@xenosystem/acp-agent 0.1.1

package/dist/config/providerPolicyHash.js

@@ -0,0 +1,65 @@
+/**
+ * Deterministic hashing of the SAFETY-RELEVANT fields of a provider definition and a provider
+ * policy. Used to tie an approval to an exact (definition, policy) pair so that any change
+ * makes the approval stale.
+ *
+ * Includes: ids, trust class, auth requirement, secret reference ids/kinds (NEVER values),
+ * egress mode/allowed+blocked hosts/flags, I/O authority, implementation status.
+ * Excludes: secret values (not represented at all), timestamps, display-only notes.
+ */
+import { createHash } from "node:crypto";
+/** Stable, sorted-key serialization. */
+function canonical(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return "[" + value.map(canonical).join(",") + "]";
+    const keys = Object.keys(value).sort();
+    return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonical(value[k])).join(",") + "}";
+}
+function sha256(obj) {
+    return createHash("sha256").update(canonical(obj)).digest("hex");
+}
+export function hashProviderDefinition(def) {
+    return sha256({
+        id: def.id,
+        trustClass: def.trustClass,
+        authRequirement: def.authRequirement,
+        networkRequirement: def.networkRequirement,
+        ioAuthority: def.ioAuthority,
+        capabilities: {
+            requiresAuth: def.capabilities.requiresAuth,
+            usesNetwork: def.capabilities.usesNetwork,
+            canReadFiles: def.capabilities.canReadFiles,
+            canWriteFiles: def.capabilities.canWriteFiles,
+            canRunTerminal: def.capabilities.canRunTerminal,
+        },
+        enabled: def.enabled,
+    });
+}
+export function hashProviderPolicy(entry) {
+    return sha256({
+        trustClass: entry.trustClass,
+        auth: {
+            requirement: entry.auth.requirement,
+            // Secret REFERENCES only — ids/kinds/required, never values.
+            secretRefs: (entry.auth.allowedSecretRefs ?? []).map((r) => ({ id: r.id, kind: r.kind, required: r.required })),
+            allowPlainEnv: entry.auth.allowPlainEnv,
+            allowProcessEnv: entry.auth.allowProcessEnv,
+            allowCredentialFiles: entry.auth.allowCredentialFiles,
+            allowInteractiveLogin: entry.auth.allowInteractiveLogin,
+        },
+        egress: {
+            mode: entry.egress.mode,
+            allowedHosts: [...entry.egress.allowedHosts].sort(),
+            blockedHosts: [...entry.egress.blockedHosts].sort(),
+            allowLocalhost: entry.egress.allowLocalhost,
+            allowPrivateNetwork: entry.egress.allowPrivateNetwork,
+            allowHttp: entry.egress.allowHttp,
+            allowHttps: entry.egress.allowHttps,
+            maxRedirects: entry.egress.maxRedirects,
+        },
+        io: entry.io,
+    });
+}
+//# sourceMappingURL=providerPolicyHash.js.map

package/dist/config/providerPolicyHash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerPolicyHash.js","sourceRoot":"","sources":["../../src/config/providerPolicyHash.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIzC,wCAAwC;AACxC,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AAC3H,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAuB;IAC5D,OAAO,MAAM,CAAC;QACZ,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,YAAY,EAAE;YACZ,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,YAAY;YAC3C,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,WAAW;YACzC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,YAAY;YAC3C,aAAa,EAAE,GAAG,CAAC,YAAY,CAAC,aAAa;YAC7C,cAAc,EAAE,GAAG,CAAC,YAAY,CAAC,cAAc;SAChD;QACD,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAA0B;IAC3D,OAAO,MAAM,CAAC;QACZ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE;YACJ,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;YACnC,6DAA6D;YAC7D,UAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/G,aAAa,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa;YACvC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,eAAe;YAC3C,oBAAoB,EAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB;YACrD,qBAAqB,EAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB;SACxD;QACD,MAAM,EAAE;YACN,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACvB,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE;YACnD,YAAY,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE;YACnD,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;YAC3C,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,mBAAmB;YACrD,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;YACjC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACnC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;SACxC;QACD,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/config/providerPolicySchema.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Provider policy config schema + strict validation (XACP-007).
+ *
+ * A provider policy config declares POLICY METADATA for providers (auth secret *references*,
+ * egress allowlists, I/O posture, trust class). It must NEVER contain secret values, and it
+ * cannot make an unimplemented provider runnable. Validation is strict and produces safe
+ * diagnostics (no throw, no secret echo).
