@vauban-org/agent-sdk 0.16.0

package/dist/skills/cboe-vix-spot.js

@@ -0,0 +1,70 @@
+/**
+ * cboe_vix_spot — CBOE delayed VIX quote with 15min cache.
+ *
+ * V5 piège 4: NOT Yahoo Finance. CBOE delayed quote is the canonical source.
+ * Cache stub uses an in-process Map; host can override via SkillContext.cache.
+ *
+ * @public
+ */
+import { z } from "zod";
+import { SkillExecutionError } from "./errors.js";
+import { withSkillSpan } from "./_otel.js";
+const inputSchema = z.object({}).strict();
+const PROCESS_CACHE = new Map();
+const CACHE_KEY = "vix-spot";
+const CACHE_TTL_MS = 15 * 60 * 1000;
+export const cboeVixSpot = {
+    name: "cboe_vix_spot",
+    inputSchema,
+    async execute(input, ctx) {
+        if (ctx.isReplay) {
+            const mock = ctx.dryRunMocks["cboe_vix_spot"];
+            if (mock)
+                return mock(input);
+            return {
+                symbol: "VIX",
+                last: 0,
+                delayed_minutes: 15,
+                fetched_at: new Date(0).toISOString(),
+                cached: false,
+            };
+        }
+        const now = Date.now();
+        const hit = PROCESS_CACHE.get(CACHE_KEY);
+        if (hit && hit.expires_at > now) {
+            return { ...hit.value, cached: true };
+        }
+        return withSkillSpan("cboe_vix_spot", async () => {
+            // CBOE delayed-quote endpoint (public, no API key).
+            const url = "https://cdn.cboe.com/api/global/delayed_quotes/quotes/VIX.json";
+            const res = await fetch(url, {
+                headers: { Accept: "application/json" },
+            });
+            if (!res.ok) {
+                throw new SkillExecutionError("cboe_vix_spot", `${res.status}`, {
+                    status: res.status,
+                });
+            }
+            const data = (await res.json());
+            const lastRaw = data.data?.last ?? data.data?.current_price ?? 0;
+            const last = typeof lastRaw === "string" ? Number(lastRaw) : lastRaw;
+            const value = {
+                symbol: "VIX",
+                last,
+                delayed_minutes: 15,
+                fetched_at: new Date(now).toISOString(),
+                cached: false,
+            };
+            PROCESS_CACHE.set(CACHE_KEY, {
+                value,
+                expires_at: now + CACHE_TTL_MS,
+            });
+            return value;
+        });
+    },
+};
+/** Test helper: clear in-process VIX cache. */
+export function _clearCboeVixCache() {
+    PROCESS_CACHE.clear();
+}
+//# sourceMappingURL=cboe-vix-spot.js.map

package/dist/skills/cboe-vix-spot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cboe-vix-spot.js","sourceRoot":"","sources":["../../src/skills/cboe-vix-spot.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAe1C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;AACpD,MAAM,SAAS,GAAG,UAAU,CAAC;AAC7B,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,MAAM,CAAC,MAAM,WAAW,GAA+C;IACrE,IAAI,EAAE,eAAe;IACrB,WAAW;IACX,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAiB;QACpC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;YAC9C,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAsB,CAAC;YAClD,OAAO;gBACL,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,CAAC;gBACP,eAAe,EAAE,EAAE;gBACnB,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBACrC,MAAM,EAAE,KAAK;aACd,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;YAChC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,aAAa,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;YAC/C,oDAAoD;YACpD,MAAM,GAAG,GACP,gEAAgE,CAAC;YACnE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,mBAAmB,CAAC,eAAe,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE;oBAC9D,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,aAAa,IAAI,CAAC,CAAC;YACjE,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACrE,MAAM,KAAK,GAAsB;gBAC/B,MAAM,EAAE,KAAK;gBACb,IAAI;gBACJ,eAAe,EAAE,EAAE;gBACnB,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBACvC,MAAM,EAAE,KAAK;aACd,CAAC;YACF,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC3B,KAAK;gBACL,UAAU,EAAE,GAAG,GAAG,YAAY;aAC/B,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,+CAA+C;AAC/C,MAAM,UAAU,kBAAkB;IAChC,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC"}

