@tetsujs/openapi 0.4.0 → 0.4.2

package/dist/src/operation.d.ts

@@ -12,8 +12,17 @@
 import type { AppOptions, RouteTableEntry } from "@tetsujs/core";
 import type { SchemaComponents } from "./components.ts";
 import type { OperationObject } from "./document.ts";
+import type { Envelopes } from "./envelopes.ts";
 /** Describes one route. */
-export declare function operationOf(entry: RouteTableEntry, options: AppOptions, components: SchemaComponents, ids: OperationIds, warn: (message: string) => void): OperationObject;
+export declare function operationOf(entry: RouteTableEntry, options: AppOptions, components: SchemaComponents, envelopes: Envelopes, ids: OperationIds, warn: (message: string) => void): OperationObject;
+/**
+ * Records the envelopes a route declares, so that its definitions are the
+ * ones the document keeps — whichever operation refers to them first.
+ *
+ * Runs before any operation is built. A schema that cannot describe itself
+ * is skipped without a word: building the operation says so, once.
+ */
+export declare function declareEnvelopes(entry: RouteTableEntry, envelopes: Envelopes): void;
 /**
  * Hands out the `operationId` of every route in one document.
  *

package/dist/src/operation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operation.d.ts","sourceRoot":"","sources":["../../src/operation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAEV,UAAU,EAEV,eAAe,EAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,eAAe,CAAC;AAKvB,2BAA2B;AAC3B,wBAAgB,WAAW,CACzB,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,gBAAgB,EAC5B,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,eAAe,CAsCjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC;CACtC;AAED,wBAAgB,YAAY,IAAI,YAAY,CAmB3C"}
+{"version":3,"file":"operation.d.ts","sourceRoot":"","sources":["../../src/operation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAEV,UAAU,EAEV,eAAe,EAChB,MAAM,eAAe,CAAC;AAQvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,KAAK,EAGV,eAAe,EAEhB,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIhD,2BAA2B;AAC3B,wBAAgB,WAAW,CACzB,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,gBAAgB,EAC5B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAC9B,eAAe,CAyCjB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,SAAS,GACnB,IAAI,CAaN;AA+GD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,YAAY;IAC3B,qEAAqE;IACrE,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC;CACtC;AAED,wBAAgB,YAAY,IAAI,YAAY,CAmB3C"}

package/dist/src/page.d.ts

@@ -12,6 +12,13 @@
  * a parameter, so a self-hosted copy is one option away. Nothing is
  * fetched unless this function is called.
  *
+ * What the CDN serves runs on the application's origin, with its cookies.
+ * The default renderers are therefore pinned to an exact version and
+ * carry the hash of that file: a CDN, or a package release, that serves
+ * something else is refused by the browser rather than run. A page on an
+ * origin with a session is still somebody else's application in the
+ * user's session — which is why `docs()` can serve the document alone.
+ *
  * @module
  */
 /** The renderers this package knows how to bootstrap. */
@@ -20,6 +27,19 @@ export type DocsUi = "scalar" | "swagger-ui" | "redoc";
 export interface DocsAssets {
     readonly script: string;
     readonly style?: string;
+    /**
+     * Subresource Integrity hashes of the two files, for a copy that is not
+     * on the application's own origin: the browser runs the file only if it
+     * hashes to this. Absent, the files are loaded as they are.
+     *
+     * One line computes one:
+     * `curl -s <url> | openssl dgst -sha384 -binary | openssl base64 -A`,
+     * prefixed with `sha384-`.
+     */
+    readonly integrity?: {
+        readonly script?: string;
+        readonly style?: string;
+    };
 }
 /** What the page needs to know. */
 export interface DocsPageOptions {

package/dist/src/page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../src/page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,yDAAyD;AACzD,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC;AAEvD,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAyBzD"}
+{"version":3,"file":"page.d.ts","sourceRoot":"","sources":["../../src/page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,yDAAyD;AACzD,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,YAAY,GAAG,OAAO,CAAC;AAEvD,uCAAuC;AACvC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE;QACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;CAC9B;AAyCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAyBzD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tetsujs/openapi",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "An OpenAPI 3.1 document and docs page generated from Tetsu routes",
   "keywords": [
     "bun",
@@ -34,10 +34,10 @@
     }
   },
   "peerDependencies": {
-    "@tetsujs/core": "^0.4.0"
+    "@tetsujs/core": "^0.4.2"
   },
   "devDependencies": {
-    "@tetsujs/core": "0.4.0"
+    "@tetsujs/core": "0.4.2"
   },
   "publishConfig": {
     "access": "public"

package/src/annotations.ts

@@ -17,16 +17,17 @@
  */
 
 import type { AnyHook, AnySchema } from "@tetsujs/core";
+import type { JsonSchema } from "./json-schema.ts";
 
