@agent-assembly/sdk 0.0.1-alpha.3

package/dist/cjs/runtime.js

@@ -0,0 +1,144 @@
+"use strict";
+/**
+ * Runtime auto-detection and lifecycle management for the `aasm` sidecar
+ * (F115 / AAASM-1205).
+ *
+ * The `initAssembly()` exported here is intentionally NOT re-exported from
+ * `@agent-assembly/sdk` at the top level: the existing gateway-based
+ * `initAssembly(config)` keeps its meaning. Opt in to the runtime-managed
+ * flow with `import { initAssembly } from "@agent-assembly/sdk/runtime"`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INSTALL_HINT = exports.RUNTIME_SUBPACKAGE = exports.RUNTIME_LOG_FILENAME = exports.DOCKER_BASE_BIN = exports.USER_LOCAL_BIN = exports.DEFAULT_RUNTIME_HOST = exports.DEFAULT_PORT = exports.BINARY_NAME = void 0;
+exports.findAasmBinary = findAasmBinary;
+exports.isRunning = isRunning;
+exports.startRuntime = startRuntime;
+exports.initAssembly = initAssembly;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_module_1 = require("node:module");
+const node_net_1 = require("node:net");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_process_1 = require("node:process");
+exports.BINARY_NAME = "aasm";
+exports.DEFAULT_PORT = 7878;
+exports.DEFAULT_RUNTIME_HOST = "127.0.0.1";
+exports.USER_LOCAL_BIN = (0, node_path_1.join)((0, node_os_1.homedir)(), ".local", "bin");
+exports.DOCKER_BASE_BIN = "/usr/local/bin";
+exports.RUNTIME_LOG_FILENAME = ".aasm-runtime.log";
+/** npm sub-package name for the bundled platform binary (esbuild pattern). */
+exports.RUNTIME_SUBPACKAGE = `runtime-${(0, node_os_1.platform)()}-${(0, node_os_1.arch)()}`;
+exports.INSTALL_HINT = [
+    "agent-assembly runtime not found.",
+    "  Install with: pnpm add agent-assembly",
+    "  Or manually:  brew install agent-assembly/tap/aasm",
+    "               curl -fsSL https://get.agent-assembly.io | sh",
+].join("\n");
+/**
+ * Path to the platform-specific `aasm` binary bundled as an optional npm
+ * dependency, or `null` when the consumer hasn't installed that platform's
+ * `@agent-assembly/runtime-{platform}-{arch}` sub-package.
+ *
+ * Uses `createRequire(<cwd>/package.json)` — the same pattern used by
+ * `src/native/client.ts` and the framework-detection modules — so this
+ * module compiles cleanly under both the ESM and CJS build targets
+ * (`import.meta.url` is ESM-only and breaks `tsconfig.cjs.json`).
+ */
+function bundledRuntimeBinaryPath() {
+    try {
+        const requireFromCwd = (0, node_module_1.createRequire)(`${(0, node_process_1.cwd)()}/package.json`);
+        const pkgJson = requireFromCwd.resolve(`@agent-assembly/${exports.RUNTIME_SUBPACKAGE}/package.json`);
+        return (0, node_path_1.join)((0, node_path_1.dirname)(pkgJson), "bin", exports.BINARY_NAME);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Locate the `aasm` binary across the 4 supported install paths.
+ *
+ * Search order: `$PATH` (Homebrew, cargo install) → `~/.local/bin/aasm`
+ * (curl installer) → `node_modules/@agent-assembly/runtime-{platform}-{arch}/bin/aasm`
+ * (npm optionalDependency) → `/usr/local/bin/aasm` (Docker base image).
+ * Returns the first existing match, or `null` when none exist.
+ */
+function findAasmBinary() {
