@noodleseed/one 0.157.0 → 0.159.0

package/node_modules/@noodle-borg/openapi-import/dist/index.js

@@ -1,39 +1,69 @@
 import YAML from 'yaml';
+import { importRequestBody } from './request-body.js';
+import { identifier, importOperationParameters } from './request-input.js';
 import { importResponseSchema, toOutputJsonSchema, } from './response-schema.js';
 export * from './mcp/index.js';
+export { identifier } from './request-input.js';
 export { importResponseSchema, MAX_RESPONSE_SCHEMA_DEPTH, MAX_RESPONSE_SCHEMA_NODES, toOutputJsonSchema, } from './response-schema.js';
 const METHODS = new Set(['get', 'post', 'put', 'patch', 'delete']);
+export const MAX_OPENAPI_SOURCE_BYTES = 6 * 1024 * 1024;
 export function parseOpenApiToIr(source, options) {
-    const doc = YAML.parse(source);
+    if (Buffer.byteLength(source, 'utf8') > MAX_OPENAPI_SOURCE_BYTES) {
+        throw new Error('import openapi: document exceeds the 6 MiB size limit; import a scoped API document');
+    }
+    let parsed;
+    try {
+        parsed = YAML.parse(source, { maxAliasCount: 100 });
+    }
+    catch {
+        throw new Error('import openapi: invalid JSON/YAML document; repair its syntax and retry');
+    }
+    if (!isRecord(parsed))
+        throw new Error('import openapi: document must be an object');
+    const doc = parsed;
     if (typeof doc.openapi !== 'string' || !/^3\.[01]\./.test(doc.openapi)) {
         throw new Error('import openapi: only OpenAPI 3.0 and 3.1 documents are supported');
     }
-    const baseUrl = options.baseUrl ?? doc.servers?.find((server) => typeof server.url === 'string')?.url;
+    const baseUrl = options.baseUrl ??
+        (Array.isArray(doc.servers)
+            ? doc.servers.find((server) => isRecord(server) && typeof server.url === 'string')?.url
+            : undefined);
     if (baseUrl === undefined)
         throw new Error('import openapi: missing base URL; pass --base-url');
+    try {
+        const base = new URL(baseUrl);
+        if (!['https:', 'http:'].includes(base.protocol) ||
+            base.username ||
+            base.password ||
+            base.search ||
+            base.hash)
+            throw new Error();
+    }
+    catch {
+        throw new Error('import openapi: use an HTTP(S) base URL without credentials, query or fragment');
+    }
     const operations = [];
     const warnings = [];
     const referencedSchemes = [];
     collectSecurityRefs(doc.security, referencedSchemes);
-    for (const [path, item] of Object.entries(doc.paths ?? {})) {
+    if (!isRecord(doc.paths))
+        throw new Error('import openapi: paths must be an object');
+    for (const [path, item] of Object.entries(doc.paths)) {
+        if (!isRecord(item) ||
+            !path.startsWith('/') ||
+            path.startsWith('//') ||
+            /[?#\p{Cc}]/u.test(path)) {
+            throw new Error('import openapi: use path-item objects with relative paths and declared query parameters');
+        }
         for (const [method, rawOperation] of Object.entries(item)) {
             if (!METHODS.has(method))
                 continue;
+            if (!isRecord(rawOperation))
+                throw new Error('import openapi: each supported operation must be an object');
             const operation = rawOperation;
             collectSecurityRefs(operation.security, referencedSchemes);
             const name = identifier(typeof operation.operationId === 'string' ? operation.operationId : `${method}_${path}`);
-            const parameters = (operation.parameters ?? [])
-                .filter((param) => param.in === 'path' || param.in === 'query')
-                .map((param) => ({
-                name: identifier(String(param.name ?? 'param')),
-                in: param.in,
-                required: param.required === true,
-                schema: parameterJsonSchema(param.schema),
-            }));
-            const hasRequestBody = operation.requestBody !== undefined;
-            if (hasRequestBody) {
-                warnings.push(`${name}: requestBody imported as opaque JSON string placeholder`);
-            }
+            const { parameters, connectorPath } = importOperationParameters(path, item.parameters, operation.parameters);
             const safeName = uniqueName(manifestIdentifier(name), new Set(operations.map((op) => op.safeName)));
             const responseCtx = {
                 operationName: name,
@@ -41,6 +71,13 @@ export function parseOpenApiToIr(source, options) {
                 warnings,
             };
             const output = importResponseSchema(operation.responses, responseCtx);
+            const requestBody = importRequestBody(operation.requestBody, responseCtx);
+            if (requestBody !== undefined && method === 'get') {
+                throw new Error('import openapi: GET request bodies require an explicitly authored mapping');
+            }
+            if (requestBody !== undefined && parameters.some((param) => param.name === 'body')) {
+                throw new Error('import openapi: request body and parameter input-name collision; map the inputs explicitly');
+            }
             operations.push({
                 name,
                 safeName,
@@ -49,10 +86,10 @@ export function parseOpenApiToIr(source, options) {
                 path,
                 // OpenAPI's `{name}` path params are already the connector runtime's template form; rewriting
                 // them to `${args.name}` made catalog compilation reject the path (unsupported_path_expression).
