@xenosystem/acp 0.1.1

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,9 @@
+xeno-acp
+Copyright 2026 XENO Corporation
+
+This product includes software developed at XENO Corporation.
+
+Built on the Agent Client Protocol SDK (@agentclientprotocol/sdk), Apache-2.0.
+Drives external ACP agents (Claude Code, Codex, OpenCode, Gemini CLI) via their
+official ACP adapters / native ACP modes, using the operator's own provider
+credentials.

package/README.md

@@ -0,0 +1,24 @@
+# @xenosystem/acp
+
+OpenAI-compatible HTTP gateway over ACP agents, built on
+[`@xenosystem/acp-core`](https://www.npmjs.com/package/@xenosystem/acp-core).
+
+```bash
+npm install --global @xenosystem/acp
+xeno-acp --help
+xeno-acp init
+# Edit xeno-acp.config.jsonc, including the local bearer key and enabled agents.
+xeno-acp --config ./xeno-acp.config.jsonc
+```
+
+```bash
+curl -N localhost:8787/v1/chat/completions \
+  -H "authorization: Bearer dev-key" -H "content-type: application/json" \
+  -d '{"model":"claude-code","stream":true,
+       "messages":[{"role":"user","content":"Hello!"}]}'
+```
+
+Endpoints: `GET /v1/models`, `POST /v1/chat/completions`, `GET /healthz`.
+Public beta. Each configured provider uses the operator's own local installation and account;
+XENO ACP does not proxy credentials. See the
+[product documentation](https://xenostudio.ai/docs/acp). Apache-2.0.

package/dist/auth.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Bearer-key auth and per-app agent allowlists.
+ *
+ * Scope is single-owner / many-internal-apps (SPEC §9): every key maps to one of the
+ * owner's apps for attribution and an optional agent allowlist. `open` mode disables auth
+ * for local development only.
+ */
+import type { ResolvedConfig } from "@xenosystem/acp-core";
+export interface Principal {
+    app: string;
+    /** Agent ids this principal may use, or "*" for all. */
+    agents: string[];
+    maxConcurrentSessions?: number;
+}
+export declare class Authenticator {
+    private readonly open;
+    private readonly byKey;
+    constructor(config: ResolvedConfig);
+    get isOpen(): boolean;
+    /** Extract a bearer token from an Authorization header (or `x-api-key`). */
+    static extractToken(headers: Record<string, unknown>): string | undefined;
+    /** Resolve a token to a principal, or null if rejected. In open mode, always allows. */
+    authenticate(token: string | undefined): Principal | null;
+    /** Whether a principal may use a given agent id. */
+    static canUseAgent(principal: Principal, agentId: string): boolean;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAY,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAErE,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA+B;gBAEzC,MAAM,EAAE,cAAc;IAKlC,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,4EAA4E;IAC5E,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS;IAYzE,wFAAwF;IACxF,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI;IAgBzD,oDAAoD;IACpD,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;CAGnE"}

package/dist/auth.js

@@ -0,0 +1,58 @@
+/**
+ * Bearer-key auth and per-app agent allowlists.
+ *
+ * Scope is single-owner / many-internal-apps (SPEC §9): every key maps to one of the
+ * owner's apps for attribution and an optional agent allowlist. `open` mode disables auth
+ * for local development only.
+ */
+export class Authenticator {
+    open;
+    byKey = new Map();
+    constructor(config) {
+        this.open = config.server.auth === "open";
+        for (const k of config.keys)
+            if (k.key)
+                this.byKey.set(k.key, k);
+    }
+    get isOpen() {
+        return this.open;
+    }
+    /** Extract a bearer token from an Authorization header (or `x-api-key`). */
+    static extractToken(headers) {
+        const auth = headers["authorization"];
+        if (typeof auth === "string") {
+            const m = /^Bearer\s+(.+)$/i.exec(auth.trim());
+            if (m)
+                return m[1];
+            if (auth.trim())
+                return auth.trim();
+        }
+        const apiKey = headers["x-api-key"];
+        if (typeof apiKey === "string" && apiKey.trim())
+            return apiKey.trim();
+        return undefined;
+    }
+    /** Resolve a token to a principal, or null if rejected. In open mode, always allows. */
+    authenticate(token) {
+        if (this.open) {
+            return { app: "open", agents: ["*"] };
+        }
+        if (!token)
+            return null;
+        const entry = this.byKey.get(token);
+        if (!entry)
+            return null;
+        return {
+            app: entry.app,
+            agents: entry.agents,
+            ...(entry.maxConcurrentSessions !== undefined
+                ? { maxConcurrentSessions: entry.maxConcurrentSessions }
+                : {}),
+        };
+    }
+    /** Whether a principal may use a given agent id. */
+    static canUseAgent(principal, agentId) {
+        return principal.agents.includes("*") || principal.agents.includes(agentId);
+    }
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,MAAM,OAAO,aAAa;IACP,IAAI,CAAU;IACd,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAErD,YAAY,MAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI;YAAE,IAAI,CAAC,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,4EAA4E;IAC5E,MAAM,CAAC,YAAY,CAAC,OAAgC;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,wFAAwF;IACxF,YAAY,CAAC,KAAyB;QACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,MAAM,CAAC,WAAW,CAAC,SAAoB,EAAE,OAAe;QACtD,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9E,CAAC;CACF"}

