@xenosystem/acp-agent 0.1.1

package/dist/process/providerProcessWorkspace.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Temp-workspace preparation/cleanup for the minimal supervisor (XACP-010).
+ *
+ * SCOPED FILESYSTEM EXCEPTION. This is the only file in the process/ layer that mutates the
+ * filesystem, and it does so ONLY to create and later remove a supervisor-OWNED temp directory.
+ * Rules (enforced below):
+ *   - it creates directories ONLY under `os.tmpdir()` or an explicit absolute `workspaceRoot`;
+ *   - it removes ONLY directories it created itself (tracked by an in-process token);
+ *   - it never deletes an override `cwd` it did not create, and never touches user paths.
+ *
+ * This is workspace hygiene for *cooperative* test/fixture processes. It is NOT a filesystem
+ * jail — a launched process can still read/write anywhere it has OS permission. See
+ * `MINIMAL_SUPERVISOR_ENFORCEMENT.filesystem = "not_enforced_against_hostile_process"`.
+ */
+export interface PreparedWorkspace {
+    /** Absolute path the child should use as cwd. */
+    path: string;
+    /** True only when this directory was created by the supervisor (and may be cleaned up). */
+    ownedBySupervisor: boolean;
+    /** Remove the directory — a no-op unless the supervisor created it. */
+    cleanup(): Promise<{
+        attempted: boolean;
+        succeeded: boolean;
+    }>;
+}
+/**
+ * Create a fresh supervisor-owned temp workspace. Used by tests/smokes that don't bring their
+ * own cwd. The directory lives under `root` (default `os.tmpdir()`), which must be absolute.
+ */
+export declare function createTempWorkspace(providerId: string, root?: string): Promise<PreparedWorkspace>;
+/**
+ * Wrap an externally-supplied absolute cwd. The supervisor did NOT create it, so cleanup is a
+ * no-op — we never delete a directory we didn't make.
+ */
+export declare function useExistingWorkspace(providerId: string, cwd: string): PreparedWorkspace;
+/** A redacted marker for diagnostics — never the raw personal path. */
+export declare function redactWorkspace(ws: PreparedWorkspace): string;
+//# sourceMappingURL=providerProcessWorkspace.d.ts.map

package/dist/process/providerProcessWorkspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerProcessWorkspace.d.ts","sourceRoot":"","sources":["../../src/process/providerProcessWorkspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,iBAAiB,EAAE,OAAO,CAAC;IAC3B,uEAAuE;IACvE,OAAO,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAChE;AAID;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkCvG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAevF;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,EAAE,EAAE,iBAAiB,GAAG,MAAM,CAE7D"}

package/dist/process/providerProcessWorkspace.js

@@ -0,0 +1,86 @@
+/**
+ * Temp-workspace preparation/cleanup for the minimal supervisor (XACP-010).
+ *
+ * SCOPED FILESYSTEM EXCEPTION. This is the only file in the process/ layer that mutates the
+ * filesystem, and it does so ONLY to create and later remove a supervisor-OWNED temp directory.
+ * Rules (enforced below):
+ *   - it creates directories ONLY under `os.tmpdir()` or an explicit absolute `workspaceRoot`;
+ *   - it removes ONLY directories it created itself (tracked by an in-process token);
+ *   - it never deletes an override `cwd` it did not create, and never touches user paths.
+ *
+ * This is workspace hygiene for *cooperative* test/fixture processes. It is NOT a filesystem
+ * jail — a launched process can still read/write anywhere it has OS permission. See
+ * `MINIMAL_SUPERVISOR_ENFORCEMENT.filesystem = "not_enforced_against_hostile_process"`.
+ */
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { ProviderProcessError } from "./providerProcessErrors.js";
+const PREFIX = "xeno-acp-supervisor-";
+/**
+ * Create a fresh supervisor-owned temp workspace. Used by tests/smokes that don't bring their
+ * own cwd. The directory lives under `root` (default `os.tmpdir()`), which must be absolute.