-                connectorPath: path,
+                connectorPath,
                 description: `Call ${method.toUpperCase()} ${path}.`,
                 parameters,
-                hasRequestBody,
+                ...(requestBody === undefined ? {} : { requestBody }),
                 query: parameters.filter((param) => param.in === 'query').map((param) => param.name),
                 ...(output !== undefined ? { output } : {}),
             });
@@ -124,7 +161,7 @@ export function renderOpenApiConnectorsYaml(ir) {
                 kind: 'custom',
                 http: {
                     baseUrl: ir.baseUrl,
-                    allowedOrigins: [ir.baseUrl],
+                    allowedOrigins: [new URL(ir.baseUrl).origin],
                     ...(ir.auth !== undefined ? { auth: ir.auth } : {}),
                 },
                 operations: Object.fromEntries(ir.operations.map((operation) => [operation.safeName, connectorOperation(operation)])),
@@ -153,7 +190,7 @@ export function renderOpenApiManifestYaml(ir) {
             ...outputSchemaEntry(operation),
             fulfilment: {
                 use: `api.${operation.safeName}`,
-                args: Object.fromEntries(operation.parameters.map((param) => [param.name, `\${input.${param.name}}`])),
+                args: inputArguments(operation),
             },
         })),
     })}`;
@@ -220,7 +257,7 @@ export function mergeOpenApiIntoDraft(input) {
             ...outputSchemaEntry(operation),
             fulfilment: {
                 use: `${connectorAlias}.${operationName}`,
-                args: Object.fromEntries(operation.parameters.map((param) => [param.name, `\${input.${param.name}}`])),
+                args: inputArguments(operation),
             },
         });
         existingToolNames.add(toolName);
@@ -238,10 +275,6 @@ export function mergeOpenApiIntoDraft(input) {
         warnings,
     };
 }
-export function identifier(value) {
-    const out = value.replace(/[^A-Za-z0-9_]+/g, '_').replace(/^_+|_+$/g, '');
-    return /^[A-Za-z_]/.test(out) ? out : `op_${out || 'operation'}`;
-}
 export function title(value) {
     return value.replace(/[-_]+/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
 }
@@ -255,17 +288,12 @@ function manifestIdentifier(value) {
     return /^[a-z0-9_]+$/.test(snake) && snake.length > 0 ? snake : 'operation';
 }
 function connectorOperation(operation) {
-    const required = operation.parameters.filter((param) => param.required).map((p) => p.name);
     return {
         type: operation.operationType,
         method: operation.method.toUpperCase(),
         path: operation.connectorPath,
-        input: {
-            type: 'object',
-            properties: Object.fromEntries(operation.parameters.map((param) => [param.name, parameterSchemaJson(param.schema)])),
-            ...(required.length > 0 ? { required } : {}),
-            additionalProperties: false,
-        },
+        input: inputSchema(operation),
+        ...(operation.requestBody === undefined ? {} : { request: '${args.body}' }),
         ...(operation.query.length > 0 ? { query: [...operation.query] } : {}),
         // The same lossless `{ value: <tree> }` object the tool outputSchema advertises; an untyped
         // operation keeps an open ({}) value subtree. Response mapping wraps the JSON body as `value`.
