@gullabs/claude-cli 0.7.0 → 0.16.0

package/NOTICE

@@ -0,0 +1,6 @@
+any-llm
+Copyright 2026 Gul Labs
+
+This product includes software developed at Gul Labs (https://github.com/gul-labs).
+
+Licensed under the Apache License, Version 2.0. See LICENSE.

package/README.md

@@ -10,34 +10,42 @@
 [`@gullabs/core`](../core) that routes LLM calls through the `claude`
 (Claude Code) CLI instead of an API key. Because the CLI owns its own
 OAuth/keychain-backed session, calls made through this adapter cost $0 in API
-spend — the CLI reports its own cost for observability, but that number is
+spend (the runner scrubs `ANTHROPIC_API_KEY` and the other credential variables from
+the child's environment so that stays true; see below) — the CLI reports its own cost for observability, but that number is
 never fed into `@gullabs/core`'s cost engine (`Cost.microUsd` naturally
 resolves to `null` because these models are unpriced).
 
 ## Install
 
 ```sh
-pnpm add -D @gullabs/claude-cli
+pnpm add -D @gullabs/claude-cli @gullabs/core
 ```
 
 ## Key exports
 
 | Export                      | Kind     | Description                                                     |
 | --------------------------- | -------- | --------------------------------------------------------------- |
+| `claudeCliProvider`         | function | The `ProviderPlugin` for `composeProviders` (adapter + models). |
 | `claudeCliAdapter`          | function | Creates the `ProviderAdapter` (`id: 'claude-cli'`).             |
-| `ClaudeCliAdapterOptions`   | type     | `{ runner?, claudePath?, maxConcurrency? }`.                    |
+| `ClaudeCliAdapterOptions`   | type     | `{ runner?, claudePath?, maxConcurrency?, env? }`.              |
 | `buildClaudeCliRunner`      | function | The real `node:child_process`-backed `ClaudeCliRunner` factory. |
 | `ClaudeCliRunner`           | type     | The process-execution seam; inject a fake in tests.             |
+| `ClaudeCliRunOptions`       | type     | `{ cwd, timeoutMs?, signal?, env? }`, the options of `run`.     |
+| `ClaudeCliRunResult`        | type     | `{ stdout, stderr, exitCode }`.                                 |
+| `ClaudeCliEnvelope`         | type     | The `--output-format json` result envelope the adapter reads.   |
 | `claudeCliModelDescriptors` | value    | `ModelDescriptor[]` for the 4 supported model ids.              |
 | `claudeCliRegistry`         | value    | `ModelRegistry` built from `claudeCliModelDescriptors`.         |
+| `CLAUDE_CLI_MODEL_IDS`      | value    | The four registered model ids.                                  |
+| `CLAUDE_CLI_EFFORTS`        | value    | `['low', 'medium', 'high', 'xhigh', 'max']`.                    |
+| `Claude…ConfigSchema` (x4)  | value    | The strict zod config schema of each model.                     |
 
 ## Quick example
 
 ```ts
-import { claudeCliAdapter } from '@gullabs/claude-cli'
-import { createClient } from '@gullabs/core'
+import { composeProviders, createClient } from '@gullabs/core'
+import { claudeCliProvider } from '@gullabs/claude-cli'
 
-const client = createClient({ adapters: [claudeCliAdapter()] })
+const client = createClient({ ...composeProviders([claudeCliProvider()]) })
 
 const result = await client.generate(
   {
@@ -77,16 +85,70 @@ the requested id and no other model. Any other model id throws
 `stop_reason: "refusal"` returns `finishReason: 'content_filter'` and preserves
 its billed usage; an error envelope throws `content_filter`.
 
-P-A1 was captured on 2026-09-26 with Claude Code 2.1.282: the invariant argv
+The live capture of 2026-09-26 (Claude Code 2.1.282) shows it: the invariant argv
 and `--json-schema` completed for all four registered ids, and each success
 envelope contained only its requested id as a `modelUsage` key. The sanitized
 responses are in `src/__fixtures__/model-refresh-p-a1.json`. The full installed CLI version and
 envelope shape are runtime dependencies; an absent `modelUsage` fails closed.
