@noodleseed/one 0.158.0 → 0.160.0

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-hosted-deployment.js

@@ -92,81 +92,98 @@ const WATCH_FLAGS = [
         constraints: { default: 5, minimum: 2 },
     }),
 ];
+const DEPLOY_ARGUMENTS = [
+    argument({
+        ...ARGUMENT_FIELDS,
+        name: 'server.ts',
+        type: 'string',
+        summary: 'Server entrypoint; defaults to the linked or conventional project entrypoint.',
+        required: false,
+    }),
+];
+const DEPLOY_FLAGS = [
+    ORG_FLAG,
+    APP_FLAG,
+    ENV_FLAG,
+    flag({
+        ...FLAG_FIELDS,
+        name: 'version',
+        type: 'string',
+        value: '<version>',
+        summary: 'Publish or overwrite an exact server version. Omit it and deploy reuses this project’s last version, a vN/ entrypoint folder, or the version the hosted app already runs — a brand-new app starts at 1.',
+    }),
+    flag({
+        ...FLAG_FIELDS,
+        name: 'private',
+        type: 'boolean',
+        summary: 'Shorthand for --access owner-only.',
+    }),
+    flag({
+        ...FLAG_FIELDS,
+        name: 'access',
+        type: 'string',
+        value: '<mode>',
+        summary: 'Identity access mode for the deployment.',
+        constraints: { choices: ACCESS_MODES },
+    }),
+    flag({
+        ...FLAG_FIELDS,
+        name: 'owner-subject',
+        type: 'string',
+        value: '<subject>',
+        summary: 'Exact OAuth subject bound when access is owner-only.',
+    }),
+    flag({
+        ...FLAG_FIELDS,
+        name: 'connectors',
+        type: 'string',
+        value: '<file>',
+        summary: 'Connector catalog override file.',
+    }),
+    SERVICE_FLAG,
+    AUTH_TOKEN_FLAG,
+    flag({
+        ...FLAG_FIELDS,
+        name: 'save',
+        type: 'boolean',
+        summary: 'Also append to ~/.noodle/servers.json.',
+    }),
+    flag({
+        ...FLAG_FIELDS,
+        name: 'no-save',
+        type: 'boolean',
+        summary: 'Do not persist deployment metadata.',
+    }),
+    flag({
+        ...FLAG_FIELDS,
+        name: 'no-prompt',
+        type: 'boolean',
+        summary: 'Never prompt to set missing variables or secrets; return the complete checklist.',
+    }),
+    JSON_FLAG,
+];
 export const CATALOG_HOSTED_DEPLOYMENT = [
     {
         name: 'deploy',
         section: 'start',
+        usage: '[<server.ts>] | preflight [<server.ts>]',
         next: ['noodle login then noodle deploy', 'noodle github connect'],
         summary: 'Preflight required config, deploy your server, and verify its governed MCP URL is ready.',
-        arguments: [
-            argument({
-                ...ARGUMENT_FIELDS,
-                name: 'server.ts',
-                type: 'string',
-                summary: 'Server entrypoint; defaults to the linked or conventional project entrypoint.',
-                required: false,
-            }),
-        ],
-        flags: [
-            ORG_FLAG,
-            APP_FLAG,
-            ENV_FLAG,
-            flag({
-                ...FLAG_FIELDS,
-                name: 'version',
-                type: 'string',
-                value: '<version>',
-                summary: 'Publish or overwrite an exact server version. Omit it and deploy reuses this project’s last version, a vN/ entrypoint folder, or the version the hosted app already runs — a brand-new app starts at 1.',
-            }),
-            flag({
-                ...FLAG_FIELDS,
-                name: 'private',
-                type: 'boolean',
-                summary: 'Shorthand for --access owner-only.',
-            }),
-            flag({
-                ...FLAG_FIELDS,
-                name: 'access',
-                type: 'string',
-                value: '<mode>',
-                summary: 'Identity access mode for the deployment.',
-                constraints: { choices: ACCESS_MODES },
-            }),
-            flag({
-                ...FLAG_FIELDS,
-                name: 'owner-subject',
-                type: 'string',
-                value: '<subject>',
-                summary: 'Exact OAuth subject bound when access is owner-only.',
-            }),
-            flag({
-                ...FLAG_FIELDS,
-                name: 'connectors',
-                type: 'string',
-                value: '<file>',
-                summary: 'Connector catalog override file.',
-            }),
-            SERVICE_FLAG,
-            AUTH_TOKEN_FLAG,
-            flag({
-                ...FLAG_FIELDS,
-                name: 'save',
-                type: 'boolean',
-                summary: 'Also append to ~/.noodle/servers.json.',
-            }),
-            flag({
-                ...FLAG_FIELDS,
-                name: 'no-save',
-                type: 'boolean',
-                summary: 'Do not persist deployment metadata.',
-            }),
-            flag({
-                ...FLAG_FIELDS,
-                name: 'no-prompt',
-                type: 'boolean',
-                summary: 'Never prompt to set missing variables or secrets; return the complete checklist.',
+        arguments: DEPLOY_ARGUMENTS,
+        flags: DEPLOY_FLAGS,
+        subcommands: [
+            subcommand({
+                name: 'preflight',
+                summary: 'Check the authored deployment and all reported prerequisites without configuring or publishing.',
+                arguments: DEPLOY_ARGUMENTS,
+                flags: DEPLOY_FLAGS.filter((item) => item.name !== 'save' && item.name !== 'no-save').map((item) => item.name === 'version'
+                    ? {
+                        ...item,
+                        summary: 'Server version to validate without publishing. Omit it to use the normal deployment version resolution.',
+                    }
+                    : item),
+                jsonOutput: { mode: 'single' },
             }),
-            JSON_FLAG,
         ],
         jsonOutput: { mode: 'single' },
     },

