@silmaril-security/sdk 0.6.3 → 0.7.1

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to the Silmaril Firewall TypeScript SDK are documented here.
 
+## 0.7.1 - 2026-10-04
+
+- Reject malformed batch responses and result counts that do not match the
+  serialized request, including retried requests whose caller inputs change.
+
+## 0.7.0 - 2026-09-30
+
+- Add optional Deep Agents middleware and protected constructors for root, general-purpose,
+  declarative, and explicitly protected compiled subagents. The compiled graph factory
+  records middleware installation and constructors reject unverified graphs.
+- Declare optional peer dependencies for Deep Agents:
+  `deepagents@^1.14.1`, `langchain@^1.5.10`, `@langchain/langgraph@^1.4.10`, and
+  existing `@langchain/core@>=0.3.0`.
+- Enforce input, tool-call, tool-result, and non-streamed model-output decisions in
+  Block mode with safe continuation and a repeated-denial cap (`maxBlockedAttempts`,
+  default `3`). Shadow and Warn report decisions without changing content.
+- Enable LangChain tool start/end callbacks by default and send the LangChain run ID
+  as correlation metadata alongside a distinct classification request ID per event.
+
 ## 0.6.3 - 2026-09-24
 
 - Add an optional `signal` option to `classify()` and `classifyBatch()`.

package/README.md

@@ -18,13 +18,13 @@ This SDK provides the low-level TypeScript interface for that workflow:
 - Classify user input, tool calls, tool responses, model output, or system
   prompt content.
 - Preserve hook and tool-name context for more accurate decisions.
-- Enforce backend-owned adaptive thresholds and effective Shadow, Warn, or
+- Honor backend threat and governance decisions and effective Shadow, Warn, or
   Block behavior in adapters.
 - Send each complete sanitized event in one request.
-- Preserve exact `metadata.conversationId` sequence identity and add one event ID.
+- On individual `classify()` calls, preserve exact `metadata.conversationId` as sequence identity and add one event ID.
 - Retry API rate-limit responses.
-- Optionally attach the firewall to Vercel AI SDK middleware and LangChain.js
-  callback flows.
+- Optionally attach the firewall to Vercel AI SDK middleware, LangChain.js
+  callback flows, and Deep Agents middleware/constructors.
 
 ## Install
 
@@ -37,7 +37,7 @@ npm install @silmaril-security/sdk
 For reproducible installs, pin a tagged release:
 
 ```sh
-npm install @silmaril-security/sdk@0.6.2
+npm install @silmaril-security/sdk@0.7.1
 ```
 
 Requires Node 20 or later.
@@ -63,6 +63,12 @@ Optional LangChain.js support:
 npm install @langchain/core @langchain/openai
 ```
 
+Optional Deep Agents support (peer ranges shipped with `0.7.0`):
+
+```sh
+npm install "deepagents@^1.14.1" "langchain@^1.5.10" "@langchain/core@>=0.3.0" "@langchain/langgraph@^1.4.10"
+```
+
 ## Configuration
 
 Every `Firewall` client needs two required options:
@@ -113,15 +119,21 @@ console.log(`tool output: ${toolResult.prediction} ${toolResult.score.toFixed(4)
 ```
 
 `classify()` and `classifyBatch()` return the server's prediction, score, and
-internally applied threshold. Direct calls do not throw on malicious verdicts.
-The Vercel AI SDK and LangChain.js adapters use `result.threshold` and throw
-`FirewallBlockedException` when enforcement is enabled.
+diagnostic threshold. Direct calls do not throw on a `MALICIOUS` prediction or
+a governance block. The Vercel AI SDK and LangChain.js adapters throw
+`FirewallBlockedException` only when `prediction` is `MALICIOUS` or
+`governance.action` is `block`, and the effective mode is `block`.
+`result.threshold` is backend-returned diagnostic metadata carried on the
+result and the exception. Disabled and observe policy paths can retain the
+compatibility threshold. The adapters do not compare `score` to a local
+threshold.
 
 ## Concurrency and Cancellation
 
 A `Firewall` instance holds no per-request state, so one client can serve any
-number of concurrent calls in a runtime. Responses are matched to their own
-promise regardless of completion order:
+number of concurrent calls in a runtime. Concurrent calls are appropriate for
+independent events or different conversations. Responses are matched to their
+own promise regardless of completion order:
 
 ```ts
 const [userResult, toolResult] = await Promise.all([
@@ -130,6 +142,10 @@ const [userResult, toolResult] = await Promise.all([
 ]);
 ```
 
+Events that belong to one conversation are not independent. Send them with
+ordered individual `classify()` calls that share `metadata.conversationId`, and
+wait for each call before sending the next event for that conversation.
+
 Pass a `signal` to cancel one call without touching its siblings:
 
 ```ts
@@ -236,17 +252,16 @@ to each attempt and is combined with any caller-supplied `signal`.
 
 ## Backend Thresholding
 
-Customers do not tune score thresholds in the SDK. Tenant Firewall config owns
-the adaptive threshold schedule. The default backend config is
-`base_threshold=0.5`, `target_sequence_fpr=0.01`, and
-`max_adaptive_threshold=0.9`, which keeps the current schedule: 1 scoring
-opportunity uses `0.5`, 2 use about `0.6661`, 5 use about `0.8328`, and 10 or
-more are capped at `0.9`.
+Customers do not tune score thresholds in the SDK. The Firewall backend owns
+the threat decision and threshold policy. The current Cascade backend resolves
+decision thresholds from a tenant default or a hook-specific override; it does
+not raise them as text length, token-window count, batch size, or conversation
+length grows.
 
-The SDK does not send `threshold` in request payloads. The backend owns the
-applied threshold, which remains available on
-`BlockResult.threshold` and `FirewallBlockedException.threshold` as diagnostic
-metadata.
+The SDK does not send `threshold` in request payloads. `BlockResult.threshold`
+and `FirewallBlockedException.threshold` are backend-returned diagnostic
+metadata. Disabled and observe policy paths can retain the compatibility
+threshold.
 
 ## Modes
 
@@ -344,30 +359,49 @@ await fw.classify(text, {
 ```
 
