usertrust 1.5.0 → 2.0.0

package/dist/shared/types.d.ts

@@ -50,505 +50,156 @@ export interface TrustedResponse<T> {
 }
 export declare const TrustConfigSchema: z.ZodObject<{
     budget: z.ZodNumber;
-    tier: z.ZodDefault<z.ZodEnum<["free", "mini", "pro", "mega", "ultra"]>>;
+    tier: z.ZodDefault<z.ZodEnum<{
+        free: "free";
+        mini: "mini";
+        pro: "pro";
+        mega: "mega";
+        ultra: "ultra";
+    }>>;
     proxy: z.ZodOptional<z.ZodString>;
     key: z.ZodOptional<z.ZodString>;
     policies: z.ZodDefault<z.ZodString>;
-    pii: z.ZodDefault<z.ZodEnum<["redact", "warn", "block", "off"]>>;
-    injection: z.ZodDefault<z.ZodEnum<["block", "warn", "off"]>>;
-    board: z.ZodDefault<z.ZodObject<{
-        enabled: z.ZodDefault<z.ZodBoolean>;
-        vetoThreshold: z.ZodDefault<z.ZodEnum<["low", "medium", "high", "critical"]>>;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-        vetoThreshold: "low" | "medium" | "high" | "critical";
-    }, {
-        enabled?: boolean | undefined;
-        vetoThreshold?: "low" | "medium" | "high" | "critical" | undefined;
+    pii: z.ZodDefault<z.ZodEnum<{
+        redact: "redact";
+        warn: "warn";
+        block: "block";
+        off: "off";
     }>>;
-    circuitBreaker: z.ZodDefault<z.ZodObject<{
+    injection: z.ZodDefault<z.ZodEnum<{
+        warn: "warn";
+        block: "block";
+        off: "off";
+    }>>;
+    board: z.ZodPrefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        vetoThreshold: z.ZodDefault<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            critical: "critical";
+        }>>;
+    }, z.core.$strip>>;
+    circuitBreaker: z.ZodPrefault<z.ZodObject<{
         failureThreshold: z.ZodDefault<z.ZodNumber>;
         resetTimeout: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        failureThreshold: number;
-        resetTimeout: number;
-    }, {
-        failureThreshold?: number | undefined;
-        resetTimeout?: number | undefined;
-    }>>;
-    patterns: z.ZodDefault<z.ZodObject<{
+    }, z.core.$strip>>;
+    patterns: z.ZodPrefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         feedProxy: z.ZodDefault<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-        feedProxy: boolean;
-    }, {
-        enabled?: boolean | undefined;
-        feedProxy?: boolean | undefined;
-    }>>;
-    audit: z.ZodDefault<z.ZodObject<{
-        rotation: z.ZodDefault<z.ZodEnum<["daily", "weekly", "none"]>>;
+    }, z.core.$strip>>;
+    audit: z.ZodPrefault<z.ZodObject<{
+        rotation: z.ZodDefault<z.ZodEnum<{
+            daily: "daily";
+            weekly: "weekly";
+            none: "none";
+        }>>;
         indexLimit: z.ZodDefault<z.ZodNumber>;
         failClosed: z.ZodDefault<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        rotation: "daily" | "weekly" | "none";
-        indexLimit: number;
-        failClosed: boolean;
-    }, {
-        rotation?: "daily" | "weekly" | "none" | undefined;
-        indexLimit?: number | undefined;
-        failClosed?: boolean | undefined;
-    }>>;
-    tigerbeetle: z.ZodDefault<z.ZodObject<{
-        addresses: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    }, z.core.$strip>>;
+    tigerbeetle: z.ZodPrefault<z.ZodObject<{
+        addresses: z.ZodDefault<z.ZodArray<z.ZodString>>;
         clusterId: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        addresses: string[];
-        clusterId: number;
-    }, {
-        addresses?: string[] | undefined;
-        clusterId?: number | undefined;
-    }>>;
+    }, z.core.$strip>>;
     providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
-        models: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    }, "strip", z.ZodTypeAny, {
-        name: string;
-        models: string[];
-    }, {
-        name: string;
-        models?: string[] | undefined;
-    }>, "many">>;
-    pricing: z.ZodDefault<z.ZodEnum<["recommended", "custom"]>>;
+        models: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    pricing: z.ZodDefault<z.ZodEnum<{
+        custom: "custom";
+        recommended: "recommended";
+    }>>;
     customRates: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         inputPer1k: z.ZodNumber;
         outputPer1k: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        inputPer1k: number;
-        outputPer1k: number;
-    }, {
-        inputPer1k: number;
-        outputPer1k: number;
-    }>>>;
-    /**
-     * Endpoint matchers consumed by classifyEndpoint(). First match wins.
