agenticreplay 0.1.0 → 0.1.2

package/node_modules/@agenticreplay/node-instrument/dist/install.js

@@ -0,0 +1,174 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { DEFAULT_INSTRUMENTED_HOSTS, hostMatches, rewriteUrl } from './rewrite.js';
+/**
+ * Getting the fetch hook into an agent that is not ours.
+ *
+ * The hook is written out as one self-contained CommonJS file rather than imported from this
+ * package, and that is not a style choice: it runs inside the *agent's* process, which resolves
+ * `require` against its own dependency tree. A `require('@agenticreplay/node-instrument')` in there
+ * throws before the agent's first line and takes the whole run with it. The shell shim and the
+ * MCP config rewrite already work this way for the same reason.
+ *
+ * `--require` rather than `--import` because the CommonJS preload works for both CommonJS and ESM
+ * entry points, and `globalThis.fetch`
+ * is already there to patch by the time it does.
+ */
+export const HOOK_FILENAME = 'agenticreplay-fetch-hook.cjs';
+/**
+ * The hook's source.
+ *
+ * Configured entirely from the environment, so the bytes are identical on every run — replay
+ * prepares the same launch as the recording, and a hook that varied would read as a divergence.
+ * Everything is wrapped so that no failure inside it can reach the agent: a capture layer that
+ * breaks the run it is capturing is worse than one that captures nothing.
+ */
+/**
+ * The hook's source.
+ *
+ * Built from the *real* matcher rather than a copy of it. `rewrite.ts` documents itself as this
+ * package's security boundary and `rewrite.test.ts` is the only thing that tests it — but the hook
+ * that actually runs inside the agent cannot import it, so it carried a second, hand-written
+ * matcher. Two implementations of an allowlist, one of them tested and neither of them the other:
+ * a future fix to `rewrite.ts` would have gone green while changing nothing that runs.
+ *
+ * So the functions are serialised into the file. They are written to be self-contained for exactly
+ * this reason — no imports, no closure, nothing TypeScript-only left after compilation — and a test
+ * asserts the emitted source still contains them, so the two cannot drift apart again.
+ *
+ * Configured entirely from the environment, so the bytes are identical on every run: replay
+ * prepares the same launch as the recording, and a hook that varied would read as a divergence.
+ */
+const HOOK_SOURCE = `'use strict';
+/**
+ * AgenticReplay fetch hook — written by \`agenticreplay record\`, deleted with the run directory.
+ *
+ * Some agents never read a base-URL variable. The Vercel AI SDK is the common one: \`@ai-sdk/openai\`
+ * takes its origin as a constructor argument only, so redirecting the environment captures nothing
+ * and the run still looks like a success. This redirects at the one place every such agent does
+ * agree on — \`globalThis.fetch\` — and only for an allowlist of provider hosts.
+ *
+ * The two functions below are the instrument package's own, serialised in verbatim — this file
+ * imports nothing, because it loads inside an agent that has never heard of us.
+ */
+(function () {
+  var proxy = process.env.AGENTICREPLAY_PROXY_URL || '';
+  if (!proxy || typeof globalThis.fetch !== 'function') return;
+  if (globalThis.__agenticReplayFetchHooked) return;
+
+  ${hostMatches.toString()}
+
+  ${rewriteUrl.toString()}
+
+  var config = {
+    proxyUrl: proxy,
+    hosts: (process.env.AGENTICREPLAY_INSTRUMENT_HOSTS || ${JSON.stringify(DEFAULT_INSTRUMENTED_HOSTS.join(','))})
+      .split(',')
+      .map(function (h) { return h.trim(); })
+      .filter(Boolean),
+  };
+
+  var original = globalThis.fetch;
+  globalThis.fetch = function agenticreplayFetch(input, init) {
+    try {
+      if (typeof input === 'string' || input instanceof URL) {
+        var next = rewriteUrl(String(input), config);
+        if (next) return original.call(this, next, init);
+      } else if (input && typeof input === 'object' && typeof input.url === 'string') {
+        var moved = rewriteUrl(input.url, config);
+        // Rebuilding from the original Request copies method, headers and body; the SDKs that
+        // hand fetch a Request rather than a string are exactly the ones this exists for.
+        if (moved) return original.call(this, new Request(moved, input), init);
+      }
+    } catch (e) {
+      // Fall through and let the agent's own call proceed untouched.
+    }
+    return original.call(this, input, init);
+  };
+  globalThis.__agenticReplayFetchHooked = true;
+})();
+`;
