@soat/cli 0.62.0 → 0.64.0

package/dist/index.mjs

@@ -13,7 +13,7 @@ import * as os from "node:os";
 import { createHmac, timingSafeEqual } from "node:crypto";
 
 //#region package.json
-var version = "0.62.0";
+var version = "0.64.0";
 
 //#endregion
 //#region src/cli-wrappers/wrappers/formations.ts
@@ -780,6 +780,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "merge-actor-tags": {
@@ -798,6 +804,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "list-agents": {
@@ -2850,6 +2862,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "merge-conversation-tags": {
@@ -2868,6 +2886,378 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
+    }]
+  },
+  "list-deciders": {
+    serviceClass: "Deciders",
+    operationId: "listDeciders",
+    description: "Returns the deciders defined in a project, newest first.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "get",
+    pathParams: [],
+    queryParams: ["project_id", "limit", "offset"],
+    headerParams: [],
+    cookieParams: [],
+    flags: [{
+      "name": "project_id",
+      "description": "Project ID (required if not using project key auth)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "limit",
+      "description": "Maximum number of results to return",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }, {
+      "name": "offset",
+      "description": "Number of results to skip",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }]
+  },
+  "create-decider": {
+    serviceClass: "Deciders",
+    operationId: "createDecider",
+    description: "Creates a decider at version 1: a named question set and the backend that answers it, exactly one of `agent_id` and `tool_id`. Every question declares a finite answer space, validated here. The backend must be in the decider's project. An agent must carry no tool surface — no tool binding left active by `active_tool_ids` and no `knowledge_config.write_memory_store_id` — or the create is refused with `400 DECIDER_AGENT_NOT_TOOL_LESS`. A tool must be `http` or `pipeline` and must not pin `state` or `questions` in its `preset_parameters`, or the create is refused with `400 DECIDER_TOOL_NOT_CALLABLE`. A duplicate `name` in the project is `409 NAME_CONFLICT`.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "post",
+    pathParams: [],
+    queryParams: [],
+    headerParams: [],
+    cookieParams: [],
+    flags: [{
+      "name": "project_id",
+      "description": "Project ID (required if not using project key auth)",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "name",
+      "description": "Human-readable name, unique per project",
+      "required": true,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "description",
+      "description": "",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "agent_id",
+      "description": "A tool-less agent that answers",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "tool_id",
+      "description": "An http or pipeline tool that answers",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "questions",
+      "description": "Question id → question, 1 to 20 of them. A question id starts with a letter or underscore and holds only letters, digits and underscores (at most 64), since it keys the answer object.",
+      "required": true,
+      "type": "object",
+      "in": "body"
+    }, {
+      "name": "version_label",
+      "description": "Optional tag for version 1, e.g. `initial`",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }]
+  },
+  "get-decider": {
+    serviceClass: "Deciders",
+    operationId: "getDecider",
+    description: "Returns a decider with its current question set and version.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "get",
+    pathParams: ["decider_id"],
+    queryParams: [],
+    headerParams: [],
+    cookieParams: [],
+    flags: [{
+      "name": "decider_id",
+      "description": "The decider ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }]
+  },
+  "update-decider": {
+    serviceClass: "Deciders",
+    operationId: "updateDecider",
+    description: "Updates any of `name`, `description`, the backend and `questions`. Naming `agent_id` or `tool_id` replaces the current backend; naming both is `400`. Only a change to `questions` archives a new version; a rename, a new backend or a rewrite of the questions the decider already holds leaves `version` where it is. A new backend is held to the same rules as on create.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "patch",
+    pathParams: ["decider_id"],
+    queryParams: [],
+    headerParams: ["If-Match"],
+    cookieParams: [],
+    flags: [{
+      "name": "decider_id",
+      "description": "The decider ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }, {
+      "name": "If-Match",
+      "description": "The version the caller believes the resource holds, as an entity tag (`3` or `\"3\"`). Equivalent to `expected_version` in the request body; `*` states no precondition beyond the resource existing. A mismatch is `409 VERSION_CONFLICT`.",
+      "required": false,
+      "type": "string",
+      "in": "header"
+    }, {
+      "name": "name",
