@oxygen-agent/cli 1.152.15 → 1.162.10

package/node_modules/@oxygen/shared/dist/sql-error.js

@@ -0,0 +1,318 @@
+// Structured, non-secret attribution for Postgres / drizzle query failures.
+//
+// Background (OXY-44/OXY-46): worker error spans and logs previously carried
+// only the raw drizzle `Failed query: <sql>...` message (truncated to ~500
+// chars in Axiom), so an operator could not tell a Neon connect timeout from a
+// statement timeout, schema drift, or another SQLSTATE without guessing from
+// the truncated SQL. This classifier turns any pg/drizzle error into a small
+// set of structured, groupable fields:
+//
+//   - SQLSTATE / pg error code        (e.g. "57014", "42P01")
+//   - normalized cause category       (e.g. "statement_timeout", "schema_drift")
+//   - query kind + table              (e.g. "select" on "workflow_triggers")
+//   - whether a retry could succeed   (transient)
+//
+// HARD CONSTRAINT: customer row data and SQL *parameter values* must never leak
+// into telemetry. We therefore only ever read schema-level identifiers (the
+// table name) and the leading SQL verb from the *parameter-free* SQL, and we
+// always strip drizzle's trailing `\nparams: [...]` tail. We never emit the SQL
+// text itself or the parameter array.
+//
+// drizzle (>=0.36) wraps driver failures as a DrizzleQueryError whose message is
+// `Failed query: <sql>\nparams: <params>`, with the original pg error on
+// `.cause` (so the SQLSTATE lives on `error.cause.code`, not `error.code`).
+// Connection-level failures (Neon cold-start connect timeouts, socket resets)
+// surface before a query with a Node errno on `code`/`errno` and no SQLSTATE.
+// SQLSTATEs that mean the code expects schema the database does not have — the
+// "schema drift" signal OXY-44 specifically called out (undefined table/column/
+// function/object/schema). Distinct from generic class-42 syntax/access errors.
+const SCHEMA_DRIFT_SQLSTATES = new Set([
+    "42P01", // undefined_table
+    "42703", // undefined_column
+    "42883", // undefined_function
+    "42704", // undefined_object
+    "42P02", // undefined_parameter
+    "3F000", // invalid_schema_name
+]);
+// Node/undici errnos. These appear on `.code` (or `.errno`) for failures that
+// happen before/around the TCP+TLS handshake, so they carry no SQLSTATE.
+const CONNECT_TIMEOUT_ERRNOS = new Set(["ETIMEDOUT", "UND_ERR_CONNECT_TIMEOUT"]);
+const CONNECTION_ERRNOS = new Set([
+    "ECONNRESET",
+    "ECONNREFUSED",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "EPIPE",
+    "ENETUNREACH",
+    "UND_ERR_SOCKET",
+]);
+const CONNECT_TIMEOUT_MESSAGE = /timeout exceeded when trying to connect|connection terminated due to connection timeout|connect(?:ion)?\s+time(?:d?\s?)out/i;
+const CONNECTION_MESSAGE = /connection terminated|connection reset|socket hang up|fetch failed|getaddrinfo|network timeout/i;
+// Categories from which a retry on a later tick could plausibly succeed. This is
+// a SQLSTATE-aware retry-eligibility signal and is intentionally independent of
+// the worker span's conservative `outcome` gate (isTransientPersistenceError),
+// which only suppresses error-rate monitors for self-healing connect failures.
+const TRANSIENT_CAUSES = new Set([
+    "connect_timeout",
+    "connection",
+    "statement_timeout",
+    "admin_shutdown",
+    "too_many_connections",
+    "insufficient_resources",
+    "serialization",
+    "deadlock",
+    "transaction_rollback",
+]);
+/**
+ * Classifies a pg/drizzle error into structured, non-secret attribution.
+ * Returns null when the error carries no SQL/connection signal at all (so
+ * non-DB errors never gain spurious `db.*` attributes). Never throws.
+ */
+export function describeSqlError(error) {
+    try {
+        const sqlstate = readSqlstate(error);
+        const errno = readErrno(error);
+        const message = readMessage(error);
+        const drizzle = isDrizzleQueryError(error, message);
+        let cause = sqlstate ? categoryFromSqlstate(sqlstate) ?? "unknown" : "unknown";
+        if (cause === "unknown") {
+            if (errno && CONNECT_TIMEOUT_ERRNOS.has(errno))
+                cause = "connect_timeout";
+            else if (errno && CONNECTION_ERRNOS.has(errno))
+                cause = "connection";
+            else if (CONNECT_TIMEOUT_MESSAGE.test(message))
+                cause = "connect_timeout";
+            else if (CONNECTION_MESSAGE.test(message))
+                cause = "connection";
+        }
+        const hasSignal = Boolean(sqlstate) || Boolean(errno) || cause !== "unknown" || drizzle;
+        if (!hasSignal)
+            return null;
+        const { kind, table } = extractQueryShape(readParamFreeSql(error, message));