package/dist/context.d.ts

@@ -0,0 +1,16 @@
+import type { AcpManager, ResolvedConfig } from "@xenosystem/acp-core";
+import type { Authenticator } from "./auth.js";
+/** Shared context handed to every route registrar. */
+export interface RouteContext {
+    manager: AcpManager;
+    auth: Authenticator;
+    config: ResolvedConfig;
+}
+export declare function errorBody(message: string, code: string, type?: string): {
+    error: {
+        message: string;
+        type: string;
+        code: string;
+    };
+};
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,UAAU,CAAC;IACpB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,wBAAgB,SAAS,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,SAA0B,GAC7B;IAAE,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAE5D"}

package/dist/context.js

@@ -0,0 +1,4 @@
+export function errorBody(message, code, type = "invalid_request_error") {
+    return { error: { message, type, code } };
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,SAAS,CACvB,OAAe,EACf,IAAY,EACZ,IAAI,GAAG,uBAAuB;IAE9B,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;AAC5C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * xeno-acp gateway CLI bootstrap.
+ *
+ * Usage:
+ *   xeno-acp [--config <path>] [--host <h>] [--port <n>]
+ *   xeno-acp --help
+ *   xeno-acp --version
+ * Env overrides: XENO_ACP_CONFIG, HOST, PORT, XENO_ACP_LOG.
+ */
+export { buildServer } from "./server.js";
+export declare const VERSION = "0.1.1";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAUH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,eAAO,MAAM,OAAO,UAAU,CAAC"}

