@warlock.js/ai 4.1.1

package/esm/middleware/builtins/budget.mjs

@@ -0,0 +1,100 @@
+import { BudgetExceededError } from "../../errors/budget-exceeded-error.mjs";
+import "../../errors/index.mjs";
+import { namespacedState } from "../utils/namespaced-state.mjs";
+
+//#region ../../@warlock.js/ai/src/middleware/builtins/budget.ts
+function breach(limit, actual, unit, name) {
+	throw new BudgetExceededError(`budget "${name}" exceeded — ${actual} ${unit} (cap: ${limit})`, {
+		limit,
+		actual,
+		unit
+	});
+}
+/**
+* Enforced token and / or USD budget for an agent run.
+*
+* **Role.** Guards against runaway tool loops, misconfigured
+* prompts, and unexpected provider price swings by capping
+* cumulative usage across every LLM trip of a single execution.
+* Aborts the run with a typed `BudgetExceededError` the moment a cap
+* is breached, rather than letting the damage grow trip by trip.
+*
+* **Scope.** Per-execution. A fresh counter is created at
+* `execute.before` and lives in the middleware state bag until the
+* run ends. Two concurrent `agent.execute()` calls on the same
+* agent therefore enforce the cap independently.
+*
+* **Token accounting.** After each successful trip, the middleware
+* adds `response.usage.total` to its running total and checks
+* against `maxTokens`. Synthetic trips (cache hits) contribute
+* `usage.total` as returned by the cache — cache middleware is
+* expected to surface zero usage on a hit, which naturally excludes
+* those trips from the budget.
+*
+* **USD accounting.** When `maxCostUSD` + `pricing[modelName]` are
+* both present, the middleware converts per-trip input / output
+* tokens to USD and accumulates. Missing pricing silently degrades
+* to tokens-only — explicit rather than guessing.
+*
+* **Warn mode.** `onExceeded: "warn"` logs a single warning the first
+* time a cap is breached and lets the run continue. Useful for
+* measuring real-world traffic against a proposed cap before flipping
+* to `"abort"` in production.
+*
+* @example
+* const budgetMiddleware = budget({ maxTokens: 50_000 });
+*
+* const myAgent = agent({
+*   model,
+*   middleware: [budgetMiddleware],
+* });
+*
+* @example
+* // With USD cap and custom pricing
+* const guard = budget({
+*   maxCostUSD: 0.5,
+*   pricing: {
+*     "gpt-4o": { inputPer1K: 0.005, outputPer1K: 0.015 },
+*   },
+* });
+*/
+function budget(options) {
+	const name = options.name ?? "budget";
+	const onExceeded = options.onExceeded ?? "abort";
+	const hasTokenCap = typeof options.maxTokens === "number";
+	const hasCostCap = typeof options.maxCostUSD === "number";
+	return {
+		name,
+		execute: { before(context) {
+			namespacedState(context, name).set({
+				tokens: 0,
+				costUSD: 0,
+				warned: false
+			});
+		} },
+		trip: { after(context, response) {
+			const counters = namespacedState(context, name).get();
+			if (!counters) return;
+			counters.tokens += response.usage.total;
+			if (hasCostCap && options.pricing) {
+				const pricing = options.pricing[context.model.name];
+				if (pricing) {
+					const tripCost = response.usage.input / 1e3 * pricing.inputPer1K + response.usage.output / 1e3 * pricing.outputPer1K;
+					counters.costUSD += tripCost;
+				}
+			}
+			if (hasTokenCap && counters.tokens > options.maxTokens) {
+				if (onExceeded === "abort") breach(options.maxTokens, counters.tokens, "tokens", name);
+				if (!counters.warned) counters.warned = true;
+			}
+			if (hasCostCap && counters.costUSD > options.maxCostUSD) {
+				if (onExceeded === "abort") breach(options.maxCostUSD, counters.costUSD, "usd", name);
+				if (!counters.warned) counters.warned = true;
+			}
+		} }
+	};
+}
+
+//#endregion
+export { budget };
+//# sourceMappingURL=budget.mjs.map