+        // severity/schema/column/constraint/statusCode are schema-level identifiers
+        // or transport status codes — safe to surface. We deliberately do NOT read
+        // pg's `detail`, `hint`, or `where`: those embed customer row values (e.g.
+        // "Key (email)=(a@b.com) already exists") and would leak data (OXY-38).
+        return {
+            pgCode: sqlstate,
+            cause,
+            queryKind: kind,
+            table: table ?? readTableField(error),
+            transient: TRANSIENT_CAUSES.has(cause),
+            severity: readSeverity(error),
+            schema: readIdentifierField(error, "schema"),
+            column: readIdentifierField(error, "column"),
+            constraint: readIdentifierField(error, "constraint"),
+            statusCode: readStatusCode(error),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Log-field shape (snake_case) for merging into `errorFields(error)` payloads. */
+export function sqlErrorFields(error) {
+    const a = describeSqlError(error);
+    if (!a)
+        return {};
+    return {
+        ...(a.pgCode ? { sql_error_pg_code: a.pgCode } : {}),
+        sql_error_cause: a.cause,
+        ...(a.queryKind ? { sql_error_query_kind: a.queryKind } : {}),
+        ...(a.table ? { sql_error_table: a.table } : {}),
+        sql_error_transient: a.transient,
+        ...(a.severity ? { sql_error_severity: a.severity } : {}),
+        ...(a.schema ? { sql_error_schema: a.schema } : {}),
+        ...(a.column ? { sql_error_column: a.column } : {}),
+        ...(a.constraint ? { sql_error_constraint: a.constraint } : {}),
+        ...(a.statusCode !== null ? { sql_error_status: a.statusCode } : {}),
+    };
+}
+/**
+ * Strips drizzle's `\nparams: <values>` segment from an error message or stack
+ * so SQL parameter values never reach logs/telemetry (OXY-46). Preserves the SQL
+ * text itself and any following stack frames; a no-op on non-drizzle text.
+ *
+ * drizzle's DrizzleQueryError carries the parameter array inside its `.message`
+ * (and therefore its `.stack`) as `Failed query: <sql>\nparams: <values>`, so
+ * the generic error serializers would otherwise emit those values verbatim.
+ */
+export function redactSqlParameters(text) {
+    if (!text.includes("Failed query:"))
+        return text;
+    return text.replace(/\n[ \t]*params[ \t]*:[\s\S]*?(?=\n[ \t]*at\s|$)/i, "");
+}
+/** Telemetry-attribute shape (dotted keys) for span error attribution. */
+export function sqlErrorTelemetryAttributes(error) {
+    const a = describeSqlError(error);
+    if (!a)
+        return {};
+    return {
+        ...(a.pgCode ? { "db.pg_code": a.pgCode } : {}),
+        "db.error.cause": a.cause,
+        ...(a.queryKind ? { "db.error.query_kind": a.queryKind } : {}),
+        ...(a.table ? { "db.error.table": a.table } : {}),
+        "db.error.transient": a.transient,
+        ...(a.severity ? { "db.error.severity": a.severity } : {}),
+        ...(a.schema ? { "db.error.schema": a.schema } : {}),
+        ...(a.column ? { "db.error.column": a.column } : {}),
+        ...(a.constraint ? { "db.error.constraint": a.constraint } : {}),
+        ...(a.statusCode !== null ? { "db.error.status": a.statusCode } : {}),
+    };
+}
+function categoryFromSqlstate(code) {
+    if (code === "57014")
+        return "statement_timeout";
+    if (code === "53300")
+        return "too_many_connections";
+    if (code === "40001")
+        return "serialization";
+    if (code === "40P01")
+        return "deadlock";
+    if (SCHEMA_DRIFT_SQLSTATES.has(code))
+        return "schema_drift";
+    switch (code.slice(0, 2)) {
+        case "08": return "connection";
+        case "28": return "auth";
+        case "22": return "data_exception";
+        case "23": return "integrity_constraint";
+        case "40": return "transaction_rollback";
+        case "42": return "syntax_or_access";
+        case "53": return "insufficient_resources";
+        case "57": return "admin_shutdown";
+        case "58": return "internal";
+        case "XX": return "internal";
+        case "3F": return "schema_drift";
+        default: return null;
+    }
+}
+// Walk the Error.cause chain (bounded) and return the first non-null value the
+// reader extracts. drizzle wraps the pg error on `.cause`, and custom wrappers
+// can nest deeper, so a single-level read misses the actionable DB fields when
+// the chain is two or more deep (OXY-38).
+const MAX_CAUSE_DEPTH = 5;
+function readCauseChain(error, read) {
+    let current = error;
+    for (let depth = 0; depth < MAX_CAUSE_DEPTH; depth++) {
+        if (!current || typeof current !== "object")
+            return null;
+        const value = read(current);
+        if (value !== null)
+            return value;
