agentfootprint 7.17.0 → 7.19.0

package/dist/esm/core/agent/middleware/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * middleware — PUBLIC barrel. The governance chain family.
+ *
+ * Two chains, one vocabulary:
+ *
+ *   `.toolMiddleware(...)`     wraps every tool dispatch
+ *   `.messageMiddleware(...)`  wraps the message boundary — the input
+ *                              before the model sees it, the output before
+ *                              the caller receives it
+ *
+ * Three verbs: `allow`, `deny`, `ask`. There is no fourth, and in
+ * particular there is no way to return a result — see `types.ts`.
+ */
+export { allow, ask, deny } from './outcomes.js';
+export { MessageDeniedError, type MessageDeniedContext } from './errors.js';
+export type { AllowOutcome, AskOutcome, AskPayload, DenyOutcome, MessageMiddleware, MessageMiddlewareContext, MessageOutcome, MiddlewareDecision, ToolMiddleware, ToolMiddlewareContext, ToolOutcome, } from './types.js';

package/dist/esm/core/agent/middleware/index.js

@@ -0,0 +1,16 @@
+/**
+ * middleware — PUBLIC barrel. The governance chain family.
+ *
+ * Two chains, one vocabulary:
+ *
+ *   `.toolMiddleware(...)`     wraps every tool dispatch
+ *   `.messageMiddleware(...)`  wraps the message boundary — the input
+ *                              before the model sees it, the output before
+ *                              the caller receives it
+ *
+ * Three verbs: `allow`, `deny`, `ask`. There is no fourth, and in
+ * particular there is no way to return a result — see `types.ts`.
+ */
+export { allow, ask, deny } from './outcomes.js';
+export { MessageDeniedError } from './errors.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/core/agent/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/core/agent/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAA6B,MAAM,aAAa,CAAC"}

package/dist/esm/core/agent/middleware/ledger.d.ts

@@ -0,0 +1,40 @@
+/**
+ * middleware/ledger — INTERNAL. Where a chain's decisions become record.
+ *
+ * Pattern: one writer for one committed key.
+ * Role:    core/ layer. `runChain` decides; this file is the only thing
+ *          that commits what it decided and emits the matching event, so
+ *          the three call sites cannot record the same fact three
+ *          different ways.
+ * Emits:   `agentfootprint.middleware.decision`, one per row.
+ *
+ * ## Why the original value is committed too
+ *
+ * A transform makes the trace and the wire disagree — the model saw one
+ * string, the run remembers another. Committing the pair, with the
+ * middleware's name and its `why` beside it, is what turns that
+ * disagreement from a lie into a record. Every slice taken afterwards can
+ * then find the moment the value changed and who changed it.
+ *
+ * This is not a redaction layer, and it is not trying to be one. For the
+ * `'input'` phase in particular, the ledger row is the ONLY copy of the
+ * pre-scrub text anywhere in the run — the seed stage commits the
+ * transformed message and nothing else ever holds the original. If your
+ * threat model says the original must not survive in the commit log,
+ * configure footprintjs redaction over this key; it scrubs `before` /
+ * `after` at write time and the row itself survives, so the run still says
+ * a scrub happened and who did it.
+ */
+import type { MiddlewareDecision } from './types.js';
+/** The scope surface this file needs. Structurally a `TypedScope<AgentState>`. */
+export interface LedgerScope {
+    middlewareDecisions?: readonly MiddlewareDecision[];
+    $emit(name: string, payload?: unknown): void;
+}
+/**
+ * Append decision rows to the run's ledger and emit one event per row.
+ *
+ * No-op on an empty list, so an agent with no middleware never writes the
+ * key at all and its commit log is the one it always had.
+ */
+export declare function recordDecisions(scope: LedgerScope, rows: readonly MiddlewareDecision[]): void;