package/dist/skills/errors.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Skill-specific error classes.
+ *
+ * Each external service (Brave/Tavily, Alpaca, Telegram, Slack, SMTP/Resend,
+ * CBOE, Starknet) throws a `<Skill>NotConfiguredError` when required env keys
+ * are missing — distinguishes "config gap" from "live API failure".
+ *
+ * @public
+ */
+export declare class SkillNotConfiguredError extends Error {
+    readonly skillName: string;
+    readonly missingEnv: readonly string[];
+    constructor(skillName: string, missingEnv: readonly string[]);
+}
+export declare class SkillExecutionError extends Error {
+    readonly skillName: string;
+    readonly status?: number;
+    readonly cause?: unknown;
+    constructor(skillName: string, message: string, opts?: {
+        status?: number;
+        cause?: unknown;
+    });
+}
+export declare class SqlReadOnlyViolation extends Error {
+    readonly query: string;
+    constructor(query: string);
+}
+export declare class HttpFetchAllowlistError extends Error {
+    readonly url: string;
+    readonly host: string;
+    constructor(url: string, host: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/skills/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/skills/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;gBAC3B,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE;CAQ7D;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEvB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAQ9C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;gBACX,KAAK,EAAE,MAAM;CAK1B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAMtC"}

package/dist/skills/errors.js

@@ -0,0 +1,50 @@
+/**
+ * Skill-specific error classes.
+ *
+ * Each external service (Brave/Tavily, Alpaca, Telegram, Slack, SMTP/Resend,
+ * CBOE, Starknet) throws a `<Skill>NotConfiguredError` when required env keys
+ * are missing — distinguishes "config gap" from "live API failure".
+ *
+ * @public
+ */
+export class SkillNotConfiguredError extends Error {
+    skillName;
+    missingEnv;
+    constructor(skillName, missingEnv) {
+        super(`Skill '${skillName}' not configured: missing env ${missingEnv.join(", ")}`);
+        this.name = "SkillNotConfiguredError";
+        this.skillName = skillName;
+        this.missingEnv = missingEnv;
+    }
+}
+export class SkillExecutionError extends Error {
+    skillName;
+    status;
+    cause;
+    constructor(skillName, message, opts) {
+        super(`Skill '${skillName}' failed: ${message}`);
+        this.name = "SkillExecutionError";
+        this.skillName = skillName;
+        this.status = opts?.status;
+        this.cause = opts?.cause;
+    }
+}
+export class SqlReadOnlyViolation extends Error {
+    query;
+    constructor(query) {
+        super("SQL skill rejected non-read query (cc:read scope)");
+        this.name = "SqlReadOnlyViolation";
+        this.query = query;
+    }
+}
+export class HttpFetchAllowlistError extends Error {
+    url;
+    host;
+    constructor(url, host) {
+        super(`http_fetch: host '${host}' not in HTTP_FETCH_ALLOWLIST`);
+        this.name = "HttpFetchAllowlistError";
+        this.url = url;
+        this.host = host;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/skills/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/skills/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,SAAS,CAAS;IAClB,UAAU,CAAoB;IACvC,YAAY,SAAiB,EAAE,UAA6B;QAC1D,KAAK,CACH,UAAU,SAAS,iCAAiC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,SAAS,CAAS;IAClB,MAAM,CAAU;IAChB,KAAK,CAAW;IACzB,YACE,SAAiB,EACjB,OAAe,EACf,IAA2C;QAE3C,KAAK,CAAC,UAAU,SAAS,aAAa,OAAO,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,KAAK,CAAS;IACvB,YAAY,KAAa;QACvB,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,GAAG,CAAS;IACZ,IAAI,CAAS;IACtB,YAAY,GAAW,EAAE,IAAY;QACnC,KAAK,CAAC,qBAAqB,IAAI,+BAA+B,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/skills/hitl-request.d.ts

