@silmaril-security/sdk 0.7.8 → 0.7.10

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.7.10
+
+- Require detector counts in single and batch classification responses to be
+  nonnegative integers while preserving valid floating-point scores and
+  forward-compatible unknown keys. No unrelated features are included.
+
+## 0.7.9
+
+- Reject invalid runtime mode values in clients, per-call overrides, and all
+  framework adapters before requests or fail-open handling. Valid modes and
+  legacy defaults retain their existing behavior.
+
 ## 0.7.8
 
 - Add explicit `standard` and `deep` review selection for clients and individual

package/README.md

@@ -34,10 +34,10 @@ This SDK is distributed as an npm package.
 npm install @silmaril-security/sdk
 ```
 
-After publication, pin version 0.7.8 for reproducible installs:
+After publication, pin version 0.7.10 for reproducible installs:
 
 ```sh
-npm install @silmaril-security/sdk@0.7.8
+npm install @silmaril-security/sdk@0.7.10
 ```
 
 Requires Node 20 or later.
@@ -310,6 +310,11 @@ threshold.
 
 ## Modes
 
+Modes are case-sensitive: use `shadow`, `warn`, or `block`. Invalid client or
+adapter settings throw during construction; invalid per-call modes reject
+before an HTTP request. Adapter fail-open handling does not ignore invalid
+configuration.
+
 Mode controls local SDK and adapter handling; the backend remains authoritative
 for threat decisions and thresholds. Explicitly set `mode: "shadow"` or
 `mode: "warn"` when you want observation without adapter enforcement. Set
@@ -702,6 +707,6 @@ IDs must be non-empty; MCP tools also require their canonical server parent ID.
 The compatibility metadata copy remains attribution only. Caller agent metadata
 does not supply an authenticated principal.
 
-This source prepares version 0.7.8. Its registry install command becomes
+This source prepares version 0.7.10. Its registry install command becomes
 available after the authorized main-branch release workflow publishes the package.
 Confirm registry publication before installing this version.

package/dist/adapters/deepagents.cjs

@@ -101,6 +101,14 @@ var FIREWALL_HOOK_TO_LABEL = {
 };
 var FIREWALL_HOOK_VALUES = new Set(Object.values(FirewallHook));
 
+// src/modes.ts
+function validateMode(value) {
+  if (value === void 0 || value === "shadow" || value === "warn" || value === "block") {
+    return value;
+  }
+  throw new Error("Firewall: mode must be shadow, warn, or block");
+}
+
 // src/adapters/deepagents.ts
 var SAFE_TOOL_MESSAGE = "Silmaril Firewall blocked this tool interaction. Choose a different safe action.";
 var SAFE_FINAL_MESSAGE = "Silmaril Firewall stopped this request after repeated unsafe actions.";
@@ -144,7 +152,7 @@ function createDeepAgentsMiddleware(firewall, options = {}) {
   if (!Number.isInteger(maxBlockedAttempts) || maxBlockedAttempts < 1) {
     throw new Error("maxBlockedAttempts must be a positive integer");
   }
-  const effectiveMode = options.mode ?? firewall.mode;
+  const effectiveMode = validateMode(options.mode) ?? firewall.mode;
   const classify = async (text, hook, toolName) => {
     if (!text.trim()) return { enforce: false, mode: effectiveMode };
     try {

package/dist/adapters/deepagents.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/deepagents.ts","../../src/exceptions.ts","../../src/hooks.ts"],"sourcesContent":["// Copyright (c) 2024-2026 Silmaril Security Inc. All rights reserved.\n\n/** Optional Deep Agents integration. Import from @silmaril-security/sdk/adapters/deepagents. */\nimport { AIMessage, HumanMessage, ToolMessage } from \"@langchain/core/messages\";\nimport { Command } from \"@langchain/langgraph\";\nimport { createDeepAgent, GENERAL_PURPOSE_SUBAGENT, type AnySubAgent, type CompiledSubAgent } from \"deepagents\";\nimport { createAgent, createMiddleware, type CreateAgentParams } from \"langchain\";\n\nimport type { Firewall } from \"../firewall.js\";\nimport { isReviewCompatibilityError } from \"../exceptions.js\";\nimport { HookLabel } from \"../hooks.js\";\nimport type { ClassifyEvent, FirewallMode } from \"../types.js\";\n\nexport const SAFE_TOOL_MESSAGE = \"Silmaril Firewall blocked this tool interaction. Choose a different safe action.\";\nexport const SAFE_FINAL_MESSAGE = \"Silmaril Firewall stopped this request after repeated unsafe actions.\";\nexport const SAFE_OUTPUT_MESSAGE = \"Silmaril Firewall blocked this response.\";\nconst BLOCKED_TOOL_MARKER = \"silmaril-firewall:v1:blocked-tool\";\nconst issuedBlockedMessages = new WeakSet<ToolMessage>();\n\n// A protected graph is identified by the exact runnable returned by our factory.\nconst protectedCompiledGraphs = new WeakMap<object, Firewall>();\n\nexport interface DeepAgentsMiddlewareOptions {\n  mode?: FirewallMode;\n  failOpen?: boolean;\n  maxBlockedAttempts?: number;\n  /** A caller-supplied sequence identity; never derived from a LangChain run ID. */\n  conversationId?: string;\n  onClassify?: (event: ClassifyEvent) => void;\n}\n\nfunction textOf(message: { content: unknown }): string {\n  return typeof message.content === \"string\" ? message.content : JSON.stringify(message.content);\n}\n\nfunction textOfStructuredValue(value: unknown, seen = new WeakSet<object>()): string {\n  if (value == null) return \"\";\n  if (typeof value !== \"object\") return String(value);\n  if (seen.has(value)) return \"[circular]\";\n  seen.add(value);\n  if (Array.isArray(value)) return value.map((item) => textOfStructuredValue(item, seen)).join(\"\\n\");\n  return Object.entries(value).map(([key, item]) => `${key}: ${textOfStructuredValue(item, seen)}`).join(\"\\n\");\n}\n\nfunction stripAllowedMarker(result: ToolMessage | Command): ToolMessage | Command {\n  const strip = (message: ToolMessage): ToolMessage => {\n    if (message.additional_kwargs?.silmarilBlocked !== BLOCKED_TOOL_MARKER) return message;\n    if (issuedBlockedMessages.has(message)) return message;\n    const { silmarilBlocked: _marker, ...additional_kwargs } = message.additional_kwargs;\n    // Tool providers may return frozen messages or metadata. Copy rather\n    // than mutating a result owned by the caller.\n    return new ToolMessage({ ...message, additional_kwargs });\n  };\n  if (ToolMessage.isInstance(result)) return strip(result);\n  if (result instanceof Command) {\n    const update = result.update;\n    if (update && !Array.isArray(update) && \"messages\" in update && Array.isArray(update.messages)) {\n      const originalMessages = update.messages;\n      const messages = originalMessages.map((message) => ToolMessage.isInstance(message) ? strip(message) : message);\n      if (messages.some((message, index) => message !== originalMessages[index])) {\n        return new Command({ ...result, update: { ...update, messages } });\n      }\n    }\n  }\n  return result;\n}\n\nexport function createDeepAgentsMiddleware(firewall: Firewall, options: DeepAgentsMiddlewareOptions = {}) {\n  const maxBlockedAttempts = options.maxBlockedAttempts ?? 3;\n  if (!Number.isInteger(maxBlockedAttempts) || maxBlockedAttempts < 1) {\n    throw new Error(\"maxBlockedAttempts must be a positive integer\");\n  }\n  const effectiveMode = options.mode ?? firewall.mode;\n  const classify = async (text: string, hook: HookLabel, toolName?: string): Promise<{ enforce: boolean; mode: FirewallMode | undefined }> => {\n    if (!text.trim()) return { enforce: false, mode: effectiveMode };\n    try {\n      const result = await firewall.classify(text, {\n        hook,\n        ...(toolName === undefined ? {} : { toolName }),\n        ...(effectiveMode === undefined ? {} : { mode: effectiveMode }),\n        ...(options.conversationId === undefined ? {} : { metadata: { conversationId: options.conversationId } }),\n      });\n      const mode = effectiveMode ?? result.mode ?? \"block\";\n      const blocked = result.prediction === \"MALICIOUS\" || result.governance?.action === \"block\";\n      if (options.onClassify) {\n        try {\n          options.onClassify({ hook, ...(toolName === undefined ? {} : { toolName }), text, result, blocked, mode, shadowMode: mode === \"shadow\" });\n        } catch {\n          // Observation callbacks do not change enforcement.\n        }\n      }\n      return { enforce: blocked && mode === \"block\", mode };\n    } catch (error) {\n      if (isReviewCompatibilityError(error)) throw error;\n      if (options.failOpen === false) throw error;\n      return { enforce: false, mode: effectiveMode };\n    }\n  };\n\n  return createMiddleware({\n    name: \"SilmarilDeepAgentsMiddleware\",\n    wrapModelCall: async (request, handler) => {\n      const history = request.state.messages;\n      let lastUserIndex = -1;\n      for (let i = history.length - 1; i >= 0; i--) {\n        if (HumanMessage.isInstance(history[i])) {\n          lastUserIndex = i;\n          break;\n        }\n      }\n      const blockedCount = history.slice(lastUserIndex + 1).filter(\n        (message) => ToolMessage.isInstance(message) && message.content === SAFE_TOOL_MESSAGE\n          && message.additional_kwargs?.silmarilBlocked === BLOCKED_TOOL_MARKER,\n      ).length;\n      const latestUser = [...request.messages].reverse().find(HumanMessage.isInstance);\n      const inputDecision = latestUser\n        ? await classify(textOf(latestUser), HookLabel.USER_INPUT)\n        : undefined;\n      if (inputDecision?.enforce) return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      const capMode = effectiveMode ?? inputDecision?.mode ?? \"block\";\n      // Only genuine prior Block markers count, and the terminal cap requires current effective Block mode.\n      if (blockedCount >= maxBlockedAttempts && capMode === \"block\") {\n        return new AIMessage(SAFE_FINAL_MESSAGE);\n      }\n      const response = await handler(request);\n      if (response instanceof Command && (await classify(textOfStructuredValue(response.update), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      if (AIMessage.isInstance(response) && (await classify(textOf(response), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      return response;\n    },\n    wrapToolCall: async (request, handler) => {\n      const safe = () => {\n        const message = new ToolMessage({\n          content: SAFE_TOOL_MESSAGE,\n          tool_call_id: request.toolCall.id ?? \"\",\n          name: request.toolCall.name,\n          additional_kwargs: { silmarilBlocked: BLOCKED_TOOL_MARKER },\n        });\n        issuedBlockedMessages.add(message);\n        return message;\n      };\n      if ((await classify(JSON.stringify(request.toolCall.args ?? {}), HookLabel.TOOL_CALL, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      const result = await handler(request);\n      let resultText: string;\n      try {\n        resultText = ToolMessage.isInstance(result) ? textOf(result)\n          : result instanceof Command ? textOfStructuredValue(result.update) : String(result);\n      } catch {\n        // Content cannot be inspected, but the backend still resolves the\n        // enforcement mode. Observation modes retain the original result.\n        const decision = await classify(\"[uninspectable tool result]\", HookLabel.TOOL_RESPONSE, request.toolCall.name);\n        return decision.mode === \"block\" ? safe() : stripAllowedMarker(result);\n      }\n      if ((await classify(resultText, HookLabel.TOOL_RESPONSE, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      return stripAllowedMarker(result);\n    },\n  });\n}\n\nexport interface ProtectedCompiledSubagentOptions extends Omit<CreateAgentParams, \"middleware\"> {\n  name: string;\n  description: string;\n  middleware?: CreateAgentParams[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Compile a subagent with Silmaril middleware and register that exact graph. */\nexport function createProtectedCompiledSubagent(firewall: Firewall, options: ProtectedCompiledSubagentOptions): CompiledSubAgent {\n  const { name, description, silmaril, middleware = [], ...agentOptions } = options;\n  const runnable = createAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)] as const,\n  });\n  protectedCompiledGraphs.set(runnable, firewall);\n  return { name, description, runnable };\n}\n\nexport interface ProtectedDeepAgentOptions extends Omit<NonNullable<Parameters<typeof createDeepAgent>[0]>, \"subagents\" | \"middleware\"> {\n  subagents?: readonly AnySubAgent[];\n  /** Only pass specs returned by createProtectedCompiledSubagent for this client. */\n  protectedCompiledSubagents?: readonly CompiledSubAgent[];\n  middleware?: NonNullable<Parameters<typeof createDeepAgent>[0]>[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Protect root, default general-purpose, and declarative subagents. */\nexport function createProtectedDeepAgent(firewall: Firewall, options: ProtectedDeepAgentOptions = {}) {\n  const { silmaril, subagents = [], protectedCompiledSubagents = [], middleware = [], ...agentOptions } = options;\n  const protectedSubagents = subagents.map((subagent) => {\n    if (\"runnable\" in subagent || \"graphId\" in subagent) {\n      throw new Error(\"Compiled or remote subagents must install Silmaril middleware inside their own graph\");\n    }\n    return { ...subagent, middleware: [...(subagent.middleware ?? []), createDeepAgentsMiddleware(firewall, silmaril)] };\n  });\n  if (!protectedSubagents.some((subagent) => subagent.name === GENERAL_PURPOSE_SUBAGENT.name)) {\n    protectedSubagents.unshift({ ...GENERAL_PURPOSE_SUBAGENT, middleware: [createDeepAgentsMiddleware(firewall, silmaril)] });\n  }\n  for (const spec of protectedCompiledSubagents) {\n    if (!spec.runnable || protectedCompiledGraphs.get(spec.runnable) !== firewall) {\n      throw new Error(\"Compiled subagents must be built with createProtectedCompiledSubagent for this Firewall client\");\n    }\n  }\n  return createDeepAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)],\n    subagents: [...protectedSubagents, ...protectedCompiledSubagents],\n  });\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nimport type { HookLabel } from \"./hooks.js\";\nimport type { BlockResult, ReviewLevel } from \"./types.js\";\n\nconst MAX_PROMPT_DISPLAY_LEN = 100;\n\nexport interface MalformedInputDetails {\n  field?: string;\n  inputIndex?: number;\n  charOffset?: number;\n  malformedToken?: string;\n  codePoint?: string;\n  reason?: string;\n}\n\nexport class FirewallBlockedException extends Error {\n  readonly score: number;\n  readonly threshold: number;\n  readonly promptText: string;\n  readonly runId: string | undefined;\n  readonly hook: HookLabel | undefined;\n  readonly toolName: string | undefined;\n  readonly toolCallId: string | undefined;\n  readonly result: BlockResult | undefined;\n\n  constructor(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    runId?: string;\n    hook?: HookLabel;\n    toolName?: string;\n    toolCallId?: string;\n    result?: BlockResult;\n  }) {\n    super(FirewallBlockedException.formatMessage(params));\n    this.name = \"FirewallBlockedException\";\n    this.score = params.score;\n    this.threshold = params.threshold;\n    this.promptText = params.promptText;\n    this.runId = params.runId;\n    this.hook = params.hook;\n    this.toolName = params.toolName;\n    this.toolCallId = params.toolCallId;\n    this.result = params.result;\n    Object.setPrototypeOf(this, FirewallBlockedException.prototype);\n  }\n\n  private static formatMessage(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    result?: BlockResult;\n  }): string {\n    const truncated =\n      params.promptText.length > MAX_PROMPT_DISPLAY_LEN\n        ? `${params.promptText.slice(0, MAX_PROMPT_DISPLAY_LEN)}...`\n        : params.promptText;\n    if (\n      params.result?.prediction !== \"MALICIOUS\" &&\n      params.result?.governance?.action === \"block\"\n    ) {\n      return `Request blocked by Silmaril Firewall governance policy: '${truncated}'`;\n    }\n    return (\n      `Request blocked by Silmaril Firewall ` +\n      `(score=${params.score.toFixed(4)}, threshold=${params.threshold.toFixed(4)}): ` +\n      `'${truncated}'`\n    );\n  }\n}\n\n/** @deprecated Use FirewallBlockedException instead. */\nexport const PromptBlockedException = FirewallBlockedException;\n/** @deprecated Use FirewallBlockedException instead. */\nexport type PromptBlockedException = FirewallBlockedException;\n\nconst REVIEW_COMPATIBILITY_ERROR_BRAND = Symbol.for(\n  \"@silmaril-security/sdk/ReviewCompatibilityError\",\n);\n\nexport class ReviewCompatibilityError extends Error {\n  readonly requestedReview: ReviewLevel;\n  readonly acknowledgedReview: unknown;\n\n  constructor(requestedReview: ReviewLevel, acknowledgedReview: unknown) {\n    const detail = acknowledgedReview === undefined\n      ? \"the response omitted its acknowledgement\"\n      : \"the response acknowledgement did not match\";\n    super(`Silmaril review compatibility error: ${detail} for requested ${requestedReview} review`);\n    this.name = \"ReviewCompatibilityError\";\n    this.requestedReview = requestedReview;\n    this.acknowledgedReview = acknowledgedReview;\n    Object.defineProperty(this, REVIEW_COMPATIBILITY_ERROR_BRAND, {\n      value: true,\n      enumerable: false,\n      configurable: false,\n      writable: false,\n    });\n    Object.setPrototypeOf(this, ReviewCompatibilityError.prototype);\n  }\n}\n\nexport function isReviewCompatibilityError(error: unknown): error is ReviewCompatibilityError {\n  if ((typeof error !== \"object\" && typeof error !== \"function\") || error === null) {\n    return false;\n  }\n  try {\n    return Object.getOwnPropertyDescriptor(\n      error,\n      REVIEW_COMPATIBILITY_ERROR_BRAND,\n    )?.value === true;\n  } catch {\n    return false;\n  }\n}\n\nexport class SilmarilApiError extends Error {\n  readonly status: number;\n  readonly statusText: string;\n  readonly body: string;\n  readonly details: MalformedInputDetails | undefined;\n  readonly error: string | undefined;\n  readonly apiMessage: string | undefined;\n\n  constructor(params: {\n    status: number;\n    statusText: string;\n    body: string;\n    details?: MalformedInputDetails;\n    error?: string;\n    apiMessage?: string;\n  }) {\n    const statusText = params.statusText ? ` ${params.statusText}` : \"\";\n    super(`Silmaril API error ${params.status}${statusText}`);\n    this.name = \"SilmarilApiError\";\n    this.status = params.status;\n    this.statusText = params.statusText;\n    this.body = params.body;\n    const parsed = parseErrorBody(params.body);\n    this.details = params.details ?? parsed.details;\n    this.error = params.error ?? parsed.error;\n    this.apiMessage = params.apiMessage ?? parsed.apiMessage;\n    Object.setPrototypeOf(this, SilmarilApiError.prototype);\n  }\n}\n\nfunction parseErrorBody(body: string): {\n  details: MalformedInputDetails | undefined;\n  error: string | undefined;\n  apiMessage: string | undefined;\n} {\n  try {\n    const parsed = JSON.parse(body) as unknown;\n    if (!parsed || typeof parsed !