@agent-assembly/sdk 0.0.1-beta.3 → 0.0.1-beta.5

package/dist/esm/hooks/mastra.js

@@ -37,15 +37,18 @@ export async function patchMastra(options) {
     mastraPatchState.originalGenerate = originalGenerate;
     mastraPatchState.patchedAgentClass = module.Agent;
     module.Agent.prototype.generate = function patchedGenerate(...args) {
-        let result;
+        // The try guards only the *synchronous* setup (entering the async-context
+        // store and invoking the original); the returned promise is handed to the
+        // caller, which awaits it, so its rejection is the caller's to handle.
+        // Returning it directly (rather than via a local inside the try) avoids an
+        // unhandled-rejection footgun without changing timing or call count.
         try {
-            result = runWithAgentId(agentId, () => originalGenerate.apply(this, args));
+            return runWithAgentId(agentId, () => originalGenerate.apply(this, args));
         }
         catch (e) {
             console.warn("[assembly] Mastra lineage patch error on generate; falling back:", e);
             return originalGenerate.apply(this, args);
         }
-        return result;
     };
     // Wrap Workflow.prototype.execute if present
     if (module.Workflow?.prototype?.execute) {
@@ -53,15 +56,16 @@ export async function patchMastra(options) {
         mastraPatchState.originalExecute = originalExecute;
         mastraPatchState.patchedWorkflowClass = module.Workflow;
         module.Workflow.prototype.execute = function patchedExecute(...args) {
-            let result;
+            // See patchedGenerate above: the try guards only the synchronous setup;
+            // the returned promise is awaited by the caller, so returning it directly
+            // (not via a local) handles its rejection without altering behaviour.
             try {
-                result = runWithAgentId(agentId, () => originalExecute.apply(this, args));
+                return runWithAgentId(agentId, () => originalExecute.apply(this, args));
             }
             catch (e) {
                 console.warn("[assembly] Mastra lineage patch error on execute; falling back:", e);
                 return originalExecute.apply(this, args);
             }
-            return result;
         };
     }
     mastraPatchState.isPatched = true;

package/dist/esm/hooks/mastra.js.map

@@ -1 +1 @@
-{"version":3,"file":"mastra.js","sourceRoot":"","sources":["../../../src/hooks/mastra.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AA2BnE,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,SAAS,EAAE,KAAK;IAChB,gBAAgB,EAAE,SAAS;IAC3B,eAAe,EAAE,SAAS;IAC1B,iBAAiB,EAAE,SAAS;IAC5B,oBAAoB,EAAE,SAAS;CAChC,CAAC;AAOF,KAAK,UAAU,gBAAgB;IAC7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,cAAc,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAiB,CAAC;QAC1D,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B;IAC3D,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,CAAC;IAC1D,IAAI,MAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5B,gCAAgC;IAChC,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;IACzD,gBAAgB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IACrD,gBAAgB,CAAC,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC;IAElD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,GAAG,SAAS,eAAe,CACxD,GAAG,IAAe;QAElB,IAAI,MAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,kEAAkE,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,6CAA6C;IAC7C,IAAI,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACxC,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;QAC1D,gBAAgB,CAAC,eAAe,GAAG,eAAe,CAAC;QACnD,gBAAgB,CAAC,oBAAoB,GAAG,MAAM,CAAC,QAAQ,CAAC;QAExD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,GAAG,SAAS,cAAc,CACzD,GAAG,IAAe;YAElB,IAAI,MAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,iEAAiE,EAAE,CAAC,CAAC,CAAC;gBACnF,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,SAAS,GAAG,IAAI,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,gBAAgB,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;QAC5E,gBAAgB,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,GAAG,gBAAgB,CAAC,gBAAgB,CAAC;IAC5F,CAAC;IACD,IAAI,gBAAgB,CAAC,oBAAoB,IAAI,gBAAgB,CAAC,eAAe,EAAE,CAAC;QAC9E,gBAAgB,CAAC,oBAAoB,CAAC,SAAS,CAAC,OAAO,GAAG,gBAAgB,CAAC,eAAe,CAAC;IAC7F,CAAC;IAED,gBAAgB,CAAC,SAAS,GAAG,KAAK,CAAC;IACnC,gBAAgB,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAC9C,gBAAgB,CAAC,eAAe,GAAG,SAAS,CAAC;IAC7C,gBAAgB,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAC/C,gBAAgB,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"mastra.js","sourceRoot":"","sources":["../../../src/hooks/mastra.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AA2BnE,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,SAAS,EAAE,KAAK;IAChB,gBAAgB,EAAE,SAAS;IAC3B,eAAe,EAAE,SAAS;IAC1B,iBAAiB,EAAE,SAAS;IAC5B,oBAAoB,EAAE,SAAS;CAChC,CAAC;AAOF,KAAK,UAAU,gBAAgB;IAC7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,cAAc,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAiB,CAAC;QAC1D,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B;IAC3D,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,gBAAgB,CAAC;IAC1D,IAAI,MAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5B,gCAAgC;IAChC,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;IACzD,gBAAgB,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IACrD,gBAAgB,CAAC,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC;IAElD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,GAAG,SAAS,eAAe,CACxD,GAAG,IAAe;QAElB,0EAA0E;QAC1E,0EAA0E;QAC1E,uEAAuE;QACvE,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,CAAC;YACH,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,kEAAkE,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC;IAEF,6CAA6C;IAC7C,IAAI,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACxC,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;QAC1D,gBAAgB,CAAC,eAAe,GAAG,eAAe,CAAC;QACnD,gBAAgB,CAAC,oBAAoB,GAAG,MAAM,CAAC,QAAQ,CAAC;QAExD,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,GAAG,SAAS,cAAc,CACzD,GAAG,IAAe;YAElB,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,IAAI,CAAC;gBACH,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,iEAAiE,EAAE,CAAC,CAAC,CAAC;gBACnF,OAAO,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,SAAS,GAAG,IAAI,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,gBAAgB,CAAC,iBAAiB,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,CAAC;QAC5E,gBAAgB,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ,GAAG,gBAAgB,CAAC,gBAAgB,CAAC;IAC5F,CAAC;IACD,IAAI,gBAAgB,CAAC,oBAAoB,IAAI,gBAAgB,CAAC,eAAe,EAAE,CAAC;QAC9E,gBAAgB,CAAC,oBAAoB,CAAC,SAAS,CAAC,OAAO,GAAG,gBAAgB,CAAC,eAAe,CAAC;IAC7F,CAAC;IAED,gBAAgB,CAAC,SAAS,GAAG,KAAK,CAAC;IACnC,gBAAgB,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAC9C,gBAAgB,CAAC,eAAe,GAAG,SAAS,CAAC;IAC7C,gBAAgB,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAC/C,gBAAgB,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAClD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/esm/hooks/openai-agents.js

