@xenosystem/acp-agent 0.1.1

package/dist/providers/providerEvents.js

@@ -0,0 +1,86 @@
+/**
+ * Normalized provider event model.
+ *
+ * Providers emit append-only `ProviderEvent`s; the ACP server maps the streamable ones to ACP
+ * `session/update` notifications (`providerEventToAcpUpdate`). Terminal events
+ * (`completed`/`cancelled`/`failed`) and `diagnostic` do NOT map to ACP updates — the prompt's
+ * disposition is the source of truth, and diagnostics go to stderr. A provider never writes to
+ * stdout and never executes a tool by itself.
+ */
+export function createEventFactory(opts) {
+    let seq = 0;
+    return {
+        next(kind, payload) {
+            seq += 1;
+            return {
+                eventId: `${opts.requestId}-evt-${seq}`,
+                providerId: opts.providerId,
+                sessionId: opts.sessionId,
+                requestId: opts.requestId,
+                timestamp: opts.now(),
+                kind,
+                payload,
+            };
+        },
+    };
+}
+/** Map a streamable provider event to an ACP `session/update` payload (or null). */
+export function providerEventToAcpUpdate(event) {
+    switch (event.kind) {
+        case "plan":
+            return { sessionUpdate: "plan", entries: event.payload.entries };
+        case "message_delta":
+            return {
+                sessionUpdate: "agent_message_chunk",
+                content: { type: "text", text: event.payload.text },
+            };
+        case "tool_started": {
+            const p = event.payload;
+            return {
+                sessionUpdate: "tool_call",
+                toolCallId: p.toolCallId,
+                title: p.title ?? p.toolCallId,
+                ...(p.kind ? { kind: p.kind } : {}),
+                status: "pending",
+            };
+        }
+        case "tool_updated": {
+            const p = event.payload;
+            return { sessionUpdate: "tool_call_update", toolCallId: p.toolCallId, status: p.status ?? "in_progress" };
+        }
+        case "tool_completed": {
+            const p = event.payload;
+            return {
+                sessionUpdate: "tool_call_update",
+                toolCallId: p.toolCallId,
+                status: "completed",
+                ...(p.outcome ? { _meta: { "xeno.dev": { outcome: p.outcome } } } : {}),
+            };
+        }
+        case "tool_failed": {
+            const p = event.payload;
+            return {
+                sessionUpdate: "tool_call_update",
+                toolCallId: p.toolCallId,
+                status: "failed",
+                ...(p.outcome ? { _meta: { "xeno.dev": { outcome: p.outcome } } } : {}),
+            };
+        }
+        case "usage": {
+            const p = event.payload;
+            return { sessionUpdate: "usage_update", used: p.used, size: p.size };
+        }
+        // Terminal + diagnostic events do not map to ACP session/update notifications.
+        case "completed":
+        case "cancelled":
+        case "failed":
+        case "diagnostic":
+        default:
+            return null;
+    }
+}
+/** True for the terminal event kinds (completed/cancelled/failed). */
+export function isTerminalEvent(kind) {
+    return kind === "completed" || kind === "cancelled" || kind === "failed";
+}
+//# sourceMappingURL=providerEvents.js.map

package/dist/providers/providerEvents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerEvents.js","sourceRoot":"","sources":["../../src/providers/providerEvents.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA6DH,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO;QACL,IAAI,CAAC,IAAI,EAAE,OAAO;YAChB,GAAG,IAAI,CAAC,CAAC;YACT,OAAO;gBACL,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,QAAQ,GAAG,EAAE;gBACvC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,IAAI;gBACJ,OAAO;aACR,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,KAAoB;IAC3D,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAG,KAAK,CAAC,OAAuB,CAAC,OAAO,EAAE,CAAC;QACpF,KAAK,eAAe;YAClB,OAAO;gBACL,aAAa,EAAE,qBAAqB;gBACpC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAG,KAAK,CAAC,OAA+B,CAAC,IAAI,EAAE;aAC7E,CAAC;QACJ,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAsB,CAAC;YACvC,OAAO;gBACL,aAAa,EAAE,WAAW;gBAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU;gBAC9B,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,MAAM,EAAE,SAAS;aAClB,CAAC;QACJ,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAsB,CAAC;YACvC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;QAC5G,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAsB,CAAC;YACvC,OAAO;gBACL,aAAa,EAAE,kBAAkB;gBACjC,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,MAAM,EAAE,WAAW;gBACnB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAsB,CAAC;YACvC,OAAO;gBACL,aAAa,EAAE,kBAAkB;gBACjC,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,MAAM,EAAE,QAAQ;gBAChB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAC;QACJ,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,CAAC,GAAG,KAAK,CAAC,OAAuB,CAAC;YACxC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,CAAC;QACD,+EAA+E;QAC/E,KAAK,WAAW,CAAC;QACjB,KAAK,WAAW,CAAC;QACjB,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY,CAAC;QAClB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,IAAuB;IACrD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,QAAQ,CAAC;AAC3E,CAAC"}

package/dist/providers/providerRegistry.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Internal provider registry for @xenosystem/acp-agent.
