@noodleseed/one 0.158.0 → 0.160.0

package/node_modules/@noodle-borg/openapi-import/dist/request-input.js

@@ -0,0 +1,139 @@
+const FIELD = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const RESERVED_FIELDS = new Set([
+    'then',
+    'equals',
+    'at',
+    'optional',
+    'toExpression',
+    'toString',
+    '__proto__',
+    'constructor',
+    'prototype',
+]);
+export function identifier(value) {
+    const out = value.replace(/[^A-Za-z0-9_]+/g, '_').replace(/^_+|_+$/g, '');
+    return /^[A-Za-z_]/.test(out) ? out : `op_${out || 'operation'}`;
+}
+/** Keep wire query names intact; path placeholder names may be normalized with their arguments. */
+export function importOperationParameters(path, inherited, own) {
+    const selected = new Map();
+    for (const list of [inherited, own]) {
+        if (list === undefined)
+            continue;
+        if (!Array.isArray(list))
+            throw new Error('import openapi: parameters must be an array');
+        for (const value of list) {
+            if (!isRecord(value) ||
+                typeof value.name !== 'string' ||
+                value.name.length === 0 ||
+                value.name.length > 128 ||
+                /\p{Cc}/u.test(value.name)) {
+                throw new Error('import openapi: use inline parameters with bounded, non-control names');
+            }
+            if (value.in !== 'path' && value.in !== 'query') {
+                throw new Error('import openapi: only path/query parameters are supported; map other locations explicitly in TypeScript');
+            }
+            if (value.style !== undefined && value.style !== (value.in === 'path' ? 'simple' : 'form')) {
+                throw new Error('import openapi: unsupported parameter serialization style; map it explicitly in TypeScript');
+            }
+            if (value.allowReserved === true ||
+                value.allowEmptyValue === true ||
+                value.content !== undefined) {
+                throw new Error('import openapi: unsupported parameter wire encoding; map it explicitly in TypeScript');
+            }
+            selected.set(`${value.in}:${value.name}`, value);
+        }
+    }
+    if (selected.size > 200)
+        throw new Error('import openapi: operation exceeds 200 parameters');
+    const names = new Set();
+    const pathNames = new Map();
+    const parameters = [...selected.values()].map((value) => {
+        const rawName = String(value.name);
+        let name = value.in === 'path' ? identifier(rawName) : rawName;
+        if (value.in === 'path' && RESERVED_FIELDS.has(name))
+            name = `param_${name}`;
+        if (!FIELD.test(name) || RESERVED_FIELDS.has(name)) {
+            throw new Error('import openapi: query parameter name cannot be addressed by the authoring expression contract; map this API through an application handler');
+        }
+        if (names.has(name))
+            throw new Error('import openapi: parameter input-name collision; map the inputs explicitly');
+        names.add(name);
+        if (value.in === 'path')
+            pathNames.set(rawName, name);
+        return {
+            name,
+            in: value.in === 'path' ? 'path' : 'query',
+            required: value.in === 'path' || value.required === true,
+            schema: parameterJsonSchema(value.schema),
+        };
+    });
+    const placeholders = [...path.matchAll(/\{([^{}]+)\}/g)].map((match) => match[1]);
+    if (placeholders.some((name) => name === undefined || !pathNames.has(name)) ||
+        [...pathNames.keys()].some((name) => !placeholders.includes(name))) {
+        throw new Error('import openapi: every path placeholder must match a declared path parameter');
+    }
+    return {
+        parameters,
+        connectorPath: path.replace(/\{([^{}]+)\}/g, (_match, name) => `{${pathNames.get(name)}}`),
+    };
+}
+function parameterJsonSchema(schema) {
+    if (schema === undefined)
+        return { type: 'string' };
+    if (!isRecord(schema))
+        throw new Error('import openapi: parameter schema must be an object');
+    if (schema.$ref !== undefined)
+        throw new Error('import openapi: inline parameter schemas before import; references are not fetched');
+    const allowed = new Set([
+        'type',
+        'nullable',
+        'enum',
+        'format',
+        'title',
+        'description',
+        'example',
+        'examples',
+        'deprecated',
+    ]);
+    if (Object.keys(schema).some((key) => !allowed.has(key))) {
+        throw new Error('import openapi: unsupported parameter schema constraint; author its validated mapping explicitly');
+    }
+    const types = Array.isArray(schema.type)
+        ? schema.type
+        : [schema.type ?? 'string'];
+    const concrete = types.filter((type) => type !== 'null');
+    const base = concrete[0];
+    if (concrete.length !== 1 ||
+        types.length > 2 ||
+        typeof base !== 'string' ||
+        !['string', 'number', 'integer', 'boolean'].includes(base)) {
+        throw new Error('import openapi: unsupported parameter schema; use a scalar or an explicitly authored mapping');
+    }
+    const enumValues = base === 'string' ? stringEnum(schema.enum) : undefined;
+    if (schema.enum !== undefined &&
+        (enumValues === undefined || types.includes('null') || schema.nullable === true)) {
+        throw new Error('import openapi: unsupported parameter enum/nullable combination; author an explicit mapping');
+    }
+    const format = typeof schema.format === 'string' ? schema.format : undefined;
+    if ((schema.nullable !== undefined && typeof schema.nullable !== 'boolean') ||
+        (schema.format !== undefined && format === undefined)) {
+        throw new Error('import openapi: invalid parameter nullable or format declaration');
+    }
+    return {
+        type: schema.nullable === true || types.includes('null') ? [base, 'null'] : base,
+        ...(enumValues !== undefined ? { enum: enumValues } : {}),
+        ...(format !== undefined ? { format } : {}),
+    };
+}
+function stringEnum(value) {
+    if (!Array.isArray(value) || value.length === 0)
+        return undefined;
+    if (!value.every((entry) => typeof entry === 'string'))
+        return undefined;
+    return value;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=request-input.js.map

