@vorim/sdk 3.1.0 → 3.3.0

package/dist/integrations/llamaindex.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/integrations/llamaindex.ts"],"sourcesContent":["// ============================================================================\n// VORIM SDK — LlamaIndex TS Integration\n// Wraps LlamaIndex tools with Vorim permission checks + audit trails.\n// Provides a tool wrapper and agent registration factory.\n//\n// Peer dependency: llamaindex >=0.4.0 (or @llamaindex/core)\n// ============================================================================\n\nimport type { VorimSDK } from '../index.js';\nimport type { PermissionScope, AuditEventInput } from '../types.js';\n\n// ─── Re-declared LlamaIndex types (peer dependency — not bundled) ─────────\n// These mirror the actual interfaces from @llamaindex/core/llms and\n// @llamaindex/core/tools so consumers don't need to wrangle imports.\n\n/** Matches @llamaindex/core ToolMetadata */\ninterface ToolMetadata<P extends Record<string, unknown> = Record<string, unknown>> {\n  name: string;\n  description: string;\n  parameters?: P;\n}\n\n/**\n * Matches @llamaindex/core BaseTool.\n * In LlamaIndex, `call` is optional on BaseTool but required on BaseToolWithCall.\n */\ninterface LlamaIndexTool<Input = any> {\n  metadata: ToolMetadata;\n  call: (input: Input) => any | Promise<any>;\n}\n\n// ─── Configuration ────────────────────────────────────────────────────────\n\nexport interface VorimLlamaIndexConfig {\n  /** Vorim SDK instance. */\n  vorim: VorimSDK;\n  /** The Vorim agent_id to associate. */\n  agentId: string;\n  /** Map tool names → Vorim permission scopes. */\n  permissionMap?: Record<string, PermissionScope>;\n  /** Default permission scope for unmapped tools. @default 'agent:execute' */\n  defaultPermission?: PermissionScope;\n  /** Whether to emit audit events asynchronously (fire-and-forget). @default true */\n  asyncAudit?: boolean;\n}\n\n// ─── Tool Wrapper ─────────────────────────────────────────────────────────\n\n/**\n * Wraps a LlamaIndex tool (`BaseTool` / `BaseToolWithCall` / `FunctionTool`)\n * with Vorim permission checks before execution and audit event emission after.\n *\n * The wrapper implements the same `BaseTool` interface so it's a drop-in\n * replacement anywhere LlamaIndex expects a tool.\n *\n * @example\n * ```ts\n * import { FunctionTool } from \"llamaindex\";\n * import createVorim from \"@vorim/sdk\";\n * import { wrapTool } from \"@vorim/sdk/integrations/llamaindex\";\n *\n * const vorim = createVorim({ apiKey: \"agid_sk_live_...\" });\n *\n * const searchTool = FunctionTool.from(\n *   async ({ query }: { query: string }) => `Results for: ${query}`,\n *   { name: \"search\", description: \"Search documents\", parameters: { ... } }\n * );\n *\n * const guarded = wrapTool(searchTool, {\n *   vorim,\n *   agentId: \"agid_acme_a1b2c3d4\",\n *   permissionMap: { search: \"agent:read\" },\n * });\n *\n * // Use with any LlamaIndex agent\n * const agent = new OpenAIAgent({ tools: [guarded] });\n * ```\n */\nexport function wrapTool<T extends LlamaIndexTool>(\n  tool: T,\n  config: VorimLlamaIndexConfig,\n): T {\n  const {\n    vorim, agentId,\n    permissionMap = {},\n    defaultPermission = 'agent:execute',\n    asyncAudit = true,\n  } = config;\n\n  const originalCall = tool.call.bind(tool);\n  const toolName = tool.metadata.name;\n  const scope = permissionMap[toolName] ?? defaultPermission;\n\n  // Create a new object that preserves the tool's prototype chain\n  // and all properties, but overrides `call`\n  const wrapped = Object.create(Object.getPrototypeOf(tool), {\n    ...Object.getOwnPropertyDescriptors(tool),\n    call: {\n      value: async function vorimGuardedCall(input: any): Promise<any> {\n        // 1. Permission check\n        const { allowed, reason } = await vorim.check(agentId, scope);\n\n        if (!allowed) {\n          const event: AuditEventInput = {\n            agent_id: agentId,\n            event_type: 'tool_call',\n            action: toolName,\n            resource: truncate(JSON.stringify(input), 500),\n            permission: scope,\n            result: 'denied',\n            metadata: { reason, framework: 'llamaindex' },\n          };\n          emitAudit(vorim, event, asyncAudit);\n          throw new Error(\n            `Vorim: permission denied for \"${toolName}\" — scope \"${scope}\"${reason ? `: ${reason}` : ''}`,\n          );\n        }\n\n        // 2. Execute the original tool\n        const start = Date.now();\n        let result: any;\n        try {\n          result = await originalCall(input);\n        } catch (err) {\n          const event: AuditEventInput = {\n            agent_id: agentId,\n            event_type: 'tool_call',\n            action: toolName,\n            resource: truncate(JSON.stringify(input), 500),\n            permission: scope,\n            result: 'error',\n            latency_ms: Date.now() - start,\n            error_code: err instanceof Error ? err.name : 'UNKNOWN',\n            metadata: {\n              error: err instanceof Error ? err.message : String(err),\n              framework: 'llamaindex',\n            },\n          };\n          emitAudit(vorim, event, asyncAudit);\n          throw err;\n        }\n\n        // 3. Audit success\n        const event: AuditEventInput = {\n          agent_id: agentId,\n          event_type: 'tool_call',\n          action: toolName,\n          resource: truncate(JSON.stringify(input), 500),\n          permission: scope,\n          result: 'success',\n          latency_ms: Date.now() - start,\n          metadata: { framework: 'llamaindex' },\n        };\n        emitAudit(vorim, event, asyncAudit);\n\n        return result;\n      },\n      writable: true,\n      configurable: true,\n      enumerable: true,\n    },\n  }) as T;\n\n  return wrapped;\n}\n\n/**\n * Wraps an array of LlamaIndex tools with Vorim permission + audit.\n */\nexport function wrapTools<T extends LlamaIndexTool>(\n  tools: T[],\n  config: VorimLlamaIndexConfig,\n): T[] {\n  return tools.map(t => wrapTool(t, config));\n}\n\n// ─── Agent Factory ────────────────────────────────────────────────────────\n\nexport interface CreateVorimLlamaIndexAgentConfig extends VorimLlamaIndexConfig {\n  /** Display name for the agent. */\n  name: string;\n  /** Agent capabilities. */\n  capabilities: string[];\n  /** Initial permission scopes. */\n  scopes: PermissionScope[];\n  /** Optional description. */\n  description?: string;\n}\n\n/**\n * Registers a new agent with Vorim and returns wrapped tools ready for\n * use with any LlamaIndex agent (OpenAIAgent, ReActAgent, etc.).\n *\n * @example\n * ```ts\n * import { OpenAIAgent, FunctionTool } from \"llamaindex\";\n * import createVorim from \"@vorim/sdk\";\n * import { createVorimAgent } from \"@vorim/sdk/integrations/llamaindex\";\n *\n * const vorim = createVorim({ apiKey: \"agid_sk_live_...\" });\n *\n * const searchTool = FunctionTool.from(...);\n * const writeTool = FunctionTool.from(...);\n *\n * const { agentId, tools } = await createVorimAgent({\n *   vorim,\n *   name: \"research-agent\",\n *   capabilities: [\"search\", \"write\"],\n *   scopes: [\"agent:read\", \"agent:write\", \"agent:execute\"],\n *   tools: [searchTool, writeTool],\n *   permissionMap: {\n *     search: \"agent:read\",\n *     write: \"agent:write\",\n *   },\n * });\n *\n * // Create LlamaIndex agent with Vorim-wrapped tools\n * const agent = new OpenAIAgent({ tools });\n * const response = await agent.chat({ message: \"Research AI trends\" });\n * ```\n */\nexport async function createVorimAgent<T extends LlamaIndexTool>(\n  config: CreateVorimLlamaIndexAgentConfig & { tools: T[] },\n) {\n  const { vorim, name, capabilities, scopes, description, tools: rawTools, permissionMap, defaultPermission, asyncAudit } = config;\n\n  // Register agent with Vorim\n  const registration = await vorim.register({\n    name,\n    description,\n    capabilities,\n    scopes,\n  });\n\n  const agentId = registration.agent.agent_id;\n  const toolConfig: VorimLlamaIndexConfig = { vorim, agentId, permissionMap, defaultPermission, asyncAudit };\n\n  // Wrap tools with permission checks\n  const tools = wrapTools(rawTools, toolConfig);\n\n  return {\n    /** The Vorim agent_id. */\n    agentId,\n    /** Full registration result. */\n    registration,\n    /** Tools wrapped with Vorim permission checks + audit. */\n    tools,\n    /** The private key (store securely — shown once). */\n    privateKey: registration.private_key,\n  };\n}\n\n// ─── Audit Helpers ────────────────────────────────────────────────────────\n\n/**\n * Emit a manual audit event for a LlamaIndex agent action that isn't\n * captured by the tool wrapper (e.g. RAG retrieval, chat responses).\n */\nexport async function emitLlamaIndexEvent(\n  vorim: VorimSDK,\n  agentId: string,\n  event: {\n    action: string;\n    resource?: string;\n    result: 'success' | 'denied' | 'error';\n    latencyMs?: number;\n    error?: string;\n    metadata?: Record<string, unknown>;\n  },\n): Promise<void> {\n  await vorim.emit({\n    agent_id: agentId,\n    event_type: 'api_request',\n    action: event.action,\n    resource: event.resource,\n    result: event.result,\n    latency_ms: event.latencyMs,\n    error_code: event.error ? 'LLAMAINDEX_ERROR' : undefined,\n    metadata: {\n      framework: 'llamaindex',\n      ...