-     * match forms: scheme URL ("http://gpu-box:8000", matched by origin),
-     * leading-star hostname suffix ("*.gpu.internal"), or bare hostname ("gpu-box").
-     */
+    }, z.core.$strip>>>;
     endpoints: z.ZodDefault<z.ZodArray<z.ZodObject<{
         match: z.ZodString;
-        class: z.ZodDefault<z.ZodEnum<["local", "cloud"]>>;
-        runtime: z.ZodDefault<z.ZodEnum<["ollama", "vllm", "lmstudio", "openai-compat", "unknown"]>>;
-    }, "strip", z.ZodTypeAny, {
-        match: string;
-        class: "local" | "cloud";
-        runtime: "ollama" | "vllm" | "lmstudio" | "openai-compat" | "unknown";
-    }, {
-        match: string;
-        class?: "local" | "cloud" | undefined;
-        runtime?: "ollama" | "vllm" | "lmstudio" | "openai-compat" | "unknown" | undefined;
-    }>, "many">>;
-    /** Local (zero-marginal-cost) settlement scope. */
-    local: z.ZodDefault<z.ZodObject<{
-        /** Loopback hosts (localhost/127.0.0.1/[::1]) classify as local without config. */
+        class: z.ZodDefault<z.ZodEnum<{
+            local: "local";
+            cloud: "cloud";
+        }>>;
+        runtime: z.ZodDefault<z.ZodEnum<{
+            ollama: "ollama";
+            vllm: "vllm";
+            lmstudio: "lmstudio";
+            "openai-compat": "openai-compat";
+            unknown: "unknown";
+        }>>;
+    }, z.core.$strip>>>;
+    local: z.ZodPrefault<z.ZodObject<{
         autoDetectLoopback: z.ZodDefault<z.ZodBoolean>;
-        /**
-         * Rate applied to any local-scope model with no local.models match. Default {0,0}:
-         * with the >=1 floor, every local call settles at exactly 1 nominal usertoken.
-         */
         defaultRate: z.ZodDefault<z.ZodObject<{
             inputPer1k: z.ZodNumber;
             outputPer1k: z.ZodNumber;
-        }, "strip", z.ZodTypeAny, {
-            inputPer1k: number;
-            outputPer1k: number;
-        }, {
-            inputPer1k: number;
-            outputPer1k: number;
+        }, z.core.$strip>>;
+        rateClass: z.ZodDefault<z.ZodEnum<{
+            nominal: "nominal";
+            "amortized-usd": "amortized-usd";
         }>>;
-        /**
-         * Denomination of local rates: "nominal" (bookkeeping units) or "amortized-usd"
-         * (operator's GPU-chargeback rate; 1 usertoken = $0.0001 as usual).
-         */
-        rateClass: z.ZodDefault<z.ZodEnum<["nominal", "amortized-usd"]>>;
-        /**
-         * Per-model local rates. Keys: exact model strings or trailing-* globs
-         * ("llama3.3*", "*"). Exact match beats glob; longest glob wins.