 The SDK preserves caller metadata and adds a reserved `metadata.silmaril`
-namespace to every request. SDK-controlled fields are `sdk_language`,
-`sdk_version`, and `request_id`; batches additionally carry `input_index` for
-diagnostics and remain stateless. `governance` is also SDK-controlled whenever
-the typed governance option is supplied; it replaces any caller-provided
-`metadata.silmaril.governance` value. Exact `metadata.conversationId` is
-preserved as the backend sequence identity. No aliases are inspected. If
-callers provide `metadata.silmaril`, it must be an object and SDK-reserved keys
-are overwritten by the SDK.
+namespace to every request, including each batch item. SDK-controlled fields
+are `sdk_language`, `sdk_version`, and `request_id`; batches additionally
+carry `input_index` for diagnostics. `governance` is also SDK-controlled
+whenever the typed governance option is supplied; it replaces any
+caller-provided `metadata.silmaril.governance` value. On individual
+`classify()` calls, exact `metadata.conversationId` is preserved as the
+backend sequence identity. Batch items also preserve per-item metadata,
+including `metadata.conversationId`, but current Cascade treats each input
+independently and neither reads nor updates conversation history. Giving items
+the same `metadata.conversationId` does not connect them into a sequence. For
+conversation-aware checks, send complete events through ordered individual
+`classify()` calls with the same `metadata.conversationId`, and wait for each
+call before sending the next event for that conversation. No aliases are
+inspected. If callers provide `metadata.silmaril`, it must be an object and
+SDK-reserved keys are overwritten by the SDK.
+
+The `governance` option on `classify()` and per-item `governance` array on
+`classifyBatch()` send typed agent/resource context. `BlockResult.governance`
+returns the server action, policy version, and optional rule ID. A malicious
+prediction or explicit governance block is blocked in Block mode; legacy
+responses without governance remain valid.
 
 ## Errors
 
 - `SilmarilApiError`: thrown when the firewall API responds with a non-2xx or redirect status. Carries `status`, `statusText`, a 64 KiB-capped `body`, and any parsed malformed-input diagnostics. The default error message omits the body to keep logs clean.
 - `FirewallBlockedException`: thrown by the Vercel AI SDK and LangChain.js adapters when a malicious or governance-block decision has effective Block mode. The message distinguishes governance-policy denials from threat-score denials. Carries `score`, `threshold`, `promptText`, and optional `runId`, `hook`, `toolName`, `toolCallId`, and `result`.
 
-`PromptBlockedException` remains as a deprecated alias for one release.
+`PromptBlockedException` remains as a deprecated alias of
+`FirewallBlockedException`.
 
 All SDK exception types extend `Error` and work with `instanceof`.
 
 ## Complete events
 
 `classify()` sanitizes invalid Unicode surrogate fragments and sends the full
-logical event once. The backend owns token-window processing and sequence
-ordering. `classifyBatch()` continues to send independent stateless texts as one
-batch request.
+logical event once. For conversation-aware checks, send those complete events
+through ordered individual `classify()` calls with the same
+`metadata.conversationId`, and wait for each call before sending the next
+event for that conversation. The backend owns token-window processing and
+sequence ordering for those individual calls. `classifyBatch()` sends
+independent texts in one request: each item keeps its metadata, including
+`metadata.conversationId`, but Cascade neither reads nor updates conversation
+history for the batch.
 
 ## Batch Classification
 
@@ -391,9 +425,36 @@ console.log(`classified ${results.length} items`);
 ```
 
 Batch requests preserve result order and can carry per-item hooks, tool names,
-and metadata. Hook, tool-name, and metadata arrays must match the number of
-texts. Each batch carries SDK metadata per item so the backend can apply
-tenant-owned thresholding.
+metadata, and governance. Hook, tool-name, metadata, and governance arrays must
+match the number of texts. Each batch item preserves caller metadata, including
+`metadata.conversationId`, and carries SDK metadata so the backend can apply
+tenant-owned thresholding. Current Cascade treats each input independently and
+neither reads nor updates conversation history. Giving items the same
+`metadata.conversationId` does not connect them into a sequence.
+
+For conversation-aware checks, send complete events through ordered individual
+`classify()` calls with the same `metadata.conversationId`. Wait for each call
+before sending the next event for that conversation:
+
+```ts
+const conversationId = "customer-conversation-123";
+
+const first = await fw.classify(firstEvent, {
+  hook: HookLabel.USER_INPUT,
+  metadata: { conversationId },
+});
+
+const second = await fw.classify(secondEvent, {
+  hook: HookLabel.TOOL_RESPONSE,
+  toolName: "read_file",
+  metadata: { conversationId },
+});
+```
+
+Batch responses must contain a `predictions` array with exactly one result per
+sent input. A missing array or mismatched count raises an `Error` before
+results are returned or blocking callbacks run. Retries use the original
+payload snapshot, even if caller-owned inputs change while the request is in flight.
 
 ## Migration Notes
 
@@ -404,7 +465,7 @@ tenant/backend config, adds SDK reconstruction metadata, renames blocking
 exceptions to `FirewallBlockedException`, keeps optional LangChain.js types out
 of the root package declarations, adds typed CJS/ESM export conditions, supports
 Vercel AI SDK v5 and v6. The deprecated
-`PromptBlockedException` alias remains available for one release.
+`PromptBlockedException` alias remains available.
 
 ## Vercel AI SDK Middleware
 
@@ -427,10 +488,13 @@ const { text } = await generateText({ model, prompt: "Hello" });
 console.log(text);
 ```
 
-Middleware scans input by default. Set `scanOutput: true` to classify model
-text, and `scanToolCalls: true` to classify tool-call arguments. Infrastructure
-errors and blocking decisions are fail-closed by default and bubble up to the
-caller.
+Middleware scans input by default (`scanInput` defaults to true). It classifies
+that message's tool-result parts as `tool_response` only when the newest prompt
+message is a tool message. Otherwise it classifies the latest user message as
+`user_input` and does not scan earlier tool results. Set `scanOutput: true` to
+classify model text, and `scanToolCalls: true` to classify tool-call arguments
+on generate results. Infrastructure errors and blocking decisions are
+fail-closed by default and bubble up to the caller.
 
