@gajae-code/ai 0.15.5 → 0.16.0

package/src/utils/schema/normalize.ts

@@ -70,6 +70,14 @@ const SNAKE_TO_CAMEL_RENAMES = new Map<string, string>([
 
 const JSON_SCHEMA_COMBINERS = ["anyOf", "oneOf"] as const;
 const CCA_FORBIDDEN_COMBINERS = new Set(["anyOf", "oneOf", "allOf"]);
+const JSON_SCHEMA_MAP_KEYS = new Set([
+	"properties",
+	"patternProperties",
+	"dependencies",
+	"dependentSchemas",
+	"$defs",
+	"definitions",
+]);
 
 const CLOUD_CODE_ASSIST_CLAUDE_FALLBACK_SCHEMA = {
 	type: "object",
@@ -109,9 +117,9 @@ function applySnakeCaseRenames(obj: JsonObject): JsonObject {
 		if (!Object.hasOwn(obj, k)) continue;
 		const renamed = SNAKE_TO_CAMEL_RENAMES.get(k);
 		if (renamed !== undefined) {
-			out[renamed] = obj[k];
+			setOwnKey(out, renamed, obj[k]);
 		} else if (!outHasOwn(out, k)) {
-			out[k] = obj[k];
+			setOwnKey(out, k, obj[k]);
 		}
 	}
 	return out;
@@ -124,21 +132,21 @@ function applySnakeCaseRenames(obj: JsonObject): JsonObject {
  * original reference otherwise (zero-allocation fast path).
  */
 function preHandleNullFields(obj: JsonObject): JsonObject {
-	if (obj.type === "null") {
+	if (Object.hasOwn(obj, "type") && obj.type === "null") {
 		const out: JsonObject = {};
 		for (const k in obj) {
 			if (!Object.hasOwn(obj, k) || k === "type") continue;
-			out[k] = obj[k];
+			setOwnKey(out, k, obj[k]);
 		}
 		out.nullable = true;
 		return out;
 	}
-	if (!Array.isArray(obj.anyOf)) return obj;
+	if (!Object.hasOwn(obj, "anyOf") || !Array.isArray(obj.anyOf)) return obj;
 	const variants = obj.anyOf as unknown[];
 	let sawNull = false;
 	const kept: unknown[] = [];
 	for (const v of variants) {
-		if (isJsonObject(v) && v.type === "null") {
+		if (isJsonObject(v) && Object.hasOwn(v, "type") && v.type === "null") {
 			sawNull = true;
 			continue;
 		}
@@ -147,7 +155,7 @@ function preHandleNullFields(obj: JsonObject): JsonObject {
 	if (!sawNull) return obj;
 	const out: JsonObject = {};
 	for (const k in obj) {
-		if (Object.hasOwn(obj, k)) out[k] = obj[k];
+		if (Object.hasOwn(obj, k)) setOwnKey(out, k, obj[k]);
 	}
 	out.nullable = true;
 	if (kept.length === 0) {
@@ -156,7 +164,7 @@ function preHandleNullFields(obj: JsonObject): JsonObject {
 		delete out.anyOf;
 		const only = kept[0];
 		for (const k in only) {
-			if (Object.hasOwn(only, k) && !outHasOwn(out, k)) out[k] = only[k];
+			if (Object.hasOwn(only, k) && !outHasOwn(out, k)) setOwnKey(out, k, only[k]);
 		}
 	} else {
 		out.anyOf = kept;
@@ -168,6 +176,50 @@ function outHasOwn(obj: JsonObject, key: string): boolean {
 	return Object.hasOwn(obj, key);
 }
 
+/**
+ * Setter-independent own-data write. `JSON.parse` produces `__proto__` as an own
+ * data property, but plain-object assignment routes it to `Object.prototype`'s
+ * `__proto__` setter, so the key would be silently dropped from the copy (and a
+ * schema-shaped value would mutate the copy's prototype). Every schema copy site
+ * writes through this helper so arbitrary property names round-trip as data.
+ */
+function setOwnKey(target: JsonObject, key: string, value: unknown): void {
+	if (key === "__proto__") {
+		Object.defineProperty(target, key, { value, writable: true, enumerable: true, configurable: true });
+		return;
+	}
+	target[key] = value;
+}
+
+/**
+ * JSON Schema keywords whose values are literal instance data, not subschemas.
+ * The schema walkers must copy them verbatim: recursing into them rewrites user
+ * payloads (a `default` of `{type:"object",nullable:true}` is a default value,
+ * not a nullable object schema).
+ */
+const JSON_SCHEMA_LITERAL_PAYLOAD_KEYS = new Set(["default", "const", "enum", "examples"]);
+
+/** Deep copy of literal payload data; preserves arbitrary keys and breaks aliasing to the caller's input. */
+function cloneJsonLiteral(value: unknown, seen?: WeakMap<object, unknown>): unknown {
+	if (!value || typeof value !== "object") return value;
+	const cache = seen ?? new WeakMap<object, unknown>();
+	const cached = cache.get(value);
+	if (cached !== undefined) return cached;
+	if (Array.isArray(value)) {
+		const out: unknown[] = [];
+		cache.set(value, out);
+		for (const entry of value) out.push(cloneJsonLiteral(entry, cache));
+		return out;
+	}
+	const out: JsonObject = {};
+	cache.set(value, out);
+	for (const key in value as JsonObject) {
+		if (!Object.hasOwn(value, key)) continue;
+		setOwnKey(out, key, cloneJsonLiteral((value as JsonObject)[key], cache));
+	}
+	return out;
+}
+
 function inferJsonSchemaTypeFromValue(value: unknown): string | undefined {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "array";
@@ -225,6 +277,21 @@ function normalizeSchemaNode(value: unknown, options: NormalizeSchemaWalkOptions
 		return value;
 	}
 	if (!once(value, options.epoch)) return {};
+	if (options.insideProperties) {
+		let changed = false;
+		const result: JsonObject = {};
+		for (const key in value) {
+			if (!Object.hasOwn(value, key)) continue;
+			const child = value[key];
+			const next = normalizeSchemaNode(child, {
+				...options,
+				insideProperties: false,
+			});
+			if (next !== child) changed = true;
+			setOwnKey(result, key, next);
+		}
+		return changed ? result : value;
+	}
 	let obj = options.normalizeFieldNames && !options.insideProperties ? applySnakeCaseRenames(value) : value;
 	if (options.collapseNullFields && !options.insideProperties) {
 		obj = preHandleNullFields(obj);
@@ -232,19 +299,20 @@ function normalizeSchemaNode(value: unknown, options: NormalizeSchemaWalkOptions
 	const result: JsonObject = {};
 	let spill: Array<[string, unknown]> | undefined;
 	for (const combiner of JSON_SCHEMA_COMBINERS) {
-		if (!Array.isArray(obj[combiner])) continue;
-		const variants = obj[combiner] as JsonObject[];
-		const allHaveConst = variants.every(v => isJsonObject(v) && "const" in v);
+		const variantsRaw = Object.hasOwn(obj, combiner) ? obj[combiner] : undefined;
+		if (!Array.isArray(variantsRaw)) continue;
+		const variants = variantsRaw as JsonObject[];
+		const allHaveConst = variants.every(v => isJsonObject(v) && Object.hasOwn(v, "const"));
 		if (!allHaveConst || variants.length === 0) continue;
 