-         */
         models: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
             inputPer1k: z.ZodNumber;
             outputPer1k: z.ZodNumber;
-        }, "strip", z.ZodTypeAny, {
-            inputPer1k: number;
-            outputPer1k: number;
-        }, {
-            inputPer1k: number;
-            outputPer1k: number;
-        }>>>;
-        /** Inject stream_options:{include_usage:true} into local openai-kind streams. */
+        }, z.core.$strip>>>;
         injectUsageOptions: z.ZodDefault<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        models: Record<string, {
-            inputPer1k: number;
-            outputPer1k: number;
-        }>;
-        autoDetectLoopback: boolean;
-        defaultRate: {
-            inputPer1k: number;
-            outputPer1k: number;
-        };
-        rateClass: "nominal" | "amortized-usd";
-        injectUsageOptions: boolean;
-    }, {
-        models?: Record<string, {
-            inputPer1k: number;
-            outputPer1k: number;
-        }> | undefined;
-        autoDetectLoopback?: boolean | undefined;
-        defaultRate?: {
-            inputPer1k: number;
-            outputPer1k: number;
-        } | undefined;
-        rateClass?: "nominal" | "amortized-usd" | undefined;
-        injectUsageOptions?: boolean | undefined;
+    }, z.core.$strip>>;
+    unknownModelPolicy: z.ZodDefault<z.ZodEnum<{
+        fallback: "fallback";
+        warn: "warn";
+        deny: "deny";
     }>>;
-    /**
-     * Cloud-scope policy when a model misses customRates, PRICING_TABLE, and prefix match.
-     * "fallback" = silent sonnet-class rate (legacy) · "warn" = same rate + one-time warn +
-     * receipt.meter.rateSource "fallback" · "deny" = PolicyDeniedError before the PENDING hold.
-     */
-    unknownModelPolicy: z.ZodDefault<z.ZodEnum<["fallback", "warn", "deny"]>>;
-    supplyChain: z.ZodDefault<z.ZodObject<{
+    supplyChain: z.ZodPrefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
-        trustedPublishers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-        publisherKeys: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
-        allowedPermissions: z.ZodDefault<z.ZodArray<z.ZodEnum<["llm_call", "tool_use", "file_read", "file_write", "shell_command", "network_access", "credential_access"]>, "many">>;
+        trustedPublishers: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        publisherKeys: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+        allowedPermissions: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            llm_call: "llm_call";
+            tool_use: "tool_use";
+            shell_command: "shell_command";
+            file_read: "file_read";
+            file_write: "file_write";
+            network_access: "network_access";
+            credential_access: "credential_access";
+        }>>>;
         requireSignature: z.ZodDefault<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-        trustedPublishers: string[];
-        publisherKeys: Record<string, string[]>;
-        allowedPermissions: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[];
-        requireSignature: boolean;
-    }, {
-        enabled?: boolean | undefined;
-        trustedPublishers?: string[] | undefined;
-        publisherKeys?: Record<string, string[]> | undefined;
-        allowedPermissions?: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[] | undefined;
-        requireSignature?: boolean | undefined;
-    }>>;
-    vault: z.ZodDefault<z.ZodObject<{
+    }, z.core.$strip>>;
+    vault: z.ZodPrefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         masterKeyEnv: z.ZodDefault<z.ZodString>;
         auditAccess: z.ZodDefault<z.ZodBoolean>;
-        defaultScope: z.ZodDefault<z.ZodObject<{
-            agents: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-            actions: z.ZodDefault<z.ZodArray<z.ZodEnum<["llm_call", "tool_use", "file_access", "shell_command", "api_request"]>, "many">>;
+        defaultScope: z.ZodPrefault<z.ZodObject<{
+            agents: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            actions: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                llm_call: "llm_call";
+                tool_use: "tool_use";
+                file_access: "file_access";
+                shell_command: "shell_command";
+                api_request: "api_request";
