@silmaril-security/sdk 0.6.3 → 0.7.0

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to the Silmaril Firewall TypeScript SDK are documented here.
 
+## 0.7.0 - 2026-09-30
+
+- Add optional Deep Agents middleware and protected constructors for root, general-purpose,
+  declarative, and explicitly protected compiled subagents. The compiled graph factory
+  records middleware installation and constructors reject unverified graphs.
+- Enforce input, tool-call, tool-result, and non-streamed model-output decisions in
+  Block mode with safe continuation and a repeated-denial cap. Shadow and Warn report
+  decisions without changing content.
+- Enable LangChain tool start/end callbacks by default and send the LangChain run ID
+  as correlation metadata alongside a distinct classification request ID per event.
+
 ## 0.6.3 - 2026-09-24
 
 - Add an optional `signal` option to `classify()` and `classifyBatch()`.

package/README.md

@@ -37,7 +37,7 @@ npm install @silmaril-security/sdk
 For reproducible installs, pin a tagged release:
 
 ```sh
-npm install @silmaril-security/sdk@0.6.2
+npm install @silmaril-security/sdk@0.7.0
 ```
 
 Requires Node 20 or later.
@@ -63,6 +63,12 @@ Optional LangChain.js support:
 npm install @langchain/core @langchain/openai
 ```
 
+Optional Deep Agents support:
+
+```sh
+npm install deepagents langchain @langchain/core @langchain/langgraph
+```
+
 ## Configuration
 
 Every `Firewall` client needs two required options:
@@ -353,6 +359,12 @@ preserved as the backend sequence identity. No aliases are inspected. If
 callers provide `metadata.silmaril`, it must be an object and SDK-reserved keys
 are overwritten by the SDK.
 
+The `governance` option on `classify()` and per-item `governance` array on
+`classifyBatch()` send typed agent/resource context. `BlockResult.governance`
+returns the server action, policy version, and optional rule ID. A malicious
+prediction or explicit governance block is blocked in Block mode; legacy
+responses without governance remain valid.
+
 ## Errors
 
 - `SilmarilApiError`: thrown when the firewall API responds with a non-2xx or redirect status. Carries `status`, `statusText`, a 64 KiB-capped `body`, and any parsed malformed-input diagnostics. The default error message omits the body to keep logs clean.
@@ -464,6 +476,12 @@ and the LLM call proceeds. Set `failOpen: false` to make API errors bubble up.
 Blocking decisions still throw `FirewallBlockedException` unless shadow mode is
 enabled. `PromptBlockedException` continues to work as a deprecated alias for
 one release.
+Model-start, tool-start, and tool-end hooks are enabled by default; retriever
+hooks remain opt-in. The LangChain run ID is sent as
+`metadata.langgraph.run_id`; every classification gets a distinct
+`metadata.silmaril.request_id`. Supply `conversationId` to the handler for
+sequence identity; it sends `metadata.conversationId`. Callback blocks throw
+and end that graph execution.
 
 `asLangChainHandler()` is async because it lazy-loads `@langchain/core` so core
 users do not pay for it. The root package intentionally exposes a structural
@@ -478,6 +496,37 @@ import { createLangChainHandler } from "@silmaril-security/sdk/adapters/langchai
 const handler = await createLangChainHandler(fw);
 ```
 
+## Deep Agents
+
+```ts
+import { createProtectedDeepAgent } from "@silmaril-security/sdk/adapters/deepagents";
+
+const agent = createProtectedDeepAgent(fw, {
+  model, tools,
+  subagents: [{ name: "research", description: "Research safely" }],
+  silmaril: { conversationId },
+});
+```
+
+The constructor installs checks on the root, general-purpose, and declarative
+subagents. For a compiled subagent, call
+`createProtectedCompiledSubagent(fw, { name: "review", description: "Review",
+model, tools })` and pass its returned spec through
+`protectedCompiledSubagents`. That factory installs middleware before
+compilation. The parent constructor verifies the exact graph and Firewall
+client; it rejects arbitrary compiled runnables. Root custom middleware does
+not automatically reach every subagent.
+
+The middleware checks input before model use, tool calls before execution,
+tool results before the next model call, and non-streamed model output before
+the graph consumes it. In Block mode, denied tool interactions become a fixed
+safe `ToolMessage` with the original call ID. The agent can choose an allowed
+alternative; repeated denials end with a fixed safe response. Denied model
+output is replaced. Shadow and Warn report decisions through `onClassify`
+without replacing content. Classification errors allow model and tool execution
+by default; set `silmaril: { failOpen: false }` to require a successful
+classification. Already emitted streaming text cannot be recalled.
+
 ## Retries
 
 HTTP 429 responses are retried with exponential backoff capped at 30s, up to 5

package/dist/adapters/deepagents.cjs

@@ -0,0 +1,251 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/adapters/deepagents.ts
+var deepagents_exports = {};
+__export(deepagents_exports, {
+  SAFE_FINAL_MESSAGE: () => SAFE_FINAL_MESSAGE,
+  SAFE_OUTPUT_MESSAGE: () => SAFE_OUTPUT_MESSAGE,
+  SAFE_TOOL_MESSAGE: () => SAFE_TOOL_MESSAGE,
+  createDeepAgentsMiddleware: () => createDeepAgentsMiddleware,
+  createProtectedCompiledSubagent: () => createProtectedCompiledSubagent,
+  createProtectedDeepAgent: () => createProtectedDeepAgent
+});
+module.exports = __toCommonJS(deepagents_exports);
+var import_messages = require("@langchain/core/messages");
+var import_langgraph = require("@langchain/langgraph");
+var import_deepagents = require("deepagents");
+var import_langchain = require("langchain");
+
+// src/hooks.ts
+var HookLabel = {
+  USER_INPUT: "user_input",
+  SYSTEM_PROMPT: "system_prompt",