package/dist/esm/core/agent/middleware/ledger.js

@@ -0,0 +1,57 @@
+/**
+ * middleware/ledger — INTERNAL. Where a chain's decisions become record.
+ *
+ * Pattern: one writer for one committed key.
+ * Role:    core/ layer. `runChain` decides; this file is the only thing
+ *          that commits what it decided and emits the matching event, so
+ *          the three call sites cannot record the same fact three
+ *          different ways.
+ * Emits:   `agentfootprint.middleware.decision`, one per row.
+ *
+ * ## Why the original value is committed too
+ *
+ * A transform makes the trace and the wire disagree — the model saw one
+ * string, the run remembers another. Committing the pair, with the
+ * middleware's name and its `why` beside it, is what turns that
+ * disagreement from a lie into a record. Every slice taken afterwards can
+ * then find the moment the value changed and who changed it.
+ *
+ * This is not a redaction layer, and it is not trying to be one. For the
+ * `'input'` phase in particular, the ledger row is the ONLY copy of the
+ * pre-scrub text anywhere in the run — the seed stage commits the
+ * transformed message and nothing else ever holds the original. If your
+ * threat model says the original must not survive in the commit log,
+ * configure footprintjs redaction over this key; it scrubs `before` /
+ * `after` at write time and the row itself survives, so the run still says
+ * a scrub happened and who did it.
+ */
+import { typedEmit } from '../../../recorders/core/typedEmit.js';
+/**
+ * Append decision rows to the run's ledger and emit one event per row.
+ *
+ * No-op on an empty list, so an agent with no middleware never writes the
+ * key at all and its commit log is the one it always had.
+ */
+export function recordDecisions(scope, rows) {
+    if (rows.length === 0)
+        return;
+    const prev = scope.middlewareDecisions ?? [];
+    // Spread into a plain local array first: a TypedScope array read is a live
+    // deep-proxy view, and both the commit and the event payloads below must be
+    // detached plain data (RFC-001 'clone' capture under deferred delivery).
+    scope.middlewareDecisions = [...prev, ...rows];
+    for (const row of rows) {
+        typedEmit(scope, 'agentfootprint.middleware.decision', {
+            middleware: row.middleware,
+            at: row.at,
+            ...(row.phase !== undefined && { phase: row.phase }),
+            ...(row.toolName !== undefined && { toolName: row.toolName }),
+            ...(row.toolCallId !== undefined && { toolCallId: row.toolCallId }),
+            iteration: row.iteration,
+            outcome: row.outcome,
+            changed: row.changed,
+            ...(row.why !== undefined && { why: row.why }),
+        });
+    }
+}
+//# sourceMappingURL=ledger.js.map

package/dist/esm/core/agent/middleware/ledger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../../../../src/core/agent/middleware/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AASjE;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB,EAAE,IAAmC;IACrF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,MAAM,IAAI,GAAI,KAAK,CAAC,mBAAiE,IAAI,EAAE,CAAC;IAC5F,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,KAAK,CAAC,mBAAmB,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,SAAS,CAAC,KAAK,EAAE,oCAAoC,EAAE;YACrD,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7D,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YACnE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/esm/core/agent/middleware/outcomes.d.ts

