Repository navigation
v0.3.18
openapi-flow 0.3.18
Keep all three packages aligned at 0.3.18. Node.js 24 or later and a compatible
host LangChain model are required.
Separate source decisions from missing independent inputs
Per-call binding discovery now asks for a typed decision: independent inputs,
selected supplied response sources, missing explicitly requested sources, or a
mixture of supplied and missing sources. Code constructs the fixed empty fields
for that decision. Independent inputs cannot also carry dependency gaps. Missing
literal values remain the responsibility of the later argument/question stage.
Genuine and partially missing response dependencies are retained. Original OAS
contracts, source identities, selected API coverage, checkpoint validation and
global cycle checks remain mandatory. Contradictory fields fail validation rather
than being removed. No hidden model retry, response repair, invented input, API
pruning, timeout increase or external dependency change was added.
The Zod union emits nested anyOf with distinct literal kind values. An earlier
candidate emitted oneOf and was rejected by the actual model provider with
HTTP 400. That failed candidate was preserved and is not the release schema.
Compatibility and verification scope
Public function inputs, returns and existing Core source-selection records are
unchanged. Custom model implementations and test doubles must respect the supplied
structured schema instead of hardcoding the previous internal flat wire output.
This does not prove that a model always interprets natural-language dependencies
correctly. Each invocation still makes one model request; the host owns iteration.
Strict types, lint, formatting, 14 focused tests, 56 original-OAS checks, independent
strict installation/compilation over 154 operations, and isolated binding and
incremental/native runtime suites passed. Full unit results were 1,378/1,379 with
only the retained Ajv special-key failure; skipped/cancelled counts were zero.
Three actual-provider trials using the unchanged failed binding-stage input passed.
They are not full browser runs or a general workflow-quality benchmark.
The enabled Ajv properties.__proto__ regression and accepted n8n SDK Zod 3
security limitation remain. The audit reports the same High 5 advisory/dependency
records as 0.3.17, excluding only suggested-fix metadata. The gate is not a clean
pass. The broad-query clarification timeout and mid-planning browser rendering
verification remain separate work. No business-service API was executed. The n8n
dependency remains subject to its own Sustainable Use License.
Source synchronization, the matching tag, npm publication, GitHub Release, local
host installation and service deployment are separate steps. See the
release record.