@@ -0,0 +1,39 @@
+/**
+ * hitl_request — programmatic HITL trigger.
+ *
+ * INSERTs a row into hitl_approvals (status='pending') and returns its id.
+ * The agent then awaits resolution via the hitl-gate from quick-2 (separate
+ * concern; this skill is fire-and-return-id).
+ *
+ * @public
+ */
+import { z } from "zod";
+import type { Skill } from "../orchestration/ooda/skills.js";
+declare const inputSchema: z.ZodObject<{
+    agent_run_id: z.ZodString;
+    reason: z.ZodString;
+    risk_level: z.ZodDefault<z.ZodEnum<["low", "medium", "high", "critical"]>>;
+    payload: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    timeout_seconds: z.ZodDefault<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    reason: string;
+    agent_run_id: string;
+    risk_level: "low" | "medium" | "high" | "critical";
+    timeout_seconds: number;
+    payload?: Record<string, unknown> | undefined;
+}, {
+    reason: string;
+    agent_run_id: string;
+    risk_level?: "low" | "medium" | "high" | "critical" | undefined;
+    payload?: Record<string, unknown> | undefined;
+    timeout_seconds?: number | undefined;
+}>;
+type HitlRequestInput = z.infer<typeof inputSchema>;
+export interface HitlRequestOutput {
+    id: string;
+    status: "pending" | "replay";
+    expires_at: string;
+}
+export declare const hitlRequest: Skill<HitlRequestInput, HitlRequestOutput>;
+export {};
+//# sourceMappingURL=hitl-request.d.ts.map

package/dist/skills/hitl-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-request.d.ts","sourceRoot":"","sources":["../../src/skills/hitl-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,iCAAiC,CAAC;AAG3E,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;EAQN,CAAC;AACZ,KAAK,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,gBAAgB,EAAE,iBAAiB,CAqClE,CAAC"}

package/dist/skills/hitl-request.js

@@ -0,0 +1,55 @@
+/**
+ * hitl_request — programmatic HITL trigger.
+ *
+ * INSERTs a row into hitl_approvals (status='pending') and returns its id.
+ * The agent then awaits resolution via the hitl-gate from quick-2 (separate
+ * concern; this skill is fire-and-return-id).
+ *
+ * @public
+ */
+import { z } from "zod";
+import { withSkillSpan } from "./_otel.js";
+const inputSchema = z
+    .object({
+    agent_run_id: z.string().uuid(),
+    reason: z.string().min(1).max(4_000),
+    risk_level: z.enum(["low", "medium", "high", "critical"]).default("medium"),
+    payload: z.record(z.string(), z.unknown()).optional(),
+    timeout_seconds: z.number().int().min(1).max(86_400).default(900),
+})
+    .strict();
+export const hitlRequest = {
+    name: "hitl_request",
+    inputSchema,
+    async execute(input, ctx) {
+        if (ctx.isReplay) {
+            const mock = ctx.dryRunMocks["hitl_request"];
+            if (mock)
+                return mock(input);
+            return {
+                id: "00000000-0000-0000-0000-000000000000",
+                status: "replay",
+                expires_at: new Date(0).toISOString(),
+            };
+        }
+        return withSkillSpan("hitl_request", async () => {
+            const expiresAt = new Date(Date.now() + input.timeout_seconds * 1000).toISOString();
+            const { rows } = await ctx.db.query(`INSERT INTO hitl_approvals
+          (agent_run_id, reason, risk_level, payload, status, expires_at)
+         VALUES ($1, $2, $3, $4::jsonb, 'pending', $5)
+         RETURNING id`, [
+                input.agent_run_id,
+                input.reason,
+                input.risk_level,
+                JSON.stringify(input.payload ?? {}),
+                expiresAt,
+            ]);
+            const id = rows[0]?.id;
+            if (!id) {
+                throw new Error("hitl_request: INSERT returned no id");
+            }
+            return { id, status: "pending", expires_at: expiresAt };
+        });
+    },
+};
+//# sourceMappingURL=hitl-request.js.map

package/dist/skills/hitl-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hitl-request.js","sourceRoot":"","sources":["../../src/skills/hitl-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3E,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;CAClE,CAAC;KACD,MAAM,EAAE,CAAC;AASZ,MAAM,CAAC,MAAM,WAAW,GAA+C;IACrE,IAAI,EAAE,cAAc;IACpB,WAAW;IACX,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAiB;QACpC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAC7C,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAsB,CAAC;YAClD,OAAO;gBACL,EAAE,EAAE,sCAAsC;gBAC1C,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;aACtC,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,eAAe,GAAG,IAAI,CAC1C,CAAC,WAAW,EAAE,CAAC;YAChB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CACjC;;;sBAGc,EACd;gBACE,KAAK,CAAC,YAAY;gBAClB,KAAK,CAAC,MAAM;gBACZ,KAAK,CAAC,UAAU;gBAChB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;gBACnC,SAAS;aACV,CACF,CAAC;YACF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/skills/http-fetch.d.ts

