.0 | Apache-2.0 | pi | no | 1 |
| @smithy/node-http-handler | 4.7.3 | Apache-2.0 | pi | no | 1 |
| @smithy/signature-v4 | 5.4.3 | Apache-2.0 | pi | no | 1 |
| @smithy/types | 4.14.2 | Apache-2.0 | pi | no | 1 |
| @smithy/util-buffer-from | 2.2.0 | Apache-2.0 | pi | no | 1 |
| @smithy/util-utf8 | 2.3.0 | Apache-2.0 | pi | no | 1 |
| @types/node | 22.19.19 | MIT | pi | no | 1 |
| @types/retry | 0.12.0 | MIT | pi | no | 1 |
| @typesafe-ai/sdk | 0.6.0 | MIT | jev | no | 1 |
| agent-base | 7.1.4 | MIT | pi | no | 1 |
| balanced-match | 4.0.4 | MIT | pi | no | 1 |
| base64-js | 1.5.1 | MIT | pi | no | 1 |
| bignumber.js | 9.3.1 | MIT | pi | no | 1 |
| bowser | 2.14.1 | MIT | pi | no | 1 |
| brace-expansion | 5.0.9 | MIT | pi | no | 1 |
| buffer-equal-constant-time | 1.0.1 | BSD-3-Clause | pi | no | 1 |
| chalk | 5.6.2 | MIT | pi | no | 1 |
| cross-spawn | 7.0.6 | MIT | pi | no | 1 |
| data-uri-to-buffer | 4.0.1 | MIT | pi | no | 1 |
| debug | 4.4.3 | MIT | pi | no | 1 |
| diff | 8.0.4 | BSD-3-Clause | pi | no | 1 |
| ecdsa-sig-formatter | 1.0.11 | Apache-2.0 | pi | no | 1 |
| extend | 3.0.2 | MIT | pi | no | 1 |
| fast-xml-builder | 1.2.0 | MIT | pi | no | 1 |
| fast-xml-parser | 5.7.3 | MIT | pi | no | 1 |
| fetch-blob | 3.2.0 | MIT | pi | no | 1 |
| formdata-polyfill | 4.0.10 | MIT | pi | no | 1 |
| gaxios | 7.1.4 | Apache-2.0 | pi | no | 1 |
| gcp-metadata | 8.1.2 | Apache-2.0 | pi | no | 1 |
| get-east-asian-width | 1.6.0 | MIT | pi | no | 1 |
| glob | 13.0.6 | BlueOak-1.0.0 | pi | no | 1 |
| google-auth-library | 10.6.2 | Apache-2.0 | pi | no | 1 |
| google-logging-utils | 1.1.3 | Apache-2.0 | pi | no | 1 |
| graceful-fs | 4.2.11 | ISC | pi | no | 1 |
| grok-mermaid | 0.2.2 | Apache-2.0 | pi | no | 1 |
| highlight.js | 10.7.3 | BSD-3-Clause | pi | no | 1 |
| hosted-git-info | 9.0.3 | ISC | pi | no | 1 |
| http-proxy-agent | 7.0.2 | MIT | pi | no | 1 |
| https-proxy-agent | 7.0.6 | MIT | pi | no | 1 |
| ignore | 7.0.5 | MIT | pi | no | 1 |
| isexe | 2.0.0 | ISC | pi | no | 1 |
| jiti | 2.7.0 | MIT | pi | no | 1 |
| json-bigint | 1.0.0 | MIT | pi | no | 1 |
| json-schema-to-ts | 3.1.1 | MIT | pi | no | 1 |
| jwa | 2.0.1 | MIT | pi | no | 1 |
| jws | 4.0.1 | MIT | pi | no | 1 |
| long | 5.3.2 | Apache-2.0 | pi | no | 1 |
| lru-cache | 11.4.0 | BlueOak-1.0.0 | pi | no | 1 |
| marked | 18.0.5 | MIT | pi | no | 1 |
| minimatch | 10.2.5 | BlueOak-1.0.0 | pi | no | 1 |
| minipass | 7.1.3 | BlueOak-1.0.0 | pi | no | 1 |
| ms | 2.1.3 | MIT | pi | no | 1 |
| node-domexception | 1.0.0 | MIT | pi | no | 1 |
| node-fetch | 3.3.2 | MIT | pi | no | 1 |
| openai | 6.40.0 | Apache-2.0 | pi | no | 1 |
| p-retry | 4.6.2 | MIT | pi | no | 1 |
| partial-json | 0.1.7 | MIT | pi | no | 1 |
| path-expression-matcher | 1.5.0 | MIT | pi | no | 1 |
| path-key | 3.1.1 | MIT | pi | no | 1 |
| path-scurry | 2.0.2 | BlueOak-1.0.0 | pi | no | 1 |
| proper-lockfile | 4.1.2 | MIT | pi | no | 1 |
| protobufjs | 7.6.5 | BSD-3-Clause | pi | no | 1 |
| retry | 0.12.0 | MIT | pi | no | 1 |
| retry | 0.13.1 | MIT | pi | no | 1 |
| safe-buffer | 5.2.1 | MIT | pi | no | 1 |
| semver | 7.8.0 | ISC | pi | no | 1 |
| shebang-command | 2.0.0 | MIT | pi | no | 1 |
| shebang-regex | 3.0.0 | MIT | pi | no | 1 |
| signal-exit | 3.0.7 | ISC | pi | no | 1 |
| strnum | 2.3.0 | MIT | pi | no | 1 |
| ts-algebra | 2.0.0 | MIT | pi | no | 1 |
| tslib | 2.8.1 | 0BSD | pi | no | 1 |
| typebox | 1.3.7 | MIT | dsl, jev, pi | no | 2 |
| undici-types | 6.21.0 | MIT | pi | no | 1 |
| undici | 8.9.0 | MIT | pi | no | 1 |
| web-streams-polyfill | 3.3.3 | MIT | pi | no | 1 |
| which | 2.0.2 | ISC | pi | no | 1 |
| ws | 8.21.0 | MIT | pi | no | 1 |
| xml-naming | 0.1.0 | MIT | pi | no | 1 |
| yaml | 2.9.0 | ISC | pi | no | 1 |
| zod | 4.6.5 | MIT | pi | no | 1 |