@xenosystem/acp-agent 0.1.1

package/dist/sandbox/providerSandboxTypes.js

@@ -0,0 +1,17 @@
+/**
+ * Provider sandbox execution types (XACP-008).
+ *
+ * The runtime ENFORCEMENT boundary future adapters run inside. A provider receives only a
+ * `ProviderSandboxContext` — never raw Node globals — and every capability is deny-by-default
+ * and policy-gated.
+ *
+ * HONEST SCOPE: this is an IN-PROCESS, dependency-injected provider sandbox. It enforces
+ * XENO-authored adapter behavior through guarded interfaces + audit + fail-closed defaults.
+ * It is NOT a hostile-code OS sandbox — true containment of untrusted native code would require
+ * a later process/OS-level isolation milestone.
+ *
+ * Leaf module: imports only from `../security/securityTypes.js` (avoids cycles with
+ * `../providers/providerTypes.js`, which references `ProviderSandboxContext`).
+ */
+export {};
+//# sourceMappingURL=providerSandboxTypes.js.map

package/dist/sandbox/providerSandboxTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerSandboxTypes.js","sourceRoot":"","sources":["../../src/sandbox/providerSandboxTypes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/sandbox/sandboxCancellation.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Cancellation surface for the sandbox, backed by the prompt's AbortSignal.
+ */
+import type { SandboxCancellation } from "./providerSandboxTypes.js";
+export declare function createSandboxCancellation(signal: AbortSignal): SandboxCancellation;
+//# sourceMappingURL=sandboxCancellation.d.ts.map

package/dist/sandbox/sandboxCancellation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxCancellation.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandboxCancellation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,WAAW,GAAG,mBAAmB,CAkBlF"}

package/dist/sandbox/sandboxCancellation.js

@@ -0,0 +1,24 @@
+/**
+ * Cancellation surface for the sandbox, backed by the prompt's AbortSignal.
+ */
+import { SandboxError } from "./sandboxErrors.js";
+export function createSandboxCancellation(signal) {
+    return {
+        signal,
+        throwIfCancelled() {
+            if (signal.aborted) {
+                throw new SandboxError({ code: "SANDBOX_CANCELLED", safeMessage: "operation cancelled" });
+            }
+        },
+        onCancel(fn) {
+            if (signal.aborted) {
+                fn();
+                return () => { };
+            }
+            const handler = () => fn();
+            signal.addEventListener("abort", handler, { once: true });
+            return () => signal.removeEventListener("abort", handler);
+        },
+    };
+}
+//# sourceMappingURL=sandboxCancellation.js.map

package/dist/sandbox/sandboxCancellation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxCancellation.js","sourceRoot":"","sources":["../../src/sandbox/sandboxCancellation.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,UAAU,yBAAyB,CAAC,MAAmB;IAC3D,OAAO;QACL,MAAM;QACN,gBAAgB;YACd,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,EAAc;YACrB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,EAAE,EAAE,CAAC;gBACL,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sandbox/sandboxErrors.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Sandbox error taxonomy. Safe messages only (no stack traces / secrets on stdout).
+ */
+export type SandboxErrorCode = "SANDBOX_NOT_ALLOWED" | "SANDBOX_NETWORK_DENIED" | "SANDBOX_NO_TRANSPORT" | "SANDBOX_SECRET_DENIED" | "SANDBOX_SECRET_UNAVAILABLE" | "SANDBOX_FILESYSTEM_DENIED" | "SANDBOX_TERMINAL_DENIED" | "SANDBOX_CANCELLED" | "SANDBOX_INTERNAL";
+export declare class SandboxError extends Error {
+    readonly code: SandboxErrorCode;
+    readonly providerId?: string;
+    readonly redactedDetails?: Record<string, unknown>;
+    constructor(init: {
+        code: SandboxErrorCode;
+        safeMessage: string;
+        providerId?: string;
+        redactedDetails?: Record<string, unknown>;
+    });
+    get safeMessage(): string;
+}
+//# sourceMappingURL=sandboxErrors.d.ts.map