@@ -9,9 +9,7 @@ export function captureOriginalRunTool(agentClass) {
     if (!candidate) {
         return undefined;
     }
-    if (!openAIAgentsPatchState.originalRunTool) {
-        openAIAgentsPatchState.originalRunTool = candidate;
-    }
+    openAIAgentsPatchState.originalRunTool ??= candidate;
     return openAIAgentsPatchState.originalRunTool;
 }
 export function parseToolCallArguments(toolCall) {

package/dist/esm/hooks/openai-agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"openai-agents.js","sourceRoot":"","sources":["../../../src/hooks/openai-agents.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAclE,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,SAAS,EAAE,KAAK;IAChB,eAAe,EAAE,SAAS;IAC1B,iBAAiB,EAAE,SAAS;CAC7B,CAAC;AAEF,MAAM,UAAU,sBAAsB,CACpC,UAAkC;IAElC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,sBAAsB,CAAC,eAAe,EAAE,CAAC;QAC5C,sBAAsB,CAAC,eAAe,GAAG,SAAS,CAAC;IACrD,CAAC;IAED,OAAO,sBAAsB,CAAC,eAAe,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAA8B;IACnE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;IACrC,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,8BAA8B,CAC5C,OAA2C;IAE3C,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS;QACtC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,SAAS;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAA0B,EAC1B,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,MAAM,EAAE,EAAE,CAAC;AAC3C,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAA4B,EAC5B,OAA6B;IAE7B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,eAAe,CAClD,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,SAAS,CAClB,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,aAA4B,EAC5B,KAAa,EACb,MAAe;IAEf,KAAK,aAAa,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5E,CAAC;AAOD,MAAM,UAAU,oBAAoB,CAClC,eAAoC,EACpC,aAA4B,EAC5B,OAAoC;IAEpC,OAAO,KAAK,UAAU,cAAc,CAElC,QAA8B,EAC9B,OAA+B;QAE/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC;QAEtD,MAAM,eAAe,GAAG,KAAK,IAAyC,EAAE;YACtE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnE,2BAA2B,CAAC,aAAa,EAAE,KAAK,EAAE;gBAChD,QAAQ;gBACR,IAAI;gBACJ,MAAM;gBACN,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC;gBACnC,MAAM,EAAE,WAAW;gBACnB,QAAQ;gBACR,IAAI;gBACJ,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,eAAe,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,0BAA0B,CAC/B,QAAQ,CAAC,MAAM,EACf,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,aAAa,CAAC;YAClB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE;oBACzD,QAAQ;oBACR,KAAK;oBACL,SAAS,EAAE,OAAO,CAAC,iBAAiB;iBACrC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,eAAe,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,aAAa,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC;AASD,KAAK,UAAU,qBAAqB;IAClC,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,gBAAgB,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAuC,CAAC;QAChF,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,IAAI,sBAAsB,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC;IACvE,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,SAAS,CAAC,QAAQ,GAAG,oBAAoB,CAClD,eAAe,EACf,OAAO,CAAC,aAAa,EACrB;QACE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,MAAM;QACtD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe;KACxD,CACF,CAAC;IACF,sBAAsB,CAAC,SAAS,GAAG,IAAI,CAAC;IACxC,sBAAsB,CAAC,iBAAiB,GAAG,UAAU,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,eAAe,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sBAAsB,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ;QACzD,sBAAsB,CAAC,eAAe,CAAC;IACzC,sBAAsB,CAAC,SAAS,GAAG,KAAK,CAAC;IACzC,sBAAsB,CAAC,iBAAiB,GAAG,SAAS,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"openai-agents.js","sourceRoot":"","sources":["../../../src/hooks/openai-agents.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAclE,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,SAAS,EAAE,KAAK;IAChB,eAAe,EAAE,SAAS;IAC1B,iBAAiB,EAAE,SAAS;CAC7B,CAAC;AAEF,MAAM,UAAU,sBAAsB,CACpC,UAAkC;IAElC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,sBAAsB,CAAC,eAAe,KAAK,SAAS,CAAC;IAErD,OAAO,sBAAsB,CAAC,eAAe,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAA8B;IACnE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;IACrC,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,8BAA8B,CAC5C,OAA2C;IAE3C,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS;QACtC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,SAAS;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAA0B,EAC1B,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,MAAM,EAAE,EAAE,CAAC;AAC3C,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAA4B,EAC5B,OAA6B;IAE7B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,eAAe,CAClD,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,SAAS,CAClB,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,0BAA0B,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,aAA4B,EAC5B,KAAa,EACb,MAAe;IAEf,KAAK,aAAa,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5E,CAAC;AAOD,MAAM,UAAU,oBAAoB,CAClC,eAAoC,EACpC,aAA4B,EAC5B,OAAoC;IAEpC,OAAO,KAAK,UAAU,cAAc,CAElC,QAA8B,EAC9B,OAA+B;QAE/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxC,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC;QAEtD,MAAM,eAAe,GAAG,KAAK,IAAyC,EAAE;YACtE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnE,2BAA2B,CAAC,aAAa,EAAE,KAAK,EAAE;gBAChD,QAAQ;gBACR,IAAI;gBACJ,MAAM;gBACN,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QAEF,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC;gBACnC,MAAM,EAAE,WAAW;gBACnB,QAAQ;gBACR,IAAI;gBACJ,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,eAAe,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,0BAA0B,CAC/B,QAAQ,CAAC,MAAM,EACf,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,aAAa,CAAC;YAClB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE;oBACzD,QAAQ;oBACR,KAAK;oBACL,SAAS,EAAE,OAAO,CAAC,iBAAiB;iBACrC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,eAAe,EAAE,CAAC;YAC3B,CAAC;YACD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,aAAa,CAAC;YACvB,CAAC;QACH,CAAC;QAED,OAAO,eAAe,EAAE,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC;AASD,KAAK,UAAU,qBAAqB;IAClC,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,gBAAgB,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAuC,CAAC;QAChF,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,IAAI,sBAAsB,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC;IACvE,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,eAAe,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,SAAS,CAAC,QAAQ,GAAG,oBAAoB,CAClD,eAAe,EACf,OAAO,CAAC,aAAa,EACrB;QACE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,MAAM;QACtD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,eAAe;KACxD,CACF,CAAC;IACF,sBAAsB,CAAC,SAAS,GAAG,IAAI,CAAC;IACxC,sBAAsB,CAAC,iBAAiB,GAAG,UAAU,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,eAAe,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sBAAsB,CAAC,iBAAiB,CAAC,SAAS,CAAC,QAAQ;QACzD,sBAAsB,CAAC,eAAe,CAAC;IACzC,sBAAsB,CAAC,SAAS,GAAG,KAAK,CAAC;IACzC,sBAAsB,CAAC,iBAAiB,GAAG,SAAS,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/esm/index.js