@@ -292,26 +320,28 @@ function outputSchemaEntry(operation) {
     };
 }
 function inputSchema(operation) {
+    const required = operation.parameters
+        .filter((param) => param.required)
+        .map((param) => param.name);
+    if (operation.requestBody?.required)
+        required.push('body');
     return {
         type: 'object',
-        properties: Object.fromEntries(operation.parameters.map((param) => [param.name, parameterSchemaJson(param.schema)])),
-        required: operation.parameters.filter((param) => param.required).map((param) => param.name),
+        properties: {
+            ...Object.fromEntries(operation.parameters.map((param) => [param.name, parameterSchemaJson(param.schema)])),
+            ...(operation.requestBody === undefined
+                ? {}
+                : { body: toOutputJsonSchema(operation.requestBody.schema) }),
+        },
+        required,
         additionalProperties: false,
     };
 }
-/** Import one parameter's OpenAPI schema as a lossless JSON Schema fragment (see the type doc). */
-function parameterJsonSchema(schema) {
-    if (!isRecord(schema))
-        return { type: 'string' };
-    const rawType = schema.type;
-    const base = rawType === 'number' || rawType === 'integer' || rawType === 'boolean' ? rawType : 'string';
-    const enumValues = base === 'string' ? stringEnum(schema.enum) : undefined;
-    const format = typeof schema.format === 'string' ? schema.format : undefined;
-    return {
-        type: schema.nullable === true ? [base, 'null'] : base,
-        ...(enumValues !== undefined ? { enum: enumValues } : {}),
-        ...(format !== undefined ? { format } : {}),
-    };
+function inputArguments(operation) {
+    return Object.fromEntries([
+        ...operation.parameters.map((param) => [param.name, `\${input.${param.name}}`]),
+        ...(operation.requestBody === undefined ? [] : [['body', '${input.body}']]),
+    ]);
 }
 /** A fresh plain-JSON copy of a parameter schema, safe to embed in YAML documents. */
 function parameterSchemaJson(schema) {
@@ -321,13 +351,6 @@ function parameterSchemaJson(schema) {
         ...(schema.format !== undefined ? { format: schema.format } : {}),
     };
 }
-function stringEnum(value) {
-    if (!Array.isArray(value) || value.length === 0)
-        return undefined;
-    if (!value.every((entry) => typeof entry === 'string'))
-        return undefined;
-    return value;
-}
 function parseYamlObject(source, label) {
     const parsed = YAML.parse(source);
     if (!isRecord(parsed))

package/node_modules/@noodle-borg/openapi-import/dist/request-body.js

@@ -0,0 +1,125 @@
+import { importSchemaTree, MAX_RESPONSE_SCHEMA_DEPTH, MAX_RESPONSE_SCHEMA_NODES, } from './response-schema.js';
+/** Request inputs must not silently lose constraints or become an untyped body placeholder. */
+export function importRequestBody(value, ctx) {
+    if (value === undefined)
+        return undefined;
+    if (!isRecord(value) || value.$ref !== undefined) {
+        throw new Error('import openapi: inline the request body declaration before import');
+    }
+    if (value.required !== undefined && typeof value.required !== 'boolean') {
+        throw new Error('import openapi: request body required must be boolean');
+    }
+    const content = isRecord(value.content) ? value.content : undefined;
+    const media = content?.['application/json'];
+    const raw = isRecord(media) ? media.schema : undefined;
+    if (raw === undefined)
+        throw new Error('import openapi: request body must declare an application/json schema; map other encodings explicitly');
+    assertRequestSchema(raw, ctx);
+    const warningCount = ctx.warnings.length;
+    const schema = importSchemaTree(raw, ctx, true);
+    if (schema.kind === 'unknown' || ctx.warnings.length !== warningCount) {
+        throw new Error('import openapi: request body schema cannot be imported faithfully; simplify it or author its mapping explicitly');
+    }
+    return { required: value.required === true, schema };
+}
+function assertRequestSchema(raw, ctx) {
+    const allowed = new Set([
+        'type',
+        'nullable',
+        'properties',
+        'required',
+        'items',
+        'enum',
+        'additionalProperties',
+        '$ref',
+        'title',
+        'description',
+        'example',
+        'examples',
+        'deprecated',
+    ]);
+    let nodes = 0;
+    const visit = (value, depth, refs) => {
+        nodes++;
+        if (!isRecord(value) ||
+            depth > MAX_RESPONSE_SCHEMA_DEPTH ||
+            nodes > MAX_RESPONSE_SCHEMA_NODES) {
+            throw new Error('import openapi: request body schema exceeds supported structure/depth/size bounds');
+        }
+        if (Object.keys(value).some((key) => !allowed.has(key))) {
