sovaria-cli 0.2.5__tar.gz → 0.2.8__tar.gz

sovaria_cli-0.2.8/.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

sovaria_cli-0.2.8/.github/workflows/ci.yml

@@ -0,0 +1,174 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_call:
+
+jobs:
+  secret-scan:
+    name: Secret scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install Gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/gitleaks_8.24.2_linux_x64.tar.gz -o /tmp/gitleaks.tar.gz
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp
+          sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks
+      - name: Run Gitleaks
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            RANGE="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
+          else
+            RANGE="HEAD~1..HEAD"
+          fi
+          echo "Scanning commit range: $RANGE"
+          gitleaks detect --source . --redact --no-banner --config .gitleaks.toml --log-opts="$RANGE"
+
+  lint:
+    name: Ruff
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install ruff
+        run: pip install "ruff>=0.9"
+      - name: Ruff check
+        run: |
+          ruff check \
+            apps/cli/src/commands/login.py \
+            apps/cli/src/commands/deploy.py \
+            apps/cli/src/commands/realtime.py \
+            apps/cli/src/utils/api_client.py \
+            apps/cli/src/utils/auth_store.py \
+            apps/cli/src/utils/config.py \
+            apps/cli/tests/test_aug18_cli_tickets.py \
+            apps/cli/tests/test_config_profiles.py
+
+  typecheck:
+    name: Mypy
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    env:
+      # Fine-grained token with contents:read on sovaria/sovaria-sdk. Without it, CI installs the
+      # pinned SDK release from PyPI instead.
+      SDK_TOKEN: ${{ secrets.SOVARIA_SDK_READ_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check out the matching SDK (when SOVARIA_SDK_READ_TOKEN is set)
+        if: env.SDK_TOKEN != ''
+        uses: actions/checkout@v4
+        with:
+          repository: sovaria/sovaria-sdk
+          path: sovaria-sdk
+          token: ${{ env.SDK_TOKEN }}
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install SDK + CLI
+        run: |
+          set -euo pipefail
+          if [ -f ../sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e ../sovaria-sdk/apps/sdk/python
+          elif [ -f sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e sovaria-sdk/apps/sdk/python
+          else
+            pip install "sovaria-sdk==0.4.0"
+          fi
+          pip install -e ".[dev]"
+      - name: Mypy
+        run: |
+          mypy \
+            apps/cli/src/commands/login.py \
+            apps/cli/src/commands/deploy.py \
+            apps/cli/src/commands/realtime.py \
+            apps/cli/src/utils/api_client.py \
+            apps/cli/src/utils/auth_store.py \
+            apps/cli/src/utils/config.py
+
+  install-requirements:
+    name: requirements.txt install
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    env:
+      # Fine-grained token with contents:read on sovaria/sovaria-sdk. Without it, CI installs the
+      # pinned SDK release from PyPI instead.
+      SDK_TOKEN: ${{ secrets.SOVARIA_SDK_READ_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check out the matching SDK (when SOVARIA_SDK_READ_TOKEN is set)
+        if: env.SDK_TOKEN != ''
+        uses: actions/checkout@v4
+        with:
+          repository: sovaria/sovaria-sdk
+          path: sovaria-sdk
+          token: ${{ env.SDK_TOKEN }}
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install from requirements.txt
+        run: |
+          set -euo pipefail
+          if [ -f ../sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e ../sovaria-sdk/apps/sdk/python
+          elif [ -f sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e sovaria-sdk/apps/sdk/python
+          else
+            pip install "sovaria-sdk==0.4.0"
+          fi
+          pip install -r requirements.txt
+          pip install --no-deps .
+      - name: sov --help
+        run: sov --help
+
+  test:
+    runs-on: ubuntu-latest
+    needs: secret-scan
+    env:
+      SDK_TOKEN: ${{ secrets.SOVARIA_SDK_READ_TOKEN }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check out the matching SDK (when SOVARIA_SDK_READ_TOKEN is set)
+        if: env.SDK_TOKEN != ''
+        uses: actions/checkout@v4
+        with:
+          repository: sovaria/sovaria-sdk
+          path: sovaria-sdk
+          token: ${{ env.SDK_TOKEN }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install SDK + CLI
+        run: |
+          set -euo pipefail
+          if [ -f ../sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e ../sovaria-sdk/apps/sdk/python
+          elif [ -f sovaria-sdk/apps/sdk/python/pyproject.toml ]; then
+            pip install -e sovaria-sdk/apps/sdk/python
+          else
+            pip install "sovaria-sdk==0.4.0"
+          fi
+          pip install -e ".[dev]"
+
+      - name: Run tests
+        run: pytest apps/cli/tests -q
+
+      - name: Build wheel
+        run: python -m build
+
+      - name: Validate wheel metadata
+        run: python -m twine check dist/*