+ */
+export async function createTempWorkspace(providerId, root) {
+    const base = root ?? tmpdir();
+    if (!isAbsolute(base)) {
+        throw new ProviderProcessError({
+            code: "PROCESS_WORKSPACE_INVALID",
+            safeMessage: "workspace root must be an absolute path",
+            providerId,
+        });
+    }
+    let dir;
+    try {
+        dir = await mkdtemp(join(base, PREFIX));
+    }
+    catch {
+        throw new ProviderProcessError({
+            code: "PROCESS_WORKSPACE_INVALID",
+            safeMessage: "failed to create temp workspace",
+            providerId,
+        });
+    }
+    let cleaned = false;
+    return {
+        path: dir,
+        ownedBySupervisor: true,
+        async cleanup() {
+            if (cleaned)
+                return { attempted: false, succeeded: true };
+            cleaned = true;
+            try {
+                await rm(dir, { recursive: true, force: true });
+                return { attempted: true, succeeded: true };
+            }
+            catch {
+                return { attempted: true, succeeded: false };
+            }
+        },
+    };
+}
+/**
+ * Wrap an externally-supplied absolute cwd. The supervisor did NOT create it, so cleanup is a
+ * no-op — we never delete a directory we didn't make.
+ */
+export function useExistingWorkspace(providerId, cwd) {
+    if (!isAbsolute(cwd)) {
+        throw new ProviderProcessError({
+            code: "PROCESS_CWD_INVALID",
+            safeMessage: "cwd must be an absolute path",
+            providerId,
+        });
+    }
+    return {
+        path: cwd,
+        ownedBySupervisor: false,
+        async cleanup() {
+            return { attempted: false, succeeded: true };
+        },
+    };
+}
+/** A redacted marker for diagnostics — never the raw personal path. */
+export function redactWorkspace(ws) {
+    return ws.ownedBySupervisor ? "<supervisor-temp-workspace>" : "<configured-cwd>";
+}
+//# sourceMappingURL=providerProcessWorkspace.js.map

package/dist/process/providerProcessWorkspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerProcessWorkspace.js","sourceRoot":"","sources":["../../src/process/providerProcessWorkspace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAWlE,MAAM,MAAM,GAAG,sBAAsB,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB,EAAE,IAAa;IACzE,MAAM,IAAI,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,2BAA2B;YACjC,WAAW,EAAE,yCAAyC;YACtD,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,2BAA2B;YACjC,WAAW,EAAE,iCAAiC;YAC9C,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO;QACL,IAAI,EAAE,GAAG;QACT,iBAAiB,EAAE,IAAI;QACvB,KAAK,CAAC,OAAO;YACX,IAAI,OAAO;gBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC1D,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC9C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,GAAW;IAClE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,oBAAoB,CAAC;YAC7B,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,8BAA8B;YAC3C,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,IAAI,EAAE,GAAG;QACT,iBAAiB,EAAE,KAAK;QACxB,KAAK,CAAC,OAAO;YACX,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,EAAqB;IACnD,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACnF,CAAC"}

package/dist/providers/claudeLocalProvider.d.ts

@@ -0,0 +1,68 @@
+/**
+ * `claude-local` — the first XENO-authored adapter around a REAL local third-party CLI (XACP-021).
+ *
+ * It wraps the installed **Claude Code** CLI (`claude -p <prompt> --output-format stream-json
+ * --verbose`) and routes its native stream-json output through the SAME path every adapter uses:
+ * runnability gate (policy + manual approval) → sandbox context → minimal process supervisor
+ * (shell:false, clean env allowlist, isolated cwd, timeout) → `parseClaudeStreamJson` →
+ * `ProviderEvent` → ACP `session/update`.
+ *
+ * IMPORTANT scope/labelling:
+ *   - This is a **XENO-authored local adapter for the installed Claude CLI** — NOT "official Claude
+ *     ACP", NOT third-party ACP certification, NOT a production integration.