+  TOOL_CALL: "tool_call",
+  TOOL_RESPONSE: "tool_response",
+  LLM_OUTPUT: "llm_output",
+  UNKNOWN: "unknown"
+};
+var FirewallHook = {
+  LLM_START: "on_llm_start",
+  CHAT_MODEL_START: "on_chat_model_start",
+  TOOL_START: "on_tool_start",
+  RETRIEVER_START: "on_retriever_start",
+  LLM_END: "on_llm_end",
+  TOOL_END: "on_tool_end",
+  RETRIEVER_END: "on_retriever_end"
+};
+var DEFAULT_HOOKS = /* @__PURE__ */ new Set([
+  FirewallHook.LLM_START,
+  FirewallHook.CHAT_MODEL_START,
+  FirewallHook.TOOL_START,
+  FirewallHook.TOOL_END
+]);
+var INPUT_HOOKS = /* @__PURE__ */ new Set([
+  FirewallHook.LLM_START,
+  FirewallHook.CHAT_MODEL_START,
+  FirewallHook.TOOL_START,
+  FirewallHook.RETRIEVER_START
+]);
+var OUTPUT_HOOKS = /* @__PURE__ */ new Set([
+  FirewallHook.LLM_END,
+  FirewallHook.TOOL_END,
+  FirewallHook.RETRIEVER_END
+]);
+var ALL_HOOKS = /* @__PURE__ */ new Set([
+  ...INPUT_HOOKS,
+  ...OUTPUT_HOOKS
+]);
+var FIREWALL_HOOK_TO_LABEL = {
+  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,
+  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,
+  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,
+  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,
+  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,
+  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,
+  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT
+};
+var FIREWALL_HOOK_VALUES = new Set(Object.values(FirewallHook));
+
+// src/adapters/deepagents.ts
+var SAFE_TOOL_MESSAGE = "Silmaril Firewall blocked this tool interaction. Choose a different safe action.";
+var SAFE_FINAL_MESSAGE = "Silmaril Firewall stopped this request after repeated unsafe actions.";
+var SAFE_OUTPUT_MESSAGE = "Silmaril Firewall blocked this response.";
+var BLOCKED_TOOL_MARKER = "silmaril-firewall:v1:blocked-tool";
+var issuedBlockedMessages = /* @__PURE__ */ new WeakSet();
+var protectedCompiledGraphs = /* @__PURE__ */ new WeakMap();
+function textOf(message) {
+  return typeof message.content === "string" ? message.content : JSON.stringify(message.content);
+}
+function textOfStructuredValue(value, seen = /* @__PURE__ */ new WeakSet()) {
+  if (value == null) return "";
+  if (typeof value !== "object") return String(value);
+  if (seen.has(value)) return "[circular]";
+  seen.add(value);
+  if (Array.isArray(value)) return value.map((item) => textOfStructuredValue(item, seen)).join("\n");
+  return Object.entries(value).map(([key, item]) => `${key}: ${textOfStructuredValue(item, seen)}`).join("\n");
+}
+function stripAllowedMarker(result) {
+  const strip = (message) => {
+    if (message.additional_kwargs?.silmarilBlocked !== BLOCKED_TOOL_MARKER) return message;
+    if (issuedBlockedMessages.has(message)) return message;
+    const { silmarilBlocked: _marker, ...additional_kwargs } = message.additional_kwargs;
+    return new import_messages.ToolMessage({ ...message, additional_kwargs });
+  };
+  if (import_messages.ToolMessage.isInstance(result)) return strip(result);
+  if (result instanceof import_langgraph.Command) {
+    const update = result.update;
+    if (update && !Array.isArray(update) && "messages" in update && Array.isArray(update.messages)) {
+      const originalMessages = update.messages;
+      const messages = originalMessages.map((message) => import_messages.ToolMessage.isInstance(message) ? strip(message) : message);
+      if (messages.some((message, index) => message !== originalMessages[index])) {
+        return new import_langgraph.Command({ ...result, update: { ...update, messages } });
+      }
+    }
+  }
+  return result;
+}
+function createDeepAgentsMiddleware(firewall, options = {}) {
+  const maxBlockedAttempts = options.maxBlockedAttempts ?? 3;
+  if (!Number.isInteger(maxBlockedAttempts) || maxBlockedAttempts < 1) {
+    throw new Error("maxBlockedAttempts must be a positive integer");
+  }
+  const effectiveMode = options.mode ?? firewall.mode;
+  const classify = async (text, hook, toolName) => {
+    if (!text.trim()) return { enforce: false, mode: effectiveMode };
+    try {
+      const result = await firewall.classify(text, {
+        hook,
+        ...toolName === void 0 ? {} : { toolName },
+        ...effectiveMode === void 0 ? {} : { mode: effectiveMode },
+        ...options.conversationId === void 0 ? {} : { metadata: { conversationId: options.conversationId } }
+      });
+      const mode = effectiveMode ?? result.mode ?? "block";
+      const blocked = result.prediction === "MALICIOUS" || result.governance?.action === "block";
+      if (options.onClassify) {
+        try {
+          options.onClassify({ hook, ...toolName === void 0 ? {} : { toolName }, text, result, blocked, mode, shadowMode: mode === "shadow" });
+        } catch {
+        }
+      }
+      return { enforce: blocked && mode === "block", mode };
+    } catch (error) {
+      if (options.failOpen === false) throw error;
+      return { enforce: false, mode: effectiveMode };
+    }
+  };
+  return (0, import_langchain.createMiddleware)({
+    name: "SilmarilDeepAgentsMiddleware",
+    wrapModelCall: async (request, handler) => {
+      const history = request.state.messages;
+      let lastUserIndex = -1;
+      for (let i = history.length - 1; i >= 0; i--) {
+        if (import_messages.HumanMessage.isInstance(history[i])) {
+          lastUserIndex = i;
+          break;
+        }
+      }
+      const blockedCount = history.slice(lastUserIndex + 1).filter(
+        (message) => import_messages.ToolMessage.isInstance(message) && message.content === SAFE_TOOL_MESSAGE && message.additional_kwargs?.silmarilBlocked === BLOCKED_TOOL_MARKER
+      ).length;
+      const latestUser = [...request.messages].reverse().find(import_messages.HumanMessage.isInstance);