+      "description": "",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "description",
+      "description": "",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "agent_id",
+      "description": "Replaces the backend with this agent",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "tool_id",
+      "description": "Replaces the backend with this tool",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "questions",
+      "description": "Question id → question, 1 to 20 of them. A question id starts with a letter or underscore and holds only letters, digits and underscores (at most 64), since it keys the answer object.",
+      "required": false,
+      "type": "object",
+      "in": "body"
+    }, {
+      "name": "version_label",
+      "description": "Optional tag for the version this write archives. Ignored when the write changes no question, since no version is archived.",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }, {
+      "name": "expected_version",
+      "description": "Refuses the write unless the decider is at this version.",
+      "required": false,
+      "type": "integer",
+      "in": "body"
+    }]
+  },
+  "delete-decider": {
+    serviceClass: "Deciders",
+    operationId: "deleteDecider",
+    description: "Deletes a decider and its version archive. Its decisions remain and keep naming the decider's ID.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "delete",
+    pathParams: ["decider_id"],
+    queryParams: [],
+    headerParams: [],
+    cookieParams: [],
+    flags: [{
+      "name": "decider_id",
+      "description": "The decider ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }]
+  },
+  "list-decider-versions": {
+    serviceClass: "Deciders",
+    operationId: "listDeciderVersions",
+    description: "Returns the decider's archived question sets, newest first. A version is written on create and on every write that changes `questions`.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "get",
+    pathParams: ["decider_id"],
+    queryParams: ["limit", "offset"],
+    headerParams: [],
+    cookieParams: [],
+    flags: [{
+      "name": "decider_id",
+      "description": "The decider ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }, {
+      "name": "limit",
+      "description": "Maximum number of results to return",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }, {
+      "name": "offset",
+      "description": "Number of results to skip",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }]
+  },
+  "get-decider-version": {
+    serviceClass: "Deciders",
+    operationId: "getDeciderVersion",
+    description: "Returns the question set a version held. A decision names the `decider_version` it was answered under, so this is how its criteria are read after the decider has changed.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "get",
+    pathParams: ["decider_id", "version"],
+    queryParams: [],
+    headerParams: [],
+    cookieParams: [],
+    flags: [{
+      "name": "decider_id",
+      "description": "The decider ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }, {
+      "name": "version",
+      "description": "The archived version number",
+      "required": true,
+      "type": "integer",
+      "in": "path"
+    }]
+  },
+  "restore-decider-version": {
+    serviceClass: "Deciders",
+    operationId: "restoreDeciderVersion",
+    description: "Writes an archived question set back as the decider's live one, which archives it again as a new version rather than rewinding the counter. Restoring the question set the decider already holds is a no-op.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "post",
+    pathParams: ["decider_id", "version"],
+    queryParams: [],
+    headerParams: [],
+    cookieParams: [],
+    flags: [{
+      "name": "decider_id",
+      "description": "The decider ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }, {
+      "name": "version",
+      "description": "The archived version number",
+      "required": true,
+      "type": "integer",
+      "in": "path"
+    }, {
+      "name": "label",
+      "description": "Optional tag for the new version. Defaults to `restored from vN`.",
+      "required": false,
+      "type": "string",
+      "in": "body"
+    }]
+  },
+  "create-decision": {
+    serviceClass: "Deciders",
+    operationId: "createDecision",
+    description: "Evaluates the decider against `state` and records the decision. The questions come from the decider, never from the request, so a call site can only supply what is judged. Everything that can refuse the request is checked before the decision is written, so a refusal is a `4xx` and never a polled failure: the agent's tool surface (`400 DECIDER_AGENT_NOT_TOOL_LESS`), a tool that cannot answer (`400 DECIDER_TOOL_NOT_CALLABLE`), a paused project (`409 PROJECT_PAUSED`) and, for an agent, quota admission (`429 QUOTA_EXCEEDED`). A tool backend is called with `{ state, questions }` and must answer `{ answers: { <question id>: { choice | score | value, probabilities? } } }`; an answer outside that contract fails the decision with `DECISION_ANSWER_INVALID`. With `wait: false`, the default, the answer is `201` with the decision `queued`; poll `GET /api/v1/decisions/{decision_id}` or subscribe to `decisions.completed` and `decisions.failed`. With `wait: true` it is `201` with the decision settled.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "post",