+ *   - `trustClass: third-party`; approval-gated (it never runs "just because it exists").
+ *   - It relies on the Claude CLI's OWN existing local auth (via a minimal env allowlist the caller
+ *     supplies, e.g. HOME/USERPROFILE/PATH) — this adapter never reads, stores, or logs secret
+ *     values, makes no direct network call, spawns nothing itself (the supervisor launches claude),
+ *     and grants no filesystem-write or terminal authority.
+ *   - The parent runner's per-session markers (e.g. `CLAUDECODE`) are NOT allowlisted, so Claude's
+ *     nested-session guard is naturally avoided.
+ */
+import type { ProviderCapabilitySet, ProviderDefinition, ProviderPromptRequest } from "./providerTypes.js";
+import type { RunnabilityInput } from "../config/providerRunnability.js";
+export declare const CLAUDE_LOCAL_ID = "claude-local";
+/** Default executable name (resolved on PATH by the supervisor's resolver). */
+export declare const CLAUDE_LOCAL_DEFAULT_EXECUTABLE = "claude";
+export declare const CLAUDE_LOCAL_CAPABILITIES: ProviderCapabilitySet;
+/** Minimal non-secret env keys the Claude CLI may need to find its own local auth/session. */
+export declare const CLAUDE_LOCAL_ENV_ALLOWLIST_KEYS: readonly ["PATH", "Path", "HOME", "USERPROFILE", "APPDATA", "LOCALAPPDATA", "SystemRoot", "windir", "TEMP", "TMP", "ComSpec", "PATHEXT", "XDG_CONFIG_HOME"];
+/** Parent-session / secret-bearing env keys that must never be forwarded to nested Claude. */
+export declare const CLAUDE_LOCAL_ENV_BLOCKLIST_KEYS: readonly ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_CODE_SSE_PORT", "*_API_KEY", "*_TOKEN", "*_SECRET"];
+/** Render the prompt content blocks into a single text prompt for the CLI. */
+export declare function renderPromptText(prompt: ProviderPromptRequest["prompt"], systemPrompt?: string): string;
+/**
+ * Build the real Claude CLI argv for a non-interactive, deterministic, tool-free turn.
+ * `--output-format stream-json --verbose` yields the event stream `parseClaudeStreamJson` reads.
+ */
+export declare function claudeLocalCommand(promptText: string, opts?: {
+    executable?: string;
+    model?: string;
+    argsPrefix?: string[];
+    continueSession?: boolean;
+    sessionId?: string;
+    resumeSessionId?: string;
+}): {
+    executable: string;
+    args: string[];
+};
+export declare function stableClaudeSessionUuid(acpSessionId: string): string;
+export interface ClaudeLocalOptions {
+    /** Runnability inputs (policy entry / approval) so the harness re-gates at run time. */
+    runnability?: RunnabilityInput;
+    /** Override the executable (tests inject a fake claude; live uses the resolved `claude`). */
+    executable?: string;
+    /** Prepended args (tests run `node fake-claude.mjs <claude-args>`; empty in production). */
+    argsPrefix?: string[];
+    /** Minimal env the CLI needs for ITS OWN auth (e.g. HOME/USERPROFILE/PATH). Never secrets. */
+    envAllowlist?: Record<string, string>;
+    cwd?: string;
+    model?: string;
+    timeoutMs?: number;
+}
+/**
+ * The `claude-local` provider definition: a REAL, enabled, **approval-gated**, third-party local
+ * adapter. `authRequirement`/`networkRequirement` are `required` (truthful), so the safety gate
+ * returns `requires_approval` — it never runs without a current, hash-pinned local approval.