+ *
+ * Lists provider definitions, gates runnability through `validateProviderSafety`, and builds
+ * runtimes. The default registry includes the fixture plus approval-gated local adapters
+ * (`xeno-local`, `claude-local`, `codex-local`); base provider placeholders such as `codex`,
+ * `claude`, `gemini`, `opencode`, `kimi`, `glm`, and `hermes` remain disabled metadata until separately
+ * implemented. The registry never falls back to fixture for an unknown/blocked provider - it
+ * returns a safe error. It does NOT import or depend on XENO Hub.
+ */
+import { type SafetyResult } from "./providerSafety.js";
+import type { ProviderDefinition, ProviderRuntime, ProviderRuntimeConfig } from "./providerTypes.js";
+export declare class ProviderRegistry {
+    private readonly defs;
+    register(def: ProviderDefinition): this;
+    list(): ProviderDefinition[];
+    get(id: string): ProviderDefinition | undefined;
+    has(id: string): boolean;
+    safetyOf(id: string): SafetyResult | undefined;
+    /** A provider is runnable only if it is enabled AND passes the full capability gate. */
+    isRunnable(id: string): boolean;
+    /** Build a runtime, or throw a SAFE ProviderError (unknown / not-implemented / blocked). */
+    createRuntime(id: string, config?: ProviderRuntimeConfig): ProviderRuntime;
+}
+export declare function createPlaceholderDefinitions(): ProviderDefinition[];
+/**
+ * The default registry: the runnable fixture provider, the XENO-owned `xeno-local` adapter
+ * (XACP-014 — real but approval-gated), and the disabled third-party placeholders.
+ */
+export declare function createDefaultRegistry(): ProviderRegistry;
+//# sourceMappingURL=providerRegistry.d.ts.map

package/dist/providers/providerRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerRegistry.d.ts","sourceRoot":"","sources":["../../src/providers/providerRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAShF,OAAO,KAAK,EAEV,kBAAkB,EAGlB,eAAe,EACf,qBAAqB,EAEtB,MAAM,oBAAoB,CAAC;AAE5B,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyC;IAE9D,QAAQ,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI;IAKvC,IAAI,IAAI,kBAAkB,EAAE;IAG5B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAG/C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIxB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAK9C,wFAAwF;IACxF,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAK/B,4FAA4F;IAC5F,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe;CAuC3E;AAkID,wBAAgB,4BAA4B,IAAI,kBAAkB,EAAE,CAsBnE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,gBAAgB,CAQxD"}

package/dist/providers/providerRegistry.js

@@ -0,0 +1,234 @@
+/**
+ * Internal provider registry for @xenosystem/acp-agent.
+ *
+ * Lists provider definitions, gates runnability through `validateProviderSafety`, and builds
+ * runtimes. The default registry includes the fixture plus approval-gated local adapters
+ * (`xeno-local`, `claude-local`, `codex-local`); base provider placeholders such as `codex`,
+ * `claude`, `gemini`, `opencode`, `kimi`, `glm`, and `hermes` remain disabled metadata until separately
+ * implemented. The registry never falls back to fixture for an unknown/blocked provider - it
+ * returns a safe error. It does NOT import or depend on XENO Hub.
+ */
+import { ProviderNotImplementedError, ProviderSafetyViolationError, ProviderUnavailableError, } from "./providerErrors.js";
+import { validateProviderSafety } from "./providerSafety.js";
+import { createFixtureProviderDefinition } from "./fixtureProvider.js";
+import { createXenoLocalDefinition } from "./xenoLocalProvider.js";
+import { createClaudeLocalDefinition } from "./claudeLocalProvider.js";
+import { createCodexLocalDefinition } from "./codexLocalProvider.js";
+import { evaluateProviderSafety, isGateAllowed } from "../security/capabilityGate.js";
+import { applyPolicyToDefinition } from "../config/providerPolicyConfig.js";
+export class ProviderRegistry {
+    defs = new Map();
+    register(def) {
+        this.defs.set(def.id, def);
+        return this;
+    }
+    list() {
+        return [...this.defs.values()];
+    }
+    get(id) {
+        return this.defs.get(id);
+    }
+    has(id) {
+        return this.defs.has(id);
+    }
+    safetyOf(id) {
+        const def = this.defs.get(id);
+        return def ? validateProviderSafety(def) : undefined;
+    }
+    /** A provider is runnable only if it is enabled AND passes the full capability gate. */
+    isRunnable(id) {
+        const def = this.defs.get(id);
+        return Boolean(def && def.enabled && isGateAllowed(def));
+    }
+    /** Build a runtime, or throw a SAFE ProviderError (unknown / not-implemented / blocked). */
+    createRuntime(id, config) {
+        const def = this.defs.get(id);
+        if (!def) {
+            throw new ProviderUnavailableError({ safeMessage: `unknown provider: ${id}`, providerId: id });
+        }
+        if (!def.enabled) {
+            throw new ProviderNotImplementedError({
+                safeMessage: `provider '${id}' is not implemented (blocked)`,
+                providerId: id,
+            });
+        }
+        // Fail-closed capability gate — never bypassed by `enabled` alone. A definitively `blocked`
+        // provider can never build a runtime. A `requires_approval` provider (e.g. xeno-local,
+        // claude-local) MAY build a runtime — building is not running: the authoritative run-gate is
+        // the caller's `resolveProviderStatus` (definition + policy + approval) plus the harness
+        // re-check inside the runtime; neither lets it run without a current approval.