package/dist/sandbox/sandboxErrors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxErrors.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandboxErrors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,gBAAgB,GACxB,qBAAqB,GACrB,wBAAwB,GACxB,sBAAsB,GACtB,uBAAuB,GACvB,4BAA4B,GAC5B,2BAA2B,GAC3B,yBAAyB,GACzB,mBAAmB,GACnB,kBAAkB,CAAC;AAEvB,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAEvC,IAAI,EAAE;QAChB,IAAI,EAAE,gBAAgB,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC3C;IAQD,IAAI,WAAW,IAAI,MAAM,CAExB;CACF"}

package/dist/sandbox/sandboxErrors.js

@@ -0,0 +1,21 @@
+/**
+ * Sandbox error taxonomy. Safe messages only (no stack traces / secrets on stdout).
+ */
+export class SandboxError extends Error {
+    code;
+    providerId;
+    redactedDetails;
+    constructor(init) {
+        super(init.safeMessage);
+        this.name = "SandboxError";
+        this.code = init.code;
+        if (init.providerId !== undefined)
+            this.providerId = init.providerId;
+        if (init.redactedDetails !== undefined)
+            this.redactedDetails = init.redactedDetails;
+    }
+    get safeMessage() {
+        return this.message;
+    }
+}
+//# sourceMappingURL=sandboxErrors.js.map

package/dist/sandbox/sandboxErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxErrors.js","sourceRoot":"","sources":["../../src/sandbox/sandboxErrors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAaH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAmB;IACvB,UAAU,CAAU;IACpB,eAAe,CAA2B;IAEnD,YAAY,IAKX;QACC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACrE,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YAAE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;IACtF,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF"}

package/dist/sandbox/sandboxFilesystem.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Guarded filesystem capability. Deny-all by default (and whenever I/O authority is `none` or
+ * no backend is bound). Performs NO real filesystem I/O in source — a TEST-ONLY backend may be
+ * injected. Denied operations never touch disk. Audit records the operation, not the path.
+ */
+import type { FsBackend, SandboxAudit, SandboxFilesystem, SandboxIoLevel } from "./providerSandboxTypes.js";
+export declare function createSandboxFilesystem(opts: {
+    providerId: string;
+    filesystem: SandboxIoLevel;
+    audit: SandboxAudit;
+    workspaceRoot?: string;
+    backend?: FsBackend;
+}): SandboxFilesystem;
+//# sourceMappingURL=sandboxFilesystem.d.ts.map

package/dist/sandbox/sandboxFilesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxFilesystem.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandboxFilesystem.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EACV,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACf,MAAM,2BAA2B,CAAC;AAWnC,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,cAAc,CAAC;IAC3B,KAAK,EAAE,YAAY,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB,GAAG,iBAAiB,CAiCpB"}