(event.error ? { error: event.error } : {}),\n      ...event.metadata,\n    },\n  });\n}\n\n// ─── Internal helpers ─────────────────────────────────────────────────────\n\nfunction truncate(str: string, max: number): string {\n  return str.length > max ? str.slice(0, max) + '…' : str;\n}\n\nfunction emitAudit(vorim: VorimSDK, event: AuditEventInput, async: boolean): void {\n  if (async) {\n    vorim.emit(event).catch(() => {});\n  } else {\n    vorim.emit(event).catch(() => {});\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA8EO,SAAS,SACd,MACA,QACG;AACH,QAAM;AAAA,IACJ;AAAA,IAAO;AAAA,IACP,gBAAgB,CAAC;AAAA,IACjB,oBAAoB;AAAA,IACpB,aAAa;AAAA,EACf,IAAI;AAEJ,QAAM,eAAe,KAAK,KAAK,KAAK,IAAI;AACxC,QAAM,WAAW,KAAK,SAAS;AAC/B,QAAM,QAAQ,cAAc,QAAQ,KAAK;AAIzC,QAAM,UAAU,OAAO,OAAO,OAAO,eAAe,IAAI,GAAG;AAAA,IACzD,GAAG,OAAO,0BAA0B,IAAI;AAAA,IACxC,MAAM;AAAA,MACJ,OAAO,eAAe,iBAAiB,OAA0B;AAE/D,cAAM,EAAE,SAAS,OAAO,IAAI,MAAM,MAAM,MAAM,SAAS,KAAK;AAE5D,YAAI,CAAC,SAAS;AACZ,gBAAMA,SAAyB;AAAA,YAC7B,UAAU;AAAA,YACV,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,YAC7C,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,EAAE,QAAQ,WAAW,aAAa;AAAA,UAC9C;AACA,oBAAU,OAAOA,QAAO,UAAU;AAClC,gBAAM,IAAI;AAAA,YACR,iCAAiC,QAAQ,mBAAc,KAAK,IAAI,SAAS,KAAK,MAAM,KAAK,EAAE;AAAA,UAC7F;AAAA,QACF;AAGA,cAAM,QAAQ,KAAK,IAAI;AACvB,YAAI;AACJ,YAAI;AACF,mBAAS,MAAM,aAAa,KAAK;AAAA,QACnC,SAAS,KAAK;AACZ,gBAAMA,SAAyB;AAAA,YAC7B,UAAU;AAAA,YACV,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,YAC7C,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,YAAY,KAAK,IAAI,IAAI;AAAA,YACzB,YAAY,eAAe,QAAQ,IAAI,OAAO;AAAA,YAC9C,UAAU;AAAA,cACR,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,cACtD,WAAW;AAAA,YACb;AAAA,UACF;AACA,oBAAU,OAAOA,QAAO,UAAU;AAClC,gBAAM;AAAA,QACR;AAGA,cAAM,QAAyB;AAAA,UAC7B,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,QAAQ;AAAA,UACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,UAC7C,YAAY;AAAA,UACZ,QAAQ;AAAA,UACR,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,UAAU,EAAE,WAAW,aAAa;AAAA,QACtC;AACA,kBAAU,OAAO,OAAO,UAAU;AAElC,eAAO;AAAA,MACT;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAKO,SAAS,UACd,OACA,QACK;AACL,SAAO,MAAM,IAAI,OAAK,SAAS,GAAG,MAAM,CAAC;AAC3C;AA+CA,eAAsB,iBACpB,QACA;AACA,QAAM,EAAE,OAAO,MAAM,cAAc,QAAQ,aAAa,OAAO,UAAU,eAAe,mBAAmB,WAAW,IAAI;AAG1H,QAAM,eAAe,MAAM,MAAM,SAAS;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,aAAa,MAAM;AACnC,QAAM,aAAoC,EAAE,OAAO,SAAS,eAAe,mBAAmB,WAAW;AAGzG,QAAM,QAAQ,UAAU,UAAU,UAAU;AAE5C,SAAO;AAAA;AAAA,IAEL;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA,YAAY,aAAa;AAAA,EAC3B;AACF;AAQA,eAAsB,oBACpB,OACA,SACA,OAQe;AACf,QAAM,MAAM,KAAK;AAAA,IACf,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM,QAAQ,qBAAqB;AAAA,IAC/C,UAAU;AAAA,MACR,WAAW;AAAA,MACX,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC5C,GAAG,MAAM;AAAA,IACX;AAAA,EACF,CAAC;AACH;AAIA,SAAS,SAAS,KAAa,KAAqB;AAClD,SAAO,IAAI,SAAS,MAAM,IAAI,MAAM,GAAG,GAAG,IAAI,WAAM;AACtD;AAEA,SAAS,UAAU,OAAiB,OAAwB,OAAsB;AAChF,MAAI,OAAO;AACT,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC,OAAO;AACL,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC;AACF;","names":["event"]}
+{"version":3,"sources":["../../src/integrations/llamaindex.ts","../../src/replay.ts"],"sourcesContent":["// ============================================================================\n// VORIM SDK — LlamaIndex TS Integration\n// Wraps LlamaIndex tools with Vorim permission checks + audit trails.\n// Provides a tool wrapper and agent registration factory.\n//\n// Peer dependency: llamaindex >=0.4.0 (or @llamaindex/core)\n// ============================================================================\n\nimport type { VorimSDK } from '../index.js';\nimport type { PermissionScope, AuditEventInput } from '../types.js';\nimport {\n  prepareReplayContext,\n  type ReplayInputs,\n  type ReplayContext,\n  type CatalogueTool,\n} from '../replay.js';\n\n// ─── Re-declared LlamaIndex types (peer dependency — not bundled) ─────────\n// These mirror the actual interfaces from @llamaindex/core/llms and\n// @llamaindex/core/tools so consumers don't need to wrangle imports.\n\n/** Matches @llamaindex/core ToolMetadata */\ninterface ToolMetadata<P extends Record<string, unknown> = Record<string, unknown>> {\n  name: string;\n  description: string;\n  parameters?: P;\n}\n\n/**\n * Matches @llamaindex/core BaseTool.\n * In LlamaIndex, `call` is optional on BaseTool but required on BaseToolWithCall.\n */\ninterface LlamaIndexTool<Input = any> {\n  metadata: ToolMetadata;\n  call: (input: Input) => any | Promise<any>;\n}\n\n// ─── Configuration ────────────────────────────────────────────────────────\n\nexport interface VorimLlamaIndexConfig {\n  /** Vorim SDK instance. */\n  vorim: VorimSDK;\n  /** The Vorim agent_id to associate. */\n  agentId: string;\n  /** Map tool names → Vorim permission scopes. */\n  permissionMap?: Record<string, PermissionScope>;\n  /** Default permission scope for unmapped tools. @default 'agent:execute' */\n  defaultPermission?: PermissionScope;\n  /** Whether to emit audit events asynchronously (fire-and-forget). @default true */\n  asyncAudit?: boolean;\n  /**\n   * Replayable agent decision evidence (VAIP -02). Hashes attached to\n   * every audit event the wrapper emits. Not covered by v0 canonical\n   * signature form.\n   */\n  replay?: ReplayInputs;\n}\n\n// ─── Tool Wrapper ─────────────────────────────────────────────────────────\n\n/**\n * Wraps a LlamaIndex tool (`BaseTool` / `BaseToolWithCall` / `FunctionTool`)\n * with Vorim permission checks before execution and audit event emission after.\n *\n * The wrapper implements the same `BaseTool` interface so it's a drop-in\n * replacement anywhere LlamaIndex expects a tool.\n *\n * @example\n * ```ts\n * import { FunctionTool } from \"llamaindex\";\n * import createVorim from \"@vorim/sdk\";\n * import { wrapTool } from \"@vorim/sdk/integrations/llamaindex\";\n *\n * const vorim = createVorim({ apiKey: \"agid_sk_live_...\" });\n *\n * const searchTool = FunctionTool.from(\n *   async ({ query }: { query: string }) => `Results for: ${query}`,\n *   { name: \"search\", description: \"Search documents\", parameters: { ... } }\n * );\n *\n * const guarded = wrapTool(searchTool, {\n *   vorim,\n *   agentId: \"agid_acme_a1b2c3d4\",\n *   permissionMap: { search: \"agent:read\" },\n * });\n *\n * // Use with any LlamaIndex agent\n * const agent = new OpenAIAgent({ tools: [guarded] });\n * ```\n */\nexport function wrapTool<T extends LlamaIndexTool>(\n  tool: T,\n  config: VorimLlamaIndexConfig,\n): T {\n  const {\n    vorim, agentId,\n    permissionMap = {},\n    defaultPermission = 'agent:execute',\n    asyncAudit = true,\n    replay,\n  } = config;\n\n  const originalCall = tool.call.bind(tool);\n  const toolName = tool.metadata.name;\n  const scope = permissionMap[toolName] ?? defaultPermission;\n  const getReplayCtx = makeReplayContextGetter(replay);\n\n  // Create a new object that preserves the tool's prototype chain\n  // and all properties, but overrides `call`\n  const wrapped = Object.create(Object.getPrototypeOf(tool), {\n    ...Object.getOwnPropertyDescriptors(tool),\n    call: {\n      value: async function vorimGuardedCall(input: any): Promise<any> {\n        // 1. Permission check\n        const { allowed, reason } = await vorim.check(agentId, scope);\n        const replayCtx = await getReplayCtx();\n\n        if (!allowed) {\n          const event: AuditEventInput = {\n            agent_id: agentId,\n            event_type: 'tool_call',\n            action: toolName,\n            resource: truncate(JSON.stringify(input), 500),\n            permission: scope,\n            result: 'denied',\n            metadata: { reason, framework: 'llamaindex' },\n            ...replayCtx,\n          };\n          emitAudit(vorim, event, asyncAudit);\n          throw new Error(\n            `Vorim: permission denied for \"${toolName}\" — scope \"${scope}\"${reason ? `: ${reason}` : ''}`,\n          );\n        }\n\n        // 2. Execute the original tool\n        const start = Date.now();\n        let result: any;\n        try {\n          result = await originalCall(input);\n        } catch (err) {\n          const event: AuditEventInput = {\n            agent_id: agentId,\n            event_type: 'tool_call',\n            action: toolName,\n            resource: truncate(JSON.stringify(input), 500),\n            permission: scope,\n            result: 'error',\n            latency_ms: Date.now() - start,\n            error_code: err instanceof Error ? err.name : 'UNKNOWN',\n            metadata: {\n              error: err instanceof Error ? err.message : String(err),\n              framework: 'llamaindex',\n            },\n            ...replayCtx,\n          };\n          emitAudit(vorim, event, asyncAudit);\n          throw err;\n        }\n\n        // 3. Audit success\n        const event: AuditEventInput = {\n          agent_id: agentId,\n          event_type: 'tool_call',\n          action: toolName,\n          resource: truncate(JSON.stringify(input), 500),\n          permission: scope,\n          result: 'success',\n          latency_ms: Date.now() - start,\n          metadata: { framework: 'llamaindex' },\n          ...replayCtx,\n        };\n        emitAudit(vorim, event, asyncAudit);\n\n        return result;\n      },\n      writable: true,\n      configurable: true,\n      enumerable: true,\n    },\n  }) as T;\n\n  return wrapped;\n}\n\n/**\n * Wraps an array of LlamaIndex tools with Vorim permission + audit.\n */\nexport function wrapTools<T extends LlamaIndexTool>(\n  tools: T[],\n  config: VorimLlamaIndexConfig,\n): T[] {\n  return tools.map(t => wrapTool(t, config));\n}\n\n// ─── Agent Factory ────────────────────────────────────────────────────────\n\nexport interface CreateVorimLlamaIndexAgentConfig extends VorimLlamaIndexConfig {\n  /** Display name for the agent. */\n  name: string;\n  /** Agent capabilities. */\n  capabilities: string[];\n  /** Initial permission scopes. */\n  scopes: PermissionScope[];\n  /** Optional description. */\n  description?: string;\n}\n\n/**\n * Registers a new agent with Vorim and returns wrapped tools ready for\n * use with any LlamaIndex agent (OpenAIAgent, ReActAgent, etc.).\n *\n * @example\n * ```ts\n * import { OpenAIAgent, FunctionTool } from \"llamaindex\";\n * import createVorim from \"@vorim/sdk\";\n * import { createVorimAgent } from \"@vorim/sdk/integrations/llamaindex\";\n *\n * const vorim = createVorim({ apiKey: \"agid_sk_live_...\" });\n *\n * const searchTool = FunctionTool.from(...);\n * const writeTool = FunctionTool.from(...);\n *\n * const { agentId, tools } = await createVorimAgent({\n *   vorim,\n *   name: \"research-agent\",\n *   capabilities: [\"search\", \"write\"],\n *   scopes: [\"agent:read\", \"agent:write\", \"agent:execute\"],\n *   tools: [searchTool, writeTool],\n *   permissionMap: {\n *     search: \"agent:read\",\n *     write: \"agent:write\",\n *   },\n * });\n *\n * // Create LlamaIndex agent with Vorim-wrapped tools\n * const agent = new OpenAIAgent({ tools });\n * const response = await agent.chat({ message: \"Research AI trends\" });\n * ```\n */\nexport async function createVorimAgent<T extends LlamaIndexTool>(\n  config: CreateVorimLlamaIndexAgentConfig & { tools: T[] },\n) {\n  const { vorim, name, capabilities, scopes, description, tools: rawTools, permissionMap, defaultPermission, asyncAudit } = config;\n\n  // Register agent with Vorim\n  const registration = await vorim.register({\n    name,\n    description,\n    capabilities,\n    scopes,\n  });\n\n  const agentId = registration.agent.agent_id;\n  const toolConfig: VorimLlamaIndexConfig = { vorim, agentId, permissionMap, defaultPermission, asyncAudit };\n\n  // Wrap tools with permission checks\n  const tools = wrapTools(rawTools, toolConfig);\n\n  return {\n    /** The Vorim agent_id. */\n    agentId,\n    /** Full registration result. */\n    registration,\n    /** Tools wrapped with Vorim permission checks + audit. */\n    tools,\n    /** The private key (store securely — shown once). */\n    privateKey: registration.private_key,\n  };\n}\n\n// ─── Audit Helpers ────────────────────────────────────────────────────────\n\n/**\n * Emit a manual audit event for a LlamaIndex agent action that isn't\n * captured by the tool wrapper (e.g. RAG retrieval, chat responses).