@gaunt-sloth/core 2.0.0-alpha.3 → 2.0.0-alpha.31

package/dist/config/schema.d.ts

@@ -0,0 +1,2999 @@
+/**
+ * @packageDocumentation
+ * Zod schema for the on-disk raw Gaunt Sloth config (`RawGthConfig`).
+ *
+ * This is the single source of truth for config validation and for the generated
+ * JSON Schema (`packages/core/schema/gsloth-config.schema.json`). It models the
+ * canonical config shape only — the deprecated aliases (`contentProvider`,
+ * `requirementsProvider`, `contentProviderConfig`, `requirementsProviderConfig`)
+ * are intentionally NOT part of the schema. GS2-28 (a 2.0 breaking release with NO
+ * back-compat coercion) turns those deprecated shapes into HARD validation errors:
+ * {@link findDeprecatedConfigIssues} detects them on the raw input BEFORE the schema
+ * parse and each entry point (loader `validateRawConfigLayer`, read-side
+ * {@link validateRawGthConfig}) rejects the config with a message naming the canonical
+ * replacement + migration path. Detection runs on the RAW input on purpose: zod's
+ * per-command `z.object` strips unknown keys, so a nested `commands.*.contentProvider`
+ * would vanish before any schema-embedded check could see it.
+ *
+ * Design notes:
+ * - The top-level object is a {@link z.looseObject} so unknown keys PASS THROUGH
+ *   (they are neither stripped nor a hard failure). The loader separately diffs
+ *   present-vs-known top-level keys ({@link findUnknownTopLevelKeys}) to warn about
+ *   likely typos without failing. That typo-tolerance is deliberate: only the KNOWN
+ *   deprecated names ({@link findDeprecatedConfigIssues}) hard-fail; a genuine typo
+ *   (e.g. `pulrequest`) still only warns.
+ * - Every field is optional. The schema validates the *shape/type of what is
+ *   present*, not requiredness. In particular `llm` is optional so the loader's
+ *   existing "must at least define llm.type" checks remain the authority on llm
+ *   validity (and keep emitting their established messages).
+ * - Runtime-object-bearing fields (`tools`, `middleware`, `mcpServers`,
+ *   `a2aAgents`, `builtInToolsConfig`) are modelled permissively because JS/MJS
+ *   `configure()` returns live instances/objects there.
+ *
+ * The exported {@link RawGthConfig}/{@link GthConfig} interfaces in `config.ts`
+ * remain the public type surface; the `z.infer` here ({@link RawGthConfigInput})
+ * is additive and legitimately differs (no deprecated fields).
+ */
+import { z } from 'zod';
+/**
+ * EXT-71 §3.1 — the **subject** axis of a rule entry, and only that: `shell` is a command, `tool`
+ * a built-in or custom in-process tool, `mcpTool` a server's tool. The hand-written twin is
+ * `ApprovalEntryType` in `shell-policy.ts`. What holds the two together is
+ * `approvalEntrySchema.spec.ts`, where a list of `ApprovalEntry`-typed literals is parsed by this
+ * schema: a value either side stops accepting fails there. That is a weaker pin than a direct
+ * equality assertion — it catches a narrowing, not a widening on one side alone.
+ */
+export declare const APPROVAL_ENTRY_TYPES: readonly ['shell', 'tool', 'mcpTool'];
+/**
+ * EXT-71 §3.1 — the **comparison** axis of a rule entry, and only that. `exact`/`glob`/`regexp`
+ * take a string pattern; `hint` takes an object over the annotation names and is valid on tool
+ * subjects only (on `shell` it is a config error — see {@link shellEntrySchema}).
+ */
+export declare const APPROVAL_ENTRY_MATCHERS: readonly ['exact', 'glob', 'regexp', 'hint'];
+/**
+ * EXT-71 §3.1 / §4.7 — the four MCP `ToolAnnotations` booleans a `hint` pattern may name, and the
+ * names a user may list in `approvals.mcp.*.trustAnnotations` (§4.7.1). This is the whole
+ * vocabulary: an unknown name is a config error, never an ignored key, because a hint pattern that
+ * quietly drops a constraint matches MORE than its author wrote, and a trust list that quietly
+ * drops one reads as working while believing something else.