package/node_modules/@noodle-borg/control-plane/dist/contracts.d.ts

@@ -1,4 +1,9 @@
 export type OrgRole = 'owner' | 'developer';
+/** The canonical principal bound to a personal workspace must remain that organization's owner. */
+export declare class PersonalWorkspaceOwnerMutationError extends Error {
+    readonly code = "personal_workspace_owner_immutable";
+    constructor();
+}
 export interface OrgRecord {
     readonly slug: string;
     readonly displayName?: string;

package/node_modules/@noodle-borg/control-plane/dist/contracts.js

@@ -0,0 +1,9 @@
+/** The canonical principal bound to a personal workspace must remain that organization's owner. */
+export class PersonalWorkspaceOwnerMutationError extends Error {
+    code = 'personal_workspace_owner_immutable';
+    constructor() {
+        super('personal workspace owner is immutable');
+        this.name = 'PersonalWorkspaceOwnerMutationError';
+    }
+}
+//# sourceMappingURL=contracts.js.map

package/node_modules/@noodle-borg/control-plane/dist/in-memory-control-plane-store.d.ts

@@ -1,4 +1,4 @@
-import type { CreateOrgWithOwnerInput, OrgRecord, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, WelcomeEmailRecord } from './contracts.js';
+import type { CreateOrgWithOwnerInput, OrgMemberRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, WelcomeEmailRecord } from './contracts.js';
 import { InMemoryOrganizationStore } from './in-memory-organization-store.js';
 /** Portable organization state. Commercial account provisioning is an optional module side effect. */
 export declare class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
@@ -8,6 +8,21 @@ export declare class InMemoryControlPlaneStore extends InMemoryOrganizationStore
     });
     provisionPersonalWorkspace(input: PersonalWorkspaceProvisionInput): Promise<PersonalWorkspaceProvisionResult>;
     createOrgWithOwner(input: CreateOrgWithOwnerInput): Promise<OrgRecord>;
+    addOrgMember(input: {
+        org: string;
+        subject: string;
+        email: string;
+        role: OrgRole;
+    }): Promise<OrgMemberRecord>;
+    removeOrgMember(input: {
+        org: string;
+        subject: string;
+    }): Promise<boolean>;
+    updateOrgMemberRole(input: {
+        org: string;
+        subject: string;
+        role: OrgRole;
+    }): Promise<OrgMemberRecord | undefined>;
     claimWelcomeEmail(input: {
         readonly now: Date;
         readonly leaseMs: number;

package/node_modules/@noodle-borg/control-plane/dist/in-memory-control-plane-store.js