+        current = current.cause;
+    }
+    return null;
+}
+function readSqlstate(error) {
+    return readCauseChain(error, (obj) => {
+        const value = obj.code;
+        return typeof value === "string"
+            && /^[0-9A-Z]{5}$/.test(value)
+            && !CONNECTION_ERRNOS.has(value)
+            && !CONNECT_TIMEOUT_ERRNOS.has(value)
+            ? value
+            : null;
+    });
+}
+function readErrno(error) {
+    return readCauseChain(error, (obj) => {
+        for (const key of ["code", "errno"]) {
+            const value = obj[key];
+            if (typeof value === "string" && (CONNECTION_ERRNOS.has(value) || CONNECT_TIMEOUT_ERRNOS.has(value))) {
+                return value;
+            }
+        }
+        return null;
+    });
+}
+// pg sets `error.table` for some failures (notably constraint violations). Used
+// only as a fallback when the table cannot be parsed from the SQL. Identifiers
+// are schema metadata, never customer row data.
+function readTableField(error) {
+    return readIdentifierField(error, "table");
+}
+// pg sets schema/column/constraint/table to identifier names (never row
+// values), so they are safe to surface for triage. Guarded by isSafeIdentifier
+// as defence in depth against an unexpected driver placing free text there.
+function readIdentifierField(error, key) {
+    return readCauseChain(error, (obj) => {
+        const value = obj[key];
+        return typeof value === "string" && isSafeIdentifier(value) ? value : null;
+    });
+}
+function readSeverity(error) {
+    return readCauseChain(error, (obj) => {
+        const value = obj.severity;
+        // A short keyword (ERROR/FATAL/PANIC/WARNING), possibly localized. Cap the
+        // length and restrict to letters/spaces so it can never carry parameter
+        // values even if a driver mislabels a field.
+        return typeof value === "string" && value.length > 0 && value.length <= 32 && /^[A-Za-z _]+$/.test(value)
+            ? value
+            : null;
+    });
+}
+function readStatusCode(error) {
+    return readCauseChain(error, (obj) => {
+        for (const key of ["statusCode", "status"]) {
+            const value = obj[key];
+            if (typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599) {
+                return value;
+            }
+        }
+        return null;
+    });
+}
+function isDrizzleQueryError(error, message) {
+    return message.startsWith("Failed query:") || typeof readNestedString(error, ["query"]) === "string";
+}
+/**
+ * Returns the parameter-free SQL for shape extraction: drizzle's `.query`
+ * (already param-free) when present, else the message with the `Failed query:`
+ * prefix removed and the `\nparams: [...]` tail stripped. Never returns the
+ * parameter array.
+ */
+function readParamFreeSql(error, message) {
+    const query = readNestedString(error, ["query"]);
+    if (query)
+        return query;
+    let sql = message;
+    const prefixIndex = sql.indexOf("Failed query:");
+    if (prefixIndex >= 0)
+        sql = sql.slice(prefixIndex + "Failed query:".length);
+    const paramsIndex = sql.search(/\n\s*params\s*:/i);
+    if (paramsIndex >= 0)
+        sql = sql.slice(0, paramsIndex);
+    return sql.trim();
+}
+const SQL_VERB = /^(select|insert|update|delete|with|merge|create|alter|drop|truncate)\b/i;
+// Identifier after a table-introducing keyword: optionally double-quoted, with an
+// optional `schema.table` qualification. Stops at the first non-identifier char,
+// so it can never capture a value, a paren-subquery, or whitespace.
+const TABLE_AFTER_KEYWORD = /\b(?:from|into|update|join|table)\s+("?[A-Za-z_][\w$]*"?(?:\s*\.\s*"?[A-Za-z_][\w$]*"?)?)/i;
+function extractQueryShape(sql) {
+    const trimmed = sql.replace(/^[\s(]+/, "");
+    const kindMatch = SQL_VERB.exec(trimmed);
+    const kind = kindMatch?.[1]?.toLowerCase() ?? null;
+    const tableMatch = TABLE_AFTER_KEYWORD.exec(trimmed);
+    const rawTable = tableMatch?.[1]?.replace(/["\s]/g, "") ?? null;
+    const table = rawTable && isSafeIdentifier(rawTable) ? rawTable : null;
+    return { kind, table };
+}
+function isSafeIdentifier(value) {
+    return value.length > 0 && value.length <= 128 && /^[A-Za-z_][\w$]*(?:\.[A-Za-z_][\w$]*)?$/.test(value);
+}
+function readMessage(error) {
+    if (error instanceof Error)
+        return error.message ?? "";
+    const value = readNestedString(error, ["message"]);
+    return value ?? "";
+}
+function readNestedString(error, path) {
+    let current = error;
+    for (const part of path) {
+        if (!current || typeof current !== "object")
+            return null;
+        current = current[part];
+    }
+    return typeof current === "string" ? current : null;
+}