\n */\nexport async function emitLlamaIndexEvent(\n  vorim: VorimSDK,\n  agentId: string,\n  event: {\n    action: string;\n    resource?: string;\n    result: 'success' | 'denied' | 'error';\n    latencyMs?: number;\n    error?: string;\n    metadata?: Record<string, unknown>;\n  },\n): Promise<void> {\n  await vorim.emit({\n    agent_id: agentId,\n    event_type: 'api_request',\n    action: event.action,\n    resource: event.resource,\n    result: event.result,\n    latency_ms: event.latencyMs,\n    error_code: event.error ? 'LLAMAINDEX_ERROR' : undefined,\n    metadata: {\n      framework: 'llamaindex',\n      ...(event.error ? { error: event.error } : {}),\n      ...event.metadata,\n    },\n  });\n}\n\n// ─── Internal helpers ─────────────────────────────────────────────────────\n\nfunction truncate(str: string, max: number): string {\n  return str.length > max ? str.slice(0, max) + '…' : str;\n}\n\nfunction emitAudit(vorim: VorimSDK, event: AuditEventInput, async: boolean): void {\n  if (async) {\n    vorim.emit(event).catch(() => {});\n  } else {\n    vorim.emit(event).catch(() => {});\n  }\n}\n\n/**\n * Lazy-cached replay context getter. Hashes computed once on first\n * call, reused thereafter. Returns empty object when no replay config\n * was given, so the spread is a no-op.\n */\nfunction makeReplayContextGetter(replay: ReplayInputs | undefined): () => Promise<ReplayContext> {\n  if (!replay) return async () => ({});\n  let cached: Promise<ReplayContext> | null = null;\n  return () => {\n    if (!cached) cached = prepareReplayContext(replay);\n    return cached;\n  };\n}\n","/**\n * Replayable agent decision evidence helpers.\n *\n * Canonical-form hashing for the VAIP -02 schema fields that the SDK\n * attaches to audit events. The hashes recorded in audit_events.tool_catalogue_hash\n * and audit_events.system_prompt_hash use these functions, so the bytes\n * an auditor or counterparty reconstructs must match what the SDK produced.\n *\n * These helpers are intentionally separate from the signing path. The\n * v0 canonical signature form (event_type|action|resource|input_hash|\n * output_hash|result) does NOT cover model_version, tool_catalogue_hash,\n * or system_prompt_hash. They will enter the canonical bytes in v1\n * (RFC 8785 JCS) in a follow-up release.\n *\n * Stable across SDK versions: the canonical-form version is documented\n * in CANONICAL_TOOL_CATALOGUE_VERSION. Future changes get a v2 etc;\n * never edit the existing v1 logic, or already-recorded hashes lose\n * their meaning.\n */\n\n// ─── Versioning ───────────────────────────────────────────────────────────\n\n/**\n * Canonical-form version for tool catalogue hashes produced by this SDK.\n * Recorded in tool_catalogue_canon_version on the event metadata (when\n * the metadata field is used) so verifiers know which hash recipe to\n * reproduce. Increment ONLY if the algorithm changes in a way that\n * would change the hash for the same logical catalogue.\n */\nexport const CANONICAL_TOOL_CATALOGUE_VERSION = 'v1' as const;\n\n// ─── Types ────────────────────────────────────────────────────────────────\n\n/**\n * Minimum shape a tool needs for catalogue hashing. The framework\n * integrations adapt their native tool objects to this shape before\n * calling hashToolCatalogue.\n */\nexport interface CatalogueTool {\n  /** The name the model sees and calls. Required. */\n  name: string;\n  /** Human-readable description shown to the model. Optional; absent ↔ empty string. */\n  description?: string;\n  /**\n   * JSON Schema describing the tool's input parameters. Optional;\n   * absent ↔ empty object `{}`. The schema gets RFC 8785 JCS-canonicalised\n   * before hashing so semantically-equivalent variations (key order,\n   * whitespace) produce the same hash.\n   */\n  schema?: Record<string, unknown> | null;\n}\n\n// ─── RFC 8785 JCS subset ──────────────────────────────────────────────────\n\n/**\n * RFC 8785 JSON Canonicalization Scheme, sufficient subset for tool\n * catalogue values.\n *\n * Rules:\n *  - Object keys sorted lexicographically by UTF-16 code units (which\n *    is what JS string comparison does naturally).\n *  - No whitespace between tokens.\n *  - Numbers: integers as integers, finite floats per ECMAScript\n *    Number.prototype.toString. JCS forbids NaN and Infinity.\n *  - Strings: JSON-escape using minimal set per RFC 8259 § 7.\n *  - null, true, false, arrays: as JSON.stringify produces them, since\n *    JSON.stringify already produces the canonical form for these.\n *\n * Not vendoring a full library because tool schemas don't carry\n * non-integer numbers in practice and the JS spec for Number.toString\n * happens to coincide with JCS § 3.2.2.2 for the integer case.\n */\nexport function jcsCanonicalise(value: unknown): string {\n  if (value === null) return 'null';\n  if (value === true) return 'true';\n  if (value === false) return 'false';\n\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) {\n      throw new Error('jcsCanonicalise: NaN and Infinity are not JCS-valid');\n    }\n    // For integers in safe range, .toString() matches JCS. For\n    // non-integer floats, .toString() also matches in modern JS\n    // engines (V8, JavaScriptCore, SpiderMonkey all use the shortest\n    // round-trip representation, which is what JCS § 3.2.2.2 requires).\n    return value.toString();\n  }\n\n  if (typeof value === 'string') {\n    return JSON.stringify(value);\n  }\n\n  if (Array.isArray(value)) {\n    return '[' + value.map(jcsCanonicalise).join(',') + ']';\n  }\n\n  if (typeof value === 'object') {\n    const keys = Object.keys(value as Record<string, unknown>).sort();\n    const parts = keys.map(k => {\n      return JSON.stringify(k) + ':' + jcsCanonicalise((value as Record<string, unknown>)[k]);\n    });\n    return '{' + parts.join(',') + '}';\n  }\n\n  // undefined, function, symbol, bigint — not JSON-representable\n  throw new Error(`jcsCanonicalise: unsupported value type: ${typeof value}`);\n}\n\n// ─── SHA-256 ──────────────────────────────────────────────────────────────\n\nasync function sha256Hex(input: string | Uint8Array): Promise<string> {\n  const bytes = typeof input === 'string' ? new TextEncoder().encode(input) : input;\n\n  // Node.js Web Crypto (Node 18+) supports digest. Browser Web Crypto does too.\n  // Fall back to node:crypto if Web Crypto is unavailable.\n  const subtle = (globalThis as any).crypto?.subtle;\n  if (subtle) {\n    const buf = await subtle.digest('SHA-256', bytes);\n    return Array.from(new Uint8Array(buf))\n      .map(b => b.toString(16).padStart(2, '0'))\n      .join('');\n  }\n\n  // Node fallback\n  const nodeCrypto = await import('node:crypto');\n  return nodeCrypto.createHash('sha256').update(bytes).digest('hex');\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────\n\n/**\n * Hash a single tool definition. Returns `sha256:<hex>`.\n *\n * Canonical form (v1):\n *   JCS-canonicalised JSON of `{name, description, schema}` where\n *   absent fields substitute `description: \"\"` and `schema: {}`.\n */\nexport async function hashTool(tool: CatalogueTool): Promise<string> {\n  const normalised = {\n    name: tool.name,\n    description: tool.description ?? '',\n    schema: tool.schema ?? {},\n  };\n  const hex = await sha256Hex(jcsCanonicalise(normalised));\n  return `sha256:${hex}`;\n}\n\n/**\n * Hash an entire tool catalogue. Returns `sha256:<hex>`.\n *\n * Reordering tools does NOT change the hash (tool hashes sorted\n * lexicographically before concatenation). Adding, removing, or\n * modifying a tool DOES change the hash.\n *\n * Per-tool hashing first means a verifier comparing two catalogue\n * hashes that differ can also be given the per-tool hashes to\n * identify which specific tool changed.\n */\nexport async function hashToolCatalogue(tools: CatalogueTool[]): Promise<string> {\n  if (tools.length === 0) {\n    // Empty catalogue has a deterministic, stable hash distinct from \"no field\"\n    return `sha256:${await sha256Hex('[]')}`;\n  }\n  const perTool = await Promise.all(tools.map(hashTool));\n  perTool.sort();\n  const hex = await sha256Hex(perTool.join(''));\n  return `sha256:${hex}`;\n}\n\n/**\n * Hash a system prompt. Returns `sha256:<hex>`.\n *\n * The prompt is UTF-8 encoded and hashed verbatim — no normalisation.\n * If a caller wants to ignore whitespace or comment differences, they\n * should normalise before calling. The intent here is deterministic\n * reproducibility, not semantic equivalence.\n */\nexport async function hashSystemPrompt(prompt: string): Promise<string> {\n  const hex = await sha256Hex(prompt);\n  return `sha256:${hex}`;\n}\n\n/**\n * Convenience: hash the previous event's canonical bytes for use in\n * the prev_event_hash field of hash-chained ingest. Caller provides\n * the canonical bytes (use canonicalPayloadV0 from the main module).\n */\nexport async function hashPreviousEvent(canonicalBytes: string): Promise<string> {\n  const hex = await sha256Hex(canonicalBytes);\n  return `sha256:${hex}`;\n}\n\n// ─── Replay context — framework integration helper ────────────────────────\n\n/**\n * Raw inputs the integration captures from the framework. Set by the\n * integration's config; turned into hashes by {@link prepareReplayContext}.\n */\nexport interface ReplayInputs {\n  /** Stable identifier for the model. E.g. `\"anthropic:claude-opus-4-8\"`. */\n  modelVersion?: string;\n  /** Tools available to the agent at call time. Hashed via {@link hashToolCatalogue}. */\n  tools?: CatalogueTool[];\n  /** System prompt active at call time. Hashed via {@link hashSystemPrompt}. */\n  systemPrompt?: string;\n}\n\n/**\n * Pre-computed hashes ready to attach to audit events. The three keys\n * match the audit_events column names.\n */\nexport interface ReplayContext {\n  model_version?: string;\n  tool_catalogue_hash?: string;\n  system_prompt_hash?: string;\n}\n\n/**\n * Compute replay context once from raw inputs. Use at integration\n * setup time so each emit can attach the hashes without re-hashing.\n *\n * Returns an object suitable for spreading into an AuditEventInput:\n *   `await vorim.emit({ ...event, ...replayContext })`\n *\n * If a field is absent in the inputs, it is absent in the result\n * (not the empty string). That keeps the event lean.