+      const inputDecision = latestUser ? await classify(textOf(latestUser), HookLabel.USER_INPUT) : void 0;
+      if (inputDecision?.enforce) return new import_messages.AIMessage(SAFE_OUTPUT_MESSAGE);
+      if (blockedCount >= maxBlockedAttempts) {
+        return new import_messages.AIMessage(SAFE_FINAL_MESSAGE);
+      }
+      const response = await handler(request);
+      if (response instanceof import_langgraph.Command && (await classify(textOfStructuredValue(response.update), HookLabel.LLM_OUTPUT)).enforce) {
+        return new import_messages.AIMessage(SAFE_OUTPUT_MESSAGE);
+      }
+      if (import_messages.AIMessage.isInstance(response) && (await classify(textOf(response), HookLabel.LLM_OUTPUT)).enforce) {
+        return new import_messages.AIMessage(SAFE_OUTPUT_MESSAGE);
+      }
+      return response;
+    },
+    wrapToolCall: async (request, handler) => {
+      const safe = () => {
+        const message = new import_messages.ToolMessage({
+          content: SAFE_TOOL_MESSAGE,
+          tool_call_id: request.toolCall.id ?? "",
+          name: request.toolCall.name,
+          additional_kwargs: { silmarilBlocked: BLOCKED_TOOL_MARKER }
+        });
+        issuedBlockedMessages.add(message);
+        return message;
+      };
+      if ((await classify(JSON.stringify(request.toolCall.args ?? {}), HookLabel.TOOL_CALL, request.toolCall.name)).enforce) {
+        return safe();
+      }
+      const result = await handler(request);
+      let resultText;
+      try {
+        resultText = import_messages.ToolMessage.isInstance(result) ? textOf(result) : result instanceof import_langgraph.Command ? textOfStructuredValue(result.update) : String(result);
+      } catch {
+        const decision = await classify("[uninspectable tool result]", HookLabel.TOOL_RESPONSE, request.toolCall.name);
+        return decision.mode === "block" ? safe() : stripAllowedMarker(result);
+      }
+      if ((await classify(resultText, HookLabel.TOOL_RESPONSE, request.toolCall.name)).enforce) {
+        return safe();
+      }
+      return stripAllowedMarker(result);
+    }
+  });
+}
+function createProtectedCompiledSubagent(firewall, options) {
+  const { name, description, silmaril, middleware = [], ...agentOptions } = options;
+  const runnable = (0, import_langchain.createAgent)({
+    ...agentOptions,
+    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)]
+  });
+  protectedCompiledGraphs.set(runnable, firewall);
+  return { name, description, runnable };
+}
+function createProtectedDeepAgent(firewall, options = {}) {
+  const { silmaril, subagents = [], protectedCompiledSubagents = [], middleware = [], ...agentOptions } = options;
+  const protectedSubagents = subagents.map((subagent) => {
+    if ("runnable" in subagent || "graphId" in subagent) {
+      throw new Error("Compiled or remote subagents must install Silmaril middleware inside their own graph");
+    }
+    return { ...subagent, middleware: [...subagent.middleware ?? [], createDeepAgentsMiddleware(firewall, silmaril)] };
+  });
+  if (!protectedSubagents.some((subagent) => subagent.name === import_deepagents.GENERAL_PURPOSE_SUBAGENT.name)) {
+    protectedSubagents.unshift({ ...import_deepagents.GENERAL_PURPOSE_SUBAGENT, middleware: [createDeepAgentsMiddleware(firewall, silmaril)] });
+  }
+  for (const spec of protectedCompiledSubagents) {
+    if (!spec.runnable || protectedCompiledGraphs.get(spec.runnable) !== firewall) {
+      throw new Error("Compiled subagents must be built with createProtectedCompiledSubagent for this Firewall client");
+    }
+  }
+  return (0, import_deepagents.createDeepAgent)({
+    ...agentOptions,
+    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)],
+    subagents: [...protectedSubagents, ...protectedCompiledSubagents]
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SAFE_FINAL_MESSAGE,
+  SAFE_OUTPUT_MESSAGE,
+  SAFE_TOOL_MESSAGE,
+  createDeepAgentsMiddleware,
+  createProtectedCompiledSubagent,
+  createProtectedDeepAgent
+});
+//# sourceMappingURL=deepagents.cjs.map

package/dist/adapters/deepagents.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/deepagents.ts","../../src/hooks.ts"],"sourcesContent":["// Copyright (c) 2024-2026 Silmaril Security Inc. All rights reserved.\n\n/** Optional Deep Agents integration. Import from @silmaril-security/sdk/adapters/deepagents. */\nimport { AIMessage, HumanMessage, ToolMessage } from \"@langchain/core/messages\";\nimport { Command } from \"@langchain/langgraph\";\nimport { createDeepAgent, GENERAL_PURPOSE_SUBAGENT, type AnySubAgent, type CompiledSubAgent } from \"deepagents\";\nimport { createAgent, createMiddleware, type CreateAgentParams } from \"langchain\";\n\nimport type { Firewall } from \"../firewall.js\";\nimport { HookLabel } from \"../hooks.js\";\nimport type { ClassifyEvent, FirewallMode } from \"../types.js\";\n\nexport const SAFE_TOOL_MESSAGE = \"Silmaril Firewall blocked this tool interaction. Choose a different safe action.\";\nexport const SAFE_FINAL_MESSAGE = \"Silmaril Firewall stopped this request after repeated unsafe actions.\";\nexport const SAFE_OUTPUT_MESSAGE = \"Silmaril Firewall blocked this response.\";\nconst BLOCKED_TOOL_MARKER = \"silmaril-firewall:v1:blocked-tool\";\nconst issuedBlockedMessages = new WeakSet<ToolMessage>();\n\n// A protected graph is identified by the exact runnable returned by our factory.\nconst protectedCompiledGraphs = new WeakMap<object, Firewall>();\n\nexport interface DeepAgentsMiddlewareOptions {\n  mode?: FirewallMode;\n  failOpen?: boolean;\n  maxBlockedAttempts?: number;\n  /** A caller-supplied sequence identity; never derived from a LangChain run ID. */\n  conversationId?: string;\n  onClassify?: (event: ClassifyEvent) => void;\n}\n\nfunction textOf(message: { content: unknown }): string {\n  return typeof message.content === \"string\" ? message.content : JSON.stringify(message.content);\n}\n\nfunction textOfStructuredValue(value: unknown, seen = new WeakSet<object>()): string {\n  if (value == null) return \"\";\n  if (typeof value !