@@ -0,0 +1,45 @@
+/**
+ * middleware/outcomes — PUBLIC. The three verbs a middleware speaks.
+ *
+ * Pattern: Smart constructors over a closed union.
+ * Role:    core/ layer. `allow` / `deny` / `ask` are the entire vocabulary
+ *          of both chains, which is why they are short: they are written
+ *          inside every middleware body, several times, and a governance
+ *          rule reads better as `deny('writes to prod need a ticket')` than
+ *          as a namespaced ceremony.
+ * Emits:   N/A.
+ *
+ * The `allow` overloads carry a rule: you can pass the value through
+ * untouched with no explanation, but you cannot CHANGE it without one. A
+ * transform is the only thing here that makes the trace and the wire
+ * disagree, so it is the only thing required to say why.
+ */
+import type { AllowOutcome, AskOutcome, AskPayload, DenyOutcome } from './types.js';
+/** Pass the value through untouched. */
+export declare function allow(): AllowOutcome<never>;
+/**
+ * Replace the value and say why.
+ *
+ * The `why` is mandatory and lands in the ledger next to the before/after
+ * pair, so a run that was scrubbed can be read back as a run that was
+ * scrubbed rather than as a run whose input was always that way.
+ */
+export declare function allow<T>(value: T, why: string): AllowOutcome<T>;
+/**
+ * Refuse the call.
+ *
+ * For a tool the reason reaches the model verbatim, as the tool's result,
+ * and the loop continues — the agent gets to adapt. For a message it
+ * surfaces as a `MessageDeniedError`.
+ */
+export declare function deny(reason: string): DenyOutcome;
+/**
+ * Suspend the run and put the question to a person. Tool dispatch only —
+ * `MessageOutcome` has no `ask` arm, so this cannot be returned from a
+ * message middleware.
+ *
+ * The answer is a decision, not a result: approve and the chain continues
+ * and the REAL tool runs; decline and it becomes a denial the model reads.
+ * A middleware never gets to write the answer itself.
+ */
+export declare function ask(payload: AskPayload): AskOutcome;

package/dist/esm/core/agent/middleware/outcomes.js

@@ -0,0 +1,60 @@
+/**
+ * middleware/outcomes — PUBLIC. The three verbs a middleware speaks.
+ *
+ * Pattern: Smart constructors over a closed union.
+ * Role:    core/ layer. `allow` / `deny` / `ask` are the entire vocabulary
+ *          of both chains, which is why they are short: they are written
+ *          inside every middleware body, several times, and a governance
+ *          rule reads better as `deny('writes to prod need a ticket')` than
+ *          as a namespaced ceremony.
+ * Emits:   N/A.
+ *
+ * The `allow` overloads carry a rule: you can pass the value through
+ * untouched with no explanation, but you cannot CHANGE it without one. A
+ * transform is the only thing here that makes the trace and the wire
+ * disagree, so it is the only thing required to say why.
+ */
+export function allow(value, why) {
+    if (value === undefined)
+        return { kind: 'allow' };
+    if (typeof why !== 'string' || why.length === 0) {
+        throw new Error('allow(value, why): a transform must say why. Pass a short reason — it is what the ' +
+            'ledger shows next to the before/after pair. To pass the value through unchanged, ' +
+            'call allow() with no arguments.');
+    }
+    return { kind: 'allow', value, why };
+}
+/**
+ * Refuse the call.
+ *
+ * For a tool the reason reaches the model verbatim, as the tool's result,
+ * and the loop continues — the agent gets to adapt. For a message it
+ * surfaces as a `MessageDeniedError`.
+ */
+export function deny(reason) {
+    if (typeof reason !== 'string' || reason.length === 0) {
+        throw new Error('deny(reason): a refusal must carry a reason. For a tool it is the text the model ' +
+            'reads and adapts to, so write it for the model, not for a log line.');
+    }
+    return { kind: 'deny', reason };
+}
+/**
+ * Suspend the run and put the question to a person. Tool dispatch only —
+ * `MessageOutcome` has no `ask` arm, so this cannot be returned from a
+ * message middleware.
+ *
+ * The answer is a decision, not a result: approve and the chain continues
+ * and the REAL tool runs; decline and it becomes a denial the model reads.
+ * A middleware never gets to write the answer itself.
+ */
+export function ask(payload) {
+    if (payload === null ||
+        typeof payload !== 'object' ||
+        typeof payload.question !== 'string' ||
+        payload.question.length === 0) {
+        throw new Error('ask(payload): expected { question, detail? } with a non-empty question. The question ' +
+            'is what a person is shown when the run pauses.');
+    }
+    return { kind: 'ask', payload };
+}
+//# sourceMappingURL=outcomes.js.map