package/dist/index.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+/**
+ * xeno-acp gateway CLI bootstrap.
+ *
+ * Usage:
+ *   xeno-acp [--config <path>] [--host <h>] [--port <n>]
+ *   xeno-acp --help
+ *   xeno-acp --version
+ * Env overrides: XENO_ACP_CONFIG, HOST, PORT, XENO_ACP_LOG.
+ */
+import { copyFileSync, existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { loadConfig, createLogger } from "@xenosystem/acp-core";
+import { buildServer } from "./server.js";
+// Re-export the pure app factory so tests/embedders can build a server without
+// starting one (importing this module must have no side effects).
+export { buildServer } from "./server.js";
+const log = createLogger("server");
+export const VERSION = "0.1.1";
+function usage() {
+    return [
+        `xeno-acp ${VERSION} — OpenAI-compatible ACP gateway`,
+        "",
+        "Usage:",
+        "  xeno-acp [--config <path>] [--host <host>] [--port <port>]",
+        "  xeno-acp init [--output <path>]",
+        "  xeno-acp --help",
+        "  xeno-acp --version",
+        "",
+        "Environment:",
+        "  XENO_ACP_CONFIG   configuration file path",
+        "  HOST              listen host override",
+        "  PORT              listen port override",
+        "  XENO_ACP_LOG      log level",
+        "",
+    ].join("\n");
+}
+function flag(args, name) {
+    const i = args.indexOf(name);
+    return i !== -1 && i + 1 < args.length ? args[i + 1] : undefined;
+}
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.includes("--version") || args[0] === "version") {
+        process.stdout.write(`xeno-acp ${VERSION}\n`);
+        return;
+    }
+    if (args.includes("--help") || args.includes("-h") || args[0] === "help") {
+        process.stdout.write(usage());
+        return;
+    }
+    if (args[0] === "init") {
+        const output = resolve(flag(args, "--output") ?? "xeno-acp.config.jsonc");
+        if (existsSync(output)) {
+            throw new Error(`refusing to overwrite existing config: ${output}`);
+        }
+        const template = fileURLToPath(new URL("../xeno-acp.config.example.jsonc", import.meta.url));
+        copyFileSync(template, output);
+        process.stdout.write(`created ${output}\n`);
+        return;
+    }
+    const configPath = flag(args, "--config");
+    const config = loadConfig(configPath ? { path: configPath } : {});
+    // CLI / env overrides for host & port.
+    const host = flag(args, "--host") ?? process.env.HOST ?? config.server.host;
+    const port = Number(flag(args, "--port") ?? process.env.PORT ?? config.server.port);
+    config.server.host = host;
+    config.server.port = port;
+    const { app, manager } = buildServer(config);
+    await app.listen({ host, port });
+    log.info(`listening on http://${host}:${port}  ` +
+        `(auth=${config.server.auth}, agents=[${config.agents.map((a) => a.id).join(", ")}])`);
+    if (config.server.auth === "open") {
+        log.warn("auth=open — no API key required. Use this for local dev only.");
+    }
+    const shutdown = async (sig) => {
+        log.info(`${sig} → shutting down`);
+        try {
+            await app.close();
+            await manager.dispose();
+        }
+        finally {
+            process.exit(0);
+        }
+    };
+    process.on("SIGINT", () => void shutdown("SIGINT"));
+    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+}
+// Only auto-start when invoked as the entry point (e.g. `node dist/index.js` or the bin).
+// Importing this module (tests, embedders) must not start a server.
+const invokedDirectly = process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (invokedDirectly) {
+    main().catch((err) => {
+        log.error("fatal:", err);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,+EAA+E;AAC/E,kEAAkE;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,SAAS,KAAK;IACZ,OAAO;QACL,YAAY,OAAO,kCAAkC;QACrD,EAAE;QACF,QAAQ;QACR,8DAA8D;QAC9D,mCAAmC;QACnC,mBAAmB;QACnB,sBAAsB;QACtB,EAAE;QACF,cAAc;QACd,6CAA6C;QAC7C,0CAA0C;QAC1C,0CAA0C;QAC1C,+BAA+B;QAC/B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,IAAc,EAAE,IAAY;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,IAAI,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,uBAAuB,CAAC,CAAC;QAC1E,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAC5B,IAAI,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAC7D,CAAC;QACF,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,IAAI,CAAC,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAElE,uCAAuC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpF,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IAE1B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjC,GAAG,CAAC,IAAI,CACN,uBAAuB,IAAI,IAAI,IAAI,IAAI;QACrC,SAAS,MAAM,CAAC,MAAM,CAAC,IAAI,aAAa,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACxF,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;QACpD,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1B,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,0FAA0F;AAC1F,oEAAoE;AACpE,MAAM,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAE3F,IAAI,eAAe,EAAE,CAAC;IACpB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/openai.d.ts

@@ -0,0 +1,61 @@
+/**
+ * OpenAI chat-completions request/response shapes and helpers.
+ *
+ * This is the ONLY place that knows the OpenAI schema — the engine (@xenosystem/acp-core) stays
+ * framework- and protocol-neutral. The server translates: OpenAI request → core prompt →
+ * flattened core stream → OpenAI response/SSE.
+ */
+import type { ChatMessage } from "@xenosystem/acp-core";
+export type OpenAIContent = string | null | Array<{
+    type: string;
+    text?: string;
+    [k: string]: unknown;
+}>;
+export interface OpenAIMessage {
+    role: "system" | "user" | "assistant" | "tool" | "developer";
+    content: OpenAIContent;
+    name?: string;
+}
+export interface XenoExtension {
+    session?: string;
+    workspace?: string;
+    verbose?: boolean;
+    mode?: string;
+}
+export interface ChatCompletionRequest {
+    model: string;
+    messages: OpenAIMessage[];
+    stream?: boolean;
+    /** XENO-specific options (additive, non-OpenAI). */
+    xeno?: XenoExtension;
+    temperature?: number;
+    top_p?: number;
+    max_tokens?: number;
+    user?: string;
+}
+export interface Usage {
+    prompt_tokens: number;
+    completion_tokens: number;
+    total_tokens: number;
+}
+export declare function makeCompletionId(): string;
+/** Unix seconds. (Plain Node runtime — Date is available here.) */
+export declare function nowSeconds(): number;
+/** Normalize OpenAI messages into the engine's `ChatMessage[]`. */
+export declare function normalizeMessages(messages: OpenAIMessage[]): ChatMessage[];
+export interface CompletionParts {
+    id: string;
+    created: number;
+    model: string;
+}
+export declare function buildCompletion(parts: CompletionParts, text: string, finishReason: string, usage: Usage): unknown;
+export declare function buildChunk(parts: CompletionParts, delta: Record<string, unknown>, finishReason: string | null): unknown;
+export declare function sse(data: unknown): string;
+export declare const SSE_DONE = "data: [DONE]\n\n";
+/** Best-effort usage object when the agent didn't report token counts. */
+export declare function usageFrom(u: {
+    prompt?: number;
+    completion?: number;
+    total?: number;
+} | undefined): Usage;
+//# sourceMappingURL=openai.d.ts.map