+    pathParams: ["decider_id"],
+    queryParams: [],
+    headerParams: [],
+    cookieParams: [],
+    flags: [{
+      "name": "decider_id",
+      "description": "The decider ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
+    }, {
+      "name": "state",
+      "description": "What is judged: any JSON value. A string reaches the agent verbatim; anything else is serialized as JSON. Not stored.",
+      "required": true,
+      "type": "unknown",
+      "in": "body"
+    }, {
+      "name": "metadata",
+      "description": "Caller-owned annotations stored on the decision and returned on every read — typically the id of what was judged, since the state itself is not stored. Written once, with the decision. A non-object is rejected with `400 VALIDATION_FAILED` and no decision is written.",
+      "required": false,
+      "type": "object",
+      "in": "body"
+    }, {
+      "name": "wait",
+      "description": "True evaluates before answering and returns the settled decision. False — the default — returns the `queued` decision at once. A `builtin` tool call always waits.",
+      "required": false,
+      "type": "boolean",
+      "in": "body"
+    }]
+  },
+  "list-decisions": {
+    serviceClass: "Deciders",
+    operationId: "listDecisions",
+    description: "Returns the decisions in a project, newest first.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "get",
+    pathParams: [],
+    queryParams: ["project_id", "decider_id", "status", "limit", "offset"],
+    headerParams: [],
+    cookieParams: [],
+    flags: [{
+      "name": "project_id",
+      "description": "Project ID (required if not using project key auth)",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "decider_id",
+      "description": "Only decisions requested from this decider",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "status",
+      "description": "Only decisions in this status",
+      "required": false,
+      "type": "string",
+      "in": "query"
+    }, {
+      "name": "limit",
+      "description": "Maximum number of results to return",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }, {
+      "name": "offset",
+      "description": "Number of results to skip",
+      "required": false,
+      "type": "integer",
+      "in": "query"
+    }]
+  },
+  "get-decision": {
+    serviceClass: "Deciders",
+    operationId: "getDecision",
+    description: "Returns a decision. Poll it after a `wait: false` request until `status` is `completed` or `failed`.",
+    moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/deciders",
+    httpMethod: "get",
+    pathParams: ["decision_id"],
+    queryParams: [],
+    headerParams: [],
+    cookieParams: [],
+    flags: [{
+      "name": "decision_id",
+      "description": "The decision ID",
+      "required": true,
+      "type": "string",
+      "in": "path"
     }]
   },
   "list-documents": {
@@ -3504,6 +3894,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "merge-document-tags": {
@@ -3522,6 +3918,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "create-embeddings": {
@@ -4662,6 +5064,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "merge-file-tags": {
@@ -4680,6 +5088,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "validate-formation": {
@@ -5988,6 +6402,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "merge-memory-tags": {
@@ -6006,6 +6426,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "list-memory-rules": {
@@ -6522,6 +6948,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "merge-memory-store-tags": {
@@ -6540,6 +6972,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "list-metadata-schemas": {
@@ -8520,6 +8958,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "merge-session-tags": {
@@ -8538,6 +8982,12 @@ var routes = {
       "required": true,
       "type": "string",
       "in": "path"
+    }, {
+      "name": "tags",
+      "description": "Key-value labels on a resource. A flat object of string values — an array, a nested object or a number is rejected with `400 VALIDATION_FAILED`, never coerced. Keys are opaque and stored verbatim, so `cost_center` and `costCenter` are two different tags. Matched by JSONB containment wherever tags are read: the `?tags=` filter, knowledge search, and the IAM `soat:ResourceTag/<key>` condition.\n\nKeys beginning `system.` are reserved: the platform writes them to record which conversation, actor, agent and role a row came from, and a write naming one is refused with `400 RESERVED_TAG_KEY`. They are read and filtered like any other tag.\n\nThe bag is bounded, because every pair reaches the IAM context of every access check on the resource: at most 50 keys, each key at most 128 characters and each value at most 256. A write past a bound — including a merge that would grow the stored bag past the key count — is `400 VALIDATION_FAILED` with `meta.limit` naming the bound it crossed. `system.*` keys are the platform's and do not count against the 50.",