+/** Write the hook into `dir` and return its path. Idempotent, and identical on every call. */
+export async function writeFetchHook(dir) {
+    const path = join(dir, HOOK_FILENAME);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, HOOK_SOURCE, { mode: 0o600 });
+    return path;
+}
+/**
+ * Add a flag to an options variable, preserving whatever the user already had there.
+ *
+ * Quoted, because these variables are split on whitespace and a macOS home directory routinely has
+ * a space in it — an unquoted path makes the runtime reject the whole variable, and the agent then
+ * never starts at all.
+ *
+ * And escaped inside those quotes, because the quoting is where the runtime's own parser starts
+ * treating a backslash as an escape rather than as a separator. Unquoted, `C:\\run\\hook.cjs` arrives
+ * intact; quoted, the same path arrives as `C:runhook.cjs` and the preload is not found. So a
+ * Windows path worked until someone put the project in a directory with a space in its name —
+ * `My Projects`, `Google Drive`, anything under `Program Files` — and then every run went
+ * uninstrumented. The rule belongs to the parser, not to the platform: a backslash is a legal
+ * character in a POSIX filename too, and a POSIX path holding one is mangled the same way once a
+ * space elsewhere in it forces the quotes.
+ */
+function withHook(flag, hookPath, existing) {
+    const needsQuotes = hookPath.includes(' ');
+    const quoted = needsQuotes ? `"${escapeForOptionsParser(hookPath)}"` : hookPath;
+    const current = existing ?? '';
+    if (current.includes(quoted))
+        return current;
+    // A build from before the escaping wrote the path quoted but raw, which the parser cannot read.
+    // Recognising only the new spelling would append a second `--require` and leave the unreadable
+    // one to be loaded first, so the whole variable still fails — replace it instead of adding to it.
+    const stale = needsQuotes ? `"${hookPath}"` : hookPath;
+    if (current.includes(stale))
+        return current.split(stale).join(quoted);
+    const added = `${flag} ${quoted}`;
+    return current === '' ? added : `${current} ${added}`;
+}
+/**
+ * A path that survives being read back out of a quoted options variable.
+ *
+ * Checked against Node 24 on Windows: `--require "C:\\a b\\h.cjs"` reports
+ * `Cannot find module 'C:abh.cjs'`, while the same path with its backslashes doubled loads.
+ */
+function escapeForOptionsParser(path) {
+    return path.replaceAll('\\', '\\\\');
+}
+/** `NODE_OPTIONS` with the hook added. */
+export function nodeOptionsWithHook(hookPath, existing) {
+    return withHook('--require', hookPath, existing);
+}
+/**
+ * `BUN_OPTIONS` with the hook added.
+ *
+ * Bun accepts `NODE_OPTIONS` but ignores `--require` inside it, so a Bun-based agent ran
+ * uninstrumented and its traffic went straight to the provider — a silent miss, and the shape this
+ * package exists to prevent. `--preload` is Bun's own spelling and `BUN_OPTIONS` is how it reaches
+ * a command agenticreplay did not write. Both were checked against a real `bun` before this was written.
+ */
+export function bunOptionsWithHook(hookPath, existing, platform = process.platform) {
+    return withHook('--preload', bunReadablePath(hookPath, platform), existing);
+}
+/**
+ * A path Bun will still recognise after it has parsed `BUN_OPTIONS`.
+ *
+ * Bun splits that variable with a parser that treats a backslash as an escape, so a Windows path
+ * arrives at the loader with its separators eaten and the run dies on `preload not found` before
+ * the agent starts. Quoting does not help and is worse: Bun then accepts the argument, loads
+ * nothing, and the agent runs uninstrumented while agenticreplay reports success — the silent miss this
+ * package exists to prevent.
+ *
+ * Forward slashes survive that parser and Windows accepts them everywhere, so the separator is
+ * simply changed. Checked against bun 1.4 on Windows: backslashes fail, quoted backslashes load
+ * nothing, forward slashes load the hook.
+ *
+ * Only on Windows: a backslash is a legal character in a POSIX filename, so rewriting one there
+ * would corrupt a path rather than repair it. `platform` is a parameter so both branches are
+ * reachable from a test on either OS — the Windows behaviour is the whole point of this
+ * function, and a test that can only run on Windows leaves it unproven everywhere CI runs.
+ */
+export function bunReadablePath(path, platform = process.platform) {
+    return platform === 'win32' ? path.replaceAll('\\', '/') : path;
+}
+//# sourceMappingURL=install.js.map