 		const dedupedEnum: unknown[] = [];
 		for (const variant of variants) {
-			pushEnumValue(dedupedEnum, variant.const);
+			pushEnumValue(dedupedEnum, cloneJsonLiteral(variant.const));
 		}
 		result.enum = dedupedEnum;
 
 		const explicitTypes = variants
-			.map(variant => variant.type)
+			.map(variant => (Object.hasOwn(variant, "type") ? variant.type : undefined))
 			.filter((variantType): variantType is string => typeof variantType === "string");
 		const allHaveSameExplicitType =
 			explicitTypes.length === variants.length &&
@@ -278,10 +346,18 @@ function normalizeSchemaNode(value: unknown, options: NormalizeSchemaWalkOptions
 				continue;
 			}
 			if (options.stripNullableKeyword && key === "nullable") continue;
-			result[key] = normalizeSchemaNode(entry, {
-				...options,
-				insideProperties: key === "properties",
-			});
+			if (JSON_SCHEMA_LITERAL_PAYLOAD_KEYS.has(key)) {
+				setOwnKey(result, key, cloneJsonLiteral(entry));
+				continue;
+			}
+			setOwnKey(
+				result,
+				key,
+				normalizeSchemaNode(entry, {
+					...options,
+					insideProperties: JSON_SCHEMA_MAP_KEYS.has(key),
+				}),
+			);
 		}
 		applyDescriptionSpill(result, spill, options);
 		return applyNodePostProcessing(result, options);
@@ -297,13 +373,21 @@ function normalizeSchemaNode(value: unknown, options: NormalizeSchemaWalkOptions
 		}
 		if (options.stripNullableKeyword && key === "nullable") continue;
 		if (key === "const") {
-			constValue = entry;
+			constValue = cloneJsonLiteral(entry);
 			continue;
 		}
-		result[key] = normalizeSchemaNode(entry, {
-			...options,
-			insideProperties: key === "properties",
-		});
+		if (JSON_SCHEMA_LITERAL_PAYLOAD_KEYS.has(key)) {
+			setOwnKey(result, key, cloneJsonLiteral(entry));
+			continue;
+		}
+		setOwnKey(
+			result,
+			key,
+			normalizeSchemaNode(entry, {
+				...options,
+				insideProperties: JSON_SCHEMA_MAP_KEYS.has(key),
+			}),
+		);
 	}
 
 	if (options.normalizeTypeArrayToNullable && Array.isArray(result.type)) {
@@ -367,7 +451,7 @@ export function copySchemaWithout(schema: JsonObject, combiner: string): JsonObj
 }
 
 function mergeObjectCombinerVariants(schema: JsonObject, combiner: "anyOf" | "oneOf"): JsonObject {
-	const variantsRaw = schema[combiner];
+	const variantsRaw = Object.hasOwn(schema, combiner) ? schema[combiner] : undefined;
 	if (!Array.isArray(variantsRaw) || variantsRaw.length === 0) {
 		return schema;
 	}
@@ -377,10 +461,10 @@ function mergeObjectCombinerVariants(schema: JsonObject, combiner: "anyOf" | "on
 		if (!isJsonObject(entry)) {
 			return schema;
 		}
-		const variantType = entry.type;
+		const variantType = Object.hasOwn(entry, "type") ? entry.type : undefined;
 		const hasObjectShape =
-			isJsonObject(entry.properties) ||
-			Array.isArray(entry.required) ||
+			(Object.hasOwn(entry, "properties") && isJsonObject(entry.properties)) ||
+			(Object.hasOwn(entry, "required") && Array.isArray(entry.required)) ||
 			Object.hasOwn(entry, "additionalProperties");
 		if (variantType === undefined && !hasObjectShape) {
 			return schema;
@@ -388,29 +472,34 @@ function mergeObjectCombinerVariants(schema: JsonObject, combiner: "anyOf" | "on
 		if (variantType !== undefined && variantType !== "object") {
 			return schema;
 		}
-		if (entry.properties !== undefined && !isJsonObject(entry.properties)) {
+		if (Object.hasOwn(entry, "properties") && !isJsonObject(entry.properties)) {
 			return schema;
 		}
-		if (entry.required !== undefined && !Array.isArray(entry.required)) {
+		if (Object.hasOwn(entry, "required") && !Array.isArray(entry.required)) {
 			return schema;
 		}
 		variants.push(entry);
 	}
 
