usertrust 0.2.6 → 1.1.0

package/dist/shared/errors.js

@@ -88,6 +88,22 @@ export class AuditDegradedError extends Error {
         this.docsUrl = docsUrl;
     }
 }
+export class CredentialAccessDeniedError extends Error {
+    credentialName;
+    reason;
+    hint;
+    docsUrl;
+    constructor(credentialName, reason) {
+        const hint = "Check the credential scope in .usertrust/credentials.enc or update the scope with `usertrust secret add --scope`.";
+        const docsUrl = "https://usertrust.ai/docs/errors/credential-access-denied";
+        super(`Credential access denied for ${credentialName}: ${reason}\n\n  Hint: ${hint}\n  Docs: ${docsUrl}`);
+        this.name = "CredentialAccessDeniedError";
+        this.credentialName = credentialName;
+        this.reason = reason;
+        this.hint = hint;
+        this.docsUrl = docsUrl;
+    }
+}
 export class VaultNotInitializedError extends Error {
     path;
     hint;
@@ -102,4 +118,34 @@ export class VaultNotInitializedError extends Error {
         this.docsUrl = docsUrl;
     }
 }
+export class SkillVerificationError extends Error {
+    skillId;
+    reason;
+    hint;
+    docsUrl;
+    constructor(skillId, reason) {
+        const hint = "Verify the skill manifest is signed by a trusted publisher, or add the publisher to supplyChain.trustedPublishers.";
+        const docsUrl = "https://usertrust.ai/docs/errors/skill-verification";
+        super(`Skill verification failed for ${skillId}: ${reason}\n\n  Hint: ${hint}\n  Docs: ${docsUrl}`);
+        this.name = "SkillVerificationError";
+        this.skillId = skillId;
+        this.reason = reason;
+        this.hint = hint;
+        this.docsUrl = docsUrl;
+    }
+}
+export class VaultKeyMissingError extends Error {
+    envVar;
+    hint;
+    docsUrl;
+    constructor(envVar) {
+        const hint = `Set the ${envVar} environment variable to the vault master key.`;
+        const docsUrl = "https://usertrust.ai/docs/errors/vault-key-missing";
+        super(`Vault master key not set: ${envVar} is not defined\n\n  Hint: ${hint}\n  Docs: ${docsUrl}`);
+        this.name = "VaultKeyMissingError";
+        this.envVar = envVar;
+        this.hint = hint;
+        this.docsUrl = docsUrl;
+    }
+}
 //# sourceMappingURL=errors.js.map