@@ -1,3 +1,4 @@
+import { PersonalWorkspaceOwnerMutationError } from './contracts.js';
 import { InMemoryOrganizationStore } from './in-memory-organization-store.js';
 import { personalOrgSlugSuffix } from './organization-helpers.js';
 import { validateUserOwnedOrgSlug } from './validation.js';
@@ -75,6 +76,18 @@ export class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
             return org;
         });
     }
+    addOrgMember(input) {
+        this.#assertPersonalOwnerMutation(input.org, input.subject, input.role);
+        return super.addOrgMember(input);
+    }
+    removeOrgMember(input) {
+        this.#assertPersonalOwnerMutation(input.org, input.subject);
+        return super.removeOrgMember(input);
+    }
+    updateOrgMemberRole(input) {
+        this.#assertPersonalOwnerMutation(input.org, input.subject, input.role);
+        return super.updateOrgMemberRole(input);
+    }
     claimWelcomeEmail(input) {
         const nowMs = input.now.getTime();
         const record = [...this.#welcomeEmails.values()]
@@ -131,6 +144,11 @@ export class InMemoryControlPlaneStore extends InMemoryOrganizationStore {
             role: 'owner',
         });
     }
+    #assertPersonalOwnerMutation(org, subject, role) {
+        if (this.#personalWorkspaces.get(subject) === org && role !== 'owner') {
+            throw new PersonalWorkspaceOwnerMutationError();
+        }
+    }
     async #serialized(key, operation) {
         const prior = this.#queues.get(key) ?? Promise.resolve();
         let release;

package/node_modules/@noodle-borg/control-plane/dist/portable.d.ts

@@ -1,5 +1,6 @@
 export { type AppPurgeReconciliationActor, type AppPurgeReconciliationConflictCode, AppPurgeReconciliationError, type AppPurgeReconciliationOperator, } from './app-purge-reconciliation-port.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, ControlPlaneIdentity, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrganizationStore, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from './contracts.js';
+export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
 export { allowAllGate, bearerToken, type ControlPlaneAuthResult, type DeployAuthGate, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, type ControlPlaneSignupMode, GoogleControlPlaneGate, type GoogleControlPlaneGateOptions, type GoogleIdTokenVerifier, GoogleWorkloadControlPlaneGate, type GoogleWorkloadControlPlaneGateOptions, NoodleOAuthControlPlaneGate, type NoodleOAuthControlPlaneGateOptions, type SignupAuthorizer, } from './deploy-gates.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';

package/node_modules/@noodle-borg/control-plane/dist/portable.js

@@ -1,4 +1,5 @@
 export { AppPurgeReconciliationError, } from './app-purge-reconciliation-port.js';
+export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
 export { allowAllGate, bearerToken, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, GoogleControlPlaneGate, GoogleWorkloadControlPlaneGate, NoodleOAuthControlPlaneGate, } from './deploy-gates.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';