 	const mergedProperties: JsonObject = {};
-	const ownProperties = isJsonObject(schema.properties) ? schema.properties : {};
+	const ownProperties =
+		Object.hasOwn(schema, "properties") && isJsonObject(schema.properties) ? schema.properties : {};
 	for (const name in ownProperties) {
-		if (Object.hasOwn(ownProperties, name)) mergedProperties[name] = ownProperties[name];
+		if (Object.hasOwn(ownProperties, name)) setOwnKey(mergedProperties, name, ownProperties[name]);
 	}
 
 	for (const variant of variants) {
-		const properties = isJsonObject(variant.properties) ? variant.properties : {};
+		const properties =
+			Object.hasOwn(variant, "properties") && isJsonObject(variant.properties) ? variant.properties : {};
 		for (const name in properties) {
 			if (!Object.hasOwn(properties, name)) continue;
 			const propertySchema = properties[name];
-			const existingSchema = mergedProperties[name];
-			mergedProperties[name] =
-				existingSchema === undefined ? propertySchema : mergePropertySchemas(existingSchema, propertySchema);
+			const existingSchema = Object.hasOwn(mergedProperties, name) ? mergedProperties[name] : undefined;
+			setOwnKey(
+				mergedProperties,
+				name,
+				existingSchema === undefined ? propertySchema : mergePropertySchemas(existingSchema, propertySchema),
+			);
 		}
 	}
 
@@ -420,9 +509,10 @@ function mergeObjectCombinerVariants(schema: JsonObject, combiner: "anyOf" | "on
 
 	let requiredIntersection: string[] | undefined;
 	for (const variant of variants) {
-		const variantRequired = Array.isArray(variant.required)
-			? variant.required.filter((r): r is string => typeof r === "string")
-			: [];
+		const variantRequired =
+			Object.hasOwn(variant, "required") && Array.isArray(variant.required)
+				? variant.required.filter((r): r is string => typeof r === "string")
+				: [];
 		if (requiredIntersection === undefined) {
 			requiredIntersection = [...variantRequired];
 		} else {
@@ -430,9 +520,10 @@ function mergeObjectCombinerVariants(schema: JsonObject, combiner: "anyOf" | "on
 			requiredIntersection = requiredIntersection.filter(r => reqSet.has(r));
 		}
 	}
-	const parentRequired = Array.isArray(schema.required)
-		? schema.required.filter((r): r is string => typeof r === "string")
-		: [];
+	const parentRequired =
+		Object.hasOwn(schema, "required") && Array.isArray(schema.required)
+			? schema.required.filter((r): r is string => typeof r === "string")
+			: [];
 	const safeRequired = new Set<string>();
 	for (const name of requiredIntersection ?? []) {
 		if (Object.hasOwn(mergedProperties, name)) safeRequired.add(name);
@@ -456,7 +547,7 @@ function mergeObjectCombinerVariants(schema: JsonObject, combiner: "anyOf" | "on
 }
 
 function collapseMixedTypeCombinerVariants(schema: JsonObject, combiner: "anyOf" | "oneOf"): JsonObject {
-	const variantsRaw = schema[combiner];
+	const variantsRaw = Object.hasOwn(schema, combiner) ? schema[combiner] : undefined;
 	if (!Array.isArray(variantsRaw) || variantsRaw.length === 0) {
 		return schema;
 	}
@@ -465,7 +556,7 @@ function collapseMixedTypeCombinerVariants(schema: JsonObject, combiner: "anyOf"
 	const variantTypes: string[] = [];
 	const mergedVariantFields: JsonObject = {};
 	for (const entry of variantsRaw) {
-		if (!isJsonObject(entry) || typeof entry.type !== "string") {
+		if (!isJsonObject(entry) || !Object.hasOwn(entry, "type") || typeof entry.type !== "string") {
 			return schema;
 		}
 
@@ -487,11 +578,11 @@ function collapseMixedTypeCombinerVariants(schema: JsonObject, combiner: "anyOf"
 				return schema;
 			}
 
-			const existingValue = mergedVariantFields[key];
+			const existingValue = Object.hasOwn(mergedVariantFields, key) ? mergedVariantFields[key] : undefined;
 			if (existingValue !== undefined && !areJsonValuesEqual(existingValue, variantValue)) {
 				return schema;
 			}
-			mergedVariantFields[key] = variantValue;
+			setOwnKey(mergedVariantFields, key, variantValue);
 		}
 
 		seenTypes.add(variantType);
@@ -508,24 +599,24 @@ function collapseMixedTypeCombinerVariants(schema: JsonObject, combiner: "anyOf"
 	for (const key in mergedVariantFields) {
 		if (!Object.hasOwn(mergedVariantFields, key)) continue;
 		const value = mergedVariantFields[key];
-		const existingValue = nextSchema[key];
+		const existingValue = Object.hasOwn(nextSchema, key) ? nextSchema[key] : undefined;
 		if (existingValue !== undefined && !areJsonValuesEqual(existingValue, value)) {
 			return schema;
 		}
 		if (existingValue === undefined) {
-			nextSchema[key] = value;
+			setOwnKey(nextSchema, key, value);
 		}
 	}
 	return nextSchema;
 }
 