+    for (const dir of (node_process_1.env.PATH ?? "").split(node_path_1.delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = (0, node_path_1.join)(dir, exports.BINARY_NAME);
+        if ((0, node_fs_1.existsSync)(candidate))
+            return candidate;
+    }
+    const userLocal = (0, node_path_1.join)(exports.USER_LOCAL_BIN, exports.BINARY_NAME);
+    if ((0, node_fs_1.existsSync)(userLocal))
+        return userLocal;
+    const bundled = bundledRuntimeBinaryPath();
+    if (bundled !== null && (0, node_fs_1.existsSync)(bundled))
+        return bundled;
+    const docker = (0, node_path_1.join)(exports.DOCKER_BASE_BIN, exports.BINARY_NAME);
+    if ((0, node_fs_1.existsSync)(docker))
+        return docker;
+    return null;
+}
+/**
+ * Resolve to `true` iff a local TCP listener accepts a connect on
+ * `host:port` within 100 ms. Any socket error (refused, timeout,
+ * unreachable) resolves to `false` and is treated as no sidecar.
+ */
+function isRunning(port = exports.DEFAULT_PORT, host = exports.DEFAULT_RUNTIME_HOST) {
+    return new Promise((resolveResult) => {
+        const socket = (0, node_net_1.createConnection)({ port, host, timeout: 100 });
+        const settle = (value) => {
+            socket.removeAllListeners();
+            socket.destroy();
+            resolveResult(value);
+        };
+        socket.once("connect", () => settle(true));
+        socket.once("timeout", () => settle(false));
+        socket.once("error", () => settle(false));
+    });
+}
+/**
+ * Spawn `aasm serve --port <port>` as a detached background subprocess.
+ *
+ * Stdout/stderr are appended to `<logDir>/.aasm-runtime.log` (default
+ * `process.cwd()`) so the sidecar outlives the parent. `detached: true`
+ * + `child.unref()` releases the event loop so the Node process can
+ * exit independently of the sidecar.
+ */
+function startRuntime(binaryPath, port = exports.DEFAULT_PORT, logDir = (0, node_process_1.cwd)()) {
+    const logPath = (0, node_path_1.join)(logDir, exports.RUNTIME_LOG_FILENAME);
+    const fd = (0, node_fs_1.openSync)(logPath, "a");
+    const child = (0, node_child_process_1.spawn)(binaryPath, ["serve", "--port", String(port)], {
+        detached: true,
+        stdio: ["ignore", fd, fd],
+    });
+    child.unref();
+    return child;
+}
+/**
+ * Ensure the local `aasm` sidecar is running, starting it if necessary.
+ *
+ * Lifecycle per F115 / AAASM-1205:
+ *  1. Probe `host:port` via {@link isRunning}; return early if already up.
+ *  2. Resolve the binary via {@link findAasmBinary}.
+ *  3. Spawn the sidecar via {@link startRuntime}.
+ *
+ * `agentId` is accepted to keep the ticket-specified signature stable;
+ * actual register-and-connect is performed by the existing gateway-aware
+ * `@agent-assembly/sdk` `initAssembly` once the sidecar is reachable.
+ *
+ * Throws `Error` with {@link INSTALL_HINT} when no binary is found.
+ */
+async function initAssembly(agentId, port = exports.DEFAULT_PORT) {
+    void agentId; // not consumed at the lifecycle layer; see jsdoc
+    if (await isRunning(port))
+        return;
+    const binary = findAasmBinary();
+    if (binary === null) {
+        throw new Error(exports.INSTALL_HINT);
+    }
+    startRuntime(binary, port);
+}