\n */\nexport async function prepareReplayContext(\n  inputs: ReplayInputs,\n): Promise<ReplayContext> {\n  const ctx: ReplayContext = {};\n  if (inputs.modelVersion) ctx.model_version = inputs.modelVersion;\n  if (inputs.tools) ctx.tool_catalogue_hash = await hashToolCatalogue(inputs.tools);\n  if (inputs.systemPrompt) ctx.system_prompt_hash = await hashSystemPrompt(inputs.systemPrompt);\n  return ctx;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACwEO,SAAS,gBAAgB,OAAwB;AACtD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,MAAO,QAAO;AAE5B,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AAKA,WAAO,MAAM,SAAS;AAAA,EACxB;AAEA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AAEA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,MAAM,IAAI,eAAe,EAAE,KAAK,GAAG,IAAI;AAAA,EACtD;AAEA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,OAAO,OAAO,KAAK,KAAgC,EAAE,KAAK;AAChE,UAAM,QAAQ,KAAK,IAAI,OAAK;AAC1B,aAAO,KAAK,UAAU,CAAC,IAAI,MAAM,gBAAiB,MAAkC,CAAC,CAAC;AAAA,IACxF,CAAC;AACD,WAAO,MAAM,MAAM,KAAK,GAAG,IAAI;AAAA,EACjC;AAGA,QAAM,IAAI,MAAM,4CAA4C,OAAO,KAAK,EAAE;AAC5E;AAIA,eAAe,UAAU,OAA6C;AACpE,QAAM,QAAQ,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAI;AAI5E,QAAM,SAAU,WAAmB,QAAQ;AAC3C,MAAI,QAAQ;AACV,UAAM,MAAM,MAAM,OAAO,OAAO,WAAW,KAAK;AAChD,WAAO,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,EAClC,IAAI,OAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EACxC,KAAK,EAAE;AAAA,EACZ;AAGA,QAAM,aAAa,MAAM,OAAO,QAAa;AAC7C,SAAO,WAAW,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACnE;AAWA,eAAsB,SAAS,MAAsC;AACnE,QAAM,aAAa;AAAA,IACjB,MAAM,KAAK;AAAA,IACX,aAAa,KAAK,eAAe;AAAA,IACjC,QAAQ,KAAK,UAAU,CAAC;AAAA,EAC1B;AACA,QAAM,MAAM,MAAM,UAAU,gBAAgB,UAAU,CAAC;AACvD,SAAO,UAAU,GAAG;AACtB;AAaA,eAAsB,kBAAkB,OAAyC;AAC/E,MAAI,MAAM,WAAW,GAAG;AAEtB,WAAO,UAAU,MAAM,UAAU,IAAI,CAAC;AAAA,EACxC;AACA,QAAM,UAAU,MAAM,QAAQ,IAAI,MAAM,IAAI,QAAQ,CAAC;AACrD,UAAQ,KAAK;AACb,QAAM,MAAM,MAAM,UAAU,QAAQ,KAAK,EAAE,CAAC;AAC5C,SAAO,UAAU,GAAG;AACtB;AAUA,eAAsB,iBAAiB,QAAiC;AACtE,QAAM,MAAM,MAAM,UAAU,MAAM;AAClC,SAAO,UAAU,GAAG;AACtB;AA+CA,eAAsB,qBACpB,QACwB;AACxB,QAAM,MAAqB,CAAC;AAC5B,MAAI,OAAO,aAAc,KAAI,gBAAgB,OAAO;AACpD,MAAI,OAAO,MAAO,KAAI,sBAAsB,MAAM,kBAAkB,OAAO,KAAK;AAChF,MAAI,OAAO,aAAc,KAAI,qBAAqB,MAAM,iBAAiB,OAAO,YAAY;AAC5F,SAAO;AACT;;;ADjJO,SAAS,SACd,MACA,QACG;AACH,QAAM;AAAA,IACJ;AAAA,IAAO;AAAA,IACP,gBAAgB,CAAC;AAAA,IACjB,oBAAoB;AAAA,IACpB,aAAa;AAAA,IACb;AAAA,EACF,IAAI;AAEJ,QAAM,eAAe,KAAK,KAAK,KAAK,IAAI;AACxC,QAAM,WAAW,KAAK,SAAS;AAC/B,QAAM,QAAQ,cAAc,QAAQ,KAAK;AACzC,QAAM,eAAe,wBAAwB,MAAM;AAInD,QAAM,UAAU,OAAO,OAAO,OAAO,eAAe,IAAI,GAAG;AAAA,IACzD,GAAG,OAAO,0BAA0B,IAAI;AAAA,IACxC,MAAM;AAAA,MACJ,OAAO,eAAe,iBAAiB,OAA0B;AAE/D,cAAM,EAAE,SAAS,OAAO,IAAI,MAAM,MAAM,MAAM,SAAS,KAAK;AAC5D,cAAM,YAAY,MAAM,aAAa;AAErC,YAAI,CAAC,SAAS;AACZ,gBAAMA,SAAyB;AAAA,YAC7B,UAAU;AAAA,YACV,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,YAC7C,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,EAAE,QAAQ,WAAW,aAAa;AAAA,YAC5C,GAAG;AAAA,UACL;AACA,oBAAU,OAAOA,QAAO,UAAU;AAClC,gBAAM,IAAI;AAAA,YACR,iCAAiC,QAAQ,mBAAc,KAAK,IAAI,SAAS,KAAK,MAAM,KAAK,EAAE;AAAA,UAC7F;AAAA,QACF;AAGA,cAAM,QAAQ,KAAK,IAAI;AACvB,YAAI;AACJ,YAAI;AACF,mBAAS,MAAM,aAAa,KAAK;AAAA,QACnC,SAAS,KAAK;AACZ,gBAAMA,SAAyB;AAAA,YAC7B,UAAU;AAAA,YACV,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,YAC7C,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,YAAY,KAAK,IAAI,IAAI;AAAA,YACzB,YAAY,eAAe,QAAQ,IAAI,OAAO;AAAA,YAC9C,UAAU;AAAA,cACR,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,cACtD,WAAW;AAAA,YACb;AAAA,YACA,GAAG;AAAA,UACL;AACA,oBAAU,OAAOA,QAAO,UAAU;AAClC,gBAAM;AAAA,QACR;AAGA,cAAM,QAAyB;AAAA,UAC7B,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,QAAQ;AAAA,UACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,UAC7C,YAAY;AAAA,UACZ,QAAQ;AAAA,UACR,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,UAAU,EAAE,WAAW,aAAa;AAAA,UACpC,GAAG;AAAA,QACL;AACA,kBAAU,OAAO,OAAO,UAAU;AAElC,eAAO;AAAA,MACT;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAKO,SAAS,UACd,OACA,QACK;AACL,SAAO,MAAM,IAAI,OAAK,SAAS,GAAG,MAAM,CAAC;AAC3C;AA+CA,eAAsB,iBACpB,QACA;AACA,QAAM,EAAE,OAAO,MAAM,cAAc,QAAQ,aAAa,OAAO,UAAU,eAAe,mBAAmB,WAAW,IAAI;AAG1H,QAAM,eAAe,MAAM,MAAM,SAAS;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,aAAa,MAAM;AACnC,QAAM,aAAoC,EAAE,OAAO,SAAS,eAAe,mBAAmB,WAAW;AAGzG,QAAM,QAAQ,UAAU,UAAU,UAAU;AAE5C,SAAO;AAAA;AAAA,IAEL;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA,YAAY,aAAa;AAAA,EAC3B;AACF;AAQA,eAAsB,oBACpB,OACA,SACA,OAQe;AACf,QAAM,MAAM,KAAK;AAAA,IACf,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM,QAAQ,qBAAqB;AAAA,IAC/C,UAAU;AAAA,MACR,WAAW;AAAA,MACX,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC5C,GAAG,MAAM;AAAA,IACX;AAAA,EACF,CAAC;AACH;AAIA,SAAS,SAAS,KAAa,KAAqB;AAClD,SAAO,IAAI,SAAS,MAAM,IAAI,MAAM,GAAG,GAAG,IAAI,WAAM;AACtD;AAEA,SAAS,UAAU,OAAiB,OAAwB,OAAsB;AAChF,MAAI,OAAO;AACT,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC,OAAO;AACL,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC;AACF;AAOA,SAAS,wBAAwB,QAAgE;AAC/F,MAAI,CAAC,OAAQ,QAAO,aAAa,CAAC;AAClC,MAAI,SAAwC;AAC5C,SAAO,MAAM;AACX,QAAI,CAAC,OAAQ,UAAS,qBAAqB,MAAM;AACjD,WAAO;AAAA,EACT;AACF;","names":["event"]}

package/dist/integrations/llamaindex.d.cts

@@ -1,4 +1,4 @@
-import { VorimSDK, PermissionScope, AgentRegistrationResult } from '../index.cjs';
+import { VorimSDK, PermissionScope, ReplayInputs, AgentRegistrationResult } from '../index.cjs';
 
 /** Matches @llamaindex/core ToolMetadata */
 interface ToolMetadata<P extends Record<string, unknown> = Record<string, unknown>> {
@@ -25,6 +25,12 @@ interface VorimLlamaIndexConfig {
     defaultPermission?: PermissionScope;
     /** Whether to emit audit events asynchronously (fire-and-forget). @default true */
     asyncAudit?: boolean;
+    /**
+     * Replayable agent decision evidence (VAIP -02). Hashes attached to
+     * every audit event the wrapper emits. Not covered by v0 canonical
+     * signature form.
+     */
+    replay?: ReplayInputs;
 }
 /**
  * Wraps a LlamaIndex tool (`BaseTool` / `BaseToolWithCall` / `FunctionTool`)

package/dist/integrations/llamaindex.d.ts

@@ -1,4 +1,4 @@
-import { VorimSDK, PermissionScope, AgentRegistrationResult } from '../index.js';
+import { VorimSDK, PermissionScope, ReplayInputs, AgentRegistrationResult } from '../index.js';
 
 /** Matches @llamaindex/core ToolMetadata */
 interface ToolMetadata<P extends Record<string, unknown> = Record<string, unknown>> {
@@ -25,6 +25,12 @@ interface VorimLlamaIndexConfig {
     defaultPermission?: PermissionScope;
     /** Whether to emit audit events asynchronously (fire-and-forget). @default true */
     asyncAudit?: boolean;
+    /**
+     * Replayable agent decision evidence (VAIP -02). Hashes attached to
+     * every audit event the wrapper emits. Not covered by v0 canonical
+     * signature form.
+     */
+    replay?: ReplayInputs;
 }
 /**
  * Wraps a LlamaIndex tool (`BaseTool` / `BaseToolWithCall` / `FunctionTool`)

package/dist/integrations/llamaindex.js

@@ -1,3 +1,69 @@
+// src/replay.ts
+function jcsCanonicalise(value) {
+  if (value === null) return "null";
+  if (value === true) return "true";
+  if (value === false) return "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error("jcsCanonicalise: NaN and Infinity are not JCS-valid");
+    }
+    return value.toString();
+  }
+  if (typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map(jcsCanonicalise).join(",") + "]";
+  }
+  if (typeof value === "object") {
+    const keys = Object.keys(value).sort();
+    const parts = keys.map((k) => {
+      return JSON.stringify(k) + ":" + jcsCanonicalise(value[k]);
+    });
+    return "{" + parts.join(",") + "}";
+  }
+  throw new Error(`jcsCanonicalise: unsupported value type: ${typeof value}`);
+}
+async function sha256Hex(input) {
+  const bytes = typeof input === "string" ? new TextEncoder().encode(input) : input;
+  const subtle = globalThis.crypto?.subtle;
+  if (subtle) {
+    const buf = await subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  const nodeCrypto = await import("crypto");
+  return nodeCrypto.createHash("sha256").update(bytes).digest("hex");
+}
+async function hashTool(tool) {
+  const normalised = {
+    name: tool.name,
+    description: tool.description ?? "",
+    schema: tool.schema ?? {}
+  };
+  const hex = await sha256Hex(jcsCanonicalise(normalised));
+  return `sha256:${hex}`;
+}
+async function hashToolCatalogue(tools) {
+  if (tools.length === 0) {
+    return `sha256:${await sha256Hex("[]")}`;
+  }
+  const perTool = await Promise.all(tools.map(hashTool));
+  perTool.sort();
+  const hex = await sha256Hex(perTool.join(""));
+  return `sha256:${hex}`;
+}
+async function hashSystemPrompt(prompt) {
+  const hex = await sha256Hex(prompt);
+  return `sha256:${hex}`;
+}
+async function prepareReplayContext(inputs) {
+  const ctx = {};
+  if (inputs.modelVersion) ctx.model_version = inputs.modelVersion;
+  if (inputs.tools) ctx.tool_catalogue_hash = await hashToolCatalogue(inputs.tools);
+  if (inputs.systemPrompt) ctx.system_prompt_hash = await hashSystemPrompt(inputs.systemPrompt);
+  return ctx;
+}
+
 // src/integrations/llamaindex.ts
 function wrapTool(tool, config) {
   const {
@@ -5,16 +71,19 @@ function wrapTool(tool, config) {
     agentId,
     permissionMap = {},
     defaultPermission = "agent:execute",
-    asyncAudit = true
+    asyncAudit = true,
+    replay
   } = config;
   const originalCall = tool.call.bind(tool);
   const toolName = tool.metadata.name;
   const scope = permissionMap[toolName] ?? defaultPermission;
+  const getReplayCtx = makeReplayContextGetter(replay);
   const wrapped = Object.create(Object.getPrototypeOf(tool), {
     ...Object.getOwnPropertyDescriptors(tool),
     call: {
       value: async function vorimGuardedCall(input) {
         const { allowed, reason } = await vorim.check(agentId, scope);
+        const replayCtx = await getReplayCtx();
         if (!allowed) {
           const event2 = {
             agent_id: agentId,
@@ -23,7 +92,8 @@ function wrapTool(tool, config) {
             resource: truncate(JSON.stringify(input), 500),
             permission: scope,
             result: "denied",
-            metadata: { reason, framework: "llamaindex" }
+            metadata: { reason, framework: "llamaindex" },
+            ...replayCtx
           };
           emitAudit(vorim, event2, asyncAudit);
           throw new Error(
@@ -47,7 +117,8 @@ function wrapTool(tool, config) {
             metadata: {
               error: err instanceof Error ? err.message : String(err),
               framework: "llamaindex"
-            }
+            },
+            ...replayCtx
           };
           emitAudit(vorim, event2, asyncAudit);
           throw err;