+ */
+export declare function createClaudeLocalDefinition(): ProviderDefinition;
+//# sourceMappingURL=claudeLocalProvider.d.ts.map

package/dist/providers/claudeLocalProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeLocalProvider.d.ts","sourceRoot":"","sources":["../../src/providers/claudeLocalProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EAMtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAE9C,+EAA+E;AAC/E,eAAO,MAAM,+BAA+B,WAAW,CAAC;AAExD,eAAO,MAAM,yBAAyB,EAAE,qBAYvC,CAAC;AAYF,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,6JAclC,CAAC;AAEX,8FAA8F;AAC9F,eAAO,MAAM,+BAA+B,+GAOlC,CAAC;AAEX,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAQvG;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAO,GACjJ;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAiBxC;AAED,wBAAgB,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED,MAAM,WAAW,kBAAkB;IACjC,wFAAwF;IACxF,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAqED;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,kBAAkB,CAsChE"}

package/dist/providers/claudeLocalProvider.js

@@ -0,0 +1,217 @@
+/**
+ * `claude-local` — the first XENO-authored adapter around a REAL local third-party CLI (XACP-021).
+ *
+ * It wraps the installed **Claude Code** CLI (`claude -p <prompt> --output-format stream-json
+ * --verbose`) and routes its native stream-json output through the SAME path every adapter uses:
+ * runnability gate (policy + manual approval) → sandbox context → minimal process supervisor
+ * (shell:false, clean env allowlist, isolated cwd, timeout) → `parseClaudeStreamJson` →
+ * `ProviderEvent` → ACP `session/update`.
+ *
+ * IMPORTANT scope/labelling:
+ *   - This is a **XENO-authored local adapter for the installed Claude CLI** — NOT "official Claude
+ *     ACP", NOT third-party ACP certification, NOT a production integration.
+ *   - `trustClass: third-party`; approval-gated (it never runs "just because it exists").
+ *   - It relies on the Claude CLI's OWN existing local auth (via a minimal env allowlist the caller
+ *     supplies, e.g. HOME/USERPROFILE/PATH) — this adapter never reads, stores, or logs secret
+ *     values, makes no direct network call, spawns nothing itself (the supervisor launches claude),
+ *     and grants no filesystem-write or terminal authority.
+ *   - The parent runner's per-session markers (e.g. `CLAUDECODE`) are NOT allowlisted, so Claude's
+ *     nested-session guard is naturally avoided.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { runAdapterPrompt } from "../adapters/adapterProcessHarness.js";
+import { parseClaudeStreamJson } from "./claudeStreamJsonParser.js";
+import { ProviderConfigurationError } from "./providerErrors.js";
+import { staticModelDiscovery } from "./providerDiscovery.js";
+export const CLAUDE_LOCAL_ID = "claude-local";
+/** Default executable name (resolved on PATH by the supervisor's resolver). */
+export const CLAUDE_LOCAL_DEFAULT_EXECUTABLE = "claude";
+export const CLAUDE_LOCAL_CAPABILITIES = {
+    streamsText: true,
+    emitsPlan: false,
+    emitsToolCalls: true,
+    emitsUsage: true,
+    supportsCancel: true,
+    supportsMultipleSessions: true,
+    requiresAuth: true, // uses Claude CLI's OWN local auth (adapter stores no secrets)
+    usesNetwork: true, // Claude's normal cloud call
+    canReadFiles: false, // tools disabled for the harmless prompt; no fs authority granted
+    canWriteFiles: false,
+    canRunTerminal: false,
+};
+const CLAUDE_LOCAL_MODEL_DISCOVERY = staticModelDiscovery("Claude CLI model aliases from `claude --help`; the CLI resolves each alias to the latest available model.", [
+    { id: "sonnet", label: "Claude Sonnet", default: true, available: true, reason: null },
+    { id: "opus", label: "Claude Opus", default: false, available: true, reason: null },