+        //
+        // XACP-022 fix: gate the EFFECTIVE definition — the caller's declared policy applied onto the
+        // definition — not the bare definition. A provider like `claude-local` declares
+        // `authRequirement/networkRequirement: required` but carries no auth/egress policy on the bare
+        // definition (the policy lives in the operator's config), so the bare definition gates as
+        // `blocked` (auth/egress required, no policy). That wrongly blocked runtime creation BEFORE the
+        // adapter could launch, even when a valid policy + current approval had been resolved. Applying
+        // the policy here makes the build-time gate see what the caller resolved; without a policy the
+        // bare definition is still gated (fail-closed).
+        const runnability = config?.options?.runnability;
+        const effectiveDef = runnability?.policyEntry ? applyPolicyToDefinition(def, runnability.policyEntry) : def;
+        const gate = evaluateProviderSafety(effectiveDef);
+        if (gate.overallDecision.status === "blocked") {
+            const hint = runnability?.policyEntry
+                ? gate.overallDecision.safeMessage
+                : `${gate.overallDecision.safeMessage} (no provider policy was applied — supply --provider-policy / runnability.policyEntry)`;
+            throw new ProviderSafetyViolationError({
+                safeMessage: `provider '${id}' is blocked: ${hint}`,
+                providerId: id,
+            });
+        }
+        return def.createRuntime(config);
+    }
+}
+/** High-authority capability profile used for the disabled real-agent placeholders. */
+const REAL_AGENT_CAPABILITIES = {
+    streamsText: true,
+    emitsPlan: true,
+    emitsToolCalls: true,
+    emitsUsage: true,
+    supportsCancel: true,
+    supportsMultipleSessions: true,
+    requiresAuth: true,
+    usesNetwork: true,
+    canReadFiles: true,
+    canWriteFiles: true,
+    canRunTerminal: true,
+};
+function authPolicyFor(secretId, label, kind) {
+    return {
+        requirement: "required",
+        allowedSecretRefs: [{ id: secretId, kind, label, required: true, redactionHint: "credential" }],
+        allowPlainEnv: false,
+        allowProcessEnv: false,
+        allowCredentialFiles: false,
+        allowInteractiveLogin: false,
+    };
+}
+function egressPolicyFor(host) {
+    return {
+        mode: "allowlist",
+        allowedHosts: [host],
+        blockedHosts: [],
+        allowLocalhost: false,
+        allowPrivateNetwork: false,
+        allowHttp: false,
+        allowHttps: true,
+        maxRedirects: 0,
+    };
+}
+/**
+ * Disabled, doc-only placeholders mirroring the XACP-004 candidate matrix, each carrying
+ * explicit (metadata-only) auth + egress policy + readiness. They are NEVER runnable — the
+ * capability gate blocks them as not-implemented; the policies exist only for diagnostics.