 /**
  * The definition of a scheme, as OpenAPI spells it.
  *
- * Typed as loosely as the spec is wide — `http`, `apiKey`, `oauth2` and
- * `openIdConnect` carry different fields, and narrowing them here would
- * be a second, poorer copy of the specification.
+ * Typed as loosely as the spec is wide — `http`, `apiKey`, `oauth2`,
+ * `openIdConnect` and `mutualTLS` carry different fields, and narrowing
+ * them here would be a second, poorer copy of the specification.
  */
 export interface SecurityScheme {
-  readonly type: "http" | "apiKey" | "oauth2" | "openIdConnect";
+  readonly type: "http" | "apiKey" | "oauth2" | "openIdConnect" | "mutualTLS";
   readonly [key: string]: unknown;
 }
 
@@ -83,12 +84,70 @@ export interface DocumentedResponse {
 
   /** An example of the envelope's `message`, for the same reason. */
   readonly message?: string;
+
+  /**
+   * Fields the hook adds to the envelope, as JSON Schema by name — the
+   * `retryAfter` of `{ ...errorBody(429, "RATE_LIMITED"), retryAfter }`.
+   *
+   * Each is documented as always present. The envelope's own `status`,
+   * `message` and `error` are not redefined by a field of the same name:
+   * `error` is what a client discriminates on, and it stays the code the
+   * hook declared. Ignored when the response has a `schema`, which says
+   * everything about the body itself.
+   *
+   * @example
+   * ```ts
+   * documented(limiter, {
+   *   responses: [
+   *     {
+   *       status: 429,
+   *       description: "Too many requests",
+   *       error: "RATE_LIMITED",
+   *       fields: { retryAfter: { type: "integer", minimum: 0 } },
+   *     },
+   *   ],
+   * });
+   * ```
+   */
+  readonly fields?: Readonly<Record<string, JsonSchema>>;
+
+  /**
+   * Headers the hook sets on this response, by name — the `retry-after`
+   * of a refusal.
+   *
+   * Documented as possible rather than required: a status several sources
+   * answer with is one response in the document, and a header one of them
+   * sets is not on the others'.
+   */
+  readonly headers?: Readonly<Record<string, DocumentedHeader>>;
+}
+
+/** A header a hook's response carries. */
+export interface DocumentedHeader {
+  readonly description?: string;
+  readonly schema: JsonSchema;
+}
+
+/**
+ * Requirements of which a hook accepts any one: a session cookie *or* a
+ * bearer token, checked by one hook.
+ *
+ * "Either" lives inside a hook, never between hooks — every hook of a
+ * route runs, so the schemes of two hooks are both required. A hook that
+ * takes either of two credentials says so here, and the document lists
+ * the combinations a client may bring.
+ */
+export interface SecurityAlternatives {
+  readonly anyOf: readonly SecurityRequirement[];
 }
 
 /** Everything a hook tells the generator about itself. */
 export interface HookDocs {
-  /** What the hook demands of a request. */
-  readonly security?: SecurityRequirement;
+  /**
+   * What the hook demands of a request: one requirement, or alternatives
+   * of which any one will do.
+   */
+  readonly security?: SecurityRequirement | SecurityAlternatives;
 
   /** What the hook can answer with. */
   readonly responses?: readonly DocumentedResponse[];
@@ -128,6 +187,10 @@ export function documented<H extends AnyHook>(hook: H, docs: HookDocs): H {
  * Annotates a hook with the security it enforces — {@link documented} for
  * the case that comes up most.
  *
+ * One requirement, or `{ anyOf: [...] }` for a hook that accepts any one
+ * of several: the schemes of different hooks are all required, the
+ * alternatives of one hook are not.
+ *
  * @example
  * ```ts
  * export const auth = secured(
@@ -142,10 +205,22 @@ export function documented<H extends AnyHook>(hook: H, docs: HookDocs): H {
  *   },
  * );
  * ```
+ *
+ * @example A hook that accepts a session cookie or a bearer token
+ * ```ts
+ * export const caller = secured(
+ *   hook.beforeParse((ctx) => {
+ *     const user = sessions.fromCookie(ctx) ?? tokens.fromHeader(ctx);
+ *     if (!user) throw new HttpError(401);
+ *     return { user };
+ *   }),
+ *   { anyOf: [cookieSession, bearerToken] },
+ * );
+ * ```
  */
 export function secured<H extends AnyHook>(
   hook: H,
-  requirement: SecurityRequirement,
+  requirement: SecurityRequirement | SecurityAlternatives,
 ): H {
   return documented(hook, { security: requirement });
 }
@@ -155,14 +230,28 @@ export function docsOf(hook: AnyHook): HookDocs | undefined {
   return (hook as unknown as Record<string, HookDocs | undefined>)[docsKey];
 }
 