 When `scanOutput: true` is combined with streaming, output is classified in the
 stream's `flush` after all deltas have been emitted, so blocking is advisory:
@@ -461,9 +525,15 @@ await model.invoke("Hello");
 
 The LangChain handler is fail-open by default: infrastructure errors are logged
 and the LLM call proceeds. Set `failOpen: false` to make API errors bubble up.
-Blocking decisions still throw `FirewallBlockedException` unless shadow mode is
-enabled. `PromptBlockedException` continues to work as a deprecated alias for
-one release.
+Blocking decisions throw `FirewallBlockedException` only when the effective mode
+is Block; Shadow and Warn preserve the host flow.
+`PromptBlockedException` continues to work as a deprecated alias.
+Model-start, tool-start, and tool-end hooks are enabled by default; retriever
+and model-end (`LLM_END`) hooks remain opt-in. The LangChain run ID is sent as
+`metadata.langgraph.run_id`; every classification gets a distinct
+`metadata.silmaril.request_id`. Supply `conversationId` to the handler for
+sequence identity; it sends `metadata.conversationId`. Callback blocks throw
+and end that graph execution.
 
 `asLangChainHandler()` is async because it lazy-loads `@langchain/core` so core
 users do not pay for it. The root package intentionally exposes a structural
@@ -478,6 +548,39 @@ import { createLangChainHandler } from "@silmaril-security/sdk/adapters/langchai
 const handler = await createLangChainHandler(fw);
 ```
 
+## Deep Agents
+
+```ts
+import { createProtectedDeepAgent } from "@silmaril-security/sdk/adapters/deepagents";
+
+const agent = createProtectedDeepAgent(fw, {
+  model, tools,
+  subagents: [{ name: "research", description: "Research safely" }],
+  silmaril: { conversationId },
+});
+```
+
+The constructor installs checks on the root, general-purpose, and declarative
+subagents. For a compiled subagent, call
+`createProtectedCompiledSubagent(fw, { name: "review", description: "Review",
+model, tools })` and pass its returned spec through
+`protectedCompiledSubagents`. That factory installs middleware before
+compilation. The parent constructor verifies the exact graph and Firewall
+client; it rejects arbitrary compiled runnables. Root custom middleware does
+not automatically reach every subagent. For custom agent construction, import
+`createDeepAgentsMiddleware` from the same adapter subpath.
+
+The middleware checks input before model use, tool calls before execution,
+tool results before the next model call, and non-streamed model output before
+the graph consumes it. In Block mode, denied tool interactions become a fixed
+safe `ToolMessage` with the original call ID. The agent can choose an allowed
+alternative; after `maxBlockedAttempts` denials (default `3`), the middleware
+returns a fixed safe final response. Denied model output is replaced. Shadow
+and Warn report decisions through `onClassify` without replacing content.
+Classification errors allow model and tool execution by default; set
+`silmaril: { failOpen: false }` to require a successful classification. Already
+emitted streaming text cannot be recalled.
+
 ## Retries
 
 HTTP 429 responses are retried with exponential backoff capped at 30s, up to 5

package/dist/adapters/deepagents.cjs

@@ -0,0 +1,251 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/adapters/deepagents.ts
+var deepagents_exports = {};
+__export(deepagents_exports, {
+  SAFE_FINAL_MESSAGE: () => SAFE_FINAL_MESSAGE,
+  SAFE_OUTPUT_MESSAGE: () => SAFE_OUTPUT_MESSAGE,
+  SAFE_TOOL_MESSAGE: () => SAFE_TOOL_MESSAGE,
+  createDeepAgentsMiddleware: () => createDeepAgentsMiddleware,
+  createProtectedCompiledSubagent: () => createProtectedCompiledSubagent,
+  createProtectedDeepAgent: () => createProtectedDeepAgent
+});
+module.exports = __toCommonJS(deepagents_exports);
+var import_messages = require("@langchain/core/messages");
+var import_langgraph = require("@langchain/langgraph");
+var import_deepagents = require("deepagents");
+var import_langchain = require("langchain");
+
+// src/hooks.ts
+var HookLabel = {
+  USER_INPUT: "user_input",
+  SYSTEM_PROMPT: "system_prompt",
+  TOOL_CALL: "tool_call",
+  TOOL_RESPONSE: "tool_response",
+  LLM_OUTPUT: "llm_output",
+  UNKNOWN: "unknown"
+};
+var FirewallHook = {
+  LLM_START: "on_llm_start",
+  CHAT_MODEL_START: "on_chat_model_start",
+  TOOL_START: "on_tool_start",
+  RETRIEVER_START: "on_retriever_start",
+  LLM_END: "on_llm_end",
+  TOOL_END: "on_tool_end",
+  RETRIEVER_END: "on_retriever_end"
+};
+var DEFAULT_HOOKS = /* @__PURE__ */ new Set([
+  FirewallHook.LLM_START,
+  FirewallHook.CHAT_MODEL_START,
+  FirewallHook.TOOL_START,
+  FirewallHook.TOOL_END
+]);
+var INPUT_HOOKS = /* @__PURE__ */ new Set([
+  FirewallHook.LLM_START,
+  FirewallHook.CHAT_MODEL_START,
+  FirewallHook.TOOL_START,
+  FirewallHook.RETRIEVER_START
+]);
+var OUTPUT_HOOKS = /* @__PURE__ */ new Set([
+  FirewallHook.LLM_END,
+  FirewallHook.TOOL_END,
+  FirewallHook.RETRIEVER_END
+]);
+var ALL_HOOKS = /* @__PURE__ */ new Set([
+  ...INPUT_HOOKS,
+  ...OUTPUT_HOOKS
+]);
+var FIREWALL_HOOK_TO_LABEL = {
+  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,
+  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,
+  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,
+  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,
+  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,
+  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,
+  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT
+};
