# Runtime dependency inventory

Generated by `node scripts/export-source.mjs` from `package-lock.json` (SHA-256 `37dbd38a84839b7e155eba52df052aa33bec421b9088fde7472c5219b58894bb`). Regenerate after dependency changes.

The graph starts from the runtime dependencies of `@parcha/agentrun-dsl`, `@parcha/agentrun-jev`, and `@parcha/agentrun-pi`, follows their dependencies and peers, and includes optional platform packages recorded in the lockfile. Development-only tooling is excluded. Versions are the exact locked versions, not the ranges in package manifests. “Optional” identifies entries marked optional at every recorded installation location; package use still depends on platform and adapter configuration.

165 distinct third-party package/version pairs across 268 lockfile locations. Declared licenses: `0BSD`, `Apache-2.0`, `BSD-3-Clause`, `BlueOak-1.0.0`, `ISC`, `MIT`, `Unlicense`.

## Release review

No missing, restrictive, reciprocal, or unrecognized license identifiers were found in this runtime lockfile graph.

AgentRun's own license is declared in its package manifests, separately from this third-party inventory. This table records package metadata, not an approval to redistribute. The release owner must confirm source rights, inspect applicable license texts, and preserve required notices.

Optional peer/dependency names absent from this lockfile: `bufferutil`, `utf-8-validate`, `@modelcontextprotocol/sdk`, `kerberos`, `bufferutil`, `utf-8-validate`, `@modelcontextprotocol/sdk`, `kerberos`. These are not counted as inventoried packages; adding them requires regenerating this inventory.