-/** Reads the security requirement a hook carries, if it carries one. */
-export function securityOf(hook: AnyHook): SecurityRequirement | undefined {
+/** Reads the security a hook was annotated with, if it was. */
+export function securityOf(
+  hook: AnyHook,
+): SecurityRequirement | SecurityAlternatives | undefined {
   return docsOf(hook)?.security;
 }
 
 /** What the hooks of one route contribute, in execution order. */
 export interface HookContributions {
+  /**
+   * Every scheme the hooks mention, once per name, with the scopes of all
+   * of them: what the document registers, and what a refusal answers with.
+   */
   readonly security: readonly SecurityRequirement[];
+
+  /**
+   * What a request must satisfy, one condition per hook: every condition
+   * is required, and any one requirement of a condition satisfies it. A
+   * hook with one requirement is a condition of one.
+   */
+  readonly conditions: readonly (readonly SecurityRequirement[])[];
+
   readonly responses: readonly DocumentedResponse[];
 }
 
@@ -171,7 +260,9 @@ export interface HookContributions {
  *
  * A scheme is registered once per name and a response once per status and
  * description: the same guard on the application and on a group is one
- * requirement, not two.
+ * requirement, not two. Two hooks of one scheme asking for different
+ * scopes both run, so the requirement asks for the scopes of both — each
+ * once, in the order they were first asked for.
  *
  * Deduplicating by name means two hooks claiming one name with different
  * schemes lose one of them, and that is not a duplicate being collapsed —
@@ -183,6 +274,7 @@ export function contributionsOf(
   warn?: (message: string) => void,
 ): HookContributions {
   const security = new Map<string, SecurityRequirement>();
+  const conditions = new Map<string, readonly SecurityRequirement[]>();
   const responses = new Map<string, DocumentedResponse>();
 
   for (const slot of Object.values(chains)) {
@@ -194,17 +286,28 @@ export function contributionsOf(
       }
 
       if (docs.security) {
-        const claimed = security.get(docs.security.name);
-
-        if (!claimed) {
-          security.set(docs.security.name, docs.security);
-        } else if (
-          JSON.stringify(claimed.scheme) !==
-          JSON.stringify(docs.security.scheme)
-        ) {
-          warn?.(
-            `two hooks claim the security scheme "${docs.security.name}" with different definitions; one of them is not described`,
-          );
+        const alternatives = alternativesOf(docs.security);
+
+        conditions.set(conditionKey(alternatives), alternatives);
+
+        for (const requirement of alternatives) {
+          const claimed = security.get(requirement.name);
+
+          if (!claimed) {
+            security.set(requirement.name, requirement);
+          } else if (
+            JSON.stringify(claimed.scheme) ===
+            JSON.stringify(requirement.scheme)
+          ) {
+            security.set(requirement.name, {
+              ...claimed,
+              scopes: joinScopes(claimed.scopes, requirement.scopes),
+            });
+          } else {
+            warn?.(
+              `two hooks claim the security scheme "${requirement.name}" with different definitions; one of them is not described`,
+            );
+          }
         }
       }
 
@@ -220,6 +323,44 @@ export function contributionsOf(
 
   return {
     security: [...security.values()],
+    conditions: [...conditions.values()],
     responses: [...responses.values()],
   };
 }
+
+/** A hook's security as the alternatives it accepts; one is one. */
+function alternativesOf(
+  security: SecurityRequirement | SecurityAlternatives,
+): readonly SecurityRequirement[] {
+  return "anyOf" in security ? security.anyOf : [security];
+}
+
+/**
+ * What makes two conditions the same one: the same guard mounted on the
+ * application and on a group is one condition, and counting it twice would
+ * multiply its alternatives with themselves.
+ */
+function conditionKey(alternatives: readonly SecurityRequirement[]): string {
+  return JSON.stringify(
+    alternatives.map((requirement) => [
+      requirement.name,
+      [...(requirement.scopes ?? [])].sort(),
+    ]),
+  );
+}
+
+/** The scopes of two requirements of one scheme, each once, in order. */
+function joinScopes(
+  first: readonly string[] | undefined,
+  second: readonly string[] | undefined,
+): readonly string[] {
+  const joined = [...(first ?? [])];
+
+  for (const scope of second ?? []) {
+    if (!joined.includes(scope)) {
+      joined.push(scope);
+    }
+  }
+
+  return joined;
+}

package/src/controller.ts

@@ -22,7 +22,11 @@ import type { DocsAssets, DocsUi } from "./page.ts";
 import { docsPage } from "./page.ts";
 
