@silmaril-security/sdk 0.3.1 → 0.4.2

package/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to the Silmaril Firewall TypeScript SDK are documented here.
+
+## 0.4.2 - 2026-06-02
+
+- Add typed firewall outcome constants, ordered outcome lists, descriptions,
+  type guards, and response normalizers.
+- Type `BlockResult.primaryOutcome`, `outcomeScores`, `detectorScores`, and
+  `detectorCounts` around the canonical outcome taxonomy.
+- Document simple outcome routing examples for direct `classify()` results.
+
+## 0.4.1 - 2026-05-24
+
+- Recover the `0.4.x` npm release by moving to `0.4.1`. The `v0.4.0` Git tag
+  exists, but `@silmaril-security/sdk@0.4.0` was never published to npm.
+- Support Vercel AI SDK v5 and v6 with the `ai` peer range
+  `^5.0.0 || ^6.0.0`.
+- Keep optional LangChain.js types out of the root package declarations so core
+  consumers can typecheck without installing `@langchain/core`.
+- Add typed ESM and CommonJS export conditions, plus explicit adapter subpath
+  exports for `@silmaril-security/sdk/adapters/vercel` and
+  `@silmaril-security/sdk/adapters/langchain`.
+- Add public repository hygiene docs for contribution and vulnerability
+  reporting.
+
+## 0.4.0 - Skipped on npm
+
+- Do not install this version. The Git tag exists, but the npm package was not
+  published.

package/README.md

@@ -18,9 +18,10 @@ This SDK provides the low-level TypeScript interface for that workflow:
 - Classify user input, tool calls, tool responses, model output, or system
   prompt content.
 - Preserve hook and tool-name context for more accurate decisions.
-- Enforce automatic adaptive thresholds in adapters, with shadow mode for
+- Enforce backend-owned adaptive thresholds in adapters, with shadow mode for
   observation-only rollout.
 - Chunk long inputs consistently before they reach the API.
+- Send SDK metadata that lets the Firewall reconstruct chunked payloads.
 - Retry API rate-limit responses.
 - Optionally attach the firewall to Vercel AI SDK middleware and LangChain.js
   callback flows.
@@ -36,16 +37,21 @@ npm install @silmaril-security/sdk
 For reproducible installs, pin a tagged release:
 
 ```sh
-npm install @silmaril-security/sdk@0.3.1
+npm install @silmaril-security/sdk@0.4.2
 ```
 
 Requires Node 18 or later.
 
 The package name and SDK import path are both `@silmaril-security/sdk`, so call
-sites use `Firewall`, `HookLabel`, and `PromptBlockedException` from that
-package.
+sites use `Firewall`, `HookLabel`, and `FirewallBlockedException` from that
+package. `PromptBlockedException` is a deprecated alias.
 
-Optional Vercel AI SDK middleware support:
+This repository is public and source-available for integration transparency,
+but the SDK is not permissive open source. See [LICENSE](LICENSE) for the
+governing terms.
+
+The core client does not require optional framework peer dependencies. Optional
+Vercel AI SDK middleware support is compatible with Vercel AI SDK v5 and v6:
 
 ```sh
 npm install ai @ai-sdk/openai
@@ -109,7 +115,53 @@ console.log(`tool output: ${toolResult.prediction} ${toolResult.score.toFixed(4)
 `classify()` and `classifyBatch()` return the server's prediction, score, and
 internally applied threshold. Direct calls do not throw on malicious verdicts.
 The Vercel AI SDK and LangChain.js adapters use `result.threshold` and throw
-`PromptBlockedException` when enforcement is enabled.
+`FirewallBlockedException` when enforcement is enabled.