== \"object\") {\n      return { details: undefined, error: undefined, apiMessage: undefined };\n    }\n    const data = parsed as Record<string, unknown>;\n    return {\n      details:\n        data.details && typeof data.details === \"object\"\n          ? (data.details as MalformedInputDetails)\n          : undefined,\n      error: typeof data.error === \"string\" ? data.error : undefined,\n      apiMessage: typeof data.message === \"string\" ? data.message : undefined,\n    };\n  } catch {\n    return { details: undefined, error: undefined, apiMessage: undefined };\n  }\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nexport const HookLabel = {\n  USER_INPUT: \"user_input\",\n  SYSTEM_PROMPT: \"system_prompt\",\n  TOOL_CALL: \"tool_call\",\n  TOOL_RESPONSE: \"tool_response\",\n  LLM_OUTPUT: \"llm_output\",\n  UNKNOWN: \"unknown\",\n} as const;\n\nexport type HookLabel = (typeof HookLabel)[keyof typeof HookLabel];\n\nexport const FirewallHook = {\n  LLM_START: \"on_llm_start\",\n  CHAT_MODEL_START: \"on_chat_model_start\",\n  TOOL_START: \"on_tool_start\",\n  RETRIEVER_START: \"on_retriever_start\",\n  LLM_END: \"on_llm_end\",\n  TOOL_END: \"on_tool_end\",\n  RETRIEVER_END: \"on_retriever_end\",\n} as const;\n\nexport type FirewallHook = (typeof FirewallHook)[keyof typeof FirewallHook];\n\nexport const DEFAULT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.TOOL_END,\n]);\n\nexport const INPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.RETRIEVER_START,\n]);\n\nexport const OUTPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_END,\n  FirewallHook.TOOL_END,\n  FirewallHook.RETRIEVER_END,\n]);\n\nexport const ALL_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  ...INPUT_HOOKS,\n  ...OUTPUT_HOOKS,\n]);\n\nexport const FIREWALL_HOOK_TO_LABEL: Readonly<Record<FirewallHook, HookLabel>> = {\n  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,\n  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,\n  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT,\n};\n\nconst FIREWALL_HOOK_VALUES: ReadonlySet<string> = new Set(Object.values(FirewallHook));\n\nexport function resolveHooks(\n  hooks: Iterable<FirewallHook | string> | undefined,\n): ReadonlySet<FirewallHook> {\n  if (hooks === undefined) {\n    return DEFAULT_HOOKS;\n  }\n  const resolved = new Set<FirewallHook>();\n  for (const h of hooks) {\n    if (!FIREWALL_HOOK_VALUES.has(h)) {\n      throw new Error(`Invalid FirewallHook value: ${String(h)}`);\n    }\n    resolved.add(h as FirewallHook);\n  }\n  return resolved;\n}\n\nexport function prependHook(text: string, hook: HookLabel | string | undefined | null): string {\n  if (hook === undefined || hook === null) {\n    return text;\n  }\n  if (hook === HookLabel.UNKNOWN) {\n    return text;\n  }\n  return `[HOOK:${hook}] ${text}`;\n}\n\nexport function prependToolName(text: string, toolName: string | undefined | null): string {\n  if (toolName === undefined || toolName === null) {\n    return text;\n  }\n  return `[TOOL:${toolName}] ${text}`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,sBAAqD;AACrD,uBAAwB;AACxB,wBAAmG;AACnG,uBAAsE;;;ACyEtE,IAAM,mCAAmC,uBAAO;AAAA,EAC9C;AACF;AAwBO,SAAS,2BAA2B,OAAmD;AAC5F,MAAK,OAAO,UAAU,YAAY,OAAO,UAAU,cAAe,UAAU,MAAM;AAChF,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,IACF,GAAG,UAAU;AAAA,EACf,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AClHO,IAAM,YAAY;AAAA,EACvB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,SAAS;AACX;AAIO,IAAM,eAAe;AAAA,EAC1B,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,UAAU;AAAA,EACV,eAAe;AACjB;AAIO,IAAM,gBAA2C,oBAAI,IAAkB;AAAA,EAC5E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,cAAyC,oBAAI,IAAkB;AAAA,EAC1E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,eAA0C,oBAAI,IAAkB;AAAA,EAC3E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,YAAuC,oBAAI,IAAkB;AAAA,EACxE,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAEM,IAAM,yBAAoE;AAAA,EAC/E,CAAC,aAAa,gBAAgB,GAAG,UAAU;AAAA,EAC3C,CAAC,aAAa,SAAS,GAAG,UAAU;AAAA,EACpC,CAAC,aAAa,UAAU,GAAG,UAAU;AAAA,EACrC,CAAC,aAAa,QAAQ,GAAG,UAAU;AAAA,EACnC,CAAC,aAAa,eAAe,GAAG,UAAU;AAAA,EAC1C,CAAC,aAAa,aAAa,GAAG,UAAU;AAAA,EACxC,CAAC,aAAa,OAAO,GAAG,UAAU;AACpC;AAEA,IAAM,uBAA4C,IAAI,IAAI,OAAO,OAAO,YAAY,CAAC;;;AFhD9E,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AACnC,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB,oBAAI,QAAqB;AAGvD,IAAM,0BAA0B,oBAAI,QAA0B;AAW9D,SAAS,OAAO,SAAuC;AACrD,SAAO,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU,KAAK,UAAU,QAAQ,OAAO;AAC/F;AAEA,SAAS,sBAAsB,OAAgB,OAAO,oBAAI,QAAgB,GAAW;AACnF,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAClD,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AACd,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,sBAAsB,MAAM,IAAI,CAAC,EAAE,KAAK,IAAI;AACjG,SAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,GAAG,KAAK,sBAAsB,MAAM,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI;AAC7G;AAEA,SAAS,mBAAmB,QAAsD;AAChF,QAAM,QAAQ,CAAC,YAAsC;AACnD,QAAI,QAAQ,mBAAmB,oBAAoB,oBAAqB,QAAO;AAC/E,QAAI,sBAAsB,IAAI,OAAO,EAAG,QAAO;AAC/C,UAAM,EAAE,iBAAiB,SAAS,GAAG,kBAAkB,IAAI,QAAQ;AAGnE,WAAO,IAAI,4BAAY,EAAE,GAAG,SAAS,kBAAkB,CAAC;AAAA,EAC1D;AACA,MAAI,4BAAY,WAAW,MAAM,EAAG,QAAO,MAAM,MAAM;AACvD,MAAI,kBAAkB,0BAAS;AAC7B,UAAM,SAAS,OAAO;AACtB,QAAI,UAAU,CAAC,MAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAC9F,YAAM,mBAAmB,OAAO;AAChC,YAAM,WAAW,iBAAiB,IAAI,CAAC,YAAY,4BAAY,WAAW,OAAO,IAAI,MAAM,OAAO,IAAI,OAAO;AAC7G,UAAI,SAAS,KAAK,CAAC,SAAS,UAAU,YAAY,iBAAiB,KAAK,CAAC,GAAG;AAC1E,eAAO,IAAI,yBAAQ,EAAE,GAAG,QAAQ,QAAQ,EAAE,GAAG,QAAQ,SAAS,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,UAAoB,UAAuC,CAAC,GAAG;AACxG,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,MAAI,CAAC,OAAO,UAAU,kBAAkB,KAAK,qBAAqB,GAAG;AACnE,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,gBAAgB,QAAQ,QAAQ,SAAS;AAC/C,QAAM,WAAW,OAAO,MAAc,MAAiB,aAAqF;AAC1I,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAC/D,QAAI;AACF,YAAM,SAAS,MAAM,SAAS,SAAS,MAAM;AAAA,QAC3C;AAAA,QACA,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,QAC7C,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,MAAM,cAAc;AAAA,QAC7D,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,QAAQ,eAAe,EAAE;AAAA,MACzG,CAAC;AACD,YAAM,OAAO,iBAAiB,OAAO,QAAQ;AAC7C,YAAM,UAAU,OAAO,eAAe,eAAe,OAAO,YAAY,WAAW;AACnF,UAAI,QAAQ,YAAY;AACtB,YAAI;AACF,kBAAQ,WAAW,EAAE,MAAM,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,GAAI,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,CAAC;AAAA,QAC1I,QAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO,EAAE,SAAS,WAAW,SAAS,SAAS,KAAK;AAAA,IACtD,SAAS,OAAO;AACd,UAAI,2BAA2B,KAAK,EAAG,OAAM;AAC7C,UAAI,QAAQ,aAAa,MAAO,OAAM;AACtC,aAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAAA,IAC/C;AAAA,EACF;AAEA,aAAO,mCAAiB;AAAA,IACtB,MAAM;AAAA,IACN,eAAe,OAAO,SAAS,YAAY;AACzC,YAAM,UAAU,QAAQ,MAAM;AAC9B,UAAI,gBAAgB;AACpB,eAAS,IAAI,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;AAC5C,YAAI,6BAAa,WAAW,QAAQ,CAAC,CAAC,GAAG;AACvC,0BAAgB;AAChB;AAAA,QACF;AAAA,MACF;AACA,YAAM,eAAe,QAAQ,MAAM,gBAAgB,CAAC,EAAE;AAAA,QACpD,CAAC,YAAY,4BAAY,WAAW,OAAO,KAAK,QAAQ,YAAY,qBAC/D,QAAQ,mBAAmB,oBAAoB;AAAA,MACtD,EAAE;AACF,YAAM,aAAa,CAAC,GAAG,QAAQ,QAAQ,EAAE,QAAQ,EAAE,KAAK,6BAAa,UAAU;AAC/E,YAAM,gBAAgB,aAClB,MAAM,SAAS,OAAO,UAAU,GAAG,UAAU,UAAU,IACvD;AACJ,UAAI,eAAe,QAAS,QAAO,IAAI,0BAAU,mBAAmB;AACpE,YAAM,UAAU,iBAAiB,eAAe,QAAQ;AAExD,UAAI,gBAAgB,sBAAsB,YAAY,SAAS;AAC7D,eAAO,IAAI,0BAAU,kBAAkB;AAAA,MACzC;AACA,YAAM,WAAW,MAAM,QAAQ,OAAO;AACtC,UAAI,oBAAoB,6BAAY,MAAM,SAAS,sBAAsB,SAAS,MAAM,GAAG,UAAU,UAAU,GAAG,SAAS;AACzH,eAAO,IAAI,0BAAU,mBAAmB;AAAA,MAC1C;AACA,UAAI,0BAAU,WAAW,QAAQ,MAAM,MAAM,SAAS,OAAO,QAAQ,GAAG,UAAU,UAAU,GAAG,SAAS;AACtG,eAAO,IAAI,0BAAU,mBAAmB;AAAA,MAC1C;AACA,aAAO;AAAA,IACT;AAAA,IACA,cAAc,OAAO,SAAS,YAAY;AACxC,YAAM,OAAO,MAAM;AACjB,cAAM,UAAU,IAAI,4BAAY;AAAA,UAC9B,SAAS;AAAA,UACT,cAAc,QAAQ,SAAS,MAAM;AAAA,UACrC,MAAM,QAAQ,SAAS;AAAA,UACvB,mBAAmB,EAAE,iBAAiB,oBAAoB;AAAA,QAC5D,CAAC;AACD,8BAAsB,IAAI,OAAO;AACjC,eAAO;AAAA,MACT;AACA,WAAK,MAAM,SAAS,KAAK,UAAU,QAAQ,SAAS,QAAQ,CAAC,CAAC,GAAG,UAAU,WAAW,QAAQ,SAAS,IAAI,GAAG,SAAS;AACrH,eAAO,KAAK;AAAA,MACd;AACA,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,UAAI;AACJ,UAAI;AACF,qBAAa,4BAAY,WAAW,MAAM,IAAI,OAAO,MAAM,IACvD,kBAAkB,2BAAU,sBAAsB,OAAO,MAAM,IAAI,OAAO,MAAM;AAAA,MACtF,QAAQ;AAGN,cAAM,WAAW,MAAM,SAAS,+BAA+B,UAAU,eAAe,QAAQ,SAAS,IAAI;AAC7G,eAAO,SAAS,SAAS,UAAU,KAAK,IAAI,mBAAmB,MAAM;AAAA,MACvE;AACA,WAAK,MAAM,SAAS,YAAY,UAAU,eAAe,QAAQ,SAAS,IAAI,GAAG,SAAS;AACxF,eAAO,KAAK;AAAA,MACd;AACA,aAAO,mBAAmB,MAAM;AAAA,IAClC;AAAA,EACF,CAAC;AACH;AAUO,SAAS,gCAAgC,UAAoB,SAA6D;AAC/H,QAAM,EAAE,MAAM,aAAa,UAAU,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AAC1E,QAAM,eAAW,8BAAY;AAAA,IAC3B,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,EAC5E,CAAC;AACD,0BAAwB,IAAI,UAAU,QAAQ;AAC9C,SAAO,EAAE,MAAM,aAAa,SAAS;AACvC;AAWO,SAAS,yBAAyB,UAAoB,UAAqC,CAAC,GAAG;AACpG,QAAM,EAAE,UAAU,YAAY,CAAC,GAAG,6BAA6B,CAAC,GAAG,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AACxG,QAAM,qBAAqB,UAAU,IAAI,CAAC,aAAa;AACrD,QAAI,cAAc,YAAY,aAAa,UAAU;AACnD,YAAM,IAAI,MAAM,sFAAsF;AAAA,IACxG;AACA,WAAO,EAAE,GAAG,UAAU,YAAY,CAAC,GAAI,SAAS,cAAc,CAAC,GAAI,2BAA2B,UAAU,QAAQ,CAAC,EAAE;AAAA,EACrH,CAAC;AACD,MAAI,CAAC,mBAAmB,KAAK,CAAC,aAAa,SAAS,SAAS,2CAAyB,IAAI,GAAG;AAC3F,uBAAmB,QAAQ,EAAE,GAAG,4CAA0B,YAAY,CAAC,2BAA2B,UAAU,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC1H;AACA,aAAW,QAAQ,4BAA4B;AAC7C,QAAI,CAAC,KAAK,YAAY,wBAAwB,IAAI,KAAK,QAAQ,MAAM,UAAU;AAC7E,YAAM,IAAI,MAAM,gGAAgG;AAAA,IAClH;AAAA,EACF;AACA,aAAO,mCAAgB;AAAA,IACrB,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,IAC1E,WAAW,CAAC,GAAG,oBAAoB,GAAG,0BAA0B;AAAA,EAClE,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/adapters/deepagents.ts","../../src/exceptions.ts","../../src/hooks.ts","../../src/modes.ts"],"sourcesContent":["// Copyright (c) 2024-2026 Silmaril Security Inc. All rights reserved.\n\n/** Optional Deep Agents integration. Import from @silmaril-security/sdk/adapters/deepagents. */\nimport { AIMessage, HumanMessage, ToolMessage } from \"@langchain/core/messages\";\nimport { Command } from \"@langchain/langgraph\";\nimport { createDeepAgent, GENERAL_PURPOSE_SUBAGENT, type AnySubAgent, type CompiledSubAgent } from \"deepagents\";\nimport { createAgent, createMiddleware, type CreateAgentParams } from \"langchain\";\n\nimport type { Firewall } from \"../firewall.js\";\nimport { isReviewCompatibilityError } from \"../exceptions.js\";\nimport { HookLabel } from \"../hooks.js\";\nimport { validateMode } from \"../modes.js\";\nimport type { ClassifyEvent, FirewallMode } from \"../types.js\";\n\nexport const SAFE_TOOL_MESSAGE = \"Silmaril Firewall blocked this tool interaction. Choose a different safe action.\";\nexport const SAFE_FINAL_MESSAGE = \"Silmaril Firewall stopped this request after repeated unsafe actions.\";\nexport const SAFE_OUTPUT_MESSAGE = \"Silmaril Firewall blocked this response.\";\nconst BLOCKED_TOOL_MARKER = \"silmaril-firewall:v1:blocked-tool\";\nconst issuedBlockedMessages = new WeakSet<ToolMessage>();\n\n// A protected graph is identified by the exact runnable returned by our factory.\nconst protectedCompiledGraphs = new WeakMap<object, Firewall>();\n\nexport interface DeepAgentsMiddlewareOptions {\n  mode?: FirewallMode;\n  failOpen?: boolean;\n  maxBlockedAttempts?: number;\n  /** A caller-supplied sequence identity; never derived from a LangChain run ID. */\n  conversationId?: string;\n  onClassify?: (event: ClassifyEvent) => void;\n}\n\nfunction textOf(message: { content: unknown }): string {\n  return typeof message.content === \"string\" ? message.content : JSON.stringify(message.content);\n}\n\nfunction textOfStructuredValue(value: unknown, seen = new WeakSet<object>()): string {\n  if (value == null) return \"\";\n  if (typeof value !== \"object\") return String(value);\n  if (seen.has(value)) return \"[circular]\";\n  seen.add(value);\n  if (Array.isArray(value)) return value.map((item) => textOfStructuredValue(item, seen)).join(\"\\n\");\n  return Object.entries(value).map(([key, item]) => `${key}: ${textOfStructuredValue(item, seen)}`).join(\"\\n\");\n}\n\nfunction stripAllowedMarker(result: ToolMessage | Command): ToolMessage | Command {\n  const strip = (message: ToolMessage): ToolMessage => {\n    if (message.additional_kwargs?.silmarilBlocked !== BLOCKED_TOOL_MARKER) return message;\n    if (issuedBlockedMessages.has(message)) return message;\n    const { silmarilBlocked: _marker, ...additional_kwargs } = message.additional_kwargs;\n    // Tool providers may return frozen messages or metadata. Copy rather\n    // than mutating a result owned by the caller.\n    return new ToolMessage({ ...message, additional_kwargs });\n  };\n  if (ToolMessage.isInstance(result)) return strip(result);\n  if (result instanceof Command) {\n    const update = result.update;\n    if (update && !Array.isArray(update) && \"messages\" in update && Array.isArray(update.messages)) {\n      const originalMessages = update.messages;\n      const messages = originalMessages.map((message) => ToolMessage.isInstance(message) ? strip(message) : message);\n      if (messages.some((message, index) => message !== originalMessages[index])) {\n        return new Command({ ...result, update: { ...update, messages } });\n      }\n    }\n  }\n  return result;\n}\n\nexport function createDeepAgentsMiddleware(firewall: Firewall, options: DeepAgentsMiddlewareOptions = {}) {\n  const maxBlockedAttempts = options.maxBlockedAttempts ?? 3;\n  if (!Number.isInteger(maxBlockedAttempts) || maxBlockedAttempts < 1) {\n    throw new Error(\"maxBlockedAttempts must be a positive integer\");\n  }\n  const effectiveMode = validateMode(options.mode) ?? firewall.mode;\n  const classify = async (text: string, hook: HookLabel, toolName?: string): Promise<{ enforce: boolean; mode: FirewallMode | undefined }> => {\n    if (!text.trim()) return { enforce: false, mode: effectiveMode };\n    try {\n      const result = await firewall.classify(text, {\n        hook,\n        ...(toolName === undefined ? {} : { toolName }),\n        ...(effectiveMode === undefined ? {} : { mode: effectiveMode }),\n        ...(options.conversationId === undefined ? {} : { metadata: { conversationId: options.conversationId } }),\n      });\n      const mode = effectiveMode ?? result.mode ?? \"block\";\n      const blocked = result.prediction === \"MALICIOUS\" || result.governance?.action === \"block\";\n      if (options.onClassify) {\n        try {\n          options.onClassify({ hook, ...(toolName === undefined ? {} : { toolName }), text, result, blocked, mode, shadowMode: mode === \"shadow\" });\n        } catch {\n          // Observation callbacks do not change enforcement.\n        }\n      }\n      return { enforce: blocked && mode === \"block\", mode };\n    } catch (error) {\n      if (isReviewCompatibilityError(error)) throw error;\n      if (options.failOpen === false) throw error;\n      return { enforce: false, mode: effectiveMode };\n    }\n  };\n\n  return createMiddleware({\n    name: \"SilmarilDeepAgentsMiddleware\",\n    wrapModelCall: async (request, handler) => {\n      const history = request.state.messages;\n      let lastUserIndex = -1;\n      for (let i = history.length - 1; i >= 0; i--) {\n        if (HumanMessage.isInstance(history[i])) {\n          lastUserIndex = i;\n          break;\n        }\n      }\n      const blockedCount = history.slice(lastUserIndex + 1).filter(\n        (message) => ToolMessage.isInstance(message) && message.content === SAFE_TOOL_MESSAGE\n          && message.additional_kwargs?.silmarilBlocked === BLOCKED_TOOL_MARKER,\n      ).length;\n      const latestUser = [...request.messages].reverse().find(HumanMessage.isInstance);\n      const inputDecision = latestUser\n        ? await classify(textOf(latestUser), HookLabel.USER_INPUT)\n        : undefined;\n      if (inputDecision?.enforce) return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      const capMode = effectiveMode ?? inputDecision?.mode ?? \"block\";\n      // Only genuine prior Block markers count, and the terminal cap requires current effective Block mode.\n      if (blockedCount >= maxBlockedAttempts && capMode === \"block\") {\n        return new AIMessage(SAFE_FINAL_MESSAGE);\n      }\n      const response = await handler(request);\n      if (response instanceof Command && (await classify(textOfStructuredValue(response.update), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      if (AIMessage.isInstance(response) && (await classify(textOf(response), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      return response;\n    },\n    wrapToolCall: async (request, handler) => {\n      const safe = () => {\n        const message = new ToolMessage({\n          content: SAFE_TOOL_MESSAGE,\n          tool_call_id: request.toolCall.id ?? \"\",\n          name: request.toolCall.name,\n          additional_kwargs: { silmarilBlocked: BLOCKED_TOOL_MARKER },\n        });\n        issuedBlockedMessages.add(message);\n        return message;\n      };\n      if ((await classify(JSON.stringify(request.toolCall.args ?? {}), HookLabel.TOOL_CALL, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      const result = await handler(request);\n      let resultText: string;\n      try {\n        resultText = ToolMessage.isInstance(result) ? textOf(result)\n          : result instanceof Command ? textOfStructuredValue(result.update) : String(result);\n      } catch {\n        // Content cannot be inspected, but the backend still resolves the\n        // enforcement mode. Observation modes retain the original result.\n        const decision = await classify(\"[uninspectable tool result]\", HookLabel.TOOL_RESPONSE, request.toolCall.name);\n        return decision.mode === \"block\" ? safe() : stripAllowedMarker(result);\n      }\n      if ((await classify(resultText, HookLabel.TOOL_RESPONSE, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      return stripAllowedMarker(result);\n    },\n  });\n}\n\nexport interface ProtectedCompiledSubagentOptions extends Omit<CreateAgentParams, \"middleware\"> {\n  name: string;\n  description: string;\n  middleware?: CreateAgentParams[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Compile a subagent with Silmaril middleware and register that exact graph. */\nexport function createProtectedCompiledSubagent(firewall: Firewall, options: ProtectedCompiledSubagentOptions): CompiledSubAgent {\n  const { name, description, silmaril, middleware = [], ...agentOptions } = options;\n  const runnable = createAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)] as const,\n  });\n  protectedCompiledGraphs.set(runnable, firewall);\n  return { name, description, runnable };\n}\n\nexport interface ProtectedDeepAgentOptions extends Omit<NonNullable<Parameters<typeof createDeepAgent>[0]>, \"subagents\" | \"middleware\"> {\n  subagents?: readonly AnySubAgent[];\n  /** Only pass specs returned by createProtectedCompiledSubagent for this client. */\n  protectedCompiledSubagents?: readonly CompiledSubAgent[];\n  middleware?: NonNullable<Parameters<typeof createDeepAgent>[0]>[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Protect root, default general-purpose, and declarative subagents. */\nexport function createProtectedDeepAgent(firewall: Firewall, options: ProtectedDeepAgentOptions = {}) {\n  const { silmaril, subagents = [], protectedCompiledSubagents = [], middleware = [], ...agentOptions } = options;\n  const protectedSubagents = subagents.map((subagent) => {\n    if (\"runnable\" in subagent || \"graphId\" in subagent) {\n      throw new Error(\"Compiled or remote subagents must install Silmaril middleware inside their own graph\");\n    }\n    return { ...subagent, middleware: [...(subagent.middleware ?? []), createDeepAgentsMiddleware(firewall, silmaril)] };\n  });\n  if (!protectedSubagents.some((subagent) => subagent.name === GENERAL_PURPOSE_SUBAGENT.name)) {\n    protectedSubagents.unshift({ ...GENERAL_PURPOSE_SUBAGENT, middleware: [createDeepAgentsMiddleware(firewall, silmaril)] });\n  }\n  for (const spec of protectedCompiledSubagents) {\n    if (!spec.runnable || protectedCompiledGraphs.get(spec.runnable) !== firewall) {\n      throw new Error(\"Compiled subagents must be built with createProtectedCompiledSubagent for this Firewall client\");\n    }\n  }\n  return createDeepAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)],\n    subagents: [...protectedSubagents, ...protectedCompiledSubagents],\n  });\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nimport type { HookLabel } from \"./hooks.js\";\nimport type { BlockResult, ReviewLevel } from \"./types.js\";\n\nconst MAX_PROMPT_DISPLAY_LEN = 100;\n\nexport interface MalformedInputDetails {\n  field?: string;\n  inputIndex?: number;\n  charOffset?: number;\n  malformedToken?: string;\n  codePoint?: string;\n  reason?: string;\n}\n\nexport class FirewallBlockedException extends Error {\n  readonly score: number;\n  readonly threshold: number;\n  readonly promptText: string;\n  readonly runId: string | undefined;\n  readonly hook: HookLabel | undefined;\n  readonly toolName: string | undefined;\n  readonly toolCallId: string | undefined;\n  readonly result: BlockResult | undefined;\n\n  constructor(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    runId?: string;\n    hook?: HookLabel;\n    toolName?: string;\n    toolCallId?: string;\n    result?: BlockResult;\n  }) {\n    super(FirewallBlockedException.formatMessage(params));\n    this.name = \"FirewallBlockedException\";\n    this.score = params.score;\n    this.threshold = params.threshold;\n    this.promptText = params.promptText;\n    this.runId = params.runId;\n    this.hook = params.hook;\n    this.toolName = params.toolName;\n    this.toolCallId = params.toolCallId;\n    this.result = params.result;\n    Object.setPrototypeOf(this, FirewallBlockedException.prototype);\n  }\n\n  private static formatMessage(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    result?: BlockResult;\n  }): string {\n    const truncated =\n      params.promptText.length > MAX_PROMPT_DISPLAY_LEN\n        ? `${params.promptText.slice(0, MAX_PROMPT_DISPLAY_LEN)}...