package/dist/openai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../src/openai.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,IAAI,GACJ,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,GAAG,WAAW,CAAC;IAC7D,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oDAAoD;IACpD,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,KAAK;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,mEAAmE;AACnE,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAYD,mEAAmE;AACnE,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,CAS1E;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,KAAK,GACX,OAAO,CAeT;AAED,wBAAgB,UAAU,CACxB,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,GAC1B,OAAO,CAQT;AAED,wBAAgB,GAAG,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEzC;AAED,eAAO,MAAM,QAAQ,qBAAqB,CAAC;AAE3C,0EAA0E;AAC1E,wBAAgB,SAAS,CACvB,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACtE,KAAK,CAKP"}

package/dist/openai.js

@@ -0,0 +1,74 @@
+/**
+ * OpenAI chat-completions request/response shapes and helpers.
+ *
+ * This is the ONLY place that knows the OpenAI schema — the engine (@xenosystem/acp-core) stays
+ * framework- and protocol-neutral. The server translates: OpenAI request → core prompt →
+ * flattened core stream → OpenAI response/SSE.
+ */
+import { randomUUID } from "node:crypto";
+export function makeCompletionId() {
+    return `chatcmpl-${randomUUID().replace(/-/g, "")}`;
+}
+/** Unix seconds. (Plain Node runtime — Date is available here.) */
+export function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}
+/** Flatten OpenAI message content (string | parts) into a plain string. */
+function contentToText(content) {
+    if (content == null)
+        return "";
+    if (typeof content === "string")
+        return content;
+    return content
+        .map((part) => (typeof part?.text === "string" ? part.text : ""))
+        .filter(Boolean)
+        .join("");
+}
+/** Normalize OpenAI messages into the engine's `ChatMessage[]`. */
+export function normalizeMessages(messages) {
+    return messages.map((m) => {
+        const role = m.role === "developer" ? "system" : m.role;
+        return {
+            role: role,
+            content: contentToText(m.content),
+            ...(m.name ? { name: m.name } : {}),
+        };
+    });
+}
+export function buildCompletion(parts, text, finishReason, usage) {
+    return {
+        id: parts.id,
+        object: "chat.completion",
+        created: parts.created,
+        model: parts.model,
+        choices: [
+            {
+                index: 0,
+                message: { role: "assistant", content: text },
+                finish_reason: finishReason,
+            },
+        ],
+        usage,
+    };
+}
+export function buildChunk(parts, delta, finishReason) {
+    return {
+        id: parts.id,
+        object: "chat.completion.chunk",
+        created: parts.created,
+        model: parts.model,
+        choices: [{ index: 0, delta, finish_reason: finishReason }],
+    };
+}
+export function sse(data) {
+    return `data: ${JSON.stringify(data)}\n\n`;
+}
+export const SSE_DONE = "data: [DONE]\n\n";
+/** Best-effort usage object when the agent didn't report token counts. */
+export function usageFrom(u) {
+    const prompt = u?.prompt ?? 0;
+    const completion = u?.completion ?? 0;
+    const total = u?.total ?? prompt + completion;
+    return { prompt_tokens: prompt, completion_tokens: completion, total_tokens: total };
+}
+//# sourceMappingURL=openai.js.map

package/dist/openai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../src/openai.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAwCzC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,YAAY,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,2EAA2E;AAC3E,SAAS,aAAa,CAAC,OAAsB;IAC3C,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAChE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,iBAAiB,CAAC,QAAyB;IACzD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,IAA2B;YACjC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YACjC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAQD,MAAM,UAAU,eAAe,CAC7B,KAAsB,EACtB,IAAY,EACZ,YAAoB,EACpB,KAAY;IAEZ,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC7C,aAAa,EAAE,YAAY;aAC5B;SACF;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,KAAsB,EACtB,KAA8B,EAC9B,YAA2B;IAE3B,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,uBAAuB;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,IAAa;IAC/B,OAAO,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAE3C,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CACvB,CAAuE;IAEvE,MAAM,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,CAAC,EAAE,UAAU,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,MAAM,GAAG,UAAU,CAAC;IAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACvF,CAAC"}