@@ -0,0 +1,32 @@
+/**
+ * http_fetch — GET only, allow-listed domains via env HTTP_FETCH_ALLOWLIST
+ * (comma-sep list of bare hostnames or `*.example.com` patterns).
+ *
+ * @public
+ */
+import { z } from "zod";
+import type { Skill } from "../orchestration/ooda/skills.js";
+declare const inputSchema: z.ZodObject<{
+    url: z.ZodString;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    timeout_ms: z.ZodDefault<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    url: string;
+    timeout_ms: number;
+    headers?: Record<string, string> | undefined;
+}, {
+    url: string;
+    headers?: Record<string, string> | undefined;
+    timeout_ms?: number | undefined;
+}>;
+type HttpFetchInput = z.infer<typeof inputSchema>;
+export interface HttpFetchOutput {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+    truncated: boolean;
+}
+export declare function isHostAllowed(host: string, allowlist: string[]): boolean;
+export declare const httpFetch: Skill<HttpFetchInput, HttpFetchOutput>;
+export {};
+//# sourceMappingURL=http-fetch.d.ts.map

package/dist/skills/http-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-fetch.d.ts","sourceRoot":"","sources":["../../src/skills/http-fetch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,iCAAiC,CAAC;AAI3E,QAAA,MAAM,WAAW;;;;;;;;;;;;EAMN,CAAC;AACZ,KAAK,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAElD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB;AAYD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CASxE;AAED,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE,eAAe,CA2C5D,CAAC"}

package/dist/skills/http-fetch.js

@@ -0,0 +1,82 @@
+/**
+ * http_fetch — GET only, allow-listed domains via env HTTP_FETCH_ALLOWLIST
+ * (comma-sep list of bare hostnames or `*.example.com` patterns).
+ *
+ * @public
+ */
+import { z } from "zod";
+import { HttpFetchAllowlistError, SkillExecutionError } from "./errors.js";
+import { withSkillSpan } from "./_otel.js";
+const inputSchema = z
+    .object({
+    url: z.string().url(),
+    headers: z.record(z.string(), z.string()).optional(),
+    timeout_ms: z.number().int().min(100).max(30_000).default(15_000),
+})
+    .strict();
+const MAX_RESPONSE_BYTES = 512 * 1024;
+function parseAllowlist() {
+    const raw = process.env.HTTP_FETCH_ALLOWLIST ?? "";
+    return raw
+        .split(",")
+        .map((s) => s.trim().toLowerCase())
+        .filter((s) => s.length > 0);
+}
+export function isHostAllowed(host, allowlist) {
+    const lower = host.toLowerCase();
+    return allowlist.some((pattern) => {
+        if (pattern.startsWith("*.")) {
+            const suffix = pattern.slice(1); // ".example.com"
+            return lower.endsWith(suffix) && lower !== suffix.slice(1);
+        }
+        return lower === pattern;
+    });
+}
+export const httpFetch = {
+    name: "http_fetch",
+    inputSchema,
+    async execute(input, ctx) {
+        const parsed = new URL(input.url);
+        const allowlist = parseAllowlist();
+        if (allowlist.length === 0) {
+            throw new HttpFetchAllowlistError(input.url, parsed.hostname);
+        }
+        if (!isHostAllowed(parsed.hostname, allowlist)) {
+            throw new HttpFetchAllowlistError(input.url, parsed.hostname);
+        }
+        if (ctx.isReplay) {
+            const mock = ctx.dryRunMocks["http_fetch"];
+            if (mock)
+                return mock(input);
+            return { status: 0, headers: {}, body: "", truncated: false };
+        }
+        return withSkillSpan("http_fetch", async () => {
+            const ac = new AbortController();
+            const timer = setTimeout(() => ac.abort(), input.timeout_ms);
+            try {
+                const res = await fetch(input.url, {
+                    method: "GET",
+                    headers: input.headers,
+                    signal: ac.signal,
+                });
+                const text = await res.text();
+                const truncated = text.length > MAX_RESPONSE_BYTES;
+                const body = truncated ? text.slice(0, MAX_RESPONSE_BYTES) : text;
+                const headers = {};
+                res.headers.forEach((v, k) => {
+                    headers[k] = v;
+                });
+                return { status: res.status, headers, body, truncated };
+            }
+            catch (err) {
+                throw new SkillExecutionError("http_fetch", "fetch error", {
+                    cause: err,
+                });
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        });
+    },
+};
+//# sourceMappingURL=http-fetch.js.map