+            throw new Error('import openapi: request body contains an unsupported schema keyword; author its validated mapping explicitly');
+        }
+        if (value.$ref !== undefined) {
+            if (Object.keys(value).some((key) => !['$ref', 'title', 'description', 'example', 'examples', 'deprecated'].includes(key))) {
+                throw new Error('import openapi: request body reference siblings cannot be imported faithfully; inline the schema');
+            }
+            if (typeof value.$ref !== 'string' ||
+                !value.$ref.startsWith('#/components/schemas/') ||
+                refs.has(value.$ref)) {
+                throw new Error('import openapi: request body has an external, circular or unsupported reference; bundle it into an inline schema');
+            }
+            const name = value.$ref
+                .slice('#/components/schemas/'.length)
+                .replace(/~1/g, '/')
+                .replace(/~0/g, '~');
+            visit(ctx.componentSchemas[name], depth + 1, new Set([...refs, value.$ref]));
+            return;
+        }
+        const types = Array.isArray(value.type) ? value.type : [value.type];
+        const concrete = types.filter((type) => type !== 'null');
+        const type = concrete[0];
+        if (concrete.length !== 1 ||
+            typeof type !== 'string' ||
+            !['string', 'number', 'integer', 'boolean', 'object', 'array'].includes(type) ||
+            types.length > 2) {
+            throw new Error('import openapi: request body requires a supported explicit type at every schema node');
+        }
+        if (value.nullable !== undefined && typeof value.nullable !== 'boolean') {
+            throw new Error('import openapi: request body nullable must be boolean');
+        }
+        if ((value.properties !== undefined ||
+            value.required !== undefined ||
+            value.additionalProperties !== undefined) &&
+            type !== 'object') {
+            throw new Error('import openapi: request body object keywords require an object type');
+        }
+        if ((type === 'array' && value.items === undefined) ||
+            (value.items !== undefined && type !== 'array')) {
+            throw new Error('import openapi: request body arrays require one typed items schema');
+        }
+        if (value.additionalProperties !== undefined &&
+            typeof value.additionalProperties !== 'boolean') {
+            throw new Error('import openapi: request body additionalProperties must be boolean');
+        }
+        if (value.enum !== undefined &&
+            (!Array.isArray(value.enum) ||
+                value.enum.length === 0 ||
+                !value.enum.every((item) => typeof item === 'string'))) {
+            throw new Error('import openapi: request body supports only nonempty string enums');
+        }
+        if (value.enum !== undefined &&
+            (type !== 'string' || types.includes('null') || value.nullable === true)) {
+            throw new Error('import openapi: request body enum/nullable combination requires an explicit mapping');
+        }
+        if (value.required !== undefined &&
+            (!Array.isArray(value.required) ||
+                !value.required.every((name) => typeof name === 'string' &&
+                    isRecord(value.properties) &&
+                    Object.hasOwn(value.properties, name)))) {
+            throw new Error('import openapi: request body required fields must have declared properties');
+        }
+        if (value.properties !== undefined) {
+            if (!isRecord(value.properties))
+                throw new Error('import openapi: request body properties must be an object');
+            for (const child of Object.values(value.properties))
+                visit(child, depth + 1, refs);
+        }
+        if (value.items !== undefined)
+            visit(value.items, depth + 1, refs);
+    };
+    visit(raw, 0, new Set());
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=request-body.js.map

package/node_modules/@noodle-borg/openapi-import/dist/request-input.js

@@ -0,0 +1,139 @@
+const FIELD = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const RESERVED_FIELDS = new Set([
+    'then',
+    'equals',
+    'at',
+    'optional',
+    'toExpression',
+    'toString',
+    '__proto__',
+    'constructor',
+    'prototype',
+]);
+export function identifier(value) {
+    const out = value.replace(/[^A-Za-z0-9_]+/g, '_').replace(/^_+|_+$/g, '');
+    return /^[A-Za-z_]/.test(out) ? out : `op_${out || 'operation'}`;
+}
+/** Keep wire query names intact; path placeholder names may be normalized with their arguments. */
+export function importOperationParameters(path, inherited, own) {
+    const selected = new Map();
+    for (const list of [inherited, own]) {
+        if (list === undefined)