+var FIREWALL_HOOK_VALUES = new Set(Object.values(FirewallHook));
+
+// src/adapters/deepagents.ts
+var SAFE_TOOL_MESSAGE = "Silmaril Firewall blocked this tool interaction. Choose a different safe action.";
+var SAFE_FINAL_MESSAGE = "Silmaril Firewall stopped this request after repeated unsafe actions.";
+var SAFE_OUTPUT_MESSAGE = "Silmaril Firewall blocked this response.";
+var BLOCKED_TOOL_MARKER = "silmaril-firewall:v1:blocked-tool";
+var issuedBlockedMessages = /* @__PURE__ */ new WeakSet();
+var protectedCompiledGraphs = /* @__PURE__ */ new WeakMap();
+function textOf(message) {
+  return typeof message.content === "string" ? message.content : JSON.stringify(message.content);
+}
+function textOfStructuredValue(value, seen = /* @__PURE__ */ new WeakSet()) {
+  if (value == null) return "";
+  if (typeof value !== "object") return String(value);
+  if (seen.has(value)) return "[circular]";
+  seen.add(value);
+  if (Array.isArray(value)) return value.map((item) => textOfStructuredValue(item, seen)).join("\n");
+  return Object.entries(value).map(([key, item]) => `${key}: ${textOfStructuredValue(item, seen)}`).join("\n");
+}
+function stripAllowedMarker(result) {
+  const strip = (message) => {
+    if (message.additional_kwargs?.silmarilBlocked !== BLOCKED_TOOL_MARKER) return message;
+    if (issuedBlockedMessages.has(message)) return message;
+    const { silmarilBlocked: _marker, ...additional_kwargs } = message.additional_kwargs;
+    return new import_messages.ToolMessage({ ...message, additional_kwargs });
+  };
+  if (import_messages.ToolMessage.isInstance(result)) return strip(result);
+  if (result instanceof import_langgraph.Command) {
+    const update = result.update;
+    if (update && !Array.isArray(update) && "messages" in update && Array.isArray(update.messages)) {
+      const originalMessages = update.messages;
+      const messages = originalMessages.map((message) => import_messages.ToolMessage.isInstance(message) ? strip(message) : message);
+      if (messages.some((message, index) => message !== originalMessages[index])) {
+        return new import_langgraph.Command({ ...result, update: { ...update, messages } });
+      }
+    }
+  }
+  return result;
+}
+function createDeepAgentsMiddleware(firewall, options = {}) {
+  const maxBlockedAttempts = options.maxBlockedAttempts ?? 3;
+  if (!Number.isInteger(maxBlockedAttempts) || maxBlockedAttempts < 1) {
+    throw new Error("maxBlockedAttempts must be a positive integer");
+  }
+  const effectiveMode = options.mode ?? firewall.mode;
+  const classify = async (text, hook, toolName) => {
+    if (!text.trim()) return { enforce: false, mode: effectiveMode };
+    try {
+      const result = await firewall.classify(text, {
+        hook,
+        ...toolName === void 0 ? {} : { toolName },
+        ...effectiveMode === void 0 ? {} : { mode: effectiveMode },
+        ...options.conversationId === void 0 ? {} : { metadata: { conversationId: options.conversationId } }
+      });
+      const mode = effectiveMode ?? result.mode ?? "block";
+      const blocked = result.prediction === "MALICIOUS" || result.governance?.action === "block";
+      if (options.onClassify) {
+        try {
+          options.onClassify({ hook, ...toolName === void 0 ? {} : { toolName }, text, result, blocked, mode, shadowMode: mode === "shadow" });
+        } catch {
+        }
+      }
+      return { enforce: blocked && mode === "block", mode };
+    } catch (error) {
+      if (options.failOpen === false) throw error;
+      return { enforce: false, mode: effectiveMode };
+    }
+  };
+  return (0, import_langchain.createMiddleware)({
+    name: "SilmarilDeepAgentsMiddleware",
+    wrapModelCall: async (request, handler) => {
+      const history = request.state.messages;
+      let lastUserIndex = -1;
+      for (let i = history.length - 1; i >= 0; i--) {
+        if (import_messages.HumanMessage.isInstance(history[i])) {
+          lastUserIndex = i;
+          break;
+        }
+      }
+      const blockedCount = history.slice(lastUserIndex + 1).filter(
+        (message) => import_messages.ToolMessage.isInstance(message) && message.content === SAFE_TOOL_MESSAGE && message.additional_kwargs?.silmarilBlocked === BLOCKED_TOOL_MARKER
+      ).length;
+      const latestUser = [...request.messages].reverse().find(import_messages.HumanMessage.isInstance);
+      const inputDecision = latestUser ? await classify(textOf(latestUser), HookLabel.USER_INPUT) : void 0;
+      if (inputDecision?.enforce) return new import_messages.AIMessage(SAFE_OUTPUT_MESSAGE);
+      if (blockedCount >= maxBlockedAttempts) {
+        return new import_messages.AIMessage(SAFE_FINAL_MESSAGE);
+      }
+      const response = await handler(request);
+      if (response instanceof import_langgraph.Command && (await classify(textOfStructuredValue(response.update), HookLabel.LLM_OUTPUT)).enforce) {
+        return new import_messages.AIMessage(SAFE_OUTPUT_MESSAGE);
+      }
+      if (import_messages.AIMessage.isInstance(response) && (await classify(textOf(response), HookLabel.LLM_OUTPUT)).enforce) {
+        return new import_messages.AIMessage(SAFE_OUTPUT_MESSAGE);
+      }
+      return response;
+    },
+    wrapToolCall: async (request, handler) => {
+      const safe = () => {
+        const message = new import_messages.ToolMessage({
+          content: SAFE_TOOL_MESSAGE,
+          tool_call_id: request.toolCall.id ?? "",
+          name: request.toolCall.name,
+          additional_kwargs: { silmarilBlocked: BLOCKED_TOOL_MARKER }