package/esm/middleware/builtins/budget.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.mjs","names":[],"sources":["../../../../../../../@warlock.js/ai/src/middleware/builtins/budget.ts"],"sourcesContent":["import type { AgentMiddleware } from \"../../contracts/middleware\";\nimport { BudgetExceededError, type BudgetUnit } from \"../../errors\";\nimport { namespacedState } from \"../utils\";\n\n/**\n * Per-model pricing used to compute USD cost from token counts.\n * Caller-supplied — no bundled table. Keys are model names (the\n * `ModelContract.name` value); values are input / output token\n * prices expressed as **USD per 1K tokens** to match every major\n * provider's published pricing sheet.\n */\nexport type BudgetPricing = Record<\n  string,\n  {\n    /** USD per 1,000 input tokens. */\n    inputPer1K: number;\n    /** USD per 1,000 output tokens. */\n    outputPer1K: number;\n  }\n>;\n\n/**\n * Configuration for `budget()`. At least one of `maxTokens` or\n * `maxCostUSD` must be supplied — a budget with no cap is a no-op.\n */\nexport type BudgetOptions = {\n  /**\n   * Hard cap on cumulative total tokens (input + output, summed\n   * across every trip of the run). Inclusive — exceeding triggers\n   * the configured `onExceeded`.\n   */\n  maxTokens?: number;\n  /**\n   * Hard cap on cumulative USD cost. Requires `pricing` for the\n   * agent's configured model — without a pricing entry the USD check\n   * silently skips (tokens-only enforcement still applies).\n   */\n  maxCostUSD?: number;\n  /**\n   * Per-model pricing table used to compute USD cost. Only consulted\n   * when `maxCostUSD` is set. Model names must match the running\n   * agent's `ModelContract.name` exactly.\n   */\n  pricing?: BudgetPricing;\n  /**\n   * Behavior when a cap is breached. `\"abort\"` throws\n   * `BudgetExceededError` — surfaces on `result.error`, stops the\n   * run at the next trip boundary. `\"warn\"` logs a warning and\n   * lets the run continue (useful for observability-first rollouts\n   * before flipping the switch to abort). Default `\"abort\"`.\n   */\n  onExceeded?: \"abort\" | \"warn\";\n  /**\n   * Override the middleware name. Useful when two budgets coexist\n   * (e.g. a per-request cap plus a session-wide cap via different\n   * instances). Default `\"budget\"`.\n   */\n  name?: string;\n};\n\ntype BudgetCounters = {\n  tokens: number;\n  costUSD: number;\n  warned: boolean;\n};\n\nfunction breach(\n  limit: number,\n  actual: number,\n  unit: BudgetUnit,\n  name: string,\n): never {\n  throw new BudgetExceededError(\n    `budget \"${name}\" exceeded — ${actual} ${unit} (cap: ${limit})`,\n    { limit, actual, unit },\n  );\n}\n\n/**\n * Enforced token and / or USD budget for an agent run.\n *\n * **Role.** Guards against runaway tool loops, misconfigured\n * prompts, and unexpected provider price swings by capping\n * cumulative usage across every LLM trip of a single execution.\n * Aborts the run with a typed `BudgetExceededError` the moment a cap\n * is breached, rather than letting the damage grow trip by trip.\n *\n * **Scope.** Per-execution. A fresh counter is created at\n * `execute.before` and lives in the middleware state bag until the\n * run ends. Two concurrent `agent.execute()` calls on the same\n * agent therefore enforce the cap independently.\n *\n * **Token accounting.** After each successful trip, the middleware\n * adds `response.usage.total` to its running total and checks\n * against `maxTokens`. Synthetic trips (cache hits) contribute\n * `usage.total` as returned by the cache — cache middleware is\n * expected to surface zero usage on a hit, which naturally excludes\n * those trips from the budget.\n *\n * **USD accounting.** When `maxCostUSD` + `pricing[modelName]` are\n * both present, the middleware converts per-trip input / output\n * tokens to USD and accumulates. Missing pricing silently degrades\n * to tokens-only — explicit rather than guessing.\n *\n * **Warn mode.** `onExceeded: \"warn\"` logs a single warning the first\n * time a cap is breached and lets the run continue. Useful for\n * measuring real-world traffic against a proposed cap before flipping\n * to `\"abort\"` in production.\n *\n * @example\n * const budgetMiddleware = budget({ maxTokens: 50_000 });\n *\n * const myAgent = agent({\n *   model,\n *   middleware: [budgetMiddleware],\n * });\n *\n * @example\n * // With USD cap and custom pricing\n * const guard = budget({\n *   maxCostUSD: 0.5,\n *   pricing: {\n *     \"gpt-4o\": { inputPer1K: 0.005, outputPer1K: 0.015 },\n *   },\n * });\n */\nexport function budget(options: BudgetOptions): AgentMiddleware {\n  const name = options.name ?? \"budget\";\n  const onExceeded = options.onExceeded ?? \"abort\";\n  const hasTokenCap = typeof options.maxTokens === \"number\";\n  const hasCostCap = typeof options.maxCostUSD === \"number\";\n\n  return {\n    name,\n    execute: {\n      before(context) {\n        const counters = namespacedState<BudgetCounters>(context, name);\n        counters.set({ tokens: 0, costUSD: 0, warned: false });\n      },\n    },\n    trip: {\n      after(context, response) {\n        const counters = namespacedState<BudgetCounters>(context, name).get();\n\n        if (!counters) {\n          return;\n        }\n\n        counters.tokens += response.usage.total;\n\n        if (hasCostCap && options.pricing) {\n          const pricing = options.pricing[context.model.name];\n\n          if (pricing) {\n            const tripCost =\n              (response.usage.input / 1000) * pricing.inputPer1K +\n              (response.usage.output / 1000) * pricing.outputPer1K;\n            counters.costUSD += tripCost;\n          }\n        }\n\n        if (hasTokenCap && counters.tokens > options.maxTokens!) {\n          if (onExceeded === \"abort\") {\n            breach(options.maxTokens!, counters.tokens, \"tokens\", name);\n          }\n\n          if (!counters.warned) {\n            counters.warned = true;\n          }\n        }\n\n        if (hasCostCap && counters.costUSD > options.maxCostUSD!) {\n          if (onExceeded === \"abort\") {\n            breach(options.maxCostUSD!, counters.costUSD, \"usd\", name);\n          }\n\n          if (!counters.warned) {\n            counters.warned = true;\n          }\n        }\n      },\n    },\n  };\n}\n"],"mappings":";;;;;AAkEA,SAAS,OACP,OACA,QACA,MACA,MACO;CACP,MAAM,IAAI,oBACR,WAAW,KAAK,eAAe,OAAO,GAAG,KAAK,SAAS,MAAM,IAC7D;EAAE;EAAO;EAAQ;CAAK,CACxB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,SAAgB,OAAO,SAAyC;CAC9D,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,aAAa,QAAQ,cAAc;CACzC,MAAM,cAAc,OAAO,QAAQ,cAAc;CACjD,MAAM,aAAa,OAAO,QAAQ,eAAe;CAEjD,OAAO;EACL;EACA,SAAS,EACP,OAAO,SAAS;GAEd,AADiB,gBAAgC,SAAS,IACnD,EAAE,IAAI;IAAE,QAAQ;IAAG,SAAS;IAAG,QAAQ;GAAM,CAAC;EACvD,EACF;EACA,MAAM,EACJ,MAAM,SAAS,UAAU;GACvB,MAAM,WAAW,gBAAgC,SAAS,IAAI,EAAE,IAAI;GAEpE,IAAI,CAAC,UACH;GAGF,SAAS,UAAU,SAAS,MAAM;GAElC,IAAI,cAAc,QAAQ,SAAS;IACjC,MAAM,UAAU,QAAQ,QAAQ,QAAQ,MAAM;IAE9C,IAAI,SAAS;KACX,MAAM,WACH,SAAS,MAAM,QAAQ,MAAQ,QAAQ,aACvC,SAAS,MAAM,SAAS,MAAQ,QAAQ;KAC3C,SAAS,WAAW;IACtB;GACF;GAEA,IAAI,eAAe,SAAS,SAAS,QAAQ,WAAY;IACvD,IAAI,eAAe,SACjB,OAAO,QAAQ,WAAY,SAAS,QAAQ,UAAU,IAAI;IAG5D,IAAI,CAAC,SAAS,QACZ,SAAS,SAAS;GAEtB;GAEA,IAAI,cAAc,SAAS,UAAU,QAAQ,YAAa;IACxD,IAAI,eAAe,SACjB,OAAO,QAAQ,YAAa,SAAS,SAAS,OAAO,IAAI;IAG3D,IAAI,CAAC,SAAS,QACZ,SAAS,SAAS;GAEtB;EACF,EACF;CACF;AACF"}