+    { id: "fable", label: "Claude Fable", default: false, available: true, reason: null },
+], "sonnet");
+/** Minimal non-secret env keys the Claude CLI may need to find its own local auth/session. */
+export const CLAUDE_LOCAL_ENV_ALLOWLIST_KEYS = [
+    "PATH",
+    "Path",
+    "HOME",
+    "USERPROFILE",
+    "APPDATA",
+    "LOCALAPPDATA",
+    "SystemRoot",
+    "windir",
+    "TEMP",
+    "TMP",
+    "ComSpec",
+    "PATHEXT",
+    "XDG_CONFIG_HOME",
+];
+/** Parent-session / secret-bearing env keys that must never be forwarded to nested Claude. */
+export const CLAUDE_LOCAL_ENV_BLOCKLIST_KEYS = [
+    "CLAUDECODE",
+    "CLAUDE_CODE_ENTRYPOINT",
+    "CLAUDE_CODE_SSE_PORT",
+    "*_API_KEY",
+    "*_TOKEN",
+    "*_SECRET",
+];
+/** Render the prompt content blocks into a single text prompt for the CLI. */
+export function renderPromptText(prompt, systemPrompt) {
+    const promptText = prompt
+        .map((b) => (b && b.type === "text" && typeof b.text === "string" ? b.text : ""))
+        .filter((s) => s.length > 0)
+        .join("\n\n")
+        .trim();
+    const systemText = systemPrompt?.trim();
+    return systemText ? `<xeno_system_context>\n${systemText}\n</xeno_system_context>\n\nUser request:\n${promptText}`.trim() : promptText;
+}
+/**
+ * Build the real Claude CLI argv for a non-interactive, deterministic, tool-free turn.
+ * `--output-format stream-json --verbose` yields the event stream `parseClaudeStreamJson` reads.
+ */
+export function claudeLocalCommand(promptText, opts = {}) {
+    // `argsPrefix` lets a test drive a fake claude via `node fake-claude.mjs <claude-args>`; in
+    // production it is empty and the resolved `claude` executable receives only the claude flags.
+    const args = [
+        ...(opts.argsPrefix ?? []),
+        ...(opts.resumeSessionId ? ["--resume", opts.resumeSessionId] : opts.sessionId ? ["--session-id", opts.sessionId] : opts.continueSession ? ["--continue"] : []),
+        "--safe-mode",
+        "--tools",
+        "",
+        "-p",
+        promptText,
+        "--output-format",
+        "stream-json",
+        "--verbose",
+    ];
+    if (opts.model)
+        args.push("--model", opts.model);
+    return { executable: opts.executable ?? CLAUDE_LOCAL_DEFAULT_EXECUTABLE, args };
+}
+export function stableClaudeSessionUuid(acpSessionId) {
+    const hex = createHash("sha256").update(`xeno-acp:claude-local:${acpSessionId}`).digest("hex").slice(0, 32).split("");
+    hex[12] = "5";
+    hex[16] = ((parseInt(hex[16], 16) & 0x3) | 0x8).toString(16);
+    return `${hex.slice(0, 8).join("")}-${hex.slice(8, 12).join("")}-${hex.slice(12, 16).join("")}-${hex.slice(16, 20).join("")}-${hex.slice(20, 32).join("")}`;
+}
+class ClaudeLocalRuntime {
+    definition;
+    options;
+    sessionSeq = 0;
+    promptCount = 0;
+    nativeSessionIds = new Map();
+    completedSessions = new Set();
+    constructor(definition, config) {
+        this.definition = definition;
+        this.options = (config?.options ?? {});
+    }
+    initialize() { }
+    createSession() {
+        this.sessionSeq += 1;
+        return { sessionId: `${CLAUDE_LOCAL_ID}-session-${this.sessionSeq}`, createdAt: `s${this.sessionSeq}` };
+    }
+    cancel() {
+        /* cancellation flows via the prompt AbortSignal into the supervisor */
+    }
+    dispose() { }
+    diagnostics() {
+        return { provider: this.definition.id, sessionsCreated: this.sessionSeq, promptsRun: this.promptCount };
+    }
+    async prompt(request, ctx) {
+        this.promptCount += 1;
+        if (!this.options.runnability) {
+            throw new ProviderConfigurationError({
+                safeMessage: "claude-local requires runnability inputs (policy + approval) at runtime",