+ */
+const PLACEHOLDER_SPECS = [
+    {
+        id: "codex",
+        displayName: "Codex (via adapter)",
+        kind: "local-adapter",
+        secretId: "OPENAI_API_KEY",
+        secretLabel: "OpenAI / ChatGPT credential",
+        secretKind: "manual",
+        host: "api.openai.com",
+        metadata: { acpEntrypoint: "adapter", installedLocally: true, localReadiness: "base CLI installed; `codex exec --json` observed locally", note: "base codex CLI exposes MCP, not ACP; a future XENO-authored adapter would parse exec JSONL" },
+    },
+    {
+        id: "claude",
+        displayName: "Claude (via adapter)",
+        kind: "local-adapter",
+        secretId: "ANTHROPIC_API_KEY",
+        secretLabel: "Anthropic credential",
+        secretKind: "manual",
+        host: "api.anthropic.com",
+        metadata: { acpEntrypoint: "adapter", installedLocally: true, localReadiness: "base CLI installed (no native ACP)", note: "base claude CLI exposes MCP/print/stream-json, not ACP; requires an adapter" },
+    },
+    {
+        id: "gemini",
+        displayName: "Gemini ACP",
+        kind: "external-acp",
+        secretId: "GEMINI_API_KEY",
+        secretLabel: "Google / Gemini credential",
+        secretKind: "env",
+        host: "generativelanguage.googleapis.com",
+        metadata: { acpEntrypoint: "native", installedLocally: true, localReadiness: "native `gemini --acp` observed locally", note: "third-party; auth + network required" },
+    },
+    {
+        id: "opencode",
+        displayName: "OpenCode ACP",
+        kind: "external-acp",
+        secretId: "OPENCODE_PROVIDER_AUTH",
+        secretLabel: "OpenCode provider credential",
+        secretKind: "manual",
+        host: "opencode.ai",
+        metadata: { acpEntrypoint: "native", installedLocally: true, localReadiness: "native `opencode acp` observed locally", note: "third-party; provider auth + network required" },
+    },
+    {
+        id: "kimi",
+        displayName: "Kimi CLI ACP",
+        kind: "external-acp",
+        secretId: "KIMI_PROVIDER_AUTH",
+        secretLabel: "Kimi provider credential",
+        secretKind: "manual",
+        host: "api.moonshot.ai",
+        metadata: { acpEntrypoint: "native", installedLocally: false, localReadiness: "official docs expose native `kimi acp`; NOT verified locally", note: "third-party; provider auth + network required" },
+    },
+    {
+        id: "glm",
+        displayName: "GLM Agent ACP",
+        kind: "external-acp",
+        secretId: "Z_AI_API_KEY",
+        secretLabel: "Z.AI Coding Plan credential",
+        secretKind: "env",
+        host: "api.z.ai",
+        metadata: { acpEntrypoint: "native", installedLocally: false, localReadiness: "ACP Registry package `glm-acp-agent`; NOT verified locally", note: "third-party; Z.AI auth + network required" },
+    },
+    {
+        id: "hermes",
+        displayName: "Hermes ACP",
+        kind: "external-acp",
+        secretId: "HERMES_PROVIDER_AUTH",
+        secretLabel: "Hermes provider credential",
+        secretKind: "manual",
+        host: "hermes-agent.nousresearch.com",
+        metadata: { acpEntrypoint: "native", installedLocally: false, localReadiness: "native `hermes acp` upstream; NOT installed locally", note: "third-party; not installed; auth + network required" },
+    },
+];
+export function createPlaceholderDefinitions() {
+    return PLACEHOLDER_SPECS.map((s) => ({
+        id: s.id,
+        displayName: s.displayName,
+        description: `Placeholder for ${s.displayName}. NOT implemented (foundation/safety only).`,
+        kind: s.kind,
+        trustClass: "third-party",
+        authRequirement: "required",
+        networkRequirement: "required",
+        ioAuthority: { filesystem: "unknown", terminal: "unknown" },
+        capabilities: REAL_AGENT_CAPABILITIES,
+        enabled: false,
+        authPolicy: authPolicyFor(s.secretId, s.secretLabel, s.secretKind),
+        egressPolicy: egressPolicyFor(s.host),
+        metadata: s.metadata,
+        createRuntime() {
+            throw new ProviderNotImplementedError({
+                safeMessage: `provider '${s.id}' is not implemented (blocked)`,
+                providerId: s.id,
+            });
+        },
+    }));
+}
+/**
+ * The default registry: the runnable fixture provider, the XENO-owned `xeno-local` adapter
+ * (XACP-014 — real but approval-gated), and the disabled third-party placeholders.