package/node_modules/@oxygen/shared/dist/telemetry.js

@@ -1,6 +1,7 @@
 import { SpanStatusCode, metrics, trace, } from "@opentelemetry/api";
 import { errorId } from "./log.js";
 import { normalizeTelemetryAttributes } from "./redaction.js";
+import { redactSqlParameters, sqlErrorTelemetryAttributes } from "./sql-error.js";
 import { OXYGEN_VERSION } from "./version.js";
 const counterCache = new Map();
 const histogramCache = new Map();
@@ -20,7 +21,13 @@ export async function withTelemetrySpan(tracerName, name, attributes, fn, option
             }
             else {
                 span.setStatus({ code: SpanStatusCode.ERROR });
-                span.setAttributes(normalizeTelemetryAttributes(errorTelemetryAttributes(error)));
+                // Overwrite the initial `outcome: "started"` so ERROR-status spans are
+                // never left mislabelled as still-running; dashboards/reports that
+                // group by outcome would otherwise misclassify real faults (OXY-32).
+                span.setAttributes(normalizeTelemetryAttributes({
+                    ...errorTelemetryAttributes(error),
+                    outcome: "error",
+                }));
             }
             throw error;
         }
@@ -69,9 +76,17 @@ export function commonTelemetryAttributes(attributes) {
         "deployment.environment": workerProcess
             ? process.env.FLY_ENVIRONMENT ?? process.env.NODE_ENV ?? null
             : process.env.VERCEL_ENV ?? process.env.NODE_ENV ?? null,
+        // deployment.sha stays the deploy artifact id: the Fly registry image ref on
+        // the worker (release cross-reference), VERCEL_GIT_COMMIT_SHA on the web. The
+        // worker's image ref is NOT a git commit, so deployment.git_sha carries the
+        // resolved commit separately and is the single field that means "the commit"
+        // on both surfaces (OXY-61). On the web both happen to equal the Vercel SHA.
         "deployment.sha": workerProcess
             ? process.env.FLY_IMAGE_REF ?? process.env.VERCEL_GIT_COMMIT_SHA ?? null
             : process.env.VERCEL_GIT_COMMIT_SHA ?? process.env.FLY_IMAGE_REF ?? null,
+        "deployment.git_sha": workerProcess
+            ? process.env.OXYGEN_GIT_SHA ?? process.env.VERCEL_GIT_COMMIT_SHA ?? null
+            : process.env.VERCEL_GIT_COMMIT_SHA ?? process.env.OXYGEN_GIT_SHA ?? null,
         "cloud.region": workerProcess
             ? process.env.FLY_REGION ?? process.env.VERCEL_REGION ?? null
             : process.env.VERCEL_REGION ?? process.env.FLY_REGION ?? null,
@@ -104,19 +119,27 @@ function getHistogram(name) {
     return histogram;
 }
 function errorTelemetryAttributes(error) {
+    // Structured SQL attribution (SQLSTATE, cause category, query kind/table,
+    // transient) when the error is a pg/drizzle failure; {} otherwise, so non-DB
+    // spans are unchanged. Never includes SQL text or parameter values (OXY-46).
+    const sqlAttributes = sqlErrorTelemetryAttributes(error);
     if (error instanceof Error) {
         // pg connect timeouts (and some driver errors) surface with an empty
         // message; fall back to the error name so spans are never message-less.
-        const message = error.message.trim() ? error.message : error.name || "unknown_error";
+        // Strip drizzle's `\nparams: <values>` tail so parameter values stay out of
+        // telemetry (OXY-46).
+        const message = error.message.trim() ? redactSqlParameters(error.message) : error.name || "unknown_error";
         return {
             "error.id": errorId(error),
             "error.name": error.name,
             "error.message": message,
+            ...sqlAttributes,
         };
     }
-    const text = String(error).trim();
+    const text = redactSqlParameters(String(error)).trim();
     return {
         "error.id": "non_error",
         "error.message": text || "unknown_error",
+        ...sqlAttributes,
     };
 }

