@skillsregistry/contracts 1.0.1 → 2.0.0

package/dist/upstream.d.ts

@@ -1,4 +1,93 @@
 import { z } from 'zod';
+/**
+ * Risk appetite. Domain layer maps to a numeric trust threshold + an
+ * allowVulnerable flag; when the caller sets `minTrust` / `allowVulnerable`
+ * explicitly, those override the appetite-derived values.
+ */
+export declare const AppetiteSchema: z.ZodEnum<["strict", "cautious", "balanced", "adventurous"]>;
+export type Appetite = z.infer<typeof AppetiteSchema>;
+/**
+ * Visibility bands per cortex.md §16.6. Four-band tenant-scope model
+ * (schema migration 0035). `private` is a legacy alias kept for pre-v6.3
+ * consumers — new writes should prefer `tenant_private`.
+ *
+ * Enum *values* stay snake_case: they are stored as-is in the Postgres
+ * `chk_visibility` CHECK constraint (`@skillsregistry/schema`), so the wire
+ * value must match the column value. Only *field names* were flipped to
+ * camelCase in v2.0.0.
+ */
+export declare const SkillVisibilitySchema: z.ZodEnum<["public", "private", "tenant_private", "tenant_internal", "unlisted"]>;
+export type SkillVisibility = z.infer<typeof SkillVisibilitySchema>;
+/**
+ * Search request per cortex.md §6.2:
+ *
+ *   POST /v1/search  { query, appetite, minTrust, allowVulnerable, tenantId, limit }
+ *
+ * Fields beyond the cortex minimum (`tags`, `category`, `runtimeEnv`,
+ * `visibility`, `portable`) are the local node's search superset — the
+ * mothership treats them as optional filters when set.
+ *
+ * **v2.0.0 (MAJOR).** Field names flipped snake_case → camelCase to match
+ * every current caller (mothership inline schema at `src/routes/search.ts`,
+ * Cortex `SkillsRegistryClient.findSkill()`, local-node route surface). The
+ * v1.x snake_case shape caught no real consumers — 100% of live wire traffic
+ * was already camelCase, so the shared contract was inert. Aligning the
+ * contract to observed reality eliminates the silent-drop risk documented as
+ * X6 in the mothership repo's CLAUDE.md sibling-spec drift log (2026-07-15).
+ * Consumers that spelled the snake form must switch to camelCase in the same
+ * bump.
+ */
+export declare const SearchRequestSchema: z.ZodObject<{
+    /** Free-text query. Required, non-empty. */
+    query: z.ZodString;
+    /** Advisory tenant scope. */
+    tenantId: z.ZodOptional<z.ZodString>;
+    /** Risk appetite → default trust floor + allowVulnerable default. */
+    appetite: z.ZodOptional<z.ZodEnum<["strict", "cautious", "balanced", "adventurous"]>>;
+    /**
+     * Hard trust-score floor (0..1). Overrides `appetite` when set.
+     * Cortex sends this to gate before the confidence tier is even assessed.
+     */
+    minTrust: z.ZodOptional<z.ZodNumber>;
+    /**
+     * Allow skills tagged vulnerable / contains-vulnerable through the filter.
+     * Overrides the appetite-derived default when set.