package/dist/shared/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/shared/errors.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAClC,MAAM,CAAS;IACf,QAAQ,CAAS;IACjB,SAAS,CAAS;IAClB,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc,EAAE,QAAgB,EAAE,SAAiB;QAC9D,MAAM,IAAI,GAAG,qEAAqE,CAAC;QACnF,MAAM,OAAO,GAAG,uDAAuD,CAAC;QACxE,KAAK,CACJ,iCAAiC,MAAM,UAAU,QAAQ,UAAU,SAAS,eAAe,IAAI,aAAa,OAAO,EAAE,CACrH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc;QACzB,MAAM,IAAI,GACT,sGAAsG,CAAC;QACxG,MAAM,OAAO,GAAG,gDAAgD,CAAC;QACjE,KAAK,CAAC,kBAAkB,MAAM,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc;QACzB,MAAM,IAAI,GACT,wFAAwF,CAAC;QAC1F,MAAM,OAAO,GAAG,oDAAoD,CAAC;QACrE,KAAK,CAAC,+BAA+B,MAAM,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAClC,GAAG,CAAS;IACZ,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,GAAW;QACtB,MAAM,IAAI,GAAG,2EAA2E,CAAC;QACzF,MAAM,OAAO,GAAG,uDAAuD,CAAC;QACxE,KAAK,CAAC,iCAAiC,GAAG,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAChC,aAAa,CAAS;IACtB,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc;QACzB,MAAM,IAAI,GACT,6FAA6F,CAAC;QAC/F,MAAM,OAAO,GAAG,qDAAqD,CAAC;QACtE,KAAK,CAAC,uBAAuB,MAAM,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5B,aAAa,CAAS;IACtB,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc;QACzB,MAAM,IAAI,GAAG,sEAAsE,CAAC;QACpF,MAAM,OAAO,GAAG,iDAAiD,CAAC;QAClE,KAAK,CAAC,mBAAmB,MAAM,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAClC,IAAI,CAAS;IACb,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,IAAY;QACvB,MAAM,IAAI,GAAG,yDAAyD,CAAC;QACvE,MAAM,OAAO,GAAG,wDAAwD,CAAC;QACzE,KAAK,CAAC,6BAA6B,IAAI,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/shared/errors.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAClC,MAAM,CAAS;IACf,QAAQ,CAAS;IACjB,SAAS,CAAS;IAClB,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc,EAAE,QAAgB,EAAE,SAAiB;QAC9D,MAAM,IAAI,GAAG,qEAAqE,CAAC;QACnF,MAAM,OAAO,GAAG,uDAAuD,CAAC;QACxE,KAAK,CACJ,iCAAiC,MAAM,UAAU,QAAQ,UAAU,SAAS,eAAe,IAAI,aAAa,OAAO,EAAE,CACrH,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC3B,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc;QACzB,MAAM,IAAI,GACT,sGAAsG,CAAC;QACxG,MAAM,OAAO,GAAG,gDAAgD,CAAC;QACjE,KAAK,CAAC,kBAAkB,MAAM,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc;QACzB,MAAM,IAAI,GACT,wFAAwF,CAAC;QAC1F,MAAM,OAAO,GAAG,oDAAoD,CAAC;QACrE,KAAK,CAAC,+BAA+B,MAAM,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAClC,GAAG,CAAS;IACZ,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,GAAW;QACtB,MAAM,IAAI,GAAG,2EAA2E,CAAC;QACzF,MAAM,OAAO,GAAG,uDAAuD,CAAC;QACxE,KAAK,CAAC,iCAAiC,GAAG,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAChC,aAAa,CAAS;IACtB,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc;QACzB,MAAM,IAAI,GACT,6FAA6F,CAAC;QAC/F,MAAM,OAAO,GAAG,qDAAqD,CAAC;QACtE,KAAK,CAAC,uBAAuB,MAAM,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5B,aAAa,CAAS;IACtB,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc;QACzB,MAAM,IAAI,GAAG,sEAAsE,CAAC;QACpF,MAAM,OAAO,GAAG,iDAAiD,CAAC;QAClE,KAAK,CAAC,mBAAmB,MAAM,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACrC,cAAc,CAAS;IACvB,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,cAAsB,EAAE,MAAc;QACjD,MAAM,IAAI,GACT,mHAAmH,CAAC;QACrH,MAAM,OAAO,GAAG,2DAA2D,CAAC;QAC5E,KAAK,CACJ,gCAAgC,cAAc,KAAK,MAAM,eAAe,IAAI,aAAa,OAAO,EAAE,CAClG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAClC,IAAI,CAAS;IACb,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,IAAY;QACvB,MAAM,IAAI,GAAG,yDAAyD,CAAC;QACvE,MAAM,OAAO,GAAG,wDAAwD,CAAC;QACzE,KAAK,CAAC,6BAA6B,IAAI,eAAe,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAChC,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,OAAe,EAAE,MAAc;QAC1C,MAAM,IAAI,GACT,oHAAoH,CAAC;QACtH,MAAM,OAAO,GAAG,qDAAqD,CAAC;QACtE,KAAK,CACJ,iCAAiC,OAAO,KAAK,MAAM,eAAe,IAAI,aAAa,OAAO,EAAE,CAC5F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9B,MAAM,CAAS;IACf,IAAI,CAAS;IACb,OAAO,CAAS;IAEhC,YAAY,MAAc;QACzB,MAAM,IAAI,GAAG,WAAW,MAAM,gDAAgD,CAAC;QAC/E,MAAM,OAAO,GAAG,oDAAoD,CAAC;QACrE,KAAK,CACJ,6BAA6B,MAAM,8BAA8B,IAAI,aAAa,OAAO,EAAE,CAC3F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD"}