package/dist/skills/http-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-fetch.js","sourceRoot":"","sources":["../../src/skills/http-fetch.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAClE,CAAC;KACD,MAAM,EAAE,CAAC;AAUZ,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEtC,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;IACnD,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,SAAmB;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;YAClD,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,KAAK,KAAK,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAA2C;IAC/D,IAAI,EAAE,YAAY;IAClB,WAAW;IACX,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAiB;QACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YAC3C,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAoB,CAAC;YAChD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,aAAa,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;oBACjC,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,EAAE,CAAC,MAAM;iBAClB,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC;gBACnD,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAClE,MAAM,OAAO,GAA2B,EAAE,CAAC;gBAC3C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;oBAC3B,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACjB,CAAC,CAAC,CAAC;gBACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC1D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,mBAAmB,CAAC,YAAY,EAAE,aAAa,EAAE;oBACzD,KAAK,EAAE,GAAG;iBACX,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/skills/index.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Skill Catalog — 13 builtin OODA skills + record_outcome helper.
+ *
+ * Each skill is a pure function with a strict Zod input schema, typed output,
+ * and `isReplay` enforcement (V8-2 critical for sprint-530 replay engine).
+ * OTEL instrumentation is wired automatically when env
+ * `OTEL_EXPORTER_OTLP_ENDPOINT` is set.
+ *
+ * Differentiator vs Hermes 118 skills: each call emits a run_step with
+ * `leaf_hash_poseidon` so audits can prove "agent X called skill Y with
+ * input Z at time T".
+ *
+ * @public
+ */
+export { SkillNotConfiguredError, SkillExecutionError, SqlReadOnlyViolation, HttpFetchAllowlistError, } from "./errors.js";
+export { webSearch } from "./web-search.js";
+export type { WebSearchOutput, WebSearchResult } from "./web-search.js";
+export { alpacaQuote } from "./alpaca-quote.js";
+export type { AlpacaQuoteOutput } from "./alpaca-quote.js";
+export { brainStore } from "./brain-store.js";
+export type { BrainStoreOutput } from "./brain-store.js";
+export { brainQuery } from "./brain-query.js";
+export type { BrainQueryOutput } from "./brain-query.js";
+export { telegramNotify } from "./telegram-notify.js";
+export type { TelegramNotifyOutput } from "./telegram-notify.js";
+export { slackNotify } from "./slack-notify.js";
+export type { SlackNotifyOutput } from "./slack-notify.js";
+export { sendEmail } from "./send-email.js";
+export type { SendEmailOutput } from "./send-email.js";
+export { runSqlQuery, isReadOnlySql } from "./run-sql-query.js";
+export type { RunSqlQueryOutput } from "./run-sql-query.js";
+export { cboeVixSpot, _clearCboeVixCache } from "./cboe-vix-spot.js";
+export type { CboeVixSpotOutput } from "./cboe-vix-spot.js";
+export { starknetBalance } from "./starknet-balance.js";
+export type { StarknetBalanceOutput } from "./starknet-balance.js";
+export { calendarCheck, _resetCalendarCache } from "./calendar-check.js";
+export type { CalendarCheckOutput } from "./calendar-check.js";
+export { hitlRequest } from "./hitl-request.js";
+export type { HitlRequestOutput } from "./hitl-request.js";
+export { httpFetch, isHostAllowed } from "./http-fetch.js";
+export type { HttpFetchOutput } from "./http-fetch.js";
+export { recordOutcomeSkill, _resetOutcomesIndex } from "./record-outcome.js";
+export type { RecordOutcomeOutput } from "./record-outcome.js";
+export { resolveSkillsForAgent } from "./skill-ledger.js";
+export type { SkillLedgerEntry, SkillLifecycleState, ResolveSkillsOptions, } from "./skill-ledger.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/skills/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrE,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACzE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC3D,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC"}