+     */
+    allowVulnerable: z.ZodOptional<z.ZodBoolean>;
+    /** Result cap (1..50). Default 10 at the domain layer. */
+    limit: z.ZodOptional<z.ZodNumber>;
+    /** Local-superset filters — mothership treats as optional. */
+    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    category: z.ZodOptional<z.ZodString>;
+    runtimeEnv: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    visibility: z.ZodOptional<z.ZodEnum<["public", "private", "tenant_private", "tenant_internal", "unlisted"]>>;
+    portable: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    query: string;
+    limit?: number | undefined;
+    tags?: string[] | undefined;
+    category?: string | undefined;
+    runtimeEnv?: string[] | undefined;
+    visibility?: "public" | "private" | "tenant_private" | "tenant_internal" | "unlisted" | undefined;
+    tenantId?: string | undefined;
+    portable?: boolean | undefined;
+    appetite?: "strict" | "cautious" | "balanced" | "adventurous" | undefined;
+    minTrust?: number | undefined;
+    allowVulnerable?: boolean | undefined;
+}, {
+    query: string;
+    limit?: number | undefined;
+    tags?: string[] | undefined;
+    category?: string | undefined;
+    runtimeEnv?: string[] | undefined;
+    visibility?: "public" | "private" | "tenant_private" | "tenant_internal" | "unlisted" | undefined;
+    tenantId?: string | undefined;
+    portable?: boolean | undefined;
+    appetite?: "strict" | "cautious" | "balanced" | "adventurous" | undefined;
+    minTrust?: number | undefined;
+    allowVulnerable?: boolean | undefined;
+}>;
+export type SearchRequest = z.infer<typeof SearchRequestSchema>;
 export declare const TrustScoreRequestSchema: z.ZodObject<{
     /** Skill identifier — either the mothership UUID or the local node's slug. */
     skill_id: z.ZodString;
@@ -13,14 +102,14 @@ export declare const TrustScoreRequestSchema: z.ZodObject<{
         description: z.ZodOptional<z.ZodString>;
         skill_md: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        version: string;
         name: string;
+        version: string;
         source: string;
         description?: string | undefined;
         skill_md?: string | undefined;
     }, {
-        version: string;
         name: string;
+        version: string;
         source: string;
         description?: string | undefined;
         skill_md?: string | undefined;
@@ -30,8 +119,8 @@ export declare const TrustScoreRequestSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     skill_id: string;
     manifest?: {
-        version: string;
         name: string;
+        version: string;
         source: string;
         description?: string | undefined;
         skill_md?: string | undefined;
@@ -40,8 +129,8 @@ export declare const TrustScoreRequestSchema: z.ZodObject<{
 }, {
     skill_id: string;
     manifest?: {
-        version: string;
         name: string;
+        version: string;
         source: string;
         description?: string | undefined;
         skill_md?: string | undefined;
@@ -97,6 +186,91 @@ export declare const BudgetResponseSchema: z.ZodObject<{
     low_balance: boolean;
 }>;
 export type BudgetResponse = z.infer<typeof BudgetResponseSchema>;
+/**
+ * Sandbox contract per `skill-convention.md` v1.3 §9. The runtime (Cortex L3,
+ * on any Sandbox-seam adapter — Daytona / Novita / E2B) reads these fields
+ * verbatim to provision the execution environment. Applies to any skill with
+ * a sandbox surface (`runtime_env` ∈ {vm, agent} today; `api` may declare
+ * one if it spawns a subprocess).
+ *
+ * `image` is the OCI ref — the portability anchor (§9.1). The image family
+ * (`skill-base`, `skill-java`, `cognium-scan-base`, `agent-base`) is derived
+ * by prefix-matching the ref; not enforced here so the Lane 0 rollout can
+ * ship unbuilt images without tripping ingest.
+ *
+ * `egress` is a default-deny allow-list of hostnames (§9.3). Every host the
+ * skill contacts — clone targets, package mirrors, MCP endpoints — must be
+ * listed or the sandbox will block the connection.
+ *
+ * `profile: 'agent'` + `budget_caps` are the agent-runtime extension
+ * (§14.2). `budget_caps` are hard caps enforced in-band by the agent skill's
+ * wrapper script through llmproxy session metering — the caller cannot rely
+ * on Cortex enforcing them at the outer boundary.
+ */
+export declare const SkillSandboxSchema: z.ZodObject<{
+    /** OCI ref, e.g. `ghcr.io/cognium-labs/skill-base:1.0.0`. */
+    image: z.ZodString;
+    /** Memory allocation in MB. Base default 512 (vm) / 2048 (agent). */
+    memory_mb: z.ZodNumber;
+    /** vCPU count. Base default 2 (vm) / 4 (agent). */
+    cpu: z.ZodNumber;
+    /** Wall-clock ceiling in seconds. Base default 300 (vm) / 7200 (agent). */
+    timeout_seconds: z.ZodNumber;
+    /**
+     * Default-deny egress allow-list of hostnames. Empty array = no outbound
+     * network from the sandbox. Wildcards are NOT interpreted here — the
+     * runtime treats each entry as an exact host match.
+     */
+    egress: z.ZodArray<z.ZodString, "many">;
+    /** Present when `runtime_env: agent`. Signals the agent-runtime shape. */
+    profile: z.ZodOptional<z.ZodLiteral<"agent">>;
+    /**
+     * Agent-only hard caps. Enforced in-band by the wrapper script via
+     * llmproxy metering (Cortex only enforces the outer wall-clock via
+     * provider timeout).