+ */
+import type { ProviderAuthPolicy, ProviderEgressPolicy } from "../security/securityTypes.js";
+import type { IoAuthorityLevel, TrustClass } from "../providers/providerTypes.js";
+export interface ProviderPolicyEntry {
+    /** Operator intent only — does NOT grant runtime (implementation status comes from the def). */
+    enabled: boolean;
+    trustClass: TrustClass;
+    auth: ProviderAuthPolicy;
+    egress: ProviderEgressPolicy;
+    io: {
+        filesystem: IoAuthorityLevel;
+        terminal: IoAuthorityLevel;
+    };
+}
+export interface ProviderPolicyConfig {
+    version: 1;
+    providers: Record<string, ProviderPolicyEntry>;
+}
+export interface PolicyValidationResult {
+    ok: boolean;
+    config?: ProviderPolicyConfig;
+    errors: string[];
+}
+export declare function validateProviderPolicyConfig(raw: unknown): PolicyValidationResult;
+//# sourceMappingURL=providerPolicySchema.d.ts.map

package/dist/config/providerPolicySchema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerPolicySchema.d.ts","sourceRoot":"","sources":["../../src/config/providerPolicySchema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAElF,MAAM,WAAW,mBAAmB;IAClC,gGAAgG;IAChG,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,EAAE,kBAAkB,CAAC;IACzB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,EAAE,EAAE;QAAE,UAAU,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,gBAAgB,CAAA;KAAE,CAAC;CAClE;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAsBD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAwCjF"}

package/dist/config/providerPolicySchema.js

@@ -0,0 +1,130 @@
+/**
+ * Provider policy config schema + strict validation (XACP-007).
+ *
+ * A provider policy config declares POLICY METADATA for providers (auth secret *references*,
+ * egress allowlists, I/O posture, trust class). It must NEVER contain secret values, and it
+ * cannot make an unimplemented provider runnable. Validation is strict and produces safe
+ * diagnostics (no throw, no secret echo).
+ */
+import { looksSecretLike } from "../security/redaction.js";
+const TRUST = ["xeno-owned", "third-party", "unknown"];
+const REQ = ["none", "optional", "required"];
+const IO = ["none", "workspace-scoped", "unknown"];
+const SECRET_KINDS = ["env", "file", "keychain", "manual"];
+/** Recursively flag any string value that looks like a hardcoded secret. */
+function findSecretValues(value, path, out) {
+    if (typeof value === "string") {
+        if (looksSecretLike(value))
+            out.push(`${path} appears to contain a secret value (not allowed in policy config)`);
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((v, i) => findSecretValues(v, `${path}[${i}]`, out));
+        return;
+    }
+    if (value && typeof value === "object") {
+        for (const [k, v] of Object.entries(value))
+            findSecretValues(v, `${path}.${k}`, out);
+    }
+}
+export function validateProviderPolicyConfig(raw) {
+    const errors = [];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        return { ok: false, errors: ["config root must be an object"] };
+    }
+    const obj = raw;
+    if (obj.version !== 1)
+        errors.push("config.version must be 1");
+    if (!obj.providers || typeof obj.providers !== "object" || Array.isArray(obj.providers)) {
+        return { ok: false, errors: [...errors, "config.providers must be an object"] };
+    }
+    // Hard rule: no secret values anywhere in the config.
+    findSecretValues(obj.providers, "providers", errors);
+    const providers = {};
+    for (const [id, entryRaw] of Object.entries(obj.providers)) {
+        const e = entryRaw;
+        const where = `providers.${id}`;
+        if (!e || typeof e !== "object") {
+            errors.push(`${where} must be an object`);
+            continue;
+        }
+        if (typeof e.enabled !== "boolean")
+            errors.push(`${where}.enabled must be a boolean`);
+        if (!TRUST.includes(e.trustClass))
+            errors.push(`${where}.trustClass is invalid`);
+        validateAuth(e.auth, `${where}.auth`, errors);
+        validateEgress(e.egress, `${where}.egress`, errors);
+        validateIo(e.io, `${where}.io`, errors);
+        if (errors.length === 0 || true) {
+            providers[id] = {
+                enabled: Boolean(e.enabled),
+                trustClass: e.trustClass,
+                auth: e.auth,
+                egress: e.egress,
+                io: e.io,
+            };
+        }
+    }
+    if (errors.length)
+        return { ok: false, errors };
+    return { ok: true, config: { version: 1, providers }, errors: [] };
+}
+function validateAuth(auth, where, errors) {
+    if (!auth || typeof auth !== "object") {
+        errors.push(`${where} must be an object`);
+        return;
+    }
+    const a = auth;
+    if (!REQ.includes(a.requirement))
+        errors.push(`${where}.requirement is invalid`);
+    for (const flag of ["allowPlainEnv", "allowProcessEnv", "allowCredentialFiles", "allowInteractiveLogin"]) {
+        if (typeof a[flag] !== "boolean")
+            errors.push(`${where}.${flag} must be a boolean`);
+    }
+    if (!Array.isArray(a.allowedSecretRefs)) {
+        errors.push(`${where}.allowedSecretRefs must be an array`);
+    }
+    else {
+        a.allowedSecretRefs.forEach((r, i) => {
+            const ref = r;
+            if (!ref || typeof ref.id !== "string" || !ref.id)
+                errors.push(`${where}.allowedSecretRefs[${i}].id is invalid`);
+            if (!SECRET_KINDS.includes(ref?.kind))
+                errors.push(`${where}.allowedSecretRefs[${i}].kind is invalid`);
+            if (typeof ref?.label !== "string" || !ref.label)
+                errors.push(`${where}.allowedSecretRefs[${i}].label is invalid`);
+        });
+    }
+}
+function validateEgress(egress, where, errors) {
+    if (!egress || typeof egress !== "object") {
+        errors.push(`${where} must be an object`);
+        return;
+    }
+    const g = egress;
+    if (!["none", "allowlist", "blocked"].includes(g.mode))
+        errors.push(`${where}.mode is invalid`);
+    for (const arr of ["allowedHosts", "blockedHosts"]) {
+        if (!Array.isArray(g[arr]) || g[arr].some((h) => typeof h !== "string")) {
+            errors.push(`${where}.${arr} must be an array of strings`);
+        }
+    }
+    for (const flag of ["allowLocalhost", "allowPrivateNetwork", "allowHttp", "allowHttps"]) {
+        if (typeof g[flag] !== "boolean")
+            errors.push(`${where}.${flag} must be a boolean`);
+    }
+    if (typeof g.maxRedirects !== "number")
+        errors.push(`${where}.maxRedirects must be a number`);