package/dist/sandbox/sandboxFilesystem.js

@@ -0,0 +1,51 @@
+/**
+ * Guarded filesystem capability. Deny-all by default (and whenever I/O authority is `none` or
+ * no backend is bound). Performs NO real filesystem I/O in source — a TEST-ONLY backend may be
+ * injected. Denied operations never touch disk. Audit records the operation, not the path.
+ */
+import { isAbsolute, resolve, sep } from "node:path";
+import { SandboxError } from "./sandboxErrors.js";
+function containPath(root, requested) {
+    const absRoot = resolve(root);
+    const candidate = isAbsolute(requested) ? resolve(requested) : resolve(absRoot, requested);
+    if (candidate !== absRoot && !candidate.startsWith(absRoot + sep)) {
+        throw new Error("path escapes workspace");
+    }
+    return candidate;
+}
+export function createSandboxFilesystem(opts) {
+    let denied = 0;
+    const deny = (op, reason = "not_permitted") => {
+        denied += 1;
+        opts.audit.record("sandbox.filesystem.denied", `filesystem ${op} denied`, { op, reason });
+        throw new SandboxError({
+            code: "SANDBOX_FILESYSTEM_DENIED",
+            safeMessage: `filesystem ${op} is not permitted (filesystem authority: ${opts.filesystem})`,
+            providerId: opts.providerId,
+        });
+    };
+    const contained = (op, path) => {
+        if (opts.filesystem === "none" || opts.filesystem === "unknown" || !opts.backend)
+            return deny(op);
+        if (!opts.workspaceRoot || !isAbsolute(opts.workspaceRoot))
+            return deny(op, "workspace_root_unbound");
+        try {
+            return containPath(opts.workspaceRoot, path);
+        }
+        catch {
+            return deny(op, "outside_workspace");
+        }
+    };
+    return {
+        async readText(path) {
+            const safePath = contained("read", path);
+            return opts.backend.readText(safePath);
+        },
+        async writeText(path, content) {
+            const safePath = contained("write", path);
+            return opts.backend.writeText(safePath, content);
+        },
+        diagnostics: () => ({ filesystem: opts.filesystem, denied }),
+    };
+}
+//# sourceMappingURL=sandboxFilesystem.js.map

package/dist/sandbox/sandboxFilesystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxFilesystem.js","sourceRoot":"","sources":["../../src/sandbox/sandboxFilesystem.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQlD,SAAS,WAAW,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3F,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,MAAM,IAAI,GAAG,CAAC,EAAoB,EAAE,MAAM,GAAG,eAAe,EAAS,EAAE;QACrE,MAAM,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,2BAA2B,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,2BAA2B;YACjC,WAAW,EAAE,cAAc,EAAE,4CAA4C,IAAI,CAAC,UAAU,GAAG;YAC3F,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,EAAoB,EAAE,IAAY,EAAU,EAAE;QAC/D,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAC,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACtG,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,IAAY;YACzB,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,OAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAe;YAC3C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,OAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC"}

package/dist/sandbox/sandboxNetwork.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Guarded network capability. Deny-by-default, egress-policy-enforced, audited, header-redacted.
+ * Performs NO real network call: there is no default transport. A TEST-ONLY transport may be
+ * injected; denied requests never reach it.
+ */
+import type { ProviderEgressPolicy } from "../security/securityTypes.js";
+import type { NetworkTransport, SandboxAudit, SandboxNetwork } from "./providerSandboxTypes.js";
+export declare function createSandboxNetwork(opts: {
+    providerId: string;
+    egressPolicy?: ProviderEgressPolicy;
+    audit: SandboxAudit;
+    transport?: NetworkTransport;
+}): SandboxNetwork;
+//# sourceMappingURL=sandboxNetwork.d.ts.map

package/dist/sandbox/sandboxNetwork.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxNetwork.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandboxNetwork.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,cAAc,EAEf,MAAM,2BAA2B,CAAC;AAUnC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B,GAAG,cAAc,CA2CjB"}

