@vorim/sdk 1.0.2 → 2.0.0

package/dist/integrations/langchain.cjs

@@ -0,0 +1,197 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/integrations/langchain.ts
+var langchain_exports = {};
+__export(langchain_exports, {
+  VorimCallbackHandler: () => VorimCallbackHandler,
+  createVorimAgent: () => createVorimAgent,
+  wrapTool: () => wrapTool,
+  wrapTools: () => wrapTools
+});
+module.exports = __toCommonJS(langchain_exports);
+function wrapTool(tool, config) {
+  const { vorim, agentId, permissionMap = {}, defaultPermission = "agent:execute", asyncAudit = true } = config;
+  const originalCall = tool._call.bind(tool);
+  tool._call = async function vorimGuardedCall(arg, runManager, parentConfig) {
+    const scope = permissionMap[tool.name] ?? defaultPermission;
+    const { allowed, reason } = await vorim.check(agentId, scope);
+    if (!allowed) {
+      const event2 = {
+        agent_id: agentId,
+        event_type: "tool_call",
+        action: tool.name,
+        resource: truncate(JSON.stringify(arg), 500),
+        permission: scope,
+        result: "denied",
+        metadata: { reason, framework: "langchain" }
+      };
+      emitAudit(vorim, event2, asyncAudit);
+      throw new Error(`Vorim: permission denied for "${tool.name}" \u2014 scope "${scope}"${reason ? `: ${reason}` : ""}`);
+    }
+    const start = Date.now();
+    let result;
+    try {
+      result = await originalCall(arg, runManager, parentConfig);
+    } catch (err) {
+      const event2 = {
+        agent_id: agentId,
+        event_type: "tool_call",
+        action: tool.name,
+        resource: truncate(JSON.stringify(arg), 500),
+        permission: scope,
+        result: "error",
+        latency_ms: Date.now() - start,
+        error_code: err instanceof Error ? err.name : "UNKNOWN",
+        metadata: { error: err instanceof Error ? err.message : String(err), framework: "langchain" }
+      };
+      emitAudit(vorim, event2, asyncAudit);
+      throw err;
+    }
+    const event = {
+      agent_id: agentId,
+      event_type: "tool_call",
+      action: tool.name,
+      resource: truncate(JSON.stringify(arg), 500),
+      permission: scope,
+      result: "success",
+      latency_ms: Date.now() - start,
+      metadata: { framework: "langchain" }
+    };
+    emitAudit(vorim, event, asyncAudit);
+    return result;
+  };
+  return tool;
+}
+function wrapTools(tools, config) {
+  return tools.map((t) => wrapTool(t, config));
+}
+var VorimCallbackHandler = class _VorimCallbackHandler {
+  name = "VorimCallbackHandler";
+  vorim;
+  agentId;
+  runMap = /* @__PURE__ */ new Map();
+  // Flags to satisfy BaseCallbackHandler interface
+  ignoreLLM = true;
+  ignoreChain = true;
+  ignoreAgent = true;
+  ignoreRetriever = true;
+  ignoreCustomEvent = true;
+  lc_serializable = false;
+  get lc_id() {
+    return ["vorim", "callbacks", "VorimCallbackHandler"];
+  }
+  get lc_namespace() {
+    return ["vorim", "callbacks"];
+  }
+  constructor(vorim, agentId) {
+    this.vorim = vorim;
+    this.agentId = agentId;
+  }
+  async handleToolStart(tool, input, runId, _parentRunId, _tags, _metadata, runName) {
+    const toolName = runName ?? tool.id?.[tool.id.length - 1] ?? "unknown";
+    this.runMap.set(runId, { tool: toolName, input, startTime: Date.now() });
+  }
+  async handleToolEnd(_output, runId) {
+    const run = this.runMap.get(runId);
+    if (!run) return;
+    this.runMap.delete(runId);
+    await this.vorim.emit({
+      agent_id: this.agentId,
+      event_type: "tool_call",
+      action: run.tool,
+      resource: truncate(run.input, 500),
+      result: "success",
+      latency_ms: Date.now() - run.startTime,
+      metadata: { framework: "langchain" }
+    }).catch(() => {
+    });
+  }
+  async handleToolError(err, runId) {
+    const run = this.runMap.get(runId);
+    if (!run) return;
+    this.runMap.delete(runId);
+    await this.vorim.emit({
+      agent_id: this.agentId,
+      event_type: "tool_call",
+      action: run.tool,
+      resource: truncate(run.input, 500),
+      result: "error",
+      latency_ms: Date.now() - run.startTime,
+      error_code: err.name,
+      metadata: { error: err.message, framework: "langchain" }
+    }).catch(() => {
+    });
+  }
+  // Required by BaseCallbackHandler — no-op for events we don't need
+  copy() {
+    return new _VorimCallbackHandler(this.vorim, this.agentId);
+  }
+  toJSON() {
+    return { lc: 1, type: "not_implemented", id: this.lc_id };
+  }
+  toJSONNotImplemented() {