 
+Usage follows Anthropic's accounting, in which `input_tokens` excludes both cache lanes: `inputTokens` is
+`input_tokens + cache_read_input_tokens + cache_creation_input_tokens`, `cachedInputTokens` is the cache-read
+part, `details.cacheWrite` is the cache-creation part, and `thinkingTokens` is
+`output_tokens_details.thinking_tokens` (inside `outputTokens`). The adapter is unpriced, so none of this
+becomes a cost.
+
 `--model`, `--effort`, `--system-prompt`, and `--json-schema` are appended
 from the request when applicable; the prompt itself is always sent over
 stdin, never as a positional argv entry.
 
+`output.jsonSchema` is passed to `--json-schema` as written. Unlike the Google and
+xAI adapters (ADR-034), this adapter does not check the schema against a keyword
+profile: `nullable`, uppercase type names and keywords the CLI may ignore are not
+rejected here, so validate the result yourself.
+
+## Environment: the subscription login, never an API key
+
+Claude Code's own documentation says `ANTHROPIC_API_KEY` is "used instead of your
+Claude Pro, Max, Team, or Enterprise subscription even if you are logged in. In
+non-interactive mode (`-p`), the key is always used when present"
+(<https://code.claude.com/docs/en/env-vars>), and the adapter always runs `-p`. A
+host that has the key exported for an Anthropic SDK would therefore have every call
+billed to it while the ledger books the call as unpriced, and nothing in the result
+would say so. So the real runner does not hand the host environment to the child. It
+builds an allowlisted copy of `process.env`: `PATH`, `HOME`, `USER`, `LOGNAME`,
+`LANG`/`LC_*`, `TERM`, `TZ`, `TMPDIR`/`TEMP`/`TMP`, `SHELL`, `XDG_*`, the Windows
+profile variables, the proxy variables (`HTTPS_PROXY`, `HTTP_PROXY`, `ALL_PROXY`,
+`NO_PROXY`, either case), `NODE_EXTRA_CA_CERTS`, `SSL_CERT_FILE`/`SSL_CERT_DIR`, and
+the CLI's own documented settings for a subscription login: `CLAUDE_CONFIG_DIR`,
+`CLAUDE_CODE_OAUTH_TOKEN` (the long-lived subscription token from
+`claude setup-token`) and the mTLS variables `CLAUDE_CODE_CLIENT_CERT`,
+`CLAUDE_CODE_CLIENT_KEY`, `CLAUDE_CODE_CLIENT_KEY_PASSPHRASE`. `ANTHROPIC_API_KEY`,
+`ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_BASE_URL`, `CLAUDE_CODE_USE_BEDROCK`/`_VERTEX`/
+`_FOUNDRY` and everything else are dropped.
+
+The list does keep credentials: the library never interprets an environment credential,
+but `CLAUDE_CODE_OAUTH_TOKEN` and the mTLS variables `CLAUDE_CODE_CLIENT_CERT`,
+`CLAUDE_CODE_CLIENT_KEY` and `CLAUDE_CODE_CLIENT_KEY_PASSPHRASE` are forwarded from the
+host environment to the CLI, so a host that has them exported is using them (and a proxy
+URL in `HTTPS_PROXY` can carry credentials too). `env` adds to the copy and cannot remove
+from it: to keep the CLI off an ambient token, unset the variable before the call.
+
+`claudeCliAdapter({ env })` adds variables on top, and they win over the allowlisted
+ones. It is the one way to pass anything else on. Putting an API key there is the
+explicit opt-in: the call is then billed to it. `env` is validated at construction
+(string names without `=`, string values without NUL), else `bad_request`. A custom
+runner receives it as `ClaudeCliRunOptions.env` and decides for itself.
+
+## Queued calls and killed processes
+
+A call waits for a slot before it makes its scratch directory, and leaves the queue
+(rejecting `aborted`) when its signal fires, so calls the engine already gave up on
+cost nothing while they wait. When a timeout, abort or the stdout cap kills the call,
+the whole process group gets SIGTERM, and SIGKILL after five seconds. When the CLI
+itself exits on the SIGTERM the group gets one more SIGKILL at that moment, so a tool
+process that ignored SIGTERM and holds none of the runner's pipes does not outlive
+the call.