@@ -1,5 +1,11 @@
 export { initAssembly } from "./core/init-assembly.js";
 export { withAssembly } from "./wrappers/index.js";
+// Live op-control consumer (AAASM-3491). Subscribes to the gateway's
+// OpControlStream and exposes per-op cooperative-pause / fast-fail-terminate;
+// pass the subscriber as `withAssembly(..., { opControl })` so an operator
+// terminate/pause reaches a running tool through the SDK tool path.
+export { OpControlSubscriber } from "./op-control.js";
+export { OpTerminatedError } from "./errors/op-terminated-error.js";
 export { ENFORCEMENT_MODES } from "./types/index.js";
 export { decodeAuditEvent, decodeCallStackNode, encodeAuditEvent, encodeCallStackNode } from "./audit/index.js";
 export { currentAgentId, runWithAgentId } from "./lineage/index.js";

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAYnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpE,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,uEAAuE;AACvE,sDAAsD;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAU5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,6BAA6B;AAC7B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,qEAAqE;AACrE,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAKtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAWpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpE,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,uEAAuE;AACvE,sDAAsD;AACtD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAU5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,6BAA6B;AAC7B,cAAc,kBAAkB,CAAC"}

package/dist/esm/native/client.js

@@ -1,9 +1,30 @@
 import { createRequire } from "node:module";
 import path from "node:path";
+/**
+ * Resolve the installed `@agent-assembly/sdk` package version, or `undefined`.
+ *
+ * Forwarded into the native `connect` so the user-facing npm package version —
+ * not the shared `aa-sdk-client` crate version — is what gets signed into the
+ * runtime handshake, giving accurate downgrade detection (AAASM-3683).
+ * `undefined` lets the native shim fall back to the crate version (no
+ * regression vs AAASM-3666). Uses `createRequire(<cwd>/package.json)`, the same
+ * ESM/CJS-safe pattern as the native-binding and runtime-binary resolvers.
+ */
+export function resolveSdkVersion() {
+    try {
+        const requireFromHere = createRequire(path.resolve(process.cwd(), "package.json"));
+        const pkg = requireFromHere("@agent-assembly/sdk/package.json");
+        return typeof pkg.version === "string" && pkg.version.length > 0 ? pkg.version : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 const NATIVE_BINDING_SINGLETON_KEY = Symbol.for("@agent-assembly/sdk/native-binding");
 const ERROR_CONNECT = "AA_ERR_CONNECT";
 const ERROR_SEND_EVENT = "AA_ERR_SEND_EVENT";
 const ERROR_QUERY_POLICY = "AA_ERR_QUERY_POLICY";
+const ERROR_REGISTER = "AA_ERR_REGISTER";
 const ERROR_DISCONNECT = "AA_ERR_DISCONNECT";
 export class NativeConnectError extends Error {
     code = ERROR_CONNECT;
@@ -14,9 +35,31 @@ export class NativeSendEventError extends Error {
 export class NativeQueryPolicyError extends Error {
     code = ERROR_QUERY_POLICY;
 }
+export class NativeRegisterError extends Error {
+    code = ERROR_REGISTER;
+}
 export class NativeDisconnectError extends Error {
     code = ERROR_DISCONNECT;
 }
+/**
+ * Translate the native `{decision, reason}` verdict into the SDK's
+ * `PolicyResult`. Only `"deny"` blocks; `"pending"` routes to the approval
+ * path; `"allow"` / `"redact"` / any unrecognized value proceed. This mirrors
+ * the shared enforcement contract across the Python / Go / Node SDKs.
+ *
+ * The native primitive already fails open (returns `"allow"`) when the runtime
+ * is unreachable or too slow, so a missing or degraded runtime never blocks.
+ */
+function mapDecisionToPolicyResult(verdict) {
+    switch (verdict.decision) {
+        case "deny":
+            return { denied: true, pending: false, reason: verdict.reason };
+        case "pending":
+            return { denied: false, pending: true, reason: verdict.reason };
+        default:
+            return { denied: false, pending: false };
+    }
+}
 function mapNativeError(error) {
     if (!(error instanceof Error)) {
         return new Error(String(error));
@@ -32,6 +75,9 @@ function mapNativeError(error) {
     if (code === ERROR_QUERY_POLICY) {
         return new NativeQueryPolicyError(detail);
     }
+    if (code === ERROR_REGISTER) {
+        return new NativeRegisterError(detail);
+    }
     if (code === ERROR_DISCONNECT) {
         return new NativeDisconnectError(detail);
     }
@@ -40,9 +86,7 @@ function mapNativeError(error) {
