@vhyxseal/vue

VhyxSeal

Seal the contract between your UI and the agentic web.

AI agents are starting to use websites on people's behalf — but a web page only shows them pixels and markup. They have to guess what a button does, whether it is safe to press, and whether a human should confirm first.

VhyxSeal gives every component a contract: its intent, preconditions, consequences, safety level and whether it needs human confirmation. Your site publishes all contracts as a signed manifest at /__agent__/manifest.json, so agents know what they can do — and what they must not do alone.

Think of it as OpenAPI for your UI.

Release candidate — the contract schema is stable; small API changes may still land before 1.0.

Quick start (React)

npm install @vhyxseal/react @vhyxseal/core

import { SealProvider, Button } from "@vhyxseal/react";
import { defineContract } from "@vhyxseal/core";

const placeOrder = defineContract({
  id: "place-order",
  type: "action",
  intent: "place-order", // fills safety level, confirmation and reversibility defaults
  description: "Places the current cart as an order",
  consequence: "Creates an order and charges the saved card",
  affects: ["orders", "payments"],
  requires: [],
  requiredPermissions: [],
  contractVersion: "1.0.0",
});

export function Checkout() {
  return (
    <SealProvider config={{ domain: "example.com", domainVerified: false, verificationToken: "" }}>
      <Button contract={placeOrder} onClick={submitOrder}>
        Place order
      </Button>
    </SealProvider>
  );
}

The button renders exactly as before. Behind it, agents now see an action with intent place-order, safety level high, and a rule that a human must confirm.

Serve the manifest from Next.js with @vhyxseal/nextjs, sign it with npx @vhyxseal/cli keygen and sign, and check what changed for agents in CI with vhyxseal diff --strict.

Packages

Security model

• Structural trust — agents decide from typed fields (safetyLevel, requiresConfirmation, destructive), never from free text alone
• Signed manifests — HMAC-SHA256 over a canonical payload, bound to your domain
• Prompt-injection sanitising — every string field is checked and length-limited before an agent sees it
• Single-use action tokens — short-lived, and rejected on replay
• Abstract conditions — contracts reference user.hasPaymentMethod, never your database fields

Found a vulnerability? See SECURITY.md — please don't open a public issue.

Specification

The contract layer is specified in RFC-0001. Breaking changes go through the RFC process in docs/rfc.

Develop

Requires Node.js 20.19+ and pnpm 9+.

pnpm install
pnpm build
pnpm test
pnpm --filter @vhyxseal/docs dev         # documentation site
pnpm --filter @vhyxseal/playground dev   # playground, http://localhost:3001

See CONTRIBUTING.md and our Code of Conduct.

Family

VhyxSeal is part of the Vhyxara family:

• VhyxUI — accessible React components with VhyxSeal contracts built in
• VhyxChart — animated, text-defined diagrams; vhyxseal visualize turns any manifest into one

License

MIT © Vhyxara · vhyxseal.com