package/node_modules/@agenticreplay/node-instrument/dist/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEnF;;;;;;;;;;;;GAYG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,8BAA8B,CAAC;AAE5D;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;IAiBhB,WAAW,CAAC,QAAQ,EAAE;;IAEtB,UAAU,CAAC,QAAQ,EAAE;;;;4DAImC,IAAI,CAAC,SAAS,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;CAyB/G,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACtC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB,EAAE,QAA4B;IAC5E,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChF,MAAM,OAAO,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IAE7C,gGAAgG;IAChG,+FAA+F;IAC/F,kGAAkG;IAClG,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEtE,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;IAClC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,QAA4B;IAChF,OAAO,QAAQ,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,QAA4B,EAC5B,WAAmB,OAAO,CAAC,QAAQ;IAEnC,OAAO,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,WAAmB,OAAO,CAAC,QAAQ;IAC/E,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClE,CAAC"}

package/node_modules/@agenticreplay/node-instrument/dist/rewrite.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Which URLs a recorded agent's `fetch` should be redirected to the proxy, and which must not be.
+ *
+ * Kept as one pure function because it is the security boundary of this package. The hook runs
+ * inside someone else's agent, on every request it makes — so over-matching does not produce a
+ * missing trace, it produces an agent whose telemetry, package downloads or database calls
+ * silently go to a local port. Everything here is deny-by-default and matched on the whole
+ * hostname, never on a suffix.
+ */
+/** Provider origins a JS agent reaches when it was never told about a base URL. */
+export declare const DEFAULT_INSTRUMENTED_HOSTS: readonly ["api.openai.com", "api.anthropic.com"];
+export interface InstrumentConfig {
+    /** Where the recording proxy is listening. Empty disables the hook entirely. */
+    proxyUrl: string;
+    /** Hostnames to redirect. `*.example.com` matches subdomains, never the bare parent. */
+    hosts: readonly string[];
+}
+/**
+ * The proxy URL a request should be sent to instead, or `undefined` to leave it alone.
+ *
+ * Never throws: this sits in the hot path of an agent that is not ours, and a hook that can throw
+ * is a hook that breaks the run it was added to protect.
+ */
+export declare function rewriteUrl(raw: string, config: InstrumentConfig): string | undefined;
+/**
+ * Whole-hostname match. `endsWith` alone is the bug that lets `api.openai.com.attacker.test` in.
+ *
+ * Exported, and deliberately self-contained — no imports, no closure, nothing TypeScript-only —
+ * because `install.ts` serialises this function into the hook that runs inside the agent's own
+ * process, where it cannot import anything of ours.
+ */
+export declare function hostMatches(hostname: string, pattern: string): boolean;
+//# sourceMappingURL=rewrite.d.ts.map