+ */
+export function createDefaultRegistry() {
+    const registry = new ProviderRegistry();
+    registry.register(createFixtureProviderDefinition());
+    registry.register(createXenoLocalDefinition());
+    registry.register(createClaudeLocalDefinition());
+    registry.register(createCodexLocalDefinition());
+    for (const p of createPlaceholderDefinitions())
+        registry.register(p);
+    return registry;
+}
+//# sourceMappingURL=providerRegistry.js.map

package/dist/providers/providerRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerRegistry.js","sourceRoot":"","sources":["../../src/providers/providerRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAqB,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAa5E,MAAM,OAAO,gBAAgB;IACV,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE9D,QAAQ,CAAC,GAAuB;QAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,wFAAwF;IACxF,UAAU,CAAC,EAAU;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,4FAA4F;IAC5F,aAAa,CAAC,EAAU,EAAE,MAA8B;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,wBAAwB,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,2BAA2B,CAAC;gBACpC,WAAW,EAAE,aAAa,EAAE,gCAAgC;gBAC5D,UAAU,EAAE,EAAE;aACf,CAAC,CAAC;QACL,CAAC;QACD,4FAA4F;QAC5F,uFAAuF;QACvF,6FAA6F;QAC7F,yFAAyF;QACzF,+EAA+E;QAC/E,EAAE;QACF,8FAA8F;QAC9F,gFAAgF;QAChF,+FAA+F;QAC/F,0FAA0F;QAC1F,gGAAgG;QAChG,gGAAgG;QAChG,+FAA+F;QAC/F,gDAAgD;QAChD,MAAM,WAAW,GAAI,MAAM,EAAE,OAA0D,EAAE,WAAW,CAAC;QACrG,MAAM,YAAY,GAAG,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5G,MAAM,IAAI,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,WAAW,EAAE,WAAW;gBACnC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW;gBAClC,CAAC,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,wFAAwF,CAAC;YAChI,MAAM,IAAI,4BAA4B,CAAC;gBACrC,WAAW,EAAE,aAAa,EAAE,iBAAiB,IAAI,EAAE;gBACnD,UAAU,EAAE,EAAE;aACf,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,uBAAuB,GAA0B;IACrD,WAAW,EAAE,IAAI;IACjB,SAAS,EAAE,IAAI;IACf,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,IAAI;IAChB,cAAc,EAAE,IAAI;IACpB,wBAAwB,EAAE,IAAI;IAC9B,YAAY,EAAE,IAAI;IAClB,WAAW,EAAE,IAAI;IACjB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,IAAI;IACnB,cAAc,EAAE,IAAI;CACrB,CAAC;AAEF,SAAS,aAAa,CAAC,QAAgB,EAAE,KAAa,EAAE,IAAsB;IAC5E,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,iBAAiB,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;QAC/F,aAAa,EAAE,KAAK;QACpB,eAAe,EAAE,KAAK;QACtB,oBAAoB,EAAE,KAAK;QAC3B,qBAAqB,EAAE,KAAK;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,YAAY,EAAE,EAAE;QAChB,cAAc,EAAE,KAAK;QACrB,mBAAmB,EAAE,KAAK;QAC1B,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,CAAC;KAChB,CAAC;AACJ,CAAC;AAaD;;;;GAIG;AACH,MAAM,iBAAiB,GAAsB;IAC3C;QACE,EAAE,EAAE,OAAO;QACX,WAAW,EAAE,qBAAqB;QAClC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,6BAA6B;QAC1C,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,0DAA0D,EAAE,IAAI,EAAE,4FAA4F,EAAE;KAC/O;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,WAAW,EAAE,sBAAsB;QACnC,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,mBAAmB;QAC7B,WAAW,EAAE,sBAAsB;QACnC,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,oCAAoC,EAAE,IAAI,EAAE,6EAA6E,EAAE;KAC1M;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,WAAW,EAAE,YAAY;QACzB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,4BAA4B;QACzC,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,mCAAmC;QACzC,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,wCAAwC,EAAE,IAAI,EAAE,sCAAsC,EAAE;KACtK;IACD;QACE,EAAE,EAAE,UAAU;QACd,WAAW,EAAE,cAAc;QAC3B,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,wBAAwB;QAClC,WAAW,EAAE,8BAA8B;QAC3C,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,wCAAwC,EAAE,IAAI,EAAE,+CAA+C,EAAE;KAC/K;IACD;QACE,EAAE,EAAE,MAAM;QACV,WAAW,EAAE,cAAc;QAC3B,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,oBAAoB;QAC9B,WAAW,EAAE,0BAA0B;QACvC,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,8DAA8D,EAAE,IAAI,EAAE,+CAA+C,EAAE;KACtM;IACD;QACE,EAAE,EAAE,KAAK;QACT,WAAW,EAAE,eAAe;QAC5B,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,6BAA6B;QAC1C,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,4DAA4D,EAAE,IAAI,EAAE,2CAA2C,EAAE;KAChM;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,WAAW,EAAE,YAAY;QACzB,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,sBAAsB;QAChC,WAAW,EAAE,4BAA4B;QACzC,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,+BAA+B;QACrC,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,qDAAqD,EAAE,IAAI,EAAE,qDAAqD,EAAE;KACnM;CACF,CAAC;AAEF,MAAM,UAAU,4BAA4B;IAC1C,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,mBAAmB,CAAC,CAAC,WAAW,6CAA6C;QAC1F,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,UAAU,EAAE,aAA2B;QACvC,eAAe,EAAE,UAAU;QAC3B,kBAAkB,EAAE,UAAU;QAC9B,WAAW,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE;QAC3D,YAAY,EAAE,uBAAuB;QACrC,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC;QAClE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,aAAa;YACX,MAAM,IAAI,2BAA2B,CAAC;gBACpC,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,gCAAgC;gBAC9D,UAAU,EAAE,CAAC,CAAC,EAAE;aACjB,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,+BAA+B,EAAE,CAAC,CAAC;IACrD,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAC/C,QAAQ,CAAC,QAAQ,CAAC,2BAA2B,EAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,4BAA4B,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/providers/providerSafety.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Provider safety validation.