package/dist/shared/types.d.ts

@@ -12,6 +12,12 @@ export interface TrustReceipt {
     timestamp: string;
     /** Present and true when the audit chain write failed (failure mode 15.3). */
     auditDegraded?: boolean;
+    /** Whether cost came from provider-reported usage or the pre-call estimate. */
+    usageSource?: "provider" | "estimated";
+    /** Number of chunks delivered to the consumer (streaming calls only). */
+    chunksDelivered?: number;
+    /** Action kind for governed non-LLM actions. Absent for LLM calls (backward compat). */
+    actionKind?: ActionKind;
 }
 export interface TrustedResponse<T> {
     response: T;
@@ -24,6 +30,7 @@ export declare const TrustConfigSchema: z.ZodObject<{
     key: z.ZodOptional<z.ZodString>;
     policies: z.ZodDefault<z.ZodString>;
     pii: z.ZodDefault<z.ZodEnum<["redact", "warn", "block", "off"]>>;
+    injection: z.ZodDefault<z.ZodEnum<["block", "warn", "off"]>>;
     board: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         vetoThreshold: z.ZodDefault<z.ZodEnum<["low", "medium", "high", "critical"]>>;
@@ -74,6 +81,79 @@ export declare const TrustConfigSchema: z.ZodObject<{
         addresses?: string[] | undefined;
         clusterId?: number | undefined;
     }>>;
+    providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        models: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        models: string[];
+    }, {
+        name: string;
+        models?: string[] | undefined;
+    }>, "many">>;
+    pricing: z.ZodDefault<z.ZodEnum<["recommended", "custom"]>>;
+    customRates: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        inputPer1k: z.ZodNumber;
+        outputPer1k: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        inputPer1k: number;
+        outputPer1k: number;
+    }, {
+        inputPer1k: number;
+        outputPer1k: number;
+    }>>>;
+    supplyChain: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        trustedPublishers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        allowedPermissions: z.ZodDefault<z.ZodArray<z.ZodEnum<["llm_call", "tool_use", "file_read", "file_write", "shell_command", "network_access", "credential_access"]>, "many">>;
+        requireSignature: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        trustedPublishers: string[];
+        allowedPermissions: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[];
+        requireSignature: boolean;
+    }, {
+        enabled?: boolean | undefined;
+        trustedPublishers?: string[] | undefined;
+        allowedPermissions?: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[] | undefined;
+        requireSignature?: boolean | undefined;
+    }>>;
+    vault: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        masterKeyEnv: z.ZodDefault<z.ZodString>;
+        auditAccess: z.ZodDefault<z.ZodBoolean>;
+        defaultScope: z.ZodDefault<z.ZodObject<{
+            agents: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            actions: z.ZodDefault<z.ZodArray<z.ZodEnum<["llm_call", "tool_use", "file_access", "shell_command", "api_request"]>, "many">>;
+            expiresAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        }, "strip", z.ZodTypeAny, {
+            agents: string[];
+            actions: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[];
+            expiresAt: string | null;
+        }, {
+            agents?: string[] | undefined;
+            actions?: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[] | undefined;
+            expiresAt?: string | null | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        masterKeyEnv: string;
+        auditAccess: boolean;
+        defaultScope: {
+            agents: string[];
+            actions: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[];
+            expiresAt: string | null;
+        };
+    }, {
+        enabled?: boolean | undefined;
+        masterKeyEnv?: string | undefined;
+        auditAccess?: boolean | undefined;
+        defaultScope?: {
+            agents?: string[] | undefined;
+            actions?: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[] | undefined;
+            expiresAt?: string | null | undefined;
+        } | undefined;
+    }>>;
 }, "strip", z.ZodTypeAny, {
     audit: {
         rotation: "daily" | "weekly" | "none";
@@ -83,6 +163,7 @@ export declare const TrustConfigSchema: z.ZodObject<{
     tier: "free" | "mini" | "pro" | "mega" | "ultra";
     policies: string;
     pii: "redact" | "warn" | "block" | "off";
+    injection: "warn" | "block" | "off";
     board: {
         enabled: boolean;
         vetoThreshold: "low" | "medium" | "high" | "critical";
@@ -99,8 +180,33 @@ export declare const TrustConfigSchema: z.ZodObject<{
         addresses: string[];
         clusterId: number;
     };
+    providers: {
+        name: string;
+        models: string[];
+    }[];
+    pricing: "custom" | "recommended";
+    supplyChain: {
+        enabled: boolean;
+        trustedPublishers: string[];
+        allowedPermissions: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[];
+        requireSignature: boolean;
+    };
+    vault: {
+        enabled: boolean;
+        masterKeyEnv: string;
+        auditAccess: boolean;
+        defaultScope: {
+            agents: string[];
+            actions: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[];
+            expiresAt: string | null;
+        };
+    };
     proxy?: string | undefined;
     key?: string | undefined;
+    customRates?: Record<string, {
+        inputPer1k: number;
+        outputPer1k: number;
+    }> | undefined;
 }, {
     budget: number;
     audit?: {
@@ -112,6 +218,7 @@ export declare const TrustConfigSchema: z.ZodObject<{
     key?: string | undefined;
     policies?: string | undefined;
     pii?: "redact" | "warn" | "block" | "off" | undefined;
+    injection?: "warn" | "block" | "off" | undefined;
     board?: {
         enabled?: boolean | undefined;
         vetoThreshold?: "low" | "medium" | "high" | "critical" | undefined;
@@ -128,6 +235,31 @@ export declare const TrustConfigSchema: z.ZodObject<{
         addresses?: string[] | undefined;
         clusterId?: number | undefined;
     } | undefined;
+    providers?: {
+        name: string;
+        models?: string[] | undefined;
+    }[] | undefined;
+    pricing?: "custom" | "recommended" | undefined;
+    customRates?: Record<string, {
+        inputPer1k: number;
+        outputPer1k: number;
+    }> | undefined;
+    supplyChain?: {
+        enabled?: boolean | undefined;
+        trustedPublishers?: string[] | undefined;
+        allowedPermissions?: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[] | undefined;
+        requireSignature?: boolean | undefined;
+    } | undefined;
+    vault?: {
+        enabled?: boolean | undefined;
+        masterKeyEnv?: string | undefined;
+        auditAccess?: boolean | undefined;
+        defaultScope?: {
+            agents?: string[] | undefined;
+            actions?: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[] | undefined;
+            expiresAt?: string | null | undefined;
+        } | undefined;
+    } | undefined;
 }>;
 export type TrustConfig = z.infer<typeof TrustConfigSchema>;
 export type PolicyEffect = "deny" | "warn";
@@ -159,4 +291,140 @@ export type BoardDecision = "approved" | "blocked" | "escalated";
 export type ConcernType = "hallucination" | "bias" | "safety" | "scope_creep" | "resource_abuse" | "policy_violation";
 export type DirectorVote = "approve" | "veto" | "abstain";
 export type LLMClientKind = "anthropic" | "openai" | "google";
+/** Extensible union for governed action types. */
+export type ActionKind = "llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request";
+/** Descriptor for a governed action. */
+export interface ActionDescriptor {
+    /** The kind of action being governed. */
+    kind: ActionKind;
+    /** Human-readable name (e.g., "file_read", "curl", tool name). */
+    name: string;
+    /** Estimated cost in usertokens. Required for budget enforcement. */
+    cost: number;
+    /** Arbitrary parameters for policy evaluation and audit logging. */
+    params?: Record<string, unknown>;
+    /** Actor identity (defaults to "local"). */
+    actor?: string;
+}