+}
+function validateIo(io, where, errors) {
+    if (!io || typeof io !== "object") {
+        errors.push(`${where} must be an object`);
+        return;
+    }
+    const i = io;
+    if (!IO.includes(i.filesystem))
+        errors.push(`${where}.filesystem is invalid`);
+    if (!IO.includes(i.terminal))
+        errors.push(`${where}.terminal is invalid`);
+}
+//# sourceMappingURL=providerPolicySchema.js.map

package/dist/config/providerPolicySchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerPolicySchema.js","sourceRoot":"","sources":["../../src/config/providerPolicySchema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AA4B3D,MAAM,KAAK,GAAiB,CAAC,YAAY,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AACrE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAC7C,MAAM,EAAE,GAAuB,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC;AACvE,MAAM,YAAY,GAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAE5E,4EAA4E;AAC5E,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY,EAAE,GAAa;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,mEAAmE,CAAC,CAAC;QACjH,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,gBAAgB,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAY;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,+BAA+B,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,oCAAoC,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,sDAAsD;IACtD,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAErD,MAAM,SAAS,GAAwC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,SAAoC,CAAC,EAAE,CAAC;QACtF,MAAM,CAAC,GAAG,QAAmC,CAAC;QAC9C,MAAM,KAAK,GAAG,aAAa,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAwB,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;QAC/F,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,EAAE,MAAM,CAAC,CAAC;QACpD,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,SAAS,CAAC,EAAE,CAAC,GAAG;gBACd,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC3B,UAAU,EAAE,CAAC,CAAC,UAAwB;gBACtC,IAAI,EAAE,CAAC,CAAC,IAA0B;gBAClC,MAAM,EAAE,CAAC,CAAC,MAA8B;gBACxC,EAAE,EAAE,CAAC,CAAC,EAA+B;aACtC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,KAAa,EAAE,MAAgB;IAClE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAqB,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IAC3F,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,EAAE,CAAC;QACzG,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,oBAAoB,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE;YACpD,MAAM,GAAG,GAAG,CAA4B,CAAC;YACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,sBAAsB,CAAC,iBAAiB,CAAC,CAAC;YACjH,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAqB,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;YACxH,IAAI,OAAO,GAAG,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,sBAAsB,CAAC,oBAAoB,CAAC,CAAC;QACrH,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAe,EAAE,KAAa,EAAE,MAAgB;IACtE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAc,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;IAC1G,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAK,CAAC,CAAC,GAAG,CAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACvF,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,GAAG,8BAA8B,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;QACxF,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,oBAAoB,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,UAAU,CAAC,EAAW,EAAE,KAAa,EAAE,MAAgB;IAC9D,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,EAA6B,CAAC;IACxC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,UAA8B,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IAClG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,QAA4B,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;AAChG,CAAC"}

package/dist/config/providerRunnability.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Resolve a provider's runnability from (definition + policy config + approval record).
+ *
+ * Fail-closed. A provider is runnable ONLY if it is implemented AND the capability gate is
+ * `allowed` (possibly via a *current* approval for a `requires_approval` policy). An approval
+ * can never make an unimplemented provider runnable; a stale approval never grants runnability.
+ */
+import { type ProviderApprovalRecord } from "./providerApprovalTypes.js";
+import type { ProviderPolicyEntry } from "./providerPolicySchema.js";
+import type { ProviderDefinition } from "../providers/providerTypes.js";
+import type { ProviderCapabilityGate } from "../security/securityTypes.js";
+export type RunnabilityStatus = "allowed" | "requires_approval" | "approved_but_not_implemented" | "stale_approval" | "blocked_policy_invalid" | "blocked_no_policy" | "blocked_not_implemented" | "blocked_unknown_trust" | "blocked_io_authority";
+export interface RunnabilityInput {
+    policyEntry?: ProviderPolicyEntry;
+    approval?: ProviderApprovalRecord;
+    policyInvalid?: boolean;
+}
+export interface RunnabilityResult {
+    providerId: string;
+    status: RunnabilityStatus;
+    runnable: boolean;
+    reason: string;
+    safeMessage: string;
+    defHash: string;
+    policyHash?: string;
+    gate: ProviderCapabilityGate;
+}
+export declare function resolveProviderStatus(def: ProviderDefinition, input?: RunnabilityInput): RunnabilityResult;
+/** The approval decisions to record for a provider under its current policy. */
+export declare function approvalDecisionsFor(gate: ProviderCapabilityGate): {
+    auth: "approved" | "not_applicable";
+    egress: "approved" | "not_applicable";
+    io: "approved" | "not_applicable";
+    runtime: "approved" | "not_applicable";
+};
+//# sourceMappingURL=providerRunnability.d.ts.map

package/dist/config/providerRunnability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerRunnability.d.ts","sourceRoot":"","sources":["../../src/config/providerRunnability.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,mBAAmB,GACnB,8BAA8B,GAC9B,gBAAgB,GAChB,wBAAwB,GACxB,mBAAmB,GACnB,yBAAyB,GACzB,uBAAuB,GACvB,sBAAsB,CAAC;AAE3B,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,sBAAsB,CAAC;CAC9B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,kBAAkB,EAAE,KAAK,GAAE,gBAAqB,GAAG,iBAAiB,CAkD9G;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,sBAAsB,GAAG;IAClE,IAAI,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACpC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAAC;IACtC,EAAE,EAAE,UAAU,GAAG,gBAAgB,CAAC;IAClC,OAAO,EAAE,UAAU,GAAG,gBAAgB,CAAC;CACxC,CAQA"}

package/dist/config/providerRunnability.js

@@ -0,0 +1,72 @@
+/**
+ * Resolve a provider's runnability from (definition + policy config + approval record).