package/dist/cjs/types/assembly-config.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/assembly-context.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/assembly-mode.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/audit.js

@@ -0,0 +1,5 @@
+"use strict";
+// Mirrors the wire-protocol shape of `assembly.audit.v1.AuditEvent` +
+// `assembly.audit.v1.CallStackNode` as of agent-assembly commit
+// `ed4aa11a8c1d1ce1e6f96b08cf2179fd772099b2` (AAASM-1419 / PR #467).
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/enforcement-mode.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENFORCEMENT_MODES = void 0;
+/**
+ * Runtime-checkable list of valid {@link EnforcementMode} values, used by
+ * `initAssembly` to reject unknown strings from callers who bypass the
+ * TypeScript type system (plain JS, JSON config, dynamic input).
+ */
+exports.ENFORCEMENT_MODES = ["enforce", "observe", "disabled"];

package/dist/cjs/types/gateway-governance.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENFORCEMENT_MODES = void 0;
+var enforcement_mode_js_1 = require("./enforcement-mode.js");
+Object.defineProperty(exports, "ENFORCEMENT_MODES", { enumerable: true, get: function () { return enforcement_mode_js_1.ENFORCEMENT_MODES; } });

package/dist/cjs/types/langchain-adapter.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/openai-agents-adapter.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/policy.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/tool-map.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/vercel-ai-adapter.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/wrappers/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withAssembly = void 0;
+var with_assembly_js_1 = require("./with-assembly.js");
+Object.defineProperty(exports, "withAssembly", { enumerable: true, get: function () { return with_assembly_js_1.withAssembly; } });

package/dist/cjs/wrappers/with-assembly.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withAssembly = withAssembly;
+const node_crypto_1 = require("node:crypto");
+const policy_violation_error_js_1 = require("../errors/policy-violation-error.js");
+const DEFAULT_APPROVAL_TIMEOUT_MS = 30_000;
+async function waitForApprovalWithTimeout(gateway, toolName, runId, timeoutMs) {
+    let timeoutId;
+    const timeoutPromise = new Promise((resolve) => {
+        timeoutId = setTimeout(() => {
+            resolve({ denied: true, reason: `Approval timeout after ${timeoutMs}ms` });
+        }, timeoutMs);
+    });
+    try {
+        const approvalPromise = gateway.waitForApproval(toolName, runId, timeoutMs);
+        return await Promise.race([approvalPromise, timeoutPromise]);
+    }
+    finally {
+        if (timeoutId) {
+            clearTimeout(timeoutId);
+        }
+    }
+}
+function hasExecute(tool) {
+    return typeof tool.execute === "function";
+}
+function hasInvoke(tool) {
+    return typeof tool.invoke === "function";
+}
+function wrapSingleTool(name, tool, gateway, options) {
+    const approvalTimeoutMs = options.approvalTimeoutMs ?? DEFAULT_APPROVAL_TIMEOUT_MS;
+    if (hasExecute(tool)) {
+        const originalExecute = tool.execute;
+        tool.execute = async (...args) => {
+            const runId = `run_${(0, node_crypto_1.randomUUID)()}`;
+            const decision = await gateway.check({
+                action: "tool_call",
+                toolName: name,
+                args,
+                runId
+            });
+            if (decision.denied) {
+                throw new policy_violation_error_js_1.PolicyViolationError(`Tool '${name}' blocked: ${decision.reason ?? "Denied"}`);
+            }
+            if (decision.pending) {
+                const finalDecision = await waitForApprovalWithTimeout(gateway, name, runId, approvalTimeoutMs);
+                if (finalDecision.denied) {
+                    throw new policy_violation_error_js_1.PolicyViolationError(`Approval rejected for '${name}': ${finalDecision.reason ?? "Rejected"}`);
+                }
+            }
+            return originalExecute(...args);
+        };
+    }
+    else if (hasInvoke(tool)) {
+        const originalInvoke = tool.invoke;
+        tool.invoke = async (...args) => {
+            const runId = `run_${(0, node_crypto_1.randomUUID)()}`;
+            const decision = await gateway.check({
+                action: "tool_call",
+                toolName: name,
+                args,
+                runId
+            });
+            if (decision.denied) {
+                throw new policy_violation_error_js_1.PolicyViolationError(`Tool '${name}' blocked: ${decision.reason ?? "Denied"}`);
+            }
+            if (decision.pending) {
+                const finalDecision = await waitForApprovalWithTimeout(gateway, name, runId, approvalTimeoutMs);
+                if (finalDecision.denied) {
+                    throw new policy_violation_error_js_1.PolicyViolationError(`Approval rejected for '${name}': ${finalDecision.reason ?? "Rejected"}`);
+                }
+            }
+            return originalInvoke(...args);
+        };
+    }
+}
+function withAssembly(tools, options) {
+    for (const [name, tool] of Object.entries(tools)) {
+        wrapSingleTool(name, tool, options.gatewayClient, options);
+    }
+    return tools;
+}

package/dist/esm/adapters/adapter-registry.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapter-registry.js.map