+
+## Handle Outcomes
+
+Direct calls expose typed outcome labels so applications can choose different
+responses for different firewall decisions:
+
+```ts
+import { Firewall, HookLabel, Outcome } from "@silmaril-security/sdk";
+
+const result = await fw.classify(userInput, {
+  hook: HookLabel.USER_INPUT,
+});
+
+if (result.score < result.threshold) {
+  continueNormally();
+} else {
+  switch (result.primaryOutcome) {
+    case Outcome.SecretExposure:
+      redactAndSuppress(result);
+      break;
+    case Outcome.InformationDisclosure:
+      requireReview(result);
+      break;
+    case Outcome.ControlAbuse:
+      denyAndAskForConfirmation(result);
+      break;
+    case Outcome.SystemCompromise:
+      blockAndEscalate(result);
+      break;
+    case Outcome.ServiceDisruption:
+      blockDisruptiveAction(result);
+      break;
+    default:
+      blockByDefault(result);
+  }
+}
+```
+
+Outcome taxonomy:
+
+- `benign`: no harmful firewall outcome detected.
+- `information_disclosure`: private data, documents, internal context, logs, traces, customer data, SQL rows, topology, or similar non-secret sensitive information.
+- `secret_exposure`: credentials, tokens, API keys, cookies, passwords, signing keys, OAuth secrets, session material, or webhook secrets.
+- `control_abuse`: misuse of authorized tools or user privileges to send, change, approve, delete, operate, or bypass policy/RBAC without a stronger outcome.
+- `system_compromise`: privilege escalation, account takeover, hostile integration/plugin takeover, persistence, lateral movement, attacker webhook registration, or code/plugin execution.
+- `service_disruption`: downtime, lockout, degradation, alert suppression, destructive loops, resource exhaustion, cost spikes, or hidden outage evidence.
 
 ## Options
 
@@ -126,24 +178,26 @@ interface FirewallOptions {
 The SDK uses native `fetch`, `AbortSignal.timeout`, and JSON request bodies with
 `x-api-key` and `content-type` headers.
 
-## Automatic Thresholding
+## Backend Thresholding
 
-Customers do not tune score thresholds. Short inputs use the base threshold
-`0.5`, which corresponds to the SDK's default single-chunk operating point.
-When a call creates more scoring opportunities, the SDK raises the internal
-threshold before sending requests to `/classify`: 2 chunks use about `0.6661`,
-5 chunks use about `0.8328`, and 10 or more opportunities are capped at `0.9`.
+Customers do not tune score thresholds in the SDK. Tenant Firewall config owns
+the adaptive threshold schedule. The default backend config is
+`base_threshold=0.5`, `target_sequence_fpr=0.01`, and
+`max_adaptive_threshold=0.9`, which keeps the current schedule: 1 scoring
+opportunity uses `0.5`, 2 use about `0.6661`, 5 use about `0.8328`, and 10 or
+more are capped at `0.9`.
 
-For `classify()`, the scoring-opportunity count is the number of generated
-chunks. For `classifyBatch()`, it is the number of texts in the batch. The
-applied value remains available on `BlockResult.threshold` and
-`PromptBlockedException.threshold` as diagnostic metadata.
+The SDK no longer sends `threshold` in request payloads. It sends chunk
+metadata instead, and the backend combines tenant config, active batch size,
+and chunk count to decide the threshold. The applied value remains available on
+`BlockResult.threshold` and `FirewallBlockedException.threshold` as diagnostic
+metadata.
 
 ## Shadow Mode
 
 The Vercel AI SDK and LangChain.js adapters enforce thresholds by default.
 Shadow mode keeps the same classification and threshold logic but suppresses
-`PromptBlockedException`, so live traffic can continue while telemetry records
+`FirewallBlockedException`, so live traffic can continue while telemetry records
 what would have blocked:
 
 ```ts
@@ -175,8 +229,8 @@ const model = wrapLanguageModel({
 await generateText({ model, prompt: "Hello" });
 ```
 
-Per-adapter overrides let you enforce or shadow one surface without changing the
-client default:
+Per-adapter `shadowMode` options let you enforce or shadow one surface without
+changing the client default:
 
 ```ts
 fw.asMiddleware({
@@ -188,10 +242,10 @@ await fw.asLangChainHandler({
 });
 ```
 
-`ClassifyEvent` includes `hook`, `toolName`, `text`, `result`, `blocked`, and
-`shadowMode`. `blocked` is computed from `result.score >= result.threshold`.