 function collapseSameTypeCombinerVariants(schema: JsonObject, combiner: "anyOf" | "oneOf"): JsonObject {
-	const variantsRaw = schema[combiner];
+	const variantsRaw = Object.hasOwn(schema, combiner) ? schema[combiner] : undefined;
 	if (!Array.isArray(variantsRaw) || variantsRaw.length === 0) return schema;
 	let commonType: string | undefined;
 	let firstEntry: JsonObject | undefined;
 	for (const entry of variantsRaw) {
-		if (!isJsonObject(entry) || typeof entry.type !== "string") return schema;
+		if (!isJsonObject(entry) || !Object.hasOwn(entry, "type") || typeof entry.type !== "string") return schema;
 		if (commonType === undefined) {
 			commonType = entry.type;
 			firstEntry = entry;
@@ -534,7 +625,7 @@ function collapseSameTypeCombinerVariants(schema: JsonObject, combiner: "anyOf"
 	if (!firstEntry) return schema;
 	const nextSchema = copySchemaWithout(schema, combiner);
 	for (const key in firstEntry) {
-		if (Object.hasOwn(firstEntry, key) && !outHasOwn(nextSchema, key)) nextSchema[key] = firstEntry[key];
+		if (Object.hasOwn(firstEntry, key) && !outHasOwn(nextSchema, key)) setOwnKey(nextSchema, key, firstEntry[key]);
 	}
 	return nextSchema;
 }
@@ -544,6 +635,16 @@ function collapseSameTypeCombinerVariants(schema: JsonObject, combiner: "anyOf"
  * collapse can handle. This is needed because object-combiner merging can
  * create new anyOf in merged subtrees after child normalization already ran.
  */
+function stripResidualCombinersMap(schemaMap: JsonObject, epoch: number): JsonObject {
+	if (!once(schemaMap, epoch)) return {};
+	const result: JsonObject = {};
+	for (const key in schemaMap) {
+		if (!Object.hasOwn(schemaMap, key)) continue;
+		setOwnKey(result, key, stripResidualCombiners(schemaMap[key], epoch));
+	}
+	return result;
+}
+
 export function stripResidualCombiners(value: unknown, epoch: number = epochNext()): unknown {
 	if (Array.isArray(value)) {
 		if (!once(value, epoch)) return [];
@@ -553,7 +654,19 @@ export function stripResidualCombiners(value: unknown, epoch: number = epochNext
 	if (!once(value, epoch)) return {};
 	const result: JsonObject = {};
 	for (const key in value) {
-		if (Object.hasOwn(value, key)) result[key] = stripResidualCombiners(value[key], epoch);
+		if (!Object.hasOwn(value, key)) continue;
+		if (JSON_SCHEMA_LITERAL_PAYLOAD_KEYS.has(key)) {
+			setOwnKey(result, key, value[key]);
+			continue;
+		}
+		const child = value[key];
+		setOwnKey(
+			result,
+			key,
+			JSON_SCHEMA_MAP_KEYS.has(key) && isJsonObject(child)
+				? stripResidualCombinersMap(child, epoch)
+				: stripResidualCombiners(child, epoch),
+		);
 	}
 	let current: JsonObject = result;
 	let changed = true;
@@ -585,13 +698,13 @@ function extractNullableUnionSchema(schema: unknown): NullableExtractionResult {
 		return { schema, nullable: false };
 	}
 
-	if (schema.nullable === true) {
+	if (Object.hasOwn(schema, "nullable") && schema.nullable === true) {
 		const nextSchema = { ...schema };
 		delete nextSchema.nullable;
 		return { schema: nextSchema, nullable: true };
 	}
 
-	if (Array.isArray(schema.type)) {
+	if (Object.hasOwn(schema, "type") && Array.isArray(schema.type)) {
 		const typeVariants = schema.type.filter((entry): entry is string => typeof entry === "string");
 		const nonNullTypes = typeVariants.filter(entry => entry !== "null");
 		if (typeVariants.includes("null") && nonNullTypes.length === 1) {
@@ -601,13 +714,13 @@ function extractNullableUnionSchema(schema: unknown): NullableExtractionResult {
 	}
 
 	for (const combiner of JSON_SCHEMA_COMBINERS) {
-		const variantsRaw = schema[combiner];
+		const variantsRaw = Object.hasOwn(schema, combiner) ? schema[combiner] : undefined;
 		if (!Array.isArray(variantsRaw)) continue;
 
 		let hasNullVariant = false;
 		const nonNullVariants: unknown[] = [];
 		for (const variant of variantsRaw) {
-			if (isJsonObject(variant) && variant.type === "null") {
+			if (isJsonObject(variant) && Object.hasOwn(variant, "type") && variant.type === "null") {
 				let keyCount = 0;
 				for (const k in variant) {
 					if (!Object.hasOwn(variant, k)) continue;
@@ -630,12 +743,12 @@ function extractNullableUnionSchema(schema: unknown): NullableExtractionResult {
 		for (const key in nonNullVariant) {
 			if (!Object.hasOwn(nonNullVariant, key)) continue;
 			const value = nonNullVariant[key];
-			const existingValue = nextSchema[key];
+			const existingValue = Object.hasOwn(nextSchema, key) ? nextSchema[key] : undefined;
 			if (existingValue !== undefined && !areJsonValuesEqual(existingValue, value)) {
 				return { schema, nullable: false };
 			}
 			if (existingValue === undefined) {
-				nextSchema[key] = value;
+				setOwnKey(nextSchema, key, value);
 			}
 		}
 		return { schema: nextSchema, nullable: true };
@@ -649,6 +762,23 @@ interface NullableNormalizationResult {
 	nullable: boolean;
 }
 
+function normalizeNullableSchemaMapForCloudCodeAssist(
+	value: JsonObject,
+	propertyMap: boolean,
+	epoch: number,
+): { schema: JsonObject; nullableKeys: Set<string> } {
+	if (!once(value, epoch)) return { schema: {}, nullableKeys: new Set() };
+	const normalized: JsonObject = {};
+	const nullableKeys = new Set<string>();
+	for (const key in value) {
+		if (!Object.hasOwn(value, key)) continue;
+		const child = normalizeNullablePropertiesForCloudCodeAssist(value[key], propertyMap, epoch);
+		setOwnKey(normalized, key, child.schema);
+		if (child.nullable) nullableKeys.add(key);
+	}
+	return { schema: normalized, nullableKeys };
+}
+
 function normalizeNullablePropertiesForCloudCodeAssist(
 	value: unknown,
 	isPropertySchema = false,
@@ -671,29 +801,30 @@ function normalizeNullablePropertiesForCloudCodeAssist(
 	}
 
 	const normalized: JsonObject = {};
+	let nullablePropertyKeys: Set<string> | undefined;
 	for (const key in value) {
-		if (Object.hasOwn(value, key))
-			normalized[key] = normalizeNullablePropertiesForCloudCodeAssist(value[key], false, epoch).schema;
+		if (!Object.hasOwn(value, key)) continue;
+		if (JSON_SCHEMA_LITERAL_PAYLOAD_KEYS.has(key)) {
+			setOwnKey(normalized, key, value[key]);
+			continue;
+		}
+		if (JSON_SCHEMA_MAP_KEYS.has(key) && isJsonObject(value[key])) {
+			const mapped = normalizeNullableSchemaMapForCloudCodeAssist(value[key], key === "properties", epoch);
+			setOwnKey(normalized, key, mapped.schema);
+			if (key === "properties") nullablePropertyKeys = mapped.nullableKeys;
+			continue;
+		}
+		setOwnKey(normalized, key, normalizeNullablePropertiesForCloudCodeAssist(value[key], false, epoch).schema);
 	}
 