+ *
+ * **The runtime twin `TOOL_ANNOTATION_HINTS` in `shell-policy.ts` is a deliberate duplicate, and
+ * the reason is layering, not oversight.** Neither file may import the other. This module must stay
+ * pure and cwd/fs-independent because it feeds `z.toJSONSchema()` (see the header), and importing
+ * `shell-policy.ts` would pull `core/types.js` and the whole runtime policy surface into it;
+ * importing this module from there would in turn pull zod into every module that only wanted a
+ * policy type. So the vocabulary is written once per layer on purpose — do not "simplify" it by
+ * making one import the other. The equality assertion in `mcpApprovalsBlock.spec.ts` is what fails
+ * when they drift.
+ */
+export declare const HINT_ANNOTATION_KEYS: readonly ['readOnlyHint', 'destructiveHint', 'idempotentHint', 'openWorldHint'];
+/**
+ * EXT-71 §3.1 — the length cap on a `regexp` pattern, enforced when the config LOADS.
+ *
+ * 200 characters. The longest pattern the spec itself writes is under 40, and every rule entry
+ * names one command or tool shape rather than a grammar, so 200 is an order of magnitude of
+ * headroom over real use while still bounding what the matcher can ever be handed. The cap is a
+ * cheap load-time bound, NOT a backtracking defence — a short pattern can backtrack
+ * catastrophically too, and the run-time match budget is the separate backstop for that. What the
+ * cap buys is that a pattern nobody could have read and reviewed cannot be smuggled past load.
+ */
+export declare const APPROVAL_REGEXP_MAX_LENGTH = 200;
+/**
+ * EXT-71 §3.1 — **one** entry in `allow`, `deny` or `escalate`. All three lists take the same
+ * shape, so there is one schema and the list a rule sits in decides only what a match DOES.
+ *
+ * `type`, `matcher` and `pattern` are required on every arm: no field is inferred, and no entry
+ * reads two ways. Every arm is a strict object, so any field the grammar does not define — a typo,
+ * a `server` on a `shell` entry, a `host` on a `shell` entry — is an unrecognized-key error rather
+ * than a silently-ignored key that would widen what the entry matches.
+ *
+ * The `id` is what makes the emitted JSON Schema hoist this union into `$defs` and reference it,
+ * instead of inlining all eleven arms into each of the twenty-four places a rule list appears
+ * (three lists × the root plus seven commands). That is the difference between a schema an editor loads
+ * and one it chokes on, and `$ref` is the standard spelling every JSON Schema consumer already
+ * understands.
+ */
+export declare const approvalEntrySchema: z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodLiteral<"shell">;
+    matcher: z.ZodLiteral<"exact">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodLiteral<"shell">;
+    matcher: z.ZodLiteral<"glob">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    type: z.ZodLiteral<"shell">;
+    matcher: z.ZodLiteral<"regexp">;
+    pattern: z.ZodString;
+}, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"exact">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"glob">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"regexp">;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"tool">;
+    matcher: z.ZodLiteral<"hint">;
+    pattern: z.ZodObject<{
+        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"exact">;
+    server: z.ZodString;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"glob">;
+    server: z.ZodString;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"regexp">;
+    server: z.ZodString;
+    pattern: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    rate: z.ZodOptional<z.ZodBoolean>;
+    host: z.ZodOptional<z.ZodString>;
+    type: z.ZodLiteral<"mcpTool">;
+    matcher: z.ZodLiteral<"hint">;
+    server: z.ZodString;
+    pattern: z.ZodObject<{
+        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "matcher">], "type">;
+/**
+ * EXT-71 §3.1 — render an entry in the object form the user would write in a config file, with the
+ * fields in grammar order (`type`, `server`, `matcher`, `pattern`, then the optional bounds).
+ *
+ * The ONE place that spelling is produced, because it is shown in two very different moments that
+ * must agree: the load-time error that tells a user what to write instead of their bare string, and
+ * the escalation menu's *this is what will be stored* line (§6). A grant the menu describes one way
+ * and stores another is exactly the drift this design cannot afford.