## Locked packages

| Package | Version | Declared license | Used by | Optional | Lock locations |
| --- | --- | --- | --- | --- | --- |
| @anthropic-ai/sdk | 0.124.0 | MIT | pi | no | 2 |
| @aws-sdk/client-bedrock-runtime | 3.1127.0 | Apache-2.0 | pi | no | 2 |
| @aws-sdk/core | 3.977.9 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/core | 3.978.0 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-env | 3.972.70 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-env | 3.972.71 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-http | 3.972.72 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-http | 3.972.73 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-ini | 3.973.15 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-ini | 3.973.16 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-login | 3.972.77 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-login | 3.972.78 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-node | 3.972.82 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-node | 3.972.83 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-process | 3.972.70 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-process | 3.972.71 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-sso | 3.973.14 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-sso | 3.973.15 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-web-identity | 3.972.76 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/credential-provider-web-identity | 3.972.77 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/eventstream-handler-node | 3.972.34 | Apache-2.0 | pi | no | 2 |
| @aws-sdk/middleware-eventstream | 3.972.29 | Apache-2.0 | pi | no | 2 |
| @aws-sdk/middleware-websocket | 3.972.52 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/middleware-websocket | 3.972.53 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/nested-clients | 3.997.44 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/nested-clients | 3.997.45 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/signature-v4-multi-region | 3.996.46 | Apache-2.0 | pi | no | 2 |
| @aws-sdk/token-providers | 3.1116.0 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/token-providers | 3.1127.0 | Apache-2.0 | pi | no | 2 |
| @aws-sdk/token-providers | 3.1129.0 | Apache-2.0 | pi | no | 1 |
| @aws-sdk/types | 3.974.5 | Apache-2.0 | pi | no | 2 |
| @aws-sdk/xml-builder | 3.972.40 | Apache-2.0 | pi | no | 2 |
| @aws/lambda-invoke-store | 0.3.0 | Apache-2.0 | pi | no | 2 |
| @babel/runtime | 7.29.2 | MIT | pi | no | 1 |
| @babel/runtime | 7.29.7 | MIT | pi | no | 1 |
| @earendil-works/chord | 0.87.0 | MIT | pi | no | 2 |
| @earendil-works/pi-agent-core | 0.87.0 | MIT | pi | no | 2 |
| @earendil-works/pi-ai | 0.87.0 | MIT | pi | no | 2 |
| @earendil-works/pi-coding-agent | 0.87.0 | MIT | pi | no | 1 |
| @earendil-works/pi-telemetry | 0.87.0 | MIT | pi | no | 2 |
| @earendil-works/pi-tui | 0.87.0 | MIT | pi | no | 2 |
| @esbuild/aix-ppc64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/android-arm | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/android-arm64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/android-x64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/darwin-arm64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/darwin-x64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/freebsd-arm64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/freebsd-x64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/linux-arm | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/linux-arm64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/linux-ia32 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/linux-loong64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/linux-mips64el | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/linux-ppc64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/linux-riscv64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/linux-s390x | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/linux-x64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/netbsd-arm64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/netbsd-x64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/openbsd-arm64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/openbsd-x64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/openharmony-arm64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/sunos-x64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/win32-arm64 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/win32-ia32 | 0.28.2 | MIT | pi | yes | 2 |
| @esbuild/win32-x64 | 0.28.2 | MIT | pi | yes | 2 |
| @google/genai | 2.21.0 | Apache-2.0 | pi | no | 2 |