{sovaria_cli-0.2.5 → sovaria_cli-0.2.8}/.github/workflows/publish.yml

@@ -8,8 +8,13 @@ on:
         required: true
 
 jobs:
+  test:
+    if: github.event.inputs.confirm == 'publish'
+    uses: ./.github/workflows/ci.yml
+
   publish:
     if: github.event.inputs.confirm == 'publish'
+    needs: test
     runs-on: ubuntu-latest
     environment: pypi
     permissions:

{sovaria_cli-0.2.5 → sovaria_cli-0.2.8}/.gitignore

@@ -4,3 +4,7 @@ __pycache__/
 .mypy_cache/
 dist/
 *.egg-info/
+.env
+.env.*
+!.env.example
+!.env.*.example

sovaria_cli-0.2.8/.gitleaks.toml

@@ -0,0 +1,17 @@
+title = "Sovaria CLI gitleaks config"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Placeholder credentials and CLI test fixtures"
+paths = [
+  '''\.env\.example$''',
+  '''apps/cli/tests/''',
+]
+regexes = [
+  '''change-me''',
+  '''CHANGE_ME''',
+  '''do-not-use-in-prod''',
+  '''replace-with''',
+]

{sovaria_cli-0.2.5 → sovaria_cli-0.2.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sovaria-cli
-Version: 0.2.5
+Version: 0.2.8
 Summary: Sovaria BaaS command-line interface (sov)
 Project-URL: Homepage, https://sovaria.in
 Project-URL: Documentation, https://docs.sovaria.in/cli
@@ -11,14 +11,18 @@ Requires-Python: >=3.11
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: keyring>=25.0
 Requires-Dist: pyyaml>=6.0
-Requires-Dist: sovaria-sdk>=0.2.0
+Requires-Dist: rich>=13.7.0
+Requires-Dist: sovaria-sdk==0.4.0
 Requires-Dist: tomli-w>=1.2.0
 Requires-Dist: typer>=0.17.4
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.13; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: ruff>=0.9; extra == 'dev'
 Requires-Dist: twine>=6.0; extra == 'dev'
+Provides-Extra: mcp
+Requires-Dist: sovaria-sdk[mcp]==0.4.0; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # Sovaria CLI
@@ -60,6 +64,43 @@ scripts/cli_sdk_happy_path.sh
 
 If you already have valid CLI tokens, omit `SOVARIA_EMAIL` and `SOVARIA_PASSWORD`.
 
+## Authentication
+
+```bash
+sov login
+sov login --email you@example.com
+sov login --file-storage          # headless: tokens in ~/.sovaria/credentials.toml
+sov logout
+sov logout --force                # clear local tokens if server revoke fails
+```
+
+- **Browser (PKCE):** authorize opens the console origin (`get_console_url`); the token exchange POSTs to the gateway `api_url` `/oauth/token` proxy. That split is intentional.
+- **Password:** never pass `--password`. Operator login prompts with `getpass`, or reads `SOVARIA_PASSWORD`.
+- **Product user create:** `sov auth-product create --email ...` prompts for the new user's password, or reads `SOVARIA_USER_PASSWORD`. Do not reuse `SOVARIA_PASSWORD` (that is the operator login secret).
+- **Magic link:** `sov auth magic-link verify` reads the token from stdin or `SOVARIA_MAGIC_TOKEN`.
+- **GitHub deploy PAT:** set `SOVARIA_GITHUB_TOKEN` or use `gh auth token`. There is no `--token` flag.
+- **OAuth callback:** binds `127.0.0.1` by default. Non-loopback `SOVARIA_CLI_CALLBACK_HOST` requires `--insecure-callback`.
+
+### Token refresh contract
+
+Axis supports two refresh modes. Do not mix them:
+
+| Client | How refresh is sent |
+|---|---|
+| **CLI / Python SDK** | JSON body: `POST /api/v1/auth/refresh` with `{"refresh_token": "<stored>"}`. The CLI keeps the refresh token in OS keyring (or `credentials.toml` with `--file-storage`). |
+| **Console / browser** | Empty JSON body `{}` plus the HttpOnly refresh cookie. The browser never puts the refresh token in the request body. |
+
+Copying the console cookie pattern into a CLI or SDK client will fail silently (no cookie jar). Copying the CLI JSON-body pattern into a browser app bypasses HttpOnly cookie storage.
+
+### Pulse WebSocket URLs
+
+`sov realtime ws-url` issues an opaque `ticket=` query parameter. Never put a JWT in `?token=` — production gateways disable `GATEWAY_WS_ALLOW_QUERY_TOKEN`. Local `.env.local` may still enable the legacy query-token path; do not copy that into clients.
+
+```bash
+sov realtime ws-url my-channel --org <org_id> --project <project_id>
+# wss://api.sovaria.in/api/v1/rt/ws/my-channel?ticket=...&org_id=...&project_id=...
+```
+
 ## Core Command Groups
 