+    return this.toJSON();
+  }
+};
+async function createVorimAgent(config) {
+  const { vorim, name, capabilities, scopes, description, tools: rawTools, permissionMap, defaultPermission, asyncAudit } = config;
+  const registration = await vorim.register({
+    name,
+    description,
+    capabilities,
+    scopes
+  });
+  const agentId = registration.agent.agent_id;
+  const agentConfig = { vorim, agentId, permissionMap, defaultPermission, asyncAudit };
+  const tools = wrapTools(rawTools, agentConfig);
+  const callbackHandler = new VorimCallbackHandler(vorim, agentId);
+  return {
+    /** The Vorim agent_id. */
+    agentId,
+    /** The full agent registration result. */
+    registration,
+    /** Tools wrapped with Vorim permission checks + audit. */
+    tools,
+    /** Callback handler for audit trail observability. */
+    callbackHandler,
+    /** The private key (store securely — shown once). */
+    privateKey: registration.private_key
+  };
+}
+function truncate(str, max) {
+  return str.length > max ? str.slice(0, max) + "\u2026" : str;
+}
+function emitAudit(vorim, event, async) {
+  if (async) {
+    vorim.emit(event).catch(() => {
+    });
+  } else {
+    vorim.emit(event).catch(() => {
+    });
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  VorimCallbackHandler,
+  createVorimAgent,
+  wrapTool,
+  wrapTools
+});
+//# sourceMappingURL=langchain.cjs.map

package/dist/integrations/langchain.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/integrations/langchain.ts"],"sourcesContent":["// ============================================================================\n// VORIM SDK — LangChain / LangGraph JS Integration\n// Provides tool wrapping with permission checks + audit trail,\n// a callback handler for observability, and a factory for creating\n// Vorim-secured LangGraph ReAct agents.\n//\n// Peer dependencies:\n//   @langchain/core >=0.3.0\n//   @langchain/langgraph >=0.2.0\n// ============================================================================\n\nimport type { VorimSDK } from '../index.js';\nimport type { PermissionScope, AuditEventInput } from '../types.js';\n\n// ─── Re-declared LangChain types (peer dependency — not bundled) ──────────\n// These mirror the actual types from @langchain/core so consumers don't\n// need to import them separately for basic usage.\n\n/** Minimal subset of @langchain/core Serialized */\ninterface Serialized {\n  lc: number;\n  type: string;\n  id: string[];\n  kwargs?: Record<string, unknown>;\n}\n\n// ─── Configuration ────────────────────────────────────────────────────────\n\nexport interface VorimLangChainConfig {\n  /** Vorim SDK instance. */\n  vorim: VorimSDK;\n  /** The Vorim agent_id to associate with this LangChain agent. */\n  agentId: string;\n  /** Map tool names → Vorim permission scopes. Unmapped tools default to 'agent:execute'. */\n  permissionMap?: Record<string, PermissionScope>;\n  /** Default permission scope for tools not in permissionMap. @default 'agent:execute' */\n  defaultPermission?: PermissionScope;\n  /** Whether to emit audit events asynchronously (fire-and-forget). @default true */\n  asyncAudit?: boolean;\n}\n\n// ─── Tool Wrapper ─────────────────────────────────────────────────────────\n\n/**\n * Wraps a LangChain `StructuredTool` (or `DynamicStructuredTool`) with\n * Vorim permission checks before execution and audit event emission after.\n *\n * Works with any tool that has `name`, `description`, `schema`, and `_call`.\n *\n * @example\n * ```ts\n * import { DynamicStructuredTool } from \"@langchain/core/tools\";\n * import { wrapTool } from \"@vorim/sdk/integrations/langchain\";\n *\n * const guarded = wrapTool(myTool, {\n *   vorim, agentId: \"agid_acme_a1b2c3d4\",\n *   permissionMap: { search_docs: \"agent:read\" },\n * });\n * ```\n */\nexport function wrapTool<T extends LangChainTool>(\n  tool: T,\n  config: VorimLangChainConfig,\n): T {\n  const { vorim, agentId, permissionMap = {}, defaultPermission = 'agent:execute', asyncAudit = true } = config;\n\n  const originalCall = tool._call.bind(tool);\n\n  // Override _call to inject permission check + audit\n  (tool as any)._call = async function vorimGuardedCall(\n    arg: unknown,\n    runManager?: unknown,\n    parentConfig?: unknown,\n  ): Promise<unknown> {\n    const scope = permissionMap[tool.name] ?? defaultPermission;\n\n    // 1. Permission check\n    const { allowed, reason } = await vorim.check(agentId, scope);\n\n    if (!allowed) {\n      const event: AuditEventInput = {\n        