package/dist/esm/core/agent/middleware/outcomes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcomes.js","sourceRoot":"","sources":["../../../../../src/core/agent/middleware/outcomes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAcH,MAAM,UAAU,KAAK,CAAI,KAAS,EAAE,GAAY;IAC9C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,oFAAoF;YAClF,mFAAmF;YACnF,iCAAiC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,IAAI,CAAC,MAAc;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,qEAAqE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,CAAC,OAAmB;IACrC,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,uFAAuF;YACrF,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC"}

package/dist/esm/core/agent/middleware/runChain.d.ts

@@ -0,0 +1,104 @@
+/**
+ * middleware/runChain — INTERNAL. The one place a chain is walked.
+ *
+ * Pattern: Chain of Responsibility driver.
+ * Role:    core/ layer. Both stages (tool dispatch, message boundary) and
+ *          the MCP server call in here, so the ordering law, the
+ *          throw-is-a-denial law and the ledger row shape are written once
+ *          and cannot drift between the three callers.
+ * Emits:   N/A — it RETURNS rows; the caller commits and emits them, so a
+ *          middleware still never touches scope.
+ *
+ * ## The rules this file implements
+ *
+ * **Order is declaration order.** The chain is walked front to back, and
+ * each link is handed the previous link's output — so a scrubber placed
+ * first is a scrubber every later rule sees the effect of.
+ *
+ * **The first non-allow answer wins.** A deny or an ask stops the walk;
+ * the links behind it do not run. There is no "second opinion" pass,
+ * because a refusal that a later middleware could overturn is not a
+ * refusal.
+ *
+ * **A middleware that throws is a denial, never a pass.** The thrown
+ * message becomes the reason. This is the same deny-by-default the
+ * permission gate has always applied to a checker that throws: a
+ * governance layer whose failure mode is "allow" is not a governance
+ * layer.
+ */
+import type { LLMMessage } from '../../../adapters/types.js';
+import type { MemoryIdentity } from '../../../memory/identity/types.js';
+import type { AskPayload, MessageMiddleware, MiddlewareDecision, ToolMiddleware } from './types.js';
+/** Tool args, as they travel the chain. */
+export type ToolArgs = Readonly<Record<string, unknown>>;
+/**
+ * What to do when a middleware answers `ask` somewhere that cannot pause.
+ *
+ * `'pause'` — the caller will checkpoint (the normal dispatch path).
+ * `'refuse'` — the ask is converted into a deny naming the middleware. Used
+ * on the resume path (footprintjs's `PausableHandler.resume` returns void,
+ * so a resumed dispatch cannot suspend a second time) and by `mcpServe`
+ * (MCP is request/response — there is no pause to carry the ask).
+ */
+export type AskPolicy = 'pause' | 'refuse';
+export type ToolChainResult = {
+    readonly kind: 'allow';
+    readonly args: ToolArgs;
+    readonly decisions: MiddlewareDecision[];
+} | {
+    readonly kind: 'deny';
+    readonly reason: string;
+    readonly middleware: string;
+    readonly args: ToolArgs;
+    readonly decisions: MiddlewareDecision[];
+} | {
+    readonly kind: 'ask';
+    readonly payload: AskPayload;
+    readonly middleware: string;
+    /** Index of the link that asked — resume continues from `index + 1`. */
+    readonly index: number;
+    /** Args as transformed up to the ask. These ride the checkpoint. */
+    readonly args: ToolArgs;
+    readonly decisions: MiddlewareDecision[];
+};
+export interface ToolChainInput {
+    readonly toolName: string;
+    readonly toolCallId: string;
+    readonly iteration: number;
+    readonly args: ToolArgs;
+    readonly history: readonly LLMMessage[];
+    readonly identity?: MemoryIdentity;
+    readonly signal?: AbortSignal;
+    /**
+     * Where to start walking. `0` for a fresh dispatch; `n` on resume, to
+     * continue the chain AFTER the link that asked without re-running the
+     * links whose decisions the checkpoint already carries.
+     */
+    readonly startIndex?: number;
+    readonly askPolicy?: AskPolicy;
+}
+/** Walk the tool chain. Never throws — a throwing link becomes a denial. */
+export declare function runToolChain(chain: readonly ToolMiddleware[], input: ToolChainInput): Promise<ToolChainResult>;
+export type MessageChainResult = {
+    readonly kind: 'allow';
+    readonly content: string;
+    readonly decisions: MiddlewareDecision[];
+} | {
+    readonly kind: 'deny';
+    readonly reason: string;
+    readonly middleware: string;
+    /** Content as transformed by the links BEFORE the refusal. */
+    readonly content: string;
+    readonly decisions: MiddlewareDecision[];
+};
+export interface MessageChainInput {
+    readonly phase: 'input' | 'output';
+    readonly content: string;
+    readonly history: readonly LLMMessage[];
+    /** ReAct iteration for the ledger row. `0` at `'input'` (before iter 1). */
+    readonly iteration: number;
+    readonly identity?: MemoryIdentity;
+    readonly signal?: AbortSignal;
+}
+/** Walk the message chain. Never throws — a throwing link becomes a denial. */
+export declare function runMessageChain(chain: readonly MessageMiddleware[], input: MessageChainInput): Promise<MessageChainResult>;