+                providerId: this.definition.id,
+            });
+        }
+        const promptText = renderPromptText(request.prompt, request.systemPrompt) || "Reply concisely.";
+        const nativeSessionId = this.nativeSessionIds.get(request.sessionId) ?? randomUUID();
+        this.nativeSessionIds.set(request.sessionId, nativeSessionId);
+        const shouldResume = this.completedSessions.has(request.sessionId);
+        const command = claudeLocalCommand(promptText, {
+            ...(this.options.executable ? { executable: this.options.executable } : {}),
+            ...(this.options.argsPrefix ? { argsPrefix: this.options.argsPrefix } : {}),
+            ...(request.model || this.options.model ? { model: request.model || this.options.model } : {}),
+            ...(shouldResume ? { resumeSessionId: nativeSessionId } : { sessionId: nativeSessionId }),
+        });
+        const harness = await runAdapterPrompt({
+            definition: this.definition,
+            runnability: this.options.runnability,
+            request,
+            adapter: command,
+            parseStdout: parseClaudeStreamJson,
+            signal: ctx.signal,
+            emit: ctx.emit,
+            // The CLI's own local auth needs a minimal, explicit, non-secret env (no ambient leak,
+            // no CLAUDECODE). Empty by default → a live run would fail closed (safe).
+            ...(this.options.envAllowlist ? { envAllowlist: this.options.envAllowlist } : {}),
+            // Real cloud round-trips are slower than the fixture default; allow more headroom.
+            ...(request.cwd || this.options.cwd ? { cwd: request.cwd || this.options.cwd } : {}),
+            timeoutMs: this.options.timeoutMs ?? 120_000,
+            stdoutLimitBytes: 256 * 1024,
+            stderrLimitBytes: 64 * 1024,
+        });
+        if (harness.result.disposition === "completed")
+            this.completedSessions.add(request.sessionId);
+        return harness.result;
+    }
+}
+/**
+ * The `claude-local` provider definition: a REAL, enabled, **approval-gated**, third-party local
+ * adapter. `authRequirement`/`networkRequirement` are `required` (truthful), so the safety gate
+ * returns `requires_approval` — it never runs without a current, hash-pinned local approval.
+ */
+export function createClaudeLocalDefinition() {
+    const definition = {
+        id: CLAUDE_LOCAL_ID,
+        displayName: "Claude CLI",
+        description: "XENO-authored local adapter for the installed Claude Code CLI (claude -p --output-format stream-json). Third-party, approval-gated; relies on the CLI's own local auth; no secret loading, no fs-write, no terminal.",
+        kind: "local-adapter",
+        trustClass: "third-party",
+        authRequirement: "required",
+        networkRequirement: "required",
+        ioAuthority: { filesystem: "none", terminal: "none" },
+        capabilities: CLAUDE_LOCAL_CAPABILITIES,
+        enabled: true,
+        metadata: {
+            acpEntrypoint: "adapter",
+            installedLocally: true,
+            displayAlias: "Claude CLI",
+            versionReadiness: {
+                status: "not_checked",
+                cliName: "claude",
+                installedVersion: null,
+                minimumKnownGoodVersion: "2.1.183",
+                versionCommand: ["claude", "--version"],
+                safeUpgradeHint: "Run `claude update` outside xeno-acp when the operator chooses to upgrade.",
+            },
+            streaming: {
+                mode: "buffered",
+                safeMessage: "claude-local currently buffers Claude stream-json output through the minimal supervisor before ACP updates are emitted.",
+            },
+            setupHints: ["Install/authenticate Claude CLI.", "Review policy.", "Approve provider.", "Run providers test.", "Certify from Hub if needed."],