agent_id: agentId,\n        event_type: 'tool_call',\n        action: tool.name,\n        resource: truncate(JSON.stringify(arg), 500),\n        permission: scope,\n        result: 'denied',\n        metadata: { reason, framework: 'langchain' },\n      };\n      emitAudit(vorim, event, asyncAudit);\n      throw new Error(`Vorim: permission denied for \"${tool.name}\" — scope \"${scope}\"${reason ? `: ${reason}` : ''}`);\n    }\n\n    // 2. Execute the original tool\n    const start = Date.now();\n    let result: unknown;\n    try {\n      result = await originalCall(arg, runManager, parentConfig);\n    } catch (err) {\n      const event: AuditEventInput = {\n        agent_id: agentId,\n        event_type: 'tool_call',\n        action: tool.name,\n        resource: truncate(JSON.stringify(arg), 500),\n        permission: scope,\n        result: 'error',\n        latency_ms: Date.now() - start,\n        error_code: err instanceof Error ? err.name : 'UNKNOWN',\n        metadata: { error: err instanceof Error ? err.message : String(err), framework: 'langchain' },\n      };\n      emitAudit(vorim, event, asyncAudit);\n      throw err;\n    }\n\n    // 3. Audit success\n    const event: AuditEventInput = {\n      agent_id: agentId,\n      event_type: 'tool_call',\n      action: tool.name,\n      resource: truncate(JSON.stringify(arg), 500),\n      permission: scope,\n      result: 'success',\n      latency_ms: Date.now() - start,\n      metadata: { framework: 'langchain' },\n    };\n    emitAudit(vorim, event, asyncAudit);\n\n    return result;\n  };\n\n  return tool;\n}\n\n/**\n * Wraps an array of LangChain tools with Vorim permission + audit.\n */\nexport function wrapTools<T extends LangChainTool>(\n  tools: T[],\n  config: VorimLangChainConfig,\n): T[] {\n  return tools.map(t => wrapTool(t, config));\n}\n\n// ─── Callback Handler ─────────────────────────────────────────────────────\n\n/**\n * LangChain callback handler that emits Vorim audit events for every\n * tool invocation. This is a **non-intrusive** observability layer —\n * it does not block or modify tool execution.\n *\n * Attach it to any LangChain invoke/stream call:\n * ```ts\n * const handler = new VorimCallbackHandler(vorim, \"agid_acme_a1b2c3d4\");\n * await agent.invoke({ messages }, { callbacks: [handler] });\n * ```\n */\nexport class VorimCallbackHandler {\n  name = 'VorimCallbackHandler';\n  private vorim: VorimSDK;\n  private agentId: string;\n  private runMap = new Map<string, { tool: string; input: string; startTime: number }>();\n\n  // Flags to satisfy BaseCallbackHandler interface\n  ignoreLLM = true;\n  ignoreChain = true;\n  ignoreAgent = true;\n  ignoreRetriever = true;\n  ignoreCustomEvent = true;\n  lc_serializable = false;\n\n  get lc_id(): string[] { return ['vorim', 'callbacks', 'VorimCallbackHandler']; }\n  get lc_namespace(): string[] { return ['vorim', 'callbacks']; }\n\n  constructor(vorim: VorimSDK, agentId: string) {\n    this.vorim = vorim;\n    this.agentId = agentId;\n  }\n\n  async handleToolStart(\n    tool: Serialized,\n    input: string,\n    runId: string,\n    _parentRunId?: string,\n    _tags?: string[],\n    _metadata?: Record<string, unknown>,\n    runName?: string,\n  ): Promise<void> {\n    const toolName = runName ?? tool.id?.[tool.id.length - 1] ?? 'unknown';\n    this.runMap.set(runId, { tool: toolName, input, startTime: Date.now() });\n  }\n\n  async handleToolEnd(\n    _output: unknown,\n    runId: string,\n  ): Promise<void> {\n    const run = this.runMap.get(runId);\n    if (!run) return;\n    this.runMap.delete(runId);\n\n    await this.vorim.emit({\n      agent_id: this.agentId,\n      event_type: 'tool_call',\n      action: run.tool,\n      resource: truncate(run.input, 500),\n      result: 'success',\n      latency_ms: Date.now() - run.startTime,\n      metadata: { framework: 'langchain' },\n    }).catch(() => {}); // never throw from callback\n  }\n\n  async handleToolError(\n    err: Error,\n    runId: string,\n  ): Promise<void> {\n    const run = this.runMap.get(runId);\n    if (!run) return;\n    this.runMap.delete(runId);\n\n    await this.vorim.emit({\n      agent_id: this.agentId,\n      event_type: 'tool_call',\n      action: run.tool,\n      resource: truncate(run.input, 500),\n      result: 'error',\n      latency_ms: Date.now() - run.startTime,\n      error_code: err.name,\n      metadata: { error: err.message, framework: 'langchain' },\n    }).catch(() => {});\n  }\n\n  // Required by BaseCallbackHandler — no-op for events