package/dist/skills/index.js

@@ -0,0 +1,32 @@
+/**
+ * Skill Catalog — 13 builtin OODA skills + record_outcome helper.
+ *
+ * Each skill is a pure function with a strict Zod input schema, typed output,
+ * and `isReplay` enforcement (V8-2 critical for sprint-530 replay engine).
+ * OTEL instrumentation is wired automatically when env
+ * `OTEL_EXPORTER_OTLP_ENDPOINT` is set.
+ *
+ * Differentiator vs Hermes 118 skills: each call emits a run_step with
+ * `leaf_hash_poseidon` so audits can prove "agent X called skill Y with
+ * input Z at time T".
+ *
+ * @public
+ */
+export { SkillNotConfiguredError, SkillExecutionError, SqlReadOnlyViolation, HttpFetchAllowlistError, } from "./errors.js";
+export { webSearch } from "./web-search.js";
+export { alpacaQuote } from "./alpaca-quote.js";
+export { brainStore } from "./brain-store.js";
+export { brainQuery } from "./brain-query.js";
+export { telegramNotify } from "./telegram-notify.js";
+export { slackNotify } from "./slack-notify.js";
+export { sendEmail } from "./send-email.js";
+export { runSqlQuery, isReadOnlySql } from "./run-sql-query.js";
+export { cboeVixSpot, _clearCboeVixCache } from "./cboe-vix-spot.js";
+export { starknetBalance } from "./starknet-balance.js";
+export { calendarCheck, _resetCalendarCache } from "./calendar-check.js";
+export { hitlRequest } from "./hitl-request.js";
+export { httpFetch, isHostAllowed } from "./http-fetch.js";
+export { recordOutcomeSkill, _resetOutcomesIndex } from "./record-outcome.js";
+// Skill Ledger types + resolver (SDK v0.8.0 — sprint-530:quick-4)
+export { resolveSkillsForAgent } from "./skill-ledger.js";
+//# sourceMappingURL=index.js.map

package/dist/skills/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGhE,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAGzE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAG3D,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,kEAAkE;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/skills/record-outcome.d.ts

@@ -0,0 +1,49 @@
+/**
+ * record_outcome — helper for outcomeMapping. INSERTs an `outcomes` row.
+ *
+ * Looks up `is_pending_backfill` from outcomes.yaml at OUTCOMES_YAML_PATH
+ * (defaults to false when path absent or outcome_type not declared).
+ *
+ * Distinct from `tracking/gen-ai.recordOutcome()` (OTel attribute helper).
+ * Lives in skills/ because it's invoked from OODA Act phase as a Skill.
+ *
+ * @public
+ */
+import { z } from "zod";
+import type { Skill } from "../orchestration/ooda/skills.js";
+declare const inputSchema: z.ZodObject<{
+    agent_id: z.ZodString;
+    agent_run_id: z.ZodNullable<z.ZodString>;
+    outcome_type: z.ZodString;
+    /** Signed integer cents. */
+    value_cents: z.ZodNumber;
+    currency: z.ZodDefault<z.ZodString>;
+    occurred_at: z.ZodDefault<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strict", z.ZodTypeAny, {
+    value_cents: number;
+    agent_id: string;
+    outcome_type: string;
+    agent_run_id: string | null;
+    currency: string;
+    occurred_at: string;
+    metadata?: Record<string, unknown> | undefined;
+}, {
+    value_cents: number;
+    agent_id: string;
+    outcome_type: string;
+    agent_run_id: string | null;
+    metadata?: Record<string, unknown> | undefined;
+    currency?: string | undefined;
+    occurred_at?: string | undefined;
+}>;
+type RecordOutcomeInput = z.infer<typeof inputSchema>;
+export interface RecordOutcomeOutput {
+    id: string;
+    is_pending_backfill: boolean;
+}
+/** Test helper. */
+export declare function _resetOutcomesIndex(): void;
+export declare const recordOutcomeSkill: Skill<RecordOutcomeInput, RecordOutcomeOutput>;
+export {};
+//# sourceMappingURL=record-outcome.d.ts.map