`\n        : params.promptText;\n    if (\n      params.result?.prediction !== \"MALICIOUS\" &&\n      params.result?.governance?.action === \"block\"\n    ) {\n      return `Request blocked by Silmaril Firewall governance policy: '${truncated}'`;\n    }\n    return (\n      `Request blocked by Silmaril Firewall ` +\n      `(score=${params.score.toFixed(4)}, threshold=${params.threshold.toFixed(4)}): ` +\n      `'${truncated}'`\n    );\n  }\n}\n\n/** @deprecated Use FirewallBlockedException instead. */\nexport const PromptBlockedException = FirewallBlockedException;\n/** @deprecated Use FirewallBlockedException instead. */\nexport type PromptBlockedException = FirewallBlockedException;\n\nconst REVIEW_COMPATIBILITY_ERROR_BRAND = Symbol.for(\n  \"@silmaril-security/sdk/ReviewCompatibilityError\",\n);\n\nexport class ReviewCompatibilityError extends Error {\n  readonly requestedReview: ReviewLevel;\n  readonly acknowledgedReview: unknown;\n\n  constructor(requestedReview: ReviewLevel, acknowledgedReview: unknown) {\n    const detail = acknowledgedReview === undefined\n      ? \"the response omitted its acknowledgement\"\n      : \"the response acknowledgement did not match\";\n    super(`Silmaril review compatibility error: ${detail} for requested ${requestedReview} review`);\n    this.name = \"ReviewCompatibilityError\";\n    this.requestedReview = requestedReview;\n    this.acknowledgedReview = acknowledgedReview;\n    Object.defineProperty(this, REVIEW_COMPATIBILITY_ERROR_BRAND, {\n      value: true,\n      enumerable: false,\n      configurable: false,\n      writable: false,\n    });\n    Object.setPrototypeOf(this, ReviewCompatibilityError.prototype);\n  }\n}\n\nexport function isReviewCompatibilityError(error: unknown): error is ReviewCompatibilityError {\n  if ((typeof error !== \"object\" && typeof error !== \"function\") || error === null) {\n    return false;\n  }\n  try {\n    return Object.getOwnPropertyDescriptor(\n      error,\n      REVIEW_COMPATIBILITY_ERROR_BRAND,\n    )?.value === true;\n  } catch {\n    return false;\n  }\n}\n\nexport class SilmarilApiError extends Error {\n  readonly status: number;\n  readonly statusText: string;\n  readonly body: string;\n  readonly details: MalformedInputDetails | undefined;\n  readonly error: string | undefined;\n  readonly apiMessage: string | undefined;\n\n  constructor(params: {\n    status: number;\n    statusText: string;\n    body: string;\n    details?: MalformedInputDetails;\n    error?: string;\n    apiMessage?: string;\n  }) {\n    const statusText = params.statusText ? ` ${params.statusText}` : \"\";\n    super(`Silmaril API error ${params.status}${statusText}`);\n    this.name = \"SilmarilApiError\";\n    this.status = params.status;\n    this.statusText = params.statusText;\n    this.body = params.body;\n    const parsed = parseErrorBody(params.body);\n    this.details = params.details ?? parsed.details;\n    this.error = params.error ?? parsed.error;\n    this.apiMessage = params.apiMessage ?? parsed.apiMessage;\n    Object.setPrototypeOf(this, SilmarilApiError.prototype);\n  }\n}\n\nfunction parseErrorBody(body: string): {\n  details: MalformedInputDetails | undefined;\n  error: string | undefined;\n  apiMessage: string | undefined;\n} {\n  try {\n    const parsed = JSON.parse(body) as unknown;\n    if (!parsed || typeof parsed !== \"object\") {\n      return { details: undefined, error: undefined, apiMessage: undefined };\n    }\n    const data = parsed as Record<string, unknown>;\n    return {\n      details:\n        data.details && typeof data.details === \"object\"\n          ? (data.details as MalformedInputDetails)\n          : undefined,\n      error: typeof data.error === \"string\" ? data.error : undefined,\n      apiMessage: typeof data.message === \"string\" ? data.message : undefined,\n    };\n  } catch {\n    return { details: undefined, error: undefined, apiMessage: undefined };\n  }\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nexport const HookLabel = {\n  USER_INPUT: \"user_input\",\n  SYSTEM_PROMPT: \"system_prompt\",\n  TOOL_CALL: \"tool_call\",\n  TOOL_RESPONSE: \"tool_response\",\n  LLM_OUTPUT: \"llm_output\",\n  UNKNOWN: \"unknown\",\n} as const;\n\nexport type HookLabel = (typeof HookLabel)[keyof typeof HookLabel];\n\nexport const FirewallHook = {\n  LLM_START: \"on_llm_start\",\n  CHAT_MODEL_START: \"on_chat_model_start\",\n  TOOL_START: \"on_tool_start\",\n  RETRIEVER_START: \"on_retriever_start\",\n  LLM_END: \"on_llm_end\",\n  TOOL_END: \"on_tool_end\",\n  RETRIEVER_END: \"on_retriever_end\",\n} as const;\n\nexport type FirewallHook = (typeof FirewallHook)[keyof typeof FirewallHook];\n\nexport const DEFAULT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.TOOL_END,\n]);\n\nexport const INPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.RETRIEVER_START,\n]);\n\nexport const OUTPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_END,\n  FirewallHook.TOOL_END,\n  FirewallHook.RETRIEVER_END,\n]);\n\nexport const ALL_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  ...INPUT_HOOKS,\n  ...OUTPUT_HOOKS,\n]);\n\nexport const FIREWALL_HOOK_TO_LABEL: Readonly<Record<FirewallHook, HookLabel>> = {\n  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,\n  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,\n  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT,\n};\n\nconst FIREWALL_HOOK_VALUES: ReadonlySet<string> = new Set(Object.values(FirewallHook));\n\nexport function resolveHooks(\n  hooks: Iterable<FirewallHook | string> | undefined,\n): ReadonlySet<FirewallHook> {\n  if (hooks === undefined) {\n    return DEFAULT_HOOKS;\n  }\n  const resolved = new Set<FirewallHook>();\n  for (const h of hooks) {\n    if (!FIREWALL_HOOK_VALUES.has(h)) {\n      throw new Error(`Invalid FirewallHook value: ${String(h)}`);\n    }\n    resolved.add(h as FirewallHook);\n  }\n  return resolved;\n}\n\nexport function prependHook(text: string, hook: HookLabel | string | undefined | null): string {\n  if (hook === undefined || hook === null) {\n    return text;\n  }\n  if (hook === HookLabel.UNKNOWN) {\n    return text;\n  }\n  return `[HOOK:${hook}] ${text}`;\n}\n\nexport function prependToolName(text: string, toolName: string | undefined | null): string {\n  if (toolName === undefined || toolName === null) {\n    return text;\n  }\n  return `[TOOL:${toolName}] ${text}`;\n}\n","import type { FirewallMode } from \"./types.js\";\n\n/** Validate JavaScript/configuration inputs before any fail-open adapter path. */\nexport function validateMode(value: unknown): FirewallMode | undefined {\n  if (value === undefined || value === \"shadow\" || value === \"warn\" || value === \"block\") {\n    return value;\n  }\n  throw new Error(\"Firewall: mode must be shadow, warn, or block\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,sBAAqD;AACrD,uBAAwB;AACxB,wBAAmG;AACnG,uBAAsE;;;ACyEtE,IAAM,mCAAmC,uBAAO;AAAA,EAC9C;AACF;AAwBO,SAAS,2BAA2B,OAAmD;AAC5F,MAAK,OAAO,UAAU,YAAY,OAAO,UAAU,cAAe,UAAU,MAAM;AAChF,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,IACF,GAAG,UAAU;AAAA,EACf,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AClHO,IAAM,YAAY;AAAA,EACvB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,SAAS;AACX;AAIO,IAAM,eAAe;AAAA,EAC1B,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,UAAU;AAAA,EACV,eAAe;AACjB;AAIO,IAAM,gBAA2C,oBAAI,IAAkB;AAAA,EAC5E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,cAAyC,oBAAI,IAAkB;AAAA,EAC1E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,eAA0C,oBAAI,IAAkB;AAAA,EAC3E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,YAAuC,oBAAI,IAAkB;AAAA,EACxE,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAEM,IAAM,yBAAoE;AAAA,EAC/E,CAAC,aAAa,gBAAgB,GAAG,UAAU;AAAA,EAC3C,CAAC,aAAa,SAAS,GAAG,UAAU;AAAA,EACpC,CAAC,aAAa,UAAU,GAAG,UAAU;AAAA,EACrC,CAAC,aAAa,QAAQ,GAAG,UAAU;AAAA,EACnC,CAAC,aAAa,eAAe,GAAG,UAAU;AAAA,EAC1C,CAAC,aAAa,aAAa,GAAG,UAAU;AAAA,EACxC,CAAC,aAAa,OAAO,GAAG,UAAU;AACpC;AAEA,IAAM,uBAA4C,IAAI,IAAI,OAAO,OAAO,YAAY,CAAC;;;AC1D9E,SAAS,aAAa,OAA0C;AACrE,MAAI,UAAU,UAAa,UAAU,YAAY,UAAU,UAAU,UAAU,SAAS;AACtF,WAAO;AAAA,EACT;AACA,QAAM,IAAI,MAAM,+CAA+C;AACjE;;;AHMO,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AACnC,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB,oBAAI,QAAqB;AAGvD,IAAM,0BAA0B,oBAAI,QAA0B;AAW9D,SAAS,OAAO,SAAuC;AACrD,SAAO,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU,KAAK,UAAU,QAAQ,OAAO;AAC/F;AAEA,SAAS,sBAAsB,OAAgB,OAAO,oBAAI,QAAgB,GAAW;AACnF,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAClD,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AACd,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,sBAAsB,MAAM,IAAI,CAAC,EAAE,KAAK,IAAI;AACjG,SAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,GAAG,KAAK,sBAAsB,MAAM,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI;AAC7G;AAEA,SAAS,mBAAmB,QAAsD;AAChF,QAAM,QAAQ,CAAC,YAAsC;AACnD,QAAI,QAAQ,mBAAmB,oBAAoB,oBAAqB,QAAO;AAC/E,QAAI,sBAAsB,IAAI,OAAO,EAAG,QAAO;AAC/C,UAAM,EAAE,iBAAiB,SAAS,GAAG,kBAAkB,IAAI,QAAQ;AAGnE,WAAO,IAAI,4BAAY,EAAE,GAAG,SAAS,kBAAkB,CAAC;AAAA,EAC1D;AACA,MAAI,4BAAY,WAAW,MAAM,EAAG,QAAO,MAAM,MAAM;AACvD,MAAI,kBAAkB,0BAAS;AAC7B,UAAM,SAAS,OAAO;AACtB,QAAI,UAAU,CAAC,MAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAC9F,YAAM,mBAAmB,OAAO;AAChC,YAAM,WAAW,iBAAiB,IAAI,CAAC,YAAY,4BAAY,WAAW,OAAO,IAAI,MAAM,OAAO,IAAI,OAAO;AAC7G,UAAI,SAAS,KAAK,CAAC,SAAS,UAAU,YAAY,iBAAiB,KAAK,CAAC,GAAG;AAC1E,eAAO,IAAI,yBAAQ,EAAE,GAAG,QAAQ,QAAQ,EAAE,GAAG,QAAQ,SAAS,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,UAAoB,UAAuC,CAAC,GAAG;AACxG,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,MAAI,CAAC,OAAO,UAAU,kBAAkB,KAAK,qBAAqB,GAAG;AACnE,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,gBAAgB,aAAa,QAAQ,IAAI,KAAK,SAAS;AAC7D,QAAM,WAAW,OAAO,MAAc,MAAiB,aAAqF;AAC1I,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAC/D,QAAI;AACF,YAAM,SAAS,MAAM,SAAS,SAAS,MAAM;AAAA,QAC3C;AAAA,QACA,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,QAC7C,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,MAAM,cAAc;AAAA,QAC7D,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,QAAQ,eAAe,EAAE;AAAA,MACzG,CAAC;AACD,YAAM,OAAO,iBAAiB,OAAO,QAAQ;AAC7C,YAAM,UAAU,OAAO,eAAe,eAAe,OAAO,YAAY,WAAW;AACnF,UAAI,QAAQ,YAAY;AACtB,YAAI;AACF,kBAAQ,WAAW,EAAE,MAAM,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,GAAI,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,CAAC;AAAA,QAC1I,QAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO,EAAE,SAAS,WAAW,SAAS,SAAS,KAAK;AAAA,IACtD,SAAS,OAAO;AACd,UAAI,2BAA2B,KAAK,EAAG,OAAM;AAC7C,UAAI,QAAQ,aAAa,MAAO,OAAM;AACtC,aAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAAA,IAC/C;AAAA,EACF;AAEA,aAAO,mCAAiB;AAAA,IACtB,MAAM;AAAA,IACN,eAAe,OAAO,SAAS,YAAY;AACzC,YAAM,UAAU,QAAQ,MAAM;AAC9B,UAAI,gBAAgB;AACpB,eAAS,IAAI,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;AAC5C,YAAI,6BAAa,WAAW,QAAQ,CAAC,CAAC,GAAG;AACvC,0BAAgB;AAChB;AAAA,QACF;AAAA,MACF;AACA,YAAM,eAAe,QAAQ,MAAM,gBAAgB,CAAC,EAAE;AAAA,QACpD,CAAC,YAAY,4BAAY,WAAW,OAAO,KAAK,QAAQ,YAAY,qBAC/D,QAAQ,mBAAmB,oBAAoB;AAAA,MACtD,EAAE;AACF,YAAM,aAAa,CAAC,GAAG,QAAQ,QAAQ,EAAE,QAAQ,EAAE,KAAK,6BAAa,UAAU;AAC/E,YAAM,gBAAgB,aAClB,MAAM,SAAS,OAAO,UAAU,GAAG,UAAU,UAAU,IACvD;AACJ,UAAI,eAAe,QAAS,QAAO,IAAI,0BAAU,mBAAmB;AACpE,YAAM,UAAU,iBAAiB,eAAe,QAAQ;AAExD,UAAI,gBAAgB,sBAAsB,YAAY,SAAS;AAC7D,eAAO,IAAI,0BAAU,kBAAkB;AAAA,MACzC;AACA,YAAM,WAAW,MAAM,QAAQ,OAAO;AACtC,UAAI,oBAAoB,6BAAY,MAAM,SAAS,sBAAsB,SAAS,MAAM,GAAG,UAAU,UAAU,GAAG,SAAS;AACzH,eAAO,IAAI,0BAAU,mBAAmB;AAAA,MAC1C;AACA,UAAI,0BAAU,WAAW,QAAQ,MAAM,MAAM,SAAS,OAAO,QAAQ,GAAG,UAAU,UAAU,GAAG,SAAS;AACtG,eAAO,IAAI,0BAAU,mBAAmB;AAAA,MAC1C;AACA,aAAO;AAAA,IACT;AAAA,IACA,cAAc,OAAO,SAAS,YAAY;AACxC,YAAM,OAAO,MAAM;AACjB,cAAM,UAAU,IAAI,4BAAY;AAAA,UAC9B,SAAS;AAAA,UACT,cAAc,QAAQ,SAAS,MAAM;AAAA,UACrC,MAAM,QAAQ,SAAS;AAAA,UACvB,mBAAmB,EAAE,iBAAiB,oBAAoB;AAAA,QAC5D,CAAC;AACD,8BAAsB,IAAI,OAAO;AACjC,eAAO;AAAA,MACT;AACA,WAAK,MAAM,SAAS,KAAK,UAAU,QAAQ,SAAS,QAAQ,CAAC,CAAC,GAAG,UAAU,WAAW,QAAQ,SAAS,IAAI,GAAG,SAAS;AACrH,eAAO,KAAK;AAAA,MACd;AACA,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,UAAI;AACJ,UAAI;AACF,qBAAa,4BAAY,WAAW,MAAM,IAAI,OAAO,MAAM,IACvD,kBAAkB,2BAAU,sBAAsB,OAAO,MAAM,IAAI,OAAO,MAAM;AAAA,MACtF,QAAQ;AAGN,cAAM,WAAW,MAAM,SAAS,+BAA+B,UAAU,eAAe,QAAQ,SAAS,IAAI;AAC7G,eAAO,SAAS,SAAS,UAAU,KAAK,IAAI,mBAAmB,MAAM;AAAA,MACvE;AACA,WAAK,MAAM,SAAS,YAAY,UAAU,eAAe,QAAQ,SAAS,IAAI,GAAG,SAAS;AACxF,eAAO,KAAK;AAAA,MACd;AACA,aAAO,mBAAmB,MAAM;AAAA,IAClC;AAAA,EACF,CAAC;AACH;AAUO,SAAS,gCAAgC,UAAoB,SAA6D;AAC/H,QAAM,EAAE,MAAM,aAAa,UAAU,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AAC1E,QAAM,eAAW,8BAAY;AAAA,IAC3B,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,EAC5E,CAAC;AACD,0BAAwB,IAAI,UAAU,QAAQ;AAC9C,SAAO,EAAE,MAAM,aAAa,SAAS;AACvC;AAWO,SAAS,yBAAyB,UAAoB,UAAqC,CAAC,GAAG;AACpG,QAAM,EAAE,UAAU,YAAY,CAAC,GAAG,6BAA6B,CAAC,GAAG,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AACxG,QAAM,qBAAqB,UAAU,IAAI,CAAC,aAAa;AACrD,QAAI,cAAc,YAAY,aAAa,UAAU;AACnD,YAAM,IAAI,MAAM,sFAAsF;AAAA,IACxG;AACA,WAAO,EAAE,GAAG,UAAU,YAAY,CAAC,GAAI,SAAS,cAAc,CAAC,GAAI,2BAA2B,UAAU,QAAQ,CAAC,EAAE;AAAA,EACrH,CAAC;AACD,MAAI,CAAC,mBAAmB,KAAK,CAAC,aAAa,SAAS,SAAS,2CAAyB,IAAI,GAAG;AAC3F,uBAAmB,QAAQ,EAAE,GAAG,4CAA0B,YAAY,CAAC,2BAA2B,UAAU,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC1H;AACA,aAAW,QAAQ,4BAA4B;AAC7C,QAAI,CAAC,KAAK,YAAY,wBAAwB,IAAI,KAAK,QAAQ,MAAM,UAAU;AAC7E,YAAM,IAAI,MAAM,gGAAgG;AAAA,IAClH;AAAA,EACF;AACA,aAAO,mCAAgB;AAAA,IACrB,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,IAC1E,WAAW,CAAC,GAAG,oBAAoB,GAAG,0BAA0B;AAAA,EAClE,CAAC;AACH;","names":[]}

package/dist/adapters/deepagents.js

@@ -72,6 +72,14 @@ var FIREWALL_HOOK_TO_LABEL = {
 };
 var FIREWALL_HOOK_VALUES = new Set(Object.values(FirewallHook));
 
+// src/modes.ts
+function validateMode(value) {
+  if (value === void 0 || value === "shadow" || value === "warn" || value === "block") {
+    return value;
+  }
+  throw new Error("Firewall: mode must be shadow, warn, or block");
+}
+
 // src/adapters/deepagents.ts
 var SAFE_TOOL_MESSAGE = "Silmaril Firewall blocked this tool interaction. Choose a different safe action.";
 var SAFE_FINAL_MESSAGE = "Silmaril Firewall stopped this request after repeated unsafe actions.";
@@ -115,7 +123,7 @@ function createDeepAgentsMiddleware(firewall, options = {}) {
   if (!Number.isInteger(maxBlockedAttempts) || maxBlockedAttempts < 1) {
     throw new Error("maxBlockedAttempts must be a positive integer");
   }
-  const effectiveMode = options.mode ?? firewall.mode;
+  const effectiveMode = validateMode(options.mode) ?? firewall.mode;
   const classify = async (text, hook, toolName) => {
     if (!text.trim()) return { enforce: false, mode: effectiveMode };
     try {

package/dist/adapters/deepagents.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/deepagents.ts","../../src/exceptions.ts","../../src/hooks.ts"],"sourcesContent":["// Copyright (c) 2024-2026 Silmaril Security Inc. All rights reserved.\n\n/** Optional Deep Agents integration. Import from @silmaril-security/sdk/adapters/deepagents. */\nimport { AIMessage, HumanMessage, ToolMessage } from \"@langchain/core/messages\";\nimport { Command } from \"@langchain/langgraph\";\nimport { createDeepAgent, GENERAL_PURPOSE_SUBAGENT, type AnySubAgent, type CompiledSubAgent } from \"deepagents\";\nimport { createAgent, createMiddleware, type CreateAgentParams } from \"langchain\";\n\nimport type { Firewall } from \"../firewall.js\";\nimport { isReviewCompatibilityError } from \"../exceptions.js\";\nimport { HookLabel } from \"../hooks.js\";\nimport type { ClassifyEvent, FirewallMode } from \"../types.js\";\n\nexport const SAFE_TOOL_MESSAGE = \"Silmaril Firewall blocked this tool interaction. Choose a different safe action.\";\nexport const SAFE_FINAL_MESSAGE = \"Silmaril Firewall stopped this request after repeated unsafe actions.\";\nexport const SAFE_OUTPUT_MESSAGE = \"Silmaril Firewall blocked this response.\";\nconst BLOCKED_TOOL_MARKER = \"silmaril-firewall:v1:blocked-tool\";\nconst issuedBlockedMessages = new WeakSet<ToolMessage>();\n\n// A protected graph is identified by the exact runnable returned by our factory.\nconst protectedCompiledGraphs = new WeakMap<object, Firewall>();\n\nexport interface DeepAgentsMiddlewareOptions {\n  mode?: FirewallMode;\n  failOpen?: boolean;\n  maxBlockedAttempts?: number;\n  /** A caller-supplied sequence identity; never derived from a LangChain run ID. */\n  conversationId?: string;\n  onClassify?: (event: ClassifyEvent) => void;\n}\n\nfunction textOf(message: { content: unknown }): string {\n  return typeof message.content === \"string\" ? message.content : JSON.stringify(message.content);\n}\n\nfunction textOfStructuredValue(value: unknown, seen = new WeakSet<object>()): string {\n  if (value == null) return \"\";\n  if (typeof value !== \"object\") return String(value);\n  if (seen.has(value)) return \"[circular]\";\n  seen.add(value);\n  if (Array.isArray(value)) return value.map((item) => textOfStructuredValue(item, seen)).join(\"\\n\");\n  return Object.entries(value).map(([key, item]) => `${key}: ${textOfStructuredValue(item, seen)}`).join(\"\\n\");\n}\n\nfunction stripAllowedMarker(result: ToolMessage | Command): ToolMessage | Command {\n  const strip = (message: ToolMessage): ToolMessage => {\n    if (message.additional_kwargs?.silmarilBlocked !== BLOCKED_TOOL_MARKER) return message;\n    if (issuedBlockedMessages.has(message)) return message;\n    const { silmarilBlocked: _marker, ...additional_kwargs } = message.additional_kwargs;\n    // Tool providers may return frozen messages or metadata. Copy rather\n    // than mutating a result owned by the caller.\n    return new ToolMessage({ ...message, additional_kwargs });\n  };\n  if (ToolMessage.isInstance(result)) return strip(result);\n  if (result instanceof Command) {\n    const update = result.update;\n    if (update && !Array.isArray(update) && \"messages\" in update && Array.isArray(update.messages)) {\n      const originalMessages = update.messages;\n      const messages = originalMessages.map((message) => ToolMessage.isInstance(message) ? strip(message) : message);\n      if (messages.some((message, index) => message !== originalMessages[index])) {\n        return new Command({ ...result, update: { ...update, messages } });\n      }\n    }\n  }\n  return result;\n}\n\nexport function createDeepAgentsMiddleware(firewall: Firewall, options: DeepAgentsMiddlewareOptions = {}) {\n  const maxBlockedAttempts = options.maxBlockedAttempts ?? 3;\n  if (!Number.isInteger(maxBlockedAttempts) || maxBlockedAttempts < 1) {\n    throw new Error(\"maxBlockedAttempts must be a positive integer\");\n  }\n  const effectiveMode = options.mode ?? firewall.mode;\n  const classify = async (text: string, hook: HookLabel, toolName?: string): Promise<{ enforce: boolean; mode: FirewallMode | undefined }> => {\n    if (!text.trim()) return { enforce: false, mode: effectiveMode };\n    try {\n      const result = await firewall.classify(text, {\n        hook,\n        ...(toolName === undefined ? {} : { toolName }),\n        ...(effectiveMode === undefined ? {} : { mode: effectiveMode }),\n        ...(options.conversationId === undefined ? {} : { metadata: { conversationId: options.conversationId } }),\n      });\n      const mode = effectiveMode ?? result.mode ?? \"block\";\n      const blocked = result.prediction === \"MALICIOUS\" || result.governance?.action === \"block\";\n      if (options.onClassify) {\n        try {\n          options.onClassify({ hook, ...(toolName === undefined ? {} : { toolName }), text, result, blocked, mode, shadowMode: mode === \"shadow\" });\n        } catch {\n          // Observation callbacks do not change enforcement.\n        }\n      }\n      return { enforce: blocked && mode === \"block\", mode };\n    } catch (error) {\n      if (isReviewCompatibilityError(error)) throw error;\n      if (options.failOpen === false) throw error;\n      return { enforce: false, mode: effectiveMode };\n    }\n  };\n\n  return createMiddleware({\n    name: \"SilmarilDeepAgentsMiddleware\",\n    wrapModelCall: async (request, handler) => {\n      const history = request.state.messages;\n      let lastUserIndex = -1;\n      for (let i = history.length - 1; i >= 0; i--) {\n        if (HumanMessage.isInstance(history[i])) {\n          lastUserIndex = i;\n          break;\n        }\n      }\n      const blockedCount = history.slice(lastUserIndex + 1).filter(\n        (message) => ToolMessage.isInstance(message) && message.content === SAFE_TOOL_MESSAGE\n          && message.additional_kwargs?.silmarilBlocked === BLOCKED_TOOL_MARKER,\n      ).length;\n      const latestUser = [...request.messages].reverse().find(HumanMessage.isInstance);\n      const inputDecision = latestUser\n        ? await classify(textOf(latestUser), HookLabel.USER_INPUT)\n        : undefined;\n      if (inputDecision?.enforce) return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      const capMode = effectiveMode ?? inputDecision?.mode ?? \"block\";\n      // Only genuine prior Block markers count, and the terminal cap requires current effective Block mode.