+ *
+ * Classifies a provider definition before it can be made runnable. The certified fixture
+ * endpoint (zero I/O authority, no auth, no network, XENO-owned) must classify `approved`.
+ * Any provider that needs auth/network or claims file-write/terminal authority (or unknown
+ * trust/IO) is blocked here until a future, explicitly-scoped milestone approves it.
+ */
+import type { ProviderDefinition } from "./providerTypes.js";
+export type SafetyClassification = "approved" | "blocked_auth_required" | "blocked_network_required" | "blocked_io_authority" | "blocked_unknown_trust" | "blocked_not_implemented";
+export interface SafetyResult {
+    classification: SafetyClassification;
+    reasons: string[];
+    approved: boolean;
+}
+export declare function validateProviderSafety(def: ProviderDefinition): SafetyResult;
+//# sourceMappingURL=providerSafety.d.ts.map

package/dist/providers/providerSafety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerSafety.d.ts","sourceRoot":"","sources":["../../src/providers/providerSafety.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,MAAM,oBAAoB,GAC5B,UAAU,GACV,uBAAuB,GACvB,0BAA0B,GAC1B,sBAAsB,GACtB,uBAAuB,GACvB,yBAAyB,CAAC;AAE9B,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,oBAAoB,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,GAAG,YAAY,CA+B5E"}

package/dist/providers/providerSafety.js

@@ -0,0 +1,36 @@
+/**
+ * Provider safety validation.
+ *
+ * Classifies a provider definition before it can be made runnable. The certified fixture
+ * endpoint (zero I/O authority, no auth, no network, XENO-owned) must classify `approved`.
+ * Any provider that needs auth/network or claims file-write/terminal authority (or unknown
+ * trust/IO) is blocked here until a future, explicitly-scoped milestone approves it.
+ */
+export function validateProviderSafety(def) {
+    const reasons = [];
+    if (!def.enabled) {
+        return block("blocked_not_implemented", ["provider is a placeholder / not implemented"]);
+    }
+    if (def.trustClass === "unknown") {
+        return block("blocked_unknown_trust", ["provider trust class is unknown"]);
+    }
+    if (def.authRequirement === "required" || def.capabilities.requiresAuth) {
+        return block("blocked_auth_required", ["provider requires authentication"]);
+    }
+    if (def.networkRequirement === "required" || def.capabilities.usesNetwork) {
+        return block("blocked_network_required", ["provider requires network access"]);
+    }
+    if (def.capabilities.canWriteFiles ||
+        def.capabilities.canRunTerminal ||
+        def.ioAuthority.filesystem === "unknown" ||
+        def.ioAuthority.terminal === "unknown") {
+        return block("blocked_io_authority", [
+            "provider claims file-write/terminal authority or unknown I/O authority",
+        ]);
+    }
+    return { classification: "approved", reasons, approved: true };
+    function block(classification, rs) {
+        return { classification, reasons: rs, approved: false };
+    }
+}
+//# sourceMappingURL=providerSafety.js.map

package/dist/providers/providerSafety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerSafety.js","sourceRoot":"","sources":["../../src/providers/providerSafety.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAkBH,MAAM,UAAU,sBAAsB,CAAC,GAAuB;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC,yBAAyB,EAAE,CAAC,6CAA6C,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC,uBAAuB,EAAE,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,CAAC,eAAe,KAAK,UAAU,IAAI,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC,uBAAuB,EAAE,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,kBAAkB,KAAK,UAAU,IAAI,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;QAC1E,OAAO,KAAK,CAAC,0BAA0B,EAAE,CAAC,kCAAkC,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IACE,GAAG,CAAC,YAAY,CAAC,aAAa;QAC9B,GAAG,CAAC,YAAY,CAAC,cAAc;QAC/B,GAAG,CAAC,WAAW,CAAC,UAAU,KAAK,SAAS;QACxC,GAAG,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS,EACtC,CAAC;QACD,OAAO,KAAK,CAAC,sBAAsB,EAAE;YACnC,wEAAwE;SACzE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAE/D,SAAS,KAAK,CAAC,cAAoC,EAAE,EAAY;QAC/D,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC"}

package/dist/providers/providerTypes.d.ts

@@ -0,0 +1,212 @@
+/**
+ * Provider adapter contract for @xenosystem/acp-agent (XACP-005 foundation).