-	if (isJsonObject(normalized.properties)) {
-		const properties = normalized.properties;
+	if (nullablePropertyKeys && isJsonObject(normalized.properties)) {
 		const required = new Set(
 			Array.isArray(normalized.required)
 				? normalized.required.filter((entry): entry is string => typeof entry === "string")
 				: [],
 		);
-		const nextProperties: JsonObject = {};
-		for (const name in properties) {
-			if (!Object.hasOwn(properties, name)) continue;
-			const normalizedProperty = normalizeNullablePropertiesForCloudCodeAssist(properties[name], true, epoch);
-			nextProperties[name] = normalizedProperty.schema;
-			if (normalizedProperty.nullable) {
-				required.delete(name);
-			}
-		}
-		normalized.properties = nextProperties;
-		if (Array.isArray(normalized.required)) {
+		for (const key of nullablePropertyKeys) required.delete(key);
+		if (Object.hasOwn(normalized, "required") && Array.isArray(normalized.required)) {
 			normalized.required = Array.from(required);
 		}
 	}
@@ -750,23 +881,38 @@ function hasResidualSchemaIncompatibilities(
 		return false;
 	}
 
-	if (checks.typeArray && Array.isArray(value.type)) return true;
-	if (checks.typeNull && value.type === "null") return true;
+	if (checks.typeArray && Object.hasOwn(value, "type") && Array.isArray(value.type)) return true;
+	if (checks.typeNull && Object.hasOwn(value, "type") && value.type === "null") return true;
 	if (checks.nullable && Object.hasOwn(value, "nullable")) return true;
 	if (checks.combiners) {
 		for (const combiner of CCA_FORBIDDEN_COMBINERS) {
-			if (Array.isArray(value[combiner])) return true;
+			if (Object.hasOwn(value, combiner) && Array.isArray(value[combiner])) return true;
 		}
 	}
 	for (const k in value) {
 		if (!Object.hasOwn(value, k)) continue;
-		if (hasResidualSchemaIncompatibilities(value[k], checks, epoch)) {
+		if (JSON_SCHEMA_LITERAL_PAYLOAD_KEYS.has(k)) continue;
+		const child = value[k];
+		const hasResidual =
+			JSON_SCHEMA_MAP_KEYS.has(k) && isJsonObject(child)
+				? hasResidualSchemaMap(child, checks, epoch)
+				: hasResidualSchemaIncompatibilities(child, checks, epoch);
+		if (hasResidual) {
 			return true;
 		}
 	}
 	return false;
 }
 
+function hasResidualSchemaMap(value: JsonObject, checks: ResidualIncompatibilityChecks, epoch: number): boolean {
+	if (!once(value, epoch)) return false;
+	for (const key in value) {
+		if (!Object.hasOwn(value, key)) continue;
+		if (hasResidualSchemaIncompatibilities(value[key], checks, epoch)) return true;
+	}
+	return false;
+}
+
 export function normalizeSchema(value: unknown, options: NormalizeSchemaOptions): unknown {
 	const detoxified = decontaminateZodInstance(value);
 	const upgraded = upgradeJsonSchemaTo202012(detoxified);
@@ -832,8 +978,102 @@ export function normalizeSchemaForCCA(value: unknown): unknown {
 	});
 }
 