+ *
+ * Fail-closed. A provider is runnable ONLY if it is implemented AND the capability gate is
+ * `allowed` (possibly via a *current* approval for a `requires_approval` policy). An approval
+ * can never make an unimplemented provider runnable; a stale approval never grants runnability.
+ */
+import { evaluateProviderSafety } from "../security/capabilityGate.js";
+import { applyPolicyToDefinition } from "./providerPolicyConfig.js";
+import { hashProviderDefinition, hashProviderPolicy } from "./providerPolicyHash.js";
+import { isApprovalCurrent } from "./providerApprovalTypes.js";
+export function resolveProviderStatus(def, input = {}) {
+    const merged = input.policyEntry ? applyPolicyToDefinition(def, input.policyEntry) : def;
+    const gate = evaluateProviderSafety(merged);
+    const defHash = hashProviderDefinition(merged);
+    const policyHash = input.policyEntry ? hashProviderPolicy(input.policyEntry) : undefined;
+    const out = (status, runnable, reason, safeMessage) => ({
+        providerId: def.id,
+        status,
+        runnable,
+        reason,
+        safeMessage,
+        defHash,
+        ...(policyHash ? { policyHash } : {}),
+        gate,
+    });
+    if (input.policyInvalid) {
+        return out("blocked_policy_invalid", false, "policy.invalid", `provider '${def.id}' has an invalid policy`);
+    }
+    // Implementation status (from the definition; config can never grant it).
+    if (!def.enabled) {
+        if (input.approval && policyHash && isApprovalCurrent(input.approval, defHash, policyHash)) {
+            return out("approved_but_not_implemented", false, "approved.not_implemented", `provider '${def.id}' is approved but not implemented (not runnable)`);
+        }
+        return out("blocked_not_implemented", false, "not_implemented", `provider '${def.id}' is not implemented`);
+    }
+    switch (gate.overallDecision.status) {
+        case "allowed":
+            return out("allowed", true, "approved", `provider '${def.id}' is allowed`);
+        case "requires_approval": {
+            if (!input.approval) {
+                return out("requires_approval", false, "requires_approval", `provider '${def.id}' requires explicit approval`);
+            }
+            if (!policyHash || !isApprovalCurrent(input.approval, defHash, policyHash)) {
+                return out("stale_approval", false, "stale_approval", `provider '${def.id}' approval is stale (definition/policy changed)`);
+            }
+            return out("allowed", true, "approved_via_approval", `provider '${def.id}' is allowed (current approval)`);
+        }
+        case "blocked":
+        default: {
+            const rc = gate.overallDecision.reasonCode;
+            if (rc === "unknown_trust")
+                return out("blocked_unknown_trust", false, rc, gate.overallDecision.safeMessage);
+            if (rc.startsWith("io"))
+                return out("blocked_io_authority", false, rc, gate.overallDecision.safeMessage);
+            if (rc.startsWith("auth") || rc.startsWith("egress"))
+                return out("blocked_no_policy", false, rc, gate.overallDecision.safeMessage);
+            return out("blocked_not_implemented", false, rc, gate.overallDecision.safeMessage);
+        }
+    }
+}
+/** The approval decisions to record for a provider under its current policy. */
+export function approvalDecisionsFor(gate) {
+    const d = (s) => (s === "not_applicable" ? "not_applicable" : "approved");
+    return {
+        auth: d(gate.authDecision.status),
+        egress: d(gate.egressDecision.status),
+        io: d(gate.ioDecision.status),
+        runtime: "approved",
+    };
+}
+//# sourceMappingURL=providerRunnability.js.map

package/dist/config/providerRunnability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerRunnability.js","sourceRoot":"","sources":["../../src/config/providerRunnability.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAA+B,MAAM,4BAA4B,CAAC;AAiC5F,MAAM,UAAU,qBAAqB,CAAC,GAAuB,EAAE,QAA0B,EAAE;IACzF,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACzF,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzF,MAAM,GAAG,GAAG,CAAC,MAAyB,EAAE,QAAiB,EAAE,MAAc,EAAE,WAAmB,EAAqB,EAAE,CAAC,CAAC;QACrH,UAAU,EAAE,GAAG,CAAC,EAAE;QAClB,MAAM;QACN,QAAQ;QACR,MAAM;QACN,WAAW;QACX,OAAO;QACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,IAAI;KACL,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,EAAE,aAAa,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;IAC9G,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,KAAK,CAAC,QAAQ,IAAI,UAAU,IAAI,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3F,OAAO,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,0BAA0B,EAAE,aAAa,GAAG,CAAC,EAAE,kDAAkD,CAAC,CAAC;QACvJ,CAAC;QACD,OAAO,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,iBAAiB,EAAE,aAAa,GAAG,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC7G,CAAC;IAED,QAAQ,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;QACpC,KAAK,SAAS;YACZ,OAAO,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;QAC7E,KAAK,mBAAmB,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,OAAO,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,EAAE,aAAa,GAAG,CAAC,EAAE,8BAA8B,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC,UAAU,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC3E,OAAO,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,aAAa,GAAG,CAAC,EAAE,iDAAiD,CAAC,CAAC;YAC9H,CAAC;YACD,OAAO,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,uBAAuB,EAAE,aAAa,GAAG,CAAC,EAAE,iCAAiC,CAAC,CAAC;QAC7G,CAAC;QACD,KAAK,SAAS,CAAC;QACf,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;YAC3C,IAAI,EAAE,KAAK,eAAe;gBAAE,OAAO,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YAC7G,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YACzG,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;YACnI,OAAO,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,IAA4B;IAM/D,MAAM,CAAC,GAAG,CAAC,CAAS,EAAiC,EAAE,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACjH,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QACrC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7B,OAAO,EAAE,UAAU;KACpB,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,31 @@
+/**
+ * JSON-RPC 2.0 error codes and a typed error the dispatcher maps to a safe error response.
+ *
+ * Error responses are deterministic and NEVER include stack traces on stdout (CLAUDE.md
+ * stdout-is-sacred rule applies to the agent side too).
+ */
+export declare const JSONRPC: {
+    readonly PARSE_ERROR: -32700;
+    readonly INVALID_REQUEST: -32600;
+    readonly METHOD_NOT_FOUND: -32601;
+    readonly INVALID_PARAMS: -32602;
+    readonly INTERNAL_ERROR: -32603;
+};
+export interface JsonRpcErrorShape {
+    code: number;
+    message: string;
+    data?: unknown;
+}
+/** An error that maps cleanly to a JSON-RPC error response. */
+export declare class AcpError extends Error {
+    readonly code: number;
+    readonly data?: unknown;
+    constructor(code: number, message: string, data?: unknown);
+    toResponseError(): JsonRpcErrorShape;
+    static methodNotFound(method: string): AcpError;
+    static invalidParams(message: string): AcpError;
+    static invalidRequest(message: string): AcpError;
+    static internal(message: string): AcpError;
+    static unsupportedProtocol(requested: unknown, supported: number): AcpError;
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,OAAO;;;;;;CAMV,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,+DAA+D;AAC/D,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;gBAEZ,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO;IAOzD,eAAe,IAAI,iBAAiB;IAMpC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ;IAG/C,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ;IAG/C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ;IAGhD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ;IAG1C,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ;CAM5E"}

package/dist/errors.js

@@ -0,0 +1,45 @@
+/**
+ * JSON-RPC 2.0 error codes and a typed error the dispatcher maps to a safe error response.
+ *
+ * Error responses are deterministic and NEVER include stack traces on stdout (CLAUDE.md
+ * stdout-is-sacred rule applies to the agent side too).
+ */
+export const JSONRPC = {
+    PARSE_ERROR: -32700,
+    INVALID_REQUEST: -32600,
+    METHOD_NOT_FOUND: -32601,
+    INVALID_PARAMS: -32602,
+    INTERNAL_ERROR: -32603,
+};
+/** An error that maps cleanly to a JSON-RPC error response. */
+export class AcpError extends Error {
+    code;
+    data;
+    constructor(code, message, data) {
+        super(message);
+        this.name = "AcpError";
+        this.code = code;
+        this.data = data;
+    }
+    toResponseError() {
+        return this.data === undefined
+            ? { code: this.code, message: this.message }
+            : { code: this.code, message: this.message, data: this.data };
+    }
+    static methodNotFound(method) {
+        return new AcpError(JSONRPC.METHOD_NOT_FOUND, `method not found: ${method}`);
+    }
+    static invalidParams(message) {
+        return new AcpError(JSONRPC.INVALID_PARAMS, `invalid params: ${message}`);
+    }
+    static invalidRequest(message) {
+        return new AcpError(JSONRPC.INVALID_REQUEST, `invalid request: ${message}`);
+    }
+    static internal(message) {
+        return new AcpError(JSONRPC.INTERNAL_ERROR, message);
+    }
+    static unsupportedProtocol(requested, supported) {
+        return new AcpError(JSONRPC.INVALID_PARAMS, `unsupported protocolVersion ${JSON.stringify(requested)} — this agent speaks ACP v${supported}`);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,WAAW,EAAE,CAAC,KAAK;IACnB,eAAe,EAAE,CAAC,KAAK;IACvB,gBAAgB,EAAE,CAAC,KAAK;IACxB,cAAc,EAAE,CAAC,KAAK;IACtB,cAAc,EAAE,CAAC,KAAK;CACd,CAAC;AAQX,+DAA+D;AAC/D,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAS;IACb,IAAI,CAAW;IAExB,YAAY,IAAY,EAAE,OAAe,EAAE,IAAc;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS;YAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,MAAc;QAClC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,CAAC,aAAa,CAAC,OAAe;QAClC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,OAAe;QACnC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,CAAC,QAAQ,CAAC,OAAe;QAC7B,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,CAAC,mBAAmB,CAAC,SAAkB,EAAE,SAAiB;QAC9D,OAAO,IAAI,QAAQ,CACjB,OAAO,CAAC,cAAc,EACtB,+BAA+B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,6BAA6B,SAAS,EAAE,CACjG,CAAC;IACJ,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,79 @@
+/**
+ * @xenosystem/acp-agent — XENO-owned ACP agent-side stdio endpoint.