-Direct `classify()` and `classifyBatch()` calls never throw on verdicts and are
-unaffected by shadow mode.
+`ClassifyEvent` includes `hook`, `toolName`, `toolCallId`, `runId`, `text`,
+`result`, `blocked`, and `shadowMode`. `blocked` is computed from
+`result.score >= result.threshold`. Direct `classify()` and `classifyBatch()`
+calls never throw on verdicts and are unaffected by shadow mode.
 
 ## Hook Labels
 
@@ -209,10 +263,39 @@ text-prefix integrations. `classify()` and `classifyBatch()` send hook and tool
 metadata as structured JSON fields, so normal callers should use the `hook`,
 `toolName`, `hooks`, and `toolNames` options.
 
+## Request Metadata
+
+Use `metadata` to forward application or integration identifiers to the
+classification API without embedding them in the classified text:
+
+```ts
+await fw.classify(text, {
+  hook: HookLabel.USER_INPUT,
+  metadata: {
+    langgraph: {
+      thread_id: "customer-thread-123",
+      run_id: "langgraph-run-456",
+      message_id: "message-789",
+    },
+  },
+});
+```
+
+The SDK preserves caller metadata and adds a reserved `metadata.silmaril`
+namespace to every request. SDK-controlled fields are `sdk_language`,
+`sdk_version`, `request_id`, `input_index`, `chunk_index`, and `chunk_count`.
+Single unchunked requests use `input_index=0`, `chunk_index=0`, and
+`chunk_count=1`; batches use one metadata object per input; chunked requests
+reuse a single request id across all chunks. If callers provide
+`metadata.silmaril`, it must be an object and SDK-reserved keys are overwritten
+by the SDK.
+
 ## Errors
 
 - `SilmarilApiError`: thrown when the firewall API responds with a non-2xx or redirect status. Carries `status`, `statusText`, a 64 KiB-capped `body`, and any parsed malformed-input diagnostics. The default error message omits the body to keep logs clean.
-- `PromptBlockedException`: thrown by the Vercel AI SDK and LangChain.js adapters in enforcement mode when the score meets or exceeds the effective threshold. Carries `score`, `threshold`, `promptText`, and optional `runId`.
+- `FirewallBlockedException`: thrown by the Vercel AI SDK and LangChain.js adapters in enforcement mode when the backend blocks the request. Carries `score`, `threshold`, `promptText`, and optional `runId`, `hook`, `toolName`, `toolCallId`, and `result`.
+
+`PromptBlockedException` remains as a deprecated alias for one release.
 
 All SDK exception types extend `Error` and work with `instanceof`.
 
@@ -252,14 +335,19 @@ console.log(`classified ${results.length} items`);
 
 Batch requests preserve result order and can carry per-item hooks, tool names,
 and metadata. Hook, tool-name, and metadata arrays must match the number of
-texts. Each batch carries one internal threshold based on batch size.
+texts. Each batch carries SDK metadata per item so the backend can apply
+tenant-owned thresholding.
 
 ## Migration Notes
 
-Version `0.3.0` removes customer-facing `threshold` and `hookThresholds`
-configuration from the client, Vercel middleware, and LangChain adapter.
-Existing hook metadata, shadow mode, result threshold diagnostics, and typed
-blocking exceptions remain available.
+Version `0.4.1` is the public npm recovery release for `0.4.x`: the `v0.4.0`
+Git tag exists, but `@silmaril-security/sdk@0.4.0` was not published to npm.