+     */
+    budget_caps: z.ZodOptional<z.ZodObject<{
+        /** Max spend in USD across all LLM calls this run. */
+        max_tokens_usd: z.ZodOptional<z.ZodNumber>;
+        /** Max sub-tool invocations from inside the agent sandbox. */
+        max_internal_tool_calls: z.ZodOptional<z.ZodNumber>;
+        /** Wall-clock ceiling; usually mirrors top-level `timeout_seconds`. */
+        max_wall_seconds: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        max_tokens_usd?: number | undefined;
+        max_internal_tool_calls?: number | undefined;
+        max_wall_seconds?: number | undefined;
+    }, {
+        max_tokens_usd?: number | undefined;
+        max_internal_tool_calls?: number | undefined;
+        max_wall_seconds?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    image: string;
+    memory_mb: number;
+    cpu: number;
+    timeout_seconds: number;
+    egress: string[];
+    profile?: "agent" | undefined;
+    budget_caps?: {
+        max_tokens_usd?: number | undefined;
+        max_internal_tool_calls?: number | undefined;
+        max_wall_seconds?: number | undefined;
+    } | undefined;
+}, {
+    image: string;
+    memory_mb: number;
+    cpu: number;
+    timeout_seconds: number;
+    egress: string[];
+    profile?: "agent" | undefined;
+    budget_caps?: {
+        max_tokens_usd?: number | undefined;
+        max_internal_tool_calls?: number | undefined;
+        max_wall_seconds?: number | undefined;
+    } | undefined;
+}>;
+export type SkillSandbox = z.infer<typeof SkillSandboxSchema>;
 export declare const PublishRequestSchema: z.ZodObject<{
     /** Skill manifest to promote from local to global registry. */
     manifest: z.ZodObject<{
@@ -115,10 +289,79 @@ export declare const PublishRequestSchema: z.ZodObject<{
         source_url: z.ZodOptional<z.ZodString>;
         repository_url: z.ZodOptional<z.ZodString>;
         mcp_url: z.ZodOptional<z.ZodString>;
+        /**
+         * Sandbox contract per skill-convention v1.3 §9. Required in practice
+         * for runtime_env ∈ {vm, agent} (Cortex L3 dispatch reads it directly);
+         * kept optional at the schema level so pre-v1.3 rows / api+llm skills
+         * don't need to carry it.
+         */
+        sandbox: z.ZodOptional<z.ZodObject<{
+            /** OCI ref, e.g. `ghcr.io/cognium-labs/skill-base:1.0.0`. */
+            image: z.ZodString;
+            /** Memory allocation in MB. Base default 512 (vm) / 2048 (agent). */
+            memory_mb: z.ZodNumber;
+            /** vCPU count. Base default 2 (vm) / 4 (agent). */
+            cpu: z.ZodNumber;
+            /** Wall-clock ceiling in seconds. Base default 300 (vm) / 7200 (agent). */
+            timeout_seconds: z.ZodNumber;
+            /**
+             * Default-deny egress allow-list of hostnames. Empty array = no outbound
+             * network from the sandbox. Wildcards are NOT interpreted here — the
+             * runtime treats each entry as an exact host match.
+             */
+            egress: z.ZodArray<z.ZodString, "many">;
+            /** Present when `runtime_env: agent`. Signals the agent-runtime shape. */
+            profile: z.ZodOptional<z.ZodLiteral<"agent">>;
+            /**
+             * Agent-only hard caps. Enforced in-band by the wrapper script via
+             * llmproxy metering (Cortex only enforces the outer wall-clock via
+             * provider timeout).