 function loadNativeBinding() {
     const shouldUseCache = process.env.VITEST !== "true";
     const globalObject = globalThis;
-    const cachedBinding = shouldUseCache
-        ? globalObject[NATIVE_BINDING_SINGLETON_KEY]
-        : undefined;
+    const cachedBinding = shouldUseCache ? globalObject[NATIVE_BINDING_SINGLETON_KEY] : undefined;
     if (cachedBinding) {
         return cachedBinding;
     }
@@ -74,7 +118,11 @@ export function createNativeClient(options) {
             mode,
             close: async () => undefined,
             sendEvent: () => undefined,
-            queryPolicy: async () => ({ denied: false, pending: false })
+            queryPolicy: async () => ({ denied: false, pending: false }),
+            // No native session to register against off the in-process path; the
+            // gRPC sidecar registers the agent in its own process. Resolve neutrally
+            // so init never blocks on a transport that does not own a handle.
+            register: async () => ""
         };
     }
     const binding = loadNativeBinding();
@@ -82,20 +130,21 @@ export function createNativeClient(options) {
     let handlePromise;
     let activeHandle;
     let pendingSendError;
+    const sdkVersion = resolveSdkVersion();
     const getHandle = async () => {
-        if (!handlePromise) {
-            handlePromise = binding
-                .connect(socketPath)
-                .then((handle) => {
-                activeHandle = handle;
-                return handle;
-            })
-                .catch((error) => {
-                handlePromise = undefined;
-                activeHandle = undefined;
-                throw mapNativeError(error);
-            });
-        }
+        handlePromise ??= binding
+            // Forward the npm package version so it is signed into the handshake
+            // (AAASM-3683); agent id is wired at register time, not connect.
+            .connect(socketPath, undefined, sdkVersion)
+            .then((handle) => {
+            activeHandle = handle;
+            return handle;
+        })
+            .catch((error) => {
+            handlePromise = undefined;
+            activeHandle = undefined;
+            throw mapNativeError(error);
+        });
         return handlePromise;
     };
     return {
@@ -134,18 +183,36 @@ export function createNativeClient(options) {
                 pendingSendError = mapNativeError(error);
             });
         },
-        queryPolicy: async () => {
+        queryPolicy: async (action) => {
             if (pendingSendError) {
                 const error = pendingSendError;
                 pendingSendError = undefined;
                 throw error;
             }
-            // The SDK is not a policy authority. Ensure the session is connected
-            // (surfacing any connect error), then defer: authoritative policy and
-            // approval are enforced server-side (gateway / runtime). The native shim
-            // no longer synthesizes a decision, so this always resolves neutral.
-            await getHandle();
-            return { denied: false, pending: false };
+            // Connect (surfacing any connect error as a genuine local fault), then
+            // ask the runtime for an authoritative verdict via the native primitive.
+            // The native `queryPolicy` is async — it offloads its blocking wait to a
+            // worker thread, so awaiting it never blocks the Node event loop — and it
+            // already fails open (returns `"allow"`) when the runtime is unreachable
+            // or too slow, so a missing or degraded runtime never blocks the agent.
+            const handle = await getHandle();
+            const verdict = await binding.queryPolicy(handle, action);
+            return mapDecisionToPolicyResult(verdict);
+        },
+        register: async (options) => {
+            // Register on the same session the queryPolicy path uses, so the token
+            // the gateway issues is stored on this handle and attached to every
+            // subsequent query. This is the only direct SDK→gateway gRPC call
+            // (ADR 0004); CheckAction still flows through aa-runtime.
+            if (binding.register === undefined) {
+                // A binding without `register` predates AAASM-3400; the agent simply
+                // runs unregistered rather than failing init.
+                return "";
+            }
+            const handle = await getHandle();
+            return binding.register(handle, options).catch((error) => {
+                throw mapNativeError(error);
+            });
         }
     };
 }

