@feniix/bridgekit 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -6,6 +6,29 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.17.0] - 2026-10-06
+
+### Changed
+
+- `@types/node` moves from 25.x to 22.x to match the `>=22.19.0` engines floor,
+  which also matches pi (`@earendil-works/pi-*`); APIs added after Node 22 now
+  fail to typecheck. The Node floor itself is unchanged.
+- Dependabot version updates are disabled (`.github/dependabot.yml` removed);
+  dependency bumps are now made manually. CI's `npm audit` gate is unchanged.
+
+## [0.16.1] - 2026-10-06
+
+### Fixed
+
+- Validation errors report correct field names under TypeBox 1.3+, which the
+  `typebox ^1.1.31` range already resolves to on fresh installs. TypeBox 1.3
+  escapes JSON Pointer paths per RFC 6901, so a property named `a/b` surfaced as
+  `a~1b` (and `a~b` as `a~0b`); fields are now decoded back to the literal key.
+- `additionalProperties` violations are reported once per key again. TypeBox 1.3
+  adds a per-key sub-schema error beside the summary, which duplicated fields and
+  let a losing union branch's closed-object errors slip past phantom suppression.
+  Both TypeBox 1.1 and 1.3 now produce identical validation errors.
+
 ## [0.16.0] - 2026-10-06
 