+             */
+            budget_caps: z.ZodOptional<z.ZodObject<{
+                /** Max spend in USD across all LLM calls this run. */
+                max_tokens_usd: z.ZodOptional<z.ZodNumber>;
+                /** Max sub-tool invocations from inside the agent sandbox. */
+                max_internal_tool_calls: z.ZodOptional<z.ZodNumber>;
+                /** Wall-clock ceiling; usually mirrors top-level `timeout_seconds`. */
+                max_wall_seconds: z.ZodOptional<z.ZodNumber>;
+            }, "strip", z.ZodTypeAny, {
+                max_tokens_usd?: number | undefined;
+                max_internal_tool_calls?: number | undefined;
+                max_wall_seconds?: number | undefined;
+            }, {
+                max_tokens_usd?: number | undefined;
+                max_internal_tool_calls?: number | undefined;
+                max_wall_seconds?: number | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            image: string;
+            memory_mb: number;
+            cpu: number;
+            timeout_seconds: number;
+            egress: string[];
+            profile?: "agent" | undefined;
+            budget_caps?: {
+                max_tokens_usd?: number | undefined;
+                max_internal_tool_calls?: number | undefined;
+                max_wall_seconds?: number | undefined;
+            } | undefined;
+        }, {
+            image: string;
+            memory_mb: number;
+            cpu: number;
+            timeout_seconds: number;
+            egress: string[];
+            profile?: "agent" | undefined;
+            budget_caps?: {
+                max_tokens_usd?: number | undefined;
+                max_internal_tool_calls?: number | undefined;
+                max_wall_seconds?: number | undefined;
+            } | undefined;
+        }>>;
     }, "strip", z.ZodTypeAny, {
-        version: string;
         name: string;
         slug: string;
+        version: string;
         source: string;
         execution_layer: string;
         description?: string | undefined;
@@ -131,10 +374,23 @@ export declare const PublishRequestSchema: z.ZodObject<{
         source_url?: string | undefined;
         repository_url?: string | undefined;
         mcp_url?: string | undefined;
+        sandbox?: {
+            image: string;
+            memory_mb: number;
+            cpu: number;
+            timeout_seconds: number;
+            egress: string[];
+            profile?: "agent" | undefined;
+            budget_caps?: {
+                max_tokens_usd?: number | undefined;
+                max_internal_tool_calls?: number | undefined;
+                max_wall_seconds?: number | undefined;
+            } | undefined;
+        } | undefined;
     }, {
-        version: string;
         name: string;
         slug: string;
+        version: string;
         source: string;
         execution_layer: string;
         description?: string | undefined;
@@ -147,6 +403,19 @@ export declare const PublishRequestSchema: z.ZodObject<{
         source_url?: string | undefined;
         repository_url?: string | undefined;
         mcp_url?: string | undefined;
+        sandbox?: {
+            image: string;
+            memory_mb: number;
+            cpu: number;
+            timeout_seconds: number;
+            egress: string[];
+            profile?: "agent" | undefined;
+            budget_caps?: {
+                max_tokens_usd?: number | undefined;
+                max_internal_tool_calls?: number | undefined;
+                max_wall_seconds?: number | undefined;
+            } | undefined;
+        } | undefined;
     }>;
     /** Publisher key ID that signs the manifest. Required for A/B tier. */
     publisher_key_id: z.ZodOptional<z.ZodString>;
@@ -154,9 +423,9 @@ export declare const PublishRequestSchema: z.ZodObject<{
     signature: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     manifest: {
-        version: string;
         name: string;
         slug: string;
+        version: string;
         source: string;
         execution_layer: string;
         description?: string | undefined;
@@ -169,14 +438,27 @@ export declare const PublishRequestSchema: z.ZodObject<{
         source_url?: string | undefined;
         repository_url?: string | undefined;
         mcp_url?: string | undefined;
+        sandbox?: {
+            image: string;
+            memory_mb: number;
+            cpu: number;
+            timeout_seconds: number;
+            egress: string[];
+            profile?: "agent" | undefined;
+            budget_caps?: {
+                max_tokens_usd?: number | undefined;
+                max_internal_tool_calls?: number | undefined;
+                max_wall_seconds?: number | undefined;
+            } | undefined;
+        } | undefined;
     };
     publisher_key_id?: string | undefined;
     signature?: string | undefined;
 }, {
     manifest: {
-        version: string;
         name: string;
         slug: string;
+        version: string;
         source: string;
         execution_layer: string;
         description?: string | undefined;
@@ -189,6 +471,19 @@ export declare const PublishRequestSchema: z.ZodObject<{
         source_url?: string | undefined;
         repository_url?: string | undefined;
         mcp_url?: string | undefined;
+        sandbox?: {
+            image: string;
+            memory_mb: number;
+            cpu: number;
+            timeout_seconds: number;
+            egress: string[];
+            profile?: "agent" | undefined;
+            budget_caps?: {
+                max_tokens_usd?: number | undefined;
+                max_internal_tool_calls?: number | undefined;
+                max_wall_seconds?: number | undefined;
+            } | undefined;
+        } | undefined;
     };
     publisher_key_id?: string | undefined;
     signature?: string | undefined;
@@ -204,15 +499,15 @@ export declare const PublishResponseSchema: z.ZodObject<{
     url: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     status: "published" | "pending_review" | "rejected";
-    version: string;
     slug: string;
+    version: string;
     skill_id: string;
     published_at: string;
     url: string;
 }, {
     status: "published" | "pending_review" | "rejected";
-    version: string;
     slug: string;
+    version: string;
     skill_id: string;
     published_at: string;
     url: string;
@@ -283,6 +578,161 @@ export declare const TrustScoreSyncResponseSchema: z.ZodObject<{
     }[];
     next_cursor?: string | undefined;
 }>;
+export declare const SkillRevocationReasonSchema: z.ZodEnum<["security", "compliance", "policy", "quality", "author_request", "superseded", "unknown"]>;
+export type SkillRevocationReason = z.infer<typeof SkillRevocationReasonSchema>;
+export declare const SkillRevocationEventTypeSchema: z.ZodEnum<["skill.revoked", "skill.deprecated"]>;
+export type SkillRevocationEventType = z.infer<typeof SkillRevocationEventTypeSchema>;
+/**
+ * Single revocation / deprecation event. `event_id` is the idempotency key —
+ * consumers store the last-seen id per source to dedupe replays.