package/dist/routes/chat.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+import { type RouteContext } from "../context.js";
+export declare function registerChat(app: FastifyInstance, ctx: RouteContext): void;
+//# sourceMappingURL=chat.d.ts.map

package/dist/routes/chat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat.d.ts","sourceRoot":"","sources":["../../src/routes/chat.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAG7E,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAc7D,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,GAAG,IAAI,CAqG1E"}

package/dist/routes/chat.js

@@ -0,0 +1,89 @@
+import { flatten, resolveModel } from "@xenosystem/acp-core";
+import { Authenticator } from "../auth.js";
+import { errorBody } from "../context.js";
+import { buildChunk, buildCompletion, makeCompletionId, normalizeMessages, nowSeconds, sse, SSE_DONE, usageFrom, } from "../openai.js";
+export function registerChat(app, ctx) {
+    app.post("/v1/chat/completions", async (req, reply) => {
+        const principal = ctx.auth.authenticate(Authenticator.extractToken(req.headers));
+        if (!principal) {
+            return reply.code(401).send(errorBody("invalid or missing API key", "invalid_api_key"));
+        }
+        const body = req.body;
+        if (!body || typeof body.model !== "string" || !Array.isArray(body.messages)) {
+            return reply
+                .code(400)
+                .send(errorBody("`model` and `messages` are required", "invalid_request_error"));
+        }
+        const { id: agentId, submodel } = resolveModel(body.model);
+        if (!ctx.manager.hasAgent(agentId)) {
+            return reply.code(404).send(errorBody(`unknown model/agent: ${agentId}`, "model_not_found"));
+        }
+        if (!Authenticator.canUseAgent(principal, agentId)) {
+            return reply
+                .code(403)
+                .send(errorBody(`app "${principal.app}" is not permitted to use agent "${agentId}"`, "permission_denied", "permission_error"));
+        }
+        const verbose = body.xeno?.verbose ?? false;
+        const promptOpts = {
+            messages: normalizeMessages(body.messages),
+            model: submodel ?? null,
+            ...(body.xeno?.session ? { session: body.xeno.session } : {}),
+            ...(body.xeno?.workspace ? { workspace: body.xeno.workspace } : {}),
+            ...(body.xeno?.mode ? { mode: body.xeno.mode } : {}),
+        };
+        // Abort the turn if the client disconnects.
+        const ac = new AbortController();
+        reply.raw.on("close", () => ac.abort());
+        promptOpts.signal = ac.signal;
+        const parts = {
+            id: makeCompletionId(),
+            created: nowSeconds(),
+            model: body.model,
+        };
+        if (body.stream) {
+            reply.hijack();
+            reply.raw.writeHead(200, {
+                "content-type": "text/event-stream; charset=utf-8",
+                "cache-control": "no-cache, no-transform",
+                connection: "keep-alive",
+                "x-accel-buffering": "no",
+            });
+            // Initial role chunk.
+            reply.raw.write(sse(buildChunk(parts, { role: "assistant" }, null)));
+            let finishReason = "stop";
+            try {
+                for await (const chunk of flatten(ctx.manager.prompt(body.model, promptOpts), {
+                    verbose,
+                })) {
+                    if (chunk.type === "delta") {
+                        reply.raw.write(sse(buildChunk(parts, { content: chunk.text }, null)));
+                    }
+                    else {
+                        finishReason = chunk.finishReason;
+                    }
+                }
+            }
+            catch (err) {
+                reply.raw.write(sse(buildChunk(parts, { content: `\n[xeno-acp error] ${err.message}\n` }, null)));
+            }
+            reply.raw.write(sse(buildChunk(parts, {}, finishReason)));
+            reply.raw.write(SSE_DONE);
+            reply.raw.end();
+            return reply;
+        }
+        // Non-streaming: collect the whole turn.
+        let text = "";
+        let finishReason = "stop";
+        let usage;
+        for await (const chunk of flatten(ctx.manager.prompt(body.model, promptOpts), { verbose })) {
+            if (chunk.type === "delta")
+                text += chunk.text;
+            else {
+                finishReason = chunk.finishReason;
+                usage = chunk.usage;
+            }
+        }
+        return reply.send(buildCompletion(parts, text, finishReason, usageFrom(usage)));
+    });
+}
+//# sourceMappingURL=chat.js.map