we don't need\n  copy(): VorimCallbackHandler {\n    return new VorimCallbackHandler(this.vorim, this.agentId);\n  }\n\n  toJSON() {\n    return { lc: 1, type: 'not_implemented', id: this.lc_id };\n  }\n\n  toJSONNotImplemented() {\n    return this.toJSON();\n  }\n}\n\n// ─── Agent Factory ────────────────────────────────────────────────────────\n\nexport interface CreateVorimAgentConfig extends VorimLangChainConfig {\n  /** Display name for the agent when registering with Vorim. */\n  name: string;\n  /** Agent capabilities (e.g. [\"web_search\", \"code_execution\"]). */\n  capabilities: string[];\n  /** Initial permission scopes to grant. */\n  scopes: PermissionScope[];\n  /** Optional description. */\n  description?: string;\n}\n\n/**\n * Registers a new agent with Vorim and returns wrapped tools + callback handler\n * ready to use with `createReactAgent` or any LangChain agent.\n *\n * @example\n * ```ts\n * import { createReactAgent } from \"@langchain/langgraph/prebuilt\";\n * import { ChatOpenAI } from \"@langchain/openai\";\n * import { createVorimAgent } from \"@vorim/sdk/integrations/langchain\";\n *\n * const { agentId, tools, callbackHandler } = await createVorimAgent({\n *   vorim,\n *   name: \"research-agent\",\n *   capabilities: [\"web_search\"],\n *   scopes: [\"agent:read\", \"agent:execute\"],\n *   tools: [searchTool, analysisTool],\n * });\n *\n * const agent = createReactAgent({\n *   llm: new ChatOpenAI({ model: \"gpt-4o\" }),\n *   tools,\n * });\n *\n * const result = await agent.invoke(\n *   { messages: [{ role: \"user\", content: \"Research AI trends\" }] },\n *   { callbacks: [callbackHandler] },\n * );\n * ```\n */\nexport async function createVorimAgent<T extends LangChainTool>(config: CreateVorimAgentConfig & { tools: T[] }) {\n  const { vorim, name, capabilities, scopes, description, tools: rawTools, permissionMap, defaultPermission, asyncAudit } = config;\n\n  // Register agent with Vorim\n  const registration = await vorim.register({\n    name,\n    description,\n    capabilities,\n    scopes,\n  });\n\n  const agentId = registration.agent.agent_id;\n  const agentConfig: VorimLangChainConfig = { vorim, agentId, permissionMap, defaultPermission, asyncAudit };\n\n  // Wrap tools with permission checks\n  const tools = wrapTools(rawTools, agentConfig);\n\n  // Create callback handler for audit trail\n  const callbackHandler = new VorimCallbackHandler(vorim, agentId);\n\n  return {\n    /** The Vorim agent_id. */\n    agentId,\n    /** The full agent registration result. */\n    registration,\n    /** Tools wrapped with Vorim permission checks + audit. */\n    tools,\n    /** Callback handler for audit trail observability. */\n    callbackHandler,\n    /** The private key (store securely — shown once). */\n    privateKey: registration.private_key,\n  };\n}\n\n// ─── Internal helpers ─────────────────────────────────────────────────────\n\n/** Minimal interface matching any LangChain StructuredTool / DynamicStructuredTool. */\ninterface LangChainTool {\n  name: string;\n  description: string;\n  schema: unknown;\n  _call(arg: any, runManager?: any, parentConfig?: any): Promise<any>;\n}\n\nfunction truncate(str: string, max: number): string {\n  return str.length > max ? str.slice(0, max) + '…' : str;\n}\n\nfunction emitAudit(vorim: VorimSDK, event: AuditEventInput, async: boolean): void {\n  if (async) {\n    vorim.emit(event).catch(() => {});\n  } else {\n    vorim.emit(event).catch(() => {});\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4DO,SAAS,SACd,MACA,QACG;AACH,QAAM,EAAE,OAAO,SAAS,gBAAgB,CAAC,GAAG,oBAAoB,iBAAiB,aAAa,KAAK,IAAI;AAEvG,QAAM,eAAe,KAAK,MAAM,KAAK,IAAI;AAGzC,EAAC,KAAa,QAAQ,eAAe,iBACnC,KACA,YACA,cACkB;AAClB,UAAM,QAAQ,cAAc,KAAK,IAAI,KAAK;AAG1C,UAAM,EAAE,SAAS,OAAO,IAAI,MAAM,MAAM,MAAM,SAAS,KAAK;AAE5D,QAAI,CAAC,SAAS;AACZ,YAAMA,SAAyB;AAAA,QAC7B,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,UAAU,SAAS,KAAK,UAAU,GAAG,GAAG,GAAG;AAAA,QAC3C,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,UAAU,EAAE,QAAQ,WAAW,YAAY;AAAA,MAC7C;AACA,gBAAU,OAAOA,QAAO,UAAU;AAClC,YAAM,IAAI,MAAM,iCAAiC,KAAK,IAAI,mBAAc,KAAK,IAAI,SAAS,KAAK,MAAM,KAAK,EAAE,EAAE;AAAA,IAChH;AAGA,UAAM,QAAQ,KAAK,IAAI;AACvB,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,aAAa,KAAK,YAAY,YAAY;AAAA,IAC3D,SAAS,KAAK;AACZ,YAAMA,SAAyB;AAAA,QAC7B,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,QAAQ,KAAK;AAAA,QACb,UAAU,SAAS,KAAK,UAAU,GAAG,GAAG,GAAG;AAAA,QAC3C,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,YAAY,KAAK,IAAI,IAAI;AAAA,QACzB,YAAY,eAAe,QAAQ,IAAI,OAAO;AAAA,QAC9C,UAAU,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,WAAW,YAAY;AAAA,MAC9F;AACA,gBAAU,OAAOA,QAAO,UAAU;AAClC,YAAM;AAAA,IACR;AAGA,UAAM,QAAyB;AAAA,MAC7B,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,QAAQ,KAAK;AAAA,MACb,UAAU,SAAS,KAAK,UAAU,GAAG,GAAG,GAAG;AAAA,MAC3C,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,YAAY,KAAK,IAAI,IAAI;AAAA,MACzB,UAAU,EAAE,WAAW,YAAY;AAAA,IACrC;AACA,cAAU,OAAO,OAAO,UAAU;AAElC,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAKO,SAAS,UACd,OACA,QACK;AACL,SAAO,MAAM,IAAI,OAAK,SAAS,GAAG,MAAM,CAAC;AAC3C;AAeO,IAAM,uBAAN,MAAM,sBAAqB;AAAA,EAChC,OAAO;AAAA,EACC;AAAA,EACA;AAAA,EACA,SAAS,oBAAI,IAAgE;AAAA;AAAA,EAGrF,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,kBAAkB;AAAA,EAElB,IAAI,QAAkB;AAAE,WAAO,CAAC,SAAS,aAAa,sBAAsB;AAAA,EAAG;AAAA,EAC/E,IAAI,eAAyB;AAAE,WAAO,CAAC,SAAS,WAAW;AAAA,EAAG;AAAA,EAE9D,YAAY,OAAiB,SAAiB;AAC5C,SAAK,QAAQ;AACb,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,MAAM,gBACJ,MACA,OACA,OACA,cACA,OACA,WACA,SACe;AACf,UAAM,WAAW,WAAW,KAAK,KAAK,KAAK,GAAG,SAAS,CAAC,KAAK;AAC7D,SAAK,OAAO,IAAI,OAAO,EAAE,MAAM,UAAU,OAAO,WAAW,KAAK,IAAI,EAAE,CAAC;AAAA,EACzE;AAAA,EAEA,MAAM,cACJ,SACA,OACe;AACf,UAAM,MAAM,KAAK,OAAO,IAAI,KAAK;AACjC,QAAI,CAAC,IAAK;AACV,SAAK,OAAO,OAAO,KAAK;AAExB,UAAM,KAAK,MAAM,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,UAAU,SAAS,IAAI,OAAO,GAAG;AAAA,MACjC,QAAQ;AAAA,MACR,YAAY,KAAK,IAAI,IAAI,IAAI;AAAA,MAC7B,UAAU,EAAE,WAAW,YAAY;AAAA,IACrC,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACnB;AAAA,EAEA,MAAM,gBACJ,KACA,OACe;AACf,UAAM,MAAM,KAAK,OAAO,IAAI,KAAK;AACjC,QAAI,CAAC,IAAK;AACV,SAAK,OAAO,OAAO,KAAK;AAExB,UAAM,KAAK,MAAM,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,YAAY;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,UAAU,SAAS,IAAI,OAAO,GAAG;AAAA,MACjC,QAAQ;AAAA,MACR,YAAY,KAAK,IAAI,IAAI,IAAI;AAAA,MAC7B,YAAY,IAAI;AAAA,MAChB,UAAU,EAAE,OAAO,IAAI,SAAS,WAAW,YAAY;AAAA,IACzD,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACnB;AAAA;AAAA,EAGA,OAA6B;AAC3B,WAAO,IAAI,sBAAqB,KAAK,OAAO,KAAK,OAAO;AAAA,EAC1D;AAAA,EAEA,SAAS;AACP,WAAO,EAAE,IAAI,GAAG,MAAM,mBAAmB,IAAI,KAAK,MAAM;AAAA,EAC1D;AAAA,EAEA,uBAAuB;AACrB,WAAO,KAAK,OAAO;AAAA,EACrB;AACF;AA4CA,eAAsB,iBAA0C,QAAiD;AAC/G,QAAM,EAAE,OAAO,MAAM,cAAc,QAAQ,aAAa,OAAO,UAAU,eAAe,mBAAmB,WAAW,IAAI;AAG1H,QAAM,eAAe,MAAM,MAAM,SAAS;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,aAAa,MAAM;AACnC,QAAM,cAAoC,EAAE,OAAO,SAAS,eAAe,mBAAmB,WAAW;AAGzG,QAAM,QAAQ,UAAU,UAAU,WAAW;AAG7C,QAAM,kBAAkB,IAAI,qBAAqB,OAAO,OAAO;AAE/D,SAAO;AAAA;AAAA,IAEL;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA,YAAY,aAAa;AAAA,EAC3B;AACF;AAYA,SAAS,SAAS,KAAa,KAAqB;AAClD,SAAO,IAAI,SAAS,MAAM,IAAI,MAAM,GAAG,GAAG,IAAI,WAAM;AACtD;AAEA,SAAS,UAAU,OAAiB,OAAwB,OAAsB;AAChF,MAAI,OAAO;AACT,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC,OAAO;AACL,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC;AACF;","names":["event"]}

package/dist/integrations/langchain.d.cts

@@ -0,0 +1,145 @@
+import { VorimSDK, PermissionScope, AgentRegistrationResult } from '../index.cjs';
+
+/** Minimal subset of @langchain/core Serialized */
+interface Serialized {
+    lc: number;
+    type: string;
+    id: string[];
+    kwargs?: Record<string, unknown>;
+}
+interface VorimLangChainConfig {
+    /** Vorim SDK instance. */
+    vorim: VorimSDK;
+    /** The Vorim agent_id to associate with this LangChain agent. */
+    agentId: string;
+    /** Map tool names → Vorim permission scopes. Unmapped tools default to 'agent:execute'. */
+    permissionMap?: Record<string, PermissionScope>;
+    /** Default permission scope for tools not in permissionMap. @default 'agent:execute' */
+    defaultPermission?: PermissionScope;
+    /** Whether to emit audit events asynchronously (fire-and-forget). @default true */
+    asyncAudit?: boolean;
+}
+/**
+ * Wraps a LangChain `StructuredTool` (or `DynamicStructuredTool`) with
+ * Vorim permission checks before execution and audit event emission after.
+ *
+ * Works with any tool that has `name`, `description`, `schema`, and `_call`.
+ *
+ * @example
+ * ```ts
+ * import { DynamicStructuredTool } from "@langchain/core/tools";
+ * import { wrapTool } from "@vorim/sdk/integrations/langchain";
+ *
+ * const guarded = wrapTool(myTool, {
+ *   vorim, agentId: "agid_acme_a1b2c3d4",
+ *   permissionMap: { search_docs: "agent:read" },
+ * });
+ * ```
+ */
+declare function wrapTool<T extends LangChainTool>(tool: T, config: VorimLangChainConfig): T;
+/**
+ * Wraps an array of LangChain tools with Vorim permission + audit.