+ */
+export declare const SkillRevocationEventSchema: z.ZodObject<{
+    /** Idempotency key. Consumer dedupes on (source, event_id). */
+    event_id: z.ZodString;
+    event_type: z.ZodEnum<["skill.revoked", "skill.deprecated"]>;
+    emitted_at: z.ZodString;
+    /** Mothership skill UUID. */
+    skill_id: z.ZodString;
+    /** Human-readable identifier — helpful in webhook logs. */
+    slug: z.ZodString;
+    /** Pinned version at the time of revocation (if the whole line was pulled). */
+    version: z.ZodOptional<z.ZodString>;
+    reason: z.ZodEnum<["security", "compliance", "policy", "quality", "author_request", "superseded", "unknown"]>;
+    /** Free-form operator-visible detail — never rendered to end users unsanitized. */
+    reason_detail: z.ZodOptional<z.ZodString>;
+    /** Actionable message consumers can show in remediation UI. */
+    remediation_message: z.ZodOptional<z.ZodString>;
+    remediation_url: z.ZodOptional<z.ZodString>;
+    /** Mothership UUID of the replacement skill, if any. */
+    replacement_skill_id: z.ZodOptional<z.ZodString>;
+    /** Slug of the replacement skill (redundant with id — safer for humans). */
+    replacement_slug: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    slug: string;
+    skill_id: string;
+    event_id: string;
+    event_type: "skill.revoked" | "skill.deprecated";
+    emitted_at: string;
+    reason: "unknown" | "security" | "compliance" | "policy" | "quality" | "author_request" | "superseded";
+    version?: string | undefined;
+    reason_detail?: string | undefined;
+    remediation_message?: string | undefined;
+    remediation_url?: string | undefined;
+    replacement_skill_id?: string | undefined;
+    replacement_slug?: string | undefined;
+}, {
+    slug: string;
+    skill_id: string;
+    event_id: string;
+    event_type: "skill.revoked" | "skill.deprecated";
+    emitted_at: string;
+    reason: "unknown" | "security" | "compliance" | "policy" | "quality" | "author_request" | "superseded";
+    version?: string | undefined;
+    reason_detail?: string | undefined;
+    remediation_message?: string | undefined;
+    remediation_url?: string | undefined;
+    replacement_skill_id?: string | undefined;
+    replacement_slug?: string | undefined;
+}>;
+export type SkillRevocationEvent = z.infer<typeof SkillRevocationEventSchema>;
+/**
+ * Response for `GET /v1/sync/revocations?since=<ISO>`. Mirrors the shape of
+ * `TrustScoreSyncResponse` so consumers can share a delta-pull scaffold.