@@ -60,7 +131,8 @@ function wrapTool(tool, config) {
           permission: scope,
           result: "success",
           latency_ms: Date.now() - start,
-          metadata: { framework: "llamaindex" }
+          metadata: { framework: "llamaindex" },
+          ...replayCtx
         };
         emitAudit(vorim, event, asyncAudit);
         return result;
@@ -125,6 +197,14 @@ function emitAudit(vorim, event, async) {
     });
   }
 }
+function makeReplayContextGetter(replay) {
+  if (!replay) return async () => ({});
+  let cached = null;
+  return () => {
+    if (!cached) cached = prepareReplayContext(replay);
+    return cached;
+  };
+}
 export {
   createVorimAgent,
   emitLlamaIndexEvent,

package/dist/integrations/llamaindex.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/integrations/llamaindex.ts"],"sourcesContent":["// ============================================================================\n// VORIM SDK — LlamaIndex TS Integration\n// Wraps LlamaIndex tools with Vorim permission checks + audit trails.\n// Provides a tool wrapper and agent registration factory.\n//\n// Peer dependency: llamaindex >=0.4.0 (or @llamaindex/core)\n// ============================================================================\n\nimport type { VorimSDK } from '../index.js';\nimport type { PermissionScope, AuditEventInput } from '../types.js';\n\n// ─── Re-declared LlamaIndex types (peer dependency — not bundled) ─────────\n// These mirror the actual interfaces from @llamaindex/core/llms and\n// @llamaindex/core/tools so consumers don't need to wrangle imports.\n\n/** Matches @llamaindex/core ToolMetadata */\ninterface ToolMetadata<P extends Record<string, unknown> = Record<string, unknown>> {\n  name: string;\n  description: string;\n  parameters?: P;\n}\n\n/**\n * Matches @llamaindex/core BaseTool.\n * In LlamaIndex, `call` is optional on BaseTool but required on BaseToolWithCall.\n */\ninterface LlamaIndexTool<Input = any> {\n  metadata: ToolMetadata;\n  call: (input: Input) => any | Promise<any>;\n}\n\n// ─── Configuration ────────────────────────────────────────────────────────\n\nexport interface VorimLlamaIndexConfig {\n  /** Vorim SDK instance. */\n  vorim: VorimSDK;\n  /** The Vorim agent_id to associate. */\n  agentId: string;\n  /** Map tool names → Vorim permission scopes. */\n  permissionMap?: Record<string, PermissionScope>;\n  /** Default permission scope for unmapped tools. @default 'agent:execute' */\n  defaultPermission?: PermissionScope;\n  /** Whether to emit audit events asynchronously (fire-and-forget). @default true */\n  asyncAudit?: boolean;\n}\n\n// ─── Tool Wrapper ─────────────────────────────────────────────────────────\n\n/**\n * Wraps a LlamaIndex tool (`BaseTool` / `BaseToolWithCall` / `FunctionTool`)\n * with Vorim permission checks before execution and audit event emission after.\n *\n * The wrapper implements the same `BaseTool` interface so it's a drop-in\n * replacement anywhere LlamaIndex expects a tool.\n *\n * @example\n * ```ts\n * import { FunctionTool } from \"llamaindex\";\n * import createVorim from \"@vorim/sdk\";\n * import { wrapTool } from \"@vorim/sdk/integrations/llamaindex\";\n *\n * const vorim = createVorim({ apiKey: \"agid_sk_live_...\" });\n *\n * const searchTool = FunctionTool.from(\n *   async ({ query }: { query: string }) => `Results for: ${query}`,\n *   { name: \"search\", description: \"Search documents\", parameters: { ... } }\n * );\n *\n * const guarded = wrapTool(searchTool, {\n *   vorim,\n *   agentId: \"agid_acme_a1b2c3d4\",\n *   permissionMap: { search: \"agent:read\" },\n * });\n *\n * // Use with any LlamaIndex agent\n * const agent = new OpenAIAgent({ tools: [guarded] });\n * ```\n */\nexport function wrapTool<T extends LlamaIndexTool>(\n  tool: T,\n  config: VorimLlamaIndexConfig,\n): T {\n  const {\n    vorim, agentId,\n    permissionMap = {},\n    defaultPermission = 'agent:execute',\n    asyncAudit = true,\n  } = config;\n\n  const originalCall = tool.call.bind(tool);\n  const toolName = tool.metadata.name;\n  const scope = permissionMap[toolName] ?? defaultPermission;\n\n  // Create a new object that preserves the tool's prototype chain\n  // and all properties, but overrides `call`\n  const wrapped = Object.create(Object.getPrototypeOf(tool), {\n    ...Object.getOwnPropertyDescriptors(tool),\n    call: {\n      value: async function vorimGuardedCall(input: any): Promise<any> {\n        // 1. Permission check\n        const { allowed, reason } = await vorim.check(agentId, scope);\n\n        if (!allowed) {\n          const event: AuditEventInput = {\n            agent_id: agentId,\n            event_type: 'tool_call',\n            action: toolName,\n            resource: truncate(JSON.stringify(input), 500),\n            permission: scope,\n            result: 'denied',\n            metadata: { reason, framework: 'llamaindex' },\n          };\n          emitAudit(vorim, event, asyncAudit);\n          throw new Error(\n            `Vorim: permission denied for \"${toolName}\" — scope \"${scope}\"${reason ? `: ${reason}` : ''}`,\n          );\n        }\n\n        // 2. Execute the original tool\n        const start = Date.now();\n        let result: any;\n        try {\n          result = await originalCall(input);\n        } catch (err) {\n          const event: AuditEventInput = {\n            agent_id: agentId,\n            event_type: 'tool_call',\n            action: toolName,\n            resource: truncate(JSON.stringify(input), 500),\n            permission: scope,\n            result: 'error',\n            latency_ms: Date.now() - start,\n            error_code: err instanceof Error ? err.name : 'UNKNOWN',\n            metadata: {\n              error: err instanceof Error ? err.message : String(err),\n              framework: 'llamaindex',\n            },\n          };\n          emitAudit(vorim, event, asyncAudit);\n          throw err;\n        }\n\n        // 3. Audit success\n        const event: AuditEventInput = {\n          agent_id: agentId,\n          event_type: 'tool_call',\n          action: toolName,\n          resource: truncate(JSON.stringify(input), 500),\n          permission: scope,\n          result: 'success',\n          latency_ms: Date.now() - start,\n          metadata: { framework: 'llamaindex' },\n        };\n        emitAudit(vorim, event, asyncAudit);\n\n        return result;\n      },\n      writable: true,\n      configurable: true,\n      enumerable: true,\n    },\n  }) as T;\n\n  return wrapped;\n}\n\n/**\n * Wraps an array of LlamaIndex tools with Vorim permission + audit.\n */\nexport function wrapTools<T extends LlamaIndexTool>(\n  tools: T[],\n  config: VorimLlamaIndexConfig,\n): T[] {\n  return tools.map(t => wrapTool(t, config));\n}\n\n// ─── Agent Factory ────────────────────────────────────────────────────────\n\nexport interface CreateVorimLlamaIndexAgentConfig extends VorimLlamaIndexConfig {\n  /** Display name for the agent. */\n  name: string;\n  /** Agent capabilities. */\n  capabilities: string[];\n  /** Initial permission scopes. */\n  scopes: PermissionScope[];\n  /** Optional description. */\n  description?: string;\n}\n\n/**\n * Registers a new agent with Vorim and returns wrapped tools ready for\n * use with any LlamaIndex agent (OpenAIAgent, ReActAgent, etc.).\n *\n * @example\n * ```ts\n * import { OpenAIAgent, FunctionTool } from \"llamaindex\";\n * import createVorim from \"@vorim/sdk\";\n * import { createVorimAgent } from \"@vorim/sdk/integrations/llamaindex\";\n *\n * const vorim = createVorim({ apiKey: \"agid_sk_live_...\" });\n *\n * const searchTool = FunctionTool.from(...);\n * const writeTool = FunctionTool.from(...);\n *\n * const { agentId, tools } = await createVorimAgent({\n *   vorim,\n *   name: \"research-agent\",\n *   capabilities: [\"search\", \"write\"],\n *   scopes: [\"agent:read\", \"agent:write\", \"agent:execute\"],\n *   tools: [searchTool, writeTool],\n *   permissionMap: {\n *     search: \"agent:read\",\n *     write: \"agent:write\",\n *   },\n * });\n *\n * // Create LlamaIndex agent with Vorim-wrapped tools\n * const agent = new OpenAIAgent({ tools });\n * const response = await agent.chat({ message: \"Research AI trends\" });\n * ```\n */\nexport async function createVorimAgent<T extends LlamaIndexTool>(\n  config: CreateVorimLlamaIndexAgentConfig & { tools: T[] },\n) {\n  const { vorim, name, capabilities, scopes, description, tools: rawTools, permissionMap, defaultPermission, asyncAudit } = config;\n\n  // Register agent with Vorim\n  const registration = await vorim.register({\n    name,\n    description,\n    capabilities,\n    scopes,\n  });\n\n  const agentId = registration.agent.agent_id;\n  const toolConfig: VorimLlamaIndexConfig = { vorim, agentId, permissionMap, defaultPermission, asyncAudit };\n\n  // Wrap tools with permission checks\n  const tools = wrapTools(rawTools, toolConfig);\n\n  return {\n    /** The Vorim agent_id. */\n    agentId,\n    /** Full registration result. */\n    registration,\n    /** Tools wrapped with Vorim permission checks + audit. */\n    tools,\n    /** The private key (store securely — shown once). */\n    privateKey: registration.private_key,\n  };\n}\n\n// ─── Audit Helpers ────────────────────────────────────────────────────────\n\n/**\n * Emit a manual audit event for a LlamaIndex agent action that isn't\n * captured by the tool wrapper (e.g. RAG retrieval, chat responses).\n */\nexport async function emitLlamaIndexEvent(\n  vorim: VorimSDK,\n  agentId: string,\n  event: {\n    action: string;\n    resource?: string;\n    result: 'success' | 'denied' | 'error';\n    latencyMs?: number;\n    error?: string;\n    metadata?: Record<string, unknown>;\n  },\n): Promise<void> {\n  await vorim.emit({\n    agent_id: agentId,\n    event_type: 'api_request',\n    action: event.action,\n    resource: event.resource,\n    result: event.result,\n    latency_ms: event.latencyMs,\n    error_code: event.error ? 'LLAMAINDEX_ERROR' : undefined,\n    metadata: {\n      framework: 'llamaindex',\n      ...