+ */
+export declare function renderApprovalEntryObject(entry: {
+    type: string;
+    matcher: string;
+    pattern: unknown;
+    server?: string;
+    host?: string;
+    rate?: boolean;
+}): string;
+/**
+ * EXT-71 §2.3/§9.1 — render the object form of a bare string found in a rule list, so the
+ * migration error shows the user the entry they should have written *for their own string*
+ * rather than a generic example.
+ */
+export declare function renderApprovalEntryForString(pattern: string): string;
+/**
+ * Zod schema for the raw, on-disk Gaunt Sloth config. Loose at the top level so
+ * unknown keys are preserved (warn-only via {@link findUnknownTopLevelKeys}).
+ */
+export declare const rawGthConfigSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    llm: z.ZodOptional<z.ZodObject<{
+        type: z.ZodOptional<z.ZodString>;
+        model: z.ZodOptional<z.ZodString>;
+        configuration: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        apiKeyEnvironmentVariable: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+    extends: z.ZodOptional<z.ZodString>;
+    agent: z.ZodOptional<z.ZodObject<{
+        backend: z.ZodOptional<z.ZodEnum<{
+            deep: "deep";
+            lean: "lean";
+        }>>;
+    }, z.core.$strip>>;
+    history: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        dbPath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    memory: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<{
+            audio: "audio";
+            binary: "binary";
+            file: "file";
+            image: "image";
+            video: "video";
+        }>;
+        extensions: z.ZodArray<z.ZodString>;
+        maxSize: z.ZodOptional<z.ZodNumber>;
+        mimeTypes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>]>>;
+    contentSource: z.ZodOptional<z.ZodString>;
+    requirementSource: z.ZodOptional<z.ZodString>;
+    contentSourceConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    requirementSourceConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    prompts: z.ZodOptional<z.ZodObject<{
+        backstory: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        guidelines: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        system: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        chat: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        code: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        exec: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+        review: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            path: z.ZodOptional<z.ZodString>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            mode: z.ZodOptional<z.ZodEnum<{
+                append: "append";
+                replace: "replace";
+            }>>;
+        }, z.core.$strip>]>>;
+    }, z.core.$strip>>;
+    identityProfile: z.ZodOptional<z.ZodString>;
+    includeCurrentDateAfterGuidelines: z.ZodOptional<z.ZodBoolean>;
+    organization: z.ZodOptional<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        locale: z.ZodOptional<z.ZodString>;
+        timezone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    noDefaultPrompts: z.ZodOptional<z.ZodBoolean>;
+    filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
+        all: "all";
+        none: "none";
+        read: "read";
+    }>]>>;
+    builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        command: z.ZodOptional<z.ZodString>;
+        timeout: z.ZodOptional<z.ZodNumber>;
+        maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+        fileSet: z.ZodOptional<z.ZodEnum<{
+            all: "all";
+            gitignore: "gitignore";
+        }>>;
+    }, z.core.$strip>]>>]>>;
+    approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        assisted: "assisted";
+        auto: "auto";
+        bypass: "bypass";
+        manual: "manual";
+        write: "write";
+    }>, z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            assisted: "assisted";
+            auto: "auto";
+            bypass: "bypass";
+            manual: "manual";
+            write: "write";
+        }>>;
+        rater: z.ZodOptional<z.ZodString>;
+        allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"hint">;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"exact">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"glob">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"regexp">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"hint">;
+            server: z.ZodString;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">], "type">>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"hint">;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"exact">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"glob">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"regexp">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"hint">;
+            server: z.ZodString;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">], "type">>>;
+        escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            type: z.ZodLiteral<"shell">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"exact">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"glob">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"regexp">;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"tool">;
+            matcher: z.ZodLiteral<"hint">;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"exact">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"glob">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"regexp">;
+            server: z.ZodString;
+            pattern: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            rate: z.ZodOptional<z.ZodBoolean>;
+            host: z.ZodOptional<z.ZodString>;
+            type: z.ZodLiteral<"mcpTool">;
+            matcher: z.ZodLiteral<"hint">;
+            server: z.ZodString;
+            pattern: z.ZodObject<{
+                readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                openWorldHint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>;