package/dist/esm/native/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/native/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAe7B,MAAM,4BAA4B,GAAG,MAAM,CAAC,GAAG,CAC7C,oCAAoC,CACrC,CAAC;AAMF,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,GAAG,aAAa,CAAC;CAC/B;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,gBAAgB,CAAC;CAClC;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,GAAG,kBAAkB,CAAC;CACpC;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,gBAAgB,CAAC;CAClC;AASD,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC;IAEtD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,OAAO,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;IACrD,MAAM,YAAY,GAAG,UAAqC,CAAC;IAC3D,MAAM,aAAa,GAAG,cAAc;QAClC,CAAC,CAAC,YAAY,CAAC,4BAA4B,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,eAAe,GAAG,aAAa,CACnC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAC5C,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,oCAAoC;QACpC,uCAAuC;QACvC,GAAG,OAAO,CAAC,GAAG,EAAE,+BAA+B;KAChD,CAAC;IAEF,IAAI,SAAkB,CAAC;IACvB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAkB,CAAC;YAC5D,IAAI,cAAc,EAAE,CAAC;gBACnB,YAAY,CAAC,4BAA4B,CAAC,GAAG,OAAO,CAAC;YACvD,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,kBAAkB,CAC1B,mDAAmD,MAAM,CAAC,SAAS,CAAC,EAAE,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC;IAE5C,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;YAC5B,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAEnC,IAAI,aAA0C,CAAC;IAC/C,IAAI,YAAgC,CAAC;IACrC,IAAI,gBAAmC,CAAC;IAExC,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;QAC5C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,aAAa,GAAG,OAAO;iBACpB,OAAO,CAAC,UAAU,CAAC;iBACnB,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,YAAY,GAAG,MAAM,CAAC;gBACtB,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,aAAa,GAAG,SAAS,CAAC;gBAC1B,YAAY,GAAG,SAAS,CAAC;gBACzB,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,gBAAgB,CAAC;gBAC/B,gBAAgB,GAAG,SAAS,CAAC;gBAC7B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxD,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;YACH,aAAa,GAAG,SAAS,CAAC;YAC1B,YAAY,GAAG,SAAS,CAAC;QAC3B,CAAC;QACD,SAAS,EAAE,CAAC,KAAc,EAAE,EAAE;YAC5B,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACzC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,gBAAgB,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC3C,CAAC;gBACD,OAAO;YACT,CAAC;YAED,KAAK,SAAS,EAAE;iBACb,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,gBAAgB,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;QACP,CAAC;QACD,WAAW,EAAE,KAAK,IAAI,EAAE;YACtB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,gBAAgB,CAAC;gBAC/B,gBAAgB,GAAG,SAAS,CAAC;gBAC7B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,qEAAqE;YACrE,sEAAsE;YACtE,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/native/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AA+C7B;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,eAAe,CAAC,kCAAkC,CAAyB,CAAC;QACxF,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,4BAA4B,GAAG,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AAMtF,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,IAAI,GAAG,aAAa,CAAC;CAC/B;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,gBAAgB,CAAC;CAClC;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,GAAG,kBAAkB,CAAC;CACpC;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,GAAG,cAAc,CAAC;CAChC;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,gBAAgB,CAAC;CAClC;AAqBD;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,OAA6B;IAC9D,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM;YACT,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAClE,KAAK,SAAS;YACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAClE;YACE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC;IAEtD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC3B,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChC,OAAO,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;IACrD,MAAM,YAAY,GAAG,UAAqC,CAAC;IAC3D,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9F,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG;QACjB,oCAAoC;QACpC,uCAAuC;QACvC,GAAG,OAAO,CAAC,GAAG,EAAE,+BAA+B;KAChD,CAAC;IAEF,IAAI,SAAkB,CAAC;IACvB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAkB,CAAC;YAC5D,IAAI,cAAc,EAAE,CAAC;gBACnB,YAAY,CAAC,4BAA4B,CAAC,GAAG,OAAO,CAAC;YACvD,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,kBAAkB,CAC1B,mDAAmD,MAAM,CAAC,SAAS,CAAC,EAAE,CACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC;IAE5C,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;YAC5B,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5D,qEAAqE;YACrE,yEAAyE;YACzE,kEAAkE;YAClE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;SACzB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAEnC,IAAI,aAA0C,CAAC;IAC/C,IAAI,YAAgC,CAAC;IACrC,IAAI,gBAAmC,CAAC;IAExC,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IAEvC,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;QAC5C,aAAa,KAAK,OAAO;YACvB,qEAAqE;YACrE,iEAAiE;aAChE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC;aAC1C,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,YAAY,GAAG,MAAM,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,aAAa,GAAG,SAAS,CAAC;YAC1B,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACL,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,gBAAgB,CAAC;gBAC/B,gBAAgB,GAAG,SAAS,CAAC;gBAC7B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxD,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;YACH,aAAa,GAAG,SAAS,CAAC;YAC1B,YAAY,GAAG,SAAS,CAAC;QAC3B,CAAC;QACD,SAAS,EAAE,CAAC,KAAc,EAAE,EAAE;YAC5B,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBACzC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,gBAAgB,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC3C,CAAC;gBACD,OAAO;YACT,CAAC;YAED,KAAK,SAAS,EAAE;iBACb,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACnC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,gBAAgB,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAC3C,CAAC,CAAC,CAAC;QACP,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,MAAe,EAAE,EAAE;YACrC,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,gBAAgB,CAAC;gBAC/B,gBAAgB,GAAG,SAAS,CAAC;gBAC7B,MAAM,KAAK,CAAC;YACd,CAAC;YAED,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1D,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,OAAwB,EAAE,EAAE;YAC3C,uEAAuE;YACvE,oEAAoE;YACpE,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACnC,qEAAqE;gBACrE,8CAA8C;gBAC9C,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAChE,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/op-control.js