package/dist/sandbox/sandboxNetwork.js

@@ -0,0 +1,60 @@
+/**
+ * Guarded network capability. Deny-by-default, egress-policy-enforced, audited, header-redacted.
+ * Performs NO real network call: there is no default transport. A TEST-ONLY transport may be
+ * injected; denied requests never reach it.
+ */
+import { validateUrlAgainstEgressPolicy, NO_EGRESS_POLICY } from "../security/egressPolicy.js";
+import { redactEnvRecord } from "../security/redaction.js";
+import { SandboxError } from "./sandboxErrors.js";
+function hostOf(url) {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return "<invalid-url>";
+    }
+}
+export function createSandboxNetwork(opts) {
+    const policy = opts.egressPolicy ?? NO_EGRESS_POLICY;
+    let attempts = 0;
+    let denied = 0;
+    return {
+        validate(req) {
+            return validateUrlAgainstEgressPolicy(policy, req.url);
+        },
+        async request(req) {
+            attempts += 1;
+            const decision = validateUrlAgainstEgressPolicy(policy, req.url);
+            if (decision.status !== "allowed") {
+                denied += 1;
+                opts.audit.record("sandbox.network.denied", `network denied: ${decision.reasonCode}`, {
+                    host: hostOf(req.url),
+                    method: req.method ?? "GET",
+                });
+                throw new SandboxError({
+                    code: "SANDBOX_NETWORK_DENIED",
+                    safeMessage: decision.safeMessage,
+                    providerId: opts.providerId,
+                });
+            }
+            // Allowed by policy — record with REDACTED headers.
+            opts.audit.record("sandbox.network.allowed", `network allowed: ${hostOf(req.url)}`, {
+                host: hostOf(req.url),
+                method: req.method ?? "GET",
+                headers: req.headers ? redactEnvRecord(req.headers) : {},
+                bodyBytes: req.bodyBytes ?? 0,
+            });
+            if (!opts.transport) {
+                denied += 1;
+                throw new SandboxError({
+                    code: "SANDBOX_NO_TRANSPORT",
+                    safeMessage: "no network transport bound (the sandbox performs no real network calls)",
+                    providerId: opts.providerId,
+                });
+            }
+            return opts.transport(req);
+        },
+        diagnostics: () => ({ mode: policy.mode, allowedHosts: [...policy.allowedHosts], attempts, denied }),
+    };
+}
+//# sourceMappingURL=sandboxNetwork.js.map

package/dist/sandbox/sandboxNetwork.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxNetwork.js","sourceRoot":"","sources":["../../src/sandbox/sandboxNetwork.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AASlD,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC;IACrD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO;QACL,QAAQ,CAAC,GAA0B;YACjC,OAAO,8BAA8B,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,GAA0B;YACtC,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,QAAQ,GAAG,8BAA8B,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,CAAC;gBACZ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,EAAE,mBAAmB,QAAQ,CAAC,UAAU,EAAE,EAAE;oBACpF,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;oBACrB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;iBAC5B,CAAC,CAAC;gBACH,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,wBAAwB;oBAC9B,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,oDAAoD;YACpD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,oBAAoB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;gBAClF,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBACrB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;gBAC3B,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACxD,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,CAAC;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,CAAC;gBACZ,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,yEAAyE;oBACtF,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACrG,CAAC;AACJ,CAAC"}

package/dist/sandbox/sandboxSecrets.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Guarded secrets capability. Metadata-only by default: it reads NO real secret — no
+ * process.env, no files, no keychain. A TEST-ONLY resolver may be injected. Resolving an
+ * unapproved reference is denied; the resolved value is opaque and never appears in audit or
+ * diagnostics.
+ */
+import type { ProviderAuthPolicy } from "../security/securityTypes.js";
+import { type SecretStore } from "../security/secretStore.js";
+import type { SandboxAudit, SandboxSecrets, SecretResolver } from "./providerSandboxTypes.js";
+export declare function createSandboxSecrets(opts: {
+    providerId: string;
+    authPolicy?: ProviderAuthPolicy;
+    audit: SandboxAudit;
+    secretStore?: SecretStore;
+    resolver?: SecretResolver;
+}): SandboxSecrets;
+//# sourceMappingURL=sandboxSecrets.d.ts.map

package/dist/sandbox/sandboxSecrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxSecrets.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandboxSecrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAChF,OAAO,KAAK,EAEV,YAAY,EACZ,cAAc,EACd,cAAc,EACf,MAAM,2BAA2B,CAAC;AAEnC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,YAAY,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,cAAc,CAAC;CAC3B,GAAG,cAAc,CAmDjB"}