package/node_modules/@noodle-borg/openapi-import/dist/index.js

@@ -1,39 +1,69 @@
 import YAML from 'yaml';
+import { importRequestBody } from './request-body.js';
+import { identifier, importOperationParameters } from './request-input.js';
 import { importResponseSchema, toOutputJsonSchema, } from './response-schema.js';
 export * from './mcp/index.js';
+export { identifier } from './request-input.js';
 export { importResponseSchema, MAX_RESPONSE_SCHEMA_DEPTH, MAX_RESPONSE_SCHEMA_NODES, toOutputJsonSchema, } from './response-schema.js';
 const METHODS = new Set(['get', 'post', 'put', 'patch', 'delete']);
+export const MAX_OPENAPI_SOURCE_BYTES = 6 * 1024 * 1024;
 export function parseOpenApiToIr(source, options) {
-    const doc = YAML.parse(source);
+    if (Buffer.byteLength(source, 'utf8') > MAX_OPENAPI_SOURCE_BYTES) {
+        throw new Error('import openapi: document exceeds the 6 MiB size limit; import a scoped API document');
+    }
+    let parsed;
+    try {
+        parsed = YAML.parse(source, { maxAliasCount: 100 });
+    }
+    catch {
+        throw new Error('import openapi: invalid JSON/YAML document; repair its syntax and retry');
+    }
+    if (!isRecord(parsed))
+        throw new Error('import openapi: document must be an object');
+    const doc = parsed;
     if (typeof doc.openapi !== 'string' || !/^3\.[01]\./.test(doc.openapi)) {
         throw new Error('import openapi: only OpenAPI 3.0 and 3.1 documents are supported');
     }
-    const baseUrl = options.baseUrl ?? doc.servers?.find((server) => typeof server.url === 'string')?.url;
+    const baseUrl = options.baseUrl ??
+        (Array.isArray(doc.servers)
+            ? doc.servers.find((server) => isRecord(server) && typeof server.url === 'string')?.url
+            : undefined);
     if (baseUrl === undefined)
         throw new Error('import openapi: missing base URL; pass --base-url');
+    try {
+        const base = new URL(baseUrl);
+        if (!['https:', 'http:'].includes(base.protocol) ||
+            base.username ||
+            base.password ||
+            base.search ||
+            base.hash)
+            throw new Error();
+    }
+    catch {
+        throw new Error('import openapi: use an HTTP(S) base URL without credentials, query or fragment');
+    }
     const operations = [];
     const warnings = [];
     const referencedSchemes = [];
     collectSecurityRefs(doc.security, referencedSchemes);
-    for (const [path, item] of Object.entries(doc.paths ?? {})) {
+    if (!isRecord(doc.paths))
+        throw new Error('import openapi: paths must be an object');
+    for (const [path, item] of Object.entries(doc.paths)) {
+        if (!isRecord(item) ||
+            !path.startsWith('/') ||
+            path.startsWith('//') ||
+            /[?#\p{Cc}]/u.test(path)) {
+            throw new Error('import openapi: use path-item objects with relative paths and declared query parameters');
+        }
         for (const [method, rawOperation] of Object.entries(item)) {
             if (!METHODS.has(method))
                 continue;
+            if (!isRecord(rawOperation))
+                throw new Error('import openapi: each supported operation must be an object');
             const operation = rawOperation;
             collectSecurityRefs(operation.security, referencedSchemes);
             const name = identifier(typeof operation.operationId === 'string' ? operation.operationId : `${method}_${path}`);
-            const parameters = (operation.parameters ?? [])
-                .filter((param) => param.in === 'path' || param.in === 'query')
-                .map((param) => ({
-                name: identifier(String(param.name ?? 'param')),
-                in: param.in,
-                required: param.required === true,