package/esm/middleware/builtins/guardrail.d.mts

@@ -0,0 +1,92 @@
+import { MiddlewareTripContext } from "../../contracts/middleware/middleware-context.type.mjs";
+import { AgentMiddleware } from "../../contracts/middleware/middleware.contract.mjs";
+//#region ../../@warlock.js/ai/src/middleware/builtins/guardrail.d.ts
+/**
+ * Decision returned by a guardrail check function. `ok: true`
+ * permits the call; `ok: false` rejects with a human-readable
+ * `reason` surfaced on `GuardrailViolationError`.
+ */
+type GuardrailCheckResult = {
+  ok: true;
+} | {
+  ok: false;
+  reason: string;
+};
+/**
+ * Synchronous or asynchronous check invoked against the outbound
+ * prompt (`inputCheck`) or the inbound response (`outputCheck`).
+ * Receives the raw text and the surrounding trip context so
+ * consumers can classify, route to an external moderation API, or
+ * branch on tripIndex / messages history.
+ */
+type GuardrailCheck = (text: string, context: MiddlewareTripContext) => GuardrailCheckResult | Promise<GuardrailCheckResult>;
+/**
+ * Configuration for `guardrail()`.  At least one of `inputCheck` or
+ * `outputCheck` must be supplied — a guardrail with no checks is a
+ * no-op.
+ */
+type GuardrailOptions = {
+  /**
+   * Run against the outbound prompt just before the model sees it.
+   * Fires every trip with the concatenated last user-message text.
+   * Rejection aborts the trip with a `GuardrailViolationError` whose
+   * `phase === "input"`.
+   */
+  inputCheck?: GuardrailCheck;
+  /**
+   * Run against the model's response text after the trip completes.
+   * Fires every trip with `response.content`. Rejection aborts with
+   * a `GuardrailViolationError` whose `phase === "output"`.
+   *
+   * Output checks run BEFORE any tool dispatch — a rejected response
+   * means the tool calls it requested are never invoked.
+   */
+  outputCheck?: GuardrailCheck;
+  /**
+   * Override the middleware name — surfaces on
+   * `GuardrailViolationError.guardrail` so operators can tell two
+   * guardrails apart in logs. Default `"guardrail"`.
+   */
+  name?: string;
+};
+/**
+ * Pre/post content guardrail for an agent run.
+ *
+ * **Role.** Inspects outbound prompts and inbound responses against
+ * caller-supplied policies, aborting the trip with a typed
+ * `GuardrailViolationError` when either trips a check. Consumers
+ * distinguish `"input"` vs `"output"` violations off `error.phase`
+ * — the two failure modes have very different product responses
+ * (block the user vs re-prompt the model).
+ *
+ * **Scope.** Per-trip. Fires on every round-trip the agent makes,
+ * including repair attempts and tool-follow-up trips. Input checks
+ * evaluate the last user-role message; output checks evaluate the
+ * raw model response text before any tool call is dispatched.
+ *
+ * **Composition.** A single middleware instance can carry both
+ * `inputCheck` and `outputCheck`, or two separate instances can be
+ * registered (useful when input and output policies come from
+ * different teams / services). Registration order determines which
+ * guardrail's violation surfaces first — the short-circuit throws
+ * from the innermost offending hook, and outer guardrails never run
+ * after an abort.
+ *
+ * **Not a sanitizer.** The guardrail either passes a trip unchanged
+ * or aborts it. Mutating the prompt / response in-place is out of
+ * scope — use a bespoke middleware for content rewriting.
+ *
+ * @example
+ * const policy = guardrail({
+ *   inputCheck: async (text) =>
+ *     text.includes("SSN") ? { ok: false, reason: "pii" } : { ok: true },
+ *   outputCheck: async (text) =>
+ *     text.length > 10_000 ? { ok: false, reason: "too-long" } : { ok: true },
+ * });
+ *
+ * const myAgent = agent({ model, middleware: [policy] });
+ */
+declare function guardrail(options: GuardrailOptions): AgentMiddleware;
+//#endregion
+export { GuardrailCheck, GuardrailCheckResult, GuardrailOptions, guardrail };
+//# sourceMappingURL=guardrail.d.mts.map

package/esm/middleware/builtins/guardrail.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrail.d.mts","names":[],"sources":["../../../../../../../@warlock.js/ai/src/middleware/builtins/guardrail.ts"],"mappings":";;;;;;;AAaA;KAAY,oBAAA;EAAyB,EAAA;AAAA;EAAe,EAAA;EAAW,MAAA;AAAA;;AAAM;AASrE;;;;;KAAY,cAAA,IACV,IAAA,UACA,OAAA,EAAS,qBAAA,KACN,oBAAA,GAAuB,OAAA,CAAQ,oBAAA;;;;;;KAOxB,gBAAA;EAPP;;;;AAAmD;AAOxD;EAOE,UAAA,GAAa,cAAA;;;;;;;;;EASb,WAAA,GAAc,cAAc;EA8Cd;;;;;EAxCd,IAAA;AAAA;;AAwCmE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAArD,SAAA,CAAU,OAAA,EAAS,gBAAA,GAAmB,eAAe"}

package/esm/middleware/builtins/guardrail.mjs

@@ -0,0 +1,76 @@
+import { GuardrailViolationError } from "../../errors/guardrail-violation-error.mjs";
+import "../../errors/index.mjs";
+import { extractUserText } from "../utils/extract-user-text.mjs";
+
+//#region ../../@warlock.js/ai/src/middleware/builtins/guardrail.ts
+/**
+* Pre/post content guardrail for an agent run.
+*
+* **Role.** Inspects outbound prompts and inbound responses against
+* caller-supplied policies, aborting the trip with a typed
+* `GuardrailViolationError` when either trips a check. Consumers
+* distinguish `"input"` vs `"output"` violations off `error.phase`
+* — the two failure modes have very different product responses
+* (block the user vs re-prompt the model).
+*
+* **Scope.** Per-trip. Fires on every round-trip the agent makes,
+* including repair attempts and tool-follow-up trips. Input checks
+* evaluate the last user-role message; output checks evaluate the
+* raw model response text before any tool call is dispatched.
+*
+* **Composition.** A single middleware instance can carry both
+* `inputCheck` and `outputCheck`, or two separate instances can be
+* registered (useful when input and output policies come from
+* different teams / services). Registration order determines which
+* guardrail's violation surfaces first — the short-circuit throws
+* from the innermost offending hook, and outer guardrails never run
+* after an abort.
+*
+* **Not a sanitizer.** The guardrail either passes a trip unchanged
+* or aborts it. Mutating the prompt / response in-place is out of
+* scope — use a bespoke middleware for content rewriting.
+*
+* @example
+* const policy = guardrail({
+*   inputCheck: async (text) =>
+*     text.includes("SSN") ? { ok: false, reason: "pii" } : { ok: true },
+*   outputCheck: async (text) =>
+*     text.length > 10_000 ? { ok: false, reason: "too-long" } : { ok: true },
+* });
+*
+* const myAgent = agent({ model, middleware: [policy] });
+*/
+function guardrail(options) {
+	const name = options.name ?? "guardrail";
+	const { inputCheck, outputCheck } = options;
+	return {
+		name,
+		trip: {
+			async before(context) {
+				if (!inputCheck) return;
+				const prompt = extractUserText(context.messages);
+				if (!prompt) return;
+				const verdict = await inputCheck(prompt, context);
+				if (!verdict.ok) throw new GuardrailViolationError(`guardrail "${name}" rejected input — ${verdict.reason}`, {
+					phase: "input",
+					reason: verdict.reason,
+					guardrail: name
+				});
+			},
+			async after(context, response) {
+				if (!outputCheck) return;
+				if (!response.content) return;
+				const verdict = await outputCheck(response.content, context);
+				if (!verdict.ok) throw new GuardrailViolationError(`guardrail "${name}" rejected output — ${verdict.reason}`, {
+					phase: "output",
+					reason: verdict.reason,
+					guardrail: name
+				});
+			}
+		}
+	};
+}
+
+//#endregion
+export { guardrail };
+//# sourceMappingURL=guardrail.mjs.map