+const MCP_SCHEMA_ARRAY_KEYS = new Set(["anyOf", "oneOf", "allOf", "prefixItems"]);
+const MCP_SCHEMA_MAP_KEYS = new Set([
+	"properties",
+	"patternProperties",
+	"dependencies",
+	"dependentSchemas",
+	"$defs",
+	"definitions",
+]);
+const MCP_SCHEMA_VALUE_KEYS = new Set([
+	"items",
+	"additionalItems",
+	"contains",
+	"contentSchema",
+	"propertyNames",
+	"if",
+	"then",
+	"else",
+	"not",
+	"additionalProperties",
+	"unevaluatedItems",
+	"unevaluatedProperties",
+]);
+
+function makeImplicitMcpObjectMapsExplicit(value: unknown): unknown {
+	return normalizeMcpObjectMapNode(value, new WeakMap());
+}
+
+function normalizeMcpObjectMapNode(value: unknown, cache: WeakMap<JsonObject, JsonObject>): unknown {
+	if (!isJsonObject(value)) return value;
+	const cached = cache.get(value);
+	if (cached) return cached;
+
+	const output: JsonObject = {};
+	cache.set(value, output);
+	let changed = false;
+
+	for (const key in value) {
+		if (!Object.hasOwn(value, key)) continue;
+		const child = value[key];
+		let next: unknown = child;
+		if (MCP_SCHEMA_MAP_KEYS.has(key) && isJsonObject(child)) {
+			next = normalizeMcpObjectMap(child, cache);
+		} else if (MCP_SCHEMA_ARRAY_KEYS.has(key) && Array.isArray(child)) {
+			next = normalizeMcpObjectMapArray(child, cache);
+		} else if (MCP_SCHEMA_VALUE_KEYS.has(key)) {
+			next = Array.isArray(child)
+				? normalizeMcpObjectMapArray(child, cache)
+				: normalizeMcpObjectMapNode(child, cache);
+		}
+		if (next !== child) changed = true;
+		setOwnKey(output, key, next);
+	}
+
+	const schemaType = Object.hasOwn(value, "type") ? value.type : undefined;
+	if (
+		declaresObjectType(schemaType) &&
+		!Object.hasOwn(value, "properties") &&
+		!Object.hasOwn(value, "additionalProperties") &&
+		!Object.hasOwn(value, "patternProperties") &&
+		!Object.hasOwn(value, "unevaluatedProperties")
+	) {
+		output.additionalProperties = true;
+		changed = true;
+	}
+
+	const result = changed ? output : value;
+	cache.set(value, result);
+	return result;
+}
+
+function normalizeMcpObjectMapArray(value: unknown[], cache: WeakMap<JsonObject, JsonObject>): unknown[] {
+	let changed = false;
+	const output = value.map(item => {
+		const next = normalizeMcpObjectMapNode(item, cache);
+		if (next !== item) changed = true;
+		return next;
+	});
+	return changed ? output : value;
+}
+
+function normalizeMcpObjectMap(schemaMap: JsonObject, cache: WeakMap<JsonObject, JsonObject>): JsonObject {
+	let changed = false;
+	const output: JsonObject = {};
+	for (const key in schemaMap) {
+		if (!Object.hasOwn(schemaMap, key)) continue;
+		const child = schemaMap[key];
+		const next = normalizeMcpObjectMapNode(child, cache);
+		if (next !== child) changed = true;
+		setOwnKey(output, key, next);
+	}
+	return changed ? output : schemaMap;
+}
+
 export function normalizeSchemaForMCP(value: unknown): unknown {
-	return normalizeSchema(value, {
+	const normalized = normalizeSchema(value, {
 		unsupportedFields: isMcpUnsupportedSchemaField,
 		normalizeFieldNames: false,
 		collapseNullFields: false,
@@ -848,6 +1088,7 @@ export function normalizeSchemaForMCP(value: unknown): unknown {
 		stripResidualCombinersFixpoint: false,
 		extractNullableFromUnions: false,
 	});
+	return makeImplicitMcpObjectMapsExplicit(normalized);
 }
 
 // ---------------------------------------------------------------------------
@@ -952,7 +1193,7 @@ function normalizeOpenAIResponsesSchemaNode(value: unknown, cache: WeakMap<JsonO
 		}
 
 		if (next !== child) changed = true;
-		output[key] = next;
+		setOwnKey(output, key, next);
 	}
 
 	if (Array.isArray(value.oneOf)) {
@@ -966,7 +1207,7 @@ function normalizeOpenAIResponsesSchemaNode(value: unknown, cache: WeakMap<JsonO
 	// Draft 2020-12 lets `type` be an array (e.g. `["object", "null"]`); treat
 	// any variant that includes "object" as an object position for the
 	// properties requirement.
-	if (declaresObjectType(value.type) && !Object.hasOwn(value, "properties")) {
+	if (Object.hasOwn(value, "type") && declaresObjectType(value.type) && !Object.hasOwn(value, "properties")) {
 		output.properties = {};
 		changed = true;
 	}
@@ -1007,7 +1248,7 @@ function normalizeOpenAIResponsesSchemaMap(schemaMap: JsonObject, cache: WeakMap
 		const child = schemaMap[key];
 		const next = normalizeOpenAIResponsesSchemaNode(child, cache);
 		if (next !== child) changed = true;
-		output[key] = next;
+		setOwnKey(output, key, next);
 	}
 	return changed ? output : schemaMap;
 }
@@ -1089,21 +1330,24 @@ function hasUnrepresentableStrictObjectMap(schema: Record<string, unknown>, epoc
 	if (!once(schema, epoch)) return false;
 
 	let hasPatternProperties = false;
-	if (isJsonObject(schema.patternProperties)) {
+	if (Object.hasOwn(schema, "patternProperties") && isJsonObject(schema.patternProperties)) {
 		for (const _ in schema.patternProperties) {
 			hasPatternProperties = true;
 			break;
 		}
 	}
-	const additionalPropertiesValue = schema.additionalProperties;
+	const additionalPropertiesValue = Object.hasOwn(schema, "additionalProperties")
+		? schema.additionalProperties
+		: undefined;
 	const hasSchemaAdditionalProperties = additionalPropertiesValue === true || isJsonObject(additionalPropertiesValue);
 	if (hasPatternProperties || hasSchemaAdditionalProperties) {
 		return true;
 	}
 
-	if (isJsonObject(schema.properties)) {
+	if (Object.hasOwn(schema, "properties") && isJsonObject(schema.properties)) {
 		const properties = schema.properties;
 		for (const k in properties) {
+			if (!Object.hasOwn(properties, k)) continue;
 			const propertySchema = properties[k];
 			if (isJsonObject(propertySchema) && hasUnrepresentableStrictObjectMap(propertySchema, epoch)) {
 				return true;
@@ -1111,18 +1355,18 @@ function hasUnrepresentableStrictObjectMap(schema: Record<string, unknown>, epoc
 		}
 	}
 