-                schema: parameterJsonSchema(param.schema),
-            }));
-            const hasRequestBody = operation.requestBody !== undefined;
-            if (hasRequestBody) {
-                warnings.push(`${name}: requestBody imported as opaque JSON string placeholder`);
-            }
+            const { parameters, connectorPath } = importOperationParameters(path, item.parameters, operation.parameters);
             const safeName = uniqueName(manifestIdentifier(name), new Set(operations.map((op) => op.safeName)));
             const responseCtx = {
                 operationName: name,
@@ -41,6 +71,13 @@ export function parseOpenApiToIr(source, options) {
                 warnings,
             };
             const output = importResponseSchema(operation.responses, responseCtx);
+            const requestBody = importRequestBody(operation.requestBody, responseCtx);
+            if (requestBody !== undefined && method === 'get') {
+                throw new Error('import openapi: GET request bodies require an explicitly authored mapping');
+            }
+            if (requestBody !== undefined && parameters.some((param) => param.name === 'body')) {
+                throw new Error('import openapi: request body and parameter input-name collision; map the inputs explicitly');
+            }
             operations.push({
                 name,
                 safeName,
@@ -49,10 +86,10 @@ export function parseOpenApiToIr(source, options) {
                 path,
                 // OpenAPI's `{name}` path params are already the connector runtime's template form; rewriting
                 // them to `${args.name}` made catalog compilation reject the path (unsupported_path_expression).
-                connectorPath: path,
+                connectorPath,
                 description: `Call ${method.toUpperCase()} ${path}.`,
                 parameters,
-                hasRequestBody,
+                ...(requestBody === undefined ? {} : { requestBody }),
                 query: parameters.filter((param) => param.in === 'query').map((param) => param.name),
                 ...(output !== undefined ? { output } : {}),
             });
@@ -124,7 +161,7 @@ export function renderOpenApiConnectorsYaml(ir) {
                 kind: 'custom',
                 http: {
                     baseUrl: ir.baseUrl,
-                    allowedOrigins: [ir.baseUrl],
+                    allowedOrigins: [new URL(ir.baseUrl).origin],
                     ...(ir.auth !== undefined ? { auth: ir.auth } : {}),
                 },
                 operations: Object.fromEntries(ir.operations.map((operation) => [operation.safeName, connectorOperation(operation)])),
@@ -153,7 +190,7 @@ export function renderOpenApiManifestYaml(ir) {
             ...outputSchemaEntry(operation),
             fulfilment: {
                 use: `api.${operation.safeName}`,
-                args: Object.fromEntries(operation.parameters.map((param) => [param.name, `\${input.${param.name}}`])),
+                args: inputArguments(operation),
             },
         })),
     })}`;
@@ -220,7 +257,7 @@ export function mergeOpenApiIntoDraft(input) {
             ...outputSchemaEntry(operation),
             fulfilment: {
                 use: `${connectorAlias}.${operationName}`,
-                args: Object.fromEntries(operation.parameters.map((param) => [param.name, `\${input.${param.name}}`])),
+                args: inputArguments(operation),
             },
         });
         existingToolNames.add(toolName);
@@ -238,10 +275,6 @@ export function mergeOpenApiIntoDraft(input) {
         warnings,
     };
 }
-export function identifier(value) {
-    const out = value.replace(/[^A-Za-z0-9_]+/g, '_').replace(/^_+|_+$/g, '');
-    return /^[A-Za-z_]/.test(out) ? out : `op_${out || 'operation'}`;