| @protobufjs/aspromise | 1.1.2 | BSD-3-Clause | pi | no | 2 |
| @protobufjs/base64 | 1.1.2 | BSD-3-Clause | pi | no | 2 |
| @protobufjs/codegen | 2.0.5 | BSD-3-Clause | pi | no | 2 |
| @protobufjs/eventemitter | 1.1.1 | BSD-3-Clause | pi | no | 2 |
| @protobufjs/fetch | 1.1.1 | BSD-3-Clause | pi | no | 2 |
| @protobufjs/float | 1.0.2 | BSD-3-Clause | pi | no | 2 |
| @protobufjs/path | 1.1.2 | BSD-3-Clause | pi | no | 2 |
| @protobufjs/pool | 1.1.0 | BSD-3-Clause | pi | no | 2 |
| @protobufjs/utf8 | 1.1.1 | BSD-3-Clause | pi | no | 1 |
| @protobufjs/utf8 | 1.1.2 | BSD-3-Clause | pi | no | 1 |
| @silvia-odwyer/photon-node | 0.3.4 | Apache-2.0 | pi | no | 1 |
| @smithy/core | 3.33.3 | Apache-2.0 | pi | no | 1 |
| @smithy/core | 3.34.1 | Apache-2.0 | pi | no | 1 |
| @smithy/credential-provider-imds | 4.5.2 | Apache-2.0 | pi | no | 2 |
| @smithy/fetch-http-handler | 5.8.0 | Apache-2.0 | pi | no | 2 |
| @smithy/node-http-handler | 4.12.1 | Apache-2.0 | pi | no | 2 |
| @smithy/signature-v4 | 5.7.3 | Apache-2.0 | pi | no | 2 |
| @smithy/types | 4.18.0 | Apache-2.0 | pi | no | 2 |
| @stablelib/base64 | 1.0.1 | MIT | pi | no | 2 |
| @types/node | 22.19.19 | MIT | pi | no | 1 |
| @types/node | 22.20.4 | MIT | pi | no | 1 |
| @types/retry | 0.12.0 | MIT | pi | no | 2 |
| @typesafe-ai/sdk | 0.6.0 | MIT | jev, pi | no | 1 |
| agent-base | 7.1.4 | MIT | pi | no | 2 |
| agent-base | 9.0.0 | MIT | pi | no | 3 |
| balanced-match | 4.0.4 | MIT | pi | no | 1 |
| base64-js | 1.5.1 | MIT | pi | no | 2 |
| bignumber.js | 9.3.1 | MIT | pi | no | 2 |
| bowser | 2.14.1 | MIT | pi | no | 2 |
| brace-expansion | 5.0.9 | MIT | pi | no | 1 |
| buffer-equal-constant-time | 1.0.1 | BSD-3-Clause | pi | no | 2 |
| chalk | 6.0.0 | MIT | pi | no | 1 |
| cross-spawn | 7.0.6 | MIT | pi | no | 1 |
| data-uri-to-buffer | 4.0.1 | MIT | pi | no | 2 |
| debug | 4.4.3 | MIT | pi | no | 2 |
| diff | 8.0.4 | BSD-3-Clause | pi | no | 2 |
| ecdsa-sig-formatter | 1.0.11 | Apache-2.0 | pi | no | 2 |
| esbuild | 0.28.2 | MIT | pi | no | 2 |
| extend | 3.0.2 | MIT | pi | no | 2 |
| fast-sha256 | 1.3.0 | Unlicense | pi | no | 2 |
| fetch-blob | 3.2.0 | MIT | pi | no | 2 |
| formdata-polyfill | 4.0.10 | MIT | pi | no | 2 |
| gaxios | 7.1.4 | Apache-2.0 | pi | no | 1 |
| gaxios | 7.3.1 | Apache-2.0 | pi | no | 1 |
| gcp-metadata | 8.1.2 | Apache-2.0 | pi | no | 2 |
| get-east-asian-width | 1.6.0 | MIT | pi | no | 2 |
| google-auth-library | 10.6.2 | Apache-2.0 | pi | no | 1 |
| google-auth-library | 10.9.1 | Apache-2.0 | pi | no | 1 |
| google-logging-utils | 1.1.3 | Apache-2.0 | pi | no | 2 |
| graceful-fs | 4.2.11 | ISC | pi | no | 1 |
| grok-mermaid | 0.2.3 | Apache-2.0 | pi | no | 1 |
| highlight.js | 10.7.3 | BSD-3-Clause | pi | no | 1 |
| hosted-git-info | 9.0.3 | ISC | pi | no | 1 |
| http-proxy-agent | 9.1.0 | MIT | pi | no | 2 |
| https-proxy-agent | 7.0.6 | MIT | pi | no | 2 |
| https-proxy-agent | 9.1.0 | MIT | pi | no | 2 |
| ignore | 7.0.8 | MIT | pi | no | 2 |
| isexe | 2.0.0 | ISC | pi | no | 1 |
| jiti | 2.7.0 | MIT | pi | no | 1 |
| json-bigint | 1.0.0 | MIT | pi | no | 2 |
| json-schema-to-ts | 3.1.1 | MIT | pi | no | 2 |
| jwa | 2.0.1 | MIT | pi | no | 2 |
| jws | 4.0.1 | MIT | pi | no | 2 |
| long | 5.3.2 | Apache-2.0 | pi | no | 2 |
| lru-cache | 11.4.0 | BlueOak-1.0.0 | pi | no | 1 |
| marked | 18.0.11 | MIT | pi | no | 2 |
| minimatch | 10.2.6 | BlueOak-1.0.0 | pi | no | 1 |
| ms | 2.1.3 | MIT | pi | no | 2 |
| node-domexception | 1.0.0 | MIT | pi | no | 2 |
| node-fetch | 3.3.2 | MIT | pi | no | 2 |
| openai | 6.40.0 | Apache-2.0 | pi | no | 2 |
| p-retry | 4.6.2 | MIT | pi | no | 2 |
| partial-json | 0.1.7 | MIT | pi | no | 2 |
| path-key | 3.1.1 | MIT | pi | no | 1 |
| proper-lockfile | 4.1.2 | MIT | pi | no | 1 |
| protobufjs | 7.6.6 | BSD-3-Clause | pi | no | 2 |
| proxy-agent-negotiate | 1.1.0 | MIT | pi | no | 2 |
| retry | 0.12.0 | MIT | pi | no | 1 |
| retry | 0.13.1 | MIT | pi | no | 2 |
| safe-buffer | 5.2.1 | MIT | pi | no | 2 |
| semver | 7.8.5 | ISC | pi | no | 1 |
| shebang-command | 2.0.0 | MIT | pi | no | 1 |
| shebang-regex | 3.0.0 | MIT | pi | no | 1 |
| signal-exit | 3.0.7 | ISC | pi | no | 1 |
| standardwebhooks | 1.1.1 | MIT | pi | no | 2 |
| ts-algebra | 2.0.0 | MIT | pi | no | 2 |
| tslib | 2.8.1 | 0BSD | pi | no | 2 |
| typebox | 1.3.27 | MIT | pi | no | 3 |
| typebox | 1.3.7 | MIT | dsl, jev, pi | no | 1 |
| undici-types | 6.21.0 | MIT | pi | no | 2 |
| undici | 8.10.2 | MIT | pi | no | 1 |
| web-streams-polyfill | 3.3.3 | MIT | pi | no | 2 |
| which | 2.0.2 | ISC | pi | no | 1 |
| ws | 8.21.0 | MIT | pi | no | 1 |
| ws | 8.21.3 | MIT | pi | no | 1 |
| yaml | 2.9.0 | ISC | pi | no | 2 |
| zod | 4.6.5 | MIT | pi | no | 1 |