+      "required": true,
+      "type": "object",
+      "in": "body-root"
     }]
   },
   "list-tasks": {
@@ -9071,7 +9521,7 @@ var routes = {
   "delete-tool": {
     serviceClass: "Tools",
     operationId: "deleteTool",
-    description: "Deletes a tool by ID.",
+    description: "Deletes a tool by ID. A tool that is a decider's backend is refused with `409 TOOL_HAS_DEPENDENTS`.",
     moduleDocsUrl: "https://soat.ttoss.dev/docs/modules/tools",
     httpMethod: "delete",
     pathParams: ["tool_id"],
@@ -9674,7 +10124,7 @@ var routes = {
       "in": "query"
     }, {
       "name": "source",
-      "description": "Filter by what the spend was incurred for. `eval` is an eval run's item generations, `eval_judge` an `llm_judge` scorer's own completion and `eval_scorer` a `tool` scorer's call, so verification spend is `source` in (`eval`, `eval_judge`, `eval_scorer`); `embedding` is any embedding call. Ordinary agent traffic carries no source and is matched by none of them.\n",
+      "description": "Filter by what the spend was incurred for. `eval` is an eval run's item generations, `eval_judge` an `llm_judge` scorer's own completion and `eval_scorer` a `tool` scorer's call, so verification spend is `source` in (`eval`, `eval_judge`, `eval_scorer`); `decider` is a decision's evaluation; `embedding` is any embedding call. Ordinary agent traffic carries no source and is matched by none of them.\n",
       "required": false,
       "type": "string",
       "in": "query"
@@ -9794,7 +10244,7 @@ var routes = {
       "in": "query"
     }, {
       "name": "source",
-      "description": "Narrow by what the spend was incurred for — `eval` and `eval_judge` are verification spend. Ordinary traffic carries no source, so it cannot be selected by this filter; omit the filter for everything.\n",
+      "description": "Narrow by what the spend was incurred for — `eval` and `eval_judge` are verification spend, `decider` is decision spend. Ordinary traffic carries no source, so it cannot be selected by this filter; omit the filter for everything.\n",
       "required": false,
       "type": "string",
       "in": "query"
@@ -11071,6 +11521,10 @@ program.argument("[command]", "API command in kebab-case (e.g. list-actors)").ar
   const pathArgs = {};
   const queryArgs = {};
   const bodyArgs = {};
+  const rootBodyFlag = route.flags.find(f => {
+    return f.in === "body-root";
+  });
+  let rootBody;
   for (const [flagKey, val] of Object.entries(flags)) {
     if (flagKey === "profile" || flagKey === "id") continue;
     const canonical = toCanonical(flagKey);
@@ -11082,7 +11536,9 @@ program.argument("[command]", "API command in kebab-case (e.g. list-actors)").ar
     const queryParam = route.queryParams.find(p => {
       return toCanonical(p) === canonical;
     });
-    if (pathParam) pathArgs[pathParam] = parsedValue;else if (queryParam) queryArgs[queryParam] = parsedValue;else if (route.httpMethod === "get") queryArgs[kebabToSnake(flagKey)] = parsedValue;else bodyArgs[kebabToSnake(flagKey)] = parsedValue;
+    if (pathParam) pathArgs[pathParam] = parsedValue;else if (rootBodyFlag && canonical === toCanonical(rootBodyFlag.name)) rootBody = {
+      value: parsedValue
+    };else if (queryParam) queryArgs[queryParam] = parsedValue;else if (route.httpMethod === "get") queryArgs[kebabToSnake(flagKey)] = parsedValue;else bodyArgs[kebabToSnake(flagKey)] = parsedValue;
   }
   const positionalArgs = extractPositionalArgs({
     cliArgs: rawArgs
@@ -11116,6 +11572,15 @@ program.argument("[command]", "API command in kebab-case (e.g. list-actors)").ar
   if (Object.keys(pathArgs).length) callOpts["path"] = pathArgs;
   if (Object.keys(queryArgs).length) callOpts["query"] = queryArgs;
   if (Object.keys(bodyArgs).length) callOpts["body"] = bodyArgs;
+  if (rootBody) {
+    if (Object.keys(bodyArgs).length) {
+      console.error(`Unknown flag(s) ${Object.keys(bodyArgs).map(key => {
+        return `--${toKebab(key)}`;
+      }).join(", ")}: '${commandName}' sends its whole body in --${toKebab(rootBodyFlag?.name ?? "")}.`);
+      process.exit(1);
+    }
+    callOpts["body"] = rootBody.value;
+  }
   const result = await method(callOpts);
   if (result.error) {
     const status = result.response && "status" in result.response ? result.response.status : void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soat/cli",
-  "version": "0.62.0",
+  "version": "0.64.0",
   "description": "CLI for SOAT — open-source infrastructure for production-ready AI agents.",
   "keywords": [
     "ai-agents",
@@ -22,14 +22,14 @@
   "dependencies": {
     "@inquirer/input": "^5.1.6",
     "@inquirer/password": "^5.2.2",
-    "@soat/sdk": "0.62.0",
+    "@soat/sdk": "0.64.0",
     "@ttoss/logger": "^0.8.20",
     "commander": "^15.0.0",
     "js-yaml": "^5.4.2"
   },
   "devDependencies": {
     "@ttoss/config": "^1.38.0",
-    "@ttoss/openapi-codegen": "^0.4.0",
+    "@ttoss/openapi-codegen": "^0.5.0",
     "@ttoss/test-utils": "^4.2.19",
     "@types/jest": "^30.0.0",
     "@types/node": "^26.5.1",