\n      if (blockedCount >= maxBlockedAttempts && capMode === \"block\") {\n        return new AIMessage(SAFE_FINAL_MESSAGE);\n      }\n      const response = await handler(request);\n      if (response instanceof Command && (await classify(textOfStructuredValue(response.update), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      if (AIMessage.isInstance(response) && (await classify(textOf(response), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      return response;\n    },\n    wrapToolCall: async (request, handler) => {\n      const safe = () => {\n        const message = new ToolMessage({\n          content: SAFE_TOOL_MESSAGE,\n          tool_call_id: request.toolCall.id ?? \"\",\n          name: request.toolCall.name,\n          additional_kwargs: { silmarilBlocked: BLOCKED_TOOL_MARKER },\n        });\n        issuedBlockedMessages.add(message);\n        return message;\n      };\n      if ((await classify(JSON.stringify(request.toolCall.args ?? {}), HookLabel.TOOL_CALL, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      const result = await handler(request);\n      let resultText: string;\n      try {\n        resultText = ToolMessage.isInstance(result) ? textOf(result)\n          : result instanceof Command ? textOfStructuredValue(result.update) : String(result);\n      } catch {\n        // Content cannot be inspected, but the backend still resolves the\n        // enforcement mode. Observation modes retain the original result.\n        const decision = await classify(\"[uninspectable tool result]\", HookLabel.TOOL_RESPONSE, request.toolCall.name);\n        return decision.mode === \"block\" ? safe() : stripAllowedMarker(result);\n      }\n      if ((await classify(resultText, HookLabel.TOOL_RESPONSE, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      return stripAllowedMarker(result);\n    },\n  });\n}\n\nexport interface ProtectedCompiledSubagentOptions extends Omit<CreateAgentParams, \"middleware\"> {\n  name: string;\n  description: string;\n  middleware?: CreateAgentParams[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Compile a subagent with Silmaril middleware and register that exact graph. */\nexport function createProtectedCompiledSubagent(firewall: Firewall, options: ProtectedCompiledSubagentOptions): CompiledSubAgent {\n  const { name, description, silmaril, middleware = [], ...agentOptions } = options;\n  const runnable = createAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)] as const,\n  });\n  protectedCompiledGraphs.set(runnable, firewall);\n  return { name, description, runnable };\n}\n\nexport interface ProtectedDeepAgentOptions extends Omit<NonNullable<Parameters<typeof createDeepAgent>[0]>, \"subagents\" | \"middleware\"> {\n  subagents?: readonly AnySubAgent[];\n  /** Only pass specs returned by createProtectedCompiledSubagent for this client. */\n  protectedCompiledSubagents?: readonly CompiledSubAgent[];\n  middleware?: NonNullable<Parameters<typeof createDeepAgent>[0]>[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Protect root, default general-purpose, and declarative subagents. */\nexport function createProtectedDeepAgent(firewall: Firewall, options: ProtectedDeepAgentOptions = {}) {\n  const { silmaril, subagents = [], protectedCompiledSubagents = [], middleware = [], ...agentOptions } = options;\n  const protectedSubagents = subagents.map((subagent) => {\n    if (\"runnable\" in subagent || \"graphId\" in subagent) {\n      throw new Error(\"Compiled or remote subagents must install Silmaril middleware inside their own graph\");\n    }\n    return { ...subagent, middleware: [...(subagent.middleware ?? []), createDeepAgentsMiddleware(firewall, silmaril)] };\n  });\n  if (!protectedSubagents.some((subagent) => subagent.name === GENERAL_PURPOSE_SUBAGENT.name)) {\n    protectedSubagents.unshift({ ...GENERAL_PURPOSE_SUBAGENT, middleware: [createDeepAgentsMiddleware(firewall, silmaril)] });\n  }\n  for (const spec of protectedCompiledSubagents) {\n    if (!spec.runnable || protectedCompiledGraphs.get(spec.runnable) !== firewall) {\n      throw new Error(\"Compiled subagents must be built with createProtectedCompiledSubagent for this Firewall client\");\n    }\n  }\n  return createDeepAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)],\n    subagents: [...protectedSubagents, ...protectedCompiledSubagents],\n  });\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nimport type { HookLabel } from \"./hooks.js\";\nimport type { BlockResult, ReviewLevel } from \"./types.js\";\n\nconst MAX_PROMPT_DISPLAY_LEN = 100;\n\nexport interface MalformedInputDetails {\n  field?: string;\n  inputIndex?: number;\n  charOffset?: number;\n  malformedToken?: string;\n  codePoint?: string;\n  reason?: string;\n}\n\nexport class FirewallBlockedException extends Error {\n  readonly score: number;\n  readonly threshold: number;\n  readonly promptText: string;\n  readonly runId: string | undefined;\n  readonly hook: HookLabel | undefined;\n  readonly toolName: string | undefined;\n  readonly toolCallId: string | undefined;\n  readonly result: BlockResult | undefined;\n\n  constructor(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    runId?: string;\n    hook?: HookLabel;\n    toolName?: string;\n    toolCallId?: string;\n    result?: BlockResult;\n  }) {\n    super(FirewallBlockedException.formatMessage(params));\n    this.name = \"FirewallBlockedException\";\n    this.score = params.score;\n    this.threshold = params.threshold;\n    this.promptText = params.promptText;\n    this.runId = params.runId;\n    this.hook = params.hook;\n    this.toolName = params.toolName;\n    this.toolCallId = params.toolCallId;\n    this.result = params.result;\n    Object.setPrototypeOf(this, FirewallBlockedException.prototype);\n  }\n\n  private static formatMessage(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    result?: BlockResult;\n  }): string {\n    const truncated =\n      params.promptText.length > MAX_PROMPT_DISPLAY_LEN\n        ? `${params.promptText.slice(0, MAX_PROMPT_DISPLAY_LEN)}...`\n        : params.promptText;\n    if (\n      params.result?.prediction !== \"MALICIOUS\" &&\n      params.result?.governance?.action === \"block\"\n    ) {\n      return `Request blocked by Silmaril Firewall governance policy: '${truncated}'`;\n    }\n    return (\n      `Request blocked by Silmaril Firewall ` +\n      `(score=${params.score.toFixed(4)}, threshold=${params.threshold.toFixed(4)}): ` +\n      `'${truncated}'`\n    );\n  }\n}\n\n/** @deprecated Use FirewallBlockedException instead. */\nexport const PromptBlockedException = FirewallBlockedException;\n/** @deprecated Use FirewallBlockedException instead. */\nexport type PromptBlockedException = FirewallBlockedException;\n\nconst REVIEW_COMPATIBILITY_ERROR_BRAND = Symbol.for(\n  \"@silmaril-security/sdk/ReviewCompatibilityError\",\n);\n\nexport class ReviewCompatibilityError extends Error {\n  readonly requestedReview: ReviewLevel;\n  readonly acknowledgedReview: unknown;\n\n  constructor(requestedReview: ReviewLevel, acknowledgedReview: unknown) {\n    const detail = acknowledgedReview === undefined\n      ? \"the response omitted its acknowledgement\"\n      : \"the response acknowledgement did not match\";\n    super(`Silmaril review compatibility error: ${detail} for requested ${requestedReview} review`);\n    this.name = \"ReviewCompatibilityError\";\n    this.requestedReview = requestedReview;\n    this.acknowledgedReview = acknowledgedReview;\n    Object.defineProperty(this, REVIEW_COMPATIBILITY_ERROR_BRAND, {\n      value: true,\n      enumerable: false,\n      configurable: false,\n      writable: false,\n    });\n    Object.setPrototypeOf(this, ReviewCompatibilityError.prototype);\n  }\n}\n\nexport function isReviewCompatibilityError(error: unknown): error is ReviewCompatibilityError {\n  if ((typeof error !== \"object\" && typeof error !== \"function\") || error === null) {\n    return false;\n  }\n  try {\n    return Object.getOwnPropertyDescriptor(\n      error,\n      REVIEW_COMPATIBILITY_ERROR_BRAND,\n    )?.value === true;\n  } catch {\n    return false;\n  }\n}\n\nexport class SilmarilApiError extends Error {\n  readonly status: number;\n  readonly statusText: string;\n  readonly body: string;\n  readonly details: MalformedInputDetails | undefined;\n  readonly error: string | undefined;\n  readonly apiMessage: string | undefined;\n\n  constructor(params: {\n    status: number;\n    statusText: string;\n    body: string;\n    details?: MalformedInputDetails;\n    error?: string;\n    apiMessage?: string;\n  }) {\n    const statusText = params.statusText ? ` ${params.statusText}` : \"\";\n    super(`Silmaril API error ${params.status}${statusText}`);\n    this.name = \"SilmarilApiError\";\n    this.status = params.status;\n    this.statusText = params.statusText;\n    this.body = params.body;\n    const parsed = parseErrorBody(params.body);\n    this.details = params.details ?? parsed.details;\n    this.error = params.error ?? parsed.error;\n    this.apiMessage = params.apiMessage ?? parsed.apiMessage;\n    Object.setPrototypeOf(this, SilmarilApiError.prototype);\n  }\n}\n\nfunction parseErrorBody(body: string): {\n  details: MalformedInputDetails | undefined;\n  error: string | undefined;\n  apiMessage: string | undefined;\n} {\n  try {\n    const parsed = JSON.parse(body) as unknown;\n    if (!parsed || typeof parsed !== \"object\") {\n      return { details: undefined, error: undefined, apiMessage: undefined };\n    }\n    const data = parsed as Record<string, unknown>;\n    return {\n      details:\n        data.details && typeof data.details === \"object\"\n          ? (data.details as MalformedInputDetails)\n          : undefined,\n      error: typeof data.error === \"string\" ? data.error : undefined,\n      apiMessage: typeof data.message === \"string\" ? data.message : undefined,\n    };\n  } catch {\n    return { details: undefined, error: undefined, apiMessage: undefined };\n  }\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nexport const HookLabel = {\n  USER_INPUT: \"user_input\",\n  SYSTEM_PROMPT: \"system_prompt\",\n  TOOL_CALL: \"tool_call\",\n  TOOL_RESPONSE: \"tool_response\",\n  LLM_OUTPUT: \"llm_output\",\n  UNKNOWN: \"unknown\",\n} as const;\n\nexport type HookLabel = (typeof HookLabel)[keyof typeof HookLabel];\n\nexport const FirewallHook = {\n  LLM_START: \"on_llm_start\",\n  CHAT_MODEL_START: \"on_chat_model_start\",\n  TOOL_START: \"on_tool_start\",\n  RETRIEVER_START: \"on_retriever_start\",\n  LLM_END: \"on_llm_end\",\n  TOOL_END: \"on_tool_end\",\n  RETRIEVER_END: \"on_retriever_end\",\n} as const;\n\nexport type FirewallHook = (typeof FirewallHook)[keyof typeof FirewallHook];\n\nexport const DEFAULT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.TOOL_END,\n]);\n\nexport const INPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.RETRIEVER_START,\n]);\n\nexport const OUTPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_END,\n  FirewallHook.TOOL_END,\n  FirewallHook.RETRIEVER_END,\n]);\n\nexport const ALL_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  ...INPUT_HOOKS,\n  ...OUTPUT_HOOKS,\n]);\n\nexport const FIREWALL_HOOK_TO_LABEL: Readonly<Record<FirewallHook, HookLabel>> = {\n  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,\n  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,\n  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT,\n};\n\nconst FIREWALL_HOOK_VALUES: ReadonlySet<string> = new Set(Object.values(FirewallHook));\n\nexport function resolveHooks(\n  hooks: Iterable<FirewallHook | string> | undefined,\n): ReadonlySet<FirewallHook> {\n  if (hooks === undefined) {\n    return DEFAULT_HOOKS;\n  }\n  const resolved = new Set<FirewallHook>();\n  for (const h of hooks) {\n    if (!FIREWALL_HOOK_VALUES.has(h)) {\n      throw new Error(`Invalid FirewallHook value: ${String(h)}`);\n    }\n    resolved.add(h as FirewallHook);\n  }\n  return resolved;\n}\n\nexport function prependHook(text: string, hook: HookLabel | string | undefined | null): string {\n  if (hook === undefined || hook === null) {\n    return text;\n  }\n  if (hook === HookLabel.UNKNOWN) {\n    return text;\n  }\n  return `[HOOK:${hook}] ${text}`;\n}\n\nexport function prependToolName(text: string, toolName: string | undefined | null): string {\n  if (toolName === undefined || toolName === null) {\n    return text;\n  }\n  return `[TOOL:${toolName}] ${text}`;\n}\n"],"mappings":";AAGA,SAAS,WAAW,cAAc,mBAAmB;AACrD,SAAS,eAAe;AACxB,SAAS,iBAAiB,gCAAyE;AACnG,SAAS,aAAa,wBAAgD;;;ACyEtE,IAAM,mCAAmC,uBAAO;AAAA,EAC9C;AACF;AAwBO,SAAS,2BAA2B,OAAmD;AAC5F,MAAK,OAAO,UAAU,YAAY,OAAO,UAAU,cAAe,UAAU,MAAM;AAChF,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,IACF,GAAG,UAAU;AAAA,EACf,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AClHO,IAAM,YAAY;AAAA,EACvB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,SAAS;AACX;AAIO,IAAM,eAAe;AAAA,EAC1B,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,UAAU;AAAA,EACV,eAAe;AACjB;AAIO,IAAM,gBAA2C,oBAAI,IAAkB;AAAA,EAC5E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,cAAyC,oBAAI,IAAkB;AAAA,EAC1E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,eAA0C,oBAAI,IAAkB;AAAA,EAC3E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,YAAuC,oBAAI,IAAkB;AAAA,EACxE,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAEM,IAAM,yBAAoE;AAAA,EAC/E,CAAC,aAAa,gBAAgB,GAAG,UAAU;AAAA,EAC3C,CAAC,aAAa,SAAS,GAAG,UAAU;AAAA,EACpC,CAAC,aAAa,UAAU,GAAG,UAAU;AAAA,EACrC,CAAC,aAAa,QAAQ,GAAG,UAAU;AAAA,EACnC,CAAC,aAAa,eAAe,GAAG,UAAU;AAAA,EAC1C,CAAC,aAAa,aAAa,GAAG,UAAU;AAAA,EACxC,CAAC,aAAa,OAAO,GAAG,UAAU;AACpC;AAEA,IAAM,uBAA4C,IAAI,IAAI,OAAO,OAAO,YAAY,CAAC;;;AFhD9E,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AACnC,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB,oBAAI,QAAqB;AAGvD,IAAM,0BAA0B,oBAAI,QAA0B;AAW9D,SAAS,OAAO,SAAuC;AACrD,SAAO,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU,KAAK,UAAU,QAAQ,OAAO;AAC/F;AAEA,SAAS,sBAAsB,OAAgB,OAAO,oBAAI,QAAgB,GAAW;AACnF,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAClD,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AACd,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,sBAAsB,MAAM,IAAI,CAAC,EAAE,KAAK,IAAI;AACjG,SAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,GAAG,KAAK,sBAAsB,MAAM,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI;AAC7G;AAEA,SAAS,mBAAmB,QAAsD;AAChF,QAAM,QAAQ,CAAC,YAAsC;AACnD,QAAI,QAAQ,mBAAmB,oBAAoB,oBAAqB,QAAO;AAC/E,QAAI,sBAAsB,IAAI,OAAO,EAAG,QAAO;AAC/C,UAAM,EAAE,iBAAiB,SAAS,GAAG,kBAAkB,IAAI,QAAQ;AAGnE,WAAO,IAAI,YAAY,EAAE,GAAG,SAAS,kBAAkB,CAAC;AAAA,EAC1D;AACA,MAAI,YAAY,WAAW,MAAM,EAAG,QAAO,MAAM,MAAM;AACvD,MAAI,kBAAkB,SAAS;AAC7B,UAAM,SAAS,OAAO;AACtB,QAAI,UAAU,CAAC,MAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAC9F,YAAM,mBAAmB,OAAO;AAChC,YAAM,WAAW,iBAAiB,IAAI,CAAC,YAAY,YAAY,WAAW,OAAO,IAAI,MAAM,OAAO,IAAI,OAAO;AAC7G,UAAI,SAAS,KAAK,CAAC,SAAS,UAAU,YAAY,iBAAiB,KAAK,CAAC,GAAG;AAC1E,eAAO,IAAI,QAAQ,EAAE,GAAG,QAAQ,QAAQ,EAAE,GAAG,QAAQ,SAAS,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,UAAoB,UAAuC,CAAC,GAAG;AACxG,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,MAAI,CAAC,OAAO,UAAU,kBAAkB,KAAK,qBAAqB,GAAG;AACnE,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,gBAAgB,QAAQ,QAAQ,SAAS;AAC/C,QAAM,WAAW,OAAO,MAAc,MAAiB,aAAqF;AAC1I,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAC/D,QAAI;AACF,YAAM,SAAS,MAAM,SAAS,SAAS,MAAM;AAAA,QAC3C;AAAA,QACA,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,QAC7C,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,MAAM,cAAc;AAAA,QAC7D,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,QAAQ,eAAe,EAAE;AAAA,MACzG,CAAC;AACD,YAAM,OAAO,iBAAiB,OAAO,QAAQ;AAC7C,YAAM,UAAU,OAAO,eAAe,eAAe,OAAO,YAAY,WAAW;AACnF,UAAI,QAAQ,YAAY;AACtB,YAAI;AACF,kBAAQ,WAAW,EAAE,MAAM,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,GAAI,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,CAAC;AAAA,QAC1I,QAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO,EAAE,SAAS,WAAW,SAAS,SAAS,KAAK;AAAA,IACtD,SAAS,OAAO;AACd,UAAI,2BAA2B,KAAK,EAAG,OAAM;AAC7C,UAAI,QAAQ,aAAa,MAAO,OAAM;AACtC,aAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAAA,IAC/C;AAAA,EACF;AAEA,SAAO,iBAAiB;AAAA,IACtB,MAAM;AAAA,IACN,eAAe,OAAO,SAAS,YAAY;AACzC,YAAM,UAAU,QAAQ,MAAM;AAC9B,UAAI,gBAAgB;AACpB,eAAS,IAAI,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;AAC5C,YAAI,aAAa,WAAW,QAAQ,CAAC,CAAC,GAAG;AACvC,0BAAgB;AAChB;AAAA,QACF;AAAA,MACF;AACA,YAAM,eAAe,QAAQ,MAAM,gBAAgB,CAAC,EAAE;AAAA,QACpD,CAAC,YAAY,YAAY,WAAW,OAAO,KAAK,QAAQ,YAAY,qBAC/D,QAAQ,mBAAmB,oBAAoB;AAAA,MACtD,EAAE;AACF,YAAM,aAAa,CAAC,GAAG,QAAQ,QAAQ,EAAE,QAAQ,EAAE,KAAK,aAAa,UAAU;AAC/E,YAAM,gBAAgB,aAClB,MAAM,SAAS,OAAO,UAAU,GAAG,UAAU,UAAU,IACvD;AACJ,UAAI,eAAe,QAAS,QAAO,IAAI,UAAU,mBAAmB;AACpE,YAAM,UAAU,iBAAiB,eAAe,QAAQ;AAExD,UAAI,gBAAgB,sBAAsB,YAAY,SAAS;AAC7D,eAAO,IAAI,UAAU,kBAAkB;AAAA,MACzC;AACA,YAAM,WAAW,MAAM,QAAQ,OAAO;AACtC,UAAI,oBAAoB,YAAY,MAAM,SAAS,sBAAsB,SAAS,MAAM,GAAG,UAAU,UAAU,GAAG,SAAS;AACzH,eAAO,IAAI,UAAU,mBAAmB;AAAA,MAC1C;AACA,UAAI,UAAU,WAAW,QAAQ,MAAM,MAAM,SAAS,OAAO,QAAQ,GAAG,UAAU,UAAU,GAAG,SAAS;AACtG,eAAO,IAAI,UAAU,mBAAmB;AAAA,MAC1C;AACA,aAAO;AAAA,IACT;AAAA,IACA,cAAc,OAAO,SAAS,YAAY;AACxC,YAAM,OAAO,MAAM;AACjB,cAAM,UAAU,IAAI,YAAY;AAAA,UAC9B,SAAS;AAAA,UACT,cAAc,QAAQ,SAAS,MAAM;AAAA,UACrC,MAAM,QAAQ,SAAS;AAAA,UACvB,mBAAmB,EAAE,iBAAiB,oBAAoB;AAAA,QAC5D,CAAC;AACD,8BAAsB,IAAI,OAAO;AACjC,eAAO;AAAA,MACT;AACA,WAAK,MAAM,SAAS,KAAK,UAAU,QAAQ,SAAS,QAAQ,CAAC,CAAC,GAAG,UAAU,WAAW,QAAQ,SAAS,IAAI,GAAG,SAAS;AACrH,eAAO,KAAK;AAAA,MACd;AACA,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,UAAI;AACJ,UAAI;AACF,qBAAa,YAAY,WAAW,MAAM,IAAI,OAAO,MAAM,IACvD,kBAAkB,UAAU,sBAAsB,OAAO,MAAM,IAAI,OAAO,MAAM;AAAA,MACtF,QAAQ;AAGN,cAAM,WAAW,MAAM,SAAS,+BAA+B,UAAU,eAAe,QAAQ,SAAS,IAAI;AAC7G,eAAO,SAAS,SAAS,UAAU,KAAK,IAAI,mBAAmB,MAAM;AAAA,MACvE;AACA,WAAK,MAAM,SAAS,YAAY,UAAU,eAAe,QAAQ,SAAS,IAAI,GAAG,SAAS;AACxF,eAAO,KAAK;AAAA,MACd;AACA,aAAO,mBAAmB,MAAM;AAAA,IAClC;AAAA,EACF,CAAC;AACH;AAUO,SAAS,gCAAgC,UAAoB,SAA6D;AAC/H,QAAM,EAAE,MAAM,aAAa,UAAU,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AAC1E,QAAM,WAAW,YAAY;AAAA,IAC3B,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,EAC5E,CAAC;AACD,0BAAwB,IAAI,UAAU,QAAQ;AAC9C,SAAO,EAAE,MAAM,aAAa,SAAS;AACvC;AAWO,SAAS,yBAAyB,UAAoB,UAAqC,CAAC,GAAG;AACpG,QAAM,EAAE,UAAU,YAAY,CAAC,GAAG,6BAA6B,CAAC,GAAG,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AACxG,QAAM,qBAAqB,UAAU,IAAI,CAAC,aAAa;AACrD,QAAI,cAAc,YAAY,aAAa,UAAU;AACnD,YAAM,IAAI,MAAM,sFAAsF;AAAA,IACxG;AACA,WAAO,EAAE,GAAG,UAAU,YAAY,CAAC,GAAI,SAAS,cAAc,CAAC,GAAI,2BAA2B,UAAU,QAAQ,CAAC,EAAE;AAAA,EACrH,CAAC;AACD,MAAI,CAAC,mBAAmB,KAAK,CAAC,aAAa,SAAS,SAAS,yBAAyB,IAAI,GAAG;AAC3F,uBAAmB,QAAQ,EAAE,GAAG,0BAA0B,YAAY,CAAC,2BAA2B,UAAU,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC1H;AACA,aAAW,QAAQ,4BAA4B;AAC7C,QAAI,CAAC,KAAK,YAAY,wBAAwB,IAAI,KAAK,QAAQ,MAAM,UAAU;AAC7E,YAAM,IAAI,MAAM,gGAAgG;AAAA,IAClH;AAAA,EACF;AACA,SAAO,gBAAgB;AAAA,IACrB,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,IAC1E,WAAW,CAAC,GAAG,oBAAoB,GAAG,0BAA0B;AAAA,EAClE,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/adapters/deepagents.ts","../../src/exceptions.ts","../../src/hooks.ts","../../src/modes.ts"],"sourcesContent":["// Copyright (c) 2024-2026 Silmaril Security Inc. All rights reserved.\n\n/** Optional Deep Agents integration. Import from @silmaril-security/sdk/adapters/deepagents. */\nimport { AIMessage, HumanMessage, ToolMessage } from \"@langchain/core/messages\";\nimport { Command } from \"@langchain/langgraph\";\nimport { createDeepAgent, GENERAL_PURPOSE_SUBAGENT, type AnySubAgent, type CompiledSubAgent } from \"deepagents\";\nimport { createAgent, createMiddleware, type CreateAgentParams } from \"langchain\";\n\nimport type { Firewall } from \"../firewall.js\";\nimport { isReviewCompatibilityError } from \"../exceptions.js\";\nimport { HookLabel } from \"../hooks.js\";\nimport { validateMode } from \"../modes.js\";\nimport type { ClassifyEvent, FirewallMode } from \"../types.js\";\n\nexport const SAFE_TOOL_MESSAGE = \"Silmaril Firewall blocked this tool interaction. Choose a different safe action.