package/dist/routes/chat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat.js","sourceRoot":"","sources":["../../src/routes/chat.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAsB,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAqB,MAAM,eAAe,CAAC;AAC7D,OAAO,EACL,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,GAAG,EACH,QAAQ,EACR,SAAS,GAGV,MAAM,cAAc,CAAC;AAEtB,MAAM,UAAU,YAAY,CAAC,GAAoB,EAAE,GAAiB;IAClE,GAAG,CAAC,IAAI,CACN,sBAAsB,EACtB,KAAK,EAAE,GAAoD,EAAE,KAAmB,EAAE,EAAE;QAClF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,4BAA4B,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,SAAS,CAAC,qCAAqC,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,wBAAwB,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YACnD,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CACH,SAAS,CACP,QAAQ,SAAS,CAAC,GAAG,oCAAoC,OAAO,GAAG,EACnE,mBAAmB,EACnB,kBAAkB,CACnB,CACF,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;QAC5C,MAAM,UAAU,GAAkB;YAChC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC1C,KAAK,EAAE,QAAQ,IAAI,IAAI;YACvB,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;QAEF,4CAA4C;QAC5C,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QACxC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;QAE9B,MAAM,KAAK,GAAoB;YAC7B,EAAE,EAAE,gBAAgB,EAAE;YACtB,OAAO,EAAE,UAAU,EAAE;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,EAAE,CAAC;YACf,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACvB,cAAc,EAAE,kCAAkC;gBAClD,eAAe,EAAE,wBAAwB;gBACzC,UAAU,EAAE,YAAY;gBACxB,mBAAmB,EAAE,IAAI;aAC1B,CAAC,CAAC;YACH,sBAAsB;YACtB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAErE,IAAI,YAAY,GAAG,MAAM,CAAC;YAC1B,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE;oBAC5E,OAAO;iBACR,CAAC,EAAE,CAAC;oBACH,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;oBACzE,CAAC;yBAAM,CAAC;wBACN,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,GAAG,CAAC,KAAK,CACb,GAAG,CACD,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,sBAAuB,GAAa,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,CAAC,CACvF,CACF,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;YAC1D,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,YAAY,GAAG,MAAM,CAAC;QAC1B,IAAI,KAA2E,CAAC;QAChF,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3F,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;gBAAE,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;iBAC1C,CAAC;gBACJ,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;gBAClC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/routes/health.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+import type { RouteContext } from "../context.js";
+export declare function registerHealth(app: FastifyInstance, ctx: RouteContext): void;
+//# sourceMappingURL=health.d.ts.map

package/dist/routes/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/routes/health.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,GAAG,IAAI,CAyB5E"}

package/dist/routes/health.js

@@ -0,0 +1,26 @@
+export function registerHealth(app, ctx) {
+    app.get("/healthz", async () => ({
+        status: "ok",
+        service: "xeno-acp",
+        config: {
+            server: {
+                auth: ctx.config.server.auth,
+                host: ctx.config.server.host,
+                port: ctx.config.server.port,
+            },
+            defaults: {
+                permission: ctx.config.defaults.permission,
+                maxConcurrentSessions: ctx.config.defaults.maxConcurrentSessions,
+                terminalTimeoutMs: ctx.config.defaults.terminalTimeoutMs,
+                initTimeoutMs: ctx.config.defaults.initTimeoutMs,
+            },
+        },
+        agents: ctx.manager.statuses(),
+    }));
+    app.get("/", async () => ({
+        service: "xeno-acp",
+        description: "OpenAI-compatible gateway over ACP agents",
+        endpoints: ["/v1/models", "/v1/chat/completions", "/healthz"],
+    }));
+}
+//# sourceMappingURL=health.js.map

package/dist/routes/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/routes/health.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,cAAc,CAAC,GAAoB,EAAE,GAAiB;IACpE,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC/B,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE;YACN,MAAM,EAAE;gBACN,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;gBAC5B,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;gBAC5B,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;aAC7B;YACD,QAAQ,EAAE;gBACR,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU;gBAC1C,qBAAqB,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB;gBAChE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB;gBACxD,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa;aACjD;SACF;QACD,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE;KAC/B,CAAC,CAAC,CAAC;IAEJ,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACxB,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,2CAA2C;QACxD,SAAS,EAAE,CAAC,YAAY,EAAE,sBAAsB,EAAE,UAAU,CAAC;KAC9D,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/routes/models.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from "fastify";
+import { type RouteContext } from "../context.js";
+export declare function registerModels(app: FastifyInstance, ctx: RouteContext): void;
+//# sourceMappingURL=models.d.ts.map