package/dist/esm/adapters/adapter-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-registry.js","sourceRoot":"","sources":["../../../src/adapters/adapter-registry.ts"],"names":[],"mappings":""}

package/dist/esm/adapters/adapter.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapter.js.map

package/dist/esm/adapters/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../src/adapters/adapter.ts"],"names":[],"mappings":""}

package/dist/esm/adapters/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/esm/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/index.ts"],"names":[],"mappings":""}

package/dist/esm/adapters/langchain/assembly-callback-handler.js

@@ -0,0 +1,90 @@
+import { BaseCallbackHandler } from "@langchain/core/callbacks/base";
+const BLOCKED_OUTPUT = "[BLOCKED] This action was flagged as a policy violation.";
+function getSerializedName(value) {
+    if (!value || typeof value !== "object") {
+        return undefined;
+    }
+    const candidate = value.name;
+    return typeof candidate === "string" ? candidate : undefined;
+}
+export class AssemblyCallbackHandler extends BaseCallbackHandler {
+    gateway;
+    now;
+    pendingDenialMaxAgeMs;
+    name = "assembly_handler";
+    pendingDenials = new Map();
+    constructor(gateway, now = () => Date.now(), pendingDenialMaxAgeMs = 5 * 60 * 1000) {
+        super();
+        this.gateway = gateway;
+        this.now = now;
+        this.pendingDenialMaxAgeMs = pendingDenialMaxAgeMs;
+    }
+    async handleToolStart(tool, input, runId) {
+        this.cleanupExpiredPendingDenials();
+        const toolName = tool.name ?? getSerializedName(tool) ?? "unknown_tool";
+        const decision = await this.gateway.check({
+            action: "tool_call",
+            toolName,
+            args: input,
+            runId
+        });
+        await this.gateway.record({
+            action: "tool_start_check",
+            runId,
+            ...(decision.reason ? { reason: decision.reason } : {})
+        });
+        if (decision.denied) {
+            this.pendingDenials.set(runId, {
+                reason: decision.reason ?? "Tool denied by policy.",
+                at: this.now()
+            });
+        }
+    }
+    async handleToolEnd(output, runId) {
+        this.cleanupExpiredPendingDenials();
+        const pending = this.pendingDenials.get(runId);
+        if (pending) {
+            this.pendingDenials.delete(runId);
+            await this.gateway.record({
+                action: "policy_post_block",
+                runId,
+                reason: pending.reason
+            });
+            return BLOCKED_OUTPUT;
+        }
+        await this.gateway.recordResult({ runId, output });
+        return output;
+    }
+    async handleLLMStart(llm, prompts, runId) {
+        this.cleanupExpiredPendingDenials();
+        const modelName = llm.name ?? getSerializedName(llm);
+        await this.gateway.scanPrompts({
+            prompts,
+            runId,
+            ...(modelName ? { modelName } : {})
+        });
+    }
+    async handleLLMEnd(output, runId) {
+        this.cleanupExpiredPendingDenials();
+        await this.gateway.record({
+            action: "llm_response",
+            runId,
+            output
+        });
+    }
+    cleanupExpiredPendingDenials(now = this.now()) {
+        let removed = 0;
+        for (const [runId, denial] of this.pendingDenials.entries()) {
+            if (now - denial.at >= this.pendingDenialMaxAgeMs) {
+                this.pendingDenials.delete(runId);
+                removed += 1;
+            }
+        }
+        return removed;
+    }
+    // Exposed for deterministic unit testing around cleanup behavior.
+    getPendingDenialCount() {
+        return this.pendingDenials.size;
+    }
+}
+//# sourceMappingURL=assembly-callback-handler.js.map