package/dist/esm/core/agent/middleware/runChain.js

@@ -0,0 +1,139 @@
+/**
+ * middleware/runChain — INTERNAL. The one place a chain is walked.
+ *
+ * Pattern: Chain of Responsibility driver.
+ * Role:    core/ layer. Both stages (tool dispatch, message boundary) and
+ *          the MCP server call in here, so the ordering law, the
+ *          throw-is-a-denial law and the ledger row shape are written once
+ *          and cannot drift between the three callers.
+ * Emits:   N/A — it RETURNS rows; the caller commits and emits them, so a
+ *          middleware still never touches scope.
+ *
+ * ## The rules this file implements
+ *
+ * **Order is declaration order.** The chain is walked front to back, and
+ * each link is handed the previous link's output — so a scrubber placed
+ * first is a scrubber every later rule sees the effect of.
+ *
+ * **The first non-allow answer wins.** A deny or an ask stops the walk;
+ * the links behind it do not run. There is no "second opinion" pass,
+ * because a refusal that a later middleware could overturn is not a
+ * refusal.
+ *
+ * **A middleware that throws is a denial, never a pass.** The thrown
+ * message becomes the reason. This is the same deny-by-default the
+ * permission gate has always applied to a checker that throws: a
+ * governance layer whose failure mode is "allow" is not a governance
+ * layer.
+ */
+/** Walk the tool chain. Never throws — a throwing link becomes a denial. */
+export async function runToolChain(chain, input) {
+    const decisions = [];
+    const askPolicy = input.askPolicy ?? 'pause';
+    let args = input.args;
+    for (let i = input.startIndex ?? 0; i < chain.length; i++) {
+        const mw = chain[i];
+        const row = (extra) => ({
+            middleware: mw.name,
+            at: 'tool',
+            toolName: input.toolName,
+            toolCallId: input.toolCallId,
+            iteration: input.iteration,
+            outcome: 'allow',
+            changed: false,
+            ...extra,
+        });
+        let outcome;
+        try {
+            outcome = await mw.onToolCall({
+                toolName: input.toolName,
+                toolCallId: input.toolCallId,
+                iteration: input.iteration,
+                args,
+                history: input.history,
+                ...(input.identity && { identity: input.identity }),
+                ...(input.signal && { signal: input.signal }),
+            });
+        }
+        catch (err) {
+            const reason = `middleware '${mw.name}' threw: ${err instanceof Error ? err.message : String(err)}`;
+            decisions.push(row({ outcome: 'deny', why: reason }));
+            return { kind: 'deny', reason, middleware: mw.name, args, decisions };
+        }
+        if (outcome.kind === 'deny') {
+            decisions.push(row({ outcome: 'deny', why: outcome.reason }));
+            return { kind: 'deny', reason: outcome.reason, middleware: mw.name, args, decisions };
+        }
+        if (outcome.kind === 'ask') {
+            if (askPolicy === 'refuse') {
+                const reason = `middleware '${mw.name}' asked a person to decide, and there is no pause here to ` +
+                    `carry that ask: ${outcome.payload.question}`;
+                decisions.push(row({ outcome: 'deny', why: reason }));
+                return { kind: 'deny', reason, middleware: mw.name, args, decisions };
+            }
+            decisions.push(row({ outcome: 'ask', why: outcome.payload.question }));
+            return {
+                kind: 'ask',
+                payload: outcome.payload,
+                middleware: mw.name,
+                index: i,
+                args,
+                decisions,
+            };
+        }
+        if (outcome.value !== undefined) {
+            const before = args;
+            args = outcome.value;
+            decisions.push(row({ changed: true, ...(outcome.why && { why: outcome.why }), before, after: args }));