 - `sov auth ...` auth login/logout

{sovaria_cli-0.2.5 → sovaria_cli-0.2.8}/apps/cli/README.md

@@ -37,6 +37,43 @@ scripts/cli_sdk_happy_path.sh
 
 If you already have valid CLI tokens, omit `SOVARIA_EMAIL` and `SOVARIA_PASSWORD`.
 
+## Authentication
+
+```bash
+sov login
+sov login --email you@example.com
+sov login --file-storage          # headless: tokens in ~/.sovaria/credentials.toml
+sov logout
+sov logout --force                # clear local tokens if server revoke fails
+```
+
+- **Browser (PKCE):** authorize opens the console origin (`get_console_url`); the token exchange POSTs to the gateway `api_url` `/oauth/token` proxy. That split is intentional.
+- **Password:** never pass `--password`. Operator login prompts with `getpass`, or reads `SOVARIA_PASSWORD`.
+- **Product user create:** `sov auth-product create --email ...` prompts for the new user's password, or reads `SOVARIA_USER_PASSWORD`. Do not reuse `SOVARIA_PASSWORD` (that is the operator login secret).
+- **Magic link:** `sov auth magic-link verify` reads the token from stdin or `SOVARIA_MAGIC_TOKEN`.
+- **GitHub deploy PAT:** set `SOVARIA_GITHUB_TOKEN` or use `gh auth token`. There is no `--token` flag.
+- **OAuth callback:** binds `127.0.0.1` by default. Non-loopback `SOVARIA_CLI_CALLBACK_HOST` requires `--insecure-callback`.
+
+### Token refresh contract
+
+Axis supports two refresh modes. Do not mix them:
+
+| Client | How refresh is sent |
+|---|---|
+| **CLI / Python SDK** | JSON body: `POST /api/v1/auth/refresh` with `{"refresh_token": "<stored>"}`. The CLI keeps the refresh token in OS keyring (or `credentials.toml` with `--file-storage`). |
+| **Console / browser** | Empty JSON body `{}` plus the HttpOnly refresh cookie. The browser never puts the refresh token in the request body. |
+
+Copying the console cookie pattern into a CLI or SDK client will fail silently (no cookie jar). Copying the CLI JSON-body pattern into a browser app bypasses HttpOnly cookie storage.
+
+### Pulse WebSocket URLs
+
+`sov realtime ws-url` issues an opaque `ticket=` query parameter. Never put a JWT in `?token=` — production gateways disable `GATEWAY_WS_ALLOW_QUERY_TOKEN`. Local `.env.local` may still enable the legacy query-token path; do not copy that into clients.
+
+```bash
+sov realtime ws-url my-channel --org <org_id> --project <project_id>
+# wss://api.sovaria.in/api/v1/rt/ws/my-channel?ticket=...&org_id=...&project_id=...
+```
+
 ## Core Command Groups
 
 - `sov auth ...` auth login/logout

{sovaria_cli-0.2.5 → sovaria_cli-0.2.8}/apps/cli/src/__init__.py

@@ -1,3 +1,3 @@
 """Sovaria CLI — sov command."""
 
-__version__ = "0.2.4"
+__version__ = "0.2.8"

{sovaria_cli-0.2.5 → sovaria_cli-0.2.8}/apps/cli/src/commands/admin.py

@@ -7,7 +7,8 @@ from urllib.parse import quote, urlencode
 import typer
 
 from apps.cli.src.utils.api_client import CLIRequestError, call_api
-from apps.cli.src.utils.display import print_json
+from apps.cli.src.utils.display import handle_cli_error, handle_command_error, print_json
+from apps.cli.src.utils.project_context import resolve_org_id
 
 app = typer.Typer(help="Platform admin: error traces, usage, transparency")
 