+        }, z.core.$strict>], "matcher">], "type">>>;
+        raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        mcp: z.ZodOptional<z.ZodObject<{
+            defaults: z.ZodOptional<z.ZodObject<{
+                trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    destructiveHint: "destructiveHint";
+                    idempotentHint: "idempotentHint";
+                    openWorldHint: "openWorldHint";
+                    readOnlyHint: "readOnlyHint";
+                }>>>;
+            }, z.core.$strict>>;
+            servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    destructiveHint: "destructiveHint";
+                    idempotentHint: "idempotentHint";
+                    openWorldHint: "openWorldHint";
+                    readOnlyHint: "readOnlyHint";
+                }>>>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strip>]>>;
+    tools: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    middleware: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+    streamOutput: z.ZodOptional<z.ZodBoolean>;
+    writeOutputToFile: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>;
+    writeBinaryOutputsToFile: z.ZodOptional<z.ZodBoolean>;
+    useColour: z.ZodOptional<z.ZodBoolean>;
+    useMouse: z.ZodOptional<z.ZodBoolean>;
+    tui: z.ZodOptional<z.ZodBoolean>;
+    streamSessionInferenceLog: z.ZodOptional<z.ZodBoolean>;
+    canInterruptInferenceWithEsc: z.ZodOptional<z.ZodBoolean>;
+    debugLog: z.ZodOptional<z.ZodBoolean>;
+    recursionLimit: z.ZodOptional<z.ZodNumber>;
+    consoleLevel: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    customTools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        command: z.ZodString;
+        description: z.ZodString;
+        parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            description: z.ZodString;
+            allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                "absolute-paths": "absolute-paths";
+                "directory-traversal": "directory-traversal";
+                "null-bytes": "null-bytes";
+                "shell-injection": "shell-injection";
+            }>>>;
+        }, z.core.$strip>>>;
+        timeout: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
+    mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    tls: z.ZodOptional<z.ZodObject<{
+        extraCaCerts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        rejectUnauthorized: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    a2aAgents: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    builtInToolsConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    aiignore: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    commands: z.ZodOptional<z.ZodObject<{
+        pr: z.ZodOptional<z.ZodObject<{
+            contentSource: z.ZodOptional<z.ZodString>;
+            requirementSource: z.ZodOptional<z.ZodString>;
+            filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
+                all: "all";
+                none: "none";
+                read: "read";
+            }>]>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
+            customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
+                command: z.ZodString;
+                description: z.ZodString;
+                parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                    description: z.ZodString;
+                    allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        "absolute-paths": "absolute-paths";
+                        "directory-traversal": "directory-traversal";
+                        "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
+                    }>>>;
+                }, z.core.$strip>>>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>]>>;
+            allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            logWorkForReviewInSeconds: z.ZodOptional<z.ZodNumber>;
+            rating: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                passThreshold: z.ZodOptional<z.ZodNumber>;
+                maxRating: z.ZodOptional<z.ZodNumber>;
+                minRating: z.ZodOptional<z.ZodNumber>;
+                errorOnReviewFail: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    audio: "audio";
+                    binary: "binary";
+                    file: "file";
+                    image: "image";
+                    video: "video";
+                }>;
+                extensions: z.ZodArray<z.ZodString>;
+                maxSize: z.ZodOptional<z.ZodNumber>;
+                mimeTypes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strip>>]>>;
+        }, z.core.$strip>>;
+        review: z.ZodOptional<z.ZodObject<{
+            contentSource: z.ZodOptional<z.ZodString>;
+            requirementSource: z.ZodOptional<z.ZodString>;
+            filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
+                all: "all";
+                none: "none";
+                read: "read";
+            }>]>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
+            customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
+                command: z.ZodString;
+                description: z.ZodString;
+                parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                    description: z.ZodString;
+                    allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        "absolute-paths": "absolute-paths";
+                        "directory-traversal": "directory-traversal";
+                        "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
+                    }>>>;
+                }, z.core.$strip>>>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>]>>;
+            allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            rating: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                passThreshold: z.ZodOptional<z.ZodNumber>;