package/dist/skills/record-outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-outcome.d.ts","sourceRoot":"","sources":["../../src/skills/record-outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,KAAK,EAAgB,MAAM,iCAAiC,CAAC;AAI3E,QAAA,MAAM,WAAW;;;;IAKb,4BAA4B;;;;;;;;;;;;;;;;;;;;;EASrB,CAAC;AACZ,KAAK,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAyCD,mBAAmB;AACnB,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED,eAAO,MAAM,kBAAkB,EAAE,KAAK,CACpC,kBAAkB,EAClB,mBAAmB,CAwCpB,CAAC"}

package/dist/skills/record-outcome.js

@@ -0,0 +1,104 @@
+/**
+ * record_outcome — helper for outcomeMapping. INSERTs an `outcomes` row.
+ *
+ * Looks up `is_pending_backfill` from outcomes.yaml at OUTCOMES_YAML_PATH
+ * (defaults to false when path absent or outcome_type not declared).
+ *
+ * Distinct from `tracking/gen-ai.recordOutcome()` (OTel attribute helper).
+ * Lives in skills/ because it's invoked from OODA Act phase as a Skill.
+ *
+ * @public
+ */
+import { z } from "zod";
+import { SkillExecutionError } from "./errors.js";
+import { withSkillSpan } from "./_otel.js";
+const inputSchema = z
+    .object({
+    agent_id: z.string().min(1).max(64),
+    agent_run_id: z.string().uuid().nullable(),
+    outcome_type: z.string().min(1).max(64),
+    /** Signed integer cents. */
+    value_cents: z.number().int(),
+    currency: z.string().length(3).default("USD"),
+    occurred_at: z
+        .string()
+        .datetime({ offset: true })
+        .default(() => new Date().toISOString()),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+})
+    .strict();
+let OUTCOMES_INDEX = null;
+async function loadOutcomesIndex() {
+    if (OUTCOMES_INDEX)
+        return OUTCOMES_INDEX;
+    const path = process.env.OUTCOMES_YAML_PATH;
+    if (!path) {
+        OUTCOMES_INDEX = new Map();
+        return OUTCOMES_INDEX;
+    }
+    try {
+        const [fs, yaml] = await Promise.all([
+            import("node:fs/promises"),
+            import("yaml"),
+        ]);
+        const raw = await fs.readFile(path, "utf-8");
+        const parsed = yaml.parse(raw);
+        const entries = Array.isArray(parsed)
+            ? parsed
+            : (parsed.outcomes ?? []);
+        const m = new Map();
+        for (const e of entries) {
+            m.set(e.type, e.is_pending_backfill === true);
+        }
+        OUTCOMES_INDEX = m;
+        return OUTCOMES_INDEX;
+    }
+    catch (err) {
+        throw new SkillExecutionError("record_outcome", "could not load outcomes.yaml", {
+            cause: err,
+        });
+    }
+}
+/** Test helper. */
+export function _resetOutcomesIndex() {
+    OUTCOMES_INDEX = null;
+}
+export const recordOutcomeSkill = {
+    name: "record_outcome",
+    inputSchema,
+    async execute(input, ctx) {
+        if (ctx.isReplay) {
+            const mock = ctx.dryRunMocks["record_outcome"];
+            if (mock)
+                return mock(input);
+            return {
+                id: "00000000-0000-0000-0000-000000000000",
+                is_pending_backfill: false,
+            };
+        }
+        return withSkillSpan("record_outcome", async () => {
+            const idx = await loadOutcomesIndex();
+            const isPending = idx.get(input.outcome_type) ?? false;
+            const { rows } = await ctx.db.query(`INSERT INTO outcomes
+          (agent_id, agent_run_id, outcome_type, value_cents, currency,
+           occurred_at, is_pending_backfill, metadata)
+         VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb)
+         RETURNING id`, [
+                input.agent_id,
+                input.agent_run_id,
+                input.outcome_type,
+                input.value_cents,
+                input.currency,
+                input.occurred_at,
+                isPending,
+                JSON.stringify(input.metadata ?? {}),
+            ]);
+            const id = rows[0]?.id;
+            if (!id) {
+                throw new Error("record_outcome: INSERT returned no id");
+            }
+            return { id, is_pending_backfill: isPending };
+        });
+    },
+};
+//# sourceMappingURL=record-outcome.js.map