+            }>>>;
             expiresAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-        }, "strip", z.ZodTypeAny, {
-            agents: string[];
-            actions: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[];
-            expiresAt: string | null;
-        }, {
-            agents?: string[] | undefined;
-            actions?: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[] | undefined;
-            expiresAt?: string | null | undefined;
-        }>>;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-        masterKeyEnv: string;
-        auditAccess: boolean;
-        defaultScope: {
-            agents: string[];
-            actions: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[];
-            expiresAt: string | null;
-        };
-    }, {
-        enabled?: boolean | undefined;
-        masterKeyEnv?: string | undefined;
-        auditAccess?: boolean | undefined;
-        defaultScope?: {
-            agents?: string[] | undefined;
-            actions?: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[] | undefined;
-            expiresAt?: string | null | undefined;
-        } | undefined;
-    }>>;
-    anomaly: z.ZodDefault<z.ZodObject<{
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    anomaly: z.ZodPrefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
-        tokenRate: z.ZodDefault<z.ZodObject<{
+        tokenRate: z.ZodPrefault<z.ZodObject<{
             thresholdTokPerSec: z.ZodDefault<z.ZodNumber>;
-            /** Local-scope threshold (fast local GPU inference legitimately exceeds 500). */
             localThresholdTokPerSec: z.ZodDefault<z.ZodNumber>;
-            /** Per-model threshold overrides. Keys: exact model or trailing-* glob. */
             perModel: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>;
             windowMs: z.ZodDefault<z.ZodNumber>;
             consecutiveWindows: z.ZodDefault<z.ZodNumber>;
-        }, "strip", z.ZodTypeAny, {
-            thresholdTokPerSec: number;
-            localThresholdTokPerSec: number;
-            perModel: Record<string, number>;
-            windowMs: number;
-            consecutiveWindows: number;
-        }, {
-            thresholdTokPerSec?: number | undefined;
-            localThresholdTokPerSec?: number | undefined;
-            perModel?: Record<string, number> | undefined;
-            windowMs?: number | undefined;
-            consecutiveWindows?: number | undefined;
-        }>>;
-        spendVelocity: z.ZodDefault<z.ZodObject<{
+        }, z.core.$strip>>;
+        spendVelocity: z.ZodPrefault<z.ZodObject<{
             thresholdDollarsPerMin: z.ZodDefault<z.ZodNumber>;
-            /** Local-scope velocity threshold in nominal usertokens per minute. */
             localThresholdUsertokensPerMin: z.ZodDefault<z.ZodNumber>;
             windowMs: z.ZodDefault<z.ZodNumber>;
-        }, "strip", z.ZodTypeAny, {
-            windowMs: number;
-            thresholdDollarsPerMin: number;
-            localThresholdUsertokensPerMin: number;
-        }, {
-            windowMs?: number | undefined;
-            thresholdDollarsPerMin?: number | undefined;
-            localThresholdUsertokensPerMin?: number | undefined;
-        }>>;
-        injectionCascade: z.ZodDefault<z.ZodObject<{
+        }, z.core.$strip>>;
+        injectionCascade: z.ZodPrefault<z.ZodObject<{
             eventCount: z.ZodDefault<z.ZodNumber>;
             windowMs: z.ZodDefault<z.ZodNumber>;
-        }, "strip", z.ZodTypeAny, {
-            windowMs: number;
-            eventCount: number;
-        }, {
-            windowMs?: number | undefined;
-            eventCount?: number | undefined;
-        }>>;
+        }, z.core.$strip>>;
         cooldownMs: z.ZodDefault<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        enabled: boolean;
-        tokenRate: {
-            thresholdTokPerSec: number;
-            localThresholdTokPerSec: number;
-            perModel: Record<string, number>;
-            windowMs: number;
-            consecutiveWindows: number;
-        };
-        spendVelocity: {
-            windowMs: number;
-            thresholdDollarsPerMin: number;
-            localThresholdUsertokensPerMin: number;
-        };
-        injectionCascade: {
-            windowMs: number;
-            eventCount: number;
-        };
-        cooldownMs: number;
-    }, {