+/** Result wrapper for governed actions. */
+export interface GovernedActionResult<T> {
+    result: T;
+    receipt: TrustReceipt;
+}
+/** Result of prompt injection detection scan. */
+export interface InjectionDetection {
+    /** Whether a prompt injection attempt was detected. */
+    detected: boolean;
+    /** Confidence score from 0.0 (clean) to 1.0 (certain injection). */
+    score: number;
+    /** Names of matched detection patterns (e.g., ["keyword_combo", "role_boundary"]). */
+    patterns: string[];
+    /** Dot-paths where injections were found (e.g., ["messages[0].content(keyword_combo)"]). */
+    paths: string[];
+}
+/** Canary token for prompt leak detection. */
+export interface CanaryToken {
+    /** Random hex token (32 chars). */
+    token: string;
+    /** HTML comment marker embedding the token. */
+    marker: string;
+}
+/** Permission an agent skill can request. */
+export type SkillPermission = "llm_call" | "tool_use" | "file_read" | "file_write" | "shell_command" | "network_access" | "credential_access";
+/** A signed skill manifest declaring identity, permissions, and integrity. */
+export interface SkillManifest {
+    /** Schema version for forward compatibility. */
+    version: 1;
+    /** Unique skill identifier (e.g., "acme/summarizer"). */
+    id: string;
+    /** Human-readable skill name. */
+    name: string;
+    /** Skill author or publisher. */
+    publisher: string;
+    /** Permissions the skill requires at runtime. */
+    permissions: SkillPermission[];
+    /** SHA-256 hash of the skill's entry point source code. */
+    entryHash: string;
+    /** ISO 8601 timestamp of when the manifest was signed. */
+    signedAt: string;
+    /** Ed25519 signature of the canonical manifest (hex-encoded). */
+    signature: string;
+    /** Ed25519 public key of the signer (hex-encoded). */
+    publicKey: string;
+}
+/** Result of verifying a skill manifest. */
+export interface SkillVerification {
+    /** Whether the manifest signature is valid. */
+    valid: boolean;
+    /** Whether all declared permissions are allowed by policy. */
+    permissionsAllowed: boolean;
+    /** Permissions that were denied by policy. */
+    deniedPermissions: SkillPermission[];
+    /** SHA-256 hash of the manifest for audit inclusion. */
+    manifestHash: string;
+    /** Error message if verification failed. */
+    error?: string;
+}
+export declare const SkillManifestSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    id: z.ZodString;
+    name: z.ZodString;
+    publisher: z.ZodString;
+    permissions: z.ZodArray<z.ZodEnum<["llm_call", "tool_use", "file_read", "file_write", "shell_command", "network_access", "credential_access"]>, "many">;
+    entryHash: z.ZodString;
+    signedAt: z.ZodString;
+    signature: z.ZodString;
+    publicKey: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    version: 1;
+    id: string;
+    publisher: string;
+    permissions: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[];
+    entryHash: string;
+    signedAt: string;
+    signature: string;
+    publicKey: string;
+}, {
+    name: string;
+    version: 1;
+    id: string;
+    publisher: string;
+    permissions: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[];
+    entryHash: string;
+    signedAt: string;
+    signature: string;
+    publicKey: string;
+}>;
+/** Scope constraining when/how a credential can be accessed. */
+export interface CredentialScope {
+    /** Agents allowed to access this credential (empty = all). */
+    agents: string[];
+    /** Action kinds allowed to use this credential (empty = all). */
+    actions: ActionKind[];
+    /** Expiration timestamp (ISO 8601). Null = no expiry. */
+    expiresAt: string | null;
+}
+/** A stored credential entry (decrypted form). */
+export interface CredentialEntry {
+    /** Unique credential name (e.g., "OPENAI_API_KEY"). */
+    name: string;
+    /** The secret value. */
+    value: string;
+    /** Access scope constraints. */
+    scope: CredentialScope;
+    /** ISO 8601 timestamp when the credential was stored. */
+    createdAt: string;
+    /** ISO 8601 timestamp when the credential was last rotated. */
+    rotatedAt: string;
+}
+/** Result of a credential access attempt. */
+export interface CredentialAccessResult {
+    /** Whether access was granted. */
+    granted: boolean;
+    /** The credential value (only present if granted). */
+    value?: string;
+    /** Reason for denial (only present if denied). */
+    reason?: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/shared/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,WAAW,YAAY;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAGD,MAAM,WAAW,eAAe,CAAC,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;CACtB;AAGD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqC5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAG5D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAC3C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,CAAC;AAChD,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,UAAU,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,aAAa,GACtB,QAAQ,GACR,YAAY,GACZ,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,QAAQ,GACR,UAAU,GACV,OAAO,CAAC;AAEX,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAGD,MAAM,WAAW,UAAU;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAGD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AACjE,MAAM,MAAM,WAAW,GACpB,eAAe,GACf,MAAM,GACN,QAAQ,GACR,aAAa,GACb,gBAAgB,GAChB,kBAAkB,CAAC;AACtB,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAG1D,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,WAAW,YAAY;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC;IACvC,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,UAAU,CAAC,EAAE,UAAU,CAAC;CACxB;AAGD,MAAM,WAAW,eAAe,CAAC,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;CACtB;AAGD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4F5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAG5D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAC3C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,CAAC;AAChD,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,UAAU,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,aAAa,GACtB,QAAQ,GACR,YAAY,GACZ,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,QAAQ,GACR,UAAU,GACV,OAAO,CAAC;AAEX,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAGD,MAAM,WAAW,UAAU;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAGD,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AACjE,MAAM,MAAM,WAAW,GACpB,eAAe,GACf,MAAM,GACN,QAAQ,GACR,aAAa,GACb,gBAAgB,GAChB,kBAAkB,CAAC;AACtB,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAG1D,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAI9D,kDAAkD;AAClD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,GAAG,aAAa,CAAC;AAEnG,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAChC,yCAAyC;IACzC,IAAI,EAAE,UAAU,CAAC;IACjB,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,2CAA2C;AAC3C,MAAM,WAAW,oBAAoB,CAAC,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC;IACV,OAAO,EAAE,YAAY,CAAC;CACtB;AAID,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IAClC,uDAAuD;IACvD,QAAQ,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,4FAA4F;IAC5F,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,WAAW;IAC3B,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;CACf;AAID,6CAA6C;AAC7C,MAAM,MAAM,eAAe,GACxB,UAAU,GACV,UAAU,GACV,WAAW,GACX,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,mBAAmB,CAAC;AAEvB,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC7B,gDAAgD;IAChD,OAAO,EAAE,CAAC,CAAC;IACX,yDAAyD;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IACjC,+CAA+C;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,8DAA8D;IAC9D,kBAAkB,EAAE,OAAO,CAAC;IAC5B,8CAA8C;IAC9C,iBAAiB,EAAE,eAAe,EAAE,CAAC;IACrC,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoB9B,CAAC;AAIH,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC/B,8DAA8D;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iEAAiE;IACjE,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,yDAAyD;IACzD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,kDAAkD;AAClD,MAAM,WAAW,eAAe;IAC/B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,6CAA6C;AAC7C,MAAM,WAAW,sBAAsB;IACtC,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/shared/types.js