+ *
+ * The inverse of `@xenosystem/acp-core` (the ACP *client*). Answers ACP v1 agent methods over stdio
+ * and runs as an external ACP-compatible subprocess:
+ *
+ *   node packages/agent/dist/cli.js agent --provider fixture
+ *
+ * XACP-005+ adds a provider-adapter foundation: a typed `Provider` contract, registry, event
+ * model, error taxonomy, and safety validator. Runnable paths today are the fixture plus
+ * approval-gated `xeno-local`, `claude-local`, and `codex-local`; Gemini/OpenCode/Kimi/GLM/Hermes stay
+ * blocked placeholders. ACP mode keeps stdout JSON-RPC-only.
+ */
+export { normalizeAgentPromptBlocks, normalizeXenoSystemPrompt, startAcpAgent, XENO_CHOOSE_DIRECTORY_METHOD, XENO_CHOOSE_WORKSPACE_PLACEMENT_METHOD, XENO_CONTEXT_META_KEY, XENO_META_KEY, type AgentServerOptions, type AgentServerHandle, } from "./acpAgentServer.js";
+export { SessionStore, type AgentSession } from "./sessionStore.js";
+export { createStdioServer, logStderr, type StdioServer, type StdioServerHandlers } from "./stdioJsonRpc.js";
+export { AcpError, JSONRPC } from "./errors.js";
+export { VERSION, AGENT_NAME, AGENT_TITLE, ACP_PROTOCOL_VERSION } from "./version.js";
+export type { SessionUpdate, InitializeResult, StopReason, ToolStatus, ToolKind } from "./types.js";
+export { ProviderRegistry, createDefaultRegistry, createPlaceholderDefinitions, } from "./providers/providerRegistry.js";
+export { buildProviderDiscoverySummary, defaultOnlyModelDiscovery, isSafeProviderModelId, providerDisplayName, resolveProviderModelDiscovery, staticModelDiscovery, validateProviderModelSelection, type ProviderDiscoverySummary, type ProviderModelValidation, } from "./providers/providerDiscovery.js";
+export { discoverCodexCliModels, parseCodexModelCatalog, type CodexModelCatalogOptions, } from "./providers/codexModelCatalog.js";
+export { createFixtureProviderDefinition, FIXTURE_CAPABILITIES, FIXTURE_FINAL_TEXT, } from "./providers/fixtureProvider.js";
+export { createXenoLocalDefinition, emitXenoLocalStream, xenoLocalAdapterCommand, XENO_LOCAL_ID, XENO_LOCAL_CAPABILITIES, XENO_LOCAL_FINAL_TEXT, type XenoLocalMode, } from "./providers/xenoLocalProvider.js";
+export { createClaudeLocalDefinition, claudeLocalCommand, renderPromptText, stableClaudeSessionUuid, CLAUDE_LOCAL_ID, CLAUDE_LOCAL_DEFAULT_EXECUTABLE, CLAUDE_LOCAL_CAPABILITIES, CLAUDE_LOCAL_ENV_ALLOWLIST_KEYS, CLAUDE_LOCAL_ENV_BLOCKLIST_KEYS, type ClaudeLocalOptions, } from "./providers/claudeLocalProvider.js";
+export { parseClaudeStreamJson, type ClaudeParseResult, type ClaudeParseContext, } from "./providers/claudeStreamJsonParser.js";
+export { CODEX_HOST_REQUEST_CLOSE_TAG, CODEX_HOST_REQUEST_OPEN_TAG, parseCodexExecJson, type CodexChooseDirectoryHostRequest, type CodexChooseWorkspacePlacementHostRequest, type CodexHostRequest, type CodexParseResult, type CodexParseContext, } from "./providers/codexExecJsonParser.js";
+export { createCodexLocalDefinition, codexLocalCommand, renderCodexPromptText, CODEX_LOCAL_ID, CODEX_LOCAL_DEFAULT_EXECUTABLE, CODEX_LOCAL_CAPABILITIES, CODEX_LOCAL_ENV_ALLOWLIST_KEYS, CODEX_LOCAL_ENV_BLOCKLIST_KEYS, type CodexLocalOptions, } from "./providers/codexLocalProvider.js";
+export { type RealProviderStdoutParser } from "./adapters/adapterHarnessTypes.js";
+export { validateProviderSafety, type SafetyClassification, type SafetyResult, } from "./providers/providerSafety.js";
+export { providerEventToAcpUpdate, createEventFactory, isTerminalEvent, type ProviderEvent, type ProviderEventKind, } from "./providers/providerEvents.js";
+export { ProviderError, ProviderConfigurationError, ProviderAuthRequiredError, ProviderRateLimitError, ProviderUnavailableError, ProviderTimeoutError, ProviderCancelledError, ProviderProtocolError, ProviderSafetyViolationError, ProviderNotImplementedError, ProviderInternalError, buildProviderAuthFailureDiagnostic, type ProviderAuthFailureDiagnostic, type ProviderErrorCode, } from "./providers/providerErrors.js";
+export type { ProviderDefinition, ProviderRuntime, ProviderRuntimeConfig, ProviderRuntimeContext, ProviderHostChooseDirectoryRequest, ProviderHostChooseDirectoryResponse, ProviderHostChooseWorkspacePlacementRequest, ProviderHostChooseWorkspacePlacementResponse, ProviderHostContext, ProviderSession, ProviderPromptRequest, ProviderPromptResult, ProviderCapabilitySet, ProviderKind, ProviderMetadata, ProviderModelChoice, ProviderModelDiscovery, ProviderModelDiscoverySource, ProviderModelDiscoveryStatus, ProviderStreamingMetadata, ProviderVersionReadiness, TrustClass, } from "./providers/providerTypes.js";