package/dist/esm/adapters/langchain/assembly-callback-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assembly-callback-handler.js","sourceRoot":"","sources":["../../../../src/adapters/langchain/assembly-callback-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,MAAM,cAAc,GAAG,0DAA0D,CAAC;AAElF,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAI,KAA4B,CAAC,IAAI,CAAC;IACrD,OAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAK3C;IACA;IACA;IANV,IAAI,GAAG,kBAAkB,CAAC;IAClB,cAAc,GAAG,IAAI,GAAG,EAA0C,CAAC;IAEpF,YACmB,OAAsB,EACtB,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EACpC,wBAAgC,CAAC,GAAG,EAAE,GAAG,IAAI;QAE9D,KAAK,EAAE,CAAC;QAJS,YAAO,GAAP,OAAO,CAAe;QACtB,QAAG,GAAH,GAAG,CAAiC;QACpC,0BAAqB,GAArB,qBAAqB,CAAwB;IAGhE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAuB,EAAE,KAAc,EAAE,KAAa;QAC1E,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACxC,MAAM,EAAE,WAAW;YACnB,QAAQ;YACR,IAAI,EAAE,KAAK;YACX,KAAK;SACN,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,kBAAkB;YAC1B,KAAK;YACL,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE;gBAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,wBAAwB;gBACnD,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAe,EAAE,KAAa;QAChD,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAEpC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACxB,MAAM,EAAE,mBAAmB;gBAC3B,KAAK;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAsB,EAAE,OAAiB,EAAE,KAAa;QAC3E,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAEpC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC7B,OAAO;YACP,KAAK;YACL,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAe,EAAE,KAAa;QAC/C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAEpC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACxB,MAAM,EAAE,cAAc;YACtB,KAAK;YACL,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;QACnD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAClD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClC,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kEAAkE;IAClE,qBAAqB;QACnB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;IAClC,CAAC;CACF"}

package/dist/esm/adapters/langchain/index.js

@@ -0,0 +1,3 @@
+export { AssemblyCallbackHandler } from "./assembly-callback-handler.js";
+export { getRunId, wrapToolWithAssembly } from "./wrap-tool-with-assembly.js";
+//# sourceMappingURL=index.js.map

package/dist/esm/adapters/langchain/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/adapters/langchain/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/esm/adapters/langchain/wrap-tool-with-assembly.js

@@ -0,0 +1,52 @@
+import { randomUUID } from "node:crypto";
+import { PolicyViolationError } from "../../errors/policy-violation-error.js";
+const DEFAULT_APPROVAL_TIMEOUT_MS = 30_000;
+function createRunId() {
+    return `run_${randomUUID()}`;
+}
+async function waitForApprovalWithTimeout(gateway, toolName, runId, timeoutMs) {
+    let timeoutId;
+    const timeoutPromise = new Promise((resolve) => {
+        timeoutId = setTimeout(() => {
+            resolve({ denied: true, reason: `Approval timeout after ${timeoutMs}ms` });
+        }, timeoutMs);
+    });
+    try {
+        const approvalPromise = gateway.waitForApproval(toolName, runId, timeoutMs);
+        return await Promise.race([approvalPromise, timeoutPromise]);
+    }
+    finally {
+        if (timeoutId) {
+            clearTimeout(timeoutId);
+        }
+    }
+}
+export function wrapToolWithAssembly(tool, gateway, options = {}) {
+    const originalInvoke = tool.invoke.bind(tool);
+    const generateRunId = options.generateRunId ?? createRunId;
+    const approvalTimeoutMs = options.approvalTimeoutMs ?? DEFAULT_APPROVAL_TIMEOUT_MS;
+    tool.invoke = async (input, config) => {
+        const runId = getRunId(config, generateRunId);
+        const decision = await gateway.check({
+            action: "tool_call",
+            toolName: tool.name,
+            args: input,
+            runId
+        });
+        if (decision.denied) {
+            throw new PolicyViolationError(`Tool '${tool.name}' blocked: ${decision.reason ?? "Denied"}`);
+        }
+        if (decision.pending) {
+            const finalDecision = await waitForApprovalWithTimeout(gateway, tool.name, runId, approvalTimeoutMs);
+            if (finalDecision.denied) {
+                throw new PolicyViolationError(`Approval rejected for '${tool.name}': ${finalDecision.reason ?? "Rejected"}`);
+            }
+        }
+        return originalInvoke(input, config ? { ...config, runId } : { runId });
+    };
+    return tool;
+}
+export function getRunId(config, generateRunId) {
+    return config?.runId ?? generateRunId();
+}
+//# sourceMappingURL=wrap-tool-with-assembly.js.map