+ */
+declare function wrapTools<T extends LangChainTool>(tools: T[], config: VorimLangChainConfig): T[];
+/**
+ * LangChain callback handler that emits Vorim audit events for every
+ * tool invocation. This is a **non-intrusive** observability layer —
+ * it does not block or modify tool execution.
+ *
+ * Attach it to any LangChain invoke/stream call:
+ * ```ts
+ * const handler = new VorimCallbackHandler(vorim, "agid_acme_a1b2c3d4");
+ * await agent.invoke({ messages }, { callbacks: [handler] });
+ * ```
+ */
+declare class VorimCallbackHandler {
+    name: string;
+    private vorim;
+    private agentId;
+    private runMap;
+    ignoreLLM: boolean;
+    ignoreChain: boolean;
+    ignoreAgent: boolean;
+    ignoreRetriever: boolean;
+    ignoreCustomEvent: boolean;
+    lc_serializable: boolean;
+    get lc_id(): string[];
+    get lc_namespace(): string[];
+    constructor(vorim: VorimSDK, agentId: string);
+    handleToolStart(tool: Serialized, input: string, runId: string, _parentRunId?: string, _tags?: string[], _metadata?: Record<string, unknown>, runName?: string): Promise<void>;
+    handleToolEnd(_output: unknown, runId: string): Promise<void>;
+    handleToolError(err: Error, runId: string): Promise<void>;
+    copy(): VorimCallbackHandler;
+    toJSON(): {
+        lc: number;
+        type: string;
+        id: string[];
+    };
+    toJSONNotImplemented(): {
+        lc: number;
+        type: string;
+        id: string[];
+    };
+}
+interface CreateVorimAgentConfig extends VorimLangChainConfig {
+    /** Display name for the agent when registering with Vorim. */
+    name: string;
+    /** Agent capabilities (e.g. ["web_search", "code_execution"]). */
+    capabilities: string[];
+    /** Initial permission scopes to grant. */
+    scopes: PermissionScope[];
+    /** Optional description. */
+    description?: string;
+}
+/**
+ * Registers a new agent with Vorim and returns wrapped tools + callback handler
+ * ready to use with `createReactAgent` or any LangChain agent.
+ *
+ * @example
+ * ```ts
+ * import { createReactAgent } from "@langchain/langgraph/prebuilt";
+ * import { ChatOpenAI } from "@langchain/openai";
+ * import { createVorimAgent } from "@vorim/sdk/integrations/langchain";
+ *
+ * const { agentId, tools, callbackHandler } = await createVorimAgent({
+ *   vorim,
+ *   name: "research-agent",
+ *   capabilities: ["web_search"],
+ *   scopes: ["agent:read", "agent:execute"],
+ *   tools: [searchTool, analysisTool],
+ * });
+ *
+ * const agent = createReactAgent({
+ *   llm: new ChatOpenAI({ model: "gpt-4o" }),
+ *   tools,
+ * });
+ *
+ * const result = await agent.invoke(
+ *   { messages: [{ role: "user", content: "Research AI trends" }] },
+ *   { callbacks: [callbackHandler] },
+ * );
+ * ```
+ */
+declare function createVorimAgent<T extends LangChainTool>(config: CreateVorimAgentConfig & {
+    tools: T[];
+}): Promise<{
+    /** The Vorim agent_id. */
+    agentId: string;
+    /** The full agent registration result. */
+    registration: AgentRegistrationResult;
+    /** Tools wrapped with Vorim permission checks + audit. */
+    tools: T[];
+    /** Callback handler for audit trail observability. */
+    callbackHandler: VorimCallbackHandler;
+    /** The private key (store securely — shown once). */
+    privateKey: string;
+}>;
+/** Minimal interface matching any LangChain StructuredTool / DynamicStructuredTool. */
+interface LangChainTool {
+    name: string;
+    description: string;
+    schema: unknown;
+    _call(arg: any, runManager?: any, parentConfig?: any): Promise<any>;
+}
+
+export { type CreateVorimAgentConfig, VorimCallbackHandler, type VorimLangChainConfig, createVorimAgent, wrapTool, wrapTools };

package/dist/integrations/langchain.d.ts

@@ -0,0 +1,145 @@
+import { VorimSDK, PermissionScope, AgentRegistrationResult } from '../index.js';
+
+/** Minimal subset of @langchain/core Serialized */
+interface Serialized {
+    lc: number;
+    type: string;
+    id: string[];
+    kwargs?: Record<string, unknown>;
+}
+interface VorimLangChainConfig {
+    /** Vorim SDK instance. */
+    vorim: VorimSDK;
+    /** The Vorim agent_id to associate with this LangChain agent. */
+    agentId: string;
+    /** Map tool names → Vorim permission scopes. Unmapped tools default to 'agent:execute'. */
+    permissionMap?: Record<string, PermissionScope>;
+    /** Default permission scope for tools not in permissionMap. @default 'agent:execute' */
+    defaultPermission?: PermissionScope;
+    /** Whether to emit audit events asynchronously (fire-and-forget). @default true */
+    asyncAudit?: boolean;
+}
+/**
+ * Wraps a LangChain `StructuredTool` (or `DynamicStructuredTool`) with
+ * Vorim permission checks before execution and audit event emission after.