+ *
+ * A *provider* produces an agent's response. The fixture provider is the only IMPLEMENTED
+ * provider in XACP-005 — this file defines the contract that future Codex/Claude/Gemini/
+ * OpenCode/Hermes/XENO-authored adapters will implement, so they can be added cleanly,
+ * safely, and testably WITHOUT mixing real-provider risk into the certified fixture endpoint.
+ *
+ * The contract is protocol-neutral: providers emit normalized `ProviderEvent`s (see
+ * providerEvents.ts); the ACP server maps those to ACP `session/update` notifications. A
+ * provider NEVER writes to stdout and NEVER executes tools/fs/terminal/network itself in
+ * XACP-005. The contract does NOT depend on XENO Hub.
+ */
+import type { ProviderEvent } from "./providerEvents.js";
+import type { ProviderError } from "./providerErrors.js";
+import type { ProviderAuthPolicy, ProviderEgressPolicy } from "../security/securityTypes.js";
+import type { ProviderSandboxContext } from "../sandbox/providerSandboxTypes.js";
+export type ProviderKind = "fixture" | "local-adapter" | "external-acp" | "gateway";
+export type TrustClass = "xeno-owned" | "third-party" | "unknown";
+export type Requirement = "none" | "optional" | "required";
+export type IoAuthorityLevel = "none" | "workspace-scoped" | "unknown";
+/** Declared capabilities of a provider (used for safety classification + diagnostics). */
+export interface ProviderCapabilitySet {
+    streamsText: boolean;
+    emitsPlan: boolean;
+    emitsToolCalls: boolean;
+    emitsUsage: boolean;
+    supportsCancel: boolean;
+    supportsMultipleSessions: boolean;
+    requiresAuth: boolean;
+    usesNetwork: boolean;
+    canReadFiles: boolean;
+    canWriteFiles: boolean;
+    canRunTerminal: boolean;
+}
+export interface ProviderIoAuthority {
+    filesystem: IoAuthorityLevel;
+    terminal: IoAuthorityLevel;
+}
+export interface ProviderRuntimeConfig {
+    /** Provider-specific options (e.g. fixture's delayMs/fail/stderrTest). */
+    options?: Record<string, unknown>;
+    /** Diagnostic logger (stderr only — never stdout). */
+    log?: (message: string) => void;
+}
+export interface ProviderSession {
+    sessionId: string;
+    createdAt: string;
+}
+export interface ProviderPromptRequest {
+    sessionId: string;
+    requestId: string;
+    model?: string;
+    cwd?: string;
+    additionalDirectories?: string[];
+    systemPrompt?: string;
+    prompt: Array<{
+        type: string;
+        text?: string;
+    }>;
+}
+export type ProviderDisposition = "completed" | "cancelled" | "failed";
+export interface ProviderUsage {
+    inputTokens?: number;
+    outputTokens?: number;
+    totalTokens?: number;
+}
+export interface ProviderPromptResult {
+    disposition: ProviderDisposition;
+    usage?: ProviderUsage;
+    /** Present when disposition === "failed"; carries a safe message. */
+    error?: ProviderError;
+}
+export interface ProviderHostChooseDirectoryRequest {
+    title?: string;
+    /** Correlates the host request with a provider-authored tool lifecycle. */
+    toolCallId?: string;
+}
+export interface ProviderHostChooseDirectoryResponse {
+    path?: string;
+    cancelled?: boolean;
+    timedOut?: boolean;
+    error?: string;
+}
+export interface ProviderHostChooseWorkspacePlacementRequest {
+    directory: string;
+    title?: string;
+    /** Correlates the host request with a provider-authored tool lifecycle. */
+    toolCallId?: string;
+}
+export interface ProviderHostChooseWorkspacePlacementResponse {
+    choice?: "inbox" | "reuse" | "create";
+    directory?: string;
+    workspaceName?: string;
+    result?: string;
+    cancelled?: boolean;
+    timedOut?: boolean;
+    error?: string;
+}
+export interface ProviderHostContext {
+    /**
+     * Ask the ACP client to open its trusted directory picker and return the selected path.
+     * This is a client-mediated request, not provider-side filesystem or shell authority.
+     */
+    chooseDirectory(request?: ProviderHostChooseDirectoryRequest): Promise<ProviderHostChooseDirectoryResponse>;
+    /**
+     * Ask the ACP client how to place a selected conversation folder in XENO Hub.
+     * This is a separate client-mediated operation that runs after directory selection.