+Use `0.4.1` or later. This release moves all threshold decisions to Firewall
+tenant/backend config, adds SDK reconstruction metadata, renames blocking
+exceptions to `FirewallBlockedException`, keeps optional LangChain.js types out
+of the root package declarations, adds typed CJS/ESM export conditions, supports
+Vercel AI SDK v5 and v6. The deprecated
+`PromptBlockedException` alias remains available for one release.
 
 ## Vercel AI SDK Middleware
 
@@ -316,11 +404,22 @@ await model.invoke("Hello");
 
 The LangChain handler is fail-open by default: infrastructure errors are logged
 and the LLM call proceeds. Set `failOpen: false` to make API errors bubble up.
-Blocking decisions still throw `PromptBlockedException` unless shadow mode is
-enabled.
+Blocking decisions still throw `FirewallBlockedException` unless shadow mode is
+enabled. `PromptBlockedException` continues to work as a deprecated alias for
+one release.
 
 `asLangChainHandler()` is async because it lazy-loads `@langchain/core` so core
-users do not pay for it.
+users do not pay for it. The root package intentionally exposes a structural
+handler type so projects that do not install LangChain.js can still typecheck
+with `skipLibCheck: false`. If your project needs the exact LangChain
+`BaseCallbackHandler` return type, import the adapter helper from the optional
+subpath:
+
+```ts
+import { createLangChainHandler } from "@silmaril-security/sdk/adapters/langchain";
+
+const handler = await createLangChainHandler(fw);
+```
 
 ## Retries
 

package/dist/adapters/langchain.cjs

@@ -0,0 +1,349 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/adapters/langchain.ts
+var langchain_exports = {};
+__export(langchain_exports, {
+  createLangChainHandler: () => createLangChainHandler
+});
+module.exports = __toCommonJS(langchain_exports);
+
+// src/exceptions.ts
+var MAX_PROMPT_DISPLAY_LEN = 100;
+var FirewallBlockedException = class _FirewallBlockedException extends Error {
+  score;
+  threshold;
+  promptText;
+  runId;
+  hook;
+  toolName;
+  toolCallId;
+  result;
+  constructor(params) {
+    super(_FirewallBlockedException.formatMessage(params));
+    this.name = "FirewallBlockedException";
+    this.score = params.score;
+    this.threshold = params.threshold;
+    this.promptText = params.promptText;
+    this.runId = params.runId;
+    this.hook = params.hook;
+    this.toolName = params.toolName;
+    this.toolCallId = params.toolCallId;
+    this.result = params.result;
+    Object.setPrototypeOf(this, _FirewallBlockedException.prototype);
+  }
+  static formatMessage(params) {
+    const truncated = params.promptText.length > MAX_PROMPT_DISPLAY_LEN ? `${params.promptText.slice(0, MAX_PROMPT_DISPLAY_LEN)}...` : params.promptText;
+    return `Request blocked by Silmaril Firewall (score=${params.score.toFixed(4)}, threshold=${params.threshold.toFixed(4)}): '${truncated}'`;
+  }
+};
+
+// src/hooks.ts
+var HookLabel = {
+  USER_INPUT: "user_input",
+  SYSTEM_PROMPT: "system_prompt",
+  TOOL_CALL: "tool_call",
+  TOOL_RESPONSE: "tool_response",
+  LLM_OUTPUT: "llm_output",
+  UNKNOWN: "unknown"
+};
+var FirewallHook = {
+  LLM_START: "on_llm_start",
+  CHAT_MODEL_START: "on_chat_model_start",
+  TOOL_START: "on_tool_start",
+  RETRIEVER_START: "on_retriever_start",
+  LLM_END: "on_llm_end",
+  TOOL_END: "on_tool_end",
+  RETRIEVER_END: "on_retriever_end"
+};
+var DEFAULT_HOOKS = /* @__PURE__ */ new Set([
+  FirewallHook.LLM_START,
+  FirewallHook.CHAT_MODEL_START
+]);
+var INPUT_HOOKS = /* @__PURE__ */ new Set([
+  FirewallHook.LLM_START,
+  FirewallHook.CHAT_MODEL_START,
+  FirewallHook.TOOL_START,
+  FirewallHook.RETRIEVER_START
+]);
+var OUTPUT_HOOKS = /* @__PURE__ */ new Set([