package/node_modules/@oxygen/shared/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const OXYGEN_VERSION = "1.152.15";
-export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.135.0";
+export declare const OXYGEN_VERSION = "1.162.10";
+export declare const OXYGEN_MINIMUM_CLI_VERSION = "1.154.0";

package/node_modules/@oxygen/shared/dist/version.js

@@ -1,3 +1,6 @@
-export const OXYGEN_VERSION = "1.152.15";
+export const OXYGEN_VERSION = "1.162.10";
 // Bump this only when deployed CLI/API contracts require a newer CLI.
-export const OXYGEN_MINIMUM_CLI_VERSION = "1.135.0";
+// 1.154.0: LinkedIn → Sequencer rename moved the CLI/API/MCP surface
+// (oxygen sequences|inbox|senders, /api/cli/{sequences,inbox,senders}) and
+// removed the old /api/cli/linkedin/* routes — older CLIs would 404.
+export const OXYGEN_MINIMUM_CLI_VERSION = "1.154.0";

package/node_modules/@oxygen/workflows/dist/index.d.ts

@@ -334,7 +334,6 @@ export declare function branchStep(input: {
 export declare function isWorkflowDefinition(value: unknown): value is WorkflowDefinition;
 export declare function isWorkflowManifest(value: unknown): value is WorkflowManifest;
 export declare function isRecipeManifest(value: unknown): value is RecipeManifest;
-export declare function isDurableRecipeManifest(value: unknown): value is RecipeManifest;
 export declare function isAnyWorkflowManifest(value: unknown): value is AnyWorkflowManifest;
 export declare function compileWorkflowDefinition(// skipcq: JS-R1005 -- compiler validates workflow metadata, trigger, steps, branch targets, and defaults together.
 definition: WorkflowDefinition, options?: {
@@ -533,24 +532,6 @@ export declare const workflowManifestSchema: {
     readonly additionalProperties: true;
     readonly required: readonly ["manifest_version", "workflow", "steps", "source_hash", "compiler_version"];
 };
-export declare function getWorkflowApplySchema(): {
-    readonly $schema: "https://json-schema.org/draft/2020-12/schema";
-    readonly title: "OXYGEN Workflow Apply Input";
-    readonly type: "object";
-    readonly additionalProperties: false;
-    readonly properties: {
-        readonly manifest: {
-            readonly $ref: "#/$defs/manifest";
-        };
-    };
-    readonly required: readonly ["manifest"];
-    readonly $defs: {
-        readonly manifest: {
-            readonly type: "object";
-            readonly additionalProperties: true;
-        };
-    };
-};
 export declare function getWorkflowSchema(subject?: "apply" | "call" | "event" | "trigger" | "manifest" | "all"): {
     readonly $schema: "https://json-schema.org/draft/2020-12/schema";
     readonly title: "OXYGEN Workflow Apply Input";