+        });
+        issuedBlockedMessages.add(message);
+        return message;
+      };
+      if ((await classify(JSON.stringify(request.toolCall.args ?? {}), HookLabel.TOOL_CALL, request.toolCall.name)).enforce) {
+        return safe();
+      }
+      const result = await handler(request);
+      let resultText;
+      try {
+        resultText = import_messages.ToolMessage.isInstance(result) ? textOf(result) : result instanceof import_langgraph.Command ? textOfStructuredValue(result.update) : String(result);
+      } catch {
+        const decision = await classify("[uninspectable tool result]", HookLabel.TOOL_RESPONSE, request.toolCall.name);
+        return decision.mode === "block" ? safe() : stripAllowedMarker(result);
+      }
+      if ((await classify(resultText, HookLabel.TOOL_RESPONSE, request.toolCall.name)).enforce) {
+        return safe();
+      }
+      return stripAllowedMarker(result);
+    }
+  });
+}
+function createProtectedCompiledSubagent(firewall, options) {
+  const { name, description, silmaril, middleware = [], ...agentOptions } = options;
+  const runnable = (0, import_langchain.createAgent)({
+    ...agentOptions,
+    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)]
+  });
+  protectedCompiledGraphs.set(runnable, firewall);
+  return { name, description, runnable };
+}
+function createProtectedDeepAgent(firewall, options = {}) {
+  const { silmaril, subagents = [], protectedCompiledSubagents = [], middleware = [], ...agentOptions } = options;
+  const protectedSubagents = subagents.map((subagent) => {
+    if ("runnable" in subagent || "graphId" in subagent) {
+      throw new Error("Compiled or remote subagents must install Silmaril middleware inside their own graph");
+    }
+    return { ...subagent, middleware: [...subagent.middleware ?? [], createDeepAgentsMiddleware(firewall, silmaril)] };
+  });
+  if (!protectedSubagents.some((subagent) => subagent.name === import_deepagents.GENERAL_PURPOSE_SUBAGENT.name)) {
+    protectedSubagents.unshift({ ...import_deepagents.GENERAL_PURPOSE_SUBAGENT, middleware: [createDeepAgentsMiddleware(firewall, silmaril)] });
+  }
+  for (const spec of protectedCompiledSubagents) {
+    if (!spec.runnable || protectedCompiledGraphs.get(spec.runnable) !== firewall) {
+      throw new Error("Compiled subagents must be built with createProtectedCompiledSubagent for this Firewall client");
+    }
+  }
+  return (0, import_deepagents.createDeepAgent)({
+    ...agentOptions,
+    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)],
+    subagents: [...protectedSubagents, ...protectedCompiledSubagents]
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SAFE_FINAL_MESSAGE,
+  SAFE_OUTPUT_MESSAGE,
+  SAFE_TOOL_MESSAGE,
+  createDeepAgentsMiddleware,
+  createProtectedCompiledSubagent,
+  createProtectedDeepAgent
+});
+//# sourceMappingURL=deepagents.cjs.map

package/dist/adapters/deepagents.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/deepagents.ts","../../src/hooks.ts"],"sourcesContent":["// Copyright (c) 2024-2026 Silmaril Security Inc. All rights reserved.\n\n/** Optional Deep Agents integration. Import from @silmaril-security/sdk/adapters/deepagents. */\nimport { AIMessage, HumanMessage, ToolMessage } from \"@langchain/core/messages\";\nimport { Command } from \"@langchain/langgraph\";\nimport { createDeepAgent, GENERAL_PURPOSE_SUBAGENT, type AnySubAgent, type CompiledSubAgent } from \"deepagents\";\nimport { createAgent, createMiddleware, type CreateAgentParams } from \"langchain\";\n\nimport type { Firewall } from \"../firewall.js\";\nimport { HookLabel } from \"../hooks.js\";\nimport type { ClassifyEvent, FirewallMode } from \"../types.js\";\n\nexport const SAFE_TOOL_MESSAGE = \"Silmaril Firewall blocked this tool interaction. Choose a different safe action.\";\nexport const SAFE_FINAL_MESSAGE = \"Silmaril Firewall stopped this request after repeated unsafe actions.\";\nexport const SAFE_OUTPUT_MESSAGE = \"Silmaril Firewall blocked this response.\";\nconst BLOCKED_TOOL_MARKER = \"silmaril-firewall:v1:blocked-tool\";\nconst issuedBlockedMessages = new WeakSet<ToolMessage>();\n\n// A protected graph is identified by the exact runnable returned by our factory.\nconst protectedCompiledGraphs = new WeakMap<object, Firewall>();\n\nexport interface DeepAgentsMiddlewareOptions {\n  mode?: FirewallMode;\n  failOpen?: boolean;\n  maxBlockedAttempts?: number;\n  /** A caller-supplied sequence identity; never derived from a LangChain run ID. */\n  conversationId?: string;\n  onClassify?: (event: ClassifyEvent) => void;\n}\n\nfunction textOf(message: { content: unknown }): string {\n  return typeof message.content === \"string\" ? message.content : JSON.stringify(message.content);\n}\n\nfunction textOfStructuredValue(value: unknown, seen = new WeakSet<object>()): string {\n  if (value == null) return \"\";\n  if (typeof value !== \"object\") return String(value);\n  if (seen.has(value)) return \"[circular]\";\n  seen.add(value);\n  if (Array.isArray(value)) return value.map((item) => textOfStructuredValue(item, seen)).join(\"\\n\");\n  return Object.entries(value).map(([key, item]) => `${key}: ${textOfStructuredValue(item, seen)}`).join(\"\\n\");\n}\n\nfunction stripAllowedMarker(result: ToolMessage | Command): ToolMessage | Command {\n  const strip = (message: ToolMessage): ToolMessage => {\n    if (message.additional_kwargs?.silmarilBlocked !