@@ -9,6 +9,7 @@ export const TrustConfigSchema = z.object({
     key: z.string().optional(),
     policies: z.string().default("./policies/default.yml"),
     pii: z.enum(["redact", "warn", "block", "off"]).default("warn"),
+    injection: z.enum(["block", "warn", "off"]).default("warn"),
     board: z
         .object({
         enabled: z.boolean().default(false),
@@ -39,5 +40,71 @@ export const TrustConfigSchema = z.object({
         clusterId: z.number().int().nonnegative().default(0),
     })
         .default({}),
+    providers: z
+        .array(z.object({
+        name: z.string(),
+        models: z.array(z.string()).default([]),
+    }))
+        .default([]),
+    pricing: z.enum(["recommended", "custom"]).default("recommended"),
+    customRates: z
+        .record(z.string(), z.object({
+        inputPer1k: z.number().finite().nonnegative(),
+        outputPer1k: z.number().finite().nonnegative(),
+    }))
+        .optional(),
+    supplyChain: z
+        .object({
+        enabled: z.boolean().default(false),
+        trustedPublishers: z.array(z.string()).default([]),
+        allowedPermissions: z
+            .array(z.enum([
+            "llm_call",
+            "tool_use",
+            "file_read",
+            "file_write",
+            "shell_command",
+            "network_access",
+            "credential_access",
+        ]))
+            .default(["llm_call", "tool_use", "file_read"]),
+        requireSignature: z.boolean().default(true),
+    })
+        .default({}),
+    vault: z
+        .object({
+        enabled: z.boolean().default(false),
+        masterKeyEnv: z.string().default("USERTRUST_VAULT_KEY"),
+        auditAccess: z.boolean().default(true),
+        defaultScope: z
+            .object({
+            agents: z.array(z.string()).default([]),
+            actions: z
+                .array(z.enum(["llm_call", "tool_use", "file_access", "shell_command", "api_request"]))
+                .default([]),
+            expiresAt: z.string().datetime().nullable().default(null),
+        })
+            .default({}),
+    })
+        .default({}),
+});
+export const SkillManifestSchema = z.object({
+    version: z.literal(1),
+    id: z.string().regex(/^[a-z0-9_-]+\/[a-z0-9_-]+$/, "Skill ID must be publisher/name format"),
+    name: z.string().min(1).max(128),
+    publisher: z.string().min(1).max(64),
+    permissions: z.array(z.enum([
+        "llm_call",
+        "tool_use",
+        "file_read",
+        "file_write",
+        "shell_command",
+        "network_access",
+        "credential_access",
+    ])),
+    entryHash: z.string().regex(/^[a-f0-9]{64}$/, "Must be a SHA-256 hex hash"),
+    signedAt: z.string().datetime(),
+    signature: z.string().regex(/^[a-f0-9]{128}$/, "Must be a hex-encoded 64-byte Ed25519 signature"),
+    publicKey: z.string().regex(/^[a-f0-9]{64}$/, "Must be hex-encoded Ed25519 public key"),
 });
 //# sourceMappingURL=types.js.map