package/dist/sandbox/sandboxSecrets.js

@@ -0,0 +1,61 @@
+/**
+ * Guarded secrets capability. Metadata-only by default: it reads NO real secret — no
+ * process.env, no files, no keychain. A TEST-ONLY resolver may be injected. Resolving an
+ * unapproved reference is denied; the resolved value is opaque and never appears in audit or
+ * diagnostics.
+ */
+import { SandboxError } from "./sandboxErrors.js";
+import { SecretStoreError } from "../security/secretStore.js";
+export function createSandboxSecrets(opts) {
+    const refs = opts.authPolicy?.allowedSecretRefs ?? [];
+    let resolved = 0;
+    let denied = 0;
+    return {
+        listRefs: () => [...refs],
+        async resolve(refId) {
+            const ref = refs.find((r) => r.id === refId);
+            if (!ref) {
+                denied += 1;
+                opts.audit.record("sandbox.secret.denied", `secret reference not approved: ${refId}`, { refId });
+                throw new SandboxError({
+                    code: "SANDBOX_SECRET_DENIED",
+                    safeMessage: `secret reference '${refId}' is not approved`,
+                    providerId: opts.providerId,
+                });
+            }
+            if (!opts.secretStore && !opts.resolver) {
+                denied += 1;
+                opts.audit.record("sandbox.secret.denied", `secret unavailable (no resolver bound): ${refId}`, { refId });
+                throw new SandboxError({
+                    code: "SANDBOX_SECRET_UNAVAILABLE",
+                    safeMessage: `secret '${refId}' is unavailable (no secret store or resolver bound; the sandbox loads no real secrets)`,
+                    providerId: opts.providerId,
+                });
+            }
+            let value;
+            try {
+                value = opts.secretStore
+                    ? await opts.secretStore.resolve(ref)
+                    : { kind: "opaque-secret", refId, value: await opts.resolver(refId) };
+            }
+            catch (err) {
+                denied += 1;
+                const safeMessage = err instanceof SecretStoreError
+                    ? err.safeMessage
+                    : `secret '${refId}' is unavailable`;
+                opts.audit.record("sandbox.secret.denied", safeMessage, { refId });
+                throw new SandboxError({
+                    code: "SANDBOX_SECRET_UNAVAILABLE",
+                    safeMessage,
+                    providerId: opts.providerId,
+                });
+            }
+            resolved += 1;
+            // Record the resolution WITHOUT the value.
+            opts.audit.record("sandbox.secret.resolved", `secret resolved: ${refId}`, { refId });
+            return value;
+        },
+        diagnostics: () => ({ refIds: refs.map((r) => r.id), resolved, denied }),
+    };
+}
+//# sourceMappingURL=sandboxSecrets.js.map

package/dist/sandbox/sandboxSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxSecrets.js","sourceRoot":"","sources":["../../src/sandbox/sandboxSecrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAoB,MAAM,4BAA4B,CAAC;AAQhF,MAAM,UAAU,oBAAoB,CAAC,IAMpC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,IAAI,EAAE,CAAC;IACtD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,KAAa;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,CAAC,CAAC;gBACZ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,EAAE,kCAAkC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjG,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,uBAAuB;oBAC7B,WAAW,EAAE,qBAAqB,KAAK,mBAAmB;oBAC1D,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxC,MAAM,IAAI,CAAC,CAAC;gBACZ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,EAAE,2CAA2C,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1G,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,4BAA4B;oBAClC,WAAW,EAAE,WAAW,KAAK,yFAAyF;oBACtH,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,WAAW;oBACtB,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;oBACrC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAwB,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,QAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACpF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,CAAC;gBACZ,MAAM,WAAW,GAAG,GAAG,YAAY,gBAAgB;oBACjD,CAAC,CAAC,GAAG,CAAC,WAAW;oBACjB,CAAC,CAAC,WAAW,KAAK,kBAAkB,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnE,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,4BAA4B;oBAClC,WAAW;oBACX,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,QAAQ,IAAI,CAAC,CAAC;YACd,2CAA2C;YAC3C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,oBAAoB,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC"}

