Extracts core logic to @envguard/core and renames Node.js package

Moves shared business logic, including keychain, config, and manifest management, into a new internal `packages/core` monorepo package. This enhances reusability and establishes a clear separation of concerns.

The `@envguard/core` package is not published to npm but is bundled into the CLI and Node.js runtime packages, allowing them to be standalone.

Updates `@envguard/cli` and `@envguard/node` to depend on the new core package, streamlining their internal structure.

Renames the `packages/runner-node` directory and `@envguard/runner-node` package to `packages/node` for brevity and simplified naming.

Adjusts documentation and CI configuration to reflect these structural changes.

Author: amannirala13

.github/workflows/publish.yml

@@ -40,6 +40,8 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # Build all packages (core + cli + node)
+      # Note: @envguard/core is bundled into cli and node, not published separately
       - name: Build packages
         run: pnpm build
 

CLAUDE.md

@@ -10,19 +10,24 @@ EnvGuard is a **local-first secret management tool for developers** that stores
 
 ### Monorepo Structure
 
-This is a **pnpm workspace monorepo** with three main packages:
+This is a **pnpm workspace monorepo** with four main packages:
+
+- **`packages/core/`** - Core business logic (`@envguard/core`) **[INTERNAL - NOT PUBLISHED]**
+  - Shared keychain integration, secret storage, validation logic
+  - Bundled into CLI and Node runtime packages
+  - Not published to npm (private package)
 
 - **`packages/cli/`** - Main EnvGuard CLI application (`@envguard/cli`)
-  - Contains the command-line interface and core logic
-  - Binary entry point: `envguard` command
-  - Core modules for keychain integration, secret storage, validation, and Git integration
+  - Command-line interface for managing secrets
+  - Binary entry point: `envg` command
+  - Bundles `@envguard/core` for standalone use
 
 - **`packages/node/`** - Node.js runtime integration (`@envguard/node`)
   - Provides runtime secret injection for Node.js applications
-  - Used as `envguard-node app.js` or via Node.js preload module
+  - Bundles `@envguard/core` for standalone use
+  - Used via `import` or `--require` flag
 
-- **`packages/runner-python/`** - Python runtime integration (planned)
-  - Python package for secret injection in Python applications
+- **Future:** Python/Go/Rust runtime integrations (separate repositories)
 
 ### Core Concepts
 

config-tsconfig.json

@@ -6,7 +6,8 @@
     "**/*.config.mjs",
     "vitest.config.ts",
     "vitest.workspace.ts",
+    "packages/core/tsup.config.ts",
     "packages/cli/tsup.config.ts",
-    "packages/runner-node/tsup.config.ts"
+    "packages/node/tsup.config.ts"
   ]
 }

packages/cli/package.json

@@ -65,7 +65,7 @@
     "pack:check": "npm pack --dry-run"
   },
   "dependencies": {
-    "@napi-rs/keyring": "1.1.0",
+    "@envguard/core": "workspace:*",
     "chalk": "^5.3.0",
     "commander": "^11.1.0",
     "conf": "^12.0.0",

packages/cli/src/commands/check.action.ts

@@ -6,9 +6,9 @@
 
 import fs from 'fs/promises';
 import path from 'path';
-import { SystemKeychain } from '../core';
-import { ConfigManager } from '../core/config/config.manager';
-import { ManifestManager } from '../core/manifest/manifest.manager';
+import { SystemKeychain } from '@envguard/core';
+import { ConfigManager } from '@envguard/core';
+import { ManifestManager } from '@envguard/core';
 import { error, success, verbose, warn, info, LogTag } from '../utils/logger';
 
 interface SecurityIssue {

packages/cli/src/commands/copy.action.ts

@@ -5,9 +5,9 @@
  */
 
 import inquirer from 'inquirer';
-import { SystemKeychain } from '../core';
-import { ConfigManager } from '../core/config/config.manager';
-import { ManifestManager } from '../core/manifest/manifest.manager';
+import { SystemKeychain } from '@envguard/core';
+import { ConfigManager } from '@envguard/core';
+import { ManifestManager } from '@envguard/core';
 import { error, success, verbose, info, LogTag, warn } from '../utils/logger';
 
 export interface CopyOptions {

packages/cli/src/commands/del.action.ts

@@ -4,8 +4,8 @@
  * @description Implementation of the del command
  */
 
-import { SystemKeychain } from '../core';
-import { ConfigManager } from '../core/config/config.manager';
+import { SystemKeychain } from '@envguard/core';
+import { ConfigManager } from '@envguard/core';
 import { error, success, verbose, LogTag } from '../utils/logger';
 
 /**

packages/cli/src/commands/edit.action.ts

@@ -5,9 +5,9 @@
  */
 
 import inquirer from 'inquirer';
-import { SystemKeychain } from '../core';
-import { ConfigManager } from '../core/config/config.manager';
-import { ManifestManager } from '../core/manifest/manifest.manager';
+import { SystemKeychain } from '@envguard/core';
+import { ConfigManager } from '@envguard/core';
+import { ManifestManager } from '@envguard/core';
 import { error, success, verbose, info, LogTag, warn } from '../utils/logger';
 
 export interface EditOptions {

packages/cli/src/commands/export.action.ts

@@ -6,9 +6,9 @@
 
 import fs from 'fs/promises';
 import path from 'path';
-import { SystemKeychain } from '../core';
-import { ConfigManager } from '../core/config/config.manager';
-import { ManifestManager } from '../core/manifest/manifest.manager';
+import { SystemKeychain } from '@envguard/core';
+import { ConfigManager } from '@envguard/core';
+import { ManifestManager } from '@envguard/core';
 import { error, success, verbose, warn, info, LogTag } from '../utils/logger';
 
 export interface ExportOptions {

packages/cli/src/commands/get.action.ts

@@ -4,8 +4,8 @@
  * @description Implementation of the get command
  */
 
-import { SystemKeychain } from '../core';
-import { ConfigManager } from '../core/config/config.manager';
+import { SystemKeychain } from '@envguard/core';
+import { ConfigManager } from '@envguard/core';
 import { error, log, verbose, warn, LogTag } from '../utils/logger';
 
 /**