+  FirewallHook.LLM_END,
+  FirewallHook.TOOL_END,
+  FirewallHook.RETRIEVER_END
+]);
+var ALL_HOOKS = /* @__PURE__ */ new Set([
+  ...INPUT_HOOKS,
+  ...OUTPUT_HOOKS
+]);
+var FIREWALL_HOOK_TO_LABEL = {
+  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,
+  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,
+  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,
+  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,
+  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,
+  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,
+  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT
+};
+var FIREWALL_HOOK_VALUES = new Set(Object.values(FirewallHook));
+function resolveHooks(hooks) {
+  if (hooks === void 0) {
+    return DEFAULT_HOOKS;
+  }
+  const resolved = /* @__PURE__ */ new Set();
+  for (const h of hooks) {
+    if (!FIREWALL_HOOK_VALUES.has(h)) {
+      throw new Error(`Invalid FirewallHook value: ${String(h)}`);
+    }
+    resolved.add(h);
+  }
+  return resolved;
+}
+
+// src/utils/extract.ts
+function extractTextFromPrompts(prompts) {
+  return prompts.map((p) => p.trim()).filter((p) => p.length > 0).join("\n");
+}
+function extractTextFromToolInput(inputStr) {
+  return inputStr.trim();
+}
+function extractTextFromLLMResult(response) {
+  const parts = [];
+  for (const genList of response.generations ?? []) {
+    for (const gen of genList) {
+      const text = (gen.text ?? "").trim();
+      if (text) {
+        parts.push(text);
+      }
+    }
+  }
+  return parts.join("\n");
+}
+function extractTextFromDocuments(documents) {
+  const parts = [];
+  for (const doc of documents) {
+    const text = (doc.pageContent ?? "").trim();
+    if (text) {
+      parts.push(text);
+    }
+  }
+  return parts.join("\n");
+}
+
+// src/adapters/langchain.ts
+var USER_ROLES = /* @__PURE__ */ new Set(["human", "user"]);
+function getMessageRole(message) {
+  if (typeof message.role === "string") {
+    return message.role.toLowerCase();
+  }
+  if (typeof message.type === "string") {
+    return message.type.toLowerCase();
+  }
+  return "";
+}
+function extractMessageText(content) {
+  if (content === void 0) {
+    return "";
+  }
+  if (typeof content === "string") {
+    return content;
+  }
+  const parts = [];
+  for (const block of content) {
+    if (typeof block === "string") {
+      parts.push(block);
+    } else if (block && block.type === "text") {
+      parts.push(block.text ?? "");
+    }
+  }
+  return parts.join(" ");
+}
+function findLastUserMessage(messages) {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const msg = messages[i];
+    if (USER_ROLES.has(getMessageRole(msg))) {
+      return msg;
+    }
+  }
+  return void 0;
+}
+async function createLangChainHandler(firewall, options = {}) {
+  const { BaseCallbackHandler } = await import("@langchain/core/callbacks/base");
+  const enabledHooks = resolveHooks(options.hooks);
+  const failOpen = options.failOpen ?? true;
+  const logger = options.logger ?? ((message, error) => {
+    console.warn(`silmaril.firewall: ${message}`, error);
+  });
+  const shadowMode = options.shadowMode ?? firewall.shadowMode;
+  const onClassify = options.onClassify;
+  const fireOnClassify = (event) => {
+    if (!onClassify) {
+      return;
+    }
+    try {
+      onClassify(event);
+    } catch (err) {
+      logger("onClassify callback threw", err);
+    }
+  };
+  const classify = async (text, hookLabel, runId, toolName) => {
+    let result;
+    try {
+      result = await firewall.classify(text, {
+        hook: hookLabel,
+        ...toolName !== void 0 ? { toolName } : {}
+      });
+    } catch (err) {
+      if (!failOpen) {
+        throw err;