+     */
+    chooseWorkspacePlacement(request: ProviderHostChooseWorkspacePlacementRequest): Promise<ProviderHostChooseWorkspacePlacementResponse>;
+}
+export interface ProviderRuntimeContext {
+    /** Emit a normalized provider event (the server maps it to an ACP update). */
+    emit: (event: ProviderEvent) => void;
+    /** Aborts when the client cancels this prompt. */
+    signal: AbortSignal;
+    /** Diagnostic logging (stderr only). */
+    log: (message: string) => void;
+    /**
+     * The runtime enforcement boundary (XACP-008). Provided by the ACP server for a runnable
+     * provider; a real adapter accesses network/secrets/fs/terminal ONLY through this (all
+     * deny-by-default). Optional so in-process unit tests can omit it; the fixture ignores it.
+     */
+    sandbox?: ProviderSandboxContext;
+    /** Optional client-mediated host helpers exposed by XENO ACP extensions. */
+    host?: ProviderHostContext;
+}
+/** A live provider instance. One per agent process; sessions/prompts run against it. */
+export interface ProviderRuntime {
+    readonly definition: ProviderDefinition;
+    initialize(): Promise<void> | void;
+    createSession(): ProviderSession;
+    prompt(request: ProviderPromptRequest, ctx: ProviderRuntimeContext): Promise<ProviderPromptResult>;
+    cancel(sessionId: string): void;
+    dispose(): Promise<void> | void;
+    diagnostics(): Record<string, unknown>;
+}
+/** Declarative description of a provider + a factory for its runtime. */
+export interface ProviderDefinition {
+    id: string;
+    displayName: string;
+    description: string;
+    kind: ProviderKind;
+    trustClass: TrustClass;
+    authRequirement: Requirement;
+    networkRequirement: Requirement;
+    ioAuthority: ProviderIoAuthority;
+    capabilities: ProviderCapabilitySet;
+    /** Whether this provider is implemented & runnable. Placeholders are `false`. */
+    enabled: boolean;
+    /** Declared auth policy (metadata; XACP-006). Absent → fail-closed if auth is required. */
+    authPolicy?: ProviderAuthPolicy;
+    /** Declared egress policy (metadata; XACP-006). Absent → fail-closed if network is required. */
+    egressPolicy?: ProviderEgressPolicy;
+    /** Non-security descriptive metadata (from the XACP-004 readiness matrix). */
+    metadata?: ProviderMetadata;
+    /** Provider-owned model/default discovery metadata. Downstream UIs must not hardcode this. */
+    modelDiscovery?: ProviderModelDiscovery;
+    /** Build a runtime. MUST throw a `ProviderError` if the provider is not enabled. */
+    createRuntime(config?: ProviderRuntimeConfig): ProviderRuntime;
+}
+export interface ProviderMetadata {
+    acpEntrypoint?: "native" | "adapter" | "none";
+    installedLocally?: boolean;
+    localReadiness?: string;
+    note?: string;
+    /** Optional UI-safe alias for persisted or technical ids. */
+    displayAlias?: string;
+    /** Safe CLI version/readiness metadata; never includes account, path, or secret values. */
+    versionReadiness?: ProviderVersionReadiness;
+    /** Honest stream behavior for UIs that want to promise live token/tool progress. */
+    streaming?: ProviderStreamingMetadata;
+    /** Short safe next-step hints for setup surfaces. */
+    setupHints?: string[];
+}
+export type ProviderModelDiscoveryStatus = "available" | "default_only" | "blocked" | "unavailable";
+export type ProviderModelDiscoverySource = "provider_cli" | "adapter_static" | "operator_config" | "none";
+export interface ProviderModelChoice {
+    id: string;
+    label: string;
+    default: boolean;
+    available: boolean;
+    reason: string | null;
+}
+export interface ProviderModelDiscovery {
+    status: ProviderModelDiscoveryStatus;
+    source: ProviderModelDiscoverySource;
+    defaultModelId: string | null;
+    allowCustomModel: boolean;
+    models: ProviderModelChoice[];
+    safeMessage: string;
+}
+export interface ProviderVersionReadiness {
+    status: "not_checked" | "known_good" | "upgrade_recommended" | "not_installed" | "unknown";
+    cliName?: string;
+    installedVersion?: string | null;
+    minimumKnownGoodVersion?: string | null;
+    versionCommand?: string[];
+    safeUpgradeHint?: string;
+}
+export interface ProviderStreamingMetadata {
+    mode: "streaming" | "buffered" | "none";
+    safeMessage: string;
+}
+/** A provider safety profile is derived from a definition (see providerSafety.ts). */
+export interface ProviderSafetyProfile {
+    providerId: string;
+    trustClass: TrustClass;
+    capabilities: ProviderCapabilitySet;
+    ioAuthority: ProviderIoAuthority;
+}
+//# sourceMappingURL=providerTypes.d.ts.map