@xenosystem/acp-agent 0.1.1

package/dist/providers/providerTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerTypes.d.ts","sourceRoot":"","sources":["../../src/providers/providerTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAC7F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAEjF,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,eAAe,GAAG,cAAc,GAAG,SAAS,CAAC;AACpF,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,aAAa,GAAG,SAAS,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAC3D,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;AAEvE,0FAA0F;AAC1F,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,wBAAwB,EAAE,OAAO,CAAC;IAClC,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,sDAAsD;IACtD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAED,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEvE,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,mBAAmB,CAAC;IACjC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,qEAAqE;IACrE,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,kCAAkC;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mCAAmC;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,2CAA2C;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4CAA4C;IAC3D,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,eAAe,CAAC,OAAO,CAAC,EAAE,kCAAkC,GAAG,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAC5G;;;OAGG;IACH,wBAAwB,CACtB,OAAO,EAAE,2CAA2C,GACnD,OAAO,CAAC,4CAA4C,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,sBAAsB;IACrC,8EAA8E;IAC9E,IAAI,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IACrC,kDAAkD;IAClD,MAAM,EAAE,WAAW,CAAC;IACpB,wCAAwC;IACxC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B;;;;OAIG;IACH,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,mBAAmB,CAAC;CAC5B;AAED,wFAAwF;AACxF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnC,aAAa,IAAI,eAAe,CAAC;IACjC,MAAM,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnG,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,eAAe,EAAE,WAAW,CAAC;IAC7B,kBAAkB,EAAE,WAAW,CAAC;IAChC,WAAW,EAAE,mBAAmB,CAAC;IACjC,YAAY,EAAE,qBAAqB,CAAC;IACpC,iFAAiF;IACjF,OAAO,EAAE,OAAO,CAAC;IACjB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,gGAAgG;IAChG,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,8FAA8F;IAC9F,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,oFAAoF;IACpF,aAAa,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAAC;CAChE;AAED,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IAC9C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2FAA2F;IAC3F,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;IAC5C,oFAAoF;IACpF,SAAS,CAAC,EAAE,yBAAyB,CAAC;IACtC,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,4BAA4B,GAAG,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,aAAa,CAAC;AACpG,MAAM,MAAM,4BAA4B,GAAG,cAAc,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,MAAM,CAAC;AAE1G,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,4BAA4B,CAAC;IACrC,MAAM,EAAE,4BAA4B,CAAC;IACrC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,qBAAqB,GAAG,eAAe,GAAG,SAAS,CAAC;IAC3F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,qBAAqB,CAAC;IACpC,WAAW,EAAE,mBAAmB,CAAC;CAClC"}

package/dist/providers/providerTypes.js

@@ -0,0 +1,15 @@
+/**
+ * Provider adapter contract for @xenosystem/acp-agent (XACP-005 foundation).
+ *
+ * A *provider* produces an agent's response. The fixture provider is the only IMPLEMENTED
+ * provider in XACP-005 — this file defines the contract that future Codex/Claude/Gemini/
+ * OpenCode/Hermes/XENO-authored adapters will implement, so they can be added cleanly,
+ * safely, and testably WITHOUT mixing real-provider risk into the certified fixture endpoint.
+ *
+ * The contract is protocol-neutral: providers emit normalized `ProviderEvent`s (see
+ * providerEvents.ts); the ACP server maps those to ACP `session/update` notifications. A
+ * provider NEVER writes to stdout and NEVER executes tools/fs/terminal/network itself in
+ * XACP-005. The contract does NOT depend on XENO Hub.
+ */
+export {};
+//# sourceMappingURL=providerTypes.js.map

package/dist/providers/providerTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerTypes.js","sourceRoot":"","sources":["../../src/providers/providerTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/providers/xenoLocalProvider.d.ts