== BLOCKED_TOOL_MARKER) return message;\n    if (issuedBlockedMessages.has(message)) return message;\n    const { silmarilBlocked: _marker, ...additional_kwargs } = message.additional_kwargs;\n    // Tool providers may return frozen messages or metadata. Copy rather\n    // than mutating a result owned by the caller.\n    return new ToolMessage({ ...message, additional_kwargs });\n  };\n  if (ToolMessage.isInstance(result)) return strip(result);\n  if (result instanceof Command) {\n    const update = result.update;\n    if (update && !Array.isArray(update) && \"messages\" in update && Array.isArray(update.messages)) {\n      const originalMessages = update.messages;\n      const messages = originalMessages.map((message) => ToolMessage.isInstance(message) ? strip(message) : message);\n      if (messages.some((message, index) => message !== originalMessages[index])) {\n        return new Command({ ...result, update: { ...update, messages } });\n      }\n    }\n  }\n  return result;\n}\n\nexport function createDeepAgentsMiddleware(firewall: Firewall, options: DeepAgentsMiddlewareOptions = {}) {\n  const maxBlockedAttempts = options.maxBlockedAttempts ?? 3;\n  if (!Number.isInteger(maxBlockedAttempts) || maxBlockedAttempts < 1) {\n    throw new Error(\"maxBlockedAttempts must be a positive integer\");\n  }\n  const effectiveMode = options.mode ?? firewall.mode;\n  const classify = async (text: string, hook: HookLabel, toolName?: string): Promise<{ enforce: boolean; mode: FirewallMode | undefined }> => {\n    if (!text.trim()) return { enforce: false, mode: effectiveMode };\n    try {\n      const result = await firewall.classify(text, {\n        hook,\n        ...(toolName === undefined ? {} : { toolName }),\n        ...(effectiveMode === undefined ? {} : { mode: effectiveMode }),\n        ...(options.conversationId === undefined ? {} : { metadata: { conversationId: options.conversationId } }),\n      });\n      const mode = effectiveMode ?? result.mode ?? \"block\";\n      const blocked = result.prediction === \"MALICIOUS\" || result.governance?.action === \"block\";\n      if (options.onClassify) {\n        try {\n          options.onClassify({ hook, ...(toolName === undefined ? {} : { toolName }), text, result, blocked, mode, shadowMode: mode === \"shadow\" });\n        } catch {\n          // Observation callbacks do not change enforcement.\n        }\n      }\n      return { enforce: blocked && mode === \"block\", mode };\n    } catch (error) {\n      if (options.failOpen === false) throw error;\n      return { enforce: false, mode: effectiveMode };\n    }\n  };\n\n  return createMiddleware({\n    name: \"SilmarilDeepAgentsMiddleware\",\n    wrapModelCall: async (request, handler) => {\n      const history = request.state.messages;\n      let lastUserIndex = -1;\n      for (let i = history.length - 1; i >= 0; i--) {\n        if (HumanMessage.isInstance(history[i])) {\n          lastUserIndex = i;\n          break;\n        }\n      }\n      const blockedCount = history.slice(lastUserIndex + 1).filter(\n        (message) => ToolMessage.isInstance(message) && message.content === SAFE_TOOL_MESSAGE\n          && message.additional_kwargs?.silmarilBlocked === BLOCKED_TOOL_MARKER,\n      ).length;\n      const latestUser = [...request.messages].reverse().find(HumanMessage.isInstance);\n      const inputDecision = latestUser\n        ? await classify(textOf(latestUser), HookLabel.USER_INPUT)\n        : undefined;\n      if (inputDecision?.enforce) return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      // The marker is added only after a Block decision, so neither an\n      // unrelated input mode nor tool output that quotes the safe text affects the cap.\n      if (blockedCount >= maxBlockedAttempts) {\n        return new AIMessage(SAFE_FINAL_MESSAGE);\n      }\n      const response = await handler(request);\n      if (response instanceof Command && (await classify(textOfStructuredValue(response.update), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      if (AIMessage.isInstance(response) && (await classify(textOf(response), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      return response;\n    },\n    wrapToolCall: async (request, handler) => {\n      const safe = () => {\n        const message = new ToolMessage({\n          content: SAFE_TOOL_MESSAGE,\n          tool_call_id: request.toolCall.id ?? \"\",\n          name: request.toolCall.name,\n          additional_kwargs: { silmarilBlocked: BLOCKED_TOOL_MARKER },\n        });\n        issuedBlockedMessages.add(message);\n        return message;\n      };\n      if ((await classify(JSON.stringify(request.toolCall.args ?? {}), HookLabel.TOOL_CALL, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      const result = await handler(request);\n      let resultText: string;\n      try {\n        resultText = ToolMessage.isInstance(result) ? textOf(result)\n          : result instanceof Command ? textOfStructuredValue(result.update) : String(result);\n      } catch {\n        // Content cannot be inspected, but the backend still resolves the\n        // enforcement mode. Observation modes retain the original result.