(event.error ? { error: event.error } : {}),\n      ...event.metadata,\n    },\n  });\n}\n\n// ─── Internal helpers ─────────────────────────────────────────────────────\n\nfunction truncate(str: string, max: number): string {\n  return str.length > max ? str.slice(0, max) + '…' : str;\n}\n\nfunction emitAudit(vorim: VorimSDK, event: AuditEventInput, async: boolean): void {\n  if (async) {\n    vorim.emit(event).catch(() => {});\n  } else {\n    vorim.emit(event).catch(() => {});\n  }\n}\n"],"mappings":";AA8EO,SAAS,SACd,MACA,QACG;AACH,QAAM;AAAA,IACJ;AAAA,IAAO;AAAA,IACP,gBAAgB,CAAC;AAAA,IACjB,oBAAoB;AAAA,IACpB,aAAa;AAAA,EACf,IAAI;AAEJ,QAAM,eAAe,KAAK,KAAK,KAAK,IAAI;AACxC,QAAM,WAAW,KAAK,SAAS;AAC/B,QAAM,QAAQ,cAAc,QAAQ,KAAK;AAIzC,QAAM,UAAU,OAAO,OAAO,OAAO,eAAe,IAAI,GAAG;AAAA,IACzD,GAAG,OAAO,0BAA0B,IAAI;AAAA,IACxC,MAAM;AAAA,MACJ,OAAO,eAAe,iBAAiB,OAA0B;AAE/D,cAAM,EAAE,SAAS,OAAO,IAAI,MAAM,MAAM,MAAM,SAAS,KAAK;AAE5D,YAAI,CAAC,SAAS;AACZ,gBAAMA,SAAyB;AAAA,YAC7B,UAAU;AAAA,YACV,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,YAC7C,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,EAAE,QAAQ,WAAW,aAAa;AAAA,UAC9C;AACA,oBAAU,OAAOA,QAAO,UAAU;AAClC,gBAAM,IAAI;AAAA,YACR,iCAAiC,QAAQ,mBAAc,KAAK,IAAI,SAAS,KAAK,MAAM,KAAK,EAAE;AAAA,UAC7F;AAAA,QACF;AAGA,cAAM,QAAQ,KAAK,IAAI;AACvB,YAAI;AACJ,YAAI;AACF,mBAAS,MAAM,aAAa,KAAK;AAAA,QACnC,SAAS,KAAK;AACZ,gBAAMA,SAAyB;AAAA,YAC7B,UAAU;AAAA,YACV,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,YAC7C,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,YAAY,KAAK,IAAI,IAAI;AAAA,YACzB,YAAY,eAAe,QAAQ,IAAI,OAAO;AAAA,YAC9C,UAAU;AAAA,cACR,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,cACtD,WAAW;AAAA,YACb;AAAA,UACF;AACA,oBAAU,OAAOA,QAAO,UAAU;AAClC,gBAAM;AAAA,QACR;AAGA,cAAM,QAAyB;AAAA,UAC7B,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,QAAQ;AAAA,UACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,UAC7C,YAAY;AAAA,UACZ,QAAQ;AAAA,UACR,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,UAAU,EAAE,WAAW,aAAa;AAAA,QACtC;AACA,kBAAU,OAAO,OAAO,UAAU;AAElC,eAAO;AAAA,MACT;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAKO,SAAS,UACd,OACA,QACK;AACL,SAAO,MAAM,IAAI,OAAK,SAAS,GAAG,MAAM,CAAC;AAC3C;AA+CA,eAAsB,iBACpB,QACA;AACA,QAAM,EAAE,OAAO,MAAM,cAAc,QAAQ,aAAa,OAAO,UAAU,eAAe,mBAAmB,WAAW,IAAI;AAG1H,QAAM,eAAe,MAAM,MAAM,SAAS;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,aAAa,MAAM;AACnC,QAAM,aAAoC,EAAE,OAAO,SAAS,eAAe,mBAAmB,WAAW;AAGzG,QAAM,QAAQ,UAAU,UAAU,UAAU;AAE5C,SAAO;AAAA;AAAA,IAEL;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA,YAAY,aAAa;AAAA,EAC3B;AACF;AAQA,eAAsB,oBACpB,OACA,SACA,OAQe;AACf,QAAM,MAAM,KAAK;AAAA,IACf,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM,QAAQ,qBAAqB;AAAA,IAC/C,UAAU;AAAA,MACR,WAAW;AAAA,MACX,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC5C,GAAG,MAAM;AAAA,IACX;AAAA,EACF,CAAC;AACH;AAIA,SAAS,SAAS,KAAa,KAAqB;AAClD,SAAO,IAAI,SAAS,MAAM,IAAI,MAAM,GAAG,GAAG,IAAI,WAAM;AACtD;AAEA,SAAS,UAAU,OAAiB,OAAwB,OAAsB;AAChF,MAAI,OAAO;AACT,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC,OAAO;AACL,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC;AACF;","names":["event"]}
+{"version":3,"sources":["../../src/replay.ts","../../src/integrations/llamaindex.ts"],"sourcesContent":["/**\n * Replayable agent decision evidence helpers.\n *\n * Canonical-form hashing for the VAIP -02 schema fields that the SDK\n * attaches to audit events. The hashes recorded in audit_events.tool_catalogue_hash\n * and audit_events.system_prompt_hash use these functions, so the bytes\n * an auditor or counterparty reconstructs must match what the SDK produced.\n *\n * These helpers are intentionally separate from the signing path. The\n * v0 canonical signature form (event_type|action|resource|input_hash|\n * output_hash|result) does NOT cover model_version, tool_catalogue_hash,\n * or system_prompt_hash. They will enter the canonical bytes in v1\n * (RFC 8785 JCS) in a follow-up release.\n *\n * Stable across SDK versions: the canonical-form version is documented\n * in CANONICAL_TOOL_CATALOGUE_VERSION. Future changes get a v2 etc;\n * never edit the existing v1 logic, or already-recorded hashes lose\n * their meaning.\n */\n\n// ─── Versioning ───────────────────────────────────────────────────────────\n\n/**\n * Canonical-form version for tool catalogue hashes produced by this SDK.\n * Recorded in tool_catalogue_canon_version on the event metadata (when\n * the metadata field is used) so verifiers know which hash recipe to\n * reproduce. Increment ONLY if the algorithm changes in a way that\n * would change the hash for the same logical catalogue.\n */\nexport const CANONICAL_TOOL_CATALOGUE_VERSION = 'v1' as const;\n\n// ─── Types ────────────────────────────────────────────────────────────────\n\n/**\n * Minimum shape a tool needs for catalogue hashing. The framework\n * integrations adapt their native tool objects to this shape before\n * calling hashToolCatalogue.\n */\nexport interface CatalogueTool {\n  /** The name the model sees and calls. Required. */\n  name: string;\n  /** Human-readable description shown to the model. Optional; absent ↔ empty string. */\n  description?: string;\n  /**\n   * JSON Schema describing the tool's input parameters. Optional;\n   * absent ↔ empty object `{}`. The schema gets RFC 8785 JCS-canonicalised\n   * before hashing so semantically-equivalent variations (key order,\n   * whitespace) produce the same hash.\n   */\n  schema?: Record<string, unknown> | null;\n}\n\n// ─── RFC 8785 JCS subset ──────────────────────────────────────────────────\n\n/**\n * RFC 8785 JSON Canonicalization Scheme, sufficient subset for tool\n * catalogue values.\n *\n * Rules:\n *  - Object keys sorted lexicographically by UTF-16 code units (which\n *    is what JS string comparison does naturally).\n *  - No whitespace between tokens.\n *  - Numbers: integers as integers, finite floats per ECMAScript\n *    Number.prototype.toString. JCS forbids NaN and Infinity.\n *  - Strings: JSON-escape using minimal set per RFC 8259 § 7.\n *  - null, true, false, arrays: as JSON.stringify produces them, since\n *    JSON.stringify already produces the canonical form for these.\n *\n * Not vendoring a full library because tool schemas don't carry\n * non-integer numbers in practice and the JS spec for Number.toString\n * happens to coincide with JCS § 3.2.2.2 for the integer case.\n */\nexport function jcsCanonicalise(value: unknown): string {\n  if (value === null) return 'null';\n  if (value === true) return 'true';\n  if (value === false) return 'false';\n\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) {\n      throw new Error('jcsCanonicalise: NaN and Infinity are not JCS-valid');\n    }\n    // For integers in safe range, .toString() matches JCS. For\n    // non-integer floats, .toString() also matches in modern JS\n    // engines (V8, JavaScriptCore, SpiderMonkey all use the shortest\n    // round-trip representation, which is what JCS § 3.2.2.2 requires).\n    return value.toString();\n  }\n\n  if (typeof value === 'string') {\n    return JSON.stringify(value);\n  }\n\n  if (Array.isArray(value)) {\n    return '[' + value.map(jcsCanonicalise).join(',') + ']';\n  }\n\n  if (typeof value === 'object') {\n    const keys = Object.keys(value as Record<string, unknown>).sort();\n    const parts = keys.map(k => {\n      return JSON.stringify(k) + ':' + jcsCanonicalise((value as Record<string, unknown>)[k]);\n    });\n    return '{' + parts.join(',') + '}';\n  }\n\n  // undefined, function, symbol, bigint — not JSON-representable\n  throw new Error(`jcsCanonicalise: unsupported value type: ${typeof value}`);\n}\n\n// ─── SHA-256 ──────────────────────────────────────────────────────────────\n\nasync function sha256Hex(input: string | Uint8Array): Promise<string> {\n  const bytes = typeof input === 'string' ? new TextEncoder().encode(input) : input;\n\n  // Node.js Web Crypto (Node 18+) supports digest. Browser Web Crypto does too.\n  // Fall back to node:crypto if Web Crypto is unavailable.\n  const subtle = (globalThis as any).crypto?.subtle;\n  if (subtle) {\n    const buf = await subtle.digest('SHA-256', bytes);\n    return Array.from(new Uint8Array(buf))\n      .map(b => b.toString(16).padStart(2, '0'))\n      .join('');\n  }\n\n  // Node fallback\n  const nodeCrypto = await import('node:crypto');\n  return nodeCrypto.createHash('sha256').update(bytes).digest('hex');\n}\n\n// ─── Public API ───────────────────────────────────────────────────────────\n\n/**\n * Hash a single tool definition. Returns `sha256:<hex>`.\n *\n * Canonical form (v1):\n *   JCS-canonicalised JSON of `{name, description, schema}` where\n *   absent fields substitute `description: \"\"` and `schema: {}`.\n */\nexport async function hashTool(tool: CatalogueTool): Promise<string> {\n  const normalised = {\n    name: tool.name,\n    description: tool.description ?? '',\n    schema: tool.schema ?? {},\n  };\n  const hex = await sha256Hex(jcsCanonicalise(normalised));\n  return `sha256:${hex}`;\n}\n\n/**\n * Hash an entire tool catalogue. Returns `sha256:<hex>`.\n *\n * Reordering tools does NOT change the hash (tool hashes sorted\n * lexicographically before concatenation). Adding, removing, or\n * modifying a tool DOES change the hash.\n *\n * Per-tool hashing first means a verifier comparing two catalogue\n * hashes that differ can also be given the per-tool hashes to\n * identify which specific tool changed.\n */\nexport async function hashToolCatalogue(tools: CatalogueTool[]): Promise<string> {\n  if (tools.length === 0) {\n    // Empty catalogue has a deterministic, stable hash distinct from \"no field\"\n    return `sha256:${await sha256Hex('[]')}`;\n  }\n  const perTool = await Promise.all(tools.map(hashTool));\n  perTool.sort();\n  const hex = await sha256Hex(perTool.join(''));\n  return `sha256:${hex}`;\n}\n\n/**\n * Hash a system prompt. Returns `sha256:<hex>`.\n *\n * The prompt is UTF-8 encoded and hashed verbatim — no normalisation.\n * If a caller wants to ignore whitespace or comment differences, they\n * should normalise before calling. The intent here is deterministic\n * reproducibility, not semantic equivalence.\n */\nexport async function hashSystemPrompt(prompt: string): Promise<string> {\n  const hex = await sha256Hex(prompt);\n  return `sha256:${hex}`;\n}\n\n/**\n * Convenience: hash the previous event's canonical bytes for use in\n * the prev_event_hash field of hash-chained ingest. Caller provides\n * the canonical bytes (use canonicalPayloadV0 from the main module).\n */\nexport async function hashPreviousEvent(canonicalBytes: string): Promise<string> {\n  const hex = await sha256Hex(canonicalBytes);\n  return `sha256:${hex}`;\n}\n\n// ─── Replay context — framework integration helper ────────────────────────\n\n/**\n * Raw inputs the integration captures from the framework. Set by the\n * integration's config; turned into hashes by {@link prepareReplayContext}.\n */\nexport interface ReplayInputs {\n  /** Stable identifier for the model. E.g. `\"anthropic:claude-opus-4-8\"`. */\n  modelVersion?: string;\n  /** Tools available to the agent at call time. Hashed via {@link hashToolCatalogue}. */\n  tools?: CatalogueTool[];\n  /** System prompt active at call time. Hashed via {@link hashSystemPrompt}. */\n  systemPrompt?: string;\n}\n\n/**\n * Pre-computed hashes ready to attach to audit events. The three keys\n * match the audit_events column names.