@@ -0,0 +1,35 @@
+/**
+ * `xeno-local` — the FIRST real (non-fixture) provider adapter (XACP-014 spike).
+ *
+ * It is a XENO-OWNED, deterministic, LOCAL cooperative adapter. It is NOT a third-party provider
+ * and NOT Codex/Claude/Gemini/OpenCode/Kimi/GLM/Hermes. It proves the real provider-adapter path end to
+ * end through the FROZEN v1 contract: definition → policy → approval → safety gate → sandbox →
+ * minimal process supervisor → adapter stdout protocol → ProviderEvent → ACP session/update.
+ *
+ * It has NO auth, NO network, NO filesystem-write, NO terminal authority. It declares
+ * `filesystem: workspace-scoped` truthfully (its process runs in a supervisor-owned temp
+ * workspace), which routes it through the manual-approval gate — so it never runs "just because
+ * it exists". The runtime delegates to the XACP-011 harness (`runAdapterPrompt`); the adapter
+ * process is `node <cli.js> adapter --provider xeno-local` (this package's own source).
+ */
+import type { ProviderCapabilitySet, ProviderDefinition } from "./providerTypes.js";
+export declare const XENO_LOCAL_ID = "xeno-local";
+export declare const XENO_LOCAL_FINAL_TEXT = "XENO Local Adapter completed the request through the v1 provider runtime contract.";
+export declare const XENO_LOCAL_CAPABILITIES: ProviderCapabilitySet;
+export type XenoLocalMode = "normal" | "delayed" | "failed" | "malformed" | "stderr-secret";
+/**
+ * The deterministic adapter PROCESS output: emit v1 protocol JSON lines via `write`. This is the
+ * body of `cli.js adapter --provider xeno-local`. stdout = protocol only; no network/secrets/fs.
+ */
+export declare function emitXenoLocalStream(write: (line: string) => void, opts?: {
+    mode?: XenoLocalMode;
+    requestId?: string;
+}): void;
+/** The canonical adapter PROCESS command for a given request/mode (no shell; argv only). */
+export declare function xenoLocalAdapterCommand(requestId: string, mode?: XenoLocalMode): {
+    executable: string;
+    args: string[];
+};
+/** The XENO-owned `xeno-local` provider definition (a REAL, enabled, approval-gated provider). */
+export declare function createXenoLocalDefinition(): ProviderDefinition;
+//# sourceMappingURL=xenoLocalProvider.d.ts.map

package/dist/providers/xenoLocalProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xenoLocalProvider.d.ts","sourceRoot":"","sources":["../../src/providers/xenoLocalProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAOnB,MAAM,oBAAoB,CAAC;AAG5B,eAAO,MAAM,aAAa,eAAe,CAAC;AAC1C,eAAO,MAAM,qBAAqB,uFACoD,CAAC;AAEvF,eAAO,MAAM,uBAAuB,EAAE,qBAYrC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,eAAe,CAAC;AAE5F;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC7B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,aAAa,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACtD,IAAI,CAuCN;AAED,4FAA4F;AAC5F,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,aAAwB,GAAG;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB,CAGA;AAwDD,kGAAkG;AAClG,wBAAgB,yBAAyB,IAAI,kBAAkB,CAuC9D"}