@@ -52,8 +53,7 @@ def error_traces_list(
             params=params,
         )
     except CLIRequestError as exc:
-        typer.echo(str(exc), err=True)
-        raise typer.Exit(1) from exc
+        handle_cli_error(exc)
     print_json(result)
 
 
@@ -71,8 +71,7 @@ def error_traces_get(
             require_scope=False,
         )
     except CLIRequestError as exc:
-        typer.echo(str(exc), err=True)
-        raise typer.Exit(1) from exc
+        handle_cli_error(exc)
     print_json(result)
 
 
@@ -92,8 +91,7 @@ def error_traces_resolve(
             body={"resolved": resolved},
         )
     except CLIRequestError as exc:
-        typer.echo(str(exc), err=True)
-        raise typer.Exit(1) from exc
+        handle_cli_error(exc)
     print_json(result)
 
 
@@ -118,14 +116,13 @@ def usage_overview(
             params=params or None,
         )
     except CLIRequestError as exc:
-        typer.echo(str(exc), err=True)
-        raise typer.Exit(1) from exc
+        handle_cli_error(exc)
     print_json(result)
 
 
 @transparency_app.command("list")
 def transparency_list(
-    org_id: str = typer.Option(..., "--org", help="Organisation ID"),
+    org_id: str | None = typer.Option(None, "--org", help="Organisation ID (defaults to scoped org)"),
     project_id: str | None = typer.Option(None, "--project"),
     event_type: str | None = typer.Option(None, "--event-type"),
     since: str | None = typer.Option(None, "--since", help="ISO-8601 lower bound"),
@@ -134,8 +131,12 @@ def transparency_list(
     profile: str | None = typer.Option(None, "--profile"),
 ) -> None:
     """List tenant-visible staff access transparency events."""
+    try:
+        resolved_org = resolve_org_id(profile=profile, org_id=org_id, require=True)
+    except ValueError as exc:
+        handle_command_error(exc)
     query: dict[str, str] = {
-        "org_id": org_id,
+        "org_id": resolved_org,
         "limit": str(limit),
         "offset": str(offset),
     }
@@ -151,10 +152,9 @@ def transparency_list(
             method="GET",
             path=path,
             profile=profile,
-            org_id=org_id,
+            org_id=resolved_org,
             require_scope=False,
         )
     except CLIRequestError as exc:
-        typer.echo(str(exc), err=True)
-        raise typer.Exit(1) from exc
+        handle_cli_error(exc)
     print_json(result)

{sovaria_cli-0.2.5 → sovaria_cli-0.2.8}/apps/cli/src/commands/api.py

@@ -4,7 +4,8 @@ from __future__ import annotations
 
 import typer
 
-from apps.cli.src.utils.api_client import CLIRequestError, call_api, parse_json_arg, print_json
+from apps.cli.src.utils.api_client import CLIRequestError, call_api, parse_json_arg
+from apps.cli.src.utils.display import handle_cli_error, print_json
 
 app = typer.Typer(help="Raw gateway API calls")
 
@@ -42,7 +43,6 @@ def call_command(
             env_id=env_id,
         )
     except CLIRequestError as exc:
-        typer.echo(str(exc), err=True)
-        raise typer.Exit(1) from exc
+        handle_cli_error(exc)
 
-    typer.echo(print_json(result))
+    print_json(result)