+                maxRating: z.ZodOptional<z.ZodNumber>;
+                minRating: z.ZodOptional<z.ZodNumber>;
+                errorOnReviewFail: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    audio: "audio";
+                    binary: "binary";
+                    file: "file";
+                    image: "image";
+                    video: "video";
+                }>;
+                extensions: z.ZodArray<z.ZodString>;
+                maxSize: z.ZodOptional<z.ZodNumber>;
+                mimeTypes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strip>>]>>;
+        }, z.core.$strip>>;
+        ask: z.ZodOptional<z.ZodObject<{
+            filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
+                all: "all";
+                none: "none";
+                read: "read";
+            }>]>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
+            customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
+                command: z.ZodString;
+                description: z.ZodString;
+                parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                    description: z.ZodString;
+                    allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        "absolute-paths": "absolute-paths";
+                        "directory-traversal": "directory-traversal";
+                        "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
+                    }>>>;
+                }, z.core.$strip>>>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>]>>;
+            allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    audio: "audio";
+                    binary: "binary";
+                    file: "file";
+                    image: "image";
+                    video: "video";
+                }>;
+                extensions: z.ZodArray<z.ZodString>;
+                maxSize: z.ZodOptional<z.ZodNumber>;
+                mimeTypes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strip>>]>>;
+        }, z.core.$strip>>;
+        chat: z.ZodOptional<z.ZodObject<{
+            filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
+                all: "all";
+                none: "none";
+                read: "read";
+            }>]>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
+            customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
+                command: z.ZodString;
+                description: z.ZodString;
+                parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                    description: z.ZodString;
+                    allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        "absolute-paths": "absolute-paths";
+                        "directory-traversal": "directory-traversal";
+                        "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
+                    }>>>;
+                }, z.core.$strip>>>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>]>>;
+            allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    audio: "audio";
+                    binary: "binary";
+                    file: "file";
+                    image: "image";
+                    video: "video";
+                }>;
+                extensions: z.ZodArray<z.ZodString>;
+                maxSize: z.ZodOptional<z.ZodNumber>;
+                mimeTypes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strip>>]>>;
+        }, z.core.$strip>>;
+        code: z.ZodOptional<z.ZodObject<{
+            filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
+                all: "all";
+                none: "none";
+                read: "read";
+            }>]>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
+            customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
+                command: z.ZodString;
+                description: z.ZodString;
+                parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                    description: z.ZodString;
+                    allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        "absolute-paths": "absolute-paths";
+                        "directory-traversal": "directory-traversal";
+                        "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
+                    }>>>;
+                }, z.core.$strip>>>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>]>>;
+            allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    audio: "audio";
+                    binary: "binary";
+                    file: "file";
+                    image: "image";
+                    video: "video";
+                }>;
+                extensions: z.ZodArray<z.ZodString>;
+                maxSize: z.ZodOptional<z.ZodNumber>;
+                mimeTypes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strip>>]>>;
+        }, z.core.$strip>>;
+        exec: z.ZodOptional<z.ZodObject<{
+            filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
+                all: "all";
+                none: "none";
+                read: "read";
+            }>]>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
+            customTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodRecord<z.ZodString, z.ZodObject<{
+                command: z.ZodString;
+                description: z.ZodString;
+                parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                    description: z.ZodString;
+                    allow: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        "absolute-paths": "absolute-paths";
+                        "directory-traversal": "directory-traversal";
+                        "null-bytes": "null-bytes";
+                        "shell-injection": "shell-injection";
+                    }>>>;
+                }, z.core.$strip>>>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>]>>;
+            allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            binaryFormats: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    audio: "audio";