package/dist/providers/xenoLocalProvider.js

@@ -0,0 +1,159 @@
+/**
+ * `xeno-local` — the FIRST real (non-fixture) provider adapter (XACP-014 spike).
+ *
+ * It is a XENO-OWNED, deterministic, LOCAL cooperative adapter. It is NOT a third-party provider
+ * and NOT Codex/Claude/Gemini/OpenCode/Kimi/GLM/Hermes. It proves the real provider-adapter path end to
+ * end through the FROZEN v1 contract: definition → policy → approval → safety gate → sandbox →
+ * minimal process supervisor → adapter stdout protocol → ProviderEvent → ACP session/update.
+ *
+ * It has NO auth, NO network, NO filesystem-write, NO terminal authority. It declares
+ * `filesystem: workspace-scoped` truthfully (its process runs in a supervisor-owned temp
+ * workspace), which routes it through the manual-approval gate — so it never runs "just because
+ * it exists". The runtime delegates to the XACP-011 harness (`runAdapterPrompt`); the adapter
+ * process is `node <cli.js> adapter --provider xeno-local` (this package's own source).
+ */
+import { fileURLToPath } from "node:url";
+import { runAdapterPrompt } from "../adapters/adapterProcessHarness.js";
+import { ProviderConfigurationError } from "./providerErrors.js";
+import { staticModelDiscovery } from "./providerDiscovery.js";
+export const XENO_LOCAL_ID = "xeno-local";
+export const XENO_LOCAL_FINAL_TEXT = "XENO Local Adapter completed the request through the v1 provider runtime contract.";
+export const XENO_LOCAL_CAPABILITIES = {
+    streamsText: true,
+    emitsPlan: true,
+    emitsToolCalls: true,
+    emitsUsage: true,
+    supportsCancel: true,
+    supportsMultipleSessions: true,
+    requiresAuth: false,
+    usesNetwork: false,
+    canReadFiles: true, // within the supervisor-owned temp workspace (honest → requires approval)
+    canWriteFiles: false,
+    canRunTerminal: false,
+};
+/**
+ * The deterministic adapter PROCESS output: emit v1 protocol JSON lines via `write`. This is the
+ * body of `cli.js adapter --provider xeno-local`. stdout = protocol only; no network/secrets/fs.
+ */
+export function emitXenoLocalStream(write, opts = {}) {
+    const mode = opts.mode ?? "normal";
+    const requestId = opts.requestId ?? "xeno-local-req";
+    let seq = 0;
+    const emit = (payload) => {
+        seq += 1;
+        write(JSON.stringify({ version: 1, eventId: `${requestId}-evt-${seq}`, timestamp: `t${seq}`, requestId, ...payload }) +
+            "\n");
+    };
+    if (mode === "malformed") {
+        emit({ type: "message_delta", text: "valid line" });
+        write("THIS IS NOT JSON\n");
+        return;
+    }
+    if (mode === "stderr-secret") {
+        // FAKE token to stderr (handled by the caller); stdout stays clean.
+        process.stderr.write("[xeno-local-adapter] debug token: sk-XENOLOCALFAKEKEY0000000000000000\n");
+        emit({ type: "message_delta", text: "normal visible output" });
+        emit({ type: "completed", stopReason: "end_turn" });
+        return;
+    }
+    if (mode === "failed") {
+        emit({ type: "message_delta", text: "partial output before failure" });
+        emit({ type: "failed", message: "xeno-local adapter failure (deterministic)" });
+        return;
+    }
+    // normal + delayed share the full deterministic stream.
+    emit({ type: "plan", entries: [{ content: "Interpret the request", priority: "high", status: "completed" }] });
+    emit({ type: "message_delta", text: "XENO Local Adapter " });
+    emit({ type: "message_delta", text: "processed the request deterministically. " });
+    emit({ type: "message_delta", text: XENO_LOCAL_FINAL_TEXT });
+    emit({ type: "tool_started", toolCallId: "xeno-local-1", title: "Local inspection", kind: "read" });
+    emit({ type: "tool_completed", toolCallId: "xeno-local-1" });
+    emit({ type: "usage", used: 9, size: 1000 });
+    emit({ type: "completed", stopReason: "end_turn" });
+}
+/** The canonical adapter PROCESS command for a given request/mode (no shell; argv only). */
+export function xenoLocalAdapterCommand(requestId, mode = "normal") {
+    const cli = fileURLToPath(new URL("../cli.js", import.meta.url));
+    return { executable: process.execPath, args: [cli, "adapter", "--provider", XENO_LOCAL_ID, "--mode", mode, "--request-id", requestId] };
+}
+class XenoLocalRuntime {
+    definition;
+    options;
+    sessionSeq = 0;
+    promptCount = 0;
+    constructor(definition, config) {
+        this.definition = definition;
+        this.options = (config?.options ?? {});
+    }
+    initialize() { }
+    createSession() {
+        this.sessionSeq += 1;
+        return { sessionId: `${XENO_LOCAL_ID}-session-${this.sessionSeq}`, createdAt: `s${this.sessionSeq}` };
+    }
+    cancel() {
+        /* cancellation flows via the prompt AbortSignal into the supervisor */
+    }
+    dispose() { }
+    diagnostics() {
+        return { provider: this.definition.id, sessionsCreated: this.sessionSeq, promptsRun: this.promptCount };
+    }
+    async prompt(request, ctx) {
+        this.promptCount += 1;
+        if (!this.options.runnability) {
+            // Fail closed: the harness must be able to re-verify runnability (policy + approval).
+            throw new ProviderConfigurationError({
+                safeMessage: "xeno-local requires runnability inputs (policy + approval) at runtime",
+                providerId: this.definition.id,
+            });
+        }
+        const mode = this.options.mode ?? "normal";
+        const harness = await runAdapterPrompt({
+            definition: this.definition,
+            runnability: this.options.runnability,
+            request,
+            adapter: xenoLocalAdapterCommand(request.requestId, mode),
+            signal: ctx.signal,
+            emit: ctx.emit,
+            ...(this.options.timeoutMs !== undefined ? { timeoutMs: this.options.timeoutMs } : {}),
+        });
+        return harness.result;
+    }
+}
+/** The XENO-owned `xeno-local` provider definition (a REAL, enabled, approval-gated provider). */
+export function createXenoLocalDefinition() {
+    const definition = {
+        id: XENO_LOCAL_ID,
+        displayName: "XENO Local Adapter",
+        description: "Deterministic XENO-owned local adapter proving the real provider-adapter path (no auth, no network, no fs-write, no terminal).",
+        kind: "local-adapter",
+        trustClass: "xeno-owned",
+        authRequirement: "none",
+        networkRequirement: "none",
+        ioAuthority: { filesystem: "workspace-scoped", terminal: "none" },
+        capabilities: XENO_LOCAL_CAPABILITIES,
+        enabled: true,
+        metadata: {
+            acpEntrypoint: "adapter",
+            installedLocally: true,
+            displayAlias: "XENO Local",
+            note: "XACP-014 XENO-owned local adapter spike",
+            versionReadiness: {
+                status: "known_good",
+                installedVersion: "built-in",
+                minimumKnownGoodVersion: "built-in",
+                safeUpgradeHint: "Upgrade xeno-acp to update xeno-local.",
+            },
+            streaming: {
+                mode: "buffered",
+                safeMessage: "xeno-local adapter stdout is buffered by the minimal supervisor before ACP updates are emitted.",
+            },
+            setupHints: ["Review policy.", "Approve provider.", "Run providers test.", "Launch or certify the ACP endpoint."],
+        },
+        modelDiscovery: staticModelDiscovery("xeno-local exposes one deterministic local adapter mode.", [{ id: "xeno-local-default", label: "XENO Local default", default: true, available: true, reason: null }]),
+        createRuntime(config) {
+            return new XenoLocalRuntime(definition, config);
+        },
+    };
+    return definition;
+}
+//# sourceMappingURL=xenoLocalProvider.js.map