== \"object\") return String(value);\n  if (seen.has(value)) return \"[circular]\";\n  seen.add(value);\n  if (Array.isArray(value)) return value.map((item) => textOfStructuredValue(item, seen)).join(\"\\n\");\n  return Object.entries(value).map(([key, item]) => `${key}: ${textOfStructuredValue(item, seen)}`).join(\"\\n\");\n}\n\nfunction stripAllowedMarker(result: ToolMessage | Command): ToolMessage | Command {\n  const strip = (message: ToolMessage): ToolMessage => {\n    if (message.additional_kwargs?.silmarilBlocked !== BLOCKED_TOOL_MARKER) return message;\n    if (issuedBlockedMessages.has(message)) return message;\n    const { silmarilBlocked: _marker, ...additional_kwargs } = message.additional_kwargs;\n    // Tool providers may return frozen messages or metadata. Copy rather\n    // than mutating a result owned by the caller.\n    return new ToolMessage({ ...message, additional_kwargs });\n  };\n  if (ToolMessage.isInstance(result)) return strip(result);\n  if (result instanceof Command) {\n    const update = result.update;\n    if (update && !Array.isArray(update) && \"messages\" in update && Array.isArray(update.messages)) {\n      const originalMessages = update.messages;\n      const messages = originalMessages.map((message) => ToolMessage.isInstance(message) ? strip(message) : message);\n      if (messages.some((message, index) => message !== originalMessages[index])) {\n        return new Command({ ...result, update: { ...update, messages } });\n      }\n    }\n  }\n  return result;\n}\n\nexport function createDeepAgentsMiddleware(firewall: Firewall, options: DeepAgentsMiddlewareOptions = {}) {\n  const maxBlockedAttempts = options.maxBlockedAttempts ?? 3;\n  if (!Number.isInteger(maxBlockedAttempts) || maxBlockedAttempts < 1) {\n    throw new Error(\"maxBlockedAttempts must be a positive integer\");\n  }\n  const effectiveMode = options.mode ?? firewall.mode;\n  const classify = async (text: string, hook: HookLabel, toolName?: string): Promise<{ enforce: boolean; mode: FirewallMode | undefined }> => {\n    if (!text.trim()) return { enforce: false, mode: effectiveMode };\n    try {\n      const result = await firewall.classify(text, {\n        hook,\n        ...(toolName === undefined ? {} : { toolName }),\n        ...(effectiveMode === undefined ? {} : { mode: effectiveMode }),\n        ...(options.conversationId === undefined ? {} : { metadata: { conversationId: options.conversationId } }),\n      });\n      const mode = effectiveMode ?? result.mode ?? \"block\";\n      const blocked = result.prediction === \"MALICIOUS\" || result.governance?.action === \"block\";\n      if (options.onClassify) {\n        try {\n          options.onClassify({ hook, ...(toolName === undefined ? {} : { toolName }), text, result, blocked, mode, shadowMode: mode === \"shadow\" });\n        } catch {\n          // Observation callbacks do not change enforcement.\n        }\n      }\n      return { enforce: blocked && mode === \"block\", mode };\n    } catch (error) {\n      if (options.failOpen === false) throw error;\n      return { enforce: false, mode: effectiveMode };\n    }\n  };\n\n  return createMiddleware({\n    name: \"SilmarilDeepAgentsMiddleware\",\n    wrapModelCall: async (request, handler) => {\n      const history = request.state.messages;\n      let lastUserIndex = -1;\n      for (let i = history.length - 1; i >= 0; i--) {\n        if (HumanMessage.isInstance(history[i])) {\n          lastUserIndex = i;\n          break;\n        }\n      }\n      const blockedCount = history.slice(lastUserIndex + 1).filter(\n        (message) => ToolMessage.isInstance(message) && message.content === SAFE_TOOL_MESSAGE\n          && message.additional_kwargs?.silmarilBlocked === BLOCKED_TOOL_MARKER,\n      ).length;\n      const latestUser = [...request.messages].reverse().find(HumanMessage.isInstance);\n      const inputDecision = latestUser\n        ? await classify(textOf(latestUser), HookLabel.USER_INPUT)\n        : undefined;\n      if (inputDecision?.enforce) return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      // The marker is added only after a Block decision, so neither an\n      // unrelated input mode nor tool output that quotes the safe text affects the cap.\n      if (blockedCount >= maxBlockedAttempts) {\n        return new AIMessage(SAFE_FINAL_MESSAGE);\n      }\n      const response = await handler(request);\n      if (response instanceof Command && (await classify(textOfStructuredValue(response.update), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      if (AIMessage.isInstance(response) && (await classify(textOf(response), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      return response;\n    },\n    wrapToolCall: async (request, handler) => {\n      const safe = () => {\n        const message = new ToolMessage({\n          content: SAFE_TOOL_MESSAGE,\n          tool_call_id: request.toolCall.id ?? \"\",\n          name: request.toolCall.name,\n          additional_kwargs: { silmarilBlocked: BLOCKED_TOOL_MARKER },\n        });\n        issuedBlockedMessages.add(message);\n        return message;\n      };\n      if ((await classify(JSON.stringify(request.toolCall.args ?? {}), HookLabel.TOOL_CALL, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      const result = await handler(request);\n      let resultText: string;\n      try {\n        resultText = ToolMessage.isInstance(result) ? textOf(result)\n          : result instanceof Command ? textOfStructuredValue(result.update) : String(result);\n      } catch {\n        // Content cannot be inspected, but the backend still resolves the\n        // enforcement mode. Observation modes retain the original result.