+                    binary: "binary";
+                    file: "file";
+                    image: "image";
+                    video: "video";
+                }>;
+                extensions: z.ZodArray<z.ZodString>;
+                maxSize: z.ZodOptional<z.ZodNumber>;
+                mimeTypes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strip>>]>>;
+        }, z.core.$strip>>;
+        api: z.ZodOptional<z.ZodObject<{
+            filesystem: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodEnum<{
+                all: "all";
+                none: "none";
+                read: "read";
+            }>]>>;
+            builtInTools: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                command: z.ZodOptional<z.ZodString>;
+                timeout: z.ZodOptional<z.ZodNumber>;
+                maxOutputBytes: z.ZodOptional<z.ZodNumber>;
+                fileSet: z.ZodOptional<z.ZodEnum<{
+                    all: "all";
+                    gitignore: "gitignore";
+                }>>;
+            }, z.core.$strip>]>>]>>;
+            approvals: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+                assisted: "assisted";
+                auto: "auto";
+                bypass: "bypass";
+                manual: "manual";
+                write: "write";
+            }>, z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    assisted: "assisted";
+                    auto: "auto";
+                    bypass: "bypass";
+                    manual: "manual";
+                    write: "write";
+                }>>;
+                rater: z.ZodOptional<z.ZodString>;
+                allow: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                escalate: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    type: z.ZodLiteral<"shell">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"tool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"exact">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"glob">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"regexp">;
+                    server: z.ZodString;
+                    pattern: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    rate: z.ZodOptional<z.ZodBoolean>;
+                    host: z.ZodOptional<z.ZodString>;
+                    type: z.ZodLiteral<"mcpTool">;
+                    matcher: z.ZodLiteral<"hint">;
+                    server: z.ZodString;
+                    pattern: z.ZodObject<{
+                        readOnlyHint: z.ZodOptional<z.ZodBoolean>;
+                        destructiveHint: z.ZodOptional<z.ZodBoolean>;
+                        idempotentHint: z.ZodOptional<z.ZodBoolean>;
+                        openWorldHint: z.ZodOptional<z.ZodBoolean>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>], "matcher">], "type">>>;
+                raterTimeoutMs: z.ZodOptional<z.ZodNumber>;
+                mcp: z.ZodOptional<z.ZodObject<{
+                    defaults: z.ZodOptional<z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>;
+                    servers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                        trustAnnotations: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            destructiveHint: "destructiveHint";
+                            idempotentHint: "idempotentHint";
+                            openWorldHint: "openWorldHint";
+                            readOnlyHint: "readOnlyHint";
+                        }>>>;
+                    }, z.core.$strict>>>;
+                }, z.core.$strict>>;
+            }, z.core.$strip>]>>;
+            port: z.ZodOptional<z.ZodNumber>;
+            cors: z.ZodOptional<z.ZodObject<{
+                allowOrigin: z.ZodOptional<z.ZodString>;
+                allowMethods: z.ZodOptional<z.ZodString>;
+                allowHeaders: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    commit: z.ZodOptional<z.ZodObject<{
+        coAuthor: z.ZodOptional<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            email: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    modelDisplayName: z.ZodOptional<z.ZodString>;
+    injectModelContext: z.ZodOptional<z.ZodBoolean>;
+    debugDump: z.ZodOptional<z.ZodObject<{
+        redact: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    allowDirs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    askWriteMode: z.ZodOptional<z.ZodBoolean>;
+    output: z.ZodOptional<z.ZodObject<{
+        header: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    toolLoopGuard: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
+        warn: z.ZodOptional<z.ZodBoolean>;
+        halt: z.ZodOptional<z.ZodBoolean>;
+        threshold: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>]>>;
+    reporters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    subagents: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        profile: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$loose>;
+/**
+ * Type inferred from {@link rawGthConfigSchema}. This is additive and intentionally
+ * separate from the hand-written `RawGthConfig` interface in `config.ts` (it omits
+ * the deprecated aliases). Prefer `RawGthConfig` for the public surface.
+ */
+export type RawGthConfigInput = z.infer<typeof rawGthConfigSchema>;
+/**
+ * The set of known top-level config keys, derived from the schema shape so it can
+ * never drift from {@link rawGthConfigSchema}. Includes `$schema`.
+ */
+export declare const KNOWN_TOP_LEVEL_KEYS: ReadonlySet<string>;
+/**
+ * True when a raw config value is a plain (non-null, non-array) object, so the key scans
+ * ({@link findDeprecatedConfigIssues}, {@link findUnknownTopLevelKeys}) are safe to run. A
+ * `null`/array/primitive config (e.g. a JSON file that is just `null`, or a module
+ * `configure()` returning null) must NOT reach those scans — they'd throw on
+ * `hasOwnProperty`/`Object.keys`; the entry points instead hand it straight to
+ * `rawGthConfigSchema.safeParse`, which reports a clean "expected object" error.