+
 ## Concurrency
 
 The adapter caps concurrent `claude` CLI invocations with an internal
@@ -102,3 +164,7 @@ xhigh | max`. Haiku 4.5 has no `reasoning` key — the CLI drops `--effort`.
 No sampling knobs (`temperature`/`topP`/`topK`/`maxOutputTokens`/`stopSequences`)
 are accepted; the strict config schema rejects unknown keys. `claude-fable-5`
 and `claude-opus-4-8` are deleted with no alias.
+
+The descriptors' `limits` are what the CLI reports for its own run (the captured
+`modelUsage.contextWindow` and `maxOutputTokens`), not the API maxima: Fable 5.1
+64 000 and Haiku 4.5 32 000 output tokens, Opus 5.5 and Sonnet 5 128 000.

package/dist/index.cjs

@@ -5,9 +5,107 @@ var os = require('os');
 var path = require('path');
 var core = require('@gullabs/core');
 var child_process = require('child_process');
+var string_decoder = require('string_decoder');
 var zod = require('zod');
 
 // src/adapter.ts
+var INHERITED_NAMES = /* @__PURE__ */ new Set([
+  // Process basics.
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "LANG",
+  "LANGUAGE",
+  "TERM",
+  "TMPDIR",
+  "TEMP",
+  "TMP",
+  "SHELL",
+  "TZ",
+  // Windows equivalents of the above.
+  "SYSTEMROOT",
+  "SYSTEMDRIVE",
+  "WINDIR",
+  "COMSPEC",
+  "PATHEXT",
+  "USERPROFILE",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "PROGRAMDATA",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  // Network: proxies and trust roots.
+  "HTTPS_PROXY",
+  "HTTP_PROXY",
+  "ALL_PROXY",
+  "NO_PROXY",
+  "https_proxy",
+  "http_proxy",
+  "all_proxy",
+  "no_proxy",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  // The CLI's own documented settings that keep the subscription login usable:
+  // where its login lives, the long-lived subscription token from
+  // `claude setup-token`, and client certificates for an mTLS proxy.
+  "CLAUDE_CONFIG_DIR",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CLAUDE_CODE_CLIENT_CERT",
+  "CLAUDE_CODE_CLIENT_KEY",
+  "CLAUDE_CODE_CLIENT_KEY_PASSPHRASE",
+  "CLAUDE_CODE_PROXY_RESOLVES_HOSTS"
+]);
+var INHERITED_PREFIXES = ["LC_", "XDG_"];
+function isInherited(name, windows) {
+  const key = windows ? name.toUpperCase() : name;
+  if (INHERITED_NAMES.has(key)) return true;
+  return INHERITED_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
+function buildChildEnv(parent, extra, windows) {
+  const env = {};
+  for (const [name, value] of Object.entries(parent)) {
+    if (value !== void 0 && isInherited(name, windows)) env[name] = value;
+  }
+  if (extra !== void 0) {
+    if (windows) {
+      const overridden = new Set(Object.keys(extra).map((name) => name.toUpperCase()));
+      for (const name of Object.keys(env)) {
+        if (overridden.has(name.toUpperCase())) delete env[name];
+      }
+    }
+    Object.assign(env, extra);
+  }
+  return env;
+}
+function badEnv(message) {
+  return new core.LlmError(message, {
+    kind: "bad_request",
+    retryable: false,
+    provider: "claude-cli"
+  });
+}
+function parseExtraEnv(env) {
+  if (env === void 0) return void 0;
+  if (env === null || typeof env !== "object" || Array.isArray(env)) {
+    throw badEnv("claudeCliAdapter: `env` must be an object of string values");
+  }
+  const copy = {};
+  for (const [name, value] of Object.entries(env)) {
+    if (name === "" || name.includes("=") || name.includes("\0")) {
+      throw badEnv(`claudeCliAdapter: \`env\` has an invalid name "${name}"`);
+    }
+    if (typeof value !== "string" || value.includes("\0")) {
+      throw badEnv(
+        `claudeCliAdapter: \`env.${name}\` must be a string without NUL characters`
+      );
+    }
+    copy[name] = value;
+  }
+  return Object.freeze(copy);
+}
+var MAX_STDOUT_BYTES = 32 * 1024 * 1024;
 function buildClaudeCliRunner(claudePath = "claude") {
   return {
     run(args, input, opts) {