\n        const decision = await classify(\"[uninspectable tool result]\", HookLabel.TOOL_RESPONSE, request.toolCall.name);\n        return decision.mode === \"block\" ? safe() : stripAllowedMarker(result);\n      }\n      if ((await classify(resultText, HookLabel.TOOL_RESPONSE, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      return stripAllowedMarker(result);\n    },\n  });\n}\n\nexport interface ProtectedCompiledSubagentOptions extends Omit<CreateAgentParams, \"middleware\"> {\n  name: string;\n  description: string;\n  middleware?: CreateAgentParams[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Compile a subagent with Silmaril middleware and register that exact graph. */\nexport function createProtectedCompiledSubagent(firewall: Firewall, options: ProtectedCompiledSubagentOptions): CompiledSubAgent {\n  const { name, description, silmaril, middleware = [], ...agentOptions } = options;\n  const runnable = createAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)] as const,\n  });\n  protectedCompiledGraphs.set(runnable, firewall);\n  return { name, description, runnable };\n}\n\nexport interface ProtectedDeepAgentOptions extends Omit<NonNullable<Parameters<typeof createDeepAgent>[0]>, \"subagents\" | \"middleware\"> {\n  subagents?: readonly AnySubAgent[];\n  /** Only pass specs returned by createProtectedCompiledSubagent for this client. */\n  protectedCompiledSubagents?: readonly CompiledSubAgent[];\n  middleware?: NonNullable<Parameters<typeof createDeepAgent>[0]>[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Protect root, default general-purpose, and declarative subagents. */\nexport function createProtectedDeepAgent(firewall: Firewall, options: ProtectedDeepAgentOptions = {}) {\n  const { silmaril, subagents = [], protectedCompiledSubagents = [], middleware = [], ...agentOptions } = options;\n  const protectedSubagents = subagents.map((subagent) => {\n    if (\"runnable\" in subagent || \"graphId\" in subagent) {\n      throw new Error(\"Compiled or remote subagents must install Silmaril middleware inside their own graph\");\n    }\n    return { ...subagent, middleware: [...(subagent.middleware ?? []), createDeepAgentsMiddleware(firewall, silmaril)] };\n  });\n  if (!protectedSubagents.some((subagent) => subagent.name === GENERAL_PURPOSE_SUBAGENT.name)) {\n    protectedSubagents.unshift({ ...GENERAL_PURPOSE_SUBAGENT, middleware: [createDeepAgentsMiddleware(firewall, silmaril)] });\n  }\n  for (const spec of protectedCompiledSubagents) {\n    if (!spec.runnable || protectedCompiledGraphs.get(spec.runnable) !== firewall) {\n      throw new Error(\"Compiled subagents must be built with createProtectedCompiledSubagent for this Firewall client\");\n    }\n  }\n  return createDeepAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)],\n    subagents: [...protectedSubagents, ...protectedCompiledSubagents],\n  });\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nexport const HookLabel = {\n  USER_INPUT: \"user_input\",\n  SYSTEM_PROMPT: \"system_prompt\",\n  TOOL_CALL: \"tool_call\",\n  TOOL_RESPONSE: \"tool_response\",\n  LLM_OUTPUT: \"llm_output\",\n  UNKNOWN: \"unknown\",\n} as const;\n\nexport type HookLabel = (typeof HookLabel)[keyof typeof HookLabel];\n\nexport const FirewallHook = {\n  LLM_START: \"on_llm_start\",\n  CHAT_MODEL_START: \"on_chat_model_start\",\n  TOOL_START: \"on_tool_start\",\n  RETRIEVER_START: \"on_retriever_start\",\n  LLM_END: \"on_llm_end\",\n  TOOL_END: \"on_tool_end\",\n  RETRIEVER_END: \"on_retriever_end\",\n} as const;\n\nexport type FirewallHook = (typeof FirewallHook)[keyof typeof FirewallHook];\n\nexport const DEFAULT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.TOOL_END,\n]);\n\nexport const INPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.RETRIEVER_START,\n]);\n\nexport const OUTPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_END,\n  FirewallHook.TOOL_END,\n  FirewallHook.RETRIEVER_END,\n]);\n\nexport const ALL_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  ...INPUT_HOOKS,\n  ...OUTPUT_HOOKS,\n]);\n\nexport const FIREWALL_HOOK_TO_LABEL: Readonly<Record<FirewallHook, HookLabel>> = {\n  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,\n  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,\n  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT,\n};\n\nconst FIREWALL_HOOK_VALUES: ReadonlySet<string> = new Set(Object.values(FirewallHook));\n\nexport function resolveHooks(\n  hooks: Iterable<FirewallHook | string> | undefined,\n): ReadonlySet<FirewallHook> {\n  if (hooks === undefined) {\n    return DEFAULT_HOOKS;\n  }\n  const resolved = new Set<FirewallHook>();\n  for (const h of hooks) {\n    if (!FIREWALL_HOOK_VALUES.has(h)) {\n      throw new Error(`Invalid FirewallHook value: ${String(h)}`);\n    }\n    resolved.add(h as FirewallHook);\n  }\n  return resolved;\n}\n\nexport function prependHook(text: string, hook: HookLabel | string | undefined | null): string {\n  if (hook === undefined || hook === null) {\n    return text;\n  }\n  if (hook === HookLabel.UNKNOWN) {\n    return text;\n  }\n  return `[HOOK:${hook}] ${text}`;\n}\n\nexport function prependToolName(text: string, toolName: string | undefined | null): string {\n  if (toolName === undefined || toolName === null) {\n    return text;\n  }\n  return `[TOOL:${toolName}] ${text}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,sBAAqD;AACrD,uBAAwB;AACxB,wBAAmG;AACnG,uBAAsE;;;ACH/D,IAAM,YAAY;AAAA,EACvB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,SAAS;AACX;AAIO,IAAM,eAAe;AAAA,EAC1B,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,UAAU;AAAA,EACV,eAAe;AACjB;AAIO,IAAM,gBAA2C,oBAAI,IAAkB;AAAA,EAC5E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,cAAyC,oBAAI,IAAkB;AAAA,EAC1E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,eAA0C,oBAAI,IAAkB;AAAA,EAC3E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,YAAuC,oBAAI,IAAkB;AAAA,EACxE,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAEM,IAAM,yBAAoE;AAAA,EAC/E,CAAC,aAAa,gBAAgB,GAAG,UAAU;AAAA,EAC3C,CAAC,aAAa,SAAS,GAAG,UAAU;AAAA,EACpC,CAAC,aAAa,UAAU,GAAG,UAAU;AAAA,EACrC,CAAC,aAAa,QAAQ,GAAG,UAAU;AAAA,EACnC,CAAC,aAAa,eAAe,GAAG,UAAU;AAAA,EAC1C,CAAC,aAAa,aAAa,GAAG,UAAU;AAAA,EACxC,CAAC,aAAa,OAAO,GAAG,UAAU;AACpC;AAEA,IAAM,uBAA4C,IAAI,IAAI,OAAO,OAAO,YAAY,CAAC;;;ADjD9E,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AACnC,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB,oBAAI,QAAqB;AAGvD,IAAM,0BAA0B,oBAAI,QAA0B;AAW9D,SAAS,OAAO,SAAuC;AACrD,SAAO,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU,KAAK,UAAU,QAAQ,OAAO;AAC/F;AAEA,SAAS,sBAAsB,OAAgB,OAAO,oBAAI,QAAgB,GAAW;AACnF,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAClD,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AACd,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,sBAAsB,MAAM,IAAI,CAAC,EAAE,KAAK,IAAI;AACjG,SAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,GAAG,KAAK,sBAAsB,MAAM,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI;AAC7G;AAEA,SAAS,mBAAmB,QAAsD;AAChF,QAAM,QAAQ,CAAC,YAAsC;AACnD,QAAI,QAAQ,mBAAmB,oBAAoB,oBAAqB,QAAO;AAC/E,QAAI,sBAAsB,IAAI,OAAO,EAAG,QAAO;AAC/C,UAAM,EAAE,iBAAiB,SAAS,GAAG,kBAAkB,IAAI,QAAQ;AAGnE,WAAO,IAAI,4BAAY,EAAE,GAAG,SAAS,kBAAkB,CAAC;AAAA,EAC1D;AACA,MAAI,4BAAY,WAAW,MAAM,EAAG,QAAO,MAAM,MAAM;AACvD,MAAI,kBAAkB,0BAAS;AAC7B,UAAM,SAAS,OAAO;AACtB,QAAI,UAAU,CAAC,MAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAC9F,YAAM,mBAAmB,OAAO;AAChC,YAAM,WAAW,iBAAiB,IAAI,CAAC,YAAY,4BAAY,WAAW,OAAO,IAAI,MAAM,OAAO,IAAI,OAAO;AAC7G,UAAI,SAAS,KAAK,CAAC,SAAS,UAAU,YAAY,iBAAiB,KAAK,CAAC,GAAG;AAC1E,eAAO,IAAI,yBAAQ,EAAE,GAAG,QAAQ,QAAQ,EAAE,GAAG,QAAQ,SAAS,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,UAAoB,UAAuC,CAAC,GAAG;AACxG,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,MAAI,CAAC,OAAO,UAAU,kBAAkB,KAAK,qBAAqB,GAAG;AACnE,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,gBAAgB,QAAQ,QAAQ,SAAS;AAC/C,QAAM,WAAW,OAAO,MAAc,MAAiB,aAAqF;AAC1I,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAC/D,QAAI;AACF,YAAM,SAAS,MAAM,SAAS,SAAS,MAAM;AAAA,QAC3C;AAAA,QACA,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,QAC7C,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,MAAM,cAAc;AAAA,QAC7D,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,QAAQ,eAAe,EAAE;AAAA,MACzG,CAAC;AACD,YAAM,OAAO,iBAAiB,OAAO,QAAQ;AAC7C,YAAM,UAAU,OAAO,eAAe,eAAe,OAAO,YAAY,WAAW;AACnF,UAAI,QAAQ,YAAY;AACtB,YAAI;AACF,kBAAQ,WAAW,EAAE,MAAM,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,GAAI,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,CAAC;AAAA,QAC1I,QAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO,EAAE,SAAS,WAAW,SAAS,SAAS,KAAK;AAAA,IACtD,SAAS,OAAO;AACd,UAAI,QAAQ,aAAa,MAAO,OAAM;AACtC,aAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAAA,IAC/C;AAAA,EACF;AAEA,aAAO,mCAAiB;AAAA,IACtB,MAAM;AAAA,IACN,eAAe,OAAO,SAAS,YAAY;AACzC,YAAM,UAAU,QAAQ,MAAM;AAC9B,UAAI,gBAAgB;AACpB,eAAS,IAAI,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;AAC5C,YAAI,6BAAa,WAAW,QAAQ,CAAC,CAAC,GAAG;AACvC,0BAAgB;AAChB;AAAA,QACF;AAAA,MACF;AACA,YAAM,eAAe,QAAQ,MAAM,gBAAgB,CAAC,EAAE;AAAA,QACpD,CAAC,YAAY,4BAAY,WAAW,OAAO,KAAK,QAAQ,YAAY,qBAC/D,QAAQ,mBAAmB,oBAAoB;AAAA,MACtD,EAAE;AACF,YAAM,aAAa,CAAC,GAAG,QAAQ,QAAQ,EAAE,QAAQ,EAAE,KAAK,6BAAa,UAAU;AAC/E,YAAM,gBAAgB,aAClB,MAAM,SAAS,OAAO,UAAU,GAAG,UAAU,UAAU,IACvD;AACJ,UAAI,eAAe,QAAS,QAAO,IAAI,0BAAU,mBAAmB;AAGpE,UAAI,gBAAgB,oBAAoB;AACtC,eAAO,IAAI,0BAAU,kBAAkB;AAAA,MACzC;AACA,YAAM,WAAW,MAAM,QAAQ,OAAO;AACtC,UAAI,oBAAoB,6BAAY,MAAM,SAAS,sBAAsB,SAAS,MAAM,GAAG,UAAU,UAAU,GAAG,SAAS;AACzH,eAAO,IAAI,0BAAU,mBAAmB;AAAA,MAC1C;AACA,UAAI,0BAAU,WAAW,QAAQ,MAAM,MAAM,SAAS,OAAO,QAAQ,GAAG,UAAU,UAAU,GAAG,SAAS;AACtG,eAAO,IAAI,0BAAU,mBAAmB;AAAA,MAC1C;AACA,aAAO;AAAA,IACT;AAAA,IACA,cAAc,OAAO,SAAS,YAAY;AACxC,YAAM,OAAO,MAAM;AACjB,cAAM,UAAU,IAAI,4BAAY;AAAA,UAC9B,SAAS;AAAA,UACT,cAAc,QAAQ,SAAS,MAAM;AAAA,UACrC,MAAM,QAAQ,SAAS;AAAA,UACvB,mBAAmB,EAAE,iBAAiB,oBAAoB;AAAA,QAC5D,CAAC;AACD,8BAAsB,IAAI,OAAO;AACjC,eAAO;AAAA,MACT;AACA,WAAK,MAAM,SAAS,KAAK,UAAU,QAAQ,SAAS,QAAQ,CAAC,CAAC,GAAG,UAAU,WAAW,QAAQ,SAAS,IAAI,GAAG,SAAS;AACrH,eAAO,KAAK;AAAA,MACd;AACA,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,UAAI;AACJ,UAAI;AACF,qBAAa,4BAAY,WAAW,MAAM,IAAI,OAAO,MAAM,IACvD,kBAAkB,2BAAU,sBAAsB,OAAO,MAAM,IAAI,OAAO,MAAM;AAAA,MACtF,QAAQ;AAGN,cAAM,WAAW,MAAM,SAAS,+BAA+B,UAAU,eAAe,QAAQ,SAAS,IAAI;AAC7G,eAAO,SAAS,SAAS,UAAU,KAAK,IAAI,mBAAmB,MAAM;AAAA,MACvE;AACA,WAAK,MAAM,SAAS,YAAY,UAAU,eAAe,QAAQ,SAAS,IAAI,GAAG,SAAS;AACxF,eAAO,KAAK;AAAA,MACd;AACA,aAAO,mBAAmB,MAAM;AAAA,IAClC;AAAA,EACF,CAAC;AACH;AAUO,SAAS,gCAAgC,UAAoB,SAA6D;AAC/H,QAAM,EAAE,MAAM,aAAa,UAAU,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AAC1E,QAAM,eAAW,8BAAY;AAAA,IAC3B,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,EAC5E,CAAC;AACD,0BAAwB,IAAI,UAAU,QAAQ;AAC9C,SAAO,EAAE,MAAM,aAAa,SAAS;AACvC;AAWO,SAAS,yBAAyB,UAAoB,UAAqC,CAAC,GAAG;AACpG,QAAM,EAAE,UAAU,YAAY,CAAC,GAAG,6BAA6B,CAAC,GAAG,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AACxG,QAAM,qBAAqB,UAAU,IAAI,CAAC,aAAa;AACrD,QAAI,cAAc,YAAY,aAAa,UAAU;AACnD,YAAM,IAAI,MAAM,sFAAsF;AAAA,IACxG;AACA,WAAO,EAAE,GAAG,UAAU,YAAY,CAAC,GAAI,SAAS,cAAc,CAAC,GAAI,2BAA2B,UAAU,QAAQ,CAAC,EAAE;AAAA,EACrH,CAAC;AACD,MAAI,CAAC,mBAAmB,KAAK,CAAC,aAAa,SAAS,SAAS,2CAAyB,IAAI,GAAG;AAC3F,uBAAmB,QAAQ,EAAE,GAAG,4CAA0B,YAAY,CAAC,2BAA2B,UAAU,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC1H;AACA,aAAW,QAAQ,4BAA4B;AAC7C,QAAI,CAAC,KAAK,YAAY,wBAAwB,IAAI,KAAK,QAAQ,MAAM,UAAU;AAC7E,YAAM,IAAI,MAAM,gGAAgG;AAAA,IAClH;AAAA,EACF;AACA,aAAO,mCAAgB;AAAA,IACrB,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,IAC1E,WAAW,CAAC,GAAG,oBAAoB,GAAG,0BAA0B;AAAA,EAClE,CAAC;AACH;","names":[]}