 /** What the documentation controller serves, and from where. */
-export interface DocsOptions<Path extends string, UiPath extends string> {
+export interface DocsOptions<
+  Path extends string,
+  UiPath extends string,
+  Ui extends DocsUi | false = DocsUi | false,
+> {
   /** Title, version and the rest of the document's `info` block. */
   readonly info: OpenApiDocument["info"];
 
@@ -35,8 +39,16 @@ export interface DocsOptions<Path extends string, UiPath extends string> {
   /** Where the page is served. Defaults to `/docs`. */
   readonly uiPath?: UiPath & ValidatePath<UiPath>;
 
-  /** Which renderer the page bootstraps. Defaults to `"scalar"`. */
-  readonly ui?: DocsUi;
+  /**
+   * Which renderer the page bootstraps. Defaults to `"scalar"`.
+   *
+   * `false` serves the document without a page — what production wants
+   * on an origin that carries a session. The page runs its renderer on the
+   * application's origin, so a renderer that is not what it should be acts
+   * in the signed-in user's name there; the document alone runs nothing.
+   * `uiPath`, `title` and `assets` are then unused.
+   */
+  readonly ui?: Ui;
 
   /** Browser title of the page. Defaults to the document's own title. */
   readonly title?: string;
@@ -69,20 +81,27 @@ export interface DocsOptions<Path extends string, UiPath extends string> {
  * Instantiated through the factory, never directly — the routes carry the
  * configured paths in their types, which only the factory can infer.
  */
-export class DocsController<Path extends string, UiPath extends string> {
+export class DocsController<
+  Path extends string,
+  UiPath extends string,
+  Page extends boolean = true,
+> {
   /** The document itself, as `application/json`. */
   readonly json: RouteDef<Path, SchemaConfig, never, undefined, "GET">;
 
-  /** The page that renders it. */
-  readonly ui: RouteDef<UiPath, SchemaConfig, never, undefined, "GET">;
+  /** The page that renders it — none with `ui: false`. */
+  readonly ui: Page extends true
+    ? RouteDef<UiPath, SchemaConfig, never, undefined, "GET">
+    : undefined;
 
   private document: OpenApiDocument | undefined;
 
+  private page: string | undefined;
+
   constructor(
     private readonly options: DocsOptions<Path, UiPath>,
     documentPath: string,
     uiPath: string,
-    page: string,
   ) {
     const hidden = !options.documentSelf;
 
@@ -98,7 +117,7 @@ export class DocsController<Path extends string, UiPath extends string> {
       path: "/docs",
       docs: { summary: "Rendered documentation", tags: ["docs"], hidden },
       handler: () =>
-        new Response(page, {
+        new Response(this.page, {
           headers: { "content-type": "text/html; charset=utf-8" },
         }),
     });
@@ -113,10 +132,20 @@ export class DocsController<Path extends string, UiPath extends string> {
      * configured path lands at runtime.
      */
     this.json = { ...json, path: documentPath } as unknown as this["json"];
-    this.ui = { ...ui, path: uiPath } as unknown as this["ui"];
+    this.ui = (
+      options.ui === false ? undefined : { ...ui, path: uiPath }
+    ) as this["ui"];
   }
 
-  /** Generates the document of the application this was mounted in. */
+  /**
+   * Generates the document of the application this was mounted in, and
+   * the page that renders it.
+   *
+   * The page is built here rather than with the routes because only the
+   * application knows where the document ended up: a group this controller
+   * is mounted under prefixes its path, and a page pointing at the path as
+   * configured would fetch a `404`.
+   */
   [onMount](app: App): void {
     const generated = openapi(app, {
       info: this.options.info,
@@ -125,6 +154,19 @@ export class DocsController<Path extends string, UiPath extends string> {
 
     this.document = generated.document;
 
+    const ui = this.options.ui ?? "scalar";
+    const json: unknown = this.json;
+    const served = app.entries.find((entry) => entry.def === json);
+
+    if (ui !== false && served) {
+      this.page = docsPage({
+        ui,