package/esm/middleware/builtins/guardrail.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrail.mjs","names":[],"sources":["../../../../../../../@warlock.js/ai/src/middleware/builtins/guardrail.ts"],"sourcesContent":["import type {\n  AgentMiddleware,\n  MiddlewareTripContext,\n} from \"../../contracts/middleware\";\nimport type { ModelResponse } from \"../../contracts/model.contract\";\nimport { GuardrailViolationError } from \"../../errors\";\nimport { extractUserText } from \"../utils\";\n\n/**\n * Decision returned by a guardrail check function. `ok: true`\n * permits the call; `ok: false` rejects with a human-readable\n * `reason` surfaced on `GuardrailViolationError`.\n */\nexport type GuardrailCheckResult = { ok: true } | { ok: false; reason: string };\n\n/**\n * Synchronous or asynchronous check invoked against the outbound\n * prompt (`inputCheck`) or the inbound response (`outputCheck`).\n * Receives the raw text and the surrounding trip context so\n * consumers can classify, route to an external moderation API, or\n * branch on tripIndex / messages history.\n */\nexport type GuardrailCheck = (\n  text: string,\n  context: MiddlewareTripContext,\n) => GuardrailCheckResult | Promise<GuardrailCheckResult>;\n\n/**\n * Configuration for `guardrail()`.  At least one of `inputCheck` or\n * `outputCheck` must be supplied — a guardrail with no checks is a\n * no-op.\n */\nexport type GuardrailOptions = {\n  /**\n   * Run against the outbound prompt just before the model sees it.\n   * Fires every trip with the concatenated last user-message text.\n   * Rejection aborts the trip with a `GuardrailViolationError` whose\n   * `phase === \"input\"`.\n   */\n  inputCheck?: GuardrailCheck;\n  /**\n   * Run against the model's response text after the trip completes.\n   * Fires every trip with `response.content`. Rejection aborts with\n   * a `GuardrailViolationError` whose `phase === \"output\"`.\n   *\n   * Output checks run BEFORE any tool dispatch — a rejected response\n   * means the tool calls it requested are never invoked.\n   */\n  outputCheck?: GuardrailCheck;\n  /**\n   * Override the middleware name — surfaces on\n   * `GuardrailViolationError.guardrail` so operators can tell two\n   * guardrails apart in logs. Default `\"guardrail\"`.\n   */\n  name?: string;\n};\n\n/**\n * Pre/post content guardrail for an agent run.\n *\n * **Role.** Inspects outbound prompts and inbound responses against\n * caller-supplied policies, aborting the trip with a typed\n * `GuardrailViolationError` when either trips a check. Consumers\n * distinguish `\"input\"` vs `\"output\"` violations off `error.phase`\n * — the two failure modes have very different product responses\n * (block the user vs re-prompt the model).\n *\n * **Scope.** Per-trip. Fires on every round-trip the agent makes,\n * including repair attempts and tool-follow-up trips. Input checks\n * evaluate the last user-role message; output checks evaluate the\n * raw model response text before any tool call is dispatched.\n *\n * **Composition.** A single middleware instance can carry both\n * `inputCheck` and `outputCheck`, or two separate instances can be\n * registered (useful when input and output policies come from\n * different teams / services). Registration order determines which\n * guardrail's violation surfaces first — the short-circuit throws\n * from the innermost offending hook, and outer guardrails never run\n * after an abort.\n *\n * **Not a sanitizer.** The guardrail either passes a trip unchanged\n * or aborts it. Mutating the prompt / response in-place is out of\n * scope — use a bespoke middleware for content rewriting.\n *\n * @example\n * const policy = guardrail({\n *   inputCheck: async (text) =>\n *     text.includes(\"SSN\") ? { ok: false, reason: \"pii\" } : { ok: true },\n *   outputCheck: async (text) =>\n *     text.length > 10_000 ? { ok: false, reason: \"too-long\" } : { ok: true },\n * });\n *\n * const myAgent = agent({ model, middleware: [policy] });\n */\nexport function guardrail(options: GuardrailOptions): AgentMiddleware {\n  const name = options.name ?? \"guardrail\";\n  const { inputCheck, outputCheck } = options;\n\n  return {\n    name,\n    trip: {\n      async before(context) {\n        if (!inputCheck) {\n          return;\n        }\n\n        const prompt = extractUserText(context.messages);\n\n        if (!prompt) {\n          return;\n        }\n\n        const verdict = await inputCheck(prompt, context);\n\n        if (!verdict.ok) {\n          throw new GuardrailViolationError(\n            `guardrail \"${name}\" rejected input — ${verdict.reason}`,\n            { phase: \"input\", reason: verdict.reason, guardrail: name },\n          );\n        }\n      },\n      async after(context, response: ModelResponse) {\n        if (!outputCheck) {\n          return;\n        }\n\n        if (!response.content) {\n          return;\n        }\n\n        const verdict = await outputCheck(response.content, context);\n\n        if (!verdict.ok) {\n          throw new GuardrailViolationError(\n            `guardrail \"${name}\" rejected output — ${verdict.reason}`,\n            { phase: \"output\", reason: verdict.reason, guardrail: name },\n          );\n        }\n      },\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8FA,SAAgB,UAAU,SAA4C;CACpE,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,EAAE,YAAY,gBAAgB;CAEpC,OAAO;EACL;EACA,MAAM;GACJ,MAAM,OAAO,SAAS;IACpB,IAAI,CAAC,YACH;IAGF,MAAM,SAAS,gBAAgB,QAAQ,QAAQ;IAE/C,IAAI,CAAC,QACH;IAGF,MAAM,UAAU,MAAM,WAAW,QAAQ,OAAO;IAEhD,IAAI,CAAC,QAAQ,IACX,MAAM,IAAI,wBACR,cAAc,KAAK,qBAAqB,QAAQ,UAChD;KAAE,OAAO;KAAS,QAAQ,QAAQ;KAAQ,WAAW;IAAK,CAC5D;GAEJ;GACA,MAAM,MAAM,SAAS,UAAyB;IAC5C,IAAI,CAAC,aACH;IAGF,IAAI,CAAC,SAAS,SACZ;IAGF,MAAM,UAAU,MAAM,YAAY,SAAS,SAAS,OAAO;IAE3D,IAAI,CAAC,QAAQ,IACX,MAAM,IAAI,wBACR,cAAc,KAAK,sBAAsB,QAAQ,UACjD;KAAE,OAAO;KAAU,QAAQ,QAAQ;KAAQ,WAAW;IAAK,CAC7D;GAEJ;EACF;CACF;AACF"}