+export { evaluateProviderSafety, isGateAllowed, } from "./security/capabilityGate.js";
+export { validateProviderAuthPolicy, validateSecretReference, summarizeAuthPolicy, NO_AUTH_POLICY, } from "./security/authPolicy.js";
+export { validateUrlAgainstEgressPolicy, isHostAllowed, validateHost, normalizeHost, isLocalhost, isPrivateHost, summarizeEgressPolicy, NO_EGRESS_POLICY, } from "./security/egressPolicy.js";
+export { redactSecretLikeText, redactSecretLikeValue, redactEnvRecord, looksSecretLike } from "./security/redaction.js";
+export { buildProviderDiagnostic, type ProviderDiagnostic } from "./security/securityDiagnostics.js";
+export { SecretStoreError, createUnavailableSecretStore, createMemorySecretStore, type SecretStore, type SecretStoreBackend, type SecretStoreDiagnostics, type SecretStoreErrorCode, type SecretStoreValue, } from "./security/secretStore.js";
+export { buildSecretBindingReview, parseSecretBindingArg, type SecretBinding, type SecretBindingReview, } from "./security/secretBinding.js";
+export { loadProviderPolicyConfig, getPolicyEntry, applyPolicyToDefinition, stripJsonc, type LoadedPolicyConfig, } from "./config/providerPolicyConfig.js";
+export { validateProviderPolicyConfig, type ProviderPolicyConfig, type ProviderPolicyEntry, type PolicyValidationResult, } from "./config/providerPolicySchema.js";
+export { hashProviderDefinition, hashProviderPolicy } from "./config/providerPolicyHash.js";
+export { ProviderApprovalStore, createApprovalRecord, } from "./config/providerApprovalStore.js";
+export { isApprovalCurrent, type ProviderApprovalRecord, type ApprovalStoreFile, } from "./config/providerApprovalTypes.js";
+export { resolveProviderStatus, approvalDecisionsFor, type RunnabilityStatus, type RunnabilityResult, } from "./config/providerRunnability.js";
+export { buildPolicyReview, type PolicyReview } from "./config/providerPolicyDiagnostics.js";
+export { createProviderSandboxContext, type CreateSandboxOptions, type SandboxTransports, } from "./sandbox/providerSandbox.js";
+export { SandboxError, type SandboxErrorCode } from "./sandbox/sandboxErrors.js";
+export { createSandboxAudit } from "./sandbox/providerSandboxAudit.js";
+export { createSandboxNetwork } from "./sandbox/sandboxNetwork.js";
+export { createSandboxSecrets } from "./sandbox/sandboxSecrets.js";
+export { createSandboxFilesystem } from "./sandbox/sandboxFilesystem.js";
+export { createSandboxTerminal } from "./sandbox/sandboxTerminal.js";
+export { createSandboxCancellation } from "./sandbox/sandboxCancellation.js";
+export { createSandboxDiagnostics } from "./sandbox/providerSandboxDiagnostics.js";
+export type { ProviderSandboxContext, SandboxNetwork, SandboxNetworkRequest, SandboxNetworkResponse, NetworkTransport, SandboxSecrets, ProviderSecretValue, SecretResolver, SandboxFilesystem, FsBackend, SandboxTerminal, TerminalRunner, SandboxCancellation, SandboxAudit, SandboxAuditEvent, SandboxAuditKind, SandboxDiagnosticsSummary, } from "./sandbox/providerSandboxTypes.js";
+export type { ProviderAuthPolicy, ProviderEgressPolicy, ProviderEgressRule, ProviderSecretReference, ProviderCapabilityGate, ProviderSafetyDecision, ProviderSafetyDiagnostic, ProviderRedactionPolicy, SafetyStatus, } from "./security/securityTypes.js";
+export { createProviderProcessSupervisor, type ProviderProcessSupervisor, type SupervisorOptions, } from "./process/providerProcessSupervisor.js";
+export { validateProviderProcessConfig, VALIDATION_BOUNDS, type ValidatedProviderProcessConfig, } from "./process/providerProcessValidation.js";
+export { buildProviderEnv, envKeyList, redactedEnvForAudit, type BuildProviderEnvOptions, } from "./process/providerProcessEnvironment.js";
+export { createTempWorkspace, useExistingWorkspace, redactWorkspace, type PreparedWorkspace, } from "./process/providerProcessWorkspace.js";
+export { BoundedCapture } from "./process/providerProcessOutput.js";
+export { createProviderProcessAudit } from "./process/providerProcessAudit.js";
+export { buildProcessDiagnostics, minimalSupervisorEnforcement, enforcementSummaryLines, } from "./process/providerProcessDiagnostics.js";
+export { ProviderProcessError, type ProviderProcessErrorCode, } from "./process/providerProcessErrors.js";
+export { MINIMAL_SUPERVISOR_ENFORCEMENT, type ProviderProcessConfig, type ProviderProcessHandle, type ProviderProcessResult, type ProviderProcessStatus, type ProviderProcessAudit, type ProviderProcessAuditEvent, type ProviderProcessAuditKind, type ProviderProcessDiagnostics, type ProviderProcessEnforcement, } from "./process/providerProcessTypes.js";