package/dist/providers/xenoLocalProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xenoLocalProvider.js","sourceRoot":"","sources":["../../src/providers/xenoLocalProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAa9D,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAC;AAC1C,MAAM,CAAC,MAAM,qBAAqB,GAChC,oFAAoF,CAAC;AAEvF,MAAM,CAAC,MAAM,uBAAuB,GAA0B;IAC5D,WAAW,EAAE,IAAI;IACjB,SAAS,EAAE,IAAI;IACf,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,IAAI;IAChB,cAAc,EAAE,IAAI;IACpB,wBAAwB,EAAE,IAAI;IAC9B,YAAY,EAAE,KAAK;IACnB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI,EAAE,0EAA0E;IAC9F,aAAa,EAAE,KAAK;IACpB,cAAc,EAAE,KAAK;CACtB,CAAC;AAIF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAA6B,EAC7B,OAAqD,EAAE;IAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACrD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,IAAI,GAAG,CAAC,OAAgC,EAAQ,EAAE;QACtD,GAAG,IAAI,CAAC,CAAC;QACT,KAAK,CACH,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,QAAQ,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC;YAC7G,IAAI,CACP,CAAC;IACJ,CAAC,CAAC;IAEF,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACpD,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,oEAAoE;QACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAChG,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IAED,wDAAwD;IACxD,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/G,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACpG,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,uBAAuB,CAAC,SAAiB,EAAE,OAAsB,QAAQ;IAIvF,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACjE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,CAAC;AAC1I,CAAC;AASD,MAAM,gBAAgB;IACX,UAAU,CAAqB;IACvB,OAAO,CAAmB;IACnC,UAAU,GAAG,CAAC,CAAC;IACf,WAAW,GAAG,CAAC,CAAC;IAExB,YAAY,UAA8B,EAAE,MAA8B;QACxE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAqB,CAAC;IAC7D,CAAC;IAED,UAAU,KAAU,CAAC;IACrB,aAAa;QACX,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,OAAO,EAAE,SAAS,EAAE,GAAG,aAAa,YAAY,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;IACxG,CAAC;IACD,MAAM;QACJ,uEAAuE;IACzE,CAAC;IACD,OAAO,KAAU,CAAC;IAClB,WAAW;QACT,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IAC1G,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA8B,EAAE,GAA2B;QACtE,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAC9B,sFAAsF;YACtF,MAAM,IAAI,0BAA0B,CAAC;gBACnC,WAAW,EAAE,uEAAuE;gBACpF,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE;aAC/B,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,OAAO;YACP,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;YACzD,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,UAAU,yBAAyB;IACvC,MAAM,UAAU,GAAuB;QACrC,EAAE,EAAE,aAAa;QACjB,WAAW,EAAE,oBAAoB;QACjC,WAAW,EACT,gIAAgI;QAClI,IAAI,EAAE,eAAe;QACrB,UAAU,EAAE,YAAY;QACxB,eAAe,EAAE,MAAM;QACvB,kBAAkB,EAAE,MAAM;QAC1B,WAAW,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE;QACjE,YAAY,EAAE,uBAAuB;QACrC,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE;YACR,aAAa,EAAE,SAAS;YACxB,gBAAgB,EAAE,IAAI;YACtB,YAAY,EAAE,YAAY;YAC1B,IAAI,EAAE,yCAAyC;YAC/C,gBAAgB,EAAE;gBAChB,MAAM,EAAE,YAAY;gBACpB,gBAAgB,EAAE,UAAU;gBAC5B,uBAAuB,EAAE,UAAU;gBACnC,eAAe,EAAE,wCAAwC;aAC1D;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,UAAU;gBAChB,WAAW,EAAE,iGAAiG;aAC/G;YACD,UAAU,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,qCAAqC,CAAC;SAClH;QACD,cAAc,EAAE,oBAAoB,CAClC,0DAA0D,EAC1D,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC1G;QACD,aAAa,CAAC,MAA8B;YAC1C,OAAO,IAAI,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;KACF,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/sandbox/providerSandbox.d.ts