+            continue;
+        if (!Array.isArray(list))
+            throw new Error('import openapi: parameters must be an array');
+        for (const value of list) {
+            if (!isRecord(value) ||
+                typeof value.name !== 'string' ||
+                value.name.length === 0 ||
+                value.name.length > 128 ||
+                /\p{Cc}/u.test(value.name)) {
+                throw new Error('import openapi: use inline parameters with bounded, non-control names');
+            }
+            if (value.in !== 'path' && value.in !== 'query') {
+                throw new Error('import openapi: only path/query parameters are supported; map other locations explicitly in TypeScript');
+            }
+            if (value.style !== undefined && value.style !== (value.in === 'path' ? 'simple' : 'form')) {
+                throw new Error('import openapi: unsupported parameter serialization style; map it explicitly in TypeScript');
+            }
+            if (value.allowReserved === true ||
+                value.allowEmptyValue === true ||
+                value.content !== undefined) {
+                throw new Error('import openapi: unsupported parameter wire encoding; map it explicitly in TypeScript');
+            }
+            selected.set(`${value.in}:${value.name}`, value);
+        }
+    }
+    if (selected.size > 200)
+        throw new Error('import openapi: operation exceeds 200 parameters');
+    const names = new Set();
+    const pathNames = new Map();
+    const parameters = [...selected.values()].map((value) => {
+        const rawName = String(value.name);
+        let name = value.in === 'path' ? identifier(rawName) : rawName;
+        if (value.in === 'path' && RESERVED_FIELDS.has(name))
+            name = `param_${name}`;
+        if (!FIELD.test(name) || RESERVED_FIELDS.has(name)) {
+            throw new Error('import openapi: query parameter name cannot be addressed by the authoring expression contract; map this API through an application handler');
+        }
+        if (names.has(name))
+            throw new Error('import openapi: parameter input-name collision; map the inputs explicitly');
+        names.add(name);
+        if (value.in === 'path')
+            pathNames.set(rawName, name);
+        return {
+            name,
+            in: value.in === 'path' ? 'path' : 'query',
+            required: value.in === 'path' || value.required === true,
+            schema: parameterJsonSchema(value.schema),
+        };
+    });
+    const placeholders = [...path.matchAll(/\{([^{}]+)\}/g)].map((match) => match[1]);
+    if (placeholders.some((name) => name === undefined || !pathNames.has(name)) ||
+        [...pathNames.keys()].some((name) => !placeholders.includes(name))) {
+        throw new Error('import openapi: every path placeholder must match a declared path parameter');
+    }
+    return {
+        parameters,
+        connectorPath: path.replace(/\{([^{}]+)\}/g, (_match, name) => `{${pathNames.get(name)}}`),
+    };
+}
+function parameterJsonSchema(schema) {
+    if (schema === undefined)
+        return { type: 'string' };
+    if (!isRecord(schema))
+        throw new Error('import openapi: parameter schema must be an object');
+    if (schema.$ref !== undefined)
+        throw new Error('import openapi: inline parameter schemas before import; references are not fetched');
+    const allowed = new Set([
+        'type',
+        'nullable',
+        'enum',
+        'format',
+        'title',
+        'description',
+        'example',
+        'examples',
+        'deprecated',
+    ]);
+    if (Object.keys(schema).some((key) => !allowed.has(key))) {
+        throw new Error('import openapi: unsupported parameter schema constraint; author its validated mapping explicitly');
+    }
+    const types = Array.isArray(schema.type)
+        ? schema.type
+        : [schema.type ?? 'string'];
+    const concrete = types.filter((type) => type !== 'null');
+    const base = concrete[0];
+    if (concrete.length !== 1 ||
+        types.length > 2 ||
+        typeof base !== 'string' ||
+        !['string', 'number', 'integer', 'boolean'].includes(base)) {
+        throw new Error('import openapi: unsupported parameter schema; use a scalar or an explicitly authored mapping');
+    }
+    const enumValues = base === 'string' ? stringEnum(schema.enum) : undefined;
+    if (schema.enum !== undefined &&
+        (enumValues === undefined || types.includes('null') || schema.nullable === true)) {
+        throw new Error('import openapi: unsupported parameter enum/nullable combination; author an explicit mapping');
+    }
+    const format = typeof schema.format === 'string' ? schema.format : undefined;
+    if ((schema.nullable !== undefined && typeof schema.nullable !== 'boolean') ||