@@ -20,9 +118,14 @@ function buildClaudeCliRunner(claudePath = "claude") {
         }
         const child = child_process.spawn(claudePath, args, {
           cwd: opts.cwd,
-          stdio: ["pipe", "pipe", "pipe"]
+          stdio: ["pipe", "pipe", "pipe"],
+          detached: process.platform !== "win32",
+          env: buildChildEnv(process.env, opts.env, process.platform === "win32")
         });
+        const stdoutDecoder = new string_decoder.StringDecoder("utf8");
+        const stderrDecoder = new string_decoder.StringDecoder("utf8");
         let stdout = "";
+        let stdoutBytes = 0;
         let stderr = "";
         let settled = false;
         let pendingError;
@@ -38,12 +141,31 @@ function buildClaudeCliRunner(claudePath = "claude") {
             opts.signal.removeEventListener("abort", onAbort);
           }
         };
+        const signalTree = (signal) => {
+          if (process.platform !== "win32" && child.pid !== void 0) {
+            try {
+              process.kill(-child.pid, signal);
+              return;
+            } catch {
+            }
+          }
+          child.kill(signal);
+        };
         const killChild = () => {
-          child.kill("SIGTERM");
+          signalTree("SIGTERM");
           killTimeoutHandle = setTimeout(() => {
-            child.kill("SIGKILL");
+            signalTree("SIGKILL");
+            child.stdout.destroy();
+            child.stderr.destroy();
           }, 5e3);
         };
+        const sweepGroup = () => {
+          if (process.platform === "win32" || child.pid === void 0) return;
+          try {
+            process.kill(-child.pid, "SIGKILL");
+          } catch {
+          }
+        };
         const beginReject = (err) => {
           if (settled || pendingError !== void 0) return;
           pendingError = err;
@@ -66,10 +188,22 @@ function buildClaudeCliRunner(claudePath = "claude") {
           }, opts.timeoutMs);
         }
         child.stdout.on("data", (chunk) => {
-          stdout += chunk.toString("utf8");
+          if (pendingError !== void 0) return;
+          stdoutBytes += chunk.length;
+          if (stdoutBytes > MAX_STDOUT_BYTES) {
+            const err = new Error(
+              `claude-cli stdout exceeded ${MAX_STDOUT_BYTES} bytes; the process was killed`
+            );
+            err.name = "OutputLimitError";
+            beginReject(err);
+            return;
+          }
+          stdout += stdoutDecoder.write(chunk);
         });
         child.stderr.on("data", (chunk) => {
-          stderr += chunk.toString("utf8");
+          stderr = (stderr + stderrDecoder.write(chunk)).slice(-1048576);
+        });
+        child.stdin.on("error", () => {
         });
         child.once("error", (err) => {
           if (settled) return;
@@ -82,8 +216,11 @@ function buildClaudeCliRunner(claudePath = "claude") {
           settled = true;
           cleanup();
           if (pendingError !== void 0) {
+            sweepGroup();
             reject(pendingError);
           } else {
+            stdout += stdoutDecoder.end();
+            stderr = (stderr + stderrDecoder.end()).slice(-1048576);
             resolve({ stdout, stderr, exitCode });
           }
         });
@@ -94,31 +231,52 @@ function buildClaudeCliRunner(claudePath = "claude") {
 }
 
 // src/adapter.ts
+function abortError() {
+  const err = new Error("claude-cli call aborted");
+  err.name = "AbortError";
+  return err;
+}
 var Semaphore = class {
   available;
-  queue = [];
+  waiters = [];
   constructor(max) {
     this.available = max;
   }
-  async acquire() {
+  /**
+   * Take a slot. A caller that has to wait leaves the queue, and rejects with an
+   * `AbortError`, as soon as `signal` fires: a call the engine already gave up
+   * on must not hold a place in line.