package/dist/shared/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAwBxB,sBAAsB;AACtB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACtE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACtD,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/D,KAAK,EAAE,CAAC;SACN,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;KAC5E,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IACb,cAAc,EAAE,CAAC;SACf,MAAM,CAAC;QACP,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;KAC9C,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IACb,QAAQ,EAAE,CAAC;SACT,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrC,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IACb,KAAK,EAAE,CAAC;SACN,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;KAC5C,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;SACZ,MAAM,CAAC;QACP,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;KACpD,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;CACb,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8BxB,sBAAsB;AACtB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACtE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACtD,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC3D,KAAK,EAAE,CAAC;SACN,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;KAC5E,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IACb,cAAc,EAAE,CAAC;SACf,MAAM,CAAC;QACP,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;KAC9C,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IACb,QAAQ,EAAE,CAAC;SACT,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrC,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IACb,KAAK,EAAE,CAAC;SACN,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;KAC5C,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;SACZ,MAAM,CAAC;QACP,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC1D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;KACpD,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IACb,SAAS,EAAE,CAAC;SACV,KAAK,CACL,CAAC,CAAC,MAAM,CAAC;QACR,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACvC,CAAC,CACF;SACA,OAAO,CAAC,EAAE,CAAC;IACb,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IACjE,WAAW,EAAE,CAAC;SACZ,MAAM,CACN,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACR,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;QAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;KAC9C,CAAC,CACF;SACA,QAAQ,EAAE;IACZ,WAAW,EAAE,CAAC;SACZ,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,kBAAkB,EAAE,CAAC;aACnB,KAAK,CACL,CAAC,CAAC,IAAI,CAAC;YACN,UAAU;YACV,UAAU;YACV,WAAW;YACX,YAAY;YACZ,eAAe;YACf,gBAAgB;YAChB,mBAAmB;SACnB,CAAC,CACF;aACA,OAAO,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QAChD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC3C,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;IACb,KAAK,EAAE,CAAC;SACN,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACvD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,YAAY,EAAE,CAAC;aACb,MAAM,CAAC;YACP,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,CAAC;iBACR,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;iBACtF,OAAO,CAAC,EAAE,CAAC;YACb,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;SACzD,CAAC;aACD,OAAO,CAAC,EAAE,CAAC;KACb,CAAC;SACD,OAAO,CAAC,EAAE,CAAC;CACb,CAAC,CAAC;AA6JH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE,wCAAwC,CAAC;IAC5F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,KAAK,CACnB,CAAC,CAAC,IAAI,CAAC;QACN,UAAU;QACV,UAAU;QACV,WAAW;QACX,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,mBAAmB;KACnB,CAAC,CACF;IACD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,iDAAiD,CAAC;IACjG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,wCAAwC,CAAC;CACvF,CAAC,CAAC"}

package/dist/streaming.d.ts

@@ -22,6 +22,11 @@ export interface StreamUsage {
     inputTokens: number;
     outputTokens: number;
 }
+export interface StreamCompletion {
+    usage: StreamUsage;
+    chunksDelivered: number;
+    usageReported: boolean;
+}
 export interface GovernedStream<T> extends AsyncIterable<T> {
     /** Resolves with the trust receipt when the stream completes */
     receipt: Promise<TrustReceipt>;
@@ -31,7 +36,7 @@ export interface GovernedStream<T> extends AsyncIterable<T> {
  * Yields all chunks unchanged. Calls onComplete with accumulated usage
  * when the stream ends, or onError on failure.
  */
-export declare function wrapStream<T>(stream: AsyncIterable<T>, kind: LLMClientKind, onComplete: (usage: StreamUsage) => void, onError: (error: unknown) => void): AsyncIterable<T>;
+export declare function wrapStream<T>(stream: AsyncIterable<T>, kind: LLMClientKind, onComplete: (completion: StreamCompletion) => void, onError: (error: unknown, partial: StreamCompletion) => void): AsyncIterable<T>;
 /**
  * Creates a GovernedStream: an AsyncIterable that also exposes a `.receipt`
  * promise resolving to the TrustReceipt after the stream completes.
@@ -40,5 +45,5 @@ export declare function wrapStream<T>(stream: AsyncIterable<T>, kind: LLMClientK
  *   It should POST the actual cost and return the receipt.
  * - `rejectReceipt` is called on stream error. It should VOID the hold.
  */
-export declare function createGovernedStream<T>(stream: AsyncIterable<T>, kind: LLMClientKind, resolveReceipt: (usage: StreamUsage) => Promise<TrustReceipt>, rejectReceipt: (error: unknown) => void): GovernedStream<T>;
+export declare function createGovernedStream<T>(stream: AsyncIterable<T>, kind: LLMClientKind, resolveReceipt: (completion: StreamCompletion) => Promise<TrustReceipt>, rejectReceipt: (error: unknown, partial: StreamCompletion) => void): GovernedStream<T>;
 //# sourceMappingURL=streaming.d.ts.map