+export { runAdapterPrompt } from "./adapters/adapterProcessHarness.js";
+export { parseAdapterOutput, safeSnippet, MAX_LINE_BYTES } from "./adapters/adapterEventParser.js";
+export { mapAdapterEvents, type MappedAdapterEvents } from "./adapters/adapterEventMapper.js";
+export { buildAdapterHarnessDiagnostics } from "./adapters/adapterDiagnostics.js";
+export { AdapterHarnessError, type AdapterHarnessErrorCode } from "./adapters/adapterErrors.js";
+export { createTestAdapterDefinition, TEST_ADAPTER_ID, TEST_ADAPTER_CAPABILITIES, } from "./adapters/testAdapterProvider.js";
+export type { AdapterHarnessConfig, AdapterHarnessResult, AdapterHarnessDiagnostics, ParsedAdapterEvent, AdapterParseDiagnostic, AdapterParseOutcome, } from "./adapters/adapterHarnessTypes.js";
+export { ADAPTER_RUNTIME_CONTRACT_VERSION, SUPPORTED_CONTRACT_VERSIONS, isSupportedContractVersion, resolveContractVersion, type AdapterRuntimeContractVersion, } from "./adapters/adapterContractVersion.js";
+export { validateAdapterProtocolEvent, ADAPTER_PROTOCOL_EVENT_TYPES, type AdapterProtocolEvent, type AdapterProtocolEnvelope, type AdapterProtocolEventType, type AdapterProtocolValidation, type AdapterProtocolRejectReason, } from "./adapters/adapterEventProtocol.js";
+export { ADAPTER_FAILURE_CODES, describeAdapterFailure, isAdapterFailureCode, failureCodeForRunnability, type AdapterFailureCode, type AdapterFailureDescriptor, } from "./adapters/adapterFailureTaxonomy.js";
+export { PROVIDER_EVENT_KINDS, TERMINAL_PROVIDER_EVENT_KINDS, PROVIDER_EVENT_TO_ACP, isValidProviderEvent, isTerminalProviderEventKind, buildProviderRuntimeDiagnostics, type ProviderRuntimeDiagnosticsV1, type ProviderAuditEventV1, } from "./adapters/providerContractTypes.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,aAAa,EACb,4BAA4B,EAC5B,sCAAsC,EACtC,qBAAqB,EACrB,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7G,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACtF,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGpG,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,6BAA6B,EAC7B,oBAAoB,EACpB,8BAA8B,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,aAAa,GACnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,+BAA+B,EAC/B,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,kBAAkB,EAClB,KAAK,+BAA+B,EACpC,KAAK,wCAAwC,EAC7C,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,8BAA8B,EAC9B,wBAAwB,EACxB,8BAA8B,EAC9B,8BAA8B,EAC9B,KAAK,iBAAiB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,KAAK,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAClF,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,qBAAqB,EACrB,kCAAkC,EAClC,KAAK,6BAA6B,EAClC,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,kCAAkC,EAClC,mCAAmC,EACnC,2CAA2C,EAC3C,4CAA4C,EAC5C,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAC5B,yBAAyB,EACzB,wBAAwB,EACxB,UAAU,GACX,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,sBAAsB,EACtB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,8BAA8B,EAC9B,aAAa,EACb,YAAY,EACZ,aAAa,EACb,WAAW,EACX,aAAa,EACb,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACxH,OAAO,EAAE,uBAAuB,EAAE,KAAK,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACrG,OAAO,EACL,gBAAgB,EAChB,4BAA4B,EAC5B,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,wBAAwB,EACxB,cAAc,EACd,uBAAuB,EACvB,UAAU,EACV,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,GAC5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAC5F,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAG7F,OAAO,EACL,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,SAAS,EACT,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,YAAY,GACb,MAAM,6BAA6B,CAAC;AAIrC,OAAO,EACL,+BAA+B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,GACvB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,6BAA6B,EAC7B,iBAAiB,EACjB,KAAK,8BAA8B,GACpC,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,KAAK,uBAAuB,GAC7B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,KAAK,iBAAiB,GACvB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAC;AAI3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,KAAK,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC9F,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,KAAK,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EACL,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,GACjC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,GAC9B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,+BAA+B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,oBAAoB,GAC1B,MAAM,qCAAqC,CAAC"}