+ */
+export declare function isRecordConfig(value: unknown): value is Record<string, unknown>;
+/**
+ * Return the top-level keys present in `raw` that are not part of the known config
+ * surface. KNOWN deprecated names are rejected earlier by {@link findDeprecatedConfigIssues}
+ * (the entry points short-circuit on those), so a key that reaches here is a genuinely
+ * unknown key (a likely typo) that only warrants a warning.
+ */
+export declare function findUnknownTopLevelKeys(raw: Record<string, unknown>): string[];
+/**
+ * Render a friendly, path-scoped validation message from a Zod error. Each issue
+ * becomes a line `  - <path>: <message>`, with `(root)` for top-level issues.
+ */
+export declare function formatConfigValidationError(error: z.ZodError): string;
+/** A single deprecated-config-shape rejection: the offending `path` and the migration message. */
+export interface DeprecatedConfigIssue {
+    /** Dotted path of the offending key (e.g. `pr`, `commands.pr.contentProvider`). */
+    path: string;
+    /** Human message naming the canonical replacement + migration path. */
+    message: string;
+}
+/**
+ * GS2-28 — detect the removed pre-2.0 config shapes on the RAW input (read-only; no
+ * mutation), returning one {@link DeprecatedConfigIssue} per occurrence. A non-empty
+ * result is a HARD validation failure: 2.0 dropped back-compat coercion, so an old shape
+ * must error and point at the fix rather than be silently remapped or ignored.
+ *
+ * Detects:
+ * - (A) a COMMAND name ({@link COMMAND_KEYS}) at the config ROOT — must move under `commands.<cmd>`;
+ * - (C) a deprecated `*Provider*` name ({@link DEPRECATED_ROOT_PAIRS} at root,
+ *   {@link DEPRECATED_COMMAND_PAIRS} per command) — must use its `*Source*` replacement;
+ * - (D, CFG-18) a removed per-command key folded into another ({@link REMOVED_COMMAND_KEYS}, e.g.
+ *   `commands.<cmd>.devTools` → configure under `builtInTools`);
+ * - (E, CFG-26) a retired `run_shell_command` approval knob ({@link RETIRED_SHELL_TOOL_PAIRS}) at
+ *   EITHER `builtInTools.run_shell_command.*` or `commands.<cmd>.builtInTools.run_shell_command.*`
+ *   — each message names the `approvals.*` key that replaced it;
+ * - (F, CFG-27) a retired `approvals` key or `mode` value ({@link RETIRED_APPROVALS_KEYS},
+ *   {@link RETIRED_APPROVAL_MODES}) at EITHER `approvals.*` or `commands.<cmd>.approvals.*` —
+ *   each message names the rung that replaced it.
+ *
+ * Runs on the raw input specifically so nested `commands.*.contentProvider` is still visible
+ * (zod's per-command `z.object` would strip it before any schema-embedded check could fire).
+ * A genuinely-unknown key is NOT flagged here (it stays a warn-only unknown key), preserving
+ * the deliberate typo-tolerance.
+ */
+export declare function findDeprecatedConfigIssues(raw: Record<string, unknown>): DeprecatedConfigIssue[];
+/**
+ * EXT-71 §3.1 — every hard error the rule grammar defines, found on the RAW input: each entry in
+ * `allow`/`deny`/`escalate` validated with a path that names the offending field
+ * ({@link collectApprovalEntryIssues}), the `approvals.mcp` block ({@link collectMcpApprovalsIssues}),
+ * and the two `mcpServers` keys no rule can refer to — `*` ({@link RESERVED_MCP_SERVER_NAME}, which
+ * an entry already reads as "every server") and the empty name
+ * ({@link UNNAMEABLE_MCP_SERVER_NAME}, which no entry's `server` field can hold). Both need to see
+ * `mcpServers`, a sibling of `approvals` rather than a field of it.
+ *
+ * All of them are HARD errors, reported the same way {@link findDeprecatedConfigIssues} reports
+ * its own, and — like it — this runs BEFORE the schema parse so the precise message is the only
+ * one the user sees.
+ *
+ * PURE: it only reads the object. Kept separate from {@link findDeprecatedConfigIssues} because
+ * these are not removed pre-2.0 shapes; they are rules of the current grammar.