package/dist/esm/adapters/langchain/wrap-tool-with-assembly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap-tool-with-assembly.js","sourceRoot":"","sources":["../../../../src/adapters/langchain/wrap-tool-with-assembly.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAS9E,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAE3C,SAAS,WAAW;IAClB,OAAO,OAAO,UAAU,EAAE,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,OAAsB,EACtB,QAAgB,EAChB,KAAa,EACb,SAAiB;IAEjB,IAAI,SAAoD,CAAC;IAEzD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAmC,CAAC,OAAO,EAAE,EAAE;QAC/E,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,SAAS,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5E,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,IAAI,SAAS,EAAE,CAAC;YACd,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAW,EACX,OAAsB,EACtB,UAAuC,EAAE;IAEzC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC;IAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;IAEnF,IAAI,CAAC,MAAM,GAAG,KAAK,EAAE,KAAc,EAAE,MAA2B,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;YACnC,MAAM,EAAE,WAAW;YACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK;YACX,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAoB,CAAC,SAAS,IAAI,CAAC,IAAI,cAAc,QAAQ,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,aAAa,GAAG,MAAM,0BAA0B,CACpD,OAAO,EACP,IAAI,CAAC,IAAI,EACT,KAAK,EACL,iBAAiB,CAClB,CAAC;YACF,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;gBACzB,MAAM,IAAI,oBAAoB,CAC5B,0BAA0B,IAAI,CAAC,IAAI,MAAM,aAAa,CAAC,MAAM,IAAI,UAAU,EAAE,CAC9E,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAsC,EAAE,aAA2B;IAC1F,OAAO,MAAM,EAAE,KAAK,IAAI,aAAa,EAAE,CAAC;AAC1C,CAAC"}