-}
 export function title(value) {
     return value.replace(/[-_]+/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
 }
@@ -255,17 +288,12 @@ function manifestIdentifier(value) {
     return /^[a-z0-9_]+$/.test(snake) && snake.length > 0 ? snake : 'operation';
 }
 function connectorOperation(operation) {
-    const required = operation.parameters.filter((param) => param.required).map((p) => p.name);
     return {
         type: operation.operationType,
         method: operation.method.toUpperCase(),
         path: operation.connectorPath,
-        input: {
-            type: 'object',
-            properties: Object.fromEntries(operation.parameters.map((param) => [param.name, parameterSchemaJson(param.schema)])),
-            ...(required.length > 0 ? { required } : {}),
-            additionalProperties: false,
-        },
+        input: inputSchema(operation),
+        ...(operation.requestBody === undefined ? {} : { request: '${args.body}' }),
         ...(operation.query.length > 0 ? { query: [...operation.query] } : {}),
         // The same lossless `{ value: <tree> }` object the tool outputSchema advertises; an untyped
         // operation keeps an open ({}) value subtree. Response mapping wraps the JSON body as `value`.
@@ -292,26 +320,28 @@ function outputSchemaEntry(operation) {
     };
 }
 function inputSchema(operation) {
+    const required = operation.parameters
+        .filter((param) => param.required)
+        .map((param) => param.name);
+    if (operation.requestBody?.required)
+        required.push('body');
     return {
         type: 'object',
-        properties: Object.fromEntries(operation.parameters.map((param) => [param.name, parameterSchemaJson(param.schema)])),
-        required: operation.parameters.filter((param) => param.required).map((param) => param.name),
+        properties: {
+            ...Object.fromEntries(operation.parameters.map((param) => [param.name, parameterSchemaJson(param.schema)])),
+            ...(operation.requestBody === undefined
+                ? {}
+                : { body: toOutputJsonSchema(operation.requestBody.schema) }),
+        },
+        required,
         additionalProperties: false,
     };
 }
-/** Import one parameter's OpenAPI schema as a lossless JSON Schema fragment (see the type doc). */
-function parameterJsonSchema(schema) {
-    if (!isRecord(schema))
-        return { type: 'string' };
-    const rawType = schema.type;
-    const base = rawType === 'number' || rawType === 'integer' || rawType === 'boolean' ? rawType : 'string';
-    const enumValues = base === 'string' ? stringEnum(schema.enum) : undefined;
-    const format = typeof schema.format === 'string' ? schema.format : undefined;
-    return {
-        type: schema.nullable === true ? [base, 'null'] : base,
-        ...(enumValues !== undefined ? { enum: enumValues } : {}),
-        ...(format !== undefined ? { format } : {}),
-    };
+function inputArguments(operation) {
+    return Object.fromEntries([
+        ...operation.parameters.map((param) => [param.name, `\${input.${param.name}}`]),
+        ...(operation.requestBody === undefined ? [] : [['body', '${input.body}']]),
+    ]);
 }
 /** A fresh plain-JSON copy of a parameter schema, safe to embed in YAML documents. */
 function parameterSchemaJson(schema) {
@@ -321,13 +351,6 @@ function parameterSchemaJson(schema) {
         ...(schema.format !== undefined ? { format: schema.format } : {}),
     };
 }
-function stringEnum(value) {
-    if (!Array.isArray(value) || value.length === 0)
-        return undefined;
-    if (!value.every((entry) => typeof entry === 'string'))
-        return undefined;
-    return value;
-}
 function parseYamlObject(source, label) {
     const parsed = YAML.parse(source);
     if (!isRecord(parsed))