+ */
+export declare const SkillRevocationSyncResponseSchema: z.ZodObject<{
+    since: z.ZodString;
+    until: z.ZodString;
+    count: z.ZodNumber;
+    events: z.ZodArray<z.ZodObject<{
+        /** Idempotency key. Consumer dedupes on (source, event_id). */
+        event_id: z.ZodString;
+        event_type: z.ZodEnum<["skill.revoked", "skill.deprecated"]>;
+        emitted_at: z.ZodString;
+        /** Mothership skill UUID. */
+        skill_id: z.ZodString;
+        /** Human-readable identifier — helpful in webhook logs. */
+        slug: z.ZodString;
+        /** Pinned version at the time of revocation (if the whole line was pulled). */
+        version: z.ZodOptional<z.ZodString>;
+        reason: z.ZodEnum<["security", "compliance", "policy", "quality", "author_request", "superseded", "unknown"]>;
+        /** Free-form operator-visible detail — never rendered to end users unsanitized. */
+        reason_detail: z.ZodOptional<z.ZodString>;
+        /** Actionable message consumers can show in remediation UI. */
+        remediation_message: z.ZodOptional<z.ZodString>;
+        remediation_url: z.ZodOptional<z.ZodString>;
+        /** Mothership UUID of the replacement skill, if any. */
+        replacement_skill_id: z.ZodOptional<z.ZodString>;
+        /** Slug of the replacement skill (redundant with id — safer for humans). */
+        replacement_slug: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        slug: string;
+        skill_id: string;
+        event_id: string;
+        event_type: "skill.revoked" | "skill.deprecated";
+        emitted_at: string;
+        reason: "unknown" | "security" | "compliance" | "policy" | "quality" | "author_request" | "superseded";
+        version?: string | undefined;
+        reason_detail?: string | undefined;
+        remediation_message?: string | undefined;
+        remediation_url?: string | undefined;
+        replacement_skill_id?: string | undefined;
+        replacement_slug?: string | undefined;
+    }, {
+        slug: string;
+        skill_id: string;
+        event_id: string;
+        event_type: "skill.revoked" | "skill.deprecated";
+        emitted_at: string;
+        reason: "unknown" | "security" | "compliance" | "policy" | "quality" | "author_request" | "superseded";
+        version?: string | undefined;
+        reason_detail?: string | undefined;
+        remediation_message?: string | undefined;
+        remediation_url?: string | undefined;
+        replacement_skill_id?: string | undefined;
+        replacement_slug?: string | undefined;
+    }>, "many">;
+    /** Cursor for pagination. When present, re-request with `since=<next_cursor>`. */
+    next_cursor: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    count: number;
+    since: string;
+    until: string;
+    events: {
+        slug: string;
+        skill_id: string;
+        event_id: string;
+        event_type: "skill.revoked" | "skill.deprecated";
+        emitted_at: string;
+        reason: "unknown" | "security" | "compliance" | "policy" | "quality" | "author_request" | "superseded";
+        version?: string | undefined;
+        reason_detail?: string | undefined;
+        remediation_message?: string | undefined;
+        remediation_url?: string | undefined;
+        replacement_skill_id?: string | undefined;
+        replacement_slug?: string | undefined;
+    }[];
+    next_cursor?: string | undefined;
+}, {
+    count: number;
+    since: string;
+    until: string;
+    events: {
+        slug: string;
+        skill_id: string;
+        event_id: string;
+        event_type: "skill.revoked" | "skill.deprecated";
+        emitted_at: string;
+        reason: "unknown" | "security" | "compliance" | "policy" | "quality" | "author_request" | "superseded";
+        version?: string | undefined;
+        reason_detail?: string | undefined;
+        remediation_message?: string | undefined;
+        remediation_url?: string | undefined;
+        replacement_skill_id?: string | undefined;
+        replacement_slug?: string | undefined;
+    }[];
+    next_cursor?: string | undefined;
+}>;
+export type SkillRevocationSyncResponse = z.infer<typeof SkillRevocationSyncResponseSchema>;
 export type TrustScoreSyncResponse = z.infer<typeof TrustScoreSyncResponseSchema>;
 /**
  * Every upstream failure maps to one of these codes. Consumers can pattern-
@@ -301,23 +751,29 @@ export type TrustScoreSyncResponse = z.infer<typeof TrustScoreSyncResponseSchema
  * - `bad_request`              — schema validation failed at mothership.
  * - `upstream_unavailable`     — network / 5xx / circuit-breaker open.
  * - `upstream_timeout`         — request exceeded configured timeout.
+ * - `sandbox_contract_violated` — L3 sandbox exited with code 90
+ *                                (skill-convention §9.2) — wrong image /
+ *                                wrong provider default / preflight failed
+ *                                (`git`/`bash`/`ca-certificates` missing).
+ *                                Distinct from generic exec failure so
+ *                                operators see a named actionable cause.