\n        const decision = await classify(\"[uninspectable tool result]\", HookLabel.TOOL_RESPONSE, request.toolCall.name);\n        return decision.mode === \"block\" ? safe() : stripAllowedMarker(result);\n      }\n      if ((await classify(resultText, HookLabel.TOOL_RESPONSE, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      return stripAllowedMarker(result);\n    },\n  });\n}\n\nexport interface ProtectedCompiledSubagentOptions extends Omit<CreateAgentParams, \"middleware\"> {\n  name: string;\n  description: string;\n  middleware?: CreateAgentParams[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Compile a subagent with Silmaril middleware and register that exact graph. */\nexport function createProtectedCompiledSubagent(firewall: Firewall, options: ProtectedCompiledSubagentOptions): CompiledSubAgent {\n  const { name, description, silmaril, middleware = [], ...agentOptions } = options;\n  const runnable = createAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)] as const,\n  });\n  protectedCompiledGraphs.set(runnable, firewall);\n  return { name, description, runnable };\n}\n\nexport interface ProtectedDeepAgentOptions extends Omit<NonNullable<Parameters<typeof createDeepAgent>[0]>, \"subagents\" | \"middleware\"> {\n  subagents?: readonly AnySubAgent[];\n  /** Only pass specs returned by createProtectedCompiledSubagent for this client. */\n  protectedCompiledSubagents?: readonly CompiledSubAgent[];\n  middleware?: NonNullable<Parameters<typeof createDeepAgent>[0]>[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Protect root, default general-purpose, and declarative subagents. */\nexport function createProtectedDeepAgent(firewall: Firewall, options: ProtectedDeepAgentOptions = {}) {\n  const { silmaril, subagents = [], protectedCompiledSubagents = [], middleware = [], ...agentOptions } = options;\n  const protectedSubagents = subagents.map((subagent) => {\n    if (\"runnable\" in subagent || \"graphId\" in subagent) {\n      throw new Error(\"Compiled or remote subagents must install Silmaril middleware inside their own graph\");\n    }\n    return { ...subagent, middleware: [...(subagent.middleware ?? []), createDeepAgentsMiddleware(firewall, silmaril)] };\n  });\n  if (!protectedSubagents.some((subagent) => subagent.name === GENERAL_PURPOSE_SUBAGENT.name)) {\n    protectedSubagents.unshift({ ...GENERAL_PURPOSE_SUBAGENT, middleware: [createDeepAgentsMiddleware(firewall, silmaril)] });\n  }\n  for (const spec of protectedCompiledSubagents) {\n    if (!spec.runnable || protectedCompiledGraphs.get(spec.runnable) !== firewall) {\n      throw new Error(\"Compiled subagents must be built with createProtectedCompiledSubagent for this Firewall client\");\n    }\n  }\n  return createDeepAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)],\n    subagents: [...protectedSubagents, ...protectedCompiledSubagents],\n  });\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nexport const HookLabel = {\n  USER_INPUT: \"user_input\",\n  SYSTEM_PROMPT: \"system_prompt\",\n  TOOL_CALL: \"tool_call\",\n  TOOL_RESPONSE: \"tool_response\",\n  LLM_OUTPUT: \"llm_output\",\n  UNKNOWN: \"unknown\",\n} as const;\n\nexport type HookLabel = (typeof HookLabel)[keyof typeof HookLabel];\n\nexport const FirewallHook = {\n  LLM_START: \"on_llm_start\",\n  CHAT_MODEL_START: \"on_chat_model_start\",\n  TOOL_START: \"on_tool_start\",\n  RETRIEVER_START: \"on_retriever_start\",\n  LLM_END: \"on_llm_end\",\n  TOOL_END: \"on_tool_end\",\n  RETRIEVER_END: \"on_retriever_end\",\n} as const;\n\nexport type FirewallHook = (typeof FirewallHook)[keyof typeof FirewallHook];\n\nexport const DEFAULT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.TOOL_END,\n]);\n\nexport const INPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.RETRIEVER_START,\n]);\n\nexport const OUTPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_END,\n  FirewallHook.TOOL_END,\n  FirewallHook.RETRIEVER_END,\n]);\n\nexport const ALL_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  ...INPUT_HOOKS,\n  ...OUTPUT_HOOKS,\n]);\n\nexport const FIREWALL_HOOK_TO_LABEL: Readonly<Record<FirewallHook, HookLabel>> = {\n  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,\n  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,\n  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT,\n};\n\nconst FIREWALL_HOOK_VALUES: ReadonlySet<string> = new Set(Object.values(FirewallHook));\n\nexport function resolveHooks(\n  hooks: Iterable<FirewallHook | string> | undefined,\n): ReadonlySet<FirewallHook> {\n  if (hooks === undefined) {\n    return DEFAULT_HOOKS;\n  }\n  const resolved = new Set<FirewallHook>();\n  for (const h of hooks) {\n    if (!FIREWALL_HOOK_VALUES.has(h)) {\n      throw new Error(`Invalid FirewallHook value: ${String(h)}`);\n    }\n    resolved.add(h as FirewallHook);\n  }\n  return resolved;\n}\n\nexport function prependHook(text: string, hook: HookLabel | string | undefined | null): string {\n  if (hook === undefined || hook === null) {\n    return text;\n  }\n  if (hook === HookLabel.UNKNOWN) {\n    return text;\n  }\n  return `[HOOK:${hook}] ${text}`;\n}\n\nexport function prependToolName(text: string, toolName: string | undefined | null): string {\n  if (toolName === undefined || toolName === null) {\n    return text;\n  }\n  return `[TOOL:${toolName}] ${text}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,sBAAqD;AACrD,uBAAwB;AACxB,wBAAmG;AACnG,uBAAsE;;;ACH/D,IAAM,YAAY;AAAA,EACvB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,SAAS;AACX;AAIO,IAAM,eAAe;AAAA,EAC1B,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,UAAU;AAAA,EACV,eAAe;AACjB;AAIO,IAAM,gBAA2C,oBAAI,IAAkB;AAAA,EAC5E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,cAAyC,oBAAI,IAAkB;AAAA,EAC1E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,eAA0C,oBAAI,IAAkB;AAAA,EAC3E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,YAAuC,oBAAI,IAAkB;AAAA,EACxE,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAEM,IAAM,yBAAoE;AAAA,EAC/E,CAAC,aAAa,gBAAgB,GAAG,UAAU;AAAA,EAC3C,CAAC,aAAa,SAAS,GAAG,UAAU;AAAA,EACpC,CAAC,aAAa,UAAU,GAAG,UAAU;AAAA,EACrC,CAAC,aAAa,QAAQ,GAAG,UAAU;AAAA,EACnC,CAAC,aAAa,eAAe,GAAG,UAAU;AAAA,EAC1C,CAAC,aAAa,aAAa,GAAG,UAAU;AAAA,EACxC,CAAC,aAAa,OAAO,GAAG,UAAU;AACpC;AAEA,IAAM,uBAA4C,IAAI,IAAI,OAAO,OAAO,YAAY,CAAC;;;ADjD9E,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AACnC,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB,oBAAI,QAAqB;AAGvD,IAAM,0BAA0B,oBAAI,QAA0B;AAW9D,SAAS,OAAO,SAAuC;AACrD,SAAO,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU,KAAK,UAAU,QAAQ,OAAO;AAC/F;AAEA,SAAS,sBAAsB,OAAgB,OAAO,oBAAI,QAAgB,GAAW;AACnF,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAClD,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AACd,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,sBAAsB,MAAM,IAAI,CAAC,EAAE,KAAK,IAAI;AACjG,SAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,GAAG,KAAK,sBAAsB,MAAM,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI;AAC7G;AAEA,SAAS,mBAAmB,QAAsD;AAChF,QAAM,QAAQ,CAAC,YAAsC;AACnD,QAAI,QAAQ,mBAAmB,oBAAoB,oBAAqB,QAAO;AAC/E,QAAI,sBAAsB,IAAI,OAAO,EAAG,QAAO;AAC/C,UAAM,EAAE,iBAAiB,SAAS,GAAG,kBAAkB,IAAI,QAAQ;AAGnE,WAAO,IAAI,4BAAY,EAAE,GAAG,SAAS,kBAAkB,CAAC;AAAA,EAC1D;AACA,MAAI,4BAAY,WAAW,MAAM,EAAG,QAAO,MAAM,MAAM;AACvD,MAAI,kBAAkB,0BAAS;AAC7B,UAAM,SAAS,OAAO;AACtB,QAAI,UAAU,CAAC,MAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAC9F,YAAM,mBAAmB,OAAO;AAChC,YAAM,WAAW,iBAAiB,IAAI,CAAC,YAAY,4BAAY,WAAW,OAAO,IAAI,MAAM,OAAO,IAAI,OAAO;AAC7G,UAAI,SAAS,KAAK,CAAC,SAAS,UAAU,YAAY,iBAAiB,KAAK,CAAC,GAAG;AAC1E,eAAO,IAAI,yBAAQ,EAAE,GAAG,QAAQ,QAAQ,EAAE,GAAG,QAAQ,SAAS,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,UAAoB,UAAuC,CAAC,GAAG;AACxG,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,MAAI,CAAC,OAAO,UAAU,kBAAkB,KAAK,qBAAqB,GAAG;AACnE,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,gBAAgB,QAAQ,QAAQ,SAAS;AAC/C,QAAM,WAAW,OAAO,MAAc,MAAiB,aAAqF;AAC1I,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAC/D,QAAI;AACF,YAAM,SAAS,MAAM,SAAS,SAAS,MAAM;AAAA,QAC3C;AAAA,QACA,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,QAC7C,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,MAAM,cAAc;AAAA,QAC7D,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,QAAQ,eAAe,EAAE;AAAA,MACzG,CAAC;AACD,YAAM,OAAO,iBAAiB,OAAO,QAAQ;AAC7C,YAAM,UAAU,OAAO,eAAe,eAAe,OAAO,YAAY,WAAW;AACnF,UAAI,QAAQ,YAAY;AACtB,YAAI;AACF,kBAAQ,WAAW,EAAE,MAAM,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,GAAI,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,CAAC;AAAA,QAC1I,QAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO,EAAE,SAAS,WAAW,SAAS,SAAS,KAAK;AAAA,IACtD,SAAS,OAAO;AACd,UAAI,QAAQ,aAAa,MAAO,OAAM;AACtC,aAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAAA,IAC/C;AAAA,EACF;AAEA,aAAO,mCAAiB;AAAA,IACtB,MAAM;AAAA,IACN,eAAe,OAAO,SAAS,YAAY;AACzC,YAAM,UAAU,QAAQ,MAAM;AAC9B,UAAI,gBAAgB;AACpB,eAAS,IAAI,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;AAC5C,YAAI,6BAAa,WAAW,QAAQ,CAAC,CAAC,GAAG;AACvC,0BAAgB;AAChB;AAAA,QACF;AAAA,MACF;AACA,YAAM,eAAe,QAAQ,MAAM,gBAAgB,CAAC,EAAE;AAAA,QACpD,CAAC,YAAY,4BAAY,WAAW,OAAO,KAAK,QAAQ,YAAY,qBAC/D,QAAQ,mBAAmB,oBAAoB;AAAA,MACtD,EAAE;AACF,YAAM,aAAa,CAAC,GAAG,QAAQ,QAAQ,EAAE,QAAQ,EAAE,KAAK,6BAAa,UAAU;AAC/E,YAAM,gBAAgB,aAClB,MAAM,SAAS,OAAO,UAAU,GAAG,UAAU,UAAU,IACvD;AACJ,UAAI,eAAe,QAAS,QAAO,IAAI,0BAAU,mBAAmB;AAGpE,UAAI,gBAAgB,oBAAoB;AACtC,eAAO,IAAI,0BAAU,kBAAkB;AAAA,MACzC;AACA,YAAM,WAAW,MAAM,QAAQ,OAAO;AACtC,UAAI,oBAAoB,6BAAY,MAAM,SAAS,sBAAsB,SAAS,MAAM,GAAG,UAAU,UAAU,GAAG,SAAS;AACzH,eAAO,IAAI,0BAAU,mBAAmB;AAAA,MAC1C;AACA,UAAI,0BAAU,WAAW,QAAQ,MAAM,MAAM,SAAS,OAAO,QAAQ,GAAG,UAAU,UAAU,GAAG,SAAS;AACtG,eAAO,IAAI,0BAAU,mBAAmB;AAAA,MAC1C;AACA,aAAO;AAAA,IACT;AAAA,IACA,cAAc,OAAO,SAAS,YAAY;AACxC,YAAM,OAAO,MAAM;AACjB,cAAM,UAAU,IAAI,4BAAY;AAAA,UAC9B,SAAS;AAAA,UACT,cAAc,QAAQ,SAAS,MAAM;AAAA,UACrC,MAAM,QAAQ,SAAS;AAAA,UACvB,mBAAmB,EAAE,iBAAiB,oBAAoB;AAAA,QAC5D,CAAC;AACD,8BAAsB,IAAI,OAAO;AACjC,eAAO;AAAA,MACT;AACA,WAAK,MAAM,SAAS,KAAK,UAAU,QAAQ,SAAS,QAAQ,CAAC,CAAC,GAAG,UAAU,WAAW,QAAQ,SAAS,IAAI,GAAG,SAAS;AACrH,eAAO,KAAK;AAAA,MACd;AACA,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,UAAI;AACJ,UAAI;AACF,qBAAa,4BAAY,WAAW,MAAM,IAAI,OAAO,MAAM,IACvD,kBAAkB,2BAAU,sBAAsB,OAAO,MAAM,IAAI,OAAO,MAAM;AAAA,MACtF,QAAQ;AAGN,cAAM,WAAW,MAAM,SAAS,+BAA+B,UAAU,eAAe,QAAQ,SAAS,IAAI;AAC7G,eAAO,SAAS,SAAS,UAAU,KAAK,IAAI,mBAAmB,MAAM;AAAA,MACvE;AACA,WAAK,MAAM,SAAS,YAAY,UAAU,eAAe,QAAQ,SAAS,IAAI,GAAG,SAAS;AACxF,eAAO,KAAK;AAAA,MACd;AACA,aAAO,mBAAmB,MAAM;AAAA,IAClC;AAAA,EACF,CAAC;AACH;AAUO,SAAS,gCAAgC,UAAoB,SAA6D;AAC/H,QAAM,EAAE,MAAM,aAAa,UAAU,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AAC1E,QAAM,eAAW,8BAAY;AAAA,IAC3B,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,EAC5E,CAAC;AACD,0BAAwB,IAAI,UAAU,QAAQ;AAC9C,SAAO,EAAE,MAAM,aAAa,SAAS;AACvC;AAWO,SAAS,yBAAyB,UAAoB,UAAqC,CAAC,GAAG;AACpG,QAAM,EAAE,UAAU,YAAY,CAAC,GAAG,6BAA6B,CAAC,GAAG,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AACxG,QAAM,qBAAqB,UAAU,IAAI,CAAC,aAAa;AACrD,QAAI,cAAc,YAAY,aAAa,UAAU;AACnD,YAAM,IAAI,MAAM,sFAAsF;AAAA,IACxG;AACA,WAAO,EAAE,GAAG,UAAU,YAAY,CAAC,GAAI,SAAS,cAAc,CAAC,GAAI,2BAA2B,UAAU,QAAQ,CAAC,EAAE;AAAA,EACrH,CAAC;AACD,MAAI,CAAC,mBAAmB,KAAK,CAAC,aAAa,SAAS,SAAS,2CAAyB,IAAI,GAAG;AAC3F,uBAAmB,QAAQ,EAAE,GAAG,4CAA0B,YAAY,CAAC,2BAA2B,UAAU,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC1H;AACA,aAAW,QAAQ,4BAA4B;AAC7C,QAAI,CAAC,KAAK,YAAY,wBAAwB,IAAI,KAAK,QAAQ,MAAM,UAAU;AAC7E,YAAM,IAAI,MAAM,gGAAgG;AAAA,IAClH;AAAA,EACF;AACA,aAAO,mCAAgB;AAAA,IACrB,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,IAC1E,WAAW,CAAC,GAAG,oBAAoB,GAAG,0BAA0B;AAAA,EAClE,CAAC;AACH;","names":[]}