package/dist/adapters/deepagents.d.cts

@@ -0,0 +1,184 @@
+import * as _langchain_core_language_models_base from '@langchain/core/language_models/base';
+import * as _langchain_core_runnables from '@langchain/core/runnables';
+import * as _langchain_core_messages from '@langchain/core/messages';
+import { ToolMessage, HumanMessage } from '@langchain/core/messages';
+import * as deepagents from 'deepagents';
+import { createDeepAgent, AnySubAgent, CompiledSubAgent } from 'deepagents';
+import * as zod_v4_core from 'zod/v4/core';
+import * as zod from 'zod';
+import * as _langchain_langgraph from '@langchain/langgraph';
+import { Command } from '@langchain/langgraph';
+import * as _langchain_core_utils_types from '@langchain/core/utils/types';
+import * as langchain from 'langchain';
+import { CreateAgentParams } from 'langchain';
+import * as _langchain_core_tools from '@langchain/core/tools';
+import { h as FirewallMode, b as ClassifyEvent, e as Firewall } from '../firewall-CRNFqgMa.cjs';
+
+declare const SAFE_TOOL_MESSAGE = "Silmaril Firewall blocked this tool interaction. Choose a different safe action.";
+declare const SAFE_FINAL_MESSAGE = "Silmaril Firewall stopped this request after repeated unsafe actions.";
+declare const SAFE_OUTPUT_MESSAGE = "Silmaril Firewall blocked this response.";
+interface DeepAgentsMiddlewareOptions {
+    mode?: FirewallMode;
+    failOpen?: boolean;
+    maxBlockedAttempts?: number;
+    /** A caller-supplied sequence identity; never derived from a LangChain run ID. */
+    conversationId?: string;
+    onClassify?: (event: ClassifyEvent) => void;
+}
+declare function createDeepAgentsMiddleware(firewall: Firewall, options?: DeepAgentsMiddlewareOptions): langchain.AgentMiddleware<undefined, undefined, unknown, readonly (_langchain_core_tools.ClientTool | _langchain_core_tools.ServerTool)[], readonly []>;
+interface ProtectedCompiledSubagentOptions extends Omit<CreateAgentParams, "middleware"> {
+    name: string;
+    description: string;
+    middleware?: CreateAgentParams["middleware"];
+    silmaril?: DeepAgentsMiddlewareOptions;
+}
+/** Compile a subagent with Silmaril middleware and register that exact graph. */
+declare function createProtectedCompiledSubagent(firewall: Firewall, options: ProtectedCompiledSubagentOptions): CompiledSubAgent;
+interface ProtectedDeepAgentOptions extends Omit<NonNullable<Parameters<typeof createDeepAgent>[0]>, "subagents" | "middleware"> {
+    subagents?: readonly AnySubAgent[];
+    /** Only pass specs returned by createProtectedCompiledSubagent for this client. */
+    protectedCompiledSubagents?: readonly CompiledSubAgent[];
+    middleware?: NonNullable<Parameters<typeof createDeepAgent>[0]>["middleware"];
+    silmaril?: DeepAgentsMiddlewareOptions;
+}
+/** Protect root, default general-purpose, and declarative subagents. */
+declare function createProtectedDeepAgent(firewall: Firewall, options?: ProtectedDeepAgentOptions): deepagents.DeepAgent<deepagents.DeepAgentTypeConfig<langchain.ResponseFormatUndefined, _langchain_core_utils_types.InteropZodObject | _langchain_langgraph.AnyStateSchema | undefined, _langchain_core_utils_types.InteropZodObject, readonly [langchain.AgentMiddleware<_langchain_langgraph.StateSchema<{
+    skillsMetadata: zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodObject<{
+        name: zod.ZodString;
+        description: zod.ZodString;
+        path: zod.ZodString;
+        license: zod.ZodOptional<zod.ZodNullable<zod.ZodString>>;
+        compatibility: zod.ZodOptional<zod.ZodNullable<zod.ZodString>>;
+        metadata: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodString>>;
+        allowedTools: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
+        module: zod.ZodOptional<zod.ZodString>;
+    }, zod_v4_core.$strip>>>>;
+    files: _langchain_langgraph.ReducedValue<{
+        [x: string]: deepagents.FileData;
+    } | undefined, {
+        [x: string]: deepagents.FileData | null;
+    } | undefined>;
+}>, undefined, unknown, readonly (_langchain_core_tools.ClientTool | _langchain_core_tools.ServerTool)[], readonly []>, langchain.AgentMiddleware<_langchain_langgraph.StateSchema<{
+    files: _langchain_langgraph.ReducedValue<{
+        [x: string]: deepagents.FileData;
+    } | undefined, {
+        [x: string]: deepagents.FileData | null;
+    } | undefined>;
+}>, undefined, unknown, (langchain.DynamicStructuredTool<zod.ZodObject<{
+    path: zod.ZodDefault<zod.ZodOptional<zod.ZodString>>;
+}, zod_v4_core.$strip>, {
+    path: string;
+}, {
+    path?: string | undefined;
+}, string | ToolMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>>, unknown, "ls"> | langchain.DynamicStructuredTool<zod.ZodObject<{
+    pattern: zod.ZodString;
+    path: zod.ZodOptional<zod.ZodString>;
+}, zod_v4_core.$strip>, {
+    pattern: string;
+    path?: string | undefined;
+}, {
+    pattern: string;
+    path?: string | undefined;
+}, string | ToolMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>>, unknown, "glob"> | langchain.DynamicStructuredTool<zod.ZodObject<{
+    pattern: zod.ZodString;
+    path: zod.ZodDefault<zod.ZodOptional<zod.ZodString>>;
+    glob: zod.ZodDefault<zod.ZodNullable<zod.ZodOptional<zod.ZodString>>>;
+    max_count: zod.ZodDefault<zod.ZodNullable<zod.ZodOptional<zod.ZodCoercedNumber<unknown>>>>;
+    output_mode: zod.ZodDefault<zod.ZodOptional<zod.ZodEnum<{
+        content: "content";
+        count: "count";
+        files_with_matches: "files_with_matches";