@@ -0,0 +1,35 @@
+/**
+ * `createProviderSandboxContext` — the runtime enforcement boundary.
+ *
+ * Created ONLY after a provider resolves to `runnable` (definition + policy + approval). For a
+ * blocked / unimplemented / unapproved provider, creation fails closed. Every capability is
+ * deny-by-default and policy-gated; the fixture provider receives an allowed context but uses
+ * none of the guarded capabilities.
+ *
+ * In-process, DI-based enforcement — NOT a hostile-code OS sandbox.
+ */
+import type { ProviderDefinition } from "../providers/providerTypes.js";
+import type { ProviderPolicyEntry } from "../config/providerPolicySchema.js";
+import type { ProviderApprovalRecord } from "../config/providerApprovalTypes.js";
+import type { FsBackend, NetworkTransport, ProviderSandboxContext, SecretResolver, TerminalRunner } from "./providerSandboxTypes.js";
+/** TEST-ONLY injected backends. None of these exist in production; defaults deny everything. */
+export interface SandboxTransports {
+    network?: NetworkTransport;
+    secrets?: SecretResolver;
+    filesystem?: FsBackend;
+    filesystemRoot?: string;
+    terminal?: TerminalRunner;
+}
+export interface CreateSandboxOptions {
+    def: ProviderDefinition;
+    sessionId: string;
+    requestId: string;
+    signal: AbortSignal;
+    policyEntry?: ProviderPolicyEntry;
+    approval?: ProviderApprovalRecord;
+    policyInvalid?: boolean;
+    transports?: SandboxTransports;
+    now?: () => string;
+}
+export declare function createProviderSandboxContext(opts: CreateSandboxOptions): ProviderSandboxContext;
+//# sourceMappingURL=providerSandbox.d.ts.map

package/dist/sandbox/providerSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerSandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/providerSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACjF,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,cAAc,EACf,MAAM,2BAA2B,CAAC;AAEnC,gGAAgG;AAChG,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,kBAAkB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,oBAAoB,GAAG,sBAAsB,CA4E/F"}

package/dist/sandbox/providerSandbox.js

@@ -0,0 +1,93 @@
+/**
+ * `createProviderSandboxContext` — the runtime enforcement boundary.
+ *
+ * Created ONLY after a provider resolves to `runnable` (definition + policy + approval). For a
+ * blocked / unimplemented / unapproved provider, creation fails closed. Every capability is
+ * deny-by-default and policy-gated; the fixture provider receives an allowed context but uses
+ * none of the guarded capabilities.
+ *
+ * In-process, DI-based enforcement — NOT a hostile-code OS sandbox.
+ */
+import { createSandboxAudit } from "./providerSandboxAudit.js";
+import { createSandboxNetwork } from "./sandboxNetwork.js";
+import { createSandboxSecrets } from "./sandboxSecrets.js";
+import { createSandboxFilesystem } from "./sandboxFilesystem.js";
+import { createSandboxTerminal } from "./sandboxTerminal.js";
+import { createSandboxCancellation } from "./sandboxCancellation.js";
+import { createSandboxDiagnostics } from "./providerSandboxDiagnostics.js";
+import { SandboxError } from "./sandboxErrors.js";
+import { applyPolicyToDefinition } from "../config/providerPolicyConfig.js";
+import { resolveProviderStatus } from "../config/providerRunnability.js";
+export function createProviderSandboxContext(opts) {
+    const now = opts.now ?? (() => new Date().toISOString());
+    const status = resolveProviderStatus(opts.def, {
+        ...(opts.policyEntry ? { policyEntry: opts.policyEntry } : {}),
+        ...(opts.approval ? { approval: opts.approval } : {}),
+        ...(opts.policyInvalid !== undefined ? { policyInvalid: opts.policyInvalid } : {}),
+    });
+    const merged = opts.policyEntry ? applyPolicyToDefinition(opts.def, opts.policyEntry) : opts.def;
+    const audit = createSandboxAudit({
+        providerId: opts.def.id,
+        sessionId: opts.sessionId,
+        requestId: opts.requestId,
+        now,
+    });
+    if (!status.runnable) {
+        audit.record("sandbox.context.denied", `sandbox context denied: ${status.status}`, { status: status.status });
+        throw new SandboxError({
+            code: "SANDBOX_NOT_ALLOWED",
+            safeMessage: `cannot create a sandbox context for '${opts.def.id}': ${status.status}`,
+            providerId: opts.def.id,
+        });
+    }
+    const network = createSandboxNetwork({
+        providerId: opts.def.id,
+        ...(merged.egressPolicy ? { egressPolicy: merged.egressPolicy } : {}),
+        audit,
+        ...(opts.transports?.network ? { transport: opts.transports.network } : {}),
+    });
+    const secrets = createSandboxSecrets({
+        providerId: opts.def.id,
+        ...(merged.authPolicy ? { authPolicy: merged.authPolicy } : {}),
+        audit,
+        ...(opts.transports?.secrets ? { resolver: opts.transports.secrets } : {}),
+    });
+    const filesystem = createSandboxFilesystem({
+        providerId: opts.def.id,
+        filesystem: merged.ioAuthority.filesystem,
+        audit,
+        ...(opts.transports?.filesystemRoot ? { workspaceRoot: opts.transports.filesystemRoot } : {}),
+        ...(opts.transports?.filesystem ? { backend: opts.transports.filesystem } : {}),
+    });
+    const terminal = createSandboxTerminal({
+        providerId: opts.def.id,
+        terminal: merged.ioAuthority.terminal,
+        audit,
+        ...(opts.transports?.terminal ? { runner: opts.transports.terminal } : {}),
+    });
+    const cancellation = createSandboxCancellation(opts.signal);
+    const diagnostics = createSandboxDiagnostics({
+        providerId: opts.def.id,
+        policyHash: status.policyHash ?? "",
+        definitionHash: status.defHash,
+        decisionStatus: status.status,
+        audit,
+    });
+    audit.record("sandbox.context.created", `sandbox context created for '${opts.def.id}'`);
+    return {
+        providerId: opts.def.id,
+        sessionId: opts.sessionId,
+        requestId: opts.requestId,
+        policyHash: status.policyHash ?? "",
+        definitionHash: status.defHash,
+        safetyDecision: status.gate.overallDecision,
+        network,
+        secrets,
+        filesystem,
+        terminal,
+        diagnostics,
+        audit,
+        cancellation,
+    };
+}
+//# sourceMappingURL=providerSandbox.js.map