package/esm/middleware/builtins/semantic-cache.d.mts

@@ -0,0 +1,106 @@
+import { EmbedderContract } from "../../contracts/embedder.contract.mjs";
+import { AgentMiddleware } from "../../contracts/middleware/middleware.contract.mjs";
+import { CacheDriver } from "@warlock.js/cache";
+
+//#region ../../@warlock.js/ai/src/middleware/builtins/semantic-cache.d.ts
+/**
+ * Configuration for `semanticCache()`.
+ */
+type SemanticCacheOptions = {
+  /** Embedder used to produce the query vector from the prompt text. */embedder: EmbedderContract;
+  /**
+   * Vector-capable cache driver from `@warlock.js/cache`. Production
+   * deployments pick a driver with a real ANN index (`pg` with
+   * pgvector, `redis` with RediSearch). Dev / test environments use
+   * `new MemoryCacheDriver()` — zero config, correct, but O(N) per
+   * query. Drivers without similarity support throw
+   * `CacheUnsupportedError` from `set({ vector })` / `similar()`.
+   *
+   * Falls back to `ai.config({ defaultStore })` when omitted. When
+   * neither is set, the factory throws at construction time —
+   * semantic cache cannot operate without a store.
+   */
+  store?: CacheDriver<any, any>;
+  /**
+   * Minimum cosine similarity for a vector hit. Between 0 and 1 —
+   * 0.95 is a solid default for question-answering caches.
+   */
+  threshold: number;
+  /**
+   * Optional TTL in milliseconds. Entries whose `storedAt` is older
+   * than this are treated as misses on read and overwritten on the
+   * next write. Default: no expiry — entries live until the store
+   * evicts them (per its own TTL/eviction policy).
+   */
+  ttlMs?: number;
+  /**
+   * Namespace prefix applied to every key the cache writes. Lets
+   * multiple agents share one driver without collision. Default
+   * `"ai.cache"`.
+   */
+  namespace?: string;
+  /**
+   * Middleware name — also the state-bag key prefix inside a single
+   * execution. Default `"semantic-cache"`.
+   */
+  name?: string;
+};
+/**
+ * Semantic-similarity response cache for an agent run.
+ *
+ * **Role.** Skips LLM round-trips when the current prompt is
+ * semantically close to one the agent has already answered. For
+ * FAQ / support-style traffic this often eliminates 60–80% of
+ * model calls — the production win is massive for cost and
+ * latency.
+ *
+ * **Delegation to `@warlock.js/cache`.** This middleware does NOT
+ * implement similarity search itself. It delegates to the supplied
+ * `CacheDriver`. Production deployments pick a driver with an ANN
+ * index (`pg` + pgvector, `redis` + RediSearch). Dev / test
+ * environments pass `new MemoryCacheDriver()` — zero config, correct,
+ * but O(N) per query. Drivers without similarity support throw
+ * `CacheUnsupportedError` from `set({ vector })` / `similar()`.
+ *
+ * **Two-tier lookup.**
+ * 1. *Exact-match key* — a cheap FNV hash over the entire message
+ *    list. `store.get(hash)` returns the entry without an embedding
+ *    round trip when the prompt hasn't changed at all.
+ * 2. *Vector-match* — on exact-match miss, embed the prompt and
+ *    call `store.similar(vector, { topK: 1, threshold })`. The
+ *    driver uses its native similarity index; anything clearing
+ *    `threshold` is returned as a hit.
+ *
+ * **Write-on-miss.** When both tiers miss, `trip.before` stashes
+ * the prompt hash + vector in `ctx.state`; `trip.after` reads back
+ * the pending entry and calls
+ * `store.set(hash, entry, { vector })`. If an outer middleware
+ * (guardrail) throws in `trip.after` before the cache's `trip.after`
+ * runs, the pending entry is never written — bad responses stay out
+ * of the cache **as long as the canonical install order is followed**
+ * (cache outermost).
+ *
+ * **Synthetic-response on hit.** Returns a `ModelResponse` with
+ * `usage: { input: 0, output: 0, total: 0 }` so budget /
+ * observability correctly exclude the saved trip.
+ *
+ * @example
+ * import { semanticCache } from "@warlock.js/ai";
+ * import { MemoryCacheDriver } from "@warlock.js/cache";
+ *
+ * const store = new MemoryCacheDriver();
+ * store.setOptions({});
+ *
+ * const cache = semanticCache({
+ *   embedder: openai.embedder({ name: "text-embedding-3-small" }),
+ *   store,
+ *   threshold: 0.95,
+ *   ttlMs: 60 * 60 * 1000,
+ * });
+ *
+ * const myAgent = agent({ model, middleware: [cache] });
+ */
+declare function semanticCache(options: SemanticCacheOptions): AgentMiddleware;
+//#endregion
+export { SemanticCacheOptions, semanticCache };
+//# sourceMappingURL=semantic-cache.d.mts.map

package/esm/middleware/builtins/semantic-cache.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic-cache.d.mts","names":[],"sources":["../../../../../../../@warlock.js/ai/src/middleware/builtins/semantic-cache.ts"],"mappings":";;;;;;;;KAWY,oBAAA;EAAoB,sEAE9B,QAAA,EAAU,gBAAA;EAaS;;;;;;;;;;AAuBf;AAkHN;EAzIE,KAAA,GAAQ,WAAW;;;;;EAKnB,SAAA;EAoI2E;AAAA;;;;;EA7H3E,KAAA;;;;;;EAMA,SAAA;;;;;EAKA,IAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkHc,aAAA,CAAc,OAAA,EAAS,oBAAA,GAAuB,eAAe"}