package/node_modules/@noodle-borg/openapi-import/dist/request-body.js

@@ -0,0 +1,125 @@
+import { importSchemaTree, MAX_RESPONSE_SCHEMA_DEPTH, MAX_RESPONSE_SCHEMA_NODES, } from './response-schema.js';
+/** Request inputs must not silently lose constraints or become an untyped body placeholder. */
+export function importRequestBody(value, ctx) {
+    if (value === undefined)
+        return undefined;
+    if (!isRecord(value) || value.$ref !== undefined) {
+        throw new Error('import openapi: inline the request body declaration before import');
+    }
+    if (value.required !== undefined && typeof value.required !== 'boolean') {
+        throw new Error('import openapi: request body required must be boolean');
+    }
+    const content = isRecord(value.content) ? value.content : undefined;
+    const media = content?.['application/json'];
+    const raw = isRecord(media) ? media.schema : undefined;
+    if (raw === undefined)
+        throw new Error('import openapi: request body must declare an application/json schema; map other encodings explicitly');
+    assertRequestSchema(raw, ctx);
+    const warningCount = ctx.warnings.length;
+    const schema = importSchemaTree(raw, ctx, true);
+    if (schema.kind === 'unknown' || ctx.warnings.length !== warningCount) {
+        throw new Error('import openapi: request body schema cannot be imported faithfully; simplify it or author its mapping explicitly');
+    }
+    return { required: value.required === true, schema };
+}
+function assertRequestSchema(raw, ctx) {
+    const allowed = new Set([
+        'type',
+        'nullable',
+        'properties',
+        'required',
+        'items',
+        'enum',
+        'additionalProperties',
+        '$ref',
+        'title',
+        'description',
+        'example',
+        'examples',
+        'deprecated',
+    ]);
+    let nodes = 0;
+    const visit = (value, depth, refs) => {
+        nodes++;
+        if (!isRecord(value) ||
+            depth > MAX_RESPONSE_SCHEMA_DEPTH ||
+            nodes > MAX_RESPONSE_SCHEMA_NODES) {
+            throw new Error('import openapi: request body schema exceeds supported structure/depth/size bounds');
+        }
+        if (Object.keys(value).some((key) => !allowed.has(key))) {
+            throw new Error('import openapi: request body contains an unsupported schema keyword; author its validated mapping explicitly');
+        }
+        if (value.$ref !== undefined) {
+            if (Object.keys(value).some((key) => !['$ref', 'title', 'description', 'example', 'examples', 'deprecated'].includes(key))) {
+                throw new Error('import openapi: request body reference siblings cannot be imported faithfully; inline the schema');
+            }
+            if (typeof value.$ref !== 'string' ||
+                !value.$ref.startsWith('#/components/schemas/') ||
+                refs.has(value.$ref)) {
+                throw new Error('import openapi: request body has an external, circular or unsupported reference; bundle it into an inline schema');
+            }
+            const name = value.$ref
+                .slice('#/components/schemas/'.length)
+                .replace(/~1/g, '/')
+                .replace(/~0/g, '~');
+            visit(ctx.componentSchemas[name], depth + 1, new Set([...refs, value.$ref]));
+            return;
+        }
+        const types = Array.isArray(value.type) ? value.type : [value.type];
+        const concrete = types.filter((type) => type !== 'null');
+        const type = concrete[0];
+        if (concrete.length !== 1 ||
+            typeof type !== 'string' ||
+            !['string', 'number', 'integer', 'boolean', 'object', 'array'].includes(type) ||
+            types.length > 2) {
+            throw new Error('import openapi: request body requires a supported explicit type at every schema node');
+        }
+        if (value.nullable !== undefined && typeof value.nullable !== 'boolean') {
+            throw new Error('import openapi: request body nullable must be boolean');
+        }
+        if ((value.properties !== undefined ||
+            value.required !== undefined ||
+            value.additionalProperties !== undefined) &&
+            type !== 'object') {
+            throw new Error('import openapi: request body object keywords require an object type');
+        }
+        if ((type === 'array' && value.items === undefined) ||
+            (value.items !== undefined && type !== 'array')) {
+            throw new Error('import openapi: request body arrays require one typed items schema');
+        }
+        if (value.additionalProperties !== undefined &&
+            typeof value.additionalProperties !== 'boolean') {
+            throw new Error('import openapi: request body additionalProperties must be boolean');
+        }
+        if (value.enum !== undefined &&
+            (!Array.isArray(value.enum) ||
+                value.enum.length === 0 ||
+                !value.enum.every((item) => typeof item === 'string'))) {
+            throw new Error('import openapi: request body supports only nonempty string enums');
+        }
+        if (value.enum !== undefined &&
+            (type !== 'string' || types.includes('null') || value.nullable === true)) {
+            throw new Error('import openapi: request body enum/nullable combination requires an explicit mapping');
+        }
+        if (value.required !== undefined &&
+            (!Array.isArray(value.required) ||
+                !value.required.every((name) => typeof name === 'string' &&
+                    isRecord(value.properties) &&
+                    Object.hasOwn(value.properties, name)))) {
+            throw new Error('import openapi: request body required fields must have declared properties');
+        }
+        if (value.properties !== undefined) {
+            if (!isRecord(value.properties))
+                throw new Error('import openapi: request body properties must be an object');
+            for (const child of Object.values(value.properties))
+                visit(child, depth + 1, refs);
+        }
+        if (value.items !== undefined)
+            visit(value.items, depth + 1, refs);
+    };
+    visit(raw, 0, new Set());
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=request-body.js.map