package/dist/sandbox/providerSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerSandbox.js","sourceRoot":"","sources":["../../src/sandbox/providerSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAiCzE,MAAM,UAAU,4BAA4B,CAAC,IAA0B;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE;QAC7C,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;IAEjG,MAAM,KAAK,GAAG,kBAAkB,CAAC;QAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG;KACJ,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,2BAA2B,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9G,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,wCAAwC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE;YACrF,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,oBAAoB,CAAC;QACnC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACvB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,oBAAoB,CAAC;QACnC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACvB,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QACzC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACvB,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU;QACzC,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC;QACrC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACvB,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ;QACrC,KAAK;QACL,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAG,wBAAwB,CAAC;QAC3C,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;QACnC,cAAc,EAAE,MAAM,CAAC,OAAO;QAC9B,cAAc,EAAE,MAAM,CAAC,MAAM;QAC7B,KAAK;KACN,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,gCAAgC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAExF,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE;QACnC,cAAc,EAAE,MAAM,CAAC,OAAO;QAC9B,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe;QAC3C,OAAO;QACP,OAAO;QACP,UAAU;QACV,QAAQ;QACR,WAAW;QACX,KAAK;QACL,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/sandbox/providerSandboxAudit.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Append-only sandbox audit log. Events carry safe messages + redacted details only — never
+ * secret values, raw headers/bodies, or stack traces.
+ */
+import type { SandboxAudit } from "./providerSandboxTypes.js";
+export declare function createSandboxAudit(opts: {
+    providerId: string;
+    sessionId: string;
+    requestId: string;
+    now: () => string;
+}): SandboxAudit;
+//# sourceMappingURL=providerSandboxAudit.d.ts.map

package/dist/sandbox/providerSandboxAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerSandboxAudit.d.ts","sourceRoot":"","sources":["../../src/sandbox/providerSandboxAudit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAuC,MAAM,2BAA2B,CAAC;AAEnG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB,GAAG,YAAY,CAmBf"}

package/dist/sandbox/providerSandboxAudit.js

@@ -0,0 +1,25 @@
+/**
+ * Append-only sandbox audit log. Events carry safe messages + redacted details only — never
+ * secret values, raw headers/bodies, or stack traces.
+ */
+export function createSandboxAudit(opts) {
+    const events = [];
+    let seq = 0;
+    return {
+        record(kind, safeMessage, redactedDetails) {
+            seq += 1;
+            events.push({
+                eventId: `${opts.requestId}-aud-${seq}`,
+                timestamp: opts.now(),
+                providerId: opts.providerId,
+                sessionId: opts.sessionId,
+                requestId: opts.requestId,
+                kind,
+                safeMessage,
+                ...(redactedDetails ? { redactedDetails } : {}),
+            });
+        },
+        events: () => [...events],
+    };
+}
+//# sourceMappingURL=providerSandboxAudit.js.map

package/dist/sandbox/providerSandboxAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerSandboxAudit.js","sourceRoot":"","sources":["../../src/sandbox/providerSandboxAudit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO;QACL,MAAM,CAAC,IAAsB,EAAE,WAAmB,EAAE,eAAyC;YAC3F,GAAG,IAAI,CAAC,CAAC;YACT,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,QAAQ,GAAG,EAAE;gBACvC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI;gBACJ,WAAW;gBACX,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;KAC1B,CAAC;AACJ,CAAC"}

package/dist/sandbox/providerSandboxDiagnostics.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Redacted sandbox diagnostics summary (deny counts, audit count, decision status). No secret
+ * values, headers, bodies, or paths.
+ */
+import type { SandboxAudit, SandboxDiagnosticsApi } from "./providerSandboxTypes.js";
+export declare function createSandboxDiagnostics(opts: {
+    providerId: string;
+    policyHash: string;
+    definitionHash: string;
+    decisionStatus: string;
+    audit: SandboxAudit;
+}): SandboxDiagnosticsApi;
+//# sourceMappingURL=providerSandboxDiagnostics.d.ts.map