+   */
+  acquire(signal) {
+    if (signal?.aborted === true) return Promise.reject(abortError());
     if (this.available > 0) {
       this.available -= 1;
-      return () => {
+      return Promise.resolve(() => {
         this.release();
-      };
+      });
     }
-    await new Promise((resolve) => {
-      this.queue.push(resolve);
+    return new Promise((resolve, reject) => {
+      const grant = () => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve(() => {
+          this.release();
+        });
+      };
+      const onAbort = () => {
+        const at = this.waiters.indexOf(grant);
+        if (at >= 0) this.waiters.splice(at, 1);
+        reject(abortError());
+      };
+      signal?.addEventListener("abort", onAbort, { once: true });
+      this.waiters.push(grant);
     });
-    this.available -= 1;
-    return () => {
-      this.release();
-    };
   }
+  // A freed slot goes straight to the next waiter, so a new caller cannot
+  // overtake it between the release and the waiter's wake-up.
   release() {
-    this.available += 1;
-    const next = this.queue.shift();
+    const next = this.waiters.shift();
     if (next !== void 0) next();
+    else this.available += 1;
   }
 };
 function mapFinishReason(stopReason) {
@@ -135,14 +293,19 @@ function mapFinishReason(stopReason) {
   }
 }
 function mapUsage(usage) {
-  const inputTokens = usage?.input_tokens ?? 0;
+  const cacheRead = usage?.cache_read_input_tokens;
+  const cacheWrite = usage?.cache_creation_input_tokens;
+  const inputTokens = (usage?.input_tokens ?? 0) + (cacheRead ?? 0) + (cacheWrite ?? 0);
   const outputTokens = usage?.output_tokens ?? 0;
-  const cachedInputTokens = usage?.cache_read_input_tokens;
+  const cachedInputTokens = cacheRead;
+  const thinkingTokens = usage?.output_tokens_details?.thinking_tokens;
   const totalTokens = usage !== void 0 ? inputTokens + outputTokens : void 0;
   const details = {
     input: inputTokens,
     output: outputTokens,
     ...cachedInputTokens !== void 0 ? { cached: cachedInputTokens } : {},
+    ...cacheWrite !== void 0 ? { cacheWrite } : {},
+    ...thinkingTokens !== void 0 ? { thinking: thinkingTokens } : {},
     ...totalTokens !== void 0 ? { total: totalTokens } : {}
   };
   const raw = usage !== void 0 ? usage : null;
@@ -152,6 +315,7 @@ function mapUsage(usage) {
     details,
     raw,
     ...cachedInputTokens !== void 0 ? { cachedInputTokens } : {},
+    ...thinkingTokens !== void 0 ? { thinkingTokens } : {},
     ...totalTokens !== void 0 ? { totalTokens } : {}
   };
 }
@@ -181,11 +345,13 @@ function buildPrompt(messages) {
 ${messageText(msg)}`;
   }).join("\n\n");
 }
+var AUTH_FAILURE = /\b(?:log ?in|auth|oauth|authentication|unauthori[sz]ed|401)\b/i;
+var RATE_LIMITED = /\brate[ -]?limit(?:ed|s|ing)?\b|\btoo many requests\b|(?<![\w.:/-])429(?![\w-]|\.\d)/i;
 function looksAuthy(text) {
-  return /login|auth|unauthorized/i.test(text);
+  return AUTH_FAILURE.test(text);
 }
 function looksRateLimited(text) {
-  return /rate limit|429/i.test(text);
+  return RATE_LIMITED.test(text);
 }
 function assertServedModel(envelope, requestedModel) {
   const modelUsage = envelope.modelUsage;
@@ -220,12 +386,6 @@ function classifyRunFailure(envelope, result) {
     });
   }
   const combinedText = `${envelope?.subtype ?? ""} ${result.stderr}`;
-  if (looksAuthy(combinedText)) {
-    return new core.LlmError(
-      `claude CLI reported an authentication failure: ${result.stderr.slice(-500)}`,
-      { kind: "invalid_auth", retryable: false, provider: "claude-cli" }
-    );
-  }
   if (looksRateLimited(combinedText)) {
     return new core.LlmError(
       `claude CLI reported rate limiting: ${result.stderr.slice(-500)}`,