+        }
+        else {
+            decisions.push(row({}));
+        }
+    }
+    return { kind: 'allow', args, decisions };
+}
+/** Walk the message chain. Never throws — a throwing link becomes a denial. */
+export async function runMessageChain(chain, input) {
+    const decisions = [];
+    let content = input.content;
+    for (const mw of chain) {
+        const row = (extra) => ({
+            middleware: mw.name,
+            at: 'message',
+            phase: input.phase,
+            iteration: input.iteration,
+            outcome: 'allow',
+            changed: false,
+            ...extra,
+        });
+        let outcome;
+        try {
+            outcome = await mw.onMessage({
+                phase: input.phase,
+                content,
+                history: input.history,
+                ...(input.identity && { identity: input.identity }),
+                ...(input.signal && { signal: input.signal }),
+            });
+        }
+        catch (err) {
+            const reason = `middleware '${mw.name}' threw: ${err instanceof Error ? err.message : String(err)}`;
+            decisions.push(row({ outcome: 'deny', why: reason }));
+            return { kind: 'deny', reason, middleware: mw.name, content, decisions };
+        }
+        if (outcome.kind === 'deny') {
+            decisions.push(row({ outcome: 'deny', why: outcome.reason }));
+            return { kind: 'deny', reason: outcome.reason, middleware: mw.name, content, decisions };
+        }
+        if (outcome.value !== undefined) {
+            const before = content;
+            content = outcome.value;
+            decisions.push(row({ changed: true, ...(outcome.why && { why: outcome.why }), before, after: content }));
+        }
+        else {
+            decisions.push(row({}));
+        }
+    }
+    return { kind: 'allow', content, decisions };
+}
+//# sourceMappingURL=runChain.js.map

package/dist/esm/core/agent/middleware/runChain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runChain.js","sourceRoot":"","sources":["../../../../../src/core/agent/middleware/runChain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAgEH,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAgC,EAChC,KAAqB;IAErB,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC;IAC7C,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAEtB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAsB,EAAE,CAAC,CAAC;YACvE,UAAU,EAAE,EAAE,CAAC,IAAI;YACnB,EAAE,EAAE,MAAM;YACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,KAAK;YACd,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI;gBACJ,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,YACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxF,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,MAAM,GACV,eAAe,EAAE,CAAC,IAAI,4DAA4D;oBAClF,mBAAmB,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAChD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACxE,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,EAAE,CAAC,IAAI;gBACnB,KAAK,EAAE,CAAC;gBACR,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC;YACpB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;YACrB,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CACtF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAyBD,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAmC,EACnC,KAAwB;IAExB,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAsB,EAAE,CAAC,CAAC;YACvE,UAAU,EAAE,EAAE,CAAC,IAAI;YACnB,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,KAAK;YACd,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,YACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3F,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC;YACvB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;YACxB,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CACzF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC/C,CAAC"}