package/dist/sandbox/providerSandboxDiagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerSandboxDiagnostics.d.ts","sourceRoot":"","sources":["../../src/sandbox/providerSandboxDiagnostics.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAErF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,YAAY,CAAC;CACrB,GAAG,qBAAqB,CAsBxB"}

package/dist/sandbox/providerSandboxDiagnostics.js

@@ -0,0 +1,28 @@
+/**
+ * Redacted sandbox diagnostics summary (deny counts, audit count, decision status). No secret
+ * values, headers, bodies, or paths.
+ */
+export function createSandboxDiagnostics(opts) {
+    return {
+        summary() {
+            const events = opts.audit.events();
+            const count = (k) => events.filter((e) => e.kind === k).length;
+            const lastErr = [...events]
+                .reverse()
+                .find((e) => e.kind.endsWith("denied") || e.kind === "sandbox.provider.failed");
+            return {
+                providerId: opts.providerId,
+                policyHash: opts.policyHash,
+                definitionHash: opts.definitionHash,
+                decisionStatus: opts.decisionStatus,
+                auditEventCount: events.length,
+                deniedNetworkCount: count("sandbox.network.denied"),
+                deniedSecretCount: count("sandbox.secret.denied"),
+                deniedFilesystemCount: count("sandbox.filesystem.denied"),
+                deniedTerminalCount: count("sandbox.terminal.denied"),
+                ...(lastErr ? { lastErrorCode: lastErr.kind } : {}),
+            };
+        },
+    };
+}
+//# sourceMappingURL=providerSandboxDiagnostics.js.map

package/dist/sandbox/providerSandboxDiagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerSandboxDiagnostics.js","sourceRoot":"","sources":["../../src/sandbox/providerSandboxDiagnostics.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,UAAU,wBAAwB,CAAC,IAMxC;IACC,OAAO;QACL,OAAO;YACL,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC/E,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC;iBACxB,OAAO,EAAE;iBACT,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;YAClF,OAAO;gBACL,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,eAAe,EAAE,MAAM,CAAC,MAAM;gBAC9B,kBAAkB,EAAE,KAAK,CAAC,wBAAwB,CAAC;gBACnD,iBAAiB,EAAE,KAAK,CAAC,uBAAuB,CAAC;gBACjD,qBAAqB,EAAE,KAAK,CAAC,2BAA2B,CAAC;gBACzD,mBAAmB,EAAE,KAAK,CAAC,yBAAyB,CAAC;gBACrD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sandbox/providerSandboxTypes.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Provider sandbox execution types (XACP-008).
+ *
+ * The runtime ENFORCEMENT boundary future adapters run inside. A provider receives only a
+ * `ProviderSandboxContext` — never raw Node globals — and every capability is deny-by-default
+ * and policy-gated.
+ *
+ * HONEST SCOPE: this is an IN-PROCESS, dependency-injected provider sandbox. It enforces
+ * XENO-authored adapter behavior through guarded interfaces + audit + fail-closed defaults.
+ * It is NOT a hostile-code OS sandbox — true containment of untrusted native code would require
+ * a later process/OS-level isolation milestone.
+ *
+ * Leaf module: imports only from `../security/securityTypes.js` (avoids cycles with
+ * `../providers/providerTypes.js`, which references `ProviderSandboxContext`).
+ */
+import type { ProviderSafetyDecision, ProviderSecretReference } from "../security/securityTypes.js";
+export type SandboxIoLevel = "none" | "workspace-scoped" | "unknown";
+export type SandboxAuditKind = "sandbox.context.created" | "sandbox.context.denied" | "sandbox.network.allowed" | "sandbox.network.denied" | "sandbox.secret.resolved" | "sandbox.secret.denied" | "sandbox.filesystem.denied" | "sandbox.terminal.denied" | "sandbox.provider.cancelled" | "sandbox.provider.failed";
+export interface SandboxAuditEvent {
+    eventId: string;
+    timestamp: string;
+    providerId: string;
+    sessionId: string;
+    requestId: string;
+    kind: SandboxAuditKind;
+    safeMessage: string;
+    redactedDetails?: Record<string, unknown>;
+}
+export interface SandboxAudit {
+    record(kind: SandboxAuditKind, safeMessage: string, redactedDetails?: Record<string, unknown>): void;
+    events(): SandboxAuditEvent[];
+}
+export interface SandboxNetworkRequest {
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    bodyBytes?: number;
+}
+export interface SandboxNetworkResponse {
+    status: number;
+    headerCount?: number;
+    bodyBytes?: number;
+}
+/** Injected, TEST-ONLY transport. There is no default transport (default = deny). */
+export type NetworkTransport = (req: SandboxNetworkRequest) => Promise<SandboxNetworkResponse>;
+export interface SandboxNetwork {
+    validate(req: SandboxNetworkRequest): ProviderSafetyDecision;
+    request(req: SandboxNetworkRequest): Promise<SandboxNetworkResponse>;
+    diagnostics(): {
+        mode: string;
+        allowedHosts: string[];
+        attempts: number;
+        denied: number;
+    };
+}
+export interface ProviderSecretValue {
+    kind: "opaque-secret";
+    refId: string;
+    /** Opaque value — diagnostics/audit MUST NOT stringify this. */
+    value: string;
+}
+/** Injected, TEST-ONLY resolver. No default (default = unavailable/requires_binding). */
+export type SecretResolver = (refId: string) => string | Promise<string>;
+export interface SandboxSecrets {
+    listRefs(): ProviderSecretReference[];
+    resolve(refId: string): Promise<ProviderSecretValue>;
+    diagnostics(): {
+        refIds: string[];
+        resolved: number;
+        denied: number;
+    };
+}
+/** Injected, TEST-ONLY filesystem backend. No default (default = deny); paths are workspace-contained first. */
+export interface FsBackend {
+    readText(path: string): Promise<string>;
+    writeText(path: string, content: string): Promise<void>;
+}
+export interface SandboxFilesystem {
+    readText(path: string): Promise<string>;
+    writeText(path: string, content: string): Promise<void>;
+    diagnostics(): {
+        filesystem: SandboxIoLevel;
+        denied: number;
+    };
+}
+export interface SandboxTerminalOptions {
+    cwd?: string;
+    timeoutMs?: number;
+}
+export interface SandboxTerminalResult {
+    exitCode: number | null;
+    outputBytes?: number;
+}
+/** Injected, TEST-ONLY runner. No default (default = deny). NEVER spawns in source. */
+export type TerminalRunner = (command: string, args: string[], opts?: SandboxTerminalOptions) => Promise<SandboxTerminalResult>;
+export interface SandboxTerminal {
+    run(command: string, args: string[], opts?: SandboxTerminalOptions): Promise<SandboxTerminalResult>;
+    diagnostics(): {
+        terminal: SandboxIoLevel;
+        denied: number;
+    };
+}
+export interface SandboxCancellation {
+    signal: AbortSignal;
+    throwIfCancelled(): void;
+    onCancel(fn: () => void): () => void;
+}
+export interface SandboxDiagnosticsSummary {
+    providerId: string;
+    policyHash: string;
+    definitionHash: string;
+    decisionStatus: string;
+    auditEventCount: number;
+    deniedNetworkCount: number;
+    deniedSecretCount: number;
+    deniedFilesystemCount: number;
+    deniedTerminalCount: number;
+    lastErrorCode?: string;
+}
+export interface SandboxDiagnosticsApi {
+    summary(): SandboxDiagnosticsSummary;
+}
+export interface ProviderSandboxContext {
+    providerId: string;
+    sessionId: string;
+    requestId: string;
+    policyHash: string;
+    definitionHash: string;
+    safetyDecision: ProviderSafetyDecision;
+    network: SandboxNetwork;
+    secrets: SandboxSecrets;
+    filesystem: SandboxFilesystem;
+    terminal: SandboxTerminal;
+    diagnostics: SandboxDiagnosticsApi;
+    audit: SandboxAudit;
+    cancellation: SandboxCancellation;
+}
+//# sourceMappingURL=providerSandboxTypes.d.ts.map