+            note: "XACP-021 XENO-authored adapter around the installed Claude CLI; NOT official Claude ACP; NOT third-party certified.",
+        },
+        modelDiscovery: CLAUDE_LOCAL_MODEL_DISCOVERY,
+        createRuntime(config) {
+            return new ClaudeLocalRuntime(definition, config);
+        },
+    };
+    return definition;
+}
+//# sourceMappingURL=claudeLocalProvider.js.map

package/dist/providers/claudeLocalProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeLocalProvider.js","sourceRoot":"","sources":["../../src/providers/claudeLocalProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAa9D,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,QAAQ,CAAC;AAExD,MAAM,CAAC,MAAM,yBAAyB,GAA0B;IAC9D,WAAW,EAAE,IAAI;IACjB,SAAS,EAAE,KAAK;IAChB,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,IAAI;IAChB,cAAc,EAAE,IAAI;IACpB,wBAAwB,EAAE,IAAI;IAC9B,YAAY,EAAE,IAAI,EAAE,+DAA+D;IACnF,WAAW,EAAE,IAAI,EAAE,6BAA6B;IAChD,YAAY,EAAE,KAAK,EAAE,kEAAkE;IACvF,aAAa,EAAE,KAAK;IACpB,cAAc,EAAE,KAAK;CACtB,CAAC;AAEF,MAAM,4BAA4B,GAAG,oBAAoB,CACvD,2GAA2G,EAC3G;IACE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IACtF,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IACnF,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;CACtF,EACD,QAAQ,CACT,CAAC;AAEF,8FAA8F;AAC9F,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,MAAM;IACN,MAAM;IACN,MAAM;IACN,aAAa;IACb,SAAS;IACT,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,MAAM;IACN,KAAK;IACL,SAAS;IACT,SAAS;IACT,iBAAiB;CACT,CAAC;AAEX,8FAA8F;AAC9F,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC7C,YAAY;IACZ,wBAAwB;IACxB,sBAAsB;IACtB,WAAW;IACX,SAAS;IACT,UAAU;CACF,CAAC;AAEX,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,MAAuC,EAAE,YAAqB;IAC7F,MAAM,UAAU,GAAG,MAAM;SACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAChF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,IAAI,CAAC,MAAM,CAAC;SACZ,IAAI,EAAE,CAAC;IACV,MAAM,UAAU,GAAG,YAAY,EAAE,IAAI,EAAE,CAAC;IACxC,OAAO,UAAU,CAAC,CAAC,CAAC,0BAA0B,UAAU,8CAA8C,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AACzI,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,OAAgJ,EAAE;IAElJ,4FAA4F;IAC5F,8FAA8F;IAC9F,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/J,aAAa;QACb,SAAS;QACT,EAAE;QACF,IAAI;QACJ,UAAU;QACV,iBAAiB;QACjB,aAAa;QACb,WAAW;KACZ,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,+BAA+B,EAAE,IAAI,EAAE,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,YAAoB;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtH,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC;IACd,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAE,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9J,CAAC;AAgBD,MAAM,kBAAkB;IACb,UAAU,CAAqB;IACvB,OAAO,CAAqB;IACrC,UAAU,GAAG,CAAC,CAAC;IACf,WAAW,GAAG,CAAC,CAAC;IACP,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvD,YAAY,UAA8B,EAAE,MAA8B;QACxE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAuB,CAAC;IAC/D,CAAC;IAED,UAAU,KAAU,CAAC;IACrB,aAAa;QACX,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,OAAO,EAAE,SAAS,EAAE,GAAG,eAAe,YAAY,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;IAC1G,CAAC;IACD,MAAM;QACJ,uEAAuE;IACzE,CAAC;IACD,OAAO,KAAU,CAAC;IAClB,WAAW;QACT,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA8B,EAAE,GAA2B;QACtE,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC9B,MAAM,IAAI,0BAA0B,CAAC;gBACnC,WAAW,EAAE,yEAAyE;gBACtF,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,kBAAkB,CAAC;QAChG,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,UAAU,EAAE,CAAC;QACrF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,EAAE;YAC7C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;SAC1F,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,OAAO;YACP,OAAO,EAAE,OAAO;YAChB,WAAW,EAAE,qBAAqB;YAClC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,uFAAuF;YACvF,0EAA0E;YAC1E,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,mFAAmF;YACnF,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO;YAC5C,gBAAgB,EAAE,GAAG,GAAG,IAAI;YAC5B,gBAAgB,EAAE,EAAE,GAAG,IAAI;SAC5B,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9F,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,UAAU,GAAuB;QACrC,EAAE,EAAE,eAAe;QACnB,WAAW,EAAE,YAAY;QACzB,WAAW,EACT,sNAAsN;QACxN,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,aAAa;QACzB,eAAe,EAAE,UAAU;QAC3B,kBAAkB,EAAE,UAAU;QAC9B,WAAW,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;QACrD,YAAY,EAAE,yBAAyB;QACvC,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE;YACR,aAAa,EAAE,SAAS;YACxB,gBAAgB,EAAE,IAAI;YACtB,YAAY,EAAE,YAAY;YAC1B,gBAAgB,EAAE;gBAChB,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,QAAQ;gBACjB,gBAAgB,EAAE,IAAI;gBACtB,uBAAuB,EAAE,SAAS;gBAClC,cAAc,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;gBACvC,eAAe,EAAE,4EAA4E;aAC9F;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,UAAU;gBAChB,WAAW,EAAE,yHAAyH;aACvI;YACD,UAAU,EAAE,CAAC,kCAAkC,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,6BAA6B,CAAC;YAC7I,IAAI,EAAE,qHAAqH;SAC5H;QACD,cAAc,EAAE,4BAA4B;QAC5C,aAAa,CAAC,MAA8B;YAC1C,OAAO,IAAI,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/providers/claudeStreamJsonParser.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Parser for Claude Code's `--output-format stream-json --verbose` stdout (XACP-021).
+ *
+ * Claude Code emits newline-delimited JSON events. We map the relevant ones to normalized
+ * `ProviderEvent`s (the SAME model the ACP server consumes), so the real `claude` CLI flows
+ * through the existing supervisor → ProviderEvent → ACP path:
+ *
+ *   - `{"type":"assistant","message":{"content":[{"type":"text","text":...}|{"type":"tool_use",...}]}}`
+ *        → `message_delta` (per text block) / `tool_started` (per tool_use block)
+ *   - `{"type":"user","message":{"content":[{"type":"tool_result",...}]}}`
+ *        → `tool_completed` / `tool_failed`
+ *   - `{"type":"result","subtype":"success","is_error":false,"stop_reason":"end_turn","usage":{...}}`
+ *        → `usage` + `completed`
+ *   - `{"type":"result","is_error":true,...}` → `failed` (SAFE message; provider error text is NOT
+ *        echoed verbatim)
+ *   - `{"type":"system"|"rate_limit_event"|"user",...}` → counted as a diagnostic (not surfaced to
+ *        ACP)
+ *   - malformed / unknown lines → counted as a diagnostic; NEVER throws
+ *
+ * Pure function: no I/O, no network, no secrets. The model's answer text (a deliverable, not a
+ * secret) is passed through unredacted; provider error/diagnostic strings are not echoed.
+ */
+import { type ProviderEvent } from "./providerEvents.js";
+import type { ProviderErrorCode } from "./providerErrors.js";
+export interface ClaudeParseResult {
+    events: ProviderEvent[];
+    terminal: "completed" | "failed" | null;
+    failureCode?: ProviderErrorCode;
+    failureMessage?: string;
+    diagnosticsCount: number;
+}
+export interface ClaudeParseContext {
+    providerId: string;
+    sessionId: string;
+    requestId: string;
+    now: () => string;
+}
+export declare function parseClaudeStreamJson(stdout: string, ctx: ClaudeParseContext): ClaudeParseResult;
+//# sourceMappingURL=claudeStreamJsonParser.d.ts.map

package/dist/providers/claudeStreamJsonParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeStreamJsonParser.d.ts","sourceRoot":"","sources":["../../src/providers/claudeStreamJsonParser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,QAAQ,EAAE,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC;IACxC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,iBAAiB,CAyHhG"}