package/node_modules/@noodle-borg/openapi-import/dist/response-schema.js

@@ -8,6 +8,10 @@ export const MAX_RESPONSE_SCHEMA_DEPTH = 8;
 export const MAX_RESPONSE_SCHEMA_NODES = 200;
 const UNKNOWN = { kind: 'unknown' };
 const UNSUPPORTED_COMPOSITIONS = ['oneOf', 'anyOf', 'allOf', 'not'];
+/** Shared bounded conversion; request validation is owned by request-body.ts. */
+export function importSchemaTree(raw, ctx, request = false) {
+    return convertSchema(raw, ctx, { nodes: 0, boundWarned: false, request }, 0, new Set());
+}
 /**
  * Picks the best 2xx `application/json` schema from an operation's `responses` block and
  * converts it. Returns `undefined` (with warnings pushed to the context) when the operation
@@ -41,14 +45,17 @@ export function toOutputJsonSchema(schema) {
         case 'string':
             return withNullable({ type: 'string', ...(schema.enum !== undefined ? { enum: [...schema.enum] } : {}) }, schema.nullable);
         case 'number':
-            return withNullable({ type: 'number' }, schema.nullable);
+            return withNullable({ type: schema.integer === true ? 'integer' : 'number' }, schema.nullable);
         case 'boolean':
             return withNullable({ type: 'boolean' }, schema.nullable);
         case 'array':
             return withNullable({ type: 'array', items: toOutputJsonSchema(schema.items) }, schema.nullable);
         case 'object': {
+            const extra = schema.additionalProperties === undefined
+                ? {}
+                : { additionalProperties: schema.additionalProperties };
             if (schema.properties.length === 0)
-                return withNullable({ type: 'object' }, schema.nullable);
+                return withNullable({ type: 'object', ...extra }, schema.nullable);
             const required = schema.properties
                 .filter((property) => property.required)
                 .map((property) => property.name);
@@ -59,6 +66,7 @@ export function toOutputJsonSchema(schema) {
                     toOutputJsonSchema(property.schema),
                 ])),
                 ...(required.length > 0 ? { required } : {}),
+                ...extra,
             }, schema.nullable);
         }
         case 'unknown':
@@ -101,7 +109,11 @@ function convertSchema(raw, ctx, state, depth, visitedRefs) {
         }
         case 'number':
         case 'integer':
-            return { kind: 'number', ...nullableSpread };
+            return {
+                kind: 'number',
+                ...nullableSpread,
+                ...(state.request && type === 'integer' ? { integer: true } : {}),
+            };
         case 'boolean':
             return { kind: 'boolean', ...nullableSpread };
         case 'array':
@@ -120,6 +132,7 @@ function convertSchema(raw, ctx, state, depth, visitedRefs) {
             return {
                 kind: 'object',
                 ...nullableSpread,
+                ...(state.request ? { additionalProperties: raw.additionalProperties !== false } : {}),
                 properties: Object.entries(properties).map(([name, propertySchema]) => ({
                     name,
                     required: required.has(name),
@@ -143,7 +156,7 @@ function convertRef(ref, ctx, state, depth, visitedRefs) {
         ctx.warnings.push(`${ctx.operationName}: response schema $ref "${ref}" is not a component schema reference; that part is left untyped`);
         return UNKNOWN;
     }
-    const name = ref.slice(prefix.length);
+    const name = ref.slice(prefix.length).replace(/~1/g, '/').replace(/~0/g, '~');
     if (visitedRefs.has(name)) {
         ctx.warnings.push(`${ctx.operationName}: response schema $ref "${ref}" is circular; the repeated part is left untyped`);
         return UNKNOWN;