+ */
+export declare function findApprovalsGrammarIssues(raw: Record<string, unknown>): DeprecatedConfigIssue[];
+/**
+ * CFG-26 — one `approvals.rater` reference found in a raw config, with the dotted config path it
+ * was found at (`approvals.rater` or `commands.<name>.approvals.rater`).
+ */
+export interface RaterProfileRef {
+    /** Dotted config path of the `rater` key, for the error message. */
+    path: string;
+    /** The profile name as written. */
+    profile: string;
+}
+/**
+ * CFG-26 — collect every `approvals.rater` in a raw config (root + each `commands.<name>`).
+ * CFG-27 flattened the key: it is a BARE identity-profile name, not `rater.profile`.
+ *
+ * PURE — it only reads the object; the caller decides whether each name RESOLVES. That split is
+ * deliberate: profile resolution needs the filesystem, and `schema.ts` must stay pure so
+ * `z.toJSONSchema` and every spec that validates a config object stay cwd-independent. The loader
+ * pairs this with `resolveIdentityProfileConfigPath` to enforce the GS2-62 rule that an
+ * unresolvable profile is a hard error, never a silent fallback to the main model.
+ */
+export declare function findApprovalsRaterProfiles(raw: Record<string, unknown>): RaterProfileRef[];
+/**
+ * CFG-26 — the ONE message for an `approvals.rater.profile` that does not resolve. Shared by the
+ * loader (which hard-exits a real run) and {@link validateRawGthConfig} (which backs
+ * `gth config validate`), so the validator can never green-light a config the runtime refuses.
+ */
+export declare function unresolvedRaterProfileMessage(ref: RaterProfileRef): string;
+/**
+ * Render {@link DeprecatedConfigIssue}s as the same `  - <path>: <message>` block used for
+ * Zod validation errors, so a deprecated-shape rejection reads identically to a type-mismatch
+ * rejection (loader wraps it with `Invalid configuration in <source>:`).
+ */
+export declare function formatDeprecatedConfigIssues(issues: ReadonlyArray<DeprecatedConfigIssue>): string;
+/**
+ * Generate the JSON Schema for the raw config from {@link rawGthConfigSchema} using
+ * zod 4's native `z.toJSONSchema`. The output is committed to
+ * `packages/core/schema/gsloth-config.schema.json` and asserted by a golden test.
+ */
+export declare function generateConfigJsonSchema(): Record<string, unknown>;
+/**
+ * The structured outcome of validating a single raw config layer, WITHOUT any side
+ * effects (no console output, no `exit`). This is the read-side counterpart to the
+ * loader's `validateRawConfigLayer` (which warns + `exit`s inline): `gth config validate`
+ * uses it to render its own output and choose its own exit code.
+ */
+export interface RawConfigValidationOptions {
+    /**
+     * CFG-26 — resolves an identity profile NAME to "does it exist?". Supplied by the loader
+     * (`resolveIdentityProfileConfigPath`); omitted by pure/in-memory callers, which then skip the
+     * `approvals.rater.profile` existence check.
+     */
+    resolveProfile?: (profile: string) => boolean;
+}
+export interface RawConfigValidationResult {
+    /** True when the config parses against the schema (unknown keys do NOT make it false). */
+    ok: boolean;
+    /** Non-fatal advisories: unknown top-level keys (likely typos). Deprecated shapes are hard errors, not warnings. */
+    warnings: string[];
+    /** Present only when `ok` is false: the path-scoped, multi-line validation message. */
+    errorMessage?: string;
+}
+/**
+ * Validate a freshly-loaded raw config object against {@link rawGthConfigSchema} and
+ * report the outcome as data (a pure function — no `displayWarning`/`exit`). Mirrors the
+ * loader's policy: a removed pre-2.0 shape (a top-level command key or a deprecated
+ * `*Provider*` name) is a HARD failure that names the fix, unknown top-level keys warn but
+ * do not fail, and a genuine type mismatch on a known field fails with a path-scoped message.
+ *
+ * Read-only: `findDeprecatedConfigIssues`, `findUnknownTopLevelKeys` and `safeParse` never
+ * mutate `raw`, so no defensive copy is needed.
+ */
+export declare function validateRawGthConfig(raw: Record<string, unknown>, options?: RawConfigValidationOptions): RawConfigValidationResult;