package/dist/sandbox/providerSandboxTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerSandboxTypes.d.ts","sourceRoot":"","sources":["../../src/sandbox/providerSandboxTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,uBAAuB,EACxB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;AAIrE,MAAM,MAAM,gBAAgB,GACxB,yBAAyB,GACzB,wBAAwB,GACxB,yBAAyB,GACzB,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GACvB,2BAA2B,GAC3B,yBAAyB,GACzB,4BAA4B,GAC5B,yBAAyB,CAAC;AAE9B,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrG,MAAM,IAAI,iBAAiB,EAAE,CAAC;CAC/B;AAID,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AACD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AACD,qFAAqF;AACrF,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,qBAAqB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAE/F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,qBAAqB,GAAG,sBAAsB,CAAC;IAC7D,OAAO,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrE,WAAW,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3F;AAID,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;CACf;AACD,yFAAyF;AACzF,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAc;IAC7B,QAAQ,IAAI,uBAAuB,EAAE,CAAC;IACtC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrD,WAAW,IAAI;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACvE;AAID,gHAAgH;AAChH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AACD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,WAAW,IAAI;QAAE,UAAU,EAAE,cAAc,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAID,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AACD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AACD,uFAAuF;AACvF,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE,sBAAsB,KAC1B,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpG,WAAW,IAAI;QAAE,QAAQ,EAAE,cAAc,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7D;AAID,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,gBAAgB,IAAI,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;CACtC;AAID,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AACD,MAAM,WAAW,qBAAqB;IACpC,OAAO,IAAI,yBAAyB,CAAC;CACtC;AAID,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,sBAAsB,CAAC;IACvC,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,QAAQ,EAAE,eAAe,CAAC;IAC1B,WAAW,EAAE,qBAAqB,CAAC;IACnC,KAAK,EAAE,YAAY,CAAC;IACpB,YAAY,EAAE,mBAAmB,CAAC;CACnC"}