\n */\nexport interface ReplayContext {\n  model_version?: string;\n  tool_catalogue_hash?: string;\n  system_prompt_hash?: string;\n}\n\n/**\n * Compute replay context once from raw inputs. Use at integration\n * setup time so each emit can attach the hashes without re-hashing.\n *\n * Returns an object suitable for spreading into an AuditEventInput:\n *   `await vorim.emit({ ...event, ...replayContext })`\n *\n * If a field is absent in the inputs, it is absent in the result\n * (not the empty string). That keeps the event lean.\n */\nexport async function prepareReplayContext(\n  inputs: ReplayInputs,\n): Promise<ReplayContext> {\n  const ctx: ReplayContext = {};\n  if (inputs.modelVersion) ctx.model_version = inputs.modelVersion;\n  if (inputs.tools) ctx.tool_catalogue_hash = await hashToolCatalogue(inputs.tools);\n  if (inputs.systemPrompt) ctx.system_prompt_hash = await hashSystemPrompt(inputs.systemPrompt);\n  return ctx;\n}\n","// ============================================================================\n// VORIM SDK — LlamaIndex TS Integration\n// Wraps LlamaIndex tools with Vorim permission checks + audit trails.\n// Provides a tool wrapper and agent registration factory.\n//\n// Peer dependency: llamaindex >=0.4.0 (or @llamaindex/core)\n// ============================================================================\n\nimport type { VorimSDK } from '../index.js';\nimport type { PermissionScope, AuditEventInput } from '../types.js';\nimport {\n  prepareReplayContext,\n  type ReplayInputs,\n  type ReplayContext,\n  type CatalogueTool,\n} from '../replay.js';\n\n// ─── Re-declared LlamaIndex types (peer dependency — not bundled) ─────────\n// These mirror the actual interfaces from @llamaindex/core/llms and\n// @llamaindex/core/tools so consumers don't need to wrangle imports.\n\n/** Matches @llamaindex/core ToolMetadata */\ninterface ToolMetadata<P extends Record<string, unknown> = Record<string, unknown>> {\n  name: string;\n  description: string;\n  parameters?: P;\n}\n\n/**\n * Matches @llamaindex/core BaseTool.\n * In LlamaIndex, `call` is optional on BaseTool but required on BaseToolWithCall.\n */\ninterface LlamaIndexTool<Input = any> {\n  metadata: ToolMetadata;\n  call: (input: Input) => any | Promise<any>;\n}\n\n// ─── Configuration ────────────────────────────────────────────────────────\n\nexport interface VorimLlamaIndexConfig {\n  /** Vorim SDK instance. */\n  vorim: VorimSDK;\n  /** The Vorim agent_id to associate. */\n  agentId: string;\n  /** Map tool names → Vorim permission scopes. */\n  permissionMap?: Record<string, PermissionScope>;\n  /** Default permission scope for unmapped tools. @default 'agent:execute' */\n  defaultPermission?: PermissionScope;\n  /** Whether to emit audit events asynchronously (fire-and-forget). @default true */\n  asyncAudit?: boolean;\n  /**\n   * Replayable agent decision evidence (VAIP -02). Hashes attached to\n   * every audit event the wrapper emits. Not covered by v0 canonical\n   * signature form.\n   */\n  replay?: ReplayInputs;\n}\n\n// ─── Tool Wrapper ─────────────────────────────────────────────────────────\n\n/**\n * Wraps a LlamaIndex tool (`BaseTool` / `BaseToolWithCall` / `FunctionTool`)\n * with Vorim permission checks before execution and audit event emission after.\n *\n * The wrapper implements the same `BaseTool` interface so it's a drop-in\n * replacement anywhere LlamaIndex expects a tool.\n *\n * @example\n * ```ts\n * import { FunctionTool } from \"llamaindex\";\n * import createVorim from \"@vorim/sdk\";\n * import { wrapTool } from \"@vorim/sdk/integrations/llamaindex\";\n *\n * const vorim = createVorim({ apiKey: \"agid_sk_live_...\" });\n *\n * const searchTool = FunctionTool.from(\n *   async ({ query }: { query: string }) => `Results for: ${query}`,\n *   { name: \"search\", description: \"Search documents\", parameters: { ... } }\n * );\n *\n * const guarded = wrapTool(searchTool, {\n *   vorim,\n *   agentId: \"agid_acme_a1b2c3d4\",\n *   permissionMap: { search: \"agent:read\" },\n * });\n *\n * // Use with any LlamaIndex agent\n * const agent = new OpenAIAgent({ tools: [guarded] });\n * ```\n */\nexport function wrapTool<T extends LlamaIndexTool>(\n  tool: T,\n  config: VorimLlamaIndexConfig,\n): T {\n  const {\n    vorim, agentId,\n    permissionMap = {},\n    defaultPermission = 'agent:execute',\n    asyncAudit = true,\n    replay,\n  } = config;\n\n  const originalCall = tool.call.bind(tool);\n  const toolName = tool.metadata.name;\n  const scope = permissionMap[toolName] ?? defaultPermission;\n  const getReplayCtx = makeReplayContextGetter(replay);\n\n  // Create a new object that preserves the tool's prototype chain\n  // and all properties, but overrides `call`\n  const wrapped = Object.create(Object.getPrototypeOf(tool), {\n    ...Object.getOwnPropertyDescriptors(tool),\n    call: {\n      value: async function vorimGuardedCall(input: any): Promise<any> {\n        // 1. Permission check\n        const { allowed, reason } = await vorim.check(agentId, scope);\n        const replayCtx = await getReplayCtx();\n\n        if (!allowed) {\n          const event: AuditEventInput = {\n            agent_id: agentId,\n            event_type: 'tool_call',\n            action: toolName,\n            resource: truncate(JSON.stringify(input), 500),\n            permission: scope,\n            result: 'denied',\n            metadata: { reason, framework: 'llamaindex' },\n            ...replayCtx,\n          };\n          emitAudit(vorim, event, asyncAudit);\n          throw new Error(\n            `Vorim: permission denied for \"${toolName}\" — scope \"${scope}\"${reason ? `: ${reason}` : ''}`,\n          );\n        }\n\n        // 2. Execute the original tool\n        const start = Date.now();\n        let result: any;\n        try {\n          result = await originalCall(input);\n        } catch (err) {\n          const event: AuditEventInput = {\n            agent_id: agentId,\n            event_type: 'tool_call',\n            action: toolName,\n            resource: truncate(JSON.stringify(input), 500),\n            permission: scope,\n            result: 'error',\n            latency_ms: Date.now() - start,\n            error_code: err instanceof Error ? err.name : 'UNKNOWN',\n            metadata: {\n              error: err instanceof Error ? err.message : String(err),\n              framework: 'llamaindex',\n            },\n            ...replayCtx,\n          };\n          emitAudit(vorim, event, asyncAudit);\n          throw err;\n        }\n\n        // 3. Audit success\n        const event: AuditEventInput = {\n          agent_id: agentId,\n          event_type: 'tool_call',\n          action: toolName,\n          resource: truncate(JSON.stringify(input), 500),\n          permission: scope,\n          result: 'success',\n          latency_ms: Date.now() - start,\n          metadata: { framework: 'llamaindex' },\n          ...replayCtx,\n        };\n        emitAudit(vorim, event, asyncAudit);\n\n        return result;\n      },\n      writable: true,\n      configurable: true,\n      enumerable: true,\n    },\n  }) as T;\n\n  return wrapped;\n}\n\n/**\n * Wraps an array of LlamaIndex tools with Vorim permission + audit.\n */\nexport function wrapTools<T extends LlamaIndexTool>(\n  tools: T[],\n  config: VorimLlamaIndexConfig,\n): T[] {\n  return tools.map(t => wrapTool(t, config));\n}\n\n// ─── Agent Factory ────────────────────────────────────────────────────────\n\nexport interface CreateVorimLlamaIndexAgentConfig extends VorimLlamaIndexConfig {\n  /** Display name for the agent. */\n  name: string;\n  /** Agent capabilities. */\n  capabilities: string[];\n  /** Initial permission scopes. */\n  scopes: PermissionScope[];\n  /** Optional description. */\n  description?: string;\n}\n\n/**\n * Registers a new agent with Vorim and returns wrapped tools ready for\n * use with any LlamaIndex agent (OpenAIAgent, ReActAgent, etc.).\n *\n * @example\n * ```ts\n * import { OpenAIAgent, FunctionTool } from \"llamaindex\";\n * import createVorim from \"@vorim/sdk\";\n * import { createVorimAgent } from \"@vorim/sdk/integrations/llamaindex\";\n *\n * const vorim = createVorim({ apiKey: \"agid_sk_live_...\" });\n *\n * const searchTool = FunctionTool.from(...);\n * const writeTool = FunctionTool.from(...);\n *\n * const { agentId, tools } = await createVorimAgent({\n *   vorim,\n *   name: \"research-agent\",\n *   capabilities: [\"search\", \"write\"],\n *   scopes: [\"agent:read\", \"agent:write\", \"agent:execute\"],\n *   tools: [searchTool, writeTool],\n *   permissionMap: {\n *     search: \"agent:read\",\n *     write: \"agent:write\",\n *   },\n * });\n *\n * // Create LlamaIndex agent with Vorim-wrapped tools\n * const agent = new OpenAIAgent({ tools });\n * const response = await agent.chat({ message: \"Research AI trends\" });\n * ```\n */\nexport async function createVorimAgent<T extends LlamaIndexTool>(\n  config: CreateVorimLlamaIndexAgentConfig & { tools: T[] },\n) {\n  const { vorim, name, capabilities, scopes, description, tools: rawTools, permissionMap, defaultPermission, asyncAudit } = config;\n\n  // Register agent with Vorim\n  const registration = await vorim.register({\n    name,\n    description,\n    capabilities,\n    scopes,\n  });\n\n  const agentId = registration.agent.agent_id;\n  const toolConfig: VorimLlamaIndexConfig = { vorim, agentId, permissionMap, defaultPermission, asyncAudit };\n\n  // Wrap tools with permission checks\n  const tools = wrapTools(rawTools, toolConfig);\n\n  return {\n    /** The Vorim agent_id. */\n    agentId,\n    /** Full registration result. */\n    registration,\n    /** Tools wrapped with Vorim permission checks + audit. */\n    tools,\n    /** The private key (store securely — shown once). */\n    privateKey: registration.private_key,\n  };\n}\n\n// ─── Audit Helpers ────────────────────────────────────────────────────────\n\n/**\n * Emit a manual audit event for a LlamaIndex agent action that isn't\n * captured by the tool wrapper (e.g. RAG retrieval, chat responses).\n */\nexport async function emitLlamaIndexEvent(\n  vorim: VorimSDK,\n  agentId: string,\n  event: {\n    action: string;\n    resource?: string;\n    result: 'success' | 'denied' | 'error';\n    latencyMs?: number;\n    error?: string;\n    metadata?: Record<string, unknown>;\n  },\n): Promise<void> {\n  await vorim.emit({\n    agent_id: agentId,\n    event_type: 'api_request',\n    action: event.action,\n    resource: event.resource,\n    result: event.result,\n    latency_ms: event.latencyMs,\n    error_code: event.error ? 