package/node_modules/@noodle-borg/service/dist/routes/org-admin.js

@@ -1,4 +1,4 @@
-import { mcpSubdomainEndpointOptions } from '@noodle-borg/control-plane/portable';
+import { mcpSubdomainEndpointOptions, PersonalWorkspaceOwnerMutationError, } from '@noodle-borg/control-plane/portable';
 import { normalizePublicBaseDomain, OPENAI_APPS_CHALLENGE_PATH } from '@noodle-borg/module';
 import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import { OrgSummarySchema } from '@noodle-borg/wire-contracts';
@@ -142,7 +142,7 @@ export async function handleMembers(req, res, gate, controlPlane, maxBody, ref,
             return sendJson(res, 201, { ok: true, member });
         }
         catch (error) {
-            return sendJson(res, 400, { error: error.message });
+            return sendMemberMutationError(res, error);
         }
     }
     if (req.method === 'PATCH' && ref.subject !== undefined) {
@@ -177,7 +177,7 @@ export async function handleMembers(req, res, gate, controlPlane, maxBody, ref,
             return sendJson(res, 200, { ok: true, member });
         }
         catch (error) {
-            return sendJson(res, 400, { error: error.message });
+            return sendMemberMutationError(res, error);
         }
     }
     if (req.method === 'DELETE' && ref.subject !== undefined) {
@@ -186,18 +186,28 @@ export async function handleMembers(req, res, gate, controlPlane, maxBody, ref,
         if (await demotesLastOwner(controlPlane, ref.org, ref.subject, undefined)) {
             return sendJson(res, 409, { error: 'cannot remove the last owner' });
         }
-        const removed = await controlPlane.removeOrgMember({ org: ref.org, subject: ref.subject });
-        if (removed) {
-            await emitOrgAudit(audit, 'org.member.removed', ref.org, identity, 204, {
-                subject: ref.subject,
-            });
+        try {
+            const removed = await controlPlane.removeOrgMember({ org: ref.org, subject: ref.subject });
+            if (removed) {
+                await emitOrgAudit(audit, 'org.member.removed', ref.org, identity, 204, {
+                    subject: ref.subject,
+                });
+            }
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        catch (error) {
+            return sendMemberMutationError(res, error);
         }
-        res.writeHead(204);
-        res.end();
-        return;
     }
     return sendJson(res, 404, { error: 'not found' });
 }
+function sendMemberMutationError(res, error) {
+    sendJson(res, error instanceof PersonalWorkspaceOwnerMutationError ? 409 : 400, {
+        error: error.message,
+    });
+}
 export async function handleInvitations(req, res, gate, controlPlane, maxBody, ref, audit, url, invitationEmail = {}, now = () => new Date()) {
     const identity = await authorizeControlPlane(req, res, gate, { requireIdentity: true });
     if (identity === false)

package/node_modules/@noodle-borg/service/package.json

@@ -39,7 +39,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.95.0",
+    "@noodle-borg/agent-kit": "0.97.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.158.0",
+  "version": "0.160.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",
@@ -235,7 +235,7 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.95.0",
+    "@noodle-borg/agent-kit": "0.97.0",
     "@noodle-borg/app-audit": "0.0.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",