package/dist/esm/audit/encode.js

@@ -0,0 +1,171 @@
+// JSON wire-format bridge for the `AuditEvent` / `CallStackNode` interfaces
+// declared in `../types/audit.ts`. Mirrors the gateway's snake_case JSON
+// convention (consistent with the existing `sendEvent(handle, eventJSON)`
+// path used by `native/aa-ffi-node`) — see AAASM-1450 for context.
+/**
+ * Translate a {@link CallStackNode} into its wire JSON object form.
+ *
+ * Recurses through `children`. Optional fields (`latencyMs`,
+ * `children`) are dropped when undefined or — for `children` — empty,
+ * so the resulting object is the minimal payload the gateway accepts.
+ */
+export function encodeCallStackNode(node) {
+    const wire = {
+        id: node.id,
+        kind: node.kind,
+        label: node.label,
+    };
+    if (node.latencyMs !== undefined) {
+        wire.latency_ms = node.latencyMs;
+    }
+    if (node.children !== undefined && node.children.length > 0) {
+        wire.children = node.children.map(encodeCallStackNode);
+    }
+    return wire;
+}
+/**
+ * Serialize an {@link AuditEvent} to its JSON wire string.
+ *
+ * Translates the camelCase interface field names into the gateway's
+ * snake_case keys (`eventId` → `event_id`, `callStack` → `call_stack`,
+ * etc.), recursively encoding the call-stack tree via
+ * {@link encodeCallStackNode}. Optional fields whose value is
+ * `undefined`, an empty string, or an empty array are omitted so a
+ * legacy decoder that has never seen those fields reads the payload
+ * unchanged.
+ */
+export function encodeAuditEvent(event) {
+    const wire = {
+        event_id: event.eventId,
+        agent_id: event.agentId,
+        action_type: event.actionType,
+        decision: event.decision,
+    };
+    if (event.traceId !== undefined && event.traceId !== "") {
+        wire.trace_id = event.traceId;
+    }
+    if (event.spanId !== undefined && event.spanId !== "") {
+        wire.span_id = event.spanId;
+    }
+    if (event.parentSpanId !== undefined && event.parentSpanId !== "") {
+        wire.parent_span_id = event.parentSpanId;
+    }
+    if (event.labels !== undefined && Object.keys(event.labels).length > 0) {
+        wire.labels = event.labels;
+    }
+    if (event.callStack !== undefined && event.callStack.length > 0) {
+        wire.call_stack = event.callStack.map(encodeCallStackNode);
+    }
+    return JSON.stringify(wire);
+}
+function asRecord(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new TypeError("expected JSON object on the wire");
+    }
+    return value;
+}
+/**
+ * Translate a wire JSON object back into a {@link CallStackNode}.
+ *
+ * Symmetric inverse of {@link encodeCallStackNode}: walks `children`
+ * recursively, restores `latencyMs` from `latency_ms`, and treats a
+ * missing or empty `children` field as `undefined` on the interface
+ * side (matches AAASM-1436's default).
+ */
+export function decodeCallStackNode(payload) {
+    const wire = asRecord(payload);
+    const id = wire.id;
+    const kindRaw = wire.kind;
+    const label = wire.label;
+    if (typeof id !== "string") {
+        throw new TypeError("CallStackNode.id missing or not a string");
+    }
+    if (typeof kindRaw !== "string") {
+        throw new TypeError("CallStackNode.kind missing or not a string");
+    }
+    if (typeof label !== "string") {
+        throw new TypeError("CallStackNode.label missing or not a string");
+    }
+    const node = {
+        id,
+        kind: kindRaw,
+        label,
+    };
+    if (typeof wire.latency_ms === "number") {
+        node.latencyMs = wire.latency_ms;
+    }
+    if (Array.isArray(wire.children) && wire.children.length > 0) {
+        node.children = wire.children.map(decodeCallStackNode);
+    }
+    return node;
+}
+function asNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function asStringMap(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const entries = Object.entries(value).filter((entry) => typeof entry[1] === "string");
+    return entries.length > 0 ? Object.fromEntries(entries) : undefined;
+}
+/**
+ * Deserialize a JSON wire payload into a typed {@link AuditEvent}.
+ *
+ * Accepts either the raw JSON string (the gateway's standard
+ * transport) or an already-parsed object (handy for tests and for
+ * callers that received a JSON object via another path). Symmetric
+ * inverse of {@link encodeAuditEvent}: snake_case keys map back to
+ * camelCase fields, and missing / empty optionals decode to
+ * `undefined` so an `AuditEvent` produced from a legacy payload (no
+ * `call_stack`, empty `trace_id`, …) matches what AAASM-1436's
+ * existing consumer-side tests expect.
+ */
+export function decodeAuditEvent(payload) {
+    const wire = typeof payload === "string"
+        ? asRecord(JSON.parse(payload))
+        : asRecord(payload);
+    const eventId = wire.event_id;
+    const agentId = wire.agent_id;
+    const actionType = wire.action_type;
+    const decision = wire.decision;
+    if (typeof eventId !== "string") {
+        throw new TypeError("AuditEvent.event_id missing or not a string");
+    }
+    if (typeof agentId !== "string") {
+        throw new TypeError("AuditEvent.agent_id missing or not a string");
+    }
+    if (typeof actionType !== "string") {
+        throw new TypeError("AuditEvent.action_type missing or not a string");
+    }
+    if (typeof decision !== "string") {
+        throw new TypeError("AuditEvent.decision missing or not a string");
+    }
+    const event = {
+        eventId,
+        agentId,
+        actionType,
+        decision,
+    };
+    const traceId = asNonEmptyString(wire.trace_id);
+    if (traceId !== undefined) {
+        event.traceId = traceId;
+    }
+    const spanId = asNonEmptyString(wire.span_id);
+    if (spanId !== undefined) {
+        event.spanId = spanId;
+    }
+    const parentSpanId = asNonEmptyString(wire.parent_span_id);
+    if (parentSpanId !== undefined) {
+        event.parentSpanId = parentSpanId;
+    }
+    const labels = asStringMap(wire.labels);
+    if (labels !== undefined) {
+        event.labels = labels;
+    }
+    if (Array.isArray(wire.call_stack) && wire.call_stack.length > 0) {
+        event.callStack = wire.call_stack.map(decodeCallStackNode);
+    }
+    return event;
+}
+//# sourceMappingURL=encode.js.map