@@ -19,37 +19,141 @@
  *   - Auto-wiring into the existing `GatewayClient` / adapter hooks
  *     (separate sub-task when the adapter surface is stable).
  */
-import { credentials as grpcCredentials, } from "@grpc/grpc-js";
 import { OpTerminatedError } from "./errors/op-terminated-error.js";
-import { OpControlSignal, PolicyServiceClient, } from "./proto/generated/policy.js";
+/**
+ * Numeric `OpControlSignal` values, inlined to keep this module grpc-free at load.
+ *
+ * `OpControlSignal` lives in `./proto/generated/policy.js`, which imports
+ * `@grpc/grpc-js` at module scope; importing the enum as a *value* would defeat
+ * the lazy-load. These are the stable protobuf wire numbers (UNSPECIFIED=0,
+ * PAUSE=1, RESUME=2, TERMINATE=3) — `msg.signal` is compared against them
+ * numerically in {@link OpControlSubscriber.dispatch}. The `OpControlSignal`
+ * type is still imported (type-only) for signatures.
+ */
+const SIGNAL_PAUSE = 1;
+const SIGNAL_RESUME = 2;
+const SIGNAL_TERMINATE = 3;
+/**
+ * Hosts treated as loopback for the secure-by-default transport decision.
+ * A loopback gateway is the local dev-mode CP, where plaintext gRPC is the
+ * documented default; anything else is presumed remote and must be encrypted.
+ */
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+/**
+ * Extract the bare host from a gRPC target (`host:port`, a bare host, or a
+ * URL-style `scheme://host:port`). Returns the lowercased host with any
+ * surrounding IPv6 brackets preserved so it can be matched against
+ * {@link LOOPBACK_HOSTS}.
+ */
+export function gatewayHostOf(gatewayUrl) {
+    let target = gatewayUrl.trim();
+    const schemeIdx = target.indexOf("://");
+    if (schemeIdx !== -1)
+        target = target.slice(schemeIdx + 3);
+    // Drop a path/query suffix if a URL form was passed.
+    const slashIdx = target.indexOf("/");
+    if (slashIdx !== -1)
+        target = target.slice(0, slashIdx);
+    if (target.startsWith("[")) {
+        // Bracketed IPv6: keep the bracketed form, strip only the trailing :port.
+        const close = target.indexOf("]");
+        return close === -1 ? target.toLowerCase() : target.slice(0, close + 1).toLowerCase();
+    }
+    const colonIdx = target.indexOf(":");
+    if (colonIdx !== -1)
+        target = target.slice(0, colonIdx);
+    return target.toLowerCase();
+}
+function isLoopbackTarget(gatewayUrl) {
+    return LOOPBACK_HOSTS.has(gatewayHostOf(gatewayUrl));
+}
+/**
+ * Pick channel credentials for the op-control stream, secure by default.
+ *
+ * Precedence: an explicit `credentials` override wins; otherwise a loopback
+ * target gets plaintext (local dev gateway), a remote target gets TLS, and a
+ * remote target is only allowed plaintext when the caller sets `allowInsecure`.
+ *
+ * `grpcCredentials` is injected (rather than imported at module scope) so this
+ * module does not eagerly load `@grpc/grpc-js` — see the module header. The
+ * real-connect path passes the lazily-imported `credentials` namespace.
+ *
+ * @throws never — returns the chosen {@link ChannelCredentials}.
+ */
+export function resolveOpControlCredentials(gatewayUrl, opts, grpcCredentials) {
+    if (opts.credentials)
+        return opts.credentials;
+    if (isLoopbackTarget(gatewayUrl))
+        return grpcCredentials.createInsecure();
+    if (opts.allowInsecure)
+        return grpcCredentials.createInsecure();
+    return grpcCredentials.createSsl();
+}
 export class OpControlSubscriber {
-    client;
+    /**
+     * `null` until the channel is opened. On the test-seam (`clientFactory`) path
+     * it is set synchronously in {@link connect}; on the real-connect path it is
+     * set asynchronously once `@grpc/grpc-js` + `PolicyServiceClient` have been
+     * lazily imported (see {@link openRealChannel}).
+     */
+    client = null;
     agent;
     ops = new Map();
     call = null;
     alive = true;
-    constructor(client, agent) {
-        this.client = client;
+    /** Set once {@link close} is called before the async channel finishes opening. */
+    closed = false;
+    constructor(agent) {
         this.agent = agent;
     }
-    /** Open the gRPC channel + subscription stream and start the reader. */
+    /**
+     * Open the gRPC channel + subscription stream and start the reader.
+     *
+     * Returns synchronously. On the real-connect path the channel is opened
+     * asynchronously — `@grpc/grpc-js` and `PolicyServiceClient` are loaded lazily
+     * (`await import`) so that importing this module never eagerly pulls grpc (see
+     * the module header). The test seam (`clientFactory`) opens synchronously and
+     * never touches grpc.
+     */
     static connect(gatewayUrl, opts) {
         const agent = {
             orgId: opts.orgId,
             teamId: opts.teamId,
-            agentId: opts.agentId,
+            agentId: opts.agentId
         };
-        const client = opts.clientFactory
-            ? opts.clientFactory()
-            : new PolicyServiceClient(gatewayUrl, opts.credentials ?? grpcCredentials.createInsecure());
-        const subscriber = new OpControlSubscriber(client, agent);
-        subscriber.start();
+        const subscriber = new OpControlSubscriber(agent);
+        if (opts.clientFactory) {
+            subscriber.client = opts.clientFactory();
+            subscriber.start();
+        }
+        else {
+            // Real channel: defer grpc loading to the dynamic-import path. Errors
+            // surface as a dead stream so callers see `streamAlive() === false`.
+            void subscriber.openRealChannel(gatewayUrl, opts).catch(() => {
+                subscriber.markStreamDead();
+            });
+        }
         return subscriber;
     }
+    /**
+     * Lazily import grpc + the policy client, build the real client, and start the
+     * reader. Kept off the module's import graph so `import '@agent-assembly/sdk'`
+     * stays grpc-free until a subscriber actually opens a live channel.
+     */
+    async openRealChannel(gatewayUrl, opts) {
+        const { credentials } = await import("@grpc/grpc-js");
+        const { PolicyServiceClient } = await import("./proto/generated/policy.js");
+        if (this.closed)
+            return; // close() raced ahead of the async open.
+        this.client = new PolicyServiceClient(gatewayUrl, resolveOpControlCredentials(gatewayUrl, opts, credentials));
+        this.start();
+    }
     /** Open the stream and wire reader handlers. Public so tests can call
      * directly after constructing with a hand-rolled client.
      */
     start() {
+        if (!this.client)
+            return;
         this.call = this.client.opControlStream({ agentId: this.agent });
         this.call.on("data", (msg) => this.dispatch(msg));
         this.call.on("error", () => this.markStreamDead());
@@ -58,14 +162,14 @@ export class OpControlSubscriber {
     dispatch(msg) {
         const state = this.slot(msg.opId);
         switch (msg.signal) {
-            case OpControlSignal.OP_CONTROL_SIGNAL_PAUSE:
+            case SIGNAL_PAUSE:
                 state.paused = true;
                 break;
-            case OpControlSignal.OP_CONTROL_SIGNAL_RESUME:
+            case SIGNAL_RESUME:
                 state.paused = false;
                 this.flushResolvers(state);
                 break;
-            case OpControlSignal.OP_CONTROL_SIGNAL_TERMINATE:
+            case SIGNAL_TERMINATE:
                 state.terminated = true;
                 this.flushResolvers(state);
                 break;
@@ -137,10 +241,13 @@ export class OpControlSubscriber {
     streamAlive() {
         return this.alive;
     }
-    /** Cancel the stream and clean up. */
+    /** Cancel the stream and clean up. Safe to call before the async real-channel
+     * open has completed — it flags `closed` so the pending open bails out.
+     */
     close() {
+        this.closed = true;
         this.call?.cancel();
-        this.client.close?.();
+        this.client?.close?.();
         this.markStreamDead();
     }
 }