package/dist/sandbox/sandboxTerminal.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Guarded terminal capability. Deny-all by default (and whenever terminal authority is `none`
+ * or no runner is bound). Performs NO process spawning in source (no `child_process`) — a
+ * TEST-ONLY runner may be injected. Denied runs never spawn. Audit records the command basename
+ * + arg count, never a full command line.
+ */
+import type { SandboxAudit, SandboxIoLevel, SandboxTerminal, TerminalRunner } from "./providerSandboxTypes.js";
+export declare function createSandboxTerminal(opts: {
+    providerId: string;
+    terminal: SandboxIoLevel;
+    audit: SandboxAudit;
+    runner?: TerminalRunner;
+}): SandboxTerminal;
+//# sourceMappingURL=sandboxTerminal.d.ts.map

package/dist/sandbox/sandboxTerminal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxTerminal.d.ts","sourceRoot":"","sources":["../../src/sandbox/sandboxTerminal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EACV,YAAY,EACZ,cAAc,EACd,eAAe,EAGf,cAAc,EACf,MAAM,2BAA2B,CAAC;AAMnC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB,GAAG,eAAe,CAqBlB"}

package/dist/sandbox/sandboxTerminal.js

@@ -0,0 +1,32 @@
+/**
+ * Guarded terminal capability. Deny-all by default (and whenever terminal authority is `none`
+ * or no runner is bound). Performs NO process spawning in source (no `child_process`) — a
+ * TEST-ONLY runner may be injected. Denied runs never spawn. Audit records the command basename
+ * + arg count, never a full command line.
+ */
+import { SandboxError } from "./sandboxErrors.js";
+function basename(p) {
+    return p.split(/[\\/]/).pop() ?? p;
+}
+export function createSandboxTerminal(opts) {
+    let denied = 0;
+    return {
+        async run(command, args, options) {
+            if (opts.terminal === "none" || opts.terminal === "unknown" || !opts.runner) {
+                denied += 1;
+                opts.audit.record("sandbox.terminal.denied", "terminal run denied", {
+                    command: basename(command),
+                    argCount: args.length,
+                });
+                throw new SandboxError({
+                    code: "SANDBOX_TERMINAL_DENIED",
+                    safeMessage: `terminal execution is not permitted (terminal authority: ${opts.terminal})`,
+                    providerId: opts.providerId,
+                });
+            }
+            return opts.runner(command, args, options);
+        },
+        diagnostics: () => ({ terminal: opts.terminal, denied }),
+    };
+}
+//# sourceMappingURL=sandboxTerminal.js.map

package/dist/sandbox/sandboxTerminal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxTerminal.js","sourceRoot":"","sources":["../../src/sandbox/sandboxTerminal.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAUlD,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAKrC;IACC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,OAAgC;YACzE,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC5E,MAAM,IAAI,CAAC,CAAC;gBACZ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,EAAE,qBAAqB,EAAE;oBAClE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC;oBAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM;iBACtB,CAAC,CAAC;gBACH,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,yBAAyB;oBAC/B,WAAW,EAAE,4DAA4D,IAAI,CAAC,QAAQ,GAAG;oBACzF,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC"}