  */
-export type UpstreamErrorCode = 'upstream_not_configured' | 'budget_exhausted' | 'unauthenticated' | 'forbidden' | 'not_found' | 'rate_limited' | 'bad_request' | 'upstream_unavailable' | 'upstream_timeout';
+export type UpstreamErrorCode = 'upstream_not_configured' | 'budget_exhausted' | 'unauthenticated' | 'forbidden' | 'not_found' | 'rate_limited' | 'bad_request' | 'upstream_unavailable' | 'upstream_timeout' | 'sandbox_contract_violated';
 export declare const UpstreamErrorSchema: z.ZodObject<{
     error: z.ZodObject<{
-        code: z.ZodEnum<["upstream_not_configured", "budget_exhausted", "unauthenticated", "forbidden", "not_found", "rate_limited", "bad_request", "upstream_unavailable", "upstream_timeout"]>;
+        code: z.ZodEnum<["upstream_not_configured", "budget_exhausted", "unauthenticated", "forbidden", "not_found", "rate_limited", "bad_request", "upstream_unavailable", "upstream_timeout", "sandbox_contract_violated"]>;
         message: z.ZodString;
         /** Seconds until the caller may safely retry. Absent for permanent errors. */
         retry_after: z.ZodOptional<z.ZodNumber>;
         /** Optional structured detail (upstream field errors, etc.). */
         detail: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, "strip", z.ZodTypeAny, {
-        code: "upstream_not_configured" | "budget_exhausted" | "unauthenticated" | "forbidden" | "not_found" | "rate_limited" | "bad_request" | "upstream_unavailable" | "upstream_timeout";
+        code: "upstream_not_configured" | "budget_exhausted" | "unauthenticated" | "forbidden" | "not_found" | "rate_limited" | "bad_request" | "upstream_unavailable" | "upstream_timeout" | "sandbox_contract_violated";
         message: string;
         retry_after?: number | undefined;
         detail?: Record<string, unknown> | undefined;
     }, {
-        code: "upstream_not_configured" | "budget_exhausted" | "unauthenticated" | "forbidden" | "not_found" | "rate_limited" | "bad_request" | "upstream_unavailable" | "upstream_timeout";
+        code: "upstream_not_configured" | "budget_exhausted" | "unauthenticated" | "forbidden" | "not_found" | "rate_limited" | "bad_request" | "upstream_unavailable" | "upstream_timeout" | "sandbox_contract_violated";
         message: string;
         retry_after?: number | undefined;
         detail?: Record<string, unknown> | undefined;
@@ -326,7 +782,7 @@ export declare const UpstreamErrorSchema: z.ZodObject<{
     request_id: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     error: {
-        code: "upstream_not_configured" | "budget_exhausted" | "unauthenticated" | "forbidden" | "not_found" | "rate_limited" | "bad_request" | "upstream_unavailable" | "upstream_timeout";
+        code: "upstream_not_configured" | "budget_exhausted" | "unauthenticated" | "forbidden" | "not_found" | "rate_limited" | "bad_request" | "upstream_unavailable" | "upstream_timeout" | "sandbox_contract_violated";
         message: string;
         retry_after?: number | undefined;
         detail?: Record<string, unknown> | undefined;
@@ -334,7 +790,7 @@ export declare const UpstreamErrorSchema: z.ZodObject<{
     request_id?: string | undefined;
 }, {
     error: {
-        code: "upstream_not_configured" | "budget_exhausted" | "unauthenticated" | "forbidden" | "not_found" | "rate_limited" | "bad_request" | "upstream_unavailable" | "upstream_timeout";
+        code: "upstream_not_configured" | "budget_exhausted" | "unauthenticated" | "forbidden" | "not_found" | "rate_limited" | "bad_request" | "upstream_unavailable" | "upstream_timeout" | "sandbox_contract_violated";
         message: string;
         retry_after?: number | undefined;
         detail?: Record<string, unknown> | undefined;