package/dist/esm/op-control.js.map

@@ -1 +1 @@
-{"version":3,"file":"op-control.js","sourceRoot":"","sources":["../../src/op-control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAGL,WAAW,IAAI,eAAe,GAC/B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAEL,eAAe,EAEf,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAmCrC,MAAM,OAAO,mBAAmB;IACb,MAAM,CAAkB;IACxB,KAAK,CAAU;IACf,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,IAAI,GAAkD,IAAI,CAAC;IAC3D,KAAK,GAAG,IAAI,CAAC;IAErB,YAAoB,MAAuB,EAAE,KAAc;QACzD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,wEAAwE;IACjE,MAAM,CAAC,OAAO,CACnB,UAAkB,EAClB,IAAgC;QAEhC,MAAM,KAAK,GAAY;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa;YAC/B,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE;YACtB,CAAC,CAAE,IAAI,mBAAmB,CACtB,UAAU,EACV,IAAI,CAAC,WAAW,IAAI,eAAe,CAAC,cAAc,EAAE,CACI,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1D,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACI,KAAK;QACV,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,GAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACnD,CAAC;IAEO,QAAQ,CAAC,GAAqB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,eAAe,CAAC,uBAAuB;gBAC1C,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,KAAK,eAAe,CAAC,wBAAwB;gBAC3C,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;gBACrB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,eAAe,CAAC,2BAA2B;gBAC9C,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM;YACR;gBACE,kDAAkD;gBAClD,MAAM;QACV,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,cAAc,CAAC,KAAqB;QAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC;QAChC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,OAAO,IAAI,OAAO;YAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,uDAAuD;QACvD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,SAAS,CACpB,IAAY,EACZ,OAA+B,EAAE;QAEjC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,gCAAgC,EAAE,IAAI,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO;QAE1B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,EAAE;oBACd,uEAAuE;oBACvE,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC7C,IAAI,GAAG,KAAK,CAAC,CAAC;wBAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC/C,OAAO,EAAE,CAAC;gBACZ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,gCAAgC,EAAE,IAAI,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAEM,QAAQ,CAAC,IAAY;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC;IAC7C,CAAC;IAEM,YAAY,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,IAAI,KAAK,CAAC;IACjD,CAAC;IAEM,WAAW;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,sCAAsC;IAC/B,KAAK;QACV,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;CACF"}
+{"version":3,"file":"op-control.js","sourceRoot":"","sources":["../../src/op-control.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAaH,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAQpE;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAoB,CAAC,CAAC;AACxC,MAAM,aAAa,GAAoB,CAAC,CAAC;AACzC,MAAM,gBAAgB,GAAoB,CAAC,CAAC;AA2C5C;;;;GAIG;AACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,IAAI,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC3D,qDAAqD;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,OAAO,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;AACvD,CAAC;AAYD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CACzC,UAAkB,EAClB,IAAuE,EACvE,eAAuC;IAEvC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC9C,IAAI,gBAAgB,CAAC,UAAU,CAAC;QAAE,OAAO,eAAe,CAAC,cAAc,EAAE,CAAC;IAC1E,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,eAAe,CAAC,cAAc,EAAE,CAAC;IAChE,OAAO,eAAe,CAAC,SAAS,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,OAAO,mBAAmB;IAC9B;;;;;OAKG;IACK,MAAM,GAA2B,IAAI,CAAC;IAC7B,KAAK,CAAU;IACf,GAAG,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,IAAI,GAAkD,IAAI,CAAC;IAC3D,KAAK,GAAG,IAAI,CAAC;IACrB,kFAAkF;IAC1E,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAoB,KAAc;QAChC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,OAAO,CAAC,UAAkB,EAAE,IAAgC;QACxE,MAAM,KAAK,GAAY;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,qEAAqE;YACrE,KAAK,UAAU,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC3D,UAAU,CAAC,cAAc,EAAE,CAAC;YAC9B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAC3B,UAAkB,EAClB,IAAgC;QAEhC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,yCAAyC;QAClE,IAAI,CAAC,MAAM,GAAG,IAAI,mBAAmB,CACnC,UAAU,EACV,2BAA2B,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CACH,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACI,KAAK;QACV,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,GAAqB,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IACnD,CAAC;IAEO,QAAQ,CAAC,GAAqB;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,YAAY;gBACf,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,KAAK,aAAa;gBAChB,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;gBACrB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM;YACR,KAAK,gBAAgB;gBACnB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM;YACR;gBACE,kDAAkD;gBAClD,MAAM;QACV,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,cAAc,CAAC,KAAqB;QAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC;QAChC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,OAAO,IAAI,OAAO;YAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,uDAAuD;QACvD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE;YAAE,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAA+B,EAAE;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,gCAAgC,EAAE,IAAI,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO;QAE1B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,EAAE;oBACd,uEAAuE;oBACvE,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC7C,IAAI,GAAG,KAAK,CAAC,CAAC;wBAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBAC/C,OAAO,EAAE,CAAC;gBACZ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,iBAAiB,CAAC,MAAM,IAAI,gCAAgC,EAAE,IAAI,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAEM,QAAQ,CAAC,IAAY;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC;IAC7C,CAAC;IAEM,YAAY,CAAC,IAAY;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,IAAI,KAAK,CAAC;IACjD,CAAC;IAEM,WAAW;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;OAEG;IACI,KAAK;QACV,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/esm/runtime.js