-        enabled?: boolean | undefined;
-        tokenRate?: {
-            thresholdTokPerSec?: number | undefined;
-            localThresholdTokPerSec?: number | undefined;
-            perModel?: Record<string, number> | undefined;
-            windowMs?: number | undefined;
-            consecutiveWindows?: number | undefined;
-        } | undefined;
-        spendVelocity?: {
-            windowMs?: number | undefined;
-            thresholdDollarsPerMin?: number | undefined;
-            localThresholdUsertokensPerMin?: number | undefined;
-        } | undefined;
-        injectionCascade?: {
-            windowMs?: number | undefined;
-            eventCount?: number | undefined;
-        } | undefined;
-        cooldownMs?: number | undefined;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    audit: {
-        rotation: "daily" | "weekly" | "none";
-        indexLimit: number;
-        failClosed: boolean;
-    };
-    local: {
-        models: Record<string, {
-            inputPer1k: number;
-            outputPer1k: number;
-        }>;
-        autoDetectLoopback: boolean;
-        defaultRate: {
-            inputPer1k: number;
-            outputPer1k: number;
-        };
-        rateClass: "nominal" | "amortized-usd";
-        injectUsageOptions: boolean;
-    };
-    budget: number;
-    tier: "free" | "mini" | "pro" | "mega" | "ultra";
-    policies: string;
-    pii: "redact" | "warn" | "block" | "off";
-    injection: "warn" | "block" | "off";
-    board: {
-        enabled: boolean;
-        vetoThreshold: "low" | "medium" | "high" | "critical";
-    };
-    circuitBreaker: {
-        failureThreshold: number;
-        resetTimeout: number;
-    };
-    patterns: {
-        enabled: boolean;
-        feedProxy: boolean;
-    };
-    tigerbeetle: {
-        addresses: string[];
-        clusterId: number;
-    };
-    providers: {
-        name: string;
-        models: string[];
-    }[];
-    pricing: "custom" | "recommended";
-    endpoints: {
-        match: string;
-        class: "local" | "cloud";
-        runtime: "ollama" | "vllm" | "lmstudio" | "openai-compat" | "unknown";
-    }[];
-    unknownModelPolicy: "fallback" | "warn" | "deny";
-    supplyChain: {
-        enabled: boolean;
-        trustedPublishers: string[];
-        publisherKeys: Record<string, string[]>;
-        allowedPermissions: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[];
-        requireSignature: boolean;
-    };
-    vault: {
-        enabled: boolean;
-        masterKeyEnv: string;
-        auditAccess: boolean;
-        defaultScope: {
-            agents: string[];
-            actions: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[];
-            expiresAt: string | null;
-        };
-    };
-    anomaly: {
-        enabled: boolean;
-        tokenRate: {
-            thresholdTokPerSec: number;
-            localThresholdTokPerSec: number;
-            perModel: Record<string, number>;
-            windowMs: number;
-            consecutiveWindows: number;
-        };
-        spendVelocity: {
-            windowMs: number;
-            thresholdDollarsPerMin: number;
-            localThresholdUsertokensPerMin: number;
-        };
-        injectionCascade: {
-            windowMs: number;
-            eventCount: number;
-        };
-        cooldownMs: number;
-    };
-    proxy?: string | undefined;
-    key?: string | undefined;
-    customRates?: Record<string, {
-        inputPer1k: number;
-        outputPer1k: number;
-    }> | undefined;
-}, {
-    budget: number;
-    audit?: {
-        rotation?: "daily" | "weekly" | "none" | undefined;
-        indexLimit?: number | undefined;
-        failClosed?: boolean | undefined;
-    } | undefined;
-    local?: {
-        models?: Record<string, {
-            inputPer1k: number;
-            outputPer1k: number;
-        }> | undefined;
-        autoDetectLoopback?: boolean | undefined;
-        defaultRate?: {
-            inputPer1k: number;
-            outputPer1k: number;
-        } | undefined;
-        rateClass?: "nominal" | "amortized-usd" | undefined;
-        injectUsageOptions?: boolean | undefined;
-    } | undefined;
-    tier?: "free" | "mini" | "pro" | "mega" | "ultra" | undefined;
-    proxy?: string | undefined;
-    key?: string | undefined;
-    policies?: string | undefined;
-    pii?: "redact" | "warn" | "block" | "off" | undefined;