@@ -236,6 +396,12 @@ function classifyRunFailure(envelope, result) {
       }
     );
   }
+  if (looksAuthy(combinedText)) {
+    return new core.LlmError(
+      `claude CLI reported an authentication failure: ${result.stderr.slice(-500)}`,
+      { kind: "invalid_auth", retryable: false, provider: "claude-cli" }
+    );
+  }
   if (envelope?.is_error === true) {
     return new core.LlmError(
       `claude CLI reported an error (subtype: ${envelope.subtype ?? "unknown"}): ${result.stderr.slice(-500)}`,
@@ -251,6 +417,7 @@ function classifyRunFailure(envelope, result) {
 function claudeCliAdapter(opts) {
   const runner = opts?.runner ?? buildClaudeCliRunner(opts?.claudePath);
   const semaphore = new Semaphore(opts?.maxConcurrency ?? 2);
+  const env = parseExtraEnv(opts?.env);
   return {
     id: "claude-cli",
     async run(req, ctx) {
@@ -322,14 +489,29 @@ function claudeCliAdapter(opts) {
         args.push("--json-schema", JSON.stringify(req.outputJsonSchema));
       }
       const timeoutMs = req.attemptTimeoutMs ?? config.timeoutMs;
-      const cwd = await promises.mkdtemp(path.join(os.tmpdir(), "claude-cli-"));
-      const release = await semaphore.acquire();
+      let release;
+      try {
+        release = await semaphore.acquire(ctx.signal);
+      } catch (waitErr) {
+        throw new core.LlmError(
+          waitErr instanceof Error ? waitErr.message : "claude-cli call aborted",
+          { kind: "aborted", retryable: false, provider: "claude-cli" }
+        );
+      }
+      let cwd;
+      try {
+        cwd = await promises.mkdtemp(path.join(os.tmpdir(), "claude-cli-"));
+      } catch (mkdirErr) {
+        release();
+        throw mkdirErr;
+      }
       let result;
       try {
         result = await runner.run(args, prompt, {
           cwd,
           ...timeoutMs !== void 0 ? { timeoutMs } : {},
-          ...ctx.signal !== void 0 ? { signal: ctx.signal } : {}
+          ...ctx.signal !== void 0 ? { signal: ctx.signal } : {},
+          ...env !== void 0 ? { env } : {}
         });
       } catch (rawErr) {
         release();
@@ -394,6 +576,10 @@ function claudeCliAdapter(opts) {
       };
       const adapterResult = {
         model,
+        message: {
+          role: "assistant",
+          parts: text.length > 0 ? [{ kind: "text", text }] : []
+        },
         usage,
         warnings,
         ...text.length > 0 ? { text } : {},
@@ -453,21 +639,30 @@ var CONFIG_SCHEMAS = {
   "claude-sonnet-5": ClaudeSonnet5ConfigSchema,
   "claude-haiku-4-5-20251001": ClaudeHaiku45ConfigSchema
 };
+var CLAUDE_CLI_LIMITS = {
+  "claude-fable-5-1": { contextWindow: 1e6, maxOutputTokens: 64e3 },
+  "claude-opus-5-5": { contextWindow: 1e6, maxOutputTokens: 128e3 },
+  "claude-sonnet-5": { contextWindow: 1e6, maxOutputTokens: 128e3 },
+  "claude-haiku-4-5-20251001": { contextWindow: 2e5, maxOutputTokens: 32e3 }
+};
 var claudeCliModelDescriptors = CLAUDE_CLI_MODEL_IDS.map(
   (id) => {
     const configSchema = CONFIG_SCHEMAS[id];
     return {
       model: id,
       provider: "claude-cli",
+      limits: CLAUDE_CLI_LIMITS[id],
       capabilities: {
+        // The CLI runs text-only: the adapter rejects every non-text part.
+        inputMimeTypes: [],
         structuredOutput: true,
         nativeStructuredOutput: true,
         ...id !== "claude-haiku-4-5-20251001" ? { reasoningApi: "level" } : {},
         admittedReasoningEfforts: id === "claude-haiku-4-5-20251001" ? [] : CLAUDE_CLI_EFFORTS,
-        sampling: "fixed",
-        vision: false
+        sampling: "fixed"
       },
       configSchema,
+      configKeys: core.toConfigKeys(configSchema),
       configJsonSchema: core.toConfigJsonSchema(configSchema),
       validateConfig: core.zodToStandardSchema(configSchema)
     };