package/esm/middleware/builtins/semantic-cache.mjs

@@ -0,0 +1,149 @@
+import { extractUserText } from "../utils/extract-user-text.mjs";
+import { resolveDefaultStore } from "../../config.mjs";
+
+//#region ../../@warlock.js/ai/src/middleware/builtins/semantic-cache.ts
+const DEFAULT_NAMESPACE = "ai.cache";
+/**
+* Build a stable fingerprint for a prompt covering the full message
+* list (system + history + user turn). Ensures two prompts sharing
+* the user text but differing in prior context do not collide on
+* the exact-match fast path.
+*
+* FNV-1a variant — cheap, collision-resistant enough for a cache,
+* dependency-free. NOT a cryptographic hash: collisions would
+* surface as wrong cache hits, not a security issue in the current
+* trust model.
+*/
+function hashPrompt(messages) {
+	const serialized = messages.map((message) => {
+		return `${message.role}:${Array.isArray(message.content) ? message.content.filter((part) => part.type === "text").map((part) => part.text).join("|") : message.content}`;
+	}).join("||");
+	let hash = 2166136261;
+	for (let index = 0; index < serialized.length; index++) {
+		hash ^= serialized.charCodeAt(index);
+		hash = Math.imul(hash, 16777619);
+	}
+	return (hash >>> 0).toString(16);
+}
+function isFresh(entry, ttlMs) {
+	if (ttlMs === void 0) return true;
+	return Date.now() - entry.storedAt <= ttlMs;
+}
+/**
+* Semantic-similarity response cache for an agent run.
+*
+* **Role.** Skips LLM round-trips when the current prompt is
+* semantically close to one the agent has already answered. For
+* FAQ / support-style traffic this often eliminates 60–80% of
+* model calls — the production win is massive for cost and
+* latency.
+*
+* **Delegation to `@warlock.js/cache`.** This middleware does NOT
+* implement similarity search itself. It delegates to the supplied
+* `CacheDriver`. Production deployments pick a driver with an ANN
+* index (`pg` + pgvector, `redis` + RediSearch). Dev / test
+* environments pass `new MemoryCacheDriver()` — zero config, correct,
+* but O(N) per query. Drivers without similarity support throw
+* `CacheUnsupportedError` from `set({ vector })` / `similar()`.
+*
+* **Two-tier lookup.**
+* 1. *Exact-match key* — a cheap FNV hash over the entire message
+*    list. `store.get(hash)` returns the entry without an embedding
+*    round trip when the prompt hasn't changed at all.
+* 2. *Vector-match* — on exact-match miss, embed the prompt and
+*    call `store.similar(vector, { topK: 1, threshold })`. The
+*    driver uses its native similarity index; anything clearing
+*    `threshold` is returned as a hit.
+*
+* **Write-on-miss.** When both tiers miss, `trip.before` stashes
+* the prompt hash + vector in `ctx.state`; `trip.after` reads back
+* the pending entry and calls
+* `store.set(hash, entry, { vector })`. If an outer middleware
+* (guardrail) throws in `trip.after` before the cache's `trip.after`
+* runs, the pending entry is never written — bad responses stay out
+* of the cache **as long as the canonical install order is followed**
+* (cache outermost).
+*
+* **Synthetic-response on hit.** Returns a `ModelResponse` with
+* `usage: { input: 0, output: 0, total: 0 }` so budget /
+* observability correctly exclude the saved trip.
+*
+* @example
+* import { semanticCache } from "@warlock.js/ai";
+* import { MemoryCacheDriver } from "@warlock.js/cache";
+*
+* const store = new MemoryCacheDriver();
+* store.setOptions({});
+*
+* const cache = semanticCache({
+*   embedder: openai.embedder({ name: "text-embedding-3-small" }),
+*   store,
+*   threshold: 0.95,
+*   ttlMs: 60 * 60 * 1000,
+* });
+*
+* const myAgent = agent({ model, middleware: [cache] });
+*/
+function semanticCache(options) {
+	const name = options.name ?? "semantic-cache";
+	const namespace = options.namespace ?? DEFAULT_NAMESPACE;
+	const pendingKey = `${name}.pending`;
+	const store = options.store ?? resolveDefaultStore();
+	if (!store) throw new Error(`semanticCache: no store supplied — pass \`store\` in options or call \`ai.config({ defaultStore })\` at app boot before constructing the middleware`);
+	const keyFor = (hash) => `${namespace}.${hash}`;
+	return {
+		name,
+		log: true,
+		trip: {
+			async before(context) {
+				if (context.tripIndex !== 0) return;
+				const promptText = extractUserText(context.messages);
+				if (!promptText) return;
+				const promptKey = hashPrompt(context.messages);
+				const scopedKey = keyFor(promptKey);
+				const exact = await store.get(scopedKey);
+				if (exact && isFresh(exact, options.ttlMs)) return toSyntheticResponse(exact.response);
+				const query = await options.embedder.embed(promptText);
+				const [hit] = await store.similar(query.vector, {
+					topK: 1,
+					threshold: options.threshold
+				});
+				if (hit && isFresh(hit.value, options.ttlMs)) {
+					if (hit.key.startsWith(`${namespace}.`)) return toSyntheticResponse(hit.value.response);
+				}
+				const pending = {
+					promptKey,
+					vector: query.vector
+				};
+				context.state.set(pendingKey, pending);
+			},
+			async after(context, response) {
+				const pending = context.state.get(pendingKey);
+				if (!pending) return;
+				if (response.finishReason === "tool_calls") return;
+				context.state.delete(pendingKey);
+				const entry = {
+					response,
+					storedAt: Date.now()
+				};
+				await store.set(keyFor(pending.promptKey), entry, { vector: pending.vector });
+			}
+		}
+	};
+}
+function toSyntheticResponse(response) {
+	return {
+		content: response.content,
+		finishReason: response.finishReason,
+		usage: {
+			input: 0,
+			output: 0,
+			total: 0
+		},
+		toolCalls: response.toolCalls
+	};
+}
+
+//#endregion
+export { semanticCache };
+//# sourceMappingURL=semantic-cache.mjs.map