package/dist/streaming.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"streaming.d.ts","sourceRoot":"","sources":["../src/streaming.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAIrE,MAAM,WAAW,WAAW;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC;IAC1D,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAC/B;AAqDD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC3B,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,aAAa,EACnB,UAAU,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,EACxC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAC/B,aAAa,CAAC,CAAC,CAAC,CAElB;AA6BD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EACrC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,aAAa,EACnB,cAAc,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,EAC7D,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACrC,cAAc,CAAC,CAAC,CAAC,CA8BnB"}
+{"version":3,"file":"streaming.d.ts","sourceRoot":"","sources":["../src/streaming.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAIrE,MAAM,WAAW,WAAW;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,WAAW,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC;IAC1D,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CAC/B;AAqDD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC3B,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,aAAa,EACnB,UAAU,EAAE,CAAC,UAAU,EAAE,gBAAgB,KAAK,IAAI,EAClD,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,GAC1D,aAAa,CAAC,CAAC,CAAC,CAElB;AAsCD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EACrC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EACxB,IAAI,EAAE,aAAa,EACnB,cAAc,EAAE,CAAC,UAAU,EAAE,gBAAgB,KAAK,OAAO,CAAC,YAAY,CAAC,EACvE,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,KAAK,IAAI,GAChE,cAAc,CAAC,CAAC,CAAC,CA8BnB"}

package/dist/streaming.js

@@ -54,20 +54,27 @@ export function wrapStream(stream, kind, onComplete, onError) {
 async function* wrapStreamImpl(stream, kind, onComplete, onError) {
     let inputTokens = 0;
     let outputTokens = 0;
+    let chunksDelivered = 0;
+    let usageReported = false;
     try {
         for await (const chunk of stream) {
             const tokens = extractTokensFromChunk(chunk, kind);
             // Use latest non-zero value (providers report cumulative or final)
-            if (tokens.inputTokens > 0)
+            if (tokens.inputTokens > 0) {
                 inputTokens = tokens.inputTokens;
-            if (tokens.outputTokens > 0)
+                usageReported = true;
+            }
+            if (tokens.outputTokens > 0) {
                 outputTokens = tokens.outputTokens;
+                usageReported = true;
+            }
             yield chunk;
+            chunksDelivered++;
         }
-        onComplete({ inputTokens, outputTokens });
+        onComplete({ usage: { inputTokens, outputTokens }, chunksDelivered, usageReported });
     }
     catch (err) {
-        onError(err);
+        onError(err, { usage: { inputTokens, outputTokens }, chunksDelivered, usageReported });
         throw err;
     }
 }
@@ -87,16 +94,16 @@ export function createGovernedStream(stream, kind, resolveReceipt, rejectReceipt
         receiptResolve = resolve;
         receiptReject = reject;
     });
-    const wrapped = wrapStream(stream, kind, (usage) => {
-        resolveReceipt(usage)
+    const wrapped = wrapStream(stream, kind, (completion) => {
+        resolveReceipt(completion)
             .then((receipt) => {
             receiptResolve(receipt);
         })
             .catch((err) => {
             receiptReject(err);
         });
-    }, (error) => {
-        rejectReceipt(error);
+    }, (error, partial) => {
+        rejectReceipt(error, partial);
         receiptReject(error);
     });
     return Object.assign(wrapped, {