\";\nexport const SAFE_FINAL_MESSAGE = \"Silmaril Firewall stopped this request after repeated unsafe actions.\";\nexport const SAFE_OUTPUT_MESSAGE = \"Silmaril Firewall blocked this response.\";\nconst BLOCKED_TOOL_MARKER = \"silmaril-firewall:v1:blocked-tool\";\nconst issuedBlockedMessages = new WeakSet<ToolMessage>();\n\n// A protected graph is identified by the exact runnable returned by our factory.\nconst protectedCompiledGraphs = new WeakMap<object, Firewall>();\n\nexport interface DeepAgentsMiddlewareOptions {\n  mode?: FirewallMode;\n  failOpen?: boolean;\n  maxBlockedAttempts?: number;\n  /** A caller-supplied sequence identity; never derived from a LangChain run ID. */\n  conversationId?: string;\n  onClassify?: (event: ClassifyEvent) => void;\n}\n\nfunction textOf(message: { content: unknown }): string {\n  return typeof message.content === \"string\" ? message.content : JSON.stringify(message.content);\n}\n\nfunction textOfStructuredValue(value: unknown, seen = new WeakSet<object>()): string {\n  if (value == null) return \"\";\n  if (typeof value !== \"object\") return String(value);\n  if (seen.has(value)) return \"[circular]\";\n  seen.add(value);\n  if (Array.isArray(value)) return value.map((item) => textOfStructuredValue(item, seen)).join(\"\\n\");\n  return Object.entries(value).map(([key, item]) => `${key}: ${textOfStructuredValue(item, seen)}`).join(\"\\n\");\n}\n\nfunction stripAllowedMarker(result: ToolMessage | Command): ToolMessage | Command {\n  const strip = (message: ToolMessage): ToolMessage => {\n    if (message.additional_kwargs?.silmarilBlocked !== BLOCKED_TOOL_MARKER) return message;\n    if (issuedBlockedMessages.has(message)) return message;\n    const { silmarilBlocked: _marker, ...additional_kwargs } = message.additional_kwargs;\n    // Tool providers may return frozen messages or metadata. Copy rather\n    // than mutating a result owned by the caller.\n    return new ToolMessage({ ...message, additional_kwargs });\n  };\n  if (ToolMessage.isInstance(result)) return strip(result);\n  if (result instanceof Command) {\n    const update = result.update;\n    if (update && !Array.isArray(update) && \"messages\" in update && Array.isArray(update.messages)) {\n      const originalMessages = update.messages;\n      const messages = originalMessages.map((message) => ToolMessage.isInstance(message) ? strip(message) : message);\n      if (messages.some((message, index) => message !== originalMessages[index])) {\n        return new Command({ ...result, update: { ...update, messages } });\n      }\n    }\n  }\n  return result;\n}\n\nexport function createDeepAgentsMiddleware(firewall: Firewall, options: DeepAgentsMiddlewareOptions = {}) {\n  const maxBlockedAttempts = options.maxBlockedAttempts ?? 3;\n  if (!Number.isInteger(maxBlockedAttempts) || maxBlockedAttempts < 1) {\n    throw new Error(\"maxBlockedAttempts must be a positive integer\");\n  }\n  const effectiveMode = validateMode(options.mode) ?? firewall.mode;\n  const classify = async (text: string, hook: HookLabel, toolName?: string): Promise<{ enforce: boolean; mode: FirewallMode | undefined }> => {\n    if (!text.trim()) return { enforce: false, mode: effectiveMode };\n    try {\n      const result = await firewall.classify(text, {\n        hook,\n        ...(toolName === undefined ? {} : { toolName }),\n        ...(effectiveMode === undefined ? {} : { mode: effectiveMode }),\n        ...(options.conversationId === undefined ? {} : { metadata: { conversationId: options.conversationId } }),\n      });\n      const mode = effectiveMode ?? result.mode ?? \"block\";\n      const blocked = result.prediction === \"MALICIOUS\" || result.governance?.action === \"block\";\n      if (options.onClassify) {\n        try {\n          options.onClassify({ hook, ...(toolName === undefined ? {} : { toolName }), text, result, blocked, mode, shadowMode: mode === \"shadow\" });\n        } catch {\n          // Observation callbacks do not change enforcement.\n        }\n      }\n      return { enforce: blocked && mode === \"block\", mode };\n    } catch (error) {\n      if (isReviewCompatibilityError(error)) throw error;\n      if (options.failOpen === false) throw error;\n      return { enforce: false, mode: effectiveMode };\n    }\n  };\n\n  return createMiddleware({\n    name: \"SilmarilDeepAgentsMiddleware\",\n    wrapModelCall: async (request, handler) => {\n      const history = request.state.messages;\n      let lastUserIndex = -1;\n      for (let i = history.length - 1; i >= 0; i--) {\n        if (HumanMessage.isInstance(history[i])) {\n          lastUserIndex = i;\n          break;\n        }\n      }\n      const blockedCount = history.slice(lastUserIndex + 1).filter(\n        (message) => ToolMessage.isInstance(message) && message.content === SAFE_TOOL_MESSAGE\n          && message.additional_kwargs?.silmarilBlocked === BLOCKED_TOOL_MARKER,\n      ).length;\n      const latestUser = [...request.messages].reverse().find(HumanMessage.isInstance);\n      const inputDecision = latestUser\n        ? await classify(textOf(latestUser), HookLabel.USER_INPUT)\n        : undefined;\n      if (inputDecision?.enforce) return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      const capMode = effectiveMode ?? inputDecision?.mode ?? \"block\";\n      // Only genuine prior Block markers count, and the terminal cap requires current effective Block mode.\n      if (blockedCount >= maxBlockedAttempts && capMode === \"block\") {\n        return new AIMessage(SAFE_FINAL_MESSAGE);\n      }\n      const response = await handler(request);\n      if (response instanceof Command && (await classify(textOfStructuredValue(response.update), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      if (AIMessage.isInstance(response) && (await classify(textOf(response), HookLabel.LLM_OUTPUT)).enforce) {\n        return new AIMessage(SAFE_OUTPUT_MESSAGE);\n      }\n      return response;\n    },\n    wrapToolCall: async (request, handler) => {\n      const safe = () => {\n        const message = new ToolMessage({\n          content: SAFE_TOOL_MESSAGE,\n          tool_call_id: request.toolCall.id ?? \"\",\n          name: request.toolCall.name,\n          additional_kwargs: { silmarilBlocked: BLOCKED_TOOL_MARKER },\n        });\n        issuedBlockedMessages.add(message);\n        return message;\n      };\n      if ((await classify(JSON.stringify(request.toolCall.args ?? {}), HookLabel.TOOL_CALL, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      const result = await handler(request);\n      let resultText: string;\n      try {\n        resultText = ToolMessage.isInstance(result) ? textOf(result)\n          : result instanceof Command ? textOfStructuredValue(result.update) : String(result);\n      } catch {\n        // Content cannot be inspected, but the backend still resolves the\n        // enforcement mode. Observation modes retain the original result.\n        const decision = await classify(\"[uninspectable tool result]\", HookLabel.TOOL_RESPONSE, request.toolCall.name);\n        return decision.mode === \"block\" ? safe() : stripAllowedMarker(result);\n      }\n      if ((await classify(resultText, HookLabel.TOOL_RESPONSE, request.toolCall.name)).enforce) {\n        return safe();\n      }\n      return stripAllowedMarker(result);\n    },\n  });\n}\n\nexport interface ProtectedCompiledSubagentOptions extends Omit<CreateAgentParams, \"middleware\"> {\n  name: string;\n  description: string;\n  middleware?: CreateAgentParams[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Compile a subagent with Silmaril middleware and register that exact graph. */\nexport function createProtectedCompiledSubagent(firewall: Firewall, options: ProtectedCompiledSubagentOptions): CompiledSubAgent {\n  const { name, description, silmaril, middleware = [], ...agentOptions } = options;\n  const runnable = createAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)] as const,\n  });\n  protectedCompiledGraphs.set(runnable, firewall);\n  return { name, description, runnable };\n}\n\nexport interface ProtectedDeepAgentOptions extends Omit<NonNullable<Parameters<typeof createDeepAgent>[0]>, \"subagents\" | \"middleware\"> {\n  subagents?: readonly AnySubAgent[];\n  /** Only pass specs returned by createProtectedCompiledSubagent for this client. */\n  protectedCompiledSubagents?: readonly CompiledSubAgent[];\n  middleware?: NonNullable<Parameters<typeof createDeepAgent>[0]>[\"middleware\"];\n  silmaril?: DeepAgentsMiddlewareOptions;\n}\n\n/** Protect root, default general-purpose, and declarative subagents. */\nexport function createProtectedDeepAgent(firewall: Firewall, options: ProtectedDeepAgentOptions = {}) {\n  const { silmaril, subagents = [], protectedCompiledSubagents = [], middleware = [], ...agentOptions } = options;\n  const protectedSubagents = subagents.map((subagent) => {\n    if (\"runnable\" in subagent || \"graphId\" in subagent) {\n      throw new Error(\"Compiled or remote subagents must install Silmaril middleware inside their own graph\");\n    }\n    return { ...subagent, middleware: [...(subagent.middleware ?? []), createDeepAgentsMiddleware(firewall, silmaril)] };\n  });\n  if (!protectedSubagents.some((subagent) => subagent.name === GENERAL_PURPOSE_SUBAGENT.name)) {\n    protectedSubagents.unshift({ ...GENERAL_PURPOSE_SUBAGENT, middleware: [createDeepAgentsMiddleware(firewall, silmaril)] });\n  }\n  for (const spec of protectedCompiledSubagents) {\n    if (!spec.runnable || protectedCompiledGraphs.get(spec.runnable) !== firewall) {\n      throw new Error(\"Compiled subagents must be built with createProtectedCompiledSubagent for this Firewall client\");\n    }\n  }\n  return createDeepAgent({\n    ...agentOptions,\n    middleware: [...middleware, createDeepAgentsMiddleware(firewall, silmaril)],\n    subagents: [...protectedSubagents, ...protectedCompiledSubagents],\n  });\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nimport type { HookLabel } from \"./hooks.js\";\nimport type { BlockResult, ReviewLevel } from \"./types.js\";\n\nconst MAX_PROMPT_DISPLAY_LEN = 100;\n\nexport interface MalformedInputDetails {\n  field?: string;\n  inputIndex?: number;\n  charOffset?: number;\n  malformedToken?: string;\n  codePoint?: string;\n  reason?: string;\n}\n\nexport class FirewallBlockedException extends Error {\n  readonly score: number;\n  readonly threshold: number;\n  readonly promptText: string;\n  readonly runId: string | undefined;\n  readonly hook: HookLabel | undefined;\n  readonly toolName: string | undefined;\n  readonly toolCallId: string | undefined;\n  readonly result: BlockResult | undefined;\n\n  constructor(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    runId?: string;\n    hook?: HookLabel;\n    toolName?: string;\n    toolCallId?: string;\n    result?: BlockResult;\n  }) {\n    super(FirewallBlockedException.formatMessage(params));\n    this.name = \"FirewallBlockedException\";\n    this.score = params.score;\n    this.threshold = params.threshold;\n    this.promptText = params.promptText;\n    this.runId = params.runId;\n    this.hook = params.hook;\n    this.toolName = params.toolName;\n    this.toolCallId = params.toolCallId;\n    this.result = params.result;\n    Object.setPrototypeOf(this, FirewallBlockedException.prototype);\n  }\n\n  private static formatMessage(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    result?: BlockResult;\n  }): string {\n    const truncated =\n      params.promptText.length > MAX_PROMPT_DISPLAY_LEN\n        ? `${params.promptText.slice(0, MAX_PROMPT_DISPLAY_LEN)}...`\n        : params.promptText;\n    if (\n      params.result?.prediction !== \"MALICIOUS\" &&\n      params.result?.governance?.action === \"block\"\n    ) {\n      return `Request blocked by Silmaril Firewall governance policy: '${truncated}'`;\n    }\n    return (\n      `Request blocked by Silmaril Firewall ` +\n      `(score=${params.score.toFixed(4)}, threshold=${params.threshold.toFixed(4)}): ` +\n      `'${truncated}'`\n    );\n  }\n}\n\n/** @deprecated Use FirewallBlockedException instead. */\nexport const PromptBlockedException = FirewallBlockedException;\n/** @deprecated Use FirewallBlockedException instead. */\nexport type PromptBlockedException = FirewallBlockedException;\n\nconst REVIEW_COMPATIBILITY_ERROR_BRAND = Symbol.for(\n  \"@silmaril-security/sdk/ReviewCompatibilityError\",\n);\n\nexport class ReviewCompatibilityError extends Error {\n  readonly requestedReview: ReviewLevel;\n  readonly acknowledgedReview: unknown;\n\n  constructor(requestedReview: ReviewLevel, acknowledgedReview: unknown) {\n    const detail = acknowledgedReview === undefined\n      ? \"the response omitted its acknowledgement\"\n      : \"the response acknowledgement did not match\";\n    super(`Silmaril review compatibility error: ${detail} for requested ${requestedReview} review`);\n    this.name = \"ReviewCompatibilityError\";\n    this.requestedReview = requestedReview;\n    this.acknowledgedReview = acknowledgedReview;\n    Object.defineProperty(this, REVIEW_COMPATIBILITY_ERROR_BRAND, {\n      value: true,\n      enumerable: false,\n      configurable: false,\n      writable: false,\n    });\n    Object.setPrototypeOf(this, ReviewCompatibilityError.prototype);\n  }\n}\n\nexport function isReviewCompatibilityError(error: unknown): error is ReviewCompatibilityError {\n  if ((typeof error !== \"object\" && typeof error !== \"function\") || error === null) {\n    return false;\n  }\n  try {\n    return Object.getOwnPropertyDescriptor(\n      error,\n      REVIEW_COMPATIBILITY_ERROR_BRAND,\n    )?.value === true;\n  } catch {\n    return false;\n  }\n}\n\nexport class SilmarilApiError extends Error {\n  readonly status: number;\n  readonly statusText: string;\n  readonly body: string;\n  readonly details: MalformedInputDetails | undefined;\n  readonly error: string | undefined;\n  readonly apiMessage: string | undefined;\n\n  constructor(params: {\n    status: number;\n    statusText: string;\n    body: string;\n    details?: MalformedInputDetails;\n    error?: string;\n    apiMessage?: string;\n  }) {\n    const statusText = params.statusText ? ` ${params.statusText}` : \"\";\n    super(`Silmaril API error ${params.status}${statusText}`);\n    this.name = \"SilmarilApiError\";\n    this.status = params.status;\n    this.statusText = params.statusText;\n    this.body = params.body;\n    const parsed = parseErrorBody(params.body);\n    this.details = params.details ?? parsed.details;\n    this.error = params.error ?? parsed.error;\n    this.apiMessage = params.apiMessage ?? parsed.apiMessage;\n    Object.setPrototypeOf(this, SilmarilApiError.prototype);\n  }\n}\n\nfunction parseErrorBody(body: string): {\n  details: MalformedInputDetails | undefined;\n  error: string | undefined;\n  apiMessage: string | undefined;\n} {\n  try {\n    const parsed = JSON.parse(body) as unknown;\n    if (!parsed || typeof parsed !== \"object\") {\n      return { details: undefined, error: undefined, apiMessage: undefined };\n    }\n    const data = parsed as Record<string, unknown>;\n    return {\n      details:\n        data.details && typeof data.details === \"object\"\n          ? (data.details as MalformedInputDetails)\n          : undefined,\n      error: typeof data.error === \"string\" ? data.error : undefined,\n      apiMessage: typeof data.message === \"string\" ? data.message : undefined,\n    };\n  } catch {\n    return { details: undefined, error: undefined, apiMessage: undefined };\n  }\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nexport const HookLabel = {\n  USER_INPUT: \"user_input\",\n  SYSTEM_PROMPT: \"system_prompt\",\n  TOOL_CALL: \"tool_call\",\n  TOOL_RESPONSE: \"tool_response\",\n  LLM_OUTPUT: \"llm_output\",\n  UNKNOWN: \"unknown\",\n} as const;\n\nexport type HookLabel = (typeof HookLabel)[keyof typeof HookLabel];\n\nexport const FirewallHook = {\n  LLM_START: \"on_llm_start\",\n  CHAT_MODEL_START: \"on_chat_model_start\",\n  TOOL_START: \"on_tool_start\",\n  RETRIEVER_START: \"on_retriever_start\",\n  LLM_END: \"on_llm_end\",\n  TOOL_END: \"on_tool_end\",\n  RETRIEVER_END: \"on_retriever_end\",\n} as const;\n\nexport type FirewallHook = (typeof FirewallHook)[keyof typeof FirewallHook];\n\nexport const DEFAULT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.TOOL_END,\n]);\n\nexport const INPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.RETRIEVER_START,\n]);\n\nexport const OUTPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_END,\n  FirewallHook.TOOL_END,\n  FirewallHook.RETRIEVER_END,\n]);\n\nexport const ALL_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  ...INPUT_HOOKS,\n  ...OUTPUT_HOOKS,\n]);\n\nexport const FIREWALL_HOOK_TO_LABEL: Readonly<Record<FirewallHook, HookLabel>> = {\n  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,\n  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,\n  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT,\n};\n\nconst FIREWALL_HOOK_VALUES: ReadonlySet<string> = new Set(Object.values(FirewallHook));\n\nexport function resolveHooks(\n  hooks: Iterable<FirewallHook | string> | undefined,\n): ReadonlySet<FirewallHook> {\n  if (hooks === undefined) {\n    return DEFAULT_HOOKS;\n  }\n  const resolved = new Set<FirewallHook>();\n  for (const h of hooks) {\n    if (!FIREWALL_HOOK_VALUES.has(h)) {\n      throw new Error(`Invalid FirewallHook value: ${String(h)}`);\n    }\n    resolved.add(h as FirewallHook);\n  }\n  return resolved;\n}\n\nexport function prependHook(text: string, hook: HookLabel | string | undefined | null): string {\n  if (hook === undefined || hook === null) {\n    return text;\n  }\n  if (hook === HookLabel.UNKNOWN) {\n    return text;\n  }\n  return `[HOOK:${hook}] ${text}`;\n}\n\nexport function prependToolName(text: string, toolName: string | undefined | null): string {\n  if (toolName === undefined || toolName === null) {\n    return text;\n  }\n  return `[TOOL:${toolName}] ${text}`;\n}\n","import type { FirewallMode } from \"./types.js\";\n\n/** Validate JavaScript/configuration inputs before any fail-open adapter path. */\nexport function validateMode(value: unknown): FirewallMode | undefined {\n  if (value === undefined || value === \"shadow\" || value === \"warn\" || value === \"block\") {\n    return value;\n  }\n  throw new Error(\"Firewall: mode must be shadow, warn, or