package/node_modules/@agenticreplay/node-instrument/dist/rewrite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../src/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,mFAAmF;AACnF,eAAO,MAAM,0BAA0B,kDAAmD,CAAC;AAE3F,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAmBpF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAWtE"}

package/node_modules/@agenticreplay/node-instrument/dist/rewrite.js

@@ -0,0 +1,61 @@
+/**
+ * Which URLs a recorded agent's `fetch` should be redirected to the proxy, and which must not be.
+ *
+ * Kept as one pure function because it is the security boundary of this package. The hook runs
+ * inside someone else's agent, on every request it makes — so over-matching does not produce a
+ * missing trace, it produces an agent whose telemetry, package downloads or database calls
+ * silently go to a local port. Everything here is deny-by-default and matched on the whole
+ * hostname, never on a suffix.
+ */
+/** Provider origins a JS agent reaches when it was never told about a base URL. */
+export const DEFAULT_INSTRUMENTED_HOSTS = ['api.openai.com', 'api.anthropic.com'];
+/**
+ * The proxy URL a request should be sent to instead, or `undefined` to leave it alone.
+ *
+ * Never throws: this sits in the hot path of an agent that is not ours, and a hook that can throw
+ * is a hook that breaks the run it was added to protect.
+ */
+export function rewriteUrl(raw, config) {
+    if (config.proxyUrl === '')
+        return undefined;
+    let target;
+    let proxy;
+    try {
+        target = new URL(raw);
+        proxy = new URL(config.proxyUrl);
+    }
+    catch {
+        return undefined;
+    }
+    // Already ours. The agent may read a base-URL variable *and* be instrumented, and without this
+    // a proxy whose own upstream is itself would loop.
+    if (target.host === proxy.host)
+        return undefined;
+    if (!config.hosts.some((pattern) => hostMatches(target.hostname, pattern)))
+        return undefined;
+    // The proxy may have been given a path prefix; the provider path is appended to it, not
+    // substituted for it, so a gateway mounted under a subpath keeps working.
+    const prefix = proxy.pathname.replace(/\/+$/, '');
+    return `${proxy.origin}${prefix}${target.pathname}${target.search}`;
+}
+/**
+ * Whole-hostname match. `endsWith` alone is the bug that lets `api.openai.com.attacker.test` in.
+ *
+ * Exported, and deliberately self-contained — no imports, no closure, nothing TypeScript-only —
+ * because `install.ts` serialises this function into the hook that runs inside the agent's own
+ * process, where it cannot import anything of ours.
+ */
+export function hostMatches(hostname, pattern) {
+    const host = hostname.toLowerCase();
+    const want = pattern.trim().toLowerCase();
+    if (want === '')
+        return false;
+    if (want.startsWith('*.')) {
+        const parent = want.slice(2);
+        // A subdomain only: the label boundary is part of the comparison, and the bare parent is not
+        // covered — someone who wants both says so twice.
+        return host.endsWith(`.${parent}`) && host.length > parent.length + 1;
+    }
+    return host === want;
+}
+//# sourceMappingURL=rewrite.js.map

package/node_modules/@agenticreplay/node-instrument/dist/rewrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../src/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,gBAAgB,EAAE,mBAAmB,CAAU,CAAC;AAS3F;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,MAAwB;IAC9D,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,KAAU,CAAC;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,+FAA+F;IAC/F,mDAAmD;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7F,wFAAwF;IACxF,0EAA0E;IAC1E,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,OAAe;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,6FAA6F;QAC7F,kDAAkD;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,KAAK,IAAI,CAAC;AACvB,CAAC"}