package/esm/middleware/builtins/semantic-cache.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic-cache.mjs","names":[],"sources":["../../../../../../../@warlock.js/ai/src/middleware/builtins/semantic-cache.ts"],"sourcesContent":["import type { CacheDriver } from \"@warlock.js/cache\";\nimport { resolveDefaultStore } from \"../../config\";\nimport type { Message } from \"../../contracts/conversation-message.type\";\nimport type { EmbedderContract } from \"../../contracts/embedder.contract\";\nimport type { AgentMiddleware } from \"../../contracts/middleware\";\nimport type { ModelResponse } from \"../../contracts/model.contract\";\nimport { extractUserText } from \"../utils\";\n\n/**\n * Configuration for `semanticCache()`.\n */\nexport type SemanticCacheOptions = {\n  /** Embedder used to produce the query vector from the prompt text. */\n  embedder: EmbedderContract;\n  /**\n   * Vector-capable cache driver from `@warlock.js/cache`. Production\n   * deployments pick a driver with a real ANN index (`pg` with\n   * pgvector, `redis` with RediSearch). Dev / test environments use\n   * `new MemoryCacheDriver()` — zero config, correct, but O(N) per\n   * query. Drivers without similarity support throw\n   * `CacheUnsupportedError` from `set({ vector })` / `similar()`.\n   *\n   * Falls back to `ai.config({ defaultStore })` when omitted. When\n   * neither is set, the factory throws at construction time —\n   * semantic cache cannot operate without a store.\n   */\n  store?: CacheDriver<any, any>;\n  /**\n   * Minimum cosine similarity for a vector hit. Between 0 and 1 —\n   * 0.95 is a solid default for question-answering caches.\n   */\n  threshold: number;\n  /**\n   * Optional TTL in milliseconds. Entries whose `storedAt` is older\n   * than this are treated as misses on read and overwritten on the\n   * next write. Default: no expiry — entries live until the store\n   * evicts them (per its own TTL/eviction policy).\n   */\n  ttlMs?: number;\n  /**\n   * Namespace prefix applied to every key the cache writes. Lets\n   * multiple agents share one driver without collision. Default\n   * `\"ai.cache\"`.\n   */\n  namespace?: string;\n  /**\n   * Middleware name — also the state-bag key prefix inside a single\n   * execution. Default `\"semantic-cache\"`.\n   */\n  name?: string;\n};\n\ntype CachedEntry = {\n  response: ModelResponse;\n  storedAt: number;\n};\n\ntype PendingWrite = {\n  promptKey: string;\n  vector: number[];\n};\n\nconst DEFAULT_NAMESPACE = \"ai.cache\";\n\n/**\n * Build a stable fingerprint for a prompt covering the full message\n * list (system + history + user turn). Ensures two prompts sharing\n * the user text but differing in prior context do not collide on\n * the exact-match fast path.\n *\n * FNV-1a variant — cheap, collision-resistant enough for a cache,\n * dependency-free. NOT a cryptographic hash: collisions would\n * surface as wrong cache hits, not a security issue in the current\n * trust model.\n */\nfunction hashPrompt(messages: ReadonlyArray<Message>): string {\n  const serialized = messages\n    .map((message) => {\n      const role = message.role;\n      const content = Array.isArray(message.content)\n        ? message.content\n            .filter((part) => part.type === \"text\")\n            .map((part) => (part as { text: string }).text)\n            .join(\"|\")\n        : message.content;\n\n      return `${role}:${content}`;\n    })\n    .join(\"||\");\n\n  let hash = 0x811c9dc5;\n\n  for (let index = 0; index < serialized.length; index++) {\n    hash ^= serialized.charCodeAt(index);\n    hash = Math.imul(hash, 0x01000193);\n  }\n\n  return (hash >>> 0).toString(16);\n}\n\nfunction isFresh(entry: CachedEntry, ttlMs: number | undefined): boolean {\n  if (ttlMs === undefined) {\n    return true;\n  }\n\n  return Date.now() - entry.storedAt <= ttlMs;\n}\n\n/**\n * Semantic-similarity response cache for an agent run.\n *\n * **Role.** Skips LLM round-trips when the current prompt is\n * semantically close to one the agent has already answered. For\n * FAQ / support-style traffic this often eliminates 60–80% of\n * model calls — the production win is massive for cost and\n * latency.\n *\n * **Delegation to `@warlock.js/cache`.** This middleware does NOT\n * implement similarity search itself. It delegates to the supplied\n * `CacheDriver`. Production deployments pick a driver with an ANN\n * index (`pg` + pgvector, `redis` + RediSearch). Dev / test\n * environments pass `new MemoryCacheDriver()` — zero config, correct,\n * but O(N) per query. Drivers without similarity support throw\n * `CacheUnsupportedError` from `set({ vector })` / `similar()`.\n *\n * **Two-tier lookup.**\n * 1. *Exact-match key* — a cheap FNV hash over the entire message\n *    list. `store.get(hash)` returns the entry without an embedding\n *    round trip when the prompt hasn't changed at all.\n * 2. *Vector-match* — on exact-match miss, embed the prompt and\n *    call `store.similar(vector, { topK: 1, threshold })`. The\n *    driver uses its native similarity index; anything clearing\n *    `threshold` is returned as a hit.\n *\n * **Write-on-miss.** When both tiers miss, `trip.before` stashes\n * the prompt hash + vector in `ctx.state`; `trip.after` reads back\n * the pending entry and calls\n * `store.set(hash, entry, { vector })`. If an outer middleware\n * (guardrail) throws in `trip.after` before the cache's `trip.after`\n * runs, the pending entry is never written — bad responses stay out\n * of the cache **as long as the canonical install order is followed**\n * (cache outermost).\n *\n * **Synthetic-response on hit.** Returns a `ModelResponse` with\n * `usage: { input: 0, output: 0, total: 0 }` so budget /\n * observability correctly exclude the saved trip.\n *\n * @example\n * import { semanticCache } from \"@warlock.js/ai\";\n * import { MemoryCacheDriver } from \"@warlock.js/cache\";\n *\n * const store = new MemoryCacheDriver();\n * store.setOptions({});\n *\n * const cache = semanticCache({\n *   embedder: openai.embedder({ name: \"text-embedding-3-small\" }),\n *   store,\n *   threshold: 0.95,\n *   ttlMs: 60 * 60 * 1000,\n * });\n *\n * const myAgent = agent({ model, middleware: [cache] });\n */\nexport function semanticCache(options: SemanticCacheOptions): AgentMiddleware {\n  const name = options.name ?? \"semantic-cache\";\n  const namespace = options.namespace ?? DEFAULT_NAMESPACE;\n  const pendingKey = `${name}.pending`;\n\n  // Resolve the effective store at factory time, not per-call. Every\n  // subsequent hook closes over `store` so the resolution happens once.\n  // Throws now (loud, at construction) instead of later during the\n  // first trip (silent until the agent actually runs).\n  const store = options.store ?? resolveDefaultStore();\n\n  if (!store) {\n    throw new Error(\n      `semanticCache: no store supplied — pass \\`store\\` in options or call \\`ai.config({ defaultStore })\\` at app boot before constructing the middleware`,\n    );\n  }\n\n  // Cache's parseKey replaces \":\" with \".\" so the namespace boundary\n  // matches what `similar()` actually returns in `hit.key`. Using a\n  // dot here keeps prefix checks aligned with stored keys.\n  const keyFor = (hash: string): string => `${namespace}.${hash}`;\n\n  return {\n    name,\n    log: true,\n    trip: {\n      async before(context) {\n        // Only cache the first trip's response. Subsequent trips\n        // happen because the previous trip requested tool calls — the\n        // message list now carries tool results the original prompt\n        // never saw, so a semantic match on the unchanged user text\n        // would serve back the prior `tool_calls` response and loop\n        // the agent forever. The first turn is also the only one\n        // where a \"same question → same final answer\" caching story\n        // is sound.\n        if (context.tripIndex !== 0) {\n          return;\n        }\n\n        const promptText = extractUserText(context.messages);\n\n        if (!promptText) {\n          return;\n        }\n\n        const promptKey = hashPrompt(context.messages);\n        const scopedKey = keyFor(promptKey);\n\n        const exact = await store.get<CachedEntry>(scopedKey);\n\n        if (exact && isFresh(exact, options.ttlMs)) {\n          return toSyntheticResponse(exact.response);\n        }\n\n        const query = await options.embedder.embed(promptText);\n\n        const [hit] = await store.similar<CachedEntry>(query.vector, {\n          topK: 1,\n          threshold: options.threshold,\n        });\n\n        if (hit && isFresh(hit.value, options.ttlMs)) {\n          // Only return hits whose stored key is within this cache's\n          // namespace. Drivers shared across namespaces would otherwise\n          // leak foreign entries into queries.\n          if (hit.key.startsWith(`${namespace}.`)) {\n            return toSyntheticResponse(hit.value.response);\n          }\n        }\n\n        const pending: PendingWrite = { promptKey, vector: query.vector };\n        context.state.set(pendingKey, pending);\n\n        return;\n      },\n      async after(context, response) {\n        const pending = context.state.get(pendingKey) as PendingWrite | undefined;\n\n        if (!pending) {\n          return;\n        }\n\n        // Mid-stream tool-call responses must not be cached — the\n        // useful answer comes from the trip *after* the tool returns.\n        // Crucially, leave the pending entry in place so a later trip\n        // (the one that actually finishes with `stop`) can read it\n        // and write the final response under the *original* trip-0\n        // prompt key. Deleting here would orphan the pending and the\n        // post-tool answer would never make it into the store.\n        if (response.finishReason === \"tool_calls\") {\n          return;\n        }\n\n        context.state.delete(pendingKey);\n\n        const entry: CachedEntry = { response, storedAt: Date.now() };\n\n        await store.set(keyFor(pending.promptKey), entry, {\n          vector: pending.vector,\n        });\n\n        return;\n      },\n    },\n  };\n}\n\nfunction toSyntheticResponse(response: ModelResponse): ModelResponse {\n  return {\n    content: response.content,\n    finishReason: response.finishReason,\n    usage: { input: 0, output: 0, total: 0 },\n    toolCalls: response.toolCalls,\n  };\n}\n"],"mappings":";;;;AA8DA,MAAM,oBAAoB;;;;;;;;;;;;AAa1B,SAAS,WAAW,UAA0C;CAC5D,MAAM,aAAa,SAChB,KAAK,YAAY;EAShB,OAAO,GARM,QAAQ,KAQN,GAPC,MAAM,QAAQ,QAAQ,OAAO,IACzC,QAAQ,QACL,QAAQ,SAAS,KAAK,SAAS,MAAM,EACrC,KAAK,SAAU,KAA0B,IAAI,EAC7C,KAAK,GAAG,IACX,QAAQ;CAGd,CAAC,EACA,KAAK,IAAI;CAEZ,IAAI,OAAO;CAEX,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,QAAQ,SAAS;EACtD,QAAQ,WAAW,WAAW,KAAK;EACnC,OAAO,KAAK,KAAK,MAAM,QAAU;CACnC;CAEA,QAAQ,SAAS,GAAG,SAAS,EAAE;AACjC;AAEA,SAAS,QAAQ,OAAoB,OAAoC;CACvE,IAAI,UAAU,QACZ,OAAO;CAGT,OAAO,KAAK,IAAI,IAAI,MAAM,YAAY;AACxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,SAAgB,cAAc,SAAgD;CAC5E,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,aAAa,GAAG,KAAK;CAM3B,MAAM,QAAQ,QAAQ,SAAS,oBAAoB;CAEnD,IAAI,CAAC,OACH,MAAM,IAAI,MACR,qJACF;CAMF,MAAM,UAAU,SAAyB,GAAG,UAAU,GAAG;CAEzD,OAAO;EACL;EACA,KAAK;EACL,MAAM;GACJ,MAAM,OAAO,SAAS;IASpB,IAAI,QAAQ,cAAc,GACxB;IAGF,MAAM,aAAa,gBAAgB,QAAQ,QAAQ;IAEnD,IAAI,CAAC,YACH;IAGF,MAAM,YAAY,WAAW,QAAQ,QAAQ;IAC7C,MAAM,YAAY,OAAO,SAAS;IAElC,MAAM,QAAQ,MAAM,MAAM,IAAiB,SAAS;IAEpD,IAAI,SAAS,QAAQ,OAAO,QAAQ,KAAK,GACvC,OAAO,oBAAoB,MAAM,QAAQ;IAG3C,MAAM,QAAQ,MAAM,QAAQ,SAAS,MAAM,UAAU;IAErD,MAAM,CAAC,OAAO,MAAM,MAAM,QAAqB,MAAM,QAAQ;KAC3D,MAAM;KACN,WAAW,QAAQ;IACrB,CAAC;IAED,IAAI,OAAO,QAAQ,IAAI,OAAO,QAAQ,KAAK,GAIzC;SAAI,IAAI,IAAI,WAAW,GAAG,UAAU,EAAE,GACpC,OAAO,oBAAoB,IAAI,MAAM,QAAQ;IAC/C;IAGF,MAAM,UAAwB;KAAE;KAAW,QAAQ,MAAM;IAAO;IAChE,QAAQ,MAAM,IAAI,YAAY,OAAO;GAGvC;GACA,MAAM,MAAM,SAAS,UAAU;IAC7B,MAAM,UAAU,QAAQ,MAAM,IAAI,UAAU;IAE5C,IAAI,CAAC,SACH;IAUF,IAAI,SAAS,iBAAiB,cAC5B;IAGF,QAAQ,MAAM,OAAO,UAAU;IAE/B,MAAM,QAAqB;KAAE;KAAU,UAAU,KAAK,IAAI;IAAE;IAE5D,MAAM,MAAM,IAAI,OAAO,QAAQ,SAAS,GAAG,OAAO,EAChD,QAAQ,QAAQ,OAClB,CAAC;GAGH;EACF;CACF;AACF;AAEA,SAAS,oBAAoB,UAAwC;CACnE,OAAO;EACL,SAAS,SAAS;EAClB,cAAc,SAAS;EACvB,OAAO;GAAE,OAAO;GAAG,QAAQ;GAAG,OAAO;EAAE;EACvC,WAAW,SAAS;CACtB;AACF"}

