@soat/cli 0.52.0 → 0.53.0

package/dist/index.mjs

@@ -13,7 +13,7 @@ import * as os from "node:os";
 import { createHmac, timingSafeEqual } from "node:crypto";
 
 //#region package.json
-var version = "0.52.0";
+var version = "0.53.0";
 
 //#endregion
 //#region src/cli-wrappers/wrappers/formations.ts
@@ -832,7 +832,7 @@ var routes = {
       "in": "body"
     }, {
       "name": "boundary_policy",
-      "description": "",
+      "description": "Restricts which SOAT actions the agent may invoke. Evaluated as the intersection with the caller's own policy, so it can only narrow.",
       "required": false,
       "type": "object",
       "in": "body"
@@ -996,7 +996,7 @@ var routes = {
       "in": "body"
     }, {
       "name": "boundary_policy",
-      "description": "",
+      "description": "Restricts which SOAT actions the agent may invoke. Evaluated as the intersection with the caller's own policy, so it can only narrow.",
       "required": false,
       "type": "object",
       "in": "body"
@@ -1144,7 +1144,7 @@ var routes = {
       "in": "body"
     }, {
       "name": "boundary_policy",
-      "description": "",
+      "description": "Restricts which SOAT actions the agent may invoke. Evaluated as the intersection with the caller's own policy, so it can only narrow.",
       "required": false,
       "type": "object",
       "in": "body"
@@ -9451,6 +9451,19 @@ var findUnknownFlags = args => {
 
 //#endregion
 //#region src/webhookSignature.ts
+/**
+* Verification of the signature on a payload the local `soat listen` listener
+* receives. The listener takes two kinds, both under `X-Soat-Signature`,
+* distinguished by the value's own prefix rather than by header name:
+*
+* - A **webhook delivery** carries `t=<unix>,v1=<hex>` — a digest over
+*   `<t>.<raw body>`, so the timestamp is authenticated and a subscriber can
+*   bound a replay by age.
+* - A **trigger** payload carries `sha256=<hex>`, a digest over the bare
+*   body, which is the scheme a webhook-type trigger's sender signs with.
+*/
+/** Only the timestamped scheme starts this way; everything else is bare-body. */
+var TIMESTAMPED_PREFIX = "t=";
 var digestMatches = args => {
   const expectedBuffer = Buffer.from(args.expected, "utf8");
   const actualBuffer = Buffer.from(args.actual, "utf8");
@@ -9495,10 +9508,8 @@ var headerValue = value => {
 * Picks the scheme a delivery used and verifies it, when a secret is supplied.
 */
 var inspectDeliverySignature = args => {
-  const timestamped = headerValue(args.headers["x-soat-signature-v2"]);
-  const bareBody = headerValue(args.headers["x-soat-signature"]);
-  const scheme = timestamped ? "v2" : "v1";
-  const signature = timestamped || bareBody;
+  const signature = headerValue(args.headers["x-soat-signature"]);
+  const scheme = signature.startsWith(TIMESTAMPED_PREFIX) ? "v2" : "v1";
   if (!args.secret) return {
     signature,
     scheme,
@@ -9510,11 +9521,11 @@ var inspectDeliverySignature = args => {
     valid: scheme === "v2" ? verifyTimestampedSignature({
       secret: args.secret,
       payload: args.payload,
-      header: timestamped
+      header: signature
     }) : verifyBareBodySignature({
       secret: args.secret,
       payload: args.payload,
-      header: bareBody
+      header: signature
     })
   };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soat/cli",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "description": "CLI for SOAT — open-source infrastructure for production-ready AI agents.",
   "keywords": [
     "ai-agents",
@@ -22,7 +22,7 @@
   "dependencies": {
     "@inquirer/input": "^5.1.6",
     "@inquirer/password": "^5.2.2",
-    "@soat/sdk": "0.52.0",
+    "@soat/sdk": "0.53.0",
     "@ttoss/logger": "^0.8.20",
     "commander": "^15.0.0",
     "js-yaml": "^5.4.2"