package/dist/routes/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/routes/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAE7E,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7D,wBAAgB,cAAc,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,GAAG,IAAI,CAmB5E"}

package/dist/routes/models.js

@@ -0,0 +1,24 @@
+import { Authenticator } from "../auth.js";
+import { errorBody } from "../context.js";
+import { nowSeconds } from "../openai.js";
+export function registerModels(app, ctx) {
+    app.get("/v1/models", async (req, reply) => {
+        const principal = ctx.auth.authenticate(Authenticator.extractToken(req.headers));
+        if (!principal) {
+            return reply.code(401).send(errorBody("invalid or missing API key", "invalid_api_key"));
+        }
+        const created = nowSeconds();
+        const data = ctx.manager
+            .listAgents()
+            .filter((a) => Authenticator.canUseAgent(principal, a.id))
+            .map((a) => ({
+            id: a.id,
+            object: "model",
+            created,
+            owned_by: "xeno-acp",
+            name: a.name,
+        }));
+        return { object: "list", data };
+    });
+}
+//# sourceMappingURL=models.js.map

package/dist/routes/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/routes/models.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAqB,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,UAAU,cAAc,CAAC,GAAoB,EAAE,GAAiB;IACpE,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,EAAE,GAAmB,EAAE,KAAmB,EAAE,EAAE;QACvE,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,4BAA4B,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO;aACrB,UAAU,EAAE;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;aACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,OAAO;YACf,OAAO;YACP,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC,CAAC,CAAC;QACN,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Builds the Fastify app and wires a single shared `AcpManager`.
+ *
+ * The server is a thin translation shell over @xenosystem/acp-core: it owns no agent logic, only
+ * the OpenAI request/response mapping and auth.
+ */
+import { type FastifyInstance } from "fastify";
+import { AcpManager, type ResolvedConfig } from "@xenosystem/acp-core";
+export interface BuiltServer {
+    app: FastifyInstance;
+    manager: AcpManager;
+}
+export declare function buildServer(config: ResolvedConfig): BuiltServer;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,UAAU,EAAgB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAOrF,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,eAAe,CAAC;IACrB,OAAO,EAAE,UAAU,CAAC;CACrB;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,WAAW,CAyB/D"}

package/dist/server.js

@@ -0,0 +1,35 @@
+/**
+ * Builds the Fastify app and wires a single shared `AcpManager`.
+ *
+ * The server is a thin translation shell over @xenosystem/acp-core: it owns no agent logic, only
+ * the OpenAI request/response mapping and auth.
+ */
+import Fastify from "fastify";
+import { AcpManager, createLogger } from "@xenosystem/acp-core";
+import { Authenticator } from "./auth.js";
+import { registerHealth } from "./routes/health.js";
+import { registerModels } from "./routes/models.js";
+import { registerChat } from "./routes/chat.js";
+export function buildServer(config) {
+    const app = Fastify({
+        logger: false,
+        bodyLimit: 16 * 1024 * 1024, // 16 MB — room for long histories / inline content
+    });
+    const manager = new AcpManager(config, createLogger("server"));
+    const auth = new Authenticator(config);
+    const ctx = { manager, auth, config };
+    registerHealth(app, ctx);
+    registerModels(app, ctx);
+    registerChat(app, ctx);
+    app.setErrorHandler((err, _req, reply) => {
+        reply.code(err.statusCode ?? 500).send({
+            error: {
+                message: err.message,
+                type: "server_error",
+                code: "internal_error",
+            },
+        });
+    });
+    return { app, manager };
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAuB,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAOhD,MAAM,UAAU,WAAW,CAAC,MAAsB;IAChD,MAAM,GAAG,GAAG,OAAO,CAAC;QAClB,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,mDAAmD;KACjF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,GAAG,GAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEpD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEvB,GAAG,CAAC,eAAe,CAAC,CAAC,GAAoC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACxE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YACrC,KAAK,EAAE;gBACL,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,cAAc;gBACpB,IAAI,EAAE,gBAAgB;aACvB;SACF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@xenosystem/acp",
+  "version": "0.1.1",
+  "description": "OpenAI-compatible HTTP gateway for xeno-acp: drive any ACP agent via /v1/chat/completions.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "xeno-acp": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "xeno-acp.config.example.jsonc"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "acp",
+    "agent-client-protocol",
+    "openai-compatible",
+    "ai-gateway",
+    "xeno"
+  ],
+  "homepage": "https://xenostudio.ai/product/acp",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/XENO-CORPORATION/xeno-acp.git",
+    "directory": "packages/server"
+  },
+  "bugs": {
+    "url": "https://github.com/XENO-CORPORATION/xeno-acp/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "fastify": "^5.1.0",
+    "@xenosystem/acp-core": "^0.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.9.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.6.3"
+  },
+  "scripts": {
+    "dev": "tsx watch src/index.ts",
+    "start": "node dist/index.js",
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "clean": "rimraf dist *.tsbuildinfo"
+  }
+}