+ *
+ * Works with any tool that has `name`, `description`, `schema`, and `_call`.
+ *
+ * @example
+ * ```ts
+ * import { DynamicStructuredTool } from "@langchain/core/tools";
+ * import { wrapTool } from "@vorim/sdk/integrations/langchain";
+ *
+ * const guarded = wrapTool(myTool, {
+ *   vorim, agentId: "agid_acme_a1b2c3d4",
+ *   permissionMap: { search_docs: "agent:read" },
+ * });
+ * ```
+ */
+declare function wrapTool<T extends LangChainTool>(tool: T, config: VorimLangChainConfig): T;
+/**
+ * Wraps an array of LangChain tools with Vorim permission + audit.
+ */
+declare function wrapTools<T extends LangChainTool>(tools: T[], config: VorimLangChainConfig): T[];
+/**
+ * LangChain callback handler that emits Vorim audit events for every
+ * tool invocation. This is a **non-intrusive** observability layer —
+ * it does not block or modify tool execution.
+ *
+ * Attach it to any LangChain invoke/stream call:
+ * ```ts
+ * const handler = new VorimCallbackHandler(vorim, "agid_acme_a1b2c3d4");
+ * await agent.invoke({ messages }, { callbacks: [handler] });
+ * ```
+ */
+declare class VorimCallbackHandler {
+    name: string;
+    private vorim;
+    private agentId;
+    private runMap;
+    ignoreLLM: boolean;
+    ignoreChain: boolean;
+    ignoreAgent: boolean;
+    ignoreRetriever: boolean;
+    ignoreCustomEvent: boolean;
+    lc_serializable: boolean;
+    get lc_id(): string[];
+    get lc_namespace(): string[];
+    constructor(vorim: VorimSDK, agentId: string);
+    handleToolStart(tool: Serialized, input: string, runId: string, _parentRunId?: string, _tags?: string[], _metadata?: Record<string, unknown>, runName?: string): Promise<void>;
+    handleToolEnd(_output: unknown, runId: string): Promise<void>;
+    handleToolError(err: Error, runId: string): Promise<void>;
+    copy(): VorimCallbackHandler;
+    toJSON(): {
+        lc: number;
+        type: string;
+        id: string[];
+    };
+    toJSONNotImplemented(): {
+        lc: number;
+        type: string;
+        id: string[];
+    };
+}
+interface CreateVorimAgentConfig extends VorimLangChainConfig {
+    /** Display name for the agent when registering with Vorim. */
+    name: string;
+    /** Agent capabilities (e.g. ["web_search", "code_execution"]). */
+    capabilities: string[];
+    /** Initial permission scopes to grant. */
+    scopes: PermissionScope[];
+    /** Optional description. */
+    description?: string;
+}
+/**
+ * Registers a new agent with Vorim and returns wrapped tools + callback handler
+ * ready to use with `createReactAgent` or any LangChain agent.
+ *
+ * @example
+ * ```ts
+ * import { createReactAgent } from "@langchain/langgraph/prebuilt";
+ * import { ChatOpenAI } from "@langchain/openai";
+ * import { createVorimAgent } from "@vorim/sdk/integrations/langchain";
+ *
+ * const { agentId, tools, callbackHandler } = await createVorimAgent({
+ *   vorim,
+ *   name: "research-agent",
+ *   capabilities: ["web_search"],
+ *   scopes: ["agent:read", "agent:execute"],
+ *   tools: [searchTool, analysisTool],
+ * });
+ *
+ * const agent = createReactAgent({
+ *   llm: new ChatOpenAI({ model: "gpt-4o" }),
+ *   tools,
+ * });
+ *
+ * const result = await agent.invoke(
+ *   { messages: [{ role: "user", content: "Research AI trends" }] },
+ *   { callbacks: [callbackHandler] },
+ * );
+ * ```
+ */
+declare function createVorimAgent<T extends LangChainTool>(config: CreateVorimAgentConfig & {
+    tools: T[];
+}): Promise<{
+    /** The Vorim agent_id. */
+    agentId: string;
+    /** The full agent registration result. */
+    registration: AgentRegistrationResult;
+    /** Tools wrapped with Vorim permission checks + audit. */
+    tools: T[];
+    /** Callback handler for audit trail observability. */
+    callbackHandler: VorimCallbackHandler;
+    /** The private key (store securely — shown once). */
+    privateKey: string;
+}>;
+/** Minimal interface matching any LangChain StructuredTool / DynamicStructuredTool. */
+interface LangChainTool {
+    name: string;
+    description: string;
+    schema: unknown;
+    _call(arg: any, runManager?: any, parentConfig?: any): Promise<any>;
+}
+
+export { type CreateVorimAgentConfig, VorimCallbackHandler, type VorimLangChainConfig, createVorimAgent, wrapTool, wrapTools };

package/dist/integrations/langchain.js

@@ -0,0 +1,169 @@
+// src/integrations/langchain.ts
+function wrapTool(tool, config) {
+  const { vorim, agentId, permissionMap = {}, defaultPermission = "agent:execute", asyncAudit = true } = config;
+  const originalCall = tool._call.bind(tool);
+  tool._call = async function vorimGuardedCall(arg, runManager, parentConfig) {
+    const scope = permissionMap[tool.name] ?? defaultPermission;
+    const { allowed, reason } = await vorim.check(agentId, scope);
+    if (!allowed) {
+      const event2 = {
+        agent_id: agentId,
+        event_type: "tool_call",
+        action: tool.name,