@@ -12,11 +12,18 @@ import { existsSync, openSync } from "node:fs";
 import { createRequire } from "node:module";
 import { createConnection } from "node:net";
 import { arch, homedir, platform } from "node:os";
-import { delimiter as PATH_DELIM, dirname, join } from "node:path";
+import { delimiter as PATH_DELIM, dirname, isAbsolute, join, resolve as resolvePath } from "node:path";
 import { cwd, env } from "node:process";
 export const BINARY_NAME = "aasm";
 export const DEFAULT_PORT = 7878;
 export const DEFAULT_RUNTIME_HOST = "127.0.0.1";
+/**
+ * Opt-in gate for spawning the `aasm` sidecar. Auto-start runs a binary
+ * discovered from `$PATH` / the filesystem, so it is a privileged side effect
+ * that must be explicitly enabled rather than triggered silently by every
+ * `initAssembly()` call. Set to `1`/`true`/`yes` to permit auto-start.
+ */
+export const ENV_AUTO_START = "AA_AUTO_START";
 export const USER_LOCAL_BIN = join(homedir(), ".local", "bin");
 export const DOCKER_BASE_BIN = "/usr/local/bin";
 export const RUNTIME_LOG_FILENAME = ".aasm-runtime.log";
@@ -93,6 +100,51 @@ export function isRunning(port = DEFAULT_PORT, host = DEFAULT_RUNTIME_HOST) {
         socket.once("error", () => settle(false));
     });
 }
+/** Truthy values that enable {@link ENV_AUTO_START}. */
+function autoStartEnabled() {
+    const raw = env[ENV_AUTO_START]?.trim().toLowerCase();
+    return raw === "1" || raw === "true" || raw === "yes";
+}
+/**
+ * Install roots an auto-started `aasm` binary is permitted to live in, in
+ * addition to the npm-bundled `node_modules/@agent-assembly/runtime-*` path
+ * (which is trusted because it ships with the SDK install). This blocks a
+ * `$PATH`-injected `./aasm` or a binary planted in an arbitrary writable
+ * directory from being spawned.
+ */
+function allowedInstallDirs() {
+    const home = homedir();
+    return [
+        "/usr/local/bin",
+        "/usr/bin",
+        "/opt/homebrew/bin",
+        USER_LOCAL_BIN,
+        join(home, ".cargo", "bin"),
+        "/usr/local/cargo/bin",
+        DOCKER_BASE_BIN,
+    ];
+}
+/**
+ * Throw `Error` unless `binaryPath` is safe to spawn: it must be absolute and
+ * either resolve inside an allow-listed install dir (see
+ * {@link allowedInstallDirs}) or be the npm-bundled runtime binary. This is the
+ * integrity gate for the auto-start subprocess — without it the SDK would
+ * execute whatever `aasm` happened to be first on `$PATH`.
+ */
+export function assertSafeBinaryPath(binaryPath) {
+    if (!isAbsolute(binaryPath)) {
+        throw new Error(`Refusing to auto-start a non-absolute 'aasm' path: ${binaryPath}`);
+    }
+    const resolved = resolvePath(binaryPath);
+    const bundled = bundledRuntimeBinaryPath();
+    if (bundled !== null && resolvePath(bundled) === resolved)
+        return;
+    const ok = allowedInstallDirs().some((dir) => resolved.startsWith(resolvePath(dir) + "/"));
+    if (!ok) {
+        throw new Error(`Refusing to auto-start 'aasm' from an untrusted location: ${resolved}. ` +
+            `Install it under one of: ${allowedInstallDirs().join(", ")}.`);
+    }
+}
 /**
  * Spawn `aasm serve --port <port>` as a detached background subprocess.
  *
@@ -119,20 +171,33 @@ export function startRuntime(binaryPath, port = DEFAULT_PORT, logDir = cwd()) {
  *  2. Resolve the binary via {@link findAasmBinary}.
  *  3. Spawn the sidecar via {@link startRuntime}.
  *
- * `agentId` is accepted to keep the ticket-specified signature stable;
- * actual register-and-connect is performed by the existing gateway-aware
- * `@agent-assembly/sdk` `initAssembly` once the sidecar is reachable.
+ * `_agentId` is accepted to keep the ticket-specified signature stable but is
+ * intentionally not consumed at this lifecycle layer; actual register-and-connect
+ * is performed by the existing gateway-aware `@agent-assembly/sdk` `initAssembly`
+ * once the sidecar is reachable.
+ *
+ * Auto-start is **opt-in**: when the sidecar is not already running, this
+ * throws unless `AA_AUTO_START` is enabled. When it does spawn, the resolved
+ * binary path is logged and integrity-checked via {@link assertSafeBinaryPath}.
  *
- * Throws `Error` with {@link INSTALL_HINT} when no binary is found.
+ * Throws `Error` with {@link INSTALL_HINT} when no binary is found, and a
+ * descriptive `Error` when auto-start is not opted in or the resolved binary
+ * fails the integrity check.
  */
-export async function initAssembly(agentId, port = DEFAULT_PORT) {
-    void agentId; // not consumed at the lifecycle layer; see jsdoc
+export async function initAssembly(_agentId, port = DEFAULT_PORT) {
     if (await isRunning(port))
         return;
+    if (!autoStartEnabled()) {
+        throw new Error(`No aasm sidecar running on port ${port} and auto-start is disabled. ` +
+            `Start it with 'aasm serve --port ${port}', or set ${ENV_AUTO_START}=1 ` +
+            "to allow the SDK to auto-start it.");
+    }
     const binary = findAasmBinary();
     if (binary === null) {
         throw new Error(INSTALL_HINT);
     }
+    assertSafeBinaryPath(binary);
+    console.info(`[agent-assembly] auto-starting aasm sidecar from ${binary}`);
     startRuntime(binary, port);
 }
 //# sourceMappingURL=runtime.js.map