package/xeno-acp.config.example.jsonc

@@ -0,0 +1,99 @@
+{
+  // xeno-acp configuration. Copy to `xeno-acp.config.jsonc` (gitignored) and edit.
+  // String values support ${ENV_VAR} expansion.
+
+  "server": {
+    "host": "127.0.0.1",
+    "port": 8787,
+    // Auth mode: "bearer" (require a known key) or "open" (dev only — no auth).
+    "auth": "bearer"
+  },
+
+  // Default working-directory root for sandboxed session workspaces.
+  // Each session gets `${workspaceRoot}/<agentId>/<sessionId>/`.
+  "workspaceRoot": "./.xeno-acp/workspaces",
+  // Keep session workspaces after the turn ends (default false → cleaned up).
+  "keepWorkspaces": false,
+
+  // Per-agent defaults (can be overridden inside each agent entry).
+  "defaults": {
+    "maxConcurrentSessions": 4,
+    "permission": "auto", // "auto" | "deny" | "prompt"
+    "terminalTimeoutMs": 120000,
+    "initTimeoutMs": 60000
+  },
+
+  // Enabled agents. `id` is what consumers pass as the OpenAI `model`.
+  // Omit an entry to disable that agent. Built-in defaults exist for these agents;
+  // listing them here lets you override cmd/args/env/model.
+  "agents": [
+    {
+      "id": "claude-code",
+      "name": "Claude Code",
+      // Official Zed ACP adapter for Claude Code (bridges Claude Code's CLI to ACP).
+      "cmd": "npx",
+      "args": ["-y", "@zed-industries/claude-code-acp"],
+      "defaultModel": null
+      // Uses your existing Claude / Anthropic login.
+    },
+    {
+      "id": "codex",
+      "name": "Codex CLI",
+      "cmd": "npx",
+      "args": ["-y", "@zed-industries/codex-acp"],
+      "defaultModel": null
+      // Uses your existing ChatGPT / OpenAI (Codex) login.
+    },
+    {
+      "id": "opencode",
+      "name": "OpenCode",
+      // OpenCode speaks ACP natively.
+      "cmd": "opencode",
+      "args": ["acp"],
+      "defaultModel": null
+    },
+    {
+      "id": "gemini",
+      "name": "Gemini CLI",
+      // Gemini CLI speaks ACP natively via --acp.
+      "cmd": "gemini",
+      "args": ["--acp"],
+      "defaultModel": null
+      // Uses your Google login or GEMINI_API_KEY.
+    },
+    {
+      "id": "kimi",
+      "name": "Kimi CLI",
+      // Kimi CLI speaks ACP natively via `kimi acp`.
+      "cmd": "kimi",
+      "args": ["acp"],
+      "defaultModel": null
+      // Uses your existing Kimi / Moonshot login.
+    },
+    {
+      "id": "glm",
+      "name": "GLM Agent",
+      // GLM Agent is an ACP Registry package for Z.AI GLM Coding Plan.
+      "cmd": "npx",
+      "args": ["-y", "glm-acp-agent@latest"],
+      "defaultModel": null
+      // Uses your Z.AI Coding Plan auth.
+    }
+  ],
+
+  // Per-app API keys. Each consuming XENO app gets its own key for attribution,
+  // an optional agent allowlist, and optional limits. All consumers are the owner's apps.
+  "keys": [
+    {
+      "key": "dev-key",
+      "app": "local-dev",
+      "agents": ["*"], // "*" = all enabled agents, or a list of agent ids
+      "maxConcurrentSessions": 8
+    }
+    // {
+    //   "key": "${XENO_WORKFLOW_KEY}",
+    //   "app": "xeno-workflow",
+    //   "agents": ["claude-code", "codex"]
+    // }
+  ]
+}