+        resource: truncate(JSON.stringify(arg), 500),
+        permission: scope,
+        result: "denied",
+        metadata: { reason, framework: "langchain" }
+      };
+      emitAudit(vorim, event2, asyncAudit);
+      throw new Error(`Vorim: permission denied for "${tool.name}" \u2014 scope "${scope}"${reason ? `: ${reason}` : ""}`);
+    }
+    const start = Date.now();
+    let result;
+    try {
+      result = await originalCall(arg, runManager, parentConfig);
+    } catch (err) {
+      const event2 = {
+        agent_id: agentId,
+        event_type: "tool_call",
+        action: tool.name,
+        resource: truncate(JSON.stringify(arg), 500),
+        permission: scope,
+        result: "error",
+        latency_ms: Date.now() - start,
+        error_code: err instanceof Error ? err.name : "UNKNOWN",
+        metadata: { error: err instanceof Error ? err.message : String(err), framework: "langchain" }
+      };
+      emitAudit(vorim, event2, asyncAudit);
+      throw err;
+    }
+    const event = {
+      agent_id: agentId,
+      event_type: "tool_call",
+      action: tool.name,
+      resource: truncate(JSON.stringify(arg), 500),
+      permission: scope,
+      result: "success",
+      latency_ms: Date.now() - start,
+      metadata: { framework: "langchain" }
+    };
+    emitAudit(vorim, event, asyncAudit);
+    return result;
+  };
+  return tool;
+}
+function wrapTools(tools, config) {
+  return tools.map((t) => wrapTool(t, config));
+}
+var VorimCallbackHandler = class _VorimCallbackHandler {
+  name = "VorimCallbackHandler";
+  vorim;
+  agentId;
+  runMap = /* @__PURE__ */ new Map();
+  // Flags to satisfy BaseCallbackHandler interface
+  ignoreLLM = true;
+  ignoreChain = true;
+  ignoreAgent = true;
+  ignoreRetriever = true;
+  ignoreCustomEvent = true;
+  lc_serializable = false;
+  get lc_id() {
+    return ["vorim", "callbacks", "VorimCallbackHandler"];
+  }
+  get lc_namespace() {
+    return ["vorim", "callbacks"];
+  }
+  constructor(vorim, agentId) {
+    this.vorim = vorim;
+    this.agentId = agentId;
+  }
+  async handleToolStart(tool, input, runId, _parentRunId, _tags, _metadata, runName) {
+    const toolName = runName ?? tool.id?.[tool.id.length - 1] ?? "unknown";
+    this.runMap.set(runId, { tool: toolName, input, startTime: Date.now() });
+  }
+  async handleToolEnd(_output, runId) {
+    const run = this.runMap.get(runId);
+    if (!run) return;
+    this.runMap.delete(runId);
+    await this.vorim.emit({
+      agent_id: this.agentId,
+      event_type: "tool_call",
+      action: run.tool,
+      resource: truncate(run.input, 500),
+      result: "success",
+      latency_ms: Date.now() - run.startTime,
+      metadata: { framework: "langchain" }
+    }).catch(() => {
+    });
+  }
+  async handleToolError(err, runId) {
+    const run = this.runMap.get(runId);
+    if (!run) return;
+    this.runMap.delete(runId);
+    await this.vorim.emit({
+      agent_id: this.agentId,
+      event_type: "tool_call",
+      action: run.tool,
+      resource: truncate(run.input, 500),
+      result: "error",
+      latency_ms: Date.now() - run.startTime,
+      error_code: err.name,
+      metadata: { error: err.message, framework: "langchain" }
+    }).catch(() => {
+    });
+  }
+  // Required by BaseCallbackHandler — no-op for events we don't need
+  copy() {
+    return new _VorimCallbackHandler(this.vorim, this.agentId);
+  }
+  toJSON() {
+    return { lc: 1, type: "not_implemented", id: this.lc_id };
+  }
+  toJSONNotImplemented() {
+    return this.toJSON();
+  }
+};
+async function createVorimAgent(config) {
+  const { vorim, name, capabilities, scopes, description, tools: rawTools, permissionMap, defaultPermission, asyncAudit } = config;
+  const registration = await vorim.register({
+    name,
+    description,
+    capabilities,
+    scopes
+  });
+  const agentId = registration.agent.agent_id;
+  const agentConfig = { vorim, agentId, permissionMap, defaultPermission, asyncAudit };
+  const tools = wrapTools(rawTools, agentConfig);
+  const callbackHandler = new VorimCallbackHandler(vorim, agentId);
+  return {
+    /** The Vorim agent_id. */
+    agentId,
+    /** The full agent registration result. */
+    registration,
+    /** Tools wrapped with Vorim permission checks + audit. */
+    tools,
+    /** Callback handler for audit trail observability. */
+    callbackHandler,
+    /** The private key (store securely — shown once). */
+    privateKey: registration.private_key
+  };
+}
+function truncate(str, max) {
+  return str.length > max ? str.slice(0, max) + "\u2026" : str;
+}
+function emitAudit(vorim, event, async) {
+  if (async) {
+    vorim.emit(event).catch(() => {
+    });
+  } else {
+    vorim.emit(event).catch(() => {
+    });
+  }
+}
+export {
+  VorimCallbackHandler,
+  createVorimAgent,
+  wrapTool,
+  wrapTools
+};
+//# sourceMappingURL=langchain.js.map