package/dist/security/authPolicy.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Auth policy validation — METADATA ONLY.
+ *
+ * XACP-006 validates the SHAPE of an auth policy and its secret references. It never reads a
+ * secret: no process.env access for provider auth, no credential files, no keychain, no
+ * interactive login. Secret references describe *where* a secret would come from, never its
+ * value.
+ */
+import type { ProviderAuthPolicy, ProviderSecretReference, ProviderSafetyDecision } from "./securityTypes.js";
+export interface AuthPolicySummary {
+    requirement: ProviderAuthPolicy["requirement"];
+    secretRefs: Array<{
+        id: string;
+        kind: string;
+        label: string;
+        required: boolean;
+    }>;
+    allowPlainEnv: boolean;
+    allowProcessEnv: boolean;
+    allowCredentialFiles: boolean;
+    allowInteractiveLogin: boolean;
+}
+/** Validate a single secret reference (metadata shape only). */
+export declare function validateSecretReference(ref: ProviderSecretReference): ProviderSafetyDecision;
+/** Validate an auth policy's internal consistency (still fail-closed at the gate). */
+export declare function validateProviderAuthPolicy(policy: ProviderAuthPolicy): ProviderSafetyDecision;
+/** A redacted, value-free summary of an auth policy (safe to print/diagnose). */
+export declare function summarizeAuthPolicy(policy: ProviderAuthPolicy): AuthPolicySummary;
+/** A safe, fully-blocked default auth policy. */
+export declare const NO_AUTH_POLICY: ProviderAuthPolicy;
+//# sourceMappingURL=authPolicy.d.ts.map

package/dist/security/authPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authPolicy.d.ts","sourceRoot":"","sources":["../../src/security/authPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE9G,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC/C,UAAU,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClF,aAAa,EAAE,OAAO,CAAC;IACvB,eAAe,EAAE,OAAO,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED,gEAAgE;AAChE,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,uBAAuB,GAAG,sBAAsB,CAW5F;AAED,sFAAsF;AACtF,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,sBAAsB,CAmB7F;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,kBAAkB,GAAG,iBAAiB,CAcjF;AAED,iDAAiD;AACjD,eAAO,MAAM,cAAc,EAAE,kBAO5B,CAAC"}

package/dist/security/authPolicy.js

@@ -0,0 +1,72 @@
+/**
+ * Auth policy validation — METADATA ONLY.
+ *
+ * XACP-006 validates the SHAPE of an auth policy and its secret references. It never reads a
+ * secret: no process.env access for provider auth, no credential files, no keychain, no
+ * interactive login. Secret references describe *where* a secret would come from, never its
+ * value.
+ */
+/** Validate a single secret reference (metadata shape only). */
+export function validateSecretReference(ref) {
+    if (!ref || typeof ref.id !== "string" || ref.id.trim() === "") {
+        return blocked("auth.secret_ref.invalid_id", "secret reference must have a non-empty id");
+    }
+    if (!["env", "file", "keychain", "manual"].includes(ref.kind)) {
+        return blocked("auth.secret_ref.invalid_kind", `unsupported secret reference kind: ${ref.kind}`);
+    }
+    if (typeof ref.label !== "string" || ref.label.trim() === "") {
+        return blocked("auth.secret_ref.invalid_label", "secret reference must have a label");
+    }
+    return { status: "not_applicable", reasonCode: "auth.secret_ref.ok", safeMessage: "secret reference is valid metadata" };
+}
+/** Validate an auth policy's internal consistency (still fail-closed at the gate). */
+export function validateProviderAuthPolicy(policy) {
+    // XACP-006 hard rules: these unsafe mechanisms are never permitted yet.
+    if (policy.allowPlainEnv) {
+        return blocked("auth.plain_env_forbidden", "inline plaintext env values are not permitted");
+    }
+    if (policy.allowProcessEnv) {
+        return blocked("auth.process_env_forbidden", "reading process.env for provider auth is not permitted in XACP-006");
+    }
+    if (policy.allowCredentialFiles) {
+        return blocked("auth.credential_files_forbidden", "credential file reads are not permitted in XACP-006");
+    }
+    if (policy.allowInteractiveLogin) {
+        return blocked("auth.interactive_login_forbidden", "interactive login is not permitted in XACP-006");
+    }
+    for (const ref of policy.allowedSecretRefs ?? []) {
+        const refDecision = validateSecretReference(ref);
+        if (refDecision.status === "blocked")
+            return refDecision;
+    }
+    return { status: "not_applicable", reasonCode: "auth.policy.ok", safeMessage: "auth policy shape is valid (metadata only)" };
+}
+/** A redacted, value-free summary of an auth policy (safe to print/diagnose). */
+export function summarizeAuthPolicy(policy) {
+    return {
+        requirement: policy.requirement,
+        secretRefs: (policy.allowedSecretRefs ?? []).map((r) => ({
+            id: r.id,
+            kind: r.kind,
+            label: r.label,
+            required: r.required,
+        })),
+        allowPlainEnv: policy.allowPlainEnv,
+        allowProcessEnv: policy.allowProcessEnv,
+        allowCredentialFiles: policy.allowCredentialFiles,
+        allowInteractiveLogin: policy.allowInteractiveLogin,
+    };
+}
+/** A safe, fully-blocked default auth policy. */
+export const NO_AUTH_POLICY = {
+    requirement: "none",
+    allowedSecretRefs: [],
+    allowPlainEnv: false,
+    allowProcessEnv: false,
+    allowCredentialFiles: false,
+    allowInteractiveLogin: false,
+};
+function blocked(reasonCode, safeMessage) {
+    return { status: "blocked", reasonCode, safeMessage };
+}
+//# sourceMappingURL=authPolicy.js.map