+        (schema.format !== undefined && format === undefined)) {
+        throw new Error('import openapi: invalid parameter nullable or format declaration');
+    }
+    return {
+        type: schema.nullable === true || types.includes('null') ? [base, 'null'] : base,
+        ...(enumValues !== undefined ? { enum: enumValues } : {}),
+        ...(format !== undefined ? { format } : {}),
+    };
+}
+function stringEnum(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return undefined;
+    if (!value.every((entry) => typeof entry === 'string'))
+        return undefined;
+    return value;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=request-input.js.map

package/node_modules/@noodle-borg/openapi-import/dist/response-schema.js

@@ -8,6 +8,10 @@ export const MAX_RESPONSE_SCHEMA_DEPTH = 8;
 export const MAX_RESPONSE_SCHEMA_NODES = 200;
 const UNKNOWN = { kind: 'unknown' };
 const UNSUPPORTED_COMPOSITIONS = ['oneOf', 'anyOf', 'allOf', 'not'];
+/** Shared bounded conversion; request validation is owned by request-body.ts. */
+export function importSchemaTree(raw, ctx, request = false) {
+    return convertSchema(raw, ctx, { nodes: 0, boundWarned: false, request }, 0, new Set());
+}
 /**
  * Picks the best 2xx `application/json` schema from an operation's `responses` block and
  * converts it. Returns `undefined` (with warnings pushed to the context) when the operation
@@ -41,14 +45,17 @@ export function toOutputJsonSchema(schema) {
         case 'string':
             return withNullable({ type: 'string', ...(schema.enum !== undefined ? { enum: [...schema.enum] } : {}) }, schema.nullable);
         case 'number':
-            return withNullable({ type: 'number' }, schema.nullable);
+            return withNullable({ type: schema.integer === true ? 'integer' : 'number' }, schema.nullable);
         case 'boolean':
             return withNullable({ type: 'boolean' }, schema.nullable);
         case 'array':
             return withNullable({ type: 'array', items: toOutputJsonSchema(schema.items) }, schema.nullable);
         case 'object': {
+            const extra = schema.additionalProperties === undefined
+                ? {}
+                : { additionalProperties: schema.additionalProperties };
             if (schema.properties.length === 0)
-                return withNullable({ type: 'object' }, schema.nullable);
+                return withNullable({ type: 'object', ...extra }, schema.nullable);
             const required = schema.properties
                 .filter((property) => property.required)
                 .map((property) => property.name);
@@ -59,6 +66,7 @@ export function toOutputJsonSchema(schema) {
                     toOutputJsonSchema(property.schema),
                 ])),
                 ...(required.length > 0 ? { required } : {}),
+                ...extra,
             }, schema.nullable);
         }
         case 'unknown':
@@ -101,7 +109,11 @@ function convertSchema(raw, ctx, state, depth, visitedRefs) {
         }
         case 'number':
         case 'integer':
-            return { kind: 'number', ...nullableSpread };
+            return {
+                kind: 'number',
+                ...nullableSpread,
+                ...(state.request && type === 'integer' ? { integer: true } : {}),
+            };
         case 'boolean':
             return { kind: 'boolean', ...nullableSpread };
         case 'array':
@@ -120,6 +132,7 @@ function convertSchema(raw, ctx, state, depth, visitedRefs) {
             return {
                 kind: 'object',
                 ...nullableSpread,
+                ...(state.request ? { additionalProperties: raw.additionalProperties !== false } : {}),
                 properties: Object.entries(properties).map(([name, propertySchema]) => ({
                     name,
                     required: required.has(name),
@@ -143,7 +156,7 @@ function convertRef(ref, ctx, state, depth, visitedRefs) {
         ctx.warnings.push(`${ctx.operationName}: response schema $ref "${ref}" is not a component schema reference; that part is left untyped`);
         return UNKNOWN;
     }
-    const name = ref.slice(prefix.length);
+    const name = ref.slice(prefix.length).replace(/~1/g, '/').replace(/~0/g, '~');
     if (visitedRefs.has(name)) {
         ctx.warnings.push(`${ctx.operationName}: response schema $ref "${ref}" is circular; the repeated part is left untyped`);
         return UNKNOWN;

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.95.0",
+    "@noodle-borg/agent-kit": "0.96.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.157.0",
+  "version": "0.159.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -235,7 +235,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.95.0",
+    "@noodle-borg/agent-kit": "0.96.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",