package/node_modules/@agenticreplay/node-instrument/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@agenticreplay/node-instrument",
+  "version": "0.1.2",
+  "type": "module",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/askdkc/AgenticReplay.git",
+    "directory": "packages/node-instrument"
+  },
+  "description": "Capture model traffic from a JS agent that reads no base-URL variable",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=24.0.0"
+  }
+}

package/node_modules/@agenticreplay/plugin-api/dist/canonical.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Canonical intermediate representation.
+ *
+ * Every model exchange is recorded twice: the raw provider bytes (which is what makes exact
+ * replay exact) and this canonical form (which is what makes forking a Claude-recorded run onto
+ * GPT possible at all). Never discard the raw bytes to save space — blob dedup already handles
+ * size, and a lossy trace cannot be replayed exactly.
+ */
+export type CanonicalContent = {
+    type: 'text';
+    text: string;
+} | {
+    type: 'thinking';
+    text: string;
+} | {
+    type: 'tool_use';
+    id: string;
+    name: string;
+    input: unknown;
+} | {
+    type: 'tool_result';
+    tool_use_id: string;
+    content: string;
+    is_error?: boolean;
+} | {
+    type: 'image';
+    media_type: string;
+    data: string;
+};
+export interface CanonicalMessage {
+    role: 'user' | 'assistant';
+    content: CanonicalContent[];
+}
+export interface CanonicalTool {
+    name: string;
+    description?: string;
+    input_schema: Record<string, unknown>;
+}
+export interface CanonicalRequest {
+    model: string;
+    system?: string;
+    messages: CanonicalMessage[];
+    tools?: CanonicalTool[];
+    max_tokens?: number;
+    temperature?: number;
+    top_p?: number;
+    stop?: string[];
+    stream?: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface Usage {
+    input_tokens: number;
+    output_tokens: number;
+    cache_read_tokens?: number;
+    cache_write_tokens?: number;
+}
+export type StopReason = 'end_turn' | 'tool_use' | 'max_tokens' | 'stop_sequence' | 'error';
+export interface CanonicalResponse {
+    id: string;
+    model: string;
+    stop_reason: StopReason;
+    content: CanonicalContent[];
+    usage: Usage;
+}
+export type CanonicalChunk = {
+    type: 'text_delta';
+    text: string;
+} | {
+    type: 'tool_use_delta';
+    id: string;
+    name: string;
+    partial_json: string;
+} | {
+    type: 'done';
+    response: CanonicalResponse;
+};
+export interface Money {
+    amount: number;
+    currency: 'USD';
+}
+export interface ModelInfo {
+    id: string;
+    context_window?: number;
+    input_price_per_mtok?: number;
+    output_price_per_mtok?: number;
+}
+//# sourceMappingURL=canonical.d.ts.map

package/node_modules/@agenticreplay/plugin-api/dist/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IAC3B,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,KAAK;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,eAAe,GAAG,OAAO,CAAC;AAE5F,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,UAAU,CAAC;IACxB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;CACd;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC1E;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAElD,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,KAAK,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC"}

package/node_modules/@agenticreplay/plugin-api/dist/canonical.js

@@ -0,0 +1,10 @@
+/**
+ * Canonical intermediate representation.
+ *
+ * Every model exchange is recorded twice: the raw provider bytes (which is what makes exact
+ * replay exact) and this canonical form (which is what makes forking a Claude-recorded run onto
+ * GPT possible at all). Never discard the raw bytes to save space — blob dedup already handles
+ * size, and a lossy trace cannot be replayed exactly.
+ */
+export {};
+//# sourceMappingURL=canonical.js.map

package/node_modules/@agenticreplay/plugin-api/dist/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/node_modules/@agenticreplay/plugin-api/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './canonical.js';
+export * from './plugins.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@agenticreplay/plugin-api/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}

package/node_modules/@agenticreplay/plugin-api/dist/index.js

@@ -0,0 +1,3 @@
+export * from './canonical.js';
+export * from './plugins.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@agenticreplay/plugin-api/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC"}