fix: CATS run-validity fixes, two API contract bugs, and a Unicode validation bypass

.version

@@ -1,6 +1,6 @@
 {
   "major": 1,
   "minor": 6,
-  "patch": 0,
+  "patch": 1,
   "prerelease": ""
 }

api-schema/tmi-openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "TMI (Threat Modeling Improved) API",
     "description": "A RESTful API for collaborative threat modeling with full X6 graph library compatibility. This API provides schemas that align with AntV X6 cell object models for seamless integration with modern diagramming libraries. Supports OAuth 2.0 authentication with client callback integration for seamless single-page application authentication flows.\n\n## API Design v1.1.0\n\n### Authorization Model\nTMI uses hierarchical authorization: access control is defined at the ThreatModel level via the authorization field (readers, writers, owners). All child resources (Assets, Diagrams, Documents, Notes, Repositories, Threats) inherit permissions from their parent ThreatModel. This simplifies permission management and ensures consistent access control.\n\n### Bulk Operations\nNotes and Diagrams do not support bulk operations due to their unique creation workflows and lack of valid bulk use cases. All other resources (Threats, Assets, Documents, Repositories) support full bulk operations: POST (create), PUT (upsert), PATCH (partial update), DELETE (batch delete).\n\nAll resources support bulk metadata operations regardless of resource-level bulk support.\n\n### List Response Strategy\n- ThreatModels return summary information (TMListItem) because they contain many child objects that can be large.\n- Diagrams return summary information (DiagramListItem) because diagram data (cells, images) can be large.\n- Notes return summary information (NoteListItem) because the content field can be large.\n- Threats, Assets, Documents, Repositories return full schemas as they are relatively small and static.\n\n### PATCH Support\nAll resources support PATCH for partial updates using JSON Patch (RFC 6902). This is particularly useful for:\n- Assets: Array field updates (affected_assets, trust_boundaries) ensuring no duplicates\n- Notes: Updating name/description without changing content field\n- All resources: Efficient updates without full object replacement\n",
-    "version": "1.6.0",
+    "version": "1.6.1",
     "contact": {
       "name": "TMI Development Team",
       "url": "https://github.com/ericfitz/tmi",
@@ -25581,6 +25581,76 @@
           },
           "404": {
             "$ref": "#/components/responses/Error"
+          },
+          "200": {
+            "description": "Repositories upserted successfully. Returned when the bulk upsert completes; the handler returns 200 for PUT regardless of how many items were newly created.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/Repository"
+                  },
+                  "maxItems": 1000
+                },
+                "examples": {
+                  "bulkCreatedSources": {
+                    "summary": "Successfully created sources with generated IDs",
+                    "value": [
+                      {
+                        "name": "User Authentication Module",
+                        "description": "Core user authentication logic",
+                        "created_at": "2025-04-06T12:00:00Z",
+                        "modified_at": "2025-04-06T12:00:00Z",
+                        "uri": "https://github.com/company/repo/blob/main/oauth2/user.go",
+                        "id": "990e8400-e29b-41d4-a716-446655440023"
+                      },
+                      {
+                        "id": "650e8400-e29b-41d4-a716-446655440002",
+                        "name": "Database Connection Pool",
+                        "description": "Database connection management",
+                        "metadata": [
+                          {
+                            "key": "type",
+                            "value": "infrastructure"
+                          },
+                          {
+                            "key": "criticality",
+                            "value": "high"
+                          }
+                        ],
+                        "created_at": "2025-04-06T12:00:00Z",
+                        "modified_at": "2025-04-06T12:00:00Z",
+                        "uri": "https://github.com/company/repo/blob/main/db/pool.go"
+                      }
+                    ]
+                  }
+                }
+              }
+            },
+            "headers": {
+              "X-RateLimit-Limit": {
+                "description": "Maximum number of requests allowed in the current time window",
+                "schema": {
+                  "type": "integer",
+                  "example": 1000
+                }
+              },
+              "X-RateLimit-Remaining": {
+                "description": "Number of requests remaining in the current time window",
+                "schema": {
+                  "type": "integer",
+                  "example": 999
+                }
+              },
+              "X-RateLimit-Reset": {
+                "description": "Unix epoch seconds when the rate limit window resets",
+                "schema": {
+                  "type": "integer",
+                  "example": 1735689600
+                }
+              }
+            }
           }
         },
         "x-rate-limit": {
@@ -32366,6 +32436,53 @@
           },
           "404": {
             "$ref": "#/components/responses/Error"
+          },
+          "200": {
+            "description": "Assets upserted successfully. Returned when the bulk upsert completes; the handler returns 200 for PUT regardless of how many items were newly created.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/Asset"
+                  },
+                  "maxItems": 1000
+                },
+                "example": [
+                  {
+                    "id": "550e8400-e29b-41d4-a716-446655440001",
+                    "name": "API Gateway Updated",
+                    "type": "software",
+                    "description": "Updated gateway service",
+                    "created_at": "2026-01-17T10:00:00Z",
+                    "modified_at": "2026-01-17T11:00:00Z"
+                  }
+                ]
+              }
+            },
+            "headers": {
+              "X-RateLimit-Limit": {
+                "description": "Maximum number of requests allowed in the current time window",
+                "schema": {
+                  "type": "integer",
+                  "example": 1000
+                }
+              },
+              "X-RateLimit-Remaining": {
+                "description": "Number of requests remaining in the current time window",
+                "schema": {
+                  "type": "integer",
+                  "example": 999
+                }
+              },
+              "X-RateLimit-Reset": {
+                "description": "Unix epoch seconds when the rate limit window resets",
+                "schema": {
+                  "type": "integer",
+                  "example": 1735689600
+                }
+              }
+            }
           }
         },
         "x-rate-limit": {
@@ -59335,6 +59452,39 @@
           },
           "503": {
             "$ref": "#/components/responses/ServiceUnavailable"
+          },
+          "202": {
+            "description": "Test delivery accepted and queued for asynchronous sending. The response carries the delivery id; delivery outcome is reported separately via the deliveries endpoints.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/WebhookTestResponse"
+                }
+              }
+            },
+            "headers": {
+              "X-RateLimit-Limit": {
+                "description": "Maximum number of requests allowed in the current time window",
+                "schema": {
+                  "type": "integer",
+                  "example": 1000
+                }
+              },
+              "X-RateLimit-Remaining": {
+                "description": "Number of requests remaining in the current time window",
+                "schema": {
+                  "type": "integer",
+                  "example": 999
+                }
+              },
+              "X-RateLimit-Reset": {
+                "description": "Unix epoch seconds when the rate limit window resets",
+                "schema": {
+                  "type": "integer",
+                  "example": 1735689600
+                }
+              }
+            }
           }
         },
         "x-rate-limit": {