package/node_modules/@oxygen/workflows/dist/index.js

@@ -31,6 +31,10 @@ const UNSAFE_RECIPE_BUNDLE_PATTERNS = [
     { token: "setTimeout", pattern: /\bsetTimeout\b/ },
     { token: "setInterval", pattern: /\bsetInterval\b/ }, // skipcq: SCT-A000
 ];
+/** A valid workflow / recipe / trigger status. Optional everywhere it appears. */
+function isValidWorkflowStatus(value) {
+    return value === "active" || value === "disabled";
+}
 export function defineWorkflow(input) {
     return {
         __oxygen_workflow_definition: true,
@@ -140,9 +144,6 @@ export function isRecipeManifest(value) {
         && value.manifest_version === WORKFLOW_MANIFEST_VERSION
         && value.compiler_version === DURABLE_RECIPE_COMPILER_VERSION;
 }
-export function isDurableRecipeManifest(value) {
-    return isRecipeManifest(value);
-}
 export function isAnyWorkflowManifest(value) {
     return isWorkflowManifest(value) || isRecipeManifest(value);
 }
@@ -248,7 +249,7 @@ value, options = {}) {
             add("$.workflow.id", "invalid_workflow_id", "Workflow id is required.");
         if (!isNonEmptyString(workflow.name))
             add("$.workflow.name", "invalid_workflow_name", "Workflow name is required.");
-        if (workflow.status !== undefined && workflow.status !== "active" && workflow.status !== "disabled") {
+        if (workflow.status !== undefined && !isValidWorkflowStatus(workflow.status)) {
             add("$.workflow.status", "invalid_workflow_status", "Workflow status must be active or disabled.");
         }
     }
@@ -371,7 +372,7 @@ value, options = {}) {
             add("$.workflow.id", "invalid_workflow_id", "Recipe id is required.");
         if (!isNonEmptyString(workflow.name))
             add("$.workflow.name", "invalid_workflow_name", "Recipe name is required.");
-        if (workflow.status !== undefined && workflow.status !== "active" && workflow.status !== "disabled") {
+        if (workflow.status !== undefined && !isValidWorkflowStatus(workflow.status)) {
             add("$.workflow.status", "invalid_workflow_status", "Recipe status must be active or disabled.");
         }
     }
@@ -904,9 +905,6 @@ export const workflowManifestSchema = {
     additionalProperties: true,
     required: ["manifest_version", "workflow", "steps", "source_hash", "compiler_version"],
 };
-export function getWorkflowApplySchema() {
-    return workflowApplySchema;
-}
 export function getWorkflowSchema(subject = "apply") {
     const schemas = {
         apply: workflowApplySchema,
@@ -1042,13 +1040,20 @@ function formatSchemaTypes(types) {
 function jsonEqual(left, right) {
     return JSON.stringify(left) === JSON.stringify(right);
 }
+// Optional idempotency_key_path (webhook + event triggers): when present it must
+// be a non-empty string. `label` distinguishes the trigger type in the message.
+function validateOptionalIdempotencyKeyPath(value, path, label, add) {
+    if (value !== undefined && value !== null && !isNonEmptyString(value)) {
+        add(`${path}.idempotency_key_path`, "invalid_idempotency_key_path", `${label} idempotency path is invalid.`);
+    }
+}
 function validateTrigger(// skipcq: JS-R1005
 value, path, add) {
     if (!isRecord(value)) {
         add(path, "invalid_trigger", "Workflow trigger must be an object.");
         return;
     }
-    if (value.status !== undefined && value.status !== "active" && value.status !== "disabled") {
+    if (value.status !== undefined && !isValidWorkflowStatus(value.status)) {
         add(`${path}.status`, "invalid_trigger_status", "Trigger status must be active or disabled.");
     }
     if (value.type === "api")
@@ -1057,11 +1062,7 @@ value, path, add) {
         if (!isNonEmptyString(value.trigger_id)) {
             add(`${path}.trigger_id`, "invalid_trigger_id", "Webhook trigger_id is required.");
         }
-        if (value.idempotency_key_path !== undefined
-            && value.idempotency_key_path !== null
-            && !isNonEmptyString(value.idempotency_key_path)) {
-            add(`${path}.idempotency_key_path`, "invalid_idempotency_key_path", "Webhook idempotency path is invalid.");
-        }
+        validateOptionalIdempotencyKeyPath(value.idempotency_key_path, path, "Webhook", add);
         return;
     }
     if (value.type === "cron") {
@@ -1085,11 +1086,7 @@ value, path, add) {
         if (!isNonEmptyString(value.event)) {
             add(`${path}.event`, "invalid_event_type", "Event trigger event is required.");
         }
-        if (value.idempotency_key_path !== undefined
-            && value.idempotency_key_path !== null
-            && !isNonEmptyString(value.idempotency_key_path)) {
-            add(`${path}.idempotency_key_path`, "invalid_idempotency_key_path", "Event idempotency path is invalid.");
-        }
+        validateOptionalIdempotencyKeyPath(value.idempotency_key_path, path, "Event", add);
         if (value.filters !== undefined)
             validateEventFilters(value.filters, `${path}.filters`, add);
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxygen-agent/cli",
-  "version": "1.152.15",
+  "version": "1.162.10",
   "private": false,
   "license": "UNLICENSED",
   "type": "module",