package/esm/middleware/helpers/compose.d.mts

@@ -0,0 +1,42 @@
+import { AgentMiddleware } from "../../contracts/middleware/middleware.contract.mjs";
+//#region ../../@warlock.js/ai/src/middleware/helpers/compose.d.ts
+/**
+ * Flatten one or more middleware sources into a single ordered
+ * array suitable for `agent({ middleware: [...] })`.
+ *
+ * **Role.** As middleware catalogs grow, agent configs accumulate
+ * long arrays that mix "always-on" stacks (cache + budget + guardrail)
+ * with per-concern extras (per-tool rate-limits, audit hooks). A
+ * single `compose` call lets callers keep those sources as named
+ * variables and flatten at the registration site.
+ *
+ * **Semantics.** Registration order is preserved across sources —
+ * `compose(a, b, c)` produces `[...a, ...b, ...c]`. Because the
+ * pipeline's onion is strictly registration-ordered, the flattened
+ * order is the execution order. No de-duplication, no sorting, no
+ * priority logic — that would hide bugs, not fix them.
+ *
+ * **Accepts arrays OR individual middlewares.** Both forms are
+ * common in callsite code; the helper flattens either.
+ *
+ * @example
+ * const standardStack = [
+ *   ai.middleware.semanticCache({ ... }),
+ *   ai.middleware.budget({ maxTokens: 20_000 }),
+ *   ai.middleware.guardrail({ ... }),
+ * ];
+ *
+ * const toolRateLimits = [
+ *   toolRateLimit({ tool: "search_web", maxCalls: 3 }),
+ *   toolRateLimit({ tool: "expensive_api", maxCalls: 1 }),
+ * ];
+ *
+ * const myAgent = ai.agent({
+ *   model,
+ *   middleware: ai.middleware.compose(standardStack, toolRateLimits, auditMiddleware),
+ * });
+ */
+declare function composeMiddleware(...sources: ReadonlyArray<AgentMiddleware | ReadonlyArray<AgentMiddleware>>): AgentMiddleware[];
+//#endregion
+export { composeMiddleware };
+//# sourceMappingURL=compose.d.mts.map

package/esm/middleware/helpers/compose.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.mts","names":[],"sources":["../../../../../../../@warlock.js/ai/src/middleware/helpers/compose.ts"],"mappings":";;;;;AAsCA;;;;;;;;;;;;;;;;;AAEkB;;;;;;;;;;;;;;;;iBAFF,iBAAA,CAAA,GACX,OAAA,EAAS,aAAA,CAAc,eAAA,GAAkB,aAAA,CAAc,eAAA,KACzD,eAAA"}