sovaria_cli-0.2.8/apps/cli/src/commands/audit.py

@@ -0,0 +1,172 @@
+"""Echo audit and simulation commands."""
+
+from __future__ import annotations
+
+import typer
+
+from apps.cli.src.utils.api_client import CLIRequestError, parse_json_arg
+from apps.cli.src.utils.api_helpers import premium_api, premium_mutate
+
+app = typer.Typer(help="Echo audit trail and simulation operations")
+
+
+@app.command("append")
+def append_audit(
+    event_type: str = typer.Option(..., "--event-type"),
+    actor_id: str = typer.Option(..., "--actor-id"),
+    source: str = typer.Option(..., "--source"),
+    action: str = typer.Option(..., "--action"),
+    resource_id: str | None = typer.Option(None, "--resource-id"),
+    metadata: str | None = typer.Option(None, "--metadata", help="JSON object"),
+    ip_address: str | None = typer.Option(None, "--ip-address"),
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """Append an immutable audit entry."""
+    parsed_metadata = parse_json_arg(metadata, label="--metadata") if metadata else {}
+    if parsed_metadata is not None and not isinstance(parsed_metadata, dict):
+        raise CLIRequestError("--metadata must be a JSON object")
+    premium_mutate(
+        "Appending audit entry…",
+        success="Appended",
+        title="Audit entry",
+        method="POST",
+        path="/api/v1/audit/",
+        profile=profile,
+        body={
+            "event_type": event_type,
+            "actor_id": actor_id,
+            "resource_id": resource_id,
+            "source": source,
+            "action": action,
+            "metadata": parsed_metadata or {},
+            "ip_address": ip_address,
+        },
+    )
+
+
+@app.command("list")
+def list_audit(
+    actor_id: str | None = typer.Option(None, "--actor-id"),
+    event_type: str | None = typer.Option(None, "--event-type"),
+    source: str | None = typer.Option(None, "--source"),
+    resource_id: str | None = typer.Option(None, "--resource-id"),
+    limit: int = typer.Option(50, "--limit"),
+    offset: int = typer.Option(0, "--offset"),
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """Query audit log entries."""
+    params = {
+        "limit": str(limit),
+        "offset": str(offset),
+    }
+    if actor_id:
+        params["actor_id"] = actor_id
+    if event_type:
+        params["event_type"] = event_type
+    if source:
+        params["source"] = source
+    if resource_id:
+        params["resource_id"] = resource_id
+
+    premium_api(
+        "Loading audit entries…",
+        success="Loaded",
+        title="Audit log",
+        method="GET",
+        path="/api/v1/audit/",
+        profile=profile,
+        params=params,
+    )
+
+
+@app.command("verify")
+def verify_chain(profile: str | None = typer.Option(None, "--profile")) -> None:
+    """Verify audit hash-chain integrity."""
+    premium_api(
+        "Verifying audit chain…",
+        success="Verified",
+        title="Audit verification",
+        method="GET",
+        path="/api/v1/audit/verify",
+        profile=profile,
+    )
+
+
+@app.command("count")
+def audit_count(profile: str | None = typer.Option(None, "--profile")) -> None:
+    """Return audit log entry count."""
+    premium_api(
+        "Counting audit entries…",
+        success="Loaded",
+        title="Audit count",
+        method="GET",
+        path="/api/v1/audit/count",
+        profile=profile,
+    )
+
+
+@app.command("sim-run")
+def sim_run(
+    simulation_name: str = typer.Argument(...),
+    operations: str = typer.Argument(..., help="JSON array operations"),
+    context: str | None = typer.Option(None, "--context", help="JSON object"),
+    include_execution_tree: bool = typer.Option(False, "--include-execution-tree"),
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """Run an Echo phantom simulation."""
+    parsed_ops = parse_json_arg(operations, label="operations")
+    if not isinstance(parsed_ops, list):
+        raise CLIRequestError("operations must be a JSON array")
+
+    parsed_context = parse_json_arg(context, label="--context") if context else {}
+    if parsed_context is not None and not isinstance(parsed_context, dict):
+        raise CLIRequestError("--context must be a JSON object")
+
+    premium_api(
+        f"Running simulation '{simulation_name}'…",
+        success="Completed",
+        title="Simulation",
+        method="POST",
+        path="/api/v1/sim/run",
+        profile=profile,
+        body={
+            "simulation_name": simulation_name,
+            "operations": parsed_ops,
+            "echo_flag": True,
+            "include_execution_tree": include_execution_tree,
+            "context": parsed_context or {},
+        },
+    )
+
+
+@app.command("sim-plan")
+def sim_plan(
+    simulation_name: str = typer.Argument(...),
+    operations: str = typer.Argument(..., help="JSON array operations"),
+    context: str | None = typer.Option(None, "--context", help="JSON object"),
+    profile: str | None = typer.Option(None, "--profile"),
+) -> None:
+    """Preview an Echo simulation plan."""
+    parsed_ops = parse_json_arg(operations, label="operations")
+    if not isinstance(parsed_ops, list):
+        raise CLIRequestError("operations must be a JSON array")
+
+    parsed_context = parse_json_arg(context, label="--context") if context else {}
+    if parsed_context is not None and not isinstance(parsed_context, dict):
+        raise CLIRequestError("--context must be a JSON object")
+
+    premium_api(
+        f"Planning simulation '{simulation_name}'…",
+        success="Planned",
+        title="Simulation plan",
+        method="POST",
+        path="/api/v1/sim/plan",
+        profile=profile,
+        body={
+            "simulation_name": simulation_name,
+            "operations": parsed_ops,
+            "echo_flag": True,
+            "include_execution_tree": True,
+            "context": parsed_context or {},
+        },
+    )