-    injection?: "warn" | "block" | "off" | undefined;
-    board?: {
-        enabled?: boolean | undefined;
-        vetoThreshold?: "low" | "medium" | "high" | "critical" | undefined;
-    } | undefined;
-    circuitBreaker?: {
-        failureThreshold?: number | undefined;
-        resetTimeout?: number | undefined;
-    } | undefined;
-    patterns?: {
-        enabled?: boolean | undefined;
-        feedProxy?: boolean | undefined;
-    } | undefined;
-    tigerbeetle?: {
-        addresses?: string[] | undefined;
-        clusterId?: number | undefined;
-    } | undefined;
-    providers?: {
-        name: string;
-        models?: string[] | undefined;
-    }[] | undefined;
-    pricing?: "custom" | "recommended" | undefined;
-    customRates?: Record<string, {
-        inputPer1k: number;
-        outputPer1k: number;
-    }> | undefined;
-    endpoints?: {
-        match: string;
-        class?: "local" | "cloud" | undefined;
-        runtime?: "ollama" | "vllm" | "lmstudio" | "openai-compat" | "unknown" | undefined;
-    }[] | undefined;
-    unknownModelPolicy?: "fallback" | "warn" | "deny" | undefined;
-    supplyChain?: {
-        enabled?: boolean | undefined;
-        trustedPublishers?: string[] | undefined;
-        publisherKeys?: Record<string, string[]> | undefined;
-        allowedPermissions?: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[] | undefined;
-        requireSignature?: boolean | undefined;
-    } | undefined;
-    vault?: {
-        enabled?: boolean | undefined;
-        masterKeyEnv?: string | undefined;
-        auditAccess?: boolean | undefined;
-        defaultScope?: {
-            agents?: string[] | undefined;
-            actions?: ("llm_call" | "tool_use" | "file_access" | "shell_command" | "api_request")[] | undefined;
-            expiresAt?: string | null | undefined;
-        } | undefined;
-    } | undefined;
-    anomaly?: {
-        enabled?: boolean | undefined;
-        tokenRate?: {
-            thresholdTokPerSec?: number | undefined;
-            localThresholdTokPerSec?: number | undefined;
-            perModel?: Record<string, number> | undefined;
-            windowMs?: number | undefined;
-            consecutiveWindows?: number | undefined;
-        } | undefined;
-        spendVelocity?: {
-            windowMs?: number | undefined;
-            thresholdDollarsPerMin?: number | undefined;
-            localThresholdUsertokensPerMin?: number | undefined;
-        } | undefined;
-        injectionCascade?: {
-            windowMs?: number | undefined;
-            eventCount?: number | undefined;
-        } | undefined;
-        cooldownMs?: number | undefined;
-    } | undefined;
-}>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type TrustConfig = z.infer<typeof TrustConfigSchema>;
 export type PolicyEffect = "deny" | "warn";
 export type PolicyEnforcement = "hard" | "soft";
@@ -664,32 +315,20 @@ export declare const SkillManifestSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;
     publisher: z.ZodString;
-    permissions: z.ZodArray<z.ZodEnum<["llm_call", "tool_use", "file_read", "file_write", "shell_command", "network_access", "credential_access"]>, "many">;
+    permissions: z.ZodArray<z.ZodEnum<{
+        llm_call: "llm_call";
+        tool_use: "tool_use";
+        shell_command: "shell_command";
+        file_read: "file_read";
+        file_write: "file_write";
+        network_access: "network_access";
+        credential_access: "credential_access";
+    }>>;
     entryHash: z.ZodString;
     signedAt: z.ZodString;
     signature: z.ZodString;
     publicKey: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    version: 1;
-    id: string;
-    publisher: string;
-    permissions: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[];
-    entryHash: string;
-    signedAt: string;
-    signature: string;
-    publicKey: string;
-}, {
-    name: string;
-    version: 1;
-    id: string;
-    publisher: string;
-    permissions: ("llm_call" | "tool_use" | "shell_command" | "file_read" | "file_write" | "network_access" | "credential_access")[];
-    entryHash: string;
-    signedAt: string;
-    signature: string;
-    publicKey: string;
-}>;
+}, z.core.$strip>;
 /** Scope constraining when/how a credential can be accessed. */
 export interface CredentialScope {
     /** Agents allowed to access this credential (empty = all). */