+      }
+      logger("classification failed, allowing prompt through", err);
+      return;
+    }
+    const threshold = result.threshold;
+    const blocked = result.score >= threshold;
+    const commonEventFields = {
+      hook: hookLabel,
+      ...toolName !== void 0 ? { toolName } : {},
+      runId,
+      text,
+      result
+    };
+    fireOnClassify({
+      ...commonEventFields,
+      blocked,
+      shadowMode
+    });
+    if (!blocked || shadowMode) {
+      return;
+    }
+    throw new FirewallBlockedException({
+      score: result.score,
+      threshold,
+      promptText: text,
+      runId,
+      hook: hookLabel,
+      ...toolName !== void 0 ? { toolName } : {},
+      result
+    });
+  };
+  class SilmarilFirewallHandler extends BaseCallbackHandler {
+    name = "silmaril_firewall_handler";
+    raiseError = true;
+    awaitHandlers = true;
+    async handleChatModelStart(_llm, messages, runId) {
+      if (!enabledHooks.has(FirewallHook.CHAT_MODEL_START)) {
+        return;
+      }
+      const batches = messages;
+      const flat = [];
+      for (const batch of batches) {
+        for (const m of batch) {
+          flat.push(m);
+        }
+      }
+      const lastUser = findLastUserMessage(flat);
+      if (!lastUser) {
+        return;
+      }
+      const text = extractMessageText(lastUser.content).trim();
+      if (!text) {
+        return;
+      }
+      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.CHAT_MODEL_START], runId);
+    }
+    async handleLLMStart(_llm, prompts, runId) {
+      if (!enabledHooks.has(FirewallHook.LLM_START)) {
+        return;
+      }
+      const text = extractTextFromPrompts(prompts);
+      if (!text) {
+        return;
+      }
+      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.LLM_START], runId);
+    }
+    async handleToolStart(tool, inputStr, runId) {
+      if (!enabledHooks.has(FirewallHook.TOOL_START)) {
+        return;
+      }
+      const text = extractTextFromToolInput(inputStr);
+      if (!text) {
+        return;
+      }
+      const toolName = tool?.name;
+      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.TOOL_START], runId, toolName);
+    }
+    async handleRetrieverStart(_retriever, query, runId) {
+      if (!enabledHooks.has(FirewallHook.RETRIEVER_START)) {
+        return;
+      }
+      const text = query.trim();
+      if (!text) {
+        return;
+      }
+      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.RETRIEVER_START], runId);
+    }
+    async handleLLMEnd(output, runId) {
+      if (!enabledHooks.has(FirewallHook.LLM_END)) {
+        return;
+      }
+      const text = extractTextFromLLMResult(output);
+      if (!text) {
+        return;
+      }
+      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.LLM_END], runId);
+    }
+    async handleToolEnd(output, runId, _parentRunId, _tags, _kwargs) {
+      if (!enabledHooks.has(FirewallHook.TOOL_END)) {
+        return;
+      }
+      const text = String(output).trim();
+      if (!text) {
+        return;
+      }
+      const toolName = _kwargs?.name;
+      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.TOOL_END], runId, toolName);
+    }
+    async handleRetrieverEnd(documents, runId) {
+      if (!enabledHooks.has(FirewallHook.RETRIEVER_END)) {
+        return;
+      }
+      const text = extractTextFromDocuments(documents);
+      if (!text) {
+        return;
+      }
+      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.RETRIEVER_END], runId);
+    }
+  }
+  return new SilmarilFirewallHandler();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createLangChainHandler
+});
+//# sourceMappingURL=langchain.cjs.map