package/dist/security/authPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authPolicy.js","sourceRoot":"","sources":["../../src/security/authPolicy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,gEAAgE;AAChE,MAAM,UAAU,uBAAuB,CAAC,GAA4B;IAClE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/D,OAAO,OAAO,CAAC,4BAA4B,EAAE,2CAA2C,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC,8BAA8B,EAAE,sCAAsC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,OAAO,CAAC,+BAA+B,EAAE,oCAAoC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,oBAAoB,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;AAC3H,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACnE,wEAAwE;IACxE,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,0BAA0B,EAAE,+CAA+C,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,4BAA4B,EAAE,oEAAoE,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,iCAAiC,EAAE,qDAAqD,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,kCAAkC,EAAE,gDAAgD,CAAC,CAAC;IACvG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;AAC/H,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvD,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;SACrB,CAAC,CAAC;QACH,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;QACjD,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;KACpD,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,MAAM,cAAc,GAAuB;IAChD,WAAW,EAAE,MAAM;IACnB,iBAAiB,EAAE,EAAE;IACrB,aAAa,EAAE,KAAK;IACpB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,KAAK;IAC3B,qBAAqB,EAAE,KAAK;CAC7B,CAAC;AAEF,SAAS,OAAO,CAAC,UAAkB,EAAE,WAAmB;IACtD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AACxD,CAAC"}

package/dist/security/capabilityGate.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Capability gate — the controlled allow-path (XACP-006).
+ *
+ * `evaluateProviderSafety` combines a provider's declaration (capabilities, auth/network
+ * requirements, I/O authority, trust class, implementation status) with its declared auth +
+ * egress policies and returns a `ProviderCapabilityGate`. The stance is FAIL-CLOSED: a
+ * provider does NOT become runnable merely by declaring capabilities — it must pass every
+ * sub-decision. In XACP-006 only the fixture (which needs nothing) evaluates `allowed`; every
+ * real/placeholder provider is `blocked` (or `requires_approval`, which is not runnable).
+ */
+import type { ProviderCapabilityGate } from "./securityTypes.js";
+import type { ProviderDefinition } from "../providers/providerTypes.js";
+export declare function evaluateProviderSafety(def: ProviderDefinition): ProviderCapabilityGate;
+/** Convenience: is the provider runnable under the gate (overall === allowed)? */
+export declare function isGateAllowed(def: ProviderDefinition): boolean;
+//# sourceMappingURL=capabilityGate.d.ts.map

package/dist/security/capabilityGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilityGate.d.ts","sourceRoot":"","sources":["../../src/security/capabilityGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,sBAAsB,EAA0B,MAAM,oBAAoB,CAAC;AACzF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AA+DxE,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,GAAG,sBAAsB,CA0BtF;AAED,kFAAkF;AAClF,wBAAgB,aAAa,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAE9D"}