package/dist/streaming.js.map

@@ -1 +1 @@
-{"version":3,"file":"streaming.js","sourceRoot":"","sources":["../src/streaming.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAoCjC,yBAAyB;AAEzB,SAAS,sBAAsB,CAAC,KAAc,EAAE,IAAmB;IAClE,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtF,MAAM,GAAG,GAAG,CAAC,CAAC,OAAkC,CAAC;YACjD,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAA+B,CAAC;gBAClD,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;YAClE,CAAC;QACF,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAA+B,CAAC;gBAChD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;YACnE,CAAC;QACF,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAA+B,CAAC;YAChD,OAAO;gBACN,WAAW,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC;gBACrC,YAAY,EAAE,KAAK,CAAC,iBAAiB,IAAI,CAAC;aAC1C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,SAAS;IACT,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,CAAC,CAAC,aAAuC,CAAC;QACvD,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,gBAAgB,IAAI,CAAC;YACvC,YAAY,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC;SAC5C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,uBAAuB;AAEvB;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACzB,MAAwB,EACxB,IAAmB,EACnB,UAAwC,EACxC,OAAiC;IAEjC,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,cAAc,CAC7B,MAAwB,EACxB,IAAmB,EACnB,UAAwC,EACxC,OAAiC;IAEjC,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,IAAI,CAAC;QACJ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,mEAAmE;YACnE,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC;gBAAE,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YAC7D,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC;gBAAE,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;YAEhE,MAAM,KAAK,CAAC;QACb,CAAC;QACD,UAAU,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AAED,+BAA+B;AAE/B;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CACnC,MAAwB,EACxB,IAAmB,EACnB,cAA6D,EAC7D,aAAuC;IAEvC,IAAI,cAAgD,CAAC;IACrD,IAAI,aAAwC,CAAC;IAE7C,MAAM,cAAc,GAAG,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpE,cAAc,GAAG,OAAO,CAAC;QACzB,aAAa,GAAG,MAAM,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,UAAU,CACzB,MAAM,EACN,IAAI,EACJ,CAAC,KAAK,EAAE,EAAE;QACT,cAAc,CAAC,KAAK,CAAC;aACnB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACjB,cAAc,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACvB,aAAa,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;QACT,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,aAAa,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CACD,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,cAAc;KACvB,CAAsB,CAAC;AACzB,CAAC"}
+{"version":3,"file":"streaming.js","sourceRoot":"","sources":["../src/streaming.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AA0CjC,yBAAyB;AAEzB,SAAS,sBAAsB,CAAC,KAAc,EAAE,IAAmB;IAClE,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,CAAC,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtF,MAAM,GAAG,GAAG,CAAC,CAAC,OAAkC,CAAC;YACjD,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,GAAG,CAAC,KAA+B,CAAC;gBAClD,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;YAClE,CAAC;QACF,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAA+B,CAAC;gBAChD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;YACnE,CAAC;QACF,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,CAAC,CAAC,KAA+B,CAAC;YAChD,OAAO;gBACN,WAAW,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC;gBACrC,YAAY,EAAE,KAAK,CAAC,iBAAiB,IAAI,CAAC;aAC1C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,SAAS;IACT,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,CAAC,CAAC,aAAuC,CAAC;QACvD,OAAO;YACN,WAAW,EAAE,IAAI,CAAC,gBAAgB,IAAI,CAAC;YACvC,YAAY,EAAE,IAAI,CAAC,oBAAoB,IAAI,CAAC;SAC5C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,uBAAuB;AAEvB;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACzB,MAAwB,EACxB,IAAmB,EACnB,UAAkD,EAClD,OAA4D;IAE5D,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,cAAc,CAC7B,MAAwB,EACxB,IAAmB,EACnB,UAAkD,EAClD,OAA4D;IAE5D,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,IAAI,CAAC;QACJ,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,mEAAmE;YACnE,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;gBAC5B,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBACjC,aAAa,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC7B,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;gBACnC,aAAa,GAAG,IAAI,CAAC;YACtB,CAAC;YAED,MAAM,KAAK,CAAC;YACZ,eAAe,EAAE,CAAC;QACnB,CAAC;QACD,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;QACvF,MAAM,GAAG,CAAC;IACX,CAAC;AACF,CAAC;AAED,+BAA+B;AAE/B;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CACnC,MAAwB,EACxB,IAAmB,EACnB,cAAuE,EACvE,aAAkE;IAElE,IAAI,cAAgD,CAAC;IACrD,IAAI,aAAwC,CAAC;IAE7C,MAAM,cAAc,GAAG,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpE,cAAc,GAAG,OAAO,CAAC;QACzB,aAAa,GAAG,MAAM,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,UAAU,CACzB,MAAM,EACN,IAAI,EACJ,CAAC,UAAU,EAAE,EAAE;QACd,cAAc,CAAC,UAAU,CAAC;aACxB,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACjB,cAAc,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACvB,aAAa,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC,EACD,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAClB,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9B,aAAa,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CACD,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,cAAc;KACvB,CAAsB,CAAC;AACzB,CAAC"}

package/dist/supply-chain/manifest.d.ts

@@ -0,0 +1,22 @@
+import type { SkillManifest, SkillPermission } from "../shared/types.js";
+/**
+ * Validates a raw manifest object against the SkillManifest Zod schema.
+ * Returns the typed manifest or throws a ZodError.
+ */
+export declare function validateManifest(raw: unknown): SkillManifest;
+/**
+ * Creates an unsigned manifest with the entryHash computed from the source code.
+ */
+export declare function createUnsignedManifest(opts: {
+    id: string;
+    name: string;
+    publisher: string;
+    permissions: SkillPermission[];
+    entrySource: string;
+}): Omit<SkillManifest, "signature" | "publicKey" | "signedAt">;
+/**
+ * Computes a deterministic SHA-256 hash of the manifest fields (excluding signature),
+ * using canonical JSON serialization.
+ */
+export declare function hashManifest(manifest: Omit<SkillManifest, "signature">): string;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/supply-chain/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/supply-chain/manifest.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGzE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAE5D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;CACpB,GAAG,IAAI,CAAC,aAAa,EAAE,WAAW,GAAG,WAAW,GAAG,UAAU,CAAC,CAU9D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,CAc/E"}