-	if (isJsonObject(schema.items)) {
+	if (Object.hasOwn(schema, "items") && isJsonObject(schema.items)) {
 		if (hasUnrepresentableStrictObjectMap(schema.items, epoch)) {
 			return true;
 		}
-	} else if (Array.isArray(schema.items)) {
+	} else if (Object.hasOwn(schema, "items") && Array.isArray(schema.items)) {
 		for (const itemSchema of schema.items) {
 			if (isJsonObject(itemSchema) && hasUnrepresentableStrictObjectMap(itemSchema, epoch)) {
 				return true;
 			}
 		}
 	}
-	if (Array.isArray(schema.prefixItems)) {
+	if (Object.hasOwn(schema, "prefixItems") && Array.isArray(schema.prefixItems)) {
 		for (const itemSchema of schema.prefixItems) {
 			if (isJsonObject(itemSchema) && hasUnrepresentableStrictObjectMap(itemSchema, epoch)) {
 				return true;
@@ -1131,7 +1375,7 @@ function hasUnrepresentableStrictObjectMap(schema: Record<string, unknown>, epoc
 	}
 
 	for (const key of COMBINATOR_KEYS) {
-		const variants = schema[key];
+		const variants = Object.hasOwn(schema, key) ? schema[key] : undefined;
 		if (!Array.isArray(variants)) continue;
 		for (const variant of variants) {
 			if (isJsonObject(variant) && hasUnrepresentableStrictObjectMap(variant, epoch)) {
@@ -1141,9 +1385,10 @@ function hasUnrepresentableStrictObjectMap(schema: Record<string, unknown>, epoc
 	}
 
 	for (const defsKey of ["$defs", "definitions"] as const) {
-		const defs = schema[defsKey];
+		const defs = Object.hasOwn(schema, defsKey) ? schema[defsKey] : undefined;
 		if (!isJsonObject(defs)) continue;
 		for (const k in defs) {
+			if (!Object.hasOwn(defs, k)) continue;
 			const defSchema = defs[k];
 			if (isJsonObject(defSchema) && hasUnrepresentableStrictObjectMap(defSchema, epoch)) {
 				return true;
@@ -1186,7 +1431,7 @@ export function sanitizeSchemaForStrictMode(
 	// OpenAI strict mode forbids `{$ref, description, ...}`; the SDK resolves
 	// and merges, with sibling keys taking precedence over the ref'd def.
 	// Cite: openai-python/src/openai/lib/_pydantic.py:96-110 (`_ensure_strict_json_schema`)
-	if (typeof schema.$ref === "string") {
+	if (Object.hasOwn(schema, "$ref") && typeof schema.$ref === "string") {
 		let hasSibling = false;
 		for (const k in schema) {
 			if (k !== "$ref" && Object.hasOwn(schema, k)) {
@@ -1201,7 +1446,7 @@ export function sanitizeSchemaForStrictMode(
 				const merged: Record<string, unknown> = { ...resolved };
 				for (const k in schema) {
 					if (k === "$ref" || !Object.hasOwn(schema, k)) continue;
-					merged[k] = schema[k];
+					setOwnKey(merged, k, schema[k]);
 				}
 				const result = sanitizeSchemaForStrictMode(merged, epoch, cache, root);
 				cache.set(schema, result);
@@ -1215,13 +1460,13 @@ export function sanitizeSchemaForStrictMode(
 	// entry's keys WIN over original sibling keys, then `allOf` is dropped.
 	// Cite: openai-python/src/openai/lib/_pydantic.py:79-83
 	{
-		const allOf = schema.allOf;
+		const allOf = Object.hasOwn(schema, "allOf") ? schema.allOf : undefined;
 		if (Array.isArray(allOf) && allOf.length === 1 && isJsonObject(allOf[0])) {
 			const merged: Record<string, unknown> = { ...schema };
 			delete merged.allOf;
 			const sole = allOf[0] as Record<string, unknown>;
 			for (const k in sole) {
-				if (Object.hasOwn(sole, k)) merged[k] = sole[k];
+				if (Object.hasOwn(sole, k)) setOwnKey(merged, k, sole[k]);
 			}
 			const result = sanitizeSchemaForStrictMode(merged, epoch, cache, root);
 			cache.set(schema, result);
@@ -1229,7 +1474,7 @@ export function sanitizeSchemaForStrictMode(
 		}
 	}
 
-	const typeValue = schema.type;
+	const typeValue = Object.hasOwn(schema, "type") ? schema.type : undefined;
 	if (Array.isArray(typeValue)) {
 		const typeVariants = typeValue.filter((entry): entry is string => typeof entry === "string");
 		const schemaWithoutType = { ...schema };
@@ -1282,8 +1527,9 @@ export function sanitizeSchemaForStrictMode(
 	const sanitized: Record<string, unknown> = {};
 	cache.set(schema, sanitized);
 	for (const key in schema) {
+		if (!Object.hasOwn(schema, key)) continue;
 		const value = schema[key];
-		if (key in NON_STRUCTURAL_SCHEMA_KEYS || key === "type" || key === "const" || key === "nullable") {
+		if (Object.hasOwn(NON_STRUCTURAL_SCHEMA_KEYS, key) || key === "type" || key === "const" || key === "nullable") {
 			continue;
 		}
 		// `properties` map — recurse into each property schema.
@@ -1291,10 +1537,15 @@ export function sanitizeSchemaForStrictMode(
 		if (key === "properties" && isJsonObject(value)) {
 			const properties: Record<string, unknown> = {};
 			for (const propertyName in value) {
+				if (!Object.hasOwn(value, propertyName)) continue;
 				const propertySchema = value[propertyName];
-				properties[propertyName] = isJsonObject(propertySchema)
-					? sanitizeSchemaForStrictMode(propertySchema, epoch, cache, root)
-					: propertySchema;
+				setOwnKey(
+					properties,
+					propertyName,
+					isJsonObject(propertySchema)
+						? sanitizeSchemaForStrictMode(propertySchema, epoch, cache, root)
+						: propertySchema,
+				);
 			}
 			sanitized.properties = properties;
 			continue;
@@ -1324,8 +1575,10 @@ export function sanitizeSchemaForStrictMode(
 		// `anyOf`/`oneOf`/`allOf` arrays — recurse into each branch.
 