+    }>>>;
+}, zod_v4_core.$strip>, {
+    pattern: string;
+    path: string;
+    glob: string | null;
+    max_count: number | null;
+    output_mode: "content" | "count" | "files_with_matches";
+}, {
+    pattern: string;
+    path?: string | undefined;
+    glob?: string | null | undefined;
+    max_count?: unknown;
+    output_mode?: "content" | "count" | "files_with_matches" | undefined;
+}, string | ToolMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>>, unknown, "grep"> | langchain.DynamicStructuredTool<zod.ZodObject<{
+    command: zod.ZodString;
+}, zod_v4_core.$strip>, {
+    command: string;
+}, {
+    command: string;
+}, string, unknown, "execute"> | langchain.DynamicStructuredTool<zod.ZodPreprocess<zod.ZodObject<{
+    file_path: zod.ZodString;
+    offset: zod.ZodDefault<zod.ZodOptional<zod.ZodCoercedNumber<unknown>>>;
+    limit: zod.ZodDefault<zod.ZodOptional<zod.ZodCoercedNumber<unknown>>>;
+}, zod_v4_core.$strip>, unknown>, {
+    file_path: string;
+    offset: number;
+    limit: number;
+}, unknown, ToolMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>> | {
+    type: string;
+    text: string;
+}[] | {
+    type: string;
+    mimeType: string;
+    data: string;
+}[], unknown, "read_file"> | langchain.DynamicStructuredTool<zod.ZodPreprocess<zod.ZodObject<{
+    file_path: zod.ZodString;
+    content: zod.ZodString;
+}, zod_v4_core.$strip>, unknown>, {
+    file_path: string;
+    content: string;
+}, unknown, string | ToolMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>> | Command<unknown, {
+    files: Record<string, deepagents.FileData>;
+    messages: ToolMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>>[];
+}, string>, unknown, "write_file"> | langchain.DynamicStructuredTool<zod.ZodPreprocess<zod.ZodObject<{
+    file_path: zod.ZodString;
+    old_string: zod.ZodString;
+    new_string: zod.ZodString;
+    replace_all: zod.ZodDefault<zod.ZodOptional<zod.ZodBoolean>>;
+}, zod_v4_core.$strip>, unknown>, {
+    file_path: string;
+    old_string: string;
+    new_string: string;
+    replace_all: boolean;
+}, unknown, string | ToolMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>> | Command<unknown, {
+    files: Record<string, deepagents.FileData>;
+    messages: ToolMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>>[];
+}, string>, unknown, "edit_file"> | langchain.DynamicStructuredTool<zod.ZodPreprocess<zod.ZodObject<{
+    file_path: zod.ZodString;
+}, zod_v4_core.$strip>, unknown>, {
+    file_path: string;
+}, unknown, ToolMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>> | Command<unknown, {
+    files: Record<string, null>;
+    messages: ToolMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>>[];
+}, string>, unknown, "delete">)[], readonly []>, langchain.AgentMiddleware<undefined, undefined, unknown, readonly [langchain.DynamicStructuredTool<zod.ZodObject<{
+    description: zod.ZodString;
+    subagent_type: zod.ZodString;
+}, zod_v4_core.$strip>, {
+    description: string;
+    subagent_type: string;
+}, {
+    description: string;
+    subagent_type: string;
+}, string | Command<unknown, Record<string, unknown>, string>, unknown, "task">], readonly []>, langchain.AgentMiddleware<zod.ZodObject<{
+    _summarizationSessionId: zod.ZodOptional<zod.ZodString>;
+    _summarizationEvent: zod.ZodOptional<zod.ZodObject<{
+        cutoffIndex: zod.ZodNumber;
+        summaryMessage: zod.ZodCustom<HumanMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>>, HumanMessage<_langchain_core_messages.MessageStructure<_langchain_core_messages.MessageToolSet>>>;
+        filePath: zod.ZodNullable<zod.ZodString>;
+    }, zod_v4_core.$strip>>;
+}, zod_v4_core.$strip>, undefined, unknown, readonly (_langchain_core_tools.ClientTool | _langchain_core_tools.ServerTool)[], readonly []>, langchain.AgentMiddleware<undefined, undefined, unknown, readonly (_langchain_core_tools.ClientTool | _langchain_core_tools.ServerTool)[], readonly []>, ...langchain.AgentMiddleware<any, any, any, readonly (_langchain_core_tools.ClientTool | _langchain_core_tools.ServerTool)[], readonly (() => _langchain_langgraph.StreamTransformer<any>)[]>[], langchain.AgentMiddleware<undefined, undefined, unknown, readonly (_langchain_core_tools.ClientTool | _langchain_core_tools.ServerTool)[], readonly []>], readonly (_langchain_core_tools.ClientTool | _langchain_core_tools.ServerTool)[], readonly (CompiledSubAgent<langchain.ReactAgent<any> | _langchain_core_runnables.Runnable<any, any, _langchain_core_runnables.RunnableConfig<Record<string, any>>>> | {
+    middleware: (langchain.AgentMiddleware<undefined, undefined, unknown, readonly (_langchain_core_tools.ClientTool | _langchain_core_tools.ServerTool)[], readonly []> | langchain.AgentMiddleware<any, any, any, readonly (_langchain_core_tools.ClientTool | _langchain_core_tools.ServerTool)[], readonly (() => _langchain_langgraph.StreamTransformer<any>)[]>)[];
+    name: string;
+    description: string;
+    systemPrompt?: string | langchain.SystemMessage;
+    mode?: "isolated" | "fork";
+    tools?: langchain.StructuredTool[];
+    model?: _langchain_core_language_models_base.LanguageModelLike | string;
+    interruptOn?: Record<string, boolean | langchain.InterruptOnConfig>;
+    skills?: readonly string[];
+    responseFormat?: CreateAgentParams["responseFormat"];
+    permissions?: deepagents.FilesystemPermission[];
+})[], readonly (() => _langchain_langgraph.StreamTransformer<any>)[]>>;
+
+export { type DeepAgentsMiddlewareOptions, type ProtectedCompiledSubagentOptions, type ProtectedDeepAgentOptions, SAFE_FINAL_MESSAGE, SAFE_OUTPUT_MESSAGE, SAFE_TOOL_MESSAGE, createDeepAgentsMiddleware, createProtectedCompiledSubagent, createProtectedDeepAgent };