'LLAMAINDEX_ERROR' : undefined,\n    metadata: {\n      framework: 'llamaindex',\n      ...(event.error ? { error: event.error } : {}),\n      ...event.metadata,\n    },\n  });\n}\n\n// ─── Internal helpers ─────────────────────────────────────────────────────\n\nfunction truncate(str: string, max: number): string {\n  return str.length > max ? str.slice(0, max) + '…' : str;\n}\n\nfunction emitAudit(vorim: VorimSDK, event: AuditEventInput, async: boolean): void {\n  if (async) {\n    vorim.emit(event).catch(() => {});\n  } else {\n    vorim.emit(event).catch(() => {});\n  }\n}\n\n/**\n * Lazy-cached replay context getter. Hashes computed once on first\n * call, reused thereafter. Returns empty object when no replay config\n * was given, so the spread is a no-op.\n */\nfunction makeReplayContextGetter(replay: ReplayInputs | undefined): () => Promise<ReplayContext> {\n  if (!replay) return async () => ({});\n  let cached: Promise<ReplayContext> | null = null;\n  return () => {\n    if (!cached) cached = prepareReplayContext(replay);\n    return cached;\n  };\n}\n"],"mappings":";AAwEO,SAAS,gBAAgB,OAAwB;AACtD,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,MAAO,QAAO;AAE5B,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AAKA,WAAO,MAAM,SAAS;AAAA,EACxB;AAEA,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,KAAK,UAAU,KAAK;AAAA,EAC7B;AAEA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,MAAM,IAAI,eAAe,EAAE,KAAK,GAAG,IAAI;AAAA,EACtD;AAEA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,OAAO,OAAO,KAAK,KAAgC,EAAE,KAAK;AAChE,UAAM,QAAQ,KAAK,IAAI,OAAK;AAC1B,aAAO,KAAK,UAAU,CAAC,IAAI,MAAM,gBAAiB,MAAkC,CAAC,CAAC;AAAA,IACxF,CAAC;AACD,WAAO,MAAM,MAAM,KAAK,GAAG,IAAI;AAAA,EACjC;AAGA,QAAM,IAAI,MAAM,4CAA4C,OAAO,KAAK,EAAE;AAC5E;AAIA,eAAe,UAAU,OAA6C;AACpE,QAAM,QAAQ,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAI;AAI5E,QAAM,SAAU,WAAmB,QAAQ;AAC3C,MAAI,QAAQ;AACV,UAAM,MAAM,MAAM,OAAO,OAAO,WAAW,KAAK;AAChD,WAAO,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,EAClC,IAAI,OAAK,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EACxC,KAAK,EAAE;AAAA,EACZ;AAGA,QAAM,aAAa,MAAM,OAAO,QAAa;AAC7C,SAAO,WAAW,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACnE;AAWA,eAAsB,SAAS,MAAsC;AACnE,QAAM,aAAa;AAAA,IACjB,MAAM,KAAK;AAAA,IACX,aAAa,KAAK,eAAe;AAAA,IACjC,QAAQ,KAAK,UAAU,CAAC;AAAA,EAC1B;AACA,QAAM,MAAM,MAAM,UAAU,gBAAgB,UAAU,CAAC;AACvD,SAAO,UAAU,GAAG;AACtB;AAaA,eAAsB,kBAAkB,OAAyC;AAC/E,MAAI,MAAM,WAAW,GAAG;AAEtB,WAAO,UAAU,MAAM,UAAU,IAAI,CAAC;AAAA,EACxC;AACA,QAAM,UAAU,MAAM,QAAQ,IAAI,MAAM,IAAI,QAAQ,CAAC;AACrD,UAAQ,KAAK;AACb,QAAM,MAAM,MAAM,UAAU,QAAQ,KAAK,EAAE,CAAC;AAC5C,SAAO,UAAU,GAAG;AACtB;AAUA,eAAsB,iBAAiB,QAAiC;AACtE,QAAM,MAAM,MAAM,UAAU,MAAM;AAClC,SAAO,UAAU,GAAG;AACtB;AA+CA,eAAsB,qBACpB,QACwB;AACxB,QAAM,MAAqB,CAAC;AAC5B,MAAI,OAAO,aAAc,KAAI,gBAAgB,OAAO;AACpD,MAAI,OAAO,MAAO,KAAI,sBAAsB,MAAM,kBAAkB,OAAO,KAAK;AAChF,MAAI,OAAO,aAAc,KAAI,qBAAqB,MAAM,iBAAiB,OAAO,YAAY;AAC5F,SAAO;AACT;;;ACjJO,SAAS,SACd,MACA,QACG;AACH,QAAM;AAAA,IACJ;AAAA,IAAO;AAAA,IACP,gBAAgB,CAAC;AAAA,IACjB,oBAAoB;AAAA,IACpB,aAAa;AAAA,IACb;AAAA,EACF,IAAI;AAEJ,QAAM,eAAe,KAAK,KAAK,KAAK,IAAI;AACxC,QAAM,WAAW,KAAK,SAAS;AAC/B,QAAM,QAAQ,cAAc,QAAQ,KAAK;AACzC,QAAM,eAAe,wBAAwB,MAAM;AAInD,QAAM,UAAU,OAAO,OAAO,OAAO,eAAe,IAAI,GAAG;AAAA,IACzD,GAAG,OAAO,0BAA0B,IAAI;AAAA,IACxC,MAAM;AAAA,MACJ,OAAO,eAAe,iBAAiB,OAA0B;AAE/D,cAAM,EAAE,SAAS,OAAO,IAAI,MAAM,MAAM,MAAM,SAAS,KAAK;AAC5D,cAAM,YAAY,MAAM,aAAa;AAErC,YAAI,CAAC,SAAS;AACZ,gBAAMA,SAAyB;AAAA,YAC7B,UAAU;AAAA,YACV,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,YAC7C,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,EAAE,QAAQ,WAAW,aAAa;AAAA,YAC5C,GAAG;AAAA,UACL;AACA,oBAAU,OAAOA,QAAO,UAAU;AAClC,gBAAM,IAAI;AAAA,YACR,iCAAiC,QAAQ,mBAAc,KAAK,IAAI,SAAS,KAAK,MAAM,KAAK,EAAE;AAAA,UAC7F;AAAA,QACF;AAGA,cAAM,QAAQ,KAAK,IAAI;AACvB,YAAI;AACJ,YAAI;AACF,mBAAS,MAAM,aAAa,KAAK;AAAA,QACnC,SAAS,KAAK;AACZ,gBAAMA,SAAyB;AAAA,YAC7B,UAAU;AAAA,YACV,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,YAC7C,YAAY;AAAA,YACZ,QAAQ;AAAA,YACR,YAAY,KAAK,IAAI,IAAI;AAAA,YACzB,YAAY,eAAe,QAAQ,IAAI,OAAO;AAAA,YAC9C,UAAU;AAAA,cACR,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,cACtD,WAAW;AAAA,YACb;AAAA,YACA,GAAG;AAAA,UACL;AACA,oBAAU,OAAOA,QAAO,UAAU;AAClC,gBAAM;AAAA,QACR;AAGA,cAAM,QAAyB;AAAA,UAC7B,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,QAAQ;AAAA,UACR,UAAU,SAAS,KAAK,UAAU,KAAK,GAAG,GAAG;AAAA,UAC7C,YAAY;AAAA,UACZ,QAAQ;AAAA,UACR,YAAY,KAAK,IAAI,IAAI;AAAA,UACzB,UAAU,EAAE,WAAW,aAAa;AAAA,UACpC,GAAG;AAAA,QACL;AACA,kBAAU,OAAO,OAAO,UAAU;AAElC,eAAO;AAAA,MACT;AAAA,MACA,UAAU;AAAA,MACV,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAKO,SAAS,UACd,OACA,QACK;AACL,SAAO,MAAM,IAAI,OAAK,SAAS,GAAG,MAAM,CAAC;AAC3C;AA+CA,eAAsB,iBACpB,QACA;AACA,QAAM,EAAE,OAAO,MAAM,cAAc,QAAQ,aAAa,OAAO,UAAU,eAAe,mBAAmB,WAAW,IAAI;AAG1H,QAAM,eAAe,MAAM,MAAM,SAAS;AAAA,IACxC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,QAAM,UAAU,aAAa,MAAM;AACnC,QAAM,aAAoC,EAAE,OAAO,SAAS,eAAe,mBAAmB,WAAW;AAGzG,QAAM,QAAQ,UAAU,UAAU,UAAU;AAE5C,SAAO;AAAA;AAAA,IAEL;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA,YAAY,aAAa;AAAA,EAC3B;AACF;AAQA,eAAsB,oBACpB,OACA,SACA,OAQe;AACf,QAAM,MAAM,KAAK;AAAA,IACf,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM,QAAQ,qBAAqB;AAAA,IAC/C,UAAU;AAAA,MACR,WAAW;AAAA,MACX,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,MAC5C,GAAG,MAAM;AAAA,IACX;AAAA,EACF,CAAC;AACH;AAIA,SAAS,SAAS,KAAa,KAAqB;AAClD,SAAO,IAAI,SAAS,MAAM,IAAI,MAAM,GAAG,GAAG,IAAI,WAAM;AACtD;AAEA,SAAS,UAAU,OAAiB,OAAwB,OAAsB;AAChF,MAAI,OAAO;AACT,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC,OAAO;AACL,UAAM,KAAK,KAAK,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC;AACF;AAOA,SAAS,wBAAwB,QAAgE;AAC/F,MAAI,CAAC,OAAQ,QAAO,aAAa,CAAC;AAClC,MAAI,SAAwC;AAC5C,SAAO,MAAM;AACX,QAAI,CAAC,OAAQ,UAAS,qBAAqB,MAAM;AACjD,WAAO;AAAA,EACT;AACF;","names":["event"]}

package/dist/integrations/openai.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/integrations/openai.ts
@@ -25,21 +35,111 @@ __export(openai_exports, {
   runAgentLoop: () => runAgentLoop
 });
 module.exports = __toCommonJS(openai_exports);
+
+// src/replay.ts
+function jcsCanonicalise(value) {
+  if (value === null) return "null";
+  if (value === true) return "true";
+  if (value === false) return "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error("jcsCanonicalise: NaN and Infinity are not JCS-valid");
+    }
+    return value.toString();
+  }
+  if (typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map(jcsCanonicalise).join(",") + "]";
+  }
+  if (typeof value === "object") {
+    const keys = Object.keys(value).sort();
+    const parts = keys.map((k) => {
+      return JSON.stringify(k) + ":" + jcsCanonicalise(value[k]);
+    });
+    return "{" + parts.join(",") + "}";
+  }
+  throw new Error(`jcsCanonicalise: unsupported value type: ${typeof value}`);
+}
+async function sha256Hex(input) {
+  const bytes = typeof input === "string" ? new TextEncoder().encode(input) : input;
+  const subtle = globalThis.crypto?.subtle;
+  if (subtle) {
+    const buf = await subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  const nodeCrypto = await import("crypto");
+  return nodeCrypto.createHash("sha256").update(bytes).digest("hex");
+}
+async function hashTool(tool) {
+  const normalised = {
+    name: tool.name,
+    description: tool.description ?? "",
+    schema: tool.schema ?? {}
+  };
+  const hex = await sha256Hex(jcsCanonicalise(normalised));
+  return `sha256:${hex}`;
+}
+async function hashToolCatalogue(tools) {
+  if (tools.length === 0) {
+    return `sha256:${await sha256Hex("[]")}`;
+  }
+  const perTool = await Promise.all(tools.map(hashTool));
+  perTool.sort();
+  const hex = await sha256Hex(perTool.join(""));
+  return `sha256:${hex}`;
+}
+async function hashSystemPrompt(prompt) {
+  const hex = await sha256Hex(prompt);
+  return `sha256:${hex}`;
+}
+async function prepareReplayContext(inputs) {
+  const ctx = {};
+  if (inputs.modelVersion) ctx.model_version = inputs.modelVersion;
+  if (inputs.tools) ctx.tool_catalogue_hash = await hashToolCatalogue(inputs.tools);
+  if (inputs.systemPrompt) ctx.system_prompt_hash = await hashSystemPrompt(inputs.systemPrompt);
+  return ctx;
+}
+
+// src/integrations/openai.ts
 var VorimToolRegistry = class {
   vorim;
   agentId;
   defaultPermission;
   asyncAudit;
   tools = /* @__PURE__ */ new Map();
+  replayInputs;
+  replayCache = null;
   constructor(config) {
     this.vorim = config.vorim;
     this.agentId = config.agentId;
     this.defaultPermission = config.defaultPermission ?? "agent:execute";
     this.asyncAudit = config.asyncAudit ?? true;
+    this.replayInputs = config.replay;
+  }
+  async getReplayContext() {
+    if (!this.replayInputs) return {};
+    if (!this.replayCache) {
+      const inputs = {
+        ...this.replayInputs,
+        tools: this.replayInputs.tools ?? this.deriveCatalogue()
+      };
+      this.replayCache = prepareReplayContext(inputs);
+    }
+    return this.replayCache;
+  }
+  deriveCatalogue() {
+    return [...this.tools.values()].map((t) => ({
+      name: t.name,
+      description: t.description,
+      schema: t.parameters
+    }));
   }
-  /** Register a tool. */
+  /** Register a tool. Invalidates the cached tool-catalogue hash. */
   add(definition) {
     this.tools.set(definition.name, definition);
+    this.replayCache = null;
     return this;
   }
   /** Register multiple tools. */
@@ -92,6 +192,7 @@ var VorimToolRegistry = class {
       };
     }
     const { allowed, reason } = await this.vorim.check(this.agentId, scope);
+    const replayCtx = await this.getReplayContext();
     if (!allowed) {
       const event = {
         agent_id: this.agentId,
@@ -100,7 +201,8 @@ var VorimToolRegistry = class {
         resource: truncate(fn.arguments, 500),
         permission: scope,
         result: "denied",
-        metadata: { reason, framework: "openai" }
+        metadata: { reason, framework: "openai" },
+        ...replayCtx
       };
       this.emitAudit(event);
       return {
@@ -121,7 +223,8 @@ var VorimToolRegistry = class {
         permission: scope,
         result: "success",
         latency_ms: Date.now() - start,
-        metadata: { framework: "openai" }
+        metadata: { framework: "openai" },
+        ...replayCtx
       };
       this.emitAudit(event);
       return { role: "tool", tool_call_id: id, content };
@@ -136,7 +239,8 @@ var VorimToolRegistry = class {
         result: "error",
         latency_ms: Date.now() - start,
         error_code: err instanceof Error ? err.name : "UNKNOWN",
-        metadata: { error: errMsg, framework: "openai" }
+        metadata: { error: errMsg, framework: "openai" },
+        ...replayCtx
       };
       this.emitAudit(event);
       return {