 		if (COMBINATOR_KEYS.includes(key as (typeof COMBINATOR_KEYS)[number]) && Array.isArray(value)) {
-			sanitized[key] = value.map(entry =>
-				isJsonObject(entry) ? sanitizeSchemaForStrictMode(entry, epoch, cache, root) : entry,
+			setOwnKey(
+				sanitized,
+				key,
+				value.map(entry => (isJsonObject(entry) ? sanitizeSchemaForStrictMode(entry, epoch, cache, root) : entry)),
 			);
 			continue;
 		}
@@ -1334,12 +1587,17 @@ export function sanitizeSchemaForStrictMode(
 		if ((key === "$defs" || key === "definitions") && isJsonObject(value)) {
 			const defs: Record<string, unknown> = {};
 			for (const definitionName in value) {
+				if (!Object.hasOwn(value, definitionName)) continue;
 				const definitionSchema = value[definitionName];
-				defs[definitionName] = isJsonObject(definitionSchema)
-					? sanitizeSchemaForStrictMode(definitionSchema, epoch, cache, root)
-					: definitionSchema;
+				setOwnKey(
+					defs,
+					definitionName,
+					isJsonObject(definitionSchema)
+						? sanitizeSchemaForStrictMode(definitionSchema, epoch, cache, root)
+						: definitionSchema,
+				);
 			}
-			sanitized[key] = defs;
+			setOwnKey(sanitized, key, defs);
 			continue;
 		}
 		// `additionalProperties` is owned by `enforceStrictSchema`, which sets it to false.
@@ -1348,7 +1606,12 @@ export function sanitizeSchemaForStrictMode(
 			continue;
 		}
 
-		if (key === "description" && typeof value === "string" && schema.default !== undefined) {
+		if (
+			key === "description" &&
+			typeof value === "string" &&
+			Object.hasOwn(schema, "default") &&
+			schema.default !== undefined
+		) {
 			// Preserve `default:` info for strict-mode providers that strip the keyword.
 			// Inline as `(default: X)` text in the description, matching the convention for
 			// runtime-placeholder defaults (e.g. `cwd`) that cannot live in the keyword form.
@@ -1358,7 +1621,7 @@ export function sanitizeSchemaForStrictMode(
 			continue;
 		}
 
-		sanitized[key] = value;
+		setOwnKey(sanitized, key, value);
 	}
 	// Post-pass: re-derive `type` and turn dropped keywords into a representable shape.
 
@@ -1394,7 +1657,7 @@ export function sanitizeSchemaForStrictMode(
 	// `description` hoists to the wrapper so both branches share it without
 	// duplication — matches the optional-property wrap in `enforceStrictSchema`
 	// and the typical OpenAI strict-mode "description on the union" shape.
-	if (schema.nullable === true) {
+	if (Object.hasOwn(schema, "nullable") && schema.nullable === true) {
 		const { nullable: _, description, ...withoutNullable } = sanitized;
 		const wrapper: JsonObject = { anyOf: [withoutNullable, { type: "null" }] };
 		if (description !== undefined) wrapper.description = description;
@@ -1456,6 +1719,7 @@ function enforceStrictSchemaBody(
 		);
 		const strictProperties: Record<string, unknown> = {};
 		for (const key in props) {
+			if (!Object.hasOwn(props, key)) continue;
 			const value = props[key];
 			const processed =
 				value != null && typeof value === "object" && !Array.isArray(value)
@@ -1467,20 +1731,20 @@ function enforceStrictSchemaBody(
 				if (
 					isJsonObject(processed) &&
 					Array.isArray(processed.anyOf) &&
-					processed.anyOf.some(v => isJsonObject(v) && v.type === "null")
+					processed.anyOf.some(v => isJsonObject(v) && Object.hasOwn(v, "type") && v.type === "null")
 				) {
-					strictProperties[key] = processed;
+					setOwnKey(strictProperties, key, processed);
 					continue;
 				}
 				if (isJsonObject(processed) && typeof processed.description === "string") {
 					const { description, ...withoutDescription } = processed;
-					strictProperties[key] = { anyOf: [withoutDescription, { type: "null" }], description };
+					setOwnKey(strictProperties, key, { anyOf: [withoutDescription, { type: "null" }], description });
 					continue;
 				}
-				strictProperties[key] = { anyOf: [processed, { type: "null" }] };
+				setOwnKey(strictProperties, key, { anyOf: [processed, { type: "null" }] });
 				continue;
 			}
-			strictProperties[key] = processed;
+			setOwnKey(strictProperties, key, processed);
 		}
 		result.properties = strictProperties;
 		result.required = Object.keys(strictProperties);
@@ -1504,26 +1768,39 @@ function enforceStrictSchemaBody(
 		);
 	}
 	for (const key of COMBINATOR_KEYS) {
-		if (Array.isArray(result[key])) {
-			result[key] = (result[key] as unknown[]).map(entry =>
-				entry != null && typeof entry === "object" && !Array.isArray(entry)
-					? enforceStrictSchema(entry as Record<string, unknown>, cache)
-					: entry,
+		if (Object.hasOwn(result, key) && Array.isArray(result[key])) {
+			setOwnKey(
+				result,
+				key,
+				(result[key] as unknown[]).map(entry =>
+					entry != null && typeof entry === "object" && !Array.isArray(entry)
+						? enforceStrictSchema(entry as Record<string, unknown>, cache)
+						: entry,
+				),
 			);
 		}
 	}
 	for (const defsKey of ["$defs", "definitions"] as const) {
-		if (result[defsKey] != null && typeof result[defsKey] === "object" && !Array.isArray(result[defsKey])) {
+		if (
+			Object.hasOwn(result, defsKey) &&
+			result[defsKey] != null &&
+			typeof result[defsKey] === "object" &&
+			!Array.isArray(result[defsKey])
+		) {
 			const defs = result[defsKey] as Record<string, unknown>;
 			const nextDefs: Record<string, unknown> = {};
 			for (const name in defs) {
+				if (!Object.hasOwn(defs, name)) continue;
 				const def = defs[name];
-				nextDefs[name] =
+				setOwnKey(
+					nextDefs,
+					name,
 					def != null && typeof def === "object" && !Array.isArray(def)
 						? enforceStrictSchema(def as Record<string, unknown>, cache)
-						: def;
+						: def,
+				);
 			}
-			result[defsKey] = nextDefs;
+			setOwnKey(result, defsKey, nextDefs);
 		}
 	}
 	// Strict mode requires every schema node to declare a concrete type (or