 ### Added

package/dist/src/core/execute-tool.js

@@ -1,18 +1,30 @@
 import { Check, Errors, Pointer } from "typebox/value";
 import { assertPortableOutputSchema } from "./output-schema.js";
 const ROOT_FIELD = "(root)";
+/**
+ * Decode one RFC 6901 JSON Pointer segment (`~1` → `/`, `~0` → `~`).
+ *
+ * TypeBox 1.3+ escapes property names in `instancePath` and `schemaPath`
+ * (`"a/b"` → `/a~1b`); TypeBox 1.1 did not. The package range spans both, so
+ * every lookup tries the raw segment first and the decoded form second.
+ */
+function decodePointerSegment(segment) {
+    return segment.replaceAll("~1", "/").replaceAll("~0", "~");
+}
 function fieldFromPath(instancePath) {
-    return instancePath.split("/").filter(Boolean).at(-1) ?? ROOT_FIELD;
+    const last = instancePath.split("/").filter(Boolean).at(-1);
+    return last === undefined ? ROOT_FIELD : decodePointerSegment(last);
 }
 /**
  * Resolve the leaf property name from a TypeBox error by walking
  * `error.schemaPath` rather than `error.instancePath`.
  *
- * `instancePath` does not escape `/` inside property names (TypeBox does not
- * follow JSON Pointer RFC 6901's `~1` encoding), so a schema with BOTH a
- * slash-named property `"a/b"` AND a nested path `a.b` produces the same
+ * Before 1.3, TypeBox's `instancePath` did not escape `/` inside property
+ * names (no JSON Pointer RFC 6901 `~1` encoding), so a schema with BOTH a
+ * slash-named property `"a/b"` AND a nested path `a.b` produced the same
  * `instancePath: "/a/b"` for either failure — the two cases are
- * indistinguishable from the data path alone. `schemaPath` carries explicit
+ * indistinguishable from the data path alone. TypeBox 1.3+ escapes both paths
+ * (`/a~1b`, `#/properties/a~1b`); the walker accepts either form. `schemaPath` carries explicit
  * `/properties/` markers per nesting level, so the two cases become
  * structurally distinct:
  *
@@ -87,13 +99,17 @@ function walkSegments(node, segments, i, lastField) {
         return walkSegments(obj.items, segments, i + 1, lastField);
     }
     // `properties` command: subsequent segments form the property name (joined
-    // by `/` to recover slash-named keys). Consume by greedy longest-prefix
-    // match against the parent's actual `properties` keys, then descend.
+    // by `/` to recover unescaped slash-named keys from TypeBox < 1.3). Consume
+    // by greedy longest-prefix match against the parent's actual `properties`
+    // keys, then descend. The raw candidate wins; the RFC 6901-decoded form
+    // covers TypeBox 1.3+, which emits `a~1b` as a single segment.
     if (head === "properties" && obj.properties && typeof obj.properties === "object") {
         const props = obj.properties;
         for (let j = segments.length; j > i + 1; j--) {
-            const candidate = segments.slice(i + 1, j).join("/");
-            if (Object.hasOwn(props, candidate)) {
+            const raw = segments.slice(i + 1, j).join("/");
+            for (const candidate of new Set([raw, decodePointerSegment(raw)])) {
+                if (!Object.hasOwn(props, candidate))
+                    continue;
                 const child = walkSegments(props[candidate], segments, j, candidate);
                 if (child !== undefined)
                     return child;
@@ -151,12 +167,15 @@ function resolveSchemaAtPath(schema, instancePath) {
         if (!current || typeof current !== "object")
             return undefined;
         const obj = current;
-        if (obj.properties && typeof obj.properties === "object" && segment in obj.properties) {
-            const next = obj.properties[segment];
-            if (next === undefined)
-                return undefined;
-            current = next;
-            continue;
+        if (obj.properties && typeof obj.properties === "object") {
+            const key = segment in obj.properties ? segment : decodePointerSegment(segment);
+            if (key in obj.properties) {
+                const next = obj.properties[key];
+                if (next === undefined)
+                    return undefined;
+                current = next;
+                continue;
+            }
         }
         if (obj.items !== undefined && /^\d+$/.test(segment)) {
             if (Array.isArray(obj.items)) {
@@ -357,7 +376,8 @@ function suppressSiblingErrorsUnderUnion(schema, value, errors) {
             const remainder = error.instancePath.slice(prefix.length);
             if (remainder.includes("/"))
                 continue; // only direct discriminator props
-            const losingValues = resolution.losingDiscriminators.get(remainder);
+            const losingValues = resolution.losingDiscriminators.get(remainder) ??
+                resolution.losingDiscriminators.get(decodePointerSegment(remainder));
             if (!losingValues)
                 continue;
             if (error.keyword === "const" && losingValues.has(error.params.allowedValue))
@@ -370,6 +390,21 @@ function suppressSiblingErrorsUnderUnion(schema, value, errors) {
         return true;
     });
 }
+/**
+ * TypeBox 1.3+ reports each additional property twice: once as the
+ * `additionalProperties` summary at the object (which `expandTypeBoxError`
+ * expands per key) and once per key as the failure of the `additionalProperties`
+ * sub-schema itself (`keyword: "boolean"` for `false`, or e.g. `"type"` for a
+ * schema value), with `schemaPath` ending at that keyword. TypeBox 1.1 emitted
+ * only the summary. Dropping the per-key duplicates keeps one error per key and
+ * lets union phantom suppression, which reasons about the summary, stay
+ * authoritative. A trailing segment after a `properties` command is a property
+ * literally named `additionalProperties`, not the keyword.
+ */
+function isAdditionalPropertiesSubschemaError(error) {
+    const segments = error.schemaPath.split("/");
+    return segments.at(-1) === "additionalProperties" && segments.at(-2) !== "properties";
+}
 function expandTypeBoxError(schema, error) {
     // Read offending property names from TypeBox's structured `params` rather
     // than parsing the message string. Two payoffs: locale independence (the
@@ -428,9 +463,7 @@ export function validatePortableToolArgs(tool, args) {
     // satisfy ONE branch, not all of them). Then dedupe the survivors by
     // (field, message) using JSON.stringify so the key can't collide regardless
     // of what characters field or message contain.
-    const rawErrors = suppressSiblingErrorsUnderUnion(tool.parameters, args, [
-        ...Errors(tool.parameters, args),
-    ]);
+    const rawErrors = suppressSiblingErrorsUnderUnion(tool.parameters, args, [...Errors(tool.parameters, args)].filter((error) => !isAdditionalPropertiesSubschemaError(error)));
     const seen = new Set();
     const errors = rawErrors
         .flatMap((error) => expandTypeBoxError(tool.parameters, error))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feniix/bridgekit",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "BridgeKit defines TypeBox-backed tools once and adapts them to pi, MCP, and other hosts.",
   "keywords": [
     "pi",
@@ -73,11 +73,11 @@
     "typebox": "^1.1.31"
   },
   "devDependencies": {
+    "@biomejs/biome": "2.5.15",
     "@modelcontextprotocol/client": "^2.3.1",
     "@modelcontextprotocol/sdk": "^1.30.1",
-    "@biomejs/biome": "2.5.4",
     "@total-typescript/shoehorn": "^0.1.2",
-    "@types/node": "^25.9.1",
+    "@types/node": "^22.20.5",
     "typescript": "^6.0.3"
   },
   "license": "MIT"