package/dist/upstream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstream.d.ts","sourceRoot":"","sources":["../src/upstream.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,uBAAuB;IAClC,8EAA8E;;IAE9E;;;OAGG;;;;;;;;;;;;;;;;;;;;IAUH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;EAE1E,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;IAMnC,uEAAuE;;;;;;;;;;;;;;;;EAEvE,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,eAAO,MAAM,oBAAoB;;;;;;IAM/B,mEAAmE;;;;;;;;;;;;;;;;EAEnE,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE,eAAO,MAAM,oBAAoB;IAC/B,+DAA+D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAkB/D,uEAAuE;;IAEvE,4DAA4D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE5D,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;IAMhC,0CAA0C;;;;;;;;;;;;;;;;EAE1C,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;EAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;IAKvC;;;OAGG;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAMF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,iBAAiB,GACzB,yBAAyB,GACzB,kBAAkB,GAClB,iBAAiB,GACjB,WAAW,GACX,WAAW,GACX,cAAc,GACd,aAAa,GACb,sBAAsB,GACtB,kBAAkB,CAAC;AAEvB,eAAO,MAAM,mBAAmB;;;;QAc5B,8EAA8E;;QAE9E,gEAAgE;;;;;;;;;;;;;IAGlE,6DAA6D;;;;;;;;;;;;;;;;;;EAE7D,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"upstream.d.ts","sourceRoot":"","sources":["../src/upstream.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;GAIG;AACH,eAAO,MAAM,cAAc,8DAKzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,mFAMhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB;IAC9B,4CAA4C;;IAE5C,6BAA6B;;IAE7B,qEAAqE;;IAErE;;;OAGG;;IAEH;;;OAGG;;IAEH,0DAA0D;;IAE1D,8DAA8D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM9D,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAMhE,eAAO,MAAM,uBAAuB;IAClC,8EAA8E;;IAE9E;;;OAGG;;;;;;;;;;;;;;;;;;;;IAUH,0EAA0E;;;;;;;;;;;;;;;;;;;;;;EAE1E,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,wBAAwB;;;;;;IAMnC,uEAAuE;;;;;;;;;;;;;;;;EAEvE,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,eAAO,MAAM,oBAAoB;;;;;;IAM/B,mEAAmE;;;;;;;;;;;;;;;;EAEnE,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAMlE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,kBAAkB;IAC7B,6DAA6D;;IAE7D,qEAAqE;;IAErE,mDAAmD;;IAEnD,2EAA2E;;IAE3E;;;;OAIG;;IAEH,0EAA0E;;IAE1E;;;;OAIG;;QAGC,sDAAsD;;QAEtD,8DAA8D;;QAE9D,uEAAuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI3E,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,oBAAoB;IAC/B,+DAA+D;;;;;;;;;;;;;;;;;QAiB7D;;;;;WAKG;;YAzDL,6DAA6D;;YAE7D,qEAAqE;;YAErE,mDAAmD;;YAEnD,2EAA2E;;YAE3E;;;;eAIG;;YAEH,0EAA0E;;YAE1E;;;;eAIG;;gBAGC,sDAAsD;;gBAEtD,8DAA8D;;gBAE9D,uEAAuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAiC3E,uEAAuE;;IAEvE,4DAA4D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE5D,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;IAMhC,0CAA0C;;;;;;;;;;;;;;;;EAE1C,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAMpE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;EAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;IAKvC;;;OAGG;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAC;AAcH,eAAO,MAAM,2BAA2B,uGAQtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF,eAAO,MAAM,8BAA8B,kDAGzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,0BAA0B;IACrC,+DAA+D;;;;IAI/D,6BAA6B;;IAE7B,2DAA2D;;IAE3D,+EAA+E;;;IAG/E,mFAAmF;;IAEnF,+DAA+D;;;IAG/D,wDAAwD;;IAExD,4EAA4E;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAE5E,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;;;;QA3B5C,+DAA+D;;;;QAI/D,6BAA6B;;QAE7B,2DAA2D;;QAE3D,+EAA+E;;;QAG/E,mFAAmF;;QAEnF,+DAA+D;;;QAG/D,wDAAwD;;QAExD,4EAA4E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAc5E,kFAAkF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAElF,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAC/C,OAAO,iCAAiC,CACzC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAMF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,iBAAiB,GACzB,yBAAyB,GACzB,kBAAkB,GAClB,iBAAiB,GACjB,WAAW,GACX,WAAW,GACX,cAAc,GACd,aAAa,GACb,sBAAsB,GACtB,kBAAkB,GAClB,2BAA2B,CAAC;AAEhC,eAAO,MAAM,mBAAmB;;;;QAe5B,8EAA8E;;QAE9E,gEAAgE;;;;;;;;;;;;;IAGlE,6DAA6D;;;;;;;;;;;;;;;;;;EAE7D,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}