@soat/cli 0.52.0 → 0.54.0

package/dist/index.mjs

@@ -13,7 +13,7 @@ import * as os from "node:os";
 import { createHmac, timingSafeEqual } from "node:crypto";
 
 //#region package.json
-var version = "0.52.0";
+var version = "0.54.0";
 
 //#endregion
 //#region src/cli-wrappers/wrappers/formations.ts
@@ -437,11 +437,11 @@ var routes = {
   "list-activity": {
     serviceClass: "Activity",
     operationId: "listActivity",
-    description: "Returns activity entries for a project, newest first, filterable by kind and severity. Paginated with an opaque cursor rather than offset/limit — pass the previous page's `next_cursor` to fetch the next one; a `null` `next_cursor` means there is no more data.",
+    description: "Returns activity entries for a project, newest first, filterable by kind, severity, agent, generation and orchestration run — every filter composable with the rest. Paginated with an opaque cursor rather than offset/limit — pass the previous page's `next_cursor` to fetch the next one; a `null` `next_cursor` means there is no more data.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/activity",
     httpMethod: "get",
     pathParams: [],
-    queryParams: ["project_id", "kind", "severity", "cursor", "limit"],
+    queryParams: ["project_id", "kind", "severity", "agent_id", "generation_id", "orchestration_run_id", "cursor", "limit"],
     flags: [{
       "name": "project_id",
       "description": "Project ID (required if not using project key auth)",
@@ -460,6 +460,24 @@ var routes = {
       "required": false,
       "type": "string",
       "in": "query"
+    }, {
+      "name": "agent_id",
+      "description": "Filter to entries produced by one agent. Composable with every other filter — entries carry one agent, one generation and one run, so naming two narrows to the rows where both hold.",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "generation_id",
+      "description": "Filter to entries produced during one agent generation. This is what turns `tool_resolution_failed` from alertable into usable: the warning for a suspect turn is one query rather than a scan of the project's feed.",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "orchestration_run_id",
+      "description": "Filter to entries produced during one orchestration run.",
+      "required": false,
+      "type": "string",
+      "in": "query"
     }, {
       "name": "cursor",
       "description": "Opaque cursor from a previous page's `next_cursor`",
@@ -832,7 +850,7 @@ var routes = {
       "in": "body"
     }, {
       "name": "boundary_policy",
-      "description": "",
+      "description": "Restricts which SOAT actions the agent may invoke. Evaluated as the intersection with the caller's own policy, so it can only narrow.",
       "required": false,
       "type": "object",
       "in": "body"
@@ -996,7 +1014,7 @@ var routes = {
       "in": "body"
     }, {
       "name": "boundary_policy",
-      "description": "",
+      "description": "Restricts which SOAT actions the agent may invoke. Evaluated as the intersection with the caller's own policy, so it can only narrow.",
       "required": false,
       "type": "object",
       "in": "body"
@@ -1144,7 +1162,7 @@ var routes = {
       "in": "body"
     }, {
       "name": "boundary_policy",
-      "description": "",
+      "description": "Restricts which SOAT actions the agent may invoke. Evaluated as the intersection with the caller's own policy, so it can only narrow.",
       "required": false,
       "type": "object",
       "in": "body"
@@ -6284,6 +6302,12 @@ var routes = {
       "required": false,
       "type": "object",
       "in": "body"
+    }, {
+      "name": "idempotency_key",
+      "description": "Deduplication key, unique within the project, that makes a retry of an ambiguous failure safe. The first request under a key starts the run and answers `201`; any later request carrying the same key answers `200` with that same run, whatever state it has reached — including a retry that arrives while the original is still running.\n\nThe key is claimed by the run record and stays claimed for as long as the record exists, so it never silently expires and lets a second run through.\n\n`orchestration_id`, `input`, `tool_context` and `metadata` are the request the key names: reusing a key with any of them changed is `409 IDEMPOTENCY_KEY_REUSED` rather than a replay of a run that does something else. `wait` is not part of that comparison — it says how the caller waits, not what the run is — so a retry may flip it.",
+      "required": false,
+      "type": "string",
+      "in": "body"
     }, {
       "name": "wait",
       "description": "When true, block until the run reaches a terminal (succeeded/failed) or awaiting_input state and return the settled run. When false (default), return immediately with status \"queued\" and execute the run in the background.",
@@ -9451,6 +9475,19 @@ var findUnknownFlags = args => {
 
 //#endregion
 //#region src/webhookSignature.ts
+/**
+* Verification of the signature on a payload the local `soat listen` listener
+* receives. The listener takes two kinds, both under `X-Soat-Signature`,
+* distinguished by the value's own prefix rather than by header name:
+*
+* - A **webhook delivery** carries `t=<unix>,v1=<hex>` — a digest over
+*   `<t>.<raw body>`, so the timestamp is authenticated and a subscriber can
+*   bound a replay by age.
+* - A **trigger** payload carries `sha256=<hex>`, a digest over the bare
+*   body, which is the scheme a webhook-type trigger's sender signs with.
+*/
+/** Only the timestamped scheme starts this way; everything else is bare-body. */
+var TIMESTAMPED_PREFIX = "t=";
 var digestMatches = args => {
   const expectedBuffer = Buffer.from(args.expected, "utf8");
   const actualBuffer = Buffer.from(args.actual, "utf8");
@@ -9495,10 +9532,8 @@ var headerValue = value => {
 * Picks the scheme a delivery used and verifies it, when a secret is supplied.
 */
 var inspectDeliverySignature = args => {
-  const timestamped = headerValue(args.headers["x-soat-signature-v2"]);
-  const bareBody = headerValue(args.headers["x-soat-signature"]);
-  const scheme = timestamped ? "v2" : "v1";
-  const signature = timestamped || bareBody;
+  const signature = headerValue(args.headers["x-soat-signature"]);
+  const scheme = signature.startsWith(TIMESTAMPED_PREFIX) ? "v2" : "v1";
   if (!args.secret) return {
     signature,
     scheme,
@@ -9510,11 +9545,11 @@ var inspectDeliverySignature = args => {
     valid: scheme === "v2" ? verifyTimestampedSignature({
       secret: args.secret,
       payload: args.payload,
-      header: timestamped
+      header: signature
     }) : verifyBareBodySignature({
       secret: args.secret,
       payload: args.payload,
-      header: bareBody
+      header: signature
     })
   };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soat/cli",
-  "version": "0.52.0",
+  "version": "0.54.0",
   "description": "CLI for SOAT — open-source infrastructure for production-ready AI agents.",
   "keywords": [
     "ai-agents",
@@ -22,7 +22,7 @@
   "dependencies": {
     "@inquirer/input": "^5.1.6",
     "@inquirer/password": "^5.2.2",
-    "@soat/sdk": "0.52.0",
+    "@soat/sdk": "0.54.0",
     "@ttoss/logger": "^0.8.20",
     "commander": "^15.0.0",
     "js-yaml": "^5.4.2"