block\");\n}\n"],"mappings":";AAGA,SAAS,WAAW,cAAc,mBAAmB;AACrD,SAAS,eAAe;AACxB,SAAS,iBAAiB,gCAAyE;AACnG,SAAS,aAAa,wBAAgD;;;ACyEtE,IAAM,mCAAmC,uBAAO;AAAA,EAC9C;AACF;AAwBO,SAAS,2BAA2B,OAAmD;AAC5F,MAAK,OAAO,UAAU,YAAY,OAAO,UAAU,cAAe,UAAU,MAAM;AAChF,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,IACF,GAAG,UAAU;AAAA,EACf,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AClHO,IAAM,YAAY;AAAA,EACvB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,SAAS;AACX;AAIO,IAAM,eAAe;AAAA,EAC1B,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,UAAU;AAAA,EACV,eAAe;AACjB;AAIO,IAAM,gBAA2C,oBAAI,IAAkB;AAAA,EAC5E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,cAAyC,oBAAI,IAAkB;AAAA,EAC1E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,eAA0C,oBAAI,IAAkB;AAAA,EAC3E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,YAAuC,oBAAI,IAAkB;AAAA,EACxE,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAEM,IAAM,yBAAoE;AAAA,EAC/E,CAAC,aAAa,gBAAgB,GAAG,UAAU;AAAA,EAC3C,CAAC,aAAa,SAAS,GAAG,UAAU;AAAA,EACpC,CAAC,aAAa,UAAU,GAAG,UAAU;AAAA,EACrC,CAAC,aAAa,QAAQ,GAAG,UAAU;AAAA,EACnC,CAAC,aAAa,eAAe,GAAG,UAAU;AAAA,EAC1C,CAAC,aAAa,aAAa,GAAG,UAAU;AAAA,EACxC,CAAC,aAAa,OAAO,GAAG,UAAU;AACpC;AAEA,IAAM,uBAA4C,IAAI,IAAI,OAAO,OAAO,YAAY,CAAC;;;AC1D9E,SAAS,aAAa,OAA0C;AACrE,MAAI,UAAU,UAAa,UAAU,YAAY,UAAU,UAAU,UAAU,SAAS;AACtF,WAAO;AAAA,EACT;AACA,QAAM,IAAI,MAAM,+CAA+C;AACjE;;;AHMO,IAAM,oBAAoB;AAC1B,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AACnC,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB,oBAAI,QAAqB;AAGvD,IAAM,0BAA0B,oBAAI,QAA0B;AAW9D,SAAS,OAAO,SAAuC;AACrD,SAAO,OAAO,QAAQ,YAAY,WAAW,QAAQ,UAAU,KAAK,UAAU,QAAQ,OAAO;AAC/F;AAEA,SAAS,sBAAsB,OAAgB,OAAO,oBAAI,QAAgB,GAAW;AACnF,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAClD,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AACd,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,sBAAsB,MAAM,IAAI,CAAC,EAAE,KAAK,IAAI;AACjG,SAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,GAAG,GAAG,KAAK,sBAAsB,MAAM,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI;AAC7G;AAEA,SAAS,mBAAmB,QAAsD;AAChF,QAAM,QAAQ,CAAC,YAAsC;AACnD,QAAI,QAAQ,mBAAmB,oBAAoB,oBAAqB,QAAO;AAC/E,QAAI,sBAAsB,IAAI,OAAO,EAAG,QAAO;AAC/C,UAAM,EAAE,iBAAiB,SAAS,GAAG,kBAAkB,IAAI,QAAQ;AAGnE,WAAO,IAAI,YAAY,EAAE,GAAG,SAAS,kBAAkB,CAAC;AAAA,EAC1D;AACA,MAAI,YAAY,WAAW,MAAM,EAAG,QAAO,MAAM,MAAM;AACvD,MAAI,kBAAkB,SAAS;AAC7B,UAAM,SAAS,OAAO;AACtB,QAAI,UAAU,CAAC,MAAM,QAAQ,MAAM,KAAK,cAAc,UAAU,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAC9F,YAAM,mBAAmB,OAAO;AAChC,YAAM,WAAW,iBAAiB,IAAI,CAAC,YAAY,YAAY,WAAW,OAAO,IAAI,MAAM,OAAO,IAAI,OAAO;AAC7G,UAAI,SAAS,KAAK,CAAC,SAAS,UAAU,YAAY,iBAAiB,KAAK,CAAC,GAAG;AAC1E,eAAO,IAAI,QAAQ,EAAE,GAAG,QAAQ,QAAQ,EAAE,GAAG,QAAQ,SAAS,EAAE,CAAC;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,2BAA2B,UAAoB,UAAuC,CAAC,GAAG;AACxG,QAAM,qBAAqB,QAAQ,sBAAsB;AACzD,MAAI,CAAC,OAAO,UAAU,kBAAkB,KAAK,qBAAqB,GAAG;AACnE,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,gBAAgB,aAAa,QAAQ,IAAI,KAAK,SAAS;AAC7D,QAAM,WAAW,OAAO,MAAc,MAAiB,aAAqF;AAC1I,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAC/D,QAAI;AACF,YAAM,SAAS,MAAM,SAAS,SAAS,MAAM;AAAA,QAC3C;AAAA,QACA,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS;AAAA,QAC7C,GAAI,kBAAkB,SAAY,CAAC,IAAI,EAAE,MAAM,cAAc;AAAA,QAC7D,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,QAAQ,eAAe,EAAE;AAAA,MACzG,CAAC;AACD,YAAM,OAAO,iBAAiB,OAAO,QAAQ;AAC7C,YAAM,UAAU,OAAO,eAAe,eAAe,OAAO,YAAY,WAAW;AACnF,UAAI,QAAQ,YAAY;AACtB,YAAI;AACF,kBAAQ,WAAW,EAAE,MAAM,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,GAAI,MAAM,QAAQ,SAAS,MAAM,YAAY,SAAS,SAAS,CAAC;AAAA,QAC1I,QAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO,EAAE,SAAS,WAAW,SAAS,SAAS,KAAK;AAAA,IACtD,SAAS,OAAO;AACd,UAAI,2BAA2B,KAAK,EAAG,OAAM;AAC7C,UAAI,QAAQ,aAAa,MAAO,OAAM;AACtC,aAAO,EAAE,SAAS,OAAO,MAAM,cAAc;AAAA,IAC/C;AAAA,EACF;AAEA,SAAO,iBAAiB;AAAA,IACtB,MAAM;AAAA,IACN,eAAe,OAAO,SAAS,YAAY;AACzC,YAAM,UAAU,QAAQ,MAAM;AAC9B,UAAI,gBAAgB;AACpB,eAAS,IAAI,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;AAC5C,YAAI,aAAa,WAAW,QAAQ,CAAC,CAAC,GAAG;AACvC,0BAAgB;AAChB;AAAA,QACF;AAAA,MACF;AACA,YAAM,eAAe,QAAQ,MAAM,gBAAgB,CAAC,EAAE;AAAA,QACpD,CAAC,YAAY,YAAY,WAAW,OAAO,KAAK,QAAQ,YAAY,qBAC/D,QAAQ,mBAAmB,oBAAoB;AAAA,MACtD,EAAE;AACF,YAAM,aAAa,CAAC,GAAG,QAAQ,QAAQ,EAAE,QAAQ,EAAE,KAAK,aAAa,UAAU;AAC/E,YAAM,gBAAgB,aAClB,MAAM,SAAS,OAAO,UAAU,GAAG,UAAU,UAAU,IACvD;AACJ,UAAI,eAAe,QAAS,QAAO,IAAI,UAAU,mBAAmB;AACpE,YAAM,UAAU,iBAAiB,eAAe,QAAQ;AAExD,UAAI,gBAAgB,sBAAsB,YAAY,SAAS;AAC7D,eAAO,IAAI,UAAU,kBAAkB;AAAA,MACzC;AACA,YAAM,WAAW,MAAM,QAAQ,OAAO;AACtC,UAAI,oBAAoB,YAAY,MAAM,SAAS,sBAAsB,SAAS,MAAM,GAAG,UAAU,UAAU,GAAG,SAAS;AACzH,eAAO,IAAI,UAAU,mBAAmB;AAAA,MAC1C;AACA,UAAI,UAAU,WAAW,QAAQ,MAAM,MAAM,SAAS,OAAO,QAAQ,GAAG,UAAU,UAAU,GAAG,SAAS;AACtG,eAAO,IAAI,UAAU,mBAAmB;AAAA,MAC1C;AACA,aAAO;AAAA,IACT;AAAA,IACA,cAAc,OAAO,SAAS,YAAY;AACxC,YAAM,OAAO,MAAM;AACjB,cAAM,UAAU,IAAI,YAAY;AAAA,UAC9B,SAAS;AAAA,UACT,cAAc,QAAQ,SAAS,MAAM;AAAA,UACrC,MAAM,QAAQ,SAAS;AAAA,UACvB,mBAAmB,EAAE,iBAAiB,oBAAoB;AAAA,QAC5D,CAAC;AACD,8BAAsB,IAAI,OAAO;AACjC,eAAO;AAAA,MACT;AACA,WAAK,MAAM,SAAS,KAAK,UAAU,QAAQ,SAAS,QAAQ,CAAC,CAAC,GAAG,UAAU,WAAW,QAAQ,SAAS,IAAI,GAAG,SAAS;AACrH,eAAO,KAAK;AAAA,MACd;AACA,YAAM,SAAS,MAAM,QAAQ,OAAO;AACpC,UAAI;AACJ,UAAI;AACF,qBAAa,YAAY,WAAW,MAAM,IAAI,OAAO,MAAM,IACvD,kBAAkB,UAAU,sBAAsB,OAAO,MAAM,IAAI,OAAO,MAAM;AAAA,MACtF,QAAQ;AAGN,cAAM,WAAW,MAAM,SAAS,+BAA+B,UAAU,eAAe,QAAQ,SAAS,IAAI;AAC7G,eAAO,SAAS,SAAS,UAAU,KAAK,IAAI,mBAAmB,MAAM;AAAA,MACvE;AACA,WAAK,MAAM,SAAS,YAAY,UAAU,eAAe,QAAQ,SAAS,IAAI,GAAG,SAAS;AACxF,eAAO,KAAK;AAAA,MACd;AACA,aAAO,mBAAmB,MAAM;AAAA,IAClC;AAAA,EACF,CAAC;AACH;AAUO,SAAS,gCAAgC,UAAoB,SAA6D;AAC/H,QAAM,EAAE,MAAM,aAAa,UAAU,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AAC1E,QAAM,WAAW,YAAY;AAAA,IAC3B,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,EAC5E,CAAC;AACD,0BAAwB,IAAI,UAAU,QAAQ;AAC9C,SAAO,EAAE,MAAM,aAAa,SAAS;AACvC;AAWO,SAAS,yBAAyB,UAAoB,UAAqC,CAAC,GAAG;AACpG,QAAM,EAAE,UAAU,YAAY,CAAC,GAAG,6BAA6B,CAAC,GAAG,aAAa,CAAC,GAAG,GAAG,aAAa,IAAI;AACxG,QAAM,qBAAqB,UAAU,IAAI,CAAC,aAAa;AACrD,QAAI,cAAc,YAAY,aAAa,UAAU;AACnD,YAAM,IAAI,MAAM,sFAAsF;AAAA,IACxG;AACA,WAAO,EAAE,GAAG,UAAU,YAAY,CAAC,GAAI,SAAS,cAAc,CAAC,GAAI,2BAA2B,UAAU,QAAQ,CAAC,EAAE;AAAA,EACrH,CAAC;AACD,MAAI,CAAC,mBAAmB,KAAK,CAAC,aAAa,SAAS,SAAS,yBAAyB,IAAI,GAAG;AAC3F,uBAAmB,QAAQ,EAAE,GAAG,0BAA0B,YAAY,CAAC,2BAA2B,UAAU,QAAQ,CAAC,EAAE,CAAC;AAAA,EAC1H;AACA,aAAW,QAAQ,4BAA4B;AAC7C,QAAI,CAAC,KAAK,YAAY,wBAAwB,IAAI,KAAK,QAAQ,MAAM,UAAU;AAC7E,YAAM,IAAI,MAAM,gGAAgG;AAAA,IAClH;AAAA,EACF;AACA,SAAO,gBAAgB;AAAA,IACrB,GAAG;AAAA,IACH,YAAY,CAAC,GAAG,YAAY,2BAA2B,UAAU,QAAQ,CAAC;AAAA,IAC1E,WAAW,CAAC,GAAG,oBAAoB,GAAG,0BAA0B;AAAA,EAClE,CAAC;AACH;","names":[]}

package/dist/adapters/langchain.cjs

@@ -146,6 +146,14 @@ function resolveHooks(hooks) {
   return resolved;
 }
 
+// src/modes.ts
+function validateMode(value) {
+  if (value === void 0 || value === "shadow" || value === "warn" || value === "block") {
+    return value;
+  }
+  throw new Error("Firewall: mode must be shadow, warn, or block");
+}
+
 // src/utils/extract.ts
 function extractTextFromPrompts(prompts) {
   return prompts.map((p) => p.trim()).filter((p) => p.length > 0).join("\n");
@@ -221,7 +229,7 @@ async function createLangChainHandler(firewall, options = {}) {
   const logger = options.logger ?? ((message, error) => {
     console.warn(`silmaril.firewall: ${message}`, error);
   });
-  const requestedMode = options.mode ?? (options.shadowMode === void 0 ? firewall.mode : options.shadowMode ? "shadow" : "block");
+  const requestedMode = validateMode(options.mode) ?? (options.shadowMode === void 0 ? firewall.mode : options.shadowMode ? "shadow" : "block");
   const onClassify = options.onClassify;
   const fireOnClassify = (event) => {
     if (!onClassify) {

package/dist/adapters/langchain.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/adapters/langchain.ts","../../src/exceptions.ts","../../src/hooks.ts","../../src/utils/extract.ts"],"sourcesContent":["// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nimport type { BaseCallbackHandler } from \"@langchain/core/callbacks/base\";\n\nimport type { Firewall } from \"../firewall.js\";\nimport {\n  FirewallBlockedException,\n  isReviewCompatibilityError,\n} from \"../exceptions.js\";\nimport {\n  FIREWALL_HOOK_TO_LABEL,\n  FirewallHook,\n  HookLabel,\n  resolveHooks,\n} from \"../hooks.js\";\nimport type { BlockResult, ClassifyEvent, LangChainAdapterOptions } from \"../types.js\";\nimport {\n  extractTextFromDocuments,\n  extractTextFromLLMResult,\n  extractTextFromPrompts,\n  extractTextFromToolInput,\n} from \"../utils/extract.js\";\n\nconst USER_ROLES: ReadonlySet<string> = new Set([\"human\", \"user\"]);\n\ninterface LangChainDucktypedMessage {\n  role?: string;\n  type?: string;\n  content?: string | ReadonlyArray<string | { type?: string; text?: string }>;\n}\n\nfunction getMessageRole(message: LangChainDucktypedMessage): string {\n  if (typeof message.role === \"string\") {\n    return message.role.toLowerCase();\n  }\n  if (typeof message.type === \"string\") {\n    return message.type.toLowerCase();\n  }\n  return \"\";\n}\n\nfunction extractMessageText(content: LangChainDucktypedMessage[\"content\"]): string {\n  if (content === undefined) {\n    return \"\";\n  }\n  if (typeof content === \"string\") {\n    return content;\n  }\n  const parts: string[] = [];\n  for (const block of content) {\n    if (typeof block === \"string\") {\n      parts.push(block);\n    } else if (block && block.type === \"text\") {\n      parts.push(block.text ?? \"\");\n    }\n  }\n  return parts.join(\" \");\n}\n\nfunction findLastUserMessage(\n  messages: ReadonlyArray<LangChainDucktypedMessage>,\n): LangChainDucktypedMessage | undefined {\n  for (let i = messages.length - 1; i >= 0; i--) {\n    const msg = messages[i]!;\n    if (USER_ROLES.has(getMessageRole(msg))) {\n      return msg;\n    }\n  }\n  return undefined;\n}\n\nexport async function createLangChainHandler(\n  firewall: Firewall,\n  options: LangChainAdapterOptions = {},\n): Promise<BaseCallbackHandler> {\n  const { BaseCallbackHandler } = await import(\"@langchain/core/callbacks/base\");\n\n  const enabledHooks = resolveHooks(options.hooks);\n  // includeSystem remains inert for the user-only chat-model scan.\n  // includeTool still controls the explicit tool start and end callbacks.\n  const includeTool = options.includeTool ?? true;\n  const failOpen = options.failOpen ?? true;\n  const logger =\n    options.logger ??\n    ((message: string, error: unknown): void => {\n      // eslint-disable-next-line no-console\n      console.warn(`silmaril.firewall: ${message}`, error);\n    });\n  const requestedMode = options.mode ?? (\n    options.shadowMode === undefined\n      ? firewall.mode\n      : options.shadowMode ? \"shadow\" : \"block\"\n  );\n  const onClassify = options.onClassify;\n\n  const fireOnClassify = (event: ClassifyEvent): void => {\n    if (!onClassify) {\n      return;\n    }\n    try {\n      onClassify(event);\n    } catch (err) {\n      logger(\"onClassify callback threw\", err);\n    }\n  };\n\n  const classify = async (\n    text: string,\n    hookLabel: HookLabel,\n    runId: string,\n    toolName?: string,\n  ): Promise<void> => {\n    let result: BlockResult;\n    try {\n      result = await firewall.classify(text, {\n        hook: hookLabel,\n        metadata: {\n          langgraph: { run_id: runId },\n          ...(options.conversationId === undefined ? {} : { conversationId: options.conversationId }),\n        },\n        ...(requestedMode !== undefined ? { mode: requestedMode } : {}),\n        ...(toolName !== undefined ? { toolName } : {}),\n      });\n    } catch (err) {\n      if (isReviewCompatibilityError(err)) {\n        throw err;\n      }\n      if (!failOpen) {\n        throw err;\n      }\n      logger(\"classification failed, allowing prompt through\", err);\n      return;\n    }\n    const threshold = result.threshold;\n    const blocked = result.prediction === \"MALICIOUS\" || result.governance?.action === \"block\";\n    const effectiveMode = requestedMode ?? result.mode ?? \"block\";\n    const commonEventFields = {\n      hook: hookLabel,\n      ...(toolName !== undefined ? { toolName } : {}),\n      runId,\n      text,\n      result,\n    };\n    fireOnClassify({\n      ...commonEventFields,\n      blocked,\n      mode: effectiveMode,\n      shadowMode: effectiveMode === \"shadow\",\n    });\n    if (!blocked || effectiveMode !== \"block\") {\n      return;\n    }\n\n    throw new FirewallBlockedException({\n      score: result.score,\n      threshold,\n      promptText: text,\n      runId,\n      hook: hookLabel,\n      ...(toolName !== undefined ? { toolName } : {}),\n      result,\n    });\n  };\n\n  class SilmarilFirewallHandler extends BaseCallbackHandler {\n    override name = \"silmaril_firewall_handler\";\n    override raiseError = true;\n    override awaitHandlers = true;\n\n    override async handleChatModelStart(\n      _llm: unknown,\n      messages: unknown,\n      runId: string,\n    ): Promise<void> {\n      if (!enabledHooks.has(FirewallHook.CHAT_MODEL_START)) {\n        return;\n      }\n      const batches = messages as ReadonlyArray<ReadonlyArray<LangChainDucktypedMessage>>;\n      const flat: LangChainDucktypedMessage[] = [];\n      for (const batch of batches) {\n        for (const m of batch) {\n          flat.push(m);\n        }\n      }\n      const lastUser = findLastUserMessage(flat);\n      if (!lastUser) {\n        return;\n      }\n      const text = extractMessageText(lastUser.content).trim();\n      if (!text) {\n        return;\n      }\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.CHAT_MODEL_START], runId);\n    }\n\n    override async handleLLMStart(\n      _llm: unknown,\n      prompts: string[],\n      runId: string,\n    ): Promise<void> {\n      if (!enabledHooks.has(FirewallHook.LLM_START)) {\n        return;\n      }\n      const text = extractTextFromPrompts(prompts);\n      if (!text) {\n        return;\n      }\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.LLM_START], runId);\n    }\n\n    override async handleToolStart(\n      tool: { name?: string } | undefined,\n      inputStr: string,\n      runId: string,\n    ): Promise<void> {\n      if (!includeTool || !enabledHooks.has(FirewallHook.TOOL_START)) {\n        return;\n      }\n      const text = extractTextFromToolInput(inputStr);\n      if (!text) {\n        return;\n      }\n      const toolName = tool?.name;\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.TOOL_START], runId, toolName);\n    }\n\n    override async handleRetrieverStart(\n      _retriever: unknown,\n      query: string,\n      runId: string,\n    ): Promise<void> {\n      if (!enabledHooks.has(FirewallHook.RETRIEVER_START)) {\n        return;\n      }\n      const text = query.trim();\n      if (!text) {\n        return;\n      }\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.RETRIEVER_START], runId);\n    }\n\n    override async handleLLMEnd(output: unknown, runId: string): Promise<void> {\n      if (!enabledHooks.has(FirewallHook.LLM_END)) {\n        return;\n      }\n      const text = extractTextFromLLMResult(output as { generations?: ReadonlyArray<ReadonlyArray<{ text?: string }>> });\n      if (!text) {\n        return;\n      }\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.LLM_END], runId);\n    }\n\n    override async handleToolEnd(\n      output: unknown,\n      runId: string,\n      _parentRunId?: string,\n      _tags?: string[],\n      _kwargs?: { name?: string },\n    ): Promise<void> {\n      if (!includeTool || !enabledHooks.has(FirewallHook.TOOL_END)) {\n        return;\n      }\n      const text = String(output).trim();\n      if (!text) {\n        return;\n      }\n      const toolName = _kwargs?.name;\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.TOOL_END], runId, toolName);\n    }\n\n    override async handleRetrieverEnd(\n      documents: ReadonlyArray<{ pageContent?: string }>,\n      runId: string,\n    ): Promise<void> {\n      if (!enabledHooks.has(FirewallHook.RETRIEVER_END)) {\n        return;\n      }\n      const text = extractTextFromDocuments(documents);\n      if (!text) {\n        return;\n      }\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.RETRIEVER_END], runId);\n    }\n  }\n\n  return new SilmarilFirewallHandler();\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nimport type { HookLabel } from \"./hooks.js\";\nimport type { BlockResult, ReviewLevel } from \"./types.js\";\n\nconst MAX_PROMPT_DISPLAY_LEN = 100;\n\nexport interface MalformedInputDetails {\n  field?: string;\n  inputIndex?: number;\n  charOffset?: number;\n  malformedToken?: string;\n  codePoint?: string;\n  reason?: string;\n}\n\nexport class FirewallBlockedException extends Error {\n  readonly score: number;\n  readonly threshold: number;\n  readonly promptText: string;\n  readonly runId: string | undefined;\n  readonly hook: HookLabel | undefined;\n  readonly toolName: string | undefined;\n  readonly toolCallId: string | undefined;\n  readonly result: BlockResult | undefined;\n\n  constructor(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    runId?: string;\n    hook?: HookLabel;\n    toolName?: string;\n    toolCallId?: string;\n    result?: BlockResult;\n  }) {\n    super(FirewallBlockedException.formatMessage(params));\n    this.name = \"FirewallBlockedException\";\n    this.score = params.score;\n    this.threshold = params.threshold;\n    this.promptText = params.promptText;\n    this.runId = params.runId;\n    this.hook = params.hook;\n    this.toolName = params.toolName;\n    this.toolCallId = params.toolCallId;\n    this.result = params.result;\n    Object.setPrototypeOf(this, FirewallBlockedException.prototype);\n  }\n\n  private static formatMessage(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    result?: BlockResult;\n  }): string {\n    const truncated =\n      params.promptText.length > MAX_PROMPT_DISPLAY_LEN\n        ? `${params.promptText.slice(0, MAX_PROMPT_DISPLAY_LEN)}...`\n        : params.promptText;\n    if (\n      params.result?.prediction !== \"MALICIOUS\" &&\n      params.result?.governance?.action === \"block\"\n    ) {\n      return `Request blocked by Silmaril Firewall governance policy: '${truncated}'`;\n    }\n    return (\n      `Request blocked by Silmaril Firewall ` +\n      `(score=${params.score.toFixed(4)}, threshold=${params.threshold.toFixed(4)}): ` +\n      `'${truncated}'`\n    );\n  }\n}\n\n/** @deprecated Use FirewallBlockedException instead. */\nexport const PromptBlockedException = FirewallBlockedException;\n/** @deprecated Use FirewallBlockedException instead. */\nexport type PromptBlockedException = FirewallBlockedException;\n\nconst REVIEW_COMPATIBILITY_ERROR_BRAND = Symbol.for(\n  \"@silmaril-security/sdk/ReviewCompatibilityError\",\n);\n\nexport class ReviewCompatibilityError extends Error {\n  readonly requestedReview: ReviewLevel;\n  readonly acknowledgedReview: unknown;\n\n  constructor(requestedReview: ReviewLevel, acknowledgedReview: unknown) {\n    const detail = acknowledgedReview === undefined\n      ? \"the response omitted its acknowledgement\"\n      : \"the response acknowledgement did not match\";\n    super(`Silmaril review compatibility error: ${detail} for requested ${requestedReview} review`);\n    this.name = \"ReviewCompatibilityError\";\n    this.requestedReview = requestedReview;\n    this.acknowledgedReview = acknowledgedReview;\n    Object.defineProperty(this, REVIEW_COMPATIBILITY_ERROR_BRAND, {\n      value: true,\n      enumerable: false,\n      configurable: false,\n      writable: false,\n    });\n    Object.setPrototypeOf(this, ReviewCompatibilityError.prototype);\n  }\n}\n\nexport function isReviewCompatibilityError(error: unknown): error is ReviewCompatibilityError {\n  if ((typeof error !== \"object\" && typeof error !== \"function\") || error === null) {\n    return false;\n  }\n  try {\n    return Object.getOwnPropertyDescriptor(\n      error,\n      REVIEW_COMPATIBILITY_ERROR_BRAND,\n    )?.value === true;\n  } catch {\n    return false;\n  }\n}\n\nexport class SilmarilApiError extends Error {\n  readonly status: number;\n  readonly statusText: string;\n  readonly body: string;\n  readonly details: MalformedInputDetails | undefined;\n  readonly error: string | undefined;\n  readonly apiMessage: string | undefined;\n\n  constructor(params: {\n    status: number;\n    statusText: string;\n    body: string;\n    details?: MalformedInputDetails;\n    error?: string;\n    apiMessage?: string;\n  }) {\n    const statusText = params.statusText ? ` ${params.statusText}` : \"\";\n    super(`Silmaril API error ${params.status}${statusText}`);\n    this.name = \"SilmarilApiError\";\n    this.status = params.status;\n    this.statusText = params.statusText;\n    this.body = params.body;\n    const parsed = parseErrorBody(params.body);\n    this.details = params.details ?? parsed.details;\n    this.error = params.error ?? parsed.error;\n    this.apiMessage = params.apiMessage ?? parsed.apiMessage;\n    Object.setPrototypeOf(this, SilmarilApiError.prototype);\n  }\n}\n\nfunction parseErrorBody(body: string): {\n  details: MalformedInputDetails | undefined;\n  error: string | undefined;\n  apiMessage: string | undefined;\n} {\n  try {\n    const parsed = JSON.parse(body) as unknown;\n    if (!parsed || typeof parsed !== \"object\") {\n      return { details: undefined, error: undefined, apiMessage: undefined };\n    }\n    const data = parsed as Record<string, unknown>;\n    return {\n      details:\n        data.details && typeof data.details === \"object\"\n          ? (data.details as MalformedInputDetails)\n          : undefined,\n      error: typeof data.error === \"string\" ? data.error : undefined,\n      apiMessage: typeof data.message === \"string\" ? data.message : undefined,\n    };\n  } catch {\n    return { details: undefined, error: undefined, apiMessage: undefined };\n  }\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nexport const HookLabel = {\n  USER_INPUT: \"user_input\",\n  SYSTEM_PROMPT: \"system_prompt\",\n  TOOL_CALL: \"tool_call\",\n  TOOL_RESPONSE: \"tool_response\",\n  LLM_OUTPUT: \"llm_output\",\n  UNKNOWN: \"unknown\",\n} as const;\n\nexport type HookLabel = (typeof HookLabel)[keyof typeof HookLabel];\n\nexport const FirewallHook = {\n  LLM_START: \"on_llm_start\",\n  CHAT_MODEL_START: \"on_chat_model_start\",\n  TOOL_START: \"on_tool_start\",\n  RETRIEVER_START: \"on_retriever_start\",\n  LLM_END: \"on_llm_end\",\n  TOOL_END: \"on_tool_end\",\n  RETRIEVER_END: \"on_retriever_end\",\n} as const;\n\nexport type FirewallHook = (typeof FirewallHook)[keyof typeof FirewallHook];\n\nexport const DEFAULT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.TOOL_END,\n]);\n\nexport const INPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.RETRIEVER_START,\n]);\n\nexport const OUTPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_END,\n  FirewallHook.TOOL_END,\n  FirewallHook.RETRIEVER_END,\n]);\n\nexport const ALL_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  ...INPUT_HOOKS,\n  ...OUTPUT_HOOKS,\n]);\n\nexport const FIREWALL_HOOK_TO_LABEL: Readonly<Record<FirewallHook, HookLabel>> = {\n  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,\n  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,\n  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT,\n};\n\nconst FIREWALL_HOOK_VALUES: ReadonlySet<string> = new Set(Object.values(FirewallHook));\n\nexport function resolveHooks(\n  hooks: Iterable<FirewallHook | string> | undefined,\n): ReadonlySet<FirewallHook> {\n  if (hooks === undefined) {\n    return DEFAULT_HOOKS;\n  }\n  const resolved = new Set<FirewallHook>();\n  for (const h of hooks) {\n    if (!FIREWALL_HOOK_VALUES.has(h)) {\n      throw new Error(`Invalid FirewallHook value: ${String(h)}`);\n    }\n    resolved.add(h as FirewallHook);\n  }\n  return resolved;\n}\n\nexport function prependHook(text: string, hook: HookLabel | string | undefined | null): string {\n  if (hook === undefined || hook === null) {\n    return text;\n  }\n  if (hook === HookLabel.UNKNOWN) {\n    return text;\n  }\n  return `[HOOK:${hook}] ${text}`;\n}\n\nexport function prependToolName(text: string, toolName: string | undefined | null): string {\n  if (toolName === undefined || toolName === null) {\n    return text;\n  }\n  return `[TOOL:${toolName}] ${text}`;\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nconst SKIP_ROLES: ReadonlySet<string> = new Set([\"ai\", \"assistant\"]);\nconst SYSTEM_ROLES: ReadonlySet<string> = new Set([\"system\"]);\nconst TOOL_ROLES: ReadonlySet<string> = new Set([\"tool\", \"function\"]);\n\ntype MessageContent = string | ReadonlyArray<string | { type?: string; text?: string }>;\n\ninterface DucktypedMessage {\n  role?: string;\n  type?: string;\n  content?: MessageContent;\n}\n\ninterface DucktypedGeneration {\n  text?: string;\n}\n\ninterface DucktypedLLMResult {\n  generations?: ReadonlyArray<ReadonlyArray<DucktypedGeneration>>;\n}\n\ninterface DucktypedDocument {\n  pageContent?: string;\n}\n\nfunction extractContentText(content: MessageContent | undefined): string {\n  if (typeof content === \"string\") {\n    return content;\n  }\n  if (Array.isArray(content)) {\n    const parts: string[] = [];\n    for (const block of content) {\n      if (typeof block === \"string\") {\n        parts.push(block);\n      } else if (block && typeof block === \"object\" && block.type === \"text\") {\n        parts.push(block.text ?? \"\");\n      }\n    }\n    return parts.join(\" \");\n  }\n  return \"\";\n}\n\nfunction getRole(message: DucktypedMessage): string {\n  if (message.role !== undefined) {\n    return message.role.toLowerCase();\n  }\n  if (typeof message.type === \"string\") {\n    return message.type.toLowerCase();\n  }\n  return \"\";\n}\n\nexport function extractTextFromMessages(\n  messages: ReadonlyArray<DucktypedMessage>,\n  options: { includeSystem?: boolean; includeTool?: boolean } = {},\n): string {\n  const includeSystem = options.includeSystem ?? true;\n  const includeTool = options.includeTool ?? true;\n  const parts: string[] = [];\n  for (const message of messages) {\n    const role = getRole(message);\n    if (SKIP_ROLES.has(role)) {\n      continue;\n    }\n    if (!includeSystem && SYSTEM_ROLES.has(role)) {\n      continue;\n    }\n    if (!includeTool && TOOL_ROLES.has(role)) {\n      continue;\n    }\n    const text = extractContentText(message.content);\n    const stripped = text.trim();\n    if (stripped) {\n      parts.push(stripped);\n    }\n  }\n  return parts.join(\"\\n\");\n}\n\nexport function extractTextFromPrompts(prompts: readonly string[]): string {\n  return prompts\n    .map((p) => p.trim())\n    .filter((p) => p.length > 0)\n    .join(\"\\n\");\n}\n\nexport function extractTextFromToolInput(inputStr: string): string {\n  return inputStr.trim();\n}\n\nexport function extractTextFromLLMResult(response: DucktypedLLMResult): string {\n  const parts: string[] = [];\n  for (const genList of response.generations ?? []) {\n    for (const gen of genList) {\n      const text = (gen.text ?? \"\").trim();\n      if (text) {\n        parts.push(text);\n      }\n    }\n  }\n  return parts.join(\"\\n\");\n}\n\nexport function extractTextFromDocuments(documents: ReadonlyArray<DucktypedDocument>): string {\n  const parts: string[] = [];\n  for (const doc of documents) {\n    const text = (doc.pageContent ?? \"\").trim();\n    if (text) {\n      parts.push(text);\n    }\n  }\n  return parts.join(\"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACMA,IAAM,yBAAyB;AAWxB,IAAM,2BAAN,MAAM,kCAAiC,MAAM;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAST;AACD,UAAM,0BAAyB,cAAc,MAAM,CAAC;AACpD,SAAK,OAAO;AACZ,SAAK,QAAQ,OAAO;AACpB,SAAK,YAAY,OAAO;AACxB,SAAK,aAAa,OAAO;AACzB,SAAK,QAAQ,OAAO;AACpB,SAAK,OAAO,OAAO;AACnB,SAAK,WAAW,OAAO;AACvB,SAAK,aAAa,OAAO;AACzB,SAAK,SAAS,OAAO;AACrB,WAAO,eAAe,MAAM,0BAAyB,SAAS;AAAA,EAChE;AAAA,EAEA,OAAe,cAAc,QAKlB;AACT,UAAM,YACJ,OAAO,WAAW,SAAS,yBACvB,GAAG,OAAO,WAAW,MAAM,GAAG,sBAAsB,CAAC,QACrD,OAAO;AACb,QACE,OAAO,QAAQ,eAAe,eAC9B,OAAO,QAAQ,YAAY,WAAW,SACtC;AACA,aAAO,4DAA4D,SAAS;AAAA,IAC9E;AACA,WACE,+CACU,OAAO,MAAM,QAAQ,CAAC,CAAC,eAAe,OAAO,UAAU,QAAQ,CAAC,CAAC,OACvE,SAAS;AAAA,EAEjB;AACF;AAOA,IAAM,mCAAmC,uBAAO;AAAA,EAC9C;AACF;AAwBO,SAAS,2BAA2B,OAAmD;AAC5F,MAAK,OAAO,UAAU,YAAY,OAAO,UAAU,cAAe,UAAU,MAAM;AAChF,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,IACF,GAAG,UAAU;AAAA,EACf,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AClHO,IAAM,YAAY;AAAA,EACvB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,SAAS;AACX;AAIO,IAAM,eAAe;AAAA,EAC1B,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,UAAU;AAAA,EACV,eAAe;AACjB;AAIO,IAAM,gBAA2C,oBAAI,IAAkB;AAAA,EAC5E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,cAAyC,oBAAI,IAAkB;AAAA,EAC1E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,eAA0C,oBAAI,IAAkB;AAAA,EAC3E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,YAAuC,oBAAI,IAAkB;AAAA,EACxE,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAEM,IAAM,yBAAoE;AAAA,EAC/E,CAAC,aAAa,gBAAgB,GAAG,UAAU;AAAA,EAC3C,CAAC,aAAa,SAAS,GAAG,UAAU;AAAA,EACpC,CAAC,aAAa,UAAU,GAAG,UAAU;AAAA,EACrC,CAAC,aAAa,QAAQ,GAAG,UAAU;AAAA,EACnC,CAAC,aAAa,eAAe,GAAG,UAAU;AAAA,EAC1C,CAAC,aAAa,aAAa,GAAG,UAAU;AAAA,EACxC,CAAC,aAAa,OAAO,GAAG,UAAU;AACpC;AAEA,IAAM,uBAA4C,IAAI,IAAI,OAAO,OAAO,YAAY,CAAC;AAE9E,SAAS,aACd,OAC2B;AAC3B,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,QAAM,WAAW,oBAAI,IAAkB;AACvC,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,qBAAqB,IAAI,CAAC,GAAG;AAChC,YAAM,IAAI,MAAM,+BAA+B,OAAO,CAAC,CAAC,EAAE;AAAA,IAC5D;AACA,aAAS,IAAI,CAAiB;AAAA,EAChC;AACA,SAAO;AACT;;;ACKO,SAAS,uBAAuB,SAAoC;AACzE,SAAO,QACJ,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAC1B,KAAK,IAAI;AACd;AAEO,SAAS,yBAAyB,UAA0B;AACjE,SAAO,SAAS,KAAK;AACvB;AAEO,SAAS,yBAAyB,UAAsC;AAC7E,QAAM,QAAkB,CAAC;AACzB,aAAW,WAAW,SAAS,eAAe,CAAC,GAAG;AAChD,eAAW,OAAO,SAAS;AACzB,YAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK;AACnC,UAAI,MAAM;AACR,cAAM,KAAK,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,yBAAyB,WAAqD;AAC5F,QAAM,QAAkB,CAAC;AACzB,aAAW,OAAO,WAAW;AAC3B,UAAM,QAAQ,IAAI,eAAe,IAAI,KAAK;AAC1C,QAAI,MAAM;AACR,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;;;AH3FA,IAAM,aAAkC,oBAAI,IAAI,CAAC,SAAS,MAAM,CAAC;AAQjE,SAAS,eAAe,SAA4C;AAClE,MAAI,OAAO,QAAQ,SAAS,UAAU;AACpC,WAAO,QAAQ,KAAK,YAAY;AAAA,EAClC;AACA,MAAI,OAAO,QAAQ,SAAS,UAAU;AACpC,WAAO,QAAQ,KAAK,YAAY;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,SAAuD;AACjF,MAAI,YAAY,QAAW;AACzB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,SAAS;AAC3B,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,KAAK,KAAK;AAAA,IAClB,WAAW,SAAS,MAAM,SAAS,QAAQ;AACzC,YAAM,KAAK,MAAM,QAAQ,EAAE;AAAA,IAC7B;AAAA,EACF;AACA,SAAO,MAAM,KAAK,GAAG;AACvB;AAEA,SAAS,oBACP,UACuC;AACvC,WAAS,IAAI,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;AAC7C,UAAM,MAAM,SAAS,CAAC;AACtB,QAAI,WAAW,IAAI,eAAe,GAAG,CAAC,GAAG;AACvC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,uBACpB,UACA,UAAmC,CAAC,GACN;AAC9B,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,gCAAgC;AAE7E,QAAM,eAAe,aAAa,QAAQ,KAAK;AAG/C,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,SACJ,QAAQ,WACP,CAAC,SAAiB,UAAyB;AAE1C,YAAQ,KAAK,sBAAsB,OAAO,IAAI,KAAK;AAAA,EACrD;AACF,QAAM,gBAAgB,QAAQ,SAC5B,QAAQ,eAAe,SACnB,SAAS,OACT,QAAQ,aAAa,WAAW;AAEtC,QAAM,aAAa,QAAQ;AAE3B,QAAM,iBAAiB,CAAC,UAA+B;AACrD,QAAI,CAAC,YAAY;AACf;AAAA,IACF;AACA,QAAI;AACF,iBAAW,KAAK;AAAA,IAClB,SAAS,KAAK;AACZ,aAAO,6BAA6B,GAAG;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,WAAW,OACf,MACA,WACA,OACA,aACkB;AAClB,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,SAAS,MAAM;AAAA,QACrC,MAAM;AAAA,QACN,UAAU;AAAA,UACR,WAAW,EAAE,QAAQ,MAAM;AAAA,UAC3B,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,eAAe;AAAA,QAC3F;AAAA,QACA,GAAI,kBAAkB,SAAY,EAAE,MAAM,cAAc,IAAI,CAAC;AAAA,QAC7D,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/C,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,2BAA2B,GAAG,GAAG;AACnC,cAAM;AAAA,MACR;AACA,UAAI,CAAC,UAAU;AACb,cAAM;AAAA,MACR;AACA,aAAO,kDAAkD,GAAG;AAC5D;AAAA,IACF;AACA,UAAM,YAAY,OAAO;AACzB,UAAM,UAAU,OAAO,eAAe,eAAe,OAAO,YAAY,WAAW;AACnF,UAAM,gBAAgB,iBAAiB,OAAO,QAAQ;AACtD,UAAM,oBAAoB;AAAA,MACxB,MAAM;AAAA,MACN,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,mBAAe;AAAA,MACb,GAAG;AAAA,MACH;AAAA,MACA,MAAM;AAAA,MACN,YAAY,kBAAkB;AAAA,IAChC,CAAC;AACD,QAAI,CAAC,WAAW,kBAAkB,SAAS;AACzC;AAAA,IACF;AAEA,UAAM,IAAI,yBAAyB;AAAA,MACjC,OAAO,OAAO;AAAA,MACd;AAAA,MACA,YAAY;AAAA,MACZ;AAAA,MACA,MAAM;AAAA,MACN,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gCAAgC,oBAAoB;AAAA,IAC/C,OAAO;AAAA,IACP,aAAa;AAAA,IACb,gBAAgB;AAAA,IAEzB,MAAe,qBACb,MACA,UACA,OACe;AACf,UAAI,CAAC,aAAa,IAAI,aAAa,gBAAgB,GAAG;AACpD;AAAA,MACF;AACA,YAAM,UAAU;AAChB,YAAM,OAAoC,CAAC;AAC3C,iBAAW,SAAS,SAAS;AAC3B,mBAAW,KAAK,OAAO;AACrB,eAAK,KAAK,CAAC;AAAA,QACb;AAAA,MACF;AACA,YAAM,WAAW,oBAAoB,IAAI;AACzC,UAAI,CAAC,UAAU;AACb;AAAA,MACF;AACA,YAAM,OAAO,mBAAmB,SAAS,OAAO,EAAE,KAAK;AACvD,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,uBAAuB,aAAa,gBAAgB,GAAG,KAAK;AAAA,IACnF;AAAA,IAEA,MAAe,eACb,MACA,SACA,OACe;AACf,UAAI,CAAC,aAAa,IAAI,aAAa,SAAS,GAAG;AAC7C;AAAA,MACF;AACA,YAAM,OAAO,uBAAuB,OAAO;AAC3C,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,uBAAuB,aAAa,SAAS,GAAG,KAAK;AAAA,IAC5E;AAAA,IAEA,MAAe,gBACb,MACA,UACA,OACe;AACf,UAAI,CAAC,eAAe,CAAC,aAAa,IAAI,aAAa,UAAU,GAAG;AAC9D;AAAA,MACF;AACA,YAAM,OAAO,yBAAyB,QAAQ;AAC9C,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,WAAW,MAAM;AACvB,YAAM,SAAS,MAAM,uBAAuB,aAAa,UAAU,GAAG,OAAO,QAAQ;AAAA,IACvF;AAAA,IAEA,MAAe,qBACb,YACA,OACA,OACe;AACf,UAAI,CAAC,aAAa,IAAI,aAAa,eAAe,GAAG;AACnD;AAAA,MACF;AACA,YAAM,OAAO,MAAM,KAAK;AACxB,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,uBAAuB,aAAa,eAAe,GAAG,KAAK;AAAA,IAClF;AAAA,IAEA,MAAe,aAAa,QAAiB,OAA8B;AACzE,UAAI,CAAC,aAAa,IAAI,aAAa,OAAO,GAAG;AAC3C;AAAA,MACF;AACA,YAAM,OAAO,yBAAyB,MAA2E;AACjH,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,uBAAuB,aAAa,OAAO,GAAG,KAAK;AAAA,IAC1E;AAAA,IAEA,MAAe,cACb,QACA,OACA,cACA,OACA,SACe;AACf,UAAI,CAAC,eAAe,CAAC,aAAa,IAAI,aAAa,QAAQ,GAAG;AAC5D;AAAA,MACF;AACA,YAAM,OAAO,OAAO,MAAM,EAAE,KAAK;AACjC,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,WAAW,SAAS;AAC1B,YAAM,SAAS,MAAM,uBAAuB,aAAa,QAAQ,GAAG,OAAO,QAAQ;AAAA,IACrF;AAAA,IAEA,MAAe,mBACb,WACA,OACe;AACf,UAAI,CAAC,aAAa,IAAI,aAAa,aAAa,GAAG;AACjD;AAAA,MACF;AACA,YAAM,OAAO,yBAAyB,SAAS;AAC/C,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,uBAAuB,aAAa,aAAa,GAAG,KAAK;AAAA,IAChF;AAAA,EACF;AAEA,SAAO,IAAI,wBAAwB;AACrC;","names":[]}
+{"version":3,"sources":["../../src/adapters/langchain.ts","../../src/exceptions.ts","../../src/hooks.ts","../../src/modes.ts","../../src/utils/extract.ts"],"sourcesContent":["// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nimport type { BaseCallbackHandler } from \"@langchain/core/callbacks/base\";\n\nimport type { Firewall } from \"../firewall.js\";\nimport {\n  FirewallBlockedException,\n  isReviewCompatibilityError,\n} from \"../exceptions.js\";\nimport {\n  FIREWALL_HOOK_TO_LABEL,\n  FirewallHook,\n  HookLabel,\n  resolveHooks,\n} from \"../hooks.js\";\nimport type { BlockResult, ClassifyEvent, LangChainAdapterOptions } from \"../types.js\";\nimport { validateMode } from \"../modes.js\";\nimport {\n  extractTextFromDocuments,\n  extractTextFromLLMResult,\n  extractTextFromPrompts,\n  extractTextFromToolInput,\n} from \"../utils/extract.js\";\n\nconst USER_ROLES: ReadonlySet<string> = new Set([\"human\", \"user\"]);\n\ninterface LangChainDucktypedMessage {\n  role?: string;\n  type?: string;\n  content?: string | ReadonlyArray<string | { type?: string; text?: string }>;\n}\n\nfunction getMessageRole(message: LangChainDucktypedMessage): string {\n  if (typeof message.role === \"string\") {\n    return message.role.toLowerCase();\n  }\n  if (typeof message.type === \"string\") {\n    return message.type.toLowerCase();\n  }\n  return \"\";\n}\n\nfunction extractMessageText(content: LangChainDucktypedMessage[\"content\"]): string {\n  if (content === undefined) {\n    return \"\";\n  }\n  if (typeof content === \"string\") {\n    return content;\n  }\n  const parts: string[] = [];\n  for (const block of content) {\n    if (typeof block === \"string\") {\n      parts.push(block);\n    } else if (block && block.type === \"text\") {\n      parts.push(block.text ?? \"\");\n    }\n  }\n  return parts.join(\" \");\n}\n\nfunction findLastUserMessage(\n  messages: ReadonlyArray<LangChainDucktypedMessage>,\n): LangChainDucktypedMessage | undefined {\n  for (let i = messages.length - 1; i >= 0; i--) {\n    const msg = messages[i]!;\n    if (USER_ROLES.has(getMessageRole(msg))) {\n      return msg;\n    }\n  }\n  return undefined;\n}\n\nexport async function createLangChainHandler(\n  firewall: Firewall,\n  options: LangChainAdapterOptions = {},\n): Promise<BaseCallbackHandler> {\n  const { BaseCallbackHandler } = await import(\"@langchain/core/callbacks/base\");\n\n  const enabledHooks = resolveHooks(options.hooks);\n  // includeSystem remains inert for the user-only chat-model scan.\n  // includeTool still controls the explicit tool start and end callbacks.\n  const includeTool = options.includeTool ?? true;\n  const failOpen = options.failOpen ?? true;\n  const logger =\n    options.logger ??\n    ((message: string, error: unknown): void => {\n      // eslint-disable-next-line no-console\n      console.warn(`silmaril.firewall: ${message}`, error);\n    });\n  const requestedMode = validateMode(options.mode) ?? (\n    options.shadowMode === undefined\n      ? firewall.mode\n      : options.shadowMode ? \"shadow\" : \"block\"\n  );\n  const onClassify = options.onClassify;\n\n  const fireOnClassify = (event: ClassifyEvent): void => {\n    if (!onClassify) {\n      return;\n    }\n    try {\n      onClassify(event);\n    } catch (err) {\n      logger(\"onClassify callback threw\", err);\n    }\n  };\n\n  const classify = async (\n    text: string,\n    hookLabel: HookLabel,\n    runId: string,\n    toolName?: string,\n  ): Promise<void> => {\n    let result: BlockResult;\n    try {\n      result = await firewall.classify(text, {\n        hook: hookLabel,\n        metadata: {\n          langgraph: { run_id: runId },\n          ...(options.conversationId === undefined ? {} : { conversationId: options.conversationId }),\n        },\n        ...(requestedMode !== undefined ? { mode: requestedMode } : {}),\n        ...(toolName !== undefined ? { toolName } : {}),\n      });\n    } catch (err) {\n      if (isReviewCompatibilityError(err)) {\n        throw err;\n      }\n      if (!failOpen) {\n        throw err;\n      }\n      logger(\"classification failed, allowing prompt through\", err);\n      return;\n    }\n    const threshold = result.threshold;\n    const blocked = result.prediction === \"MALICIOUS\" || result.governance?.action === \"block\";\n    const effectiveMode = requestedMode ?? result.mode ?? \"block\";\n    const commonEventFields = {\n      hook: hookLabel,\n      ...(toolName !== undefined ? { toolName } : {}),\n      runId,\n      text,\n      result,\n    };\n    fireOnClassify({\n      ...commonEventFields,\n      blocked,\n      mode: effectiveMode,\n      shadowMode: effectiveMode === \"shadow\",\n    });\n    if (!blocked || effectiveMode !== \"block\") {\n      return;\n    }\n\n    throw new FirewallBlockedException({\n      score: result.score,\n      threshold,\n      promptText: text,\n      runId,\n      hook: hookLabel,\n      ...(toolName !== undefined ? { toolName } : {}),\n      result,\n    });\n  };\n\n  class SilmarilFirewallHandler extends BaseCallbackHandler {\n    override name = \"silmaril_firewall_handler\";\n    override raiseError = true;\n    override awaitHandlers = true;\n\n    override async handleChatModelStart(\n      _llm: unknown,\n      messages: unknown,\n      runId: string,\n    ): Promise<void> {\n      if (!enabledHooks.has(FirewallHook.CHAT_MODEL_START)) {\n        return;\n      }\n      const batches = messages as ReadonlyArray<ReadonlyArray<LangChainDucktypedMessage>>;\n      const flat: LangChainDucktypedMessage[] = [];\n      for (const batch of batches) {\n        for (const m of batch) {\n          flat.push(m);\n        }\n      }\n      const lastUser = findLastUserMessage(flat);\n      if (!lastUser) {\n        return;\n      }\n      const text = extractMessageText(lastUser.content).trim();\n      if (!text) {\n        return;\n      }\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.CHAT_MODEL_START], runId);\n    }\n\n    override async handleLLMStart(\n      _llm: unknown,\n      prompts: string[],\n      runId: string,\n    ): Promise<void> {\n      if (!enabledHooks.has(FirewallHook.LLM_START)) {\n        return;\n      }\n      const text = extractTextFromPrompts(prompts);\n      if (!text) {\n        return;\n      }\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.LLM_START], runId);\n    }\n\n    override async handleToolStart(\n      tool: { name?: string } | undefined,\n      inputStr: string,\n      runId: string,\n    ): Promise<void> {\n      if (!includeTool || !enabledHooks.has(FirewallHook.TOOL_START)) {\n        return;\n      }\n      const text = extractTextFromToolInput(inputStr);\n      if (!text) {\n        return;\n      }\n      const toolName = tool?.name;\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.TOOL_START], runId, toolName);\n    }\n\n    override async handleRetrieverStart(\n      _retriever: unknown,\n      query: string,\n      runId: string,\n    ): Promise<void> {\n      if (!enabledHooks.has(FirewallHook.RETRIEVER_START)) {\n        return;\n      }\n      const text = query.trim();\n      if (!text) {\n        return;\n      }\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.RETRIEVER_START], runId);\n    }\n\n    override async handleLLMEnd(output: unknown, runId: string): Promise<void> {\n      if (!enabledHooks.has(FirewallHook.LLM_END)) {\n        return;\n      }\n      const text = extractTextFromLLMResult(output as { generations?: ReadonlyArray<ReadonlyArray<{ text?: string }>> });\n      if (!text) {\n        return;\n      }\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.LLM_END], runId);\n    }\n\n    override async handleToolEnd(\n      output: unknown,\n      runId: string,\n      _parentRunId?: string,\n      _tags?: string[],\n      _kwargs?: { name?: string },\n    ): Promise<void> {\n      if (!includeTool || !enabledHooks.has(FirewallHook.TOOL_END)) {\n        return;\n      }\n      const text = String(output).trim();\n      if (!text) {\n        return;\n      }\n      const toolName = _kwargs?.name;\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.TOOL_END], runId, toolName);\n    }\n\n    override async handleRetrieverEnd(\n      documents: ReadonlyArray<{ pageContent?: string }>,\n      runId: string,\n    ): Promise<void> {\n      if (!enabledHooks.has(FirewallHook.RETRIEVER_END)) {\n        return;\n      }\n      const text = extractTextFromDocuments(documents);\n      if (!text) {\n        return;\n      }\n      await classify(text, FIREWALL_HOOK_TO_LABEL[FirewallHook.RETRIEVER_END], runId);\n    }\n  }\n\n  return new SilmarilFirewallHandler();\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nimport type { HookLabel } from \"./hooks.js\";\nimport type { BlockResult, ReviewLevel } from \"./types.js\";\n\nconst MAX_PROMPT_DISPLAY_LEN = 100;\n\nexport interface MalformedInputDetails {\n  field?: string;\n  inputIndex?: number;\n  charOffset?: number;\n  malformedToken?: string;\n  codePoint?: string;\n  reason?: string;\n}\n\nexport class FirewallBlockedException extends Error {\n  readonly score: number;\n  readonly threshold: number;\n  readonly promptText: string;\n  readonly runId: string | undefined;\n  readonly hook: HookLabel | undefined;\n  readonly toolName: string | undefined;\n  readonly toolCallId: string | undefined;\n  readonly result: BlockResult | undefined;\n\n  constructor(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    runId?: string;\n    hook?: HookLabel;\n    toolName?: string;\n    toolCallId?: string;\n    result?: BlockResult;\n  }) {\n    super(FirewallBlockedException.formatMessage(params));\n    this.name = \"FirewallBlockedException\";\n    this.score = params.score;\n    this.threshold = params.threshold;\n    this.promptText = params.promptText;\n    this.runId = params.runId;\n    this.hook = params.hook;\n    this.toolName = params.toolName;\n    this.toolCallId = params.toolCallId;\n    this.result = params.result;\n    Object.setPrototypeOf(this, FirewallBlockedException.prototype);\n  }\n\n  private static formatMessage(params: {\n    score: number;\n    threshold: number;\n    promptText: string;\n    result?: BlockResult;\n  }): string {\n    const truncated =\n      params.promptText.length > MAX_PROMPT_DISPLAY_LEN\n        ? `${params.promptText.slice(0, MAX_PROMPT_DISPLAY_LEN)}...`\n        : params.promptText;\n    if (\n      params.result?.prediction !== \"MALICIOUS\" &&\n      params.result?.governance?.action === \"block\"\n    ) {\n      return `Request blocked by Silmaril Firewall governance policy: '${truncated}'`;\n    }\n    return (\n      `Request blocked by Silmaril Firewall ` +\n      `(score=${params.score.toFixed(4)}, threshold=${params.threshold.toFixed(4)}): ` +\n      `'${truncated}'`\n    );\n  }\n}\n\n/** @deprecated Use FirewallBlockedException instead. */\nexport const PromptBlockedException = FirewallBlockedException;\n/** @deprecated Use FirewallBlockedException instead. */\nexport type PromptBlockedException = FirewallBlockedException;\n\nconst REVIEW_COMPATIBILITY_ERROR_BRAND = Symbol.for(\n  \"@silmaril-security/sdk/ReviewCompatibilityError\",\n);\n\nexport class ReviewCompatibilityError extends Error {\n  readonly requestedReview: ReviewLevel;\n  readonly acknowledgedReview: unknown;\n\n  constructor(requestedReview: ReviewLevel, acknowledgedReview: unknown) {\n    const detail = acknowledgedReview === undefined\n      ? \"the response omitted its acknowledgement\"\n      : \"the response acknowledgement did not match\";\n    super(`Silmaril review compatibility error: ${detail} for requested ${requestedReview} review`);\n    this.name = \"ReviewCompatibilityError\";\n    this.requestedReview = requestedReview;\n    this.acknowledgedReview = acknowledgedReview;\n    Object.defineProperty(this, REVIEW_COMPATIBILITY_ERROR_BRAND, {\n      value: true,\n      enumerable: false,\n      configurable: false,\n      writable: false,\n    });\n    Object.setPrototypeOf(this, ReviewCompatibilityError.prototype);\n  }\n}\n\nexport function isReviewCompatibilityError(error: unknown): error is ReviewCompatibilityError {\n  if ((typeof error !== \"object\" && typeof error !== \"function\") || error === null) {\n    return false;\n  }\n  try {\n    return Object.getOwnPropertyDescriptor(\n      error,\n      REVIEW_COMPATIBILITY_ERROR_BRAND,\n    )?.value === true;\n  } catch {\n    return false;\n  }\n}\n\nexport class SilmarilApiError extends Error {\n  readonly status: number;\n  readonly statusText: string;\n  readonly body: string;\n  readonly details: MalformedInputDetails | undefined;\n  readonly error: string | undefined;\n  readonly apiMessage: string | undefined;\n\n  constructor(params: {\n    status: number;\n    statusText: string;\n    body: string;\n    details?: MalformedInputDetails;\n    error?: string;\n    apiMessage?: string;\n  }) {\n    const statusText = params.statusText ? ` ${params.statusText}` : \"\";\n    super(`Silmaril API error ${params.status}${statusText}`);\n    this.name = \"SilmarilApiError\";\n    this.status = params.status;\n    this.statusText = params.statusText;\n    this.body = params.body;\n    const parsed = parseErrorBody(params.body);\n    this.details = params.details ?? parsed.details;\n    this.error = params.error ?? parsed.error;\n    this.apiMessage = params.apiMessage ?? parsed.apiMessage;\n    Object.setPrototypeOf(this, SilmarilApiError.prototype);\n  }\n}\n\nfunction parseErrorBody(body: string): {\n  details: MalformedInputDetails | undefined;\n  error: string | undefined;\n  apiMessage: string | undefined;\n} {\n  try {\n    const parsed = JSON.parse(body) as unknown;\n    if (!parsed || typeof parsed !== \"object\") {\n      return { details: undefined, error: undefined, apiMessage: undefined };\n    }\n    const data = parsed as Record<string, unknown>;\n    return {\n      details:\n        data.details && typeof data.details === \"object\"\n          ? (data.details as MalformedInputDetails)\n          : undefined,\n      error: typeof data.error === \"string\" ? data.error : undefined,\n      apiMessage: typeof data.message === \"string\" ? data.message : undefined,\n    };\n  } catch {\n    return { details: undefined, error: undefined, apiMessage: undefined };\n  }\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nexport const HookLabel = {\n  USER_INPUT: \"user_input\",\n  SYSTEM_PROMPT: \"system_prompt\",\n  TOOL_CALL: \"tool_call\",\n  TOOL_RESPONSE: \"tool_response\",\n  LLM_OUTPUT: \"llm_output\",\n  UNKNOWN: \"unknown\",\n} as const;\n\nexport type HookLabel = (typeof HookLabel)[keyof typeof HookLabel];\n\nexport const FirewallHook = {\n  LLM_START: \"on_llm_start\",\n  CHAT_MODEL_START: \"on_chat_model_start\",\n  TOOL_START: \"on_tool_start\",\n  RETRIEVER_START: \"on_retriever_start\",\n  LLM_END: \"on_llm_end\",\n  TOOL_END: \"on_tool_end\",\n  RETRIEVER_END: \"on_retriever_end\",\n} as const;\n\nexport type FirewallHook = (typeof FirewallHook)[keyof typeof FirewallHook];\n\nexport const DEFAULT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.TOOL_END,\n]);\n\nexport const INPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_START,\n  FirewallHook.CHAT_MODEL_START,\n  FirewallHook.TOOL_START,\n  FirewallHook.RETRIEVER_START,\n]);\n\nexport const OUTPUT_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  FirewallHook.LLM_END,\n  FirewallHook.TOOL_END,\n  FirewallHook.RETRIEVER_END,\n]);\n\nexport const ALL_HOOKS: ReadonlySet<FirewallHook> = new Set<FirewallHook>([\n  ...INPUT_HOOKS,\n  ...OUTPUT_HOOKS,\n]);\n\nexport const FIREWALL_HOOK_TO_LABEL: Readonly<Record<FirewallHook, HookLabel>> = {\n  [FirewallHook.CHAT_MODEL_START]: HookLabel.USER_INPUT,\n  [FirewallHook.LLM_START]: HookLabel.USER_INPUT,\n  [FirewallHook.TOOL_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.TOOL_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.RETRIEVER_START]: HookLabel.TOOL_CALL,\n  [FirewallHook.RETRIEVER_END]: HookLabel.TOOL_RESPONSE,\n  [FirewallHook.LLM_END]: HookLabel.LLM_OUTPUT,\n};\n\nconst FIREWALL_HOOK_VALUES: ReadonlySet<string> = new Set(Object.values(FirewallHook));\n\nexport function resolveHooks(\n  hooks: Iterable<FirewallHook | string> | undefined,\n): ReadonlySet<FirewallHook> {\n  if (hooks === undefined) {\n    return DEFAULT_HOOKS;\n  }\n  const resolved = new Set<FirewallHook>();\n  for (const h of hooks) {\n    if (!FIREWALL_HOOK_VALUES.has(h)) {\n      throw new Error(`Invalid FirewallHook value: ${String(h)}`);\n    }\n    resolved.add(h as FirewallHook);\n  }\n  return resolved;\n}\n\nexport function prependHook(text: string, hook: HookLabel | string | undefined | null): string {\n  if (hook === undefined || hook === null) {\n    return text;\n  }\n  if (hook === HookLabel.UNKNOWN) {\n    return text;\n  }\n  return `[HOOK:${hook}] ${text}`;\n}\n\nexport function prependToolName(text: string, toolName: string | undefined | null): string {\n  if (toolName === undefined || toolName === null) {\n    return text;\n  }\n  return `[TOOL:${toolName}] ${text}`;\n}\n","import type { FirewallMode } from \"./types.js\";\n\n/** Validate JavaScript/configuration inputs before any fail-open adapter path. */\nexport function validateMode(value: unknown): FirewallMode | undefined {\n  if (value === undefined || value === \"shadow\" || value === \"warn\" || value === \"block\") {\n    return value;\n  }\n  throw new Error(\"Firewall: mode must be shadow, warn, or block\");\n}\n","// Copyright (c) 2024-2025 Silmaril Security Inc. All rights reserved.\n// PROPRIETARY AND CONFIDENTIAL\n\nconst SKIP_ROLES: ReadonlySet<string> = new Set([\"ai\", \"assistant\"]);\nconst SYSTEM_ROLES: ReadonlySet<string> = new Set([\"system\"]);\nconst TOOL_ROLES: ReadonlySet<string> = new Set([\"tool\", \"function\"]);\n\ntype MessageContent = string | ReadonlyArray<string | { type?: string; text?: string }>;\n\ninterface DucktypedMessage {\n  role?: string;\n  type?: string;\n  content?: MessageContent;\n}\n\ninterface DucktypedGeneration {\n  text?: string;\n}\n\ninterface DucktypedLLMResult {\n  generations?: ReadonlyArray<ReadonlyArray<DucktypedGeneration>>;\n}\n\ninterface DucktypedDocument {\n  pageContent?: string;\n}\n\nfunction extractContentText(content: MessageContent | undefined): string {\n  if (typeof content === \"string\") {\n    return content;\n  }\n  if (Array.isArray(content)) {\n    const parts: string[] = [];\n    for (const block of content) {\n      if (typeof block === \"string\") {\n        parts.push(block);\n      } else if (block && typeof block === \"object\" && block.type === \"text\") {\n        parts.push(block.text ?? \"\");\n      }\n    }\n    return parts.join(\" \");\n  }\n  return \"\";\n}\n\nfunction getRole(message: DucktypedMessage): string {\n  if (message.role !== undefined) {\n    return message.role.toLowerCase();\n  }\n  if (typeof message.type === \"string\") {\n    return message.type.toLowerCase();\n  }\n  return \"\";\n}\n\nexport function extractTextFromMessages(\n  messages: ReadonlyArray<DucktypedMessage>,\n  options: { includeSystem?: boolean; includeTool?: boolean } = {},\n): string {\n  const includeSystem = options.includeSystem ?? true;\n  const includeTool = options.includeTool ?? true;\n  const parts: string[] = [];\n  for (const message of messages) {\n    const role = getRole(message);\n    if (SKIP_ROLES.has(role)) {\n      continue;\n    }\n    if (!includeSystem && SYSTEM_ROLES.has(role)) {\n      continue;\n    }\n    if (!includeTool && TOOL_ROLES.has(role)) {\n      continue;\n    }\n    const text = extractContentText(message.content);\n    const stripped = text.trim();\n    if (stripped) {\n      parts.push(stripped);\n    }\n  }\n  return parts.join(\"\\n\");\n}\n\nexport function extractTextFromPrompts(prompts: readonly string[]): string {\n  return prompts\n    .map((p) => p.trim())\n    .filter((p) => p.length > 0)\n    .join(\"\\n\");\n}\n\nexport function extractTextFromToolInput(inputStr: string): string {\n  return inputStr.trim();\n}\n\nexport function extractTextFromLLMResult(response: DucktypedLLMResult): string {\n  const parts: string[] = [];\n  for (const genList of response.generations ?? []) {\n    for (const gen of genList) {\n      const text = (gen.text ?? \"\").trim();\n      if (text) {\n        parts.push(text);\n      }\n    }\n  }\n  return parts.join(\"\\n\");\n}\n\nexport function extractTextFromDocuments(documents: ReadonlyArray<DucktypedDocument>): string {\n  const parts: string[] = [];\n  for (const doc of documents) {\n    const text = (doc.pageContent ?? \"\").trim();\n    if (text) {\n      parts.push(text);\n    }\n  }\n  return parts.join(\"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACMA,IAAM,yBAAyB;AAWxB,IAAM,2BAAN,MAAM,kCAAiC,MAAM;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAST;AACD,UAAM,0BAAyB,cAAc,MAAM,CAAC;AACpD,SAAK,OAAO;AACZ,SAAK,QAAQ,OAAO;AACpB,SAAK,YAAY,OAAO;AACxB,SAAK,aAAa,OAAO;AACzB,SAAK,QAAQ,OAAO;AACpB,SAAK,OAAO,OAAO;AACnB,SAAK,WAAW,OAAO;AACvB,SAAK,aAAa,OAAO;AACzB,SAAK,SAAS,OAAO;AACrB,WAAO,eAAe,MAAM,0BAAyB,SAAS;AAAA,EAChE;AAAA,EAEA,OAAe,cAAc,QAKlB;AACT,UAAM,YACJ,OAAO,WAAW,SAAS,yBACvB,GAAG,OAAO,WAAW,MAAM,GAAG,sBAAsB,CAAC,QACrD,OAAO;AACb,QACE,OAAO,QAAQ,eAAe,eAC9B,OAAO,QAAQ,YAAY,WAAW,SACtC;AACA,aAAO,4DAA4D,SAAS;AAAA,IAC9E;AACA,WACE,+CACU,OAAO,MAAM,QAAQ,CAAC,CAAC,eAAe,OAAO,UAAU,QAAQ,CAAC,CAAC,OACvE,SAAS;AAAA,EAEjB;AACF;AAOA,IAAM,mCAAmC,uBAAO;AAAA,EAC9C;AACF;AAwBO,SAAS,2BAA2B,OAAmD;AAC5F,MAAK,OAAO,UAAU,YAAY,OAAO,UAAU,cAAe,UAAU,MAAM;AAChF,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,OAAO;AAAA,MACZ;AAAA,MACA;AAAA,IACF,GAAG,UAAU;AAAA,EACf,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AClHO,IAAM,YAAY;AAAA,EACvB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,WAAW;AAAA,EACX,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,SAAS;AACX;AAIO,IAAM,eAAe;AAAA,EAC1B,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,SAAS;AAAA,EACT,UAAU;AAAA,EACV,eAAe;AACjB;AAIO,IAAM,gBAA2C,oBAAI,IAAkB;AAAA,EAC5E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,cAAyC,oBAAI,IAAkB;AAAA,EAC1E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,eAA0C,oBAAI,IAAkB;AAAA,EAC3E,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf,CAAC;AAEM,IAAM,YAAuC,oBAAI,IAAkB;AAAA,EACxE,GAAG;AAAA,EACH,GAAG;AACL,CAAC;AAEM,IAAM,yBAAoE;AAAA,EAC/E,CAAC,aAAa,gBAAgB,GAAG,UAAU;AAAA,EAC3C,CAAC,aAAa,SAAS,GAAG,UAAU;AAAA,EACpC,CAAC,aAAa,UAAU,GAAG,UAAU;AAAA,EACrC,CAAC,aAAa,QAAQ,GAAG,UAAU;AAAA,EACnC,CAAC,aAAa,eAAe,GAAG,UAAU;AAAA,EAC1C,CAAC,aAAa,aAAa,GAAG,UAAU;AAAA,EACxC,CAAC,aAAa,OAAO,GAAG,UAAU;AACpC;AAEA,IAAM,uBAA4C,IAAI,IAAI,OAAO,OAAO,YAAY,CAAC;AAE9E,SAAS,aACd,OAC2B;AAC3B,MAAI,UAAU,QAAW;AACvB,WAAO;AAAA,EACT;AACA,QAAM,WAAW,oBAAI,IAAkB;AACvC,aAAW,KAAK,OAAO;AACrB,QAAI,CAAC,qBAAqB,IAAI,CAAC,GAAG;AAChC,YAAM,IAAI,MAAM,+BAA+B,OAAO,CAAC,CAAC,EAAE;AAAA,IAC5D;AACA,aAAS,IAAI,CAAiB;AAAA,EAChC;AACA,SAAO;AACT;;;AC1EO,SAAS,aAAa,OAA0C;AACrE,MAAI,UAAU,UAAa,UAAU,YAAY,UAAU,UAAU,UAAU,SAAS;AACtF,WAAO;AAAA,EACT;AACA,QAAM,IAAI,MAAM,+CAA+C;AACjE;;;AC0EO,SAAS,uBAAuB,SAAoC;AACzE,SAAO,QACJ,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAC1B,KAAK,IAAI;AACd;AAEO,SAAS,yBAAyB,UAA0B;AACjE,SAAO,SAAS,KAAK;AACvB;AAEO,SAAS,yBAAyB,UAAsC;AAC7E,QAAM,QAAkB,CAAC;AACzB,aAAW,WAAW,SAAS,eAAe,CAAC,GAAG;AAChD,eAAW,OAAO,SAAS;AACzB,YAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK;AACnC,UAAI,MAAM;AACR,cAAM,KAAK,IAAI;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,yBAAyB,WAAqD;AAC5F,QAAM,QAAkB,CAAC;AACzB,aAAW,OAAO,WAAW;AAC3B,UAAM,QAAQ,IAAI,eAAe,IAAI,KAAK;AAC1C,QAAI,MAAM;AACR,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;;;AJ1FA,IAAM,aAAkC,oBAAI,IAAI,CAAC,SAAS,MAAM,CAAC;AAQjE,SAAS,eAAe,SAA4C;AAClE,MAAI,OAAO,QAAQ,SAAS,UAAU;AACpC,WAAO,QAAQ,KAAK,YAAY;AAAA,EAClC;AACA,MAAI,OAAO,QAAQ,SAAS,UAAU;AACpC,WAAO,QAAQ,KAAK,YAAY;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,SAAuD;AACjF,MAAI,YAAY,QAAW;AACzB,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,UAAU;AAC/B,WAAO;AAAA,EACT;AACA,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,SAAS;AAC3B,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,KAAK,KAAK;AAAA,IAClB,WAAW,SAAS,MAAM,SAAS,QAAQ;AACzC,YAAM,KAAK,MAAM,QAAQ,EAAE;AAAA,IAC7B;AAAA,EACF;AACA,SAAO,MAAM,KAAK,GAAG;AACvB;AAEA,SAAS,oBACP,UACuC;AACvC,WAAS,IAAI,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK;AAC7C,UAAM,MAAM,SAAS,CAAC;AACtB,QAAI,WAAW,IAAI,eAAe,GAAG,CAAC,GAAG;AACvC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,uBACpB,UACA,UAAmC,CAAC,GACN;AAC9B,QAAM,EAAE,oBAAoB,IAAI,MAAM,OAAO,gCAAgC;AAE7E,QAAM,eAAe,aAAa,QAAQ,KAAK;AAG/C,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,SACJ,QAAQ,WACP,CAAC,SAAiB,UAAyB;AAE1C,YAAQ,KAAK,sBAAsB,OAAO,IAAI,KAAK;AAAA,EACrD;AACF,QAAM,gBAAgB,aAAa,QAAQ,IAAI,MAC7C,QAAQ,eAAe,SACnB,SAAS,OACT,QAAQ,aAAa,WAAW;AAEtC,QAAM,aAAa,QAAQ;AAE3B,QAAM,iBAAiB,CAAC,UAA+B;AACrD,QAAI,CAAC,YAAY;AACf;AAAA,IACF;AACA,QAAI;AACF,iBAAW,KAAK;AAAA,IAClB,SAAS,KAAK;AACZ,aAAO,6BAA6B,GAAG;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,WAAW,OACf,MACA,WACA,OACA,aACkB;AAClB,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,SAAS,SAAS,MAAM;AAAA,QACrC,MAAM;AAAA,QACN,UAAU;AAAA,UACR,WAAW,EAAE,QAAQ,MAAM;AAAA,UAC3B,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,eAAe;AAAA,QAC3F;AAAA,QACA,GAAI,kBAAkB,SAAY,EAAE,MAAM,cAAc,IAAI,CAAC;AAAA,QAC7D,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/C,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,2BAA2B,GAAG,GAAG;AACnC,cAAM;AAAA,MACR;AACA,UAAI,CAAC,UAAU;AACb,cAAM;AAAA,MACR;AACA,aAAO,kDAAkD,GAAG;AAC5D;AAAA,IACF;AACA,UAAM,YAAY,OAAO;AACzB,UAAM,UAAU,OAAO,eAAe,eAAe,OAAO,YAAY,WAAW;AACnF,UAAM,gBAAgB,iBAAiB,OAAO,QAAQ;AACtD,UAAM,oBAAoB;AAAA,MACxB,MAAM;AAAA,MACN,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,mBAAe;AAAA,MACb,GAAG;AAAA,MACH;AAAA,MACA,MAAM;AAAA,MACN,YAAY,kBAAkB;AAAA,IAChC,CAAC;AACD,QAAI,CAAC,WAAW,kBAAkB,SAAS;AACzC;AAAA,IACF;AAEA,UAAM,IAAI,yBAAyB;AAAA,MACjC,OAAO,OAAO;AAAA,MACd;AAAA,MACA,YAAY;AAAA,MACZ;AAAA,MACA,MAAM;AAAA,MACN,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC7C;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,gCAAgC,oBAAoB;AAAA,IAC/C,OAAO;AAAA,IACP,aAAa;AAAA,IACb,gBAAgB;AAAA,IAEzB,MAAe,qBACb,MACA,UACA,OACe;AACf,UAAI,CAAC,aAAa,IAAI,aAAa,gBAAgB,GAAG;AACpD;AAAA,MACF;AACA,YAAM,UAAU;AAChB,YAAM,OAAoC,CAAC;AAC3C,iBAAW,SAAS,SAAS;AAC3B,mBAAW,KAAK,OAAO;AACrB,eAAK,KAAK,CAAC;AAAA,QACb;AAAA,MACF;AACA,YAAM,WAAW,oBAAoB,IAAI;AACzC,UAAI,CAAC,UAAU;AACb;AAAA,MACF;AACA,YAAM,OAAO,mBAAmB,SAAS,OAAO,EAAE,KAAK;AACvD,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,uBAAuB,aAAa,gBAAgB,GAAG,KAAK;AAAA,IACnF;AAAA,IAEA,MAAe,eACb,MACA,SACA,OACe;AACf,UAAI,CAAC,aAAa,IAAI,aAAa,SAAS,GAAG;AAC7C;AAAA,MACF;AACA,YAAM,OAAO,uBAAuB,OAAO;AAC3C,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,uBAAuB,aAAa,SAAS,GAAG,KAAK;AAAA,IAC5E;AAAA,IAEA,MAAe,gBACb,MACA,UACA,OACe;AACf,UAAI,CAAC,eAAe,CAAC,aAAa,IAAI,aAAa,UAAU,GAAG;AAC9D;AAAA,MACF;AACA,YAAM,OAAO,yBAAyB,QAAQ;AAC9C,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,WAAW,MAAM;AACvB,YAAM,SAAS,MAAM,uBAAuB,aAAa,UAAU,GAAG,OAAO,QAAQ;AAAA,IACvF;AAAA,IAEA,MAAe,qBACb,YACA,OACA,OACe;AACf,UAAI,CAAC,aAAa,IAAI,aAAa,eAAe,GAAG;AACnD;AAAA,MACF;AACA,YAAM,OAAO,MAAM,KAAK;AACxB,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,uBAAuB,aAAa,eAAe,GAAG,KAAK;AAAA,IAClF;AAAA,IAEA,MAAe,aAAa,QAAiB,OAA8B;AACzE,UAAI,CAAC,aAAa,IAAI,aAAa,OAAO,GAAG;AAC3C;AAAA,MACF;AACA,YAAM,OAAO,yBAAyB,MAA2E;AACjH,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,uBAAuB,aAAa,OAAO,GAAG,KAAK;AAAA,IAC1E;AAAA,IAEA,MAAe,cACb,QACA,OACA,cACA,OACA,SACe;AACf,UAAI,CAAC,eAAe,CAAC,aAAa,IAAI,aAAa,QAAQ,GAAG;AAC5D;AAAA,MACF;AACA,YAAM,OAAO,OAAO,MAAM,EAAE,KAAK;AACjC,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,WAAW,SAAS;AAC1B,YAAM,SAAS,MAAM,uBAAuB,aAAa,QAAQ,GAAG,OAAO,QAAQ;AAAA,IACrF;AAAA,IAEA,MAAe,mBACb,WACA,OACe;AACf,UAAI,CAAC,aAAa,IAAI,aAAa,aAAa,GAAG;AACjD;AAAA,MACF;AACA,YAAM,OAAO,yBAAyB,SAAS;AAC/C,UAAI,CAAC,MAAM;AACT;AAAA,MACF;AACA,YAAM,SAAS,MAAM,uBAAuB,aAAa,aAAa,GAAG,KAAK;AAAA,IAChF;AAAA,EACF;AAEA,SAAO,IAAI,wBAAwB;AACrC;","names":[]}

package/dist/adapters/langchain.js

@@ -110,6 +110,14 @@ function resolveHooks(hooks) {
   return resolved;
 }
 
+// src/modes.ts
+function validateMode(value) {
+  if (value === void 0 || value === "shadow" || value === "warn" || value === "block") {
+    return value;
+  }
+  throw new Error("Firewall: mode must be shadow, warn, or block");
+}
+
 // src/utils/extract.ts
 function extractTextFromPrompts(prompts) {
   return prompts.map((p) => p.trim()).filter((p) => p.length > 0).join("\n");
@@ -185,7 +193,7 @@ async function createLangChainHandler(firewall, options = {}) {
   const logger = options.logger ?? ((message, error) => {
     console.warn(`silmaril.firewall: ${message}`, error);
   });
-  const requestedMode = options.mode ?? (options.shadowMode === void 0 ? firewall.mode : options.shadowMode ? "shadow" : "block");
+  const requestedMode = validateMode(options.mode) ?? (options.shadowMode === void 0 ? firewall.mode : options.shadowMode ? "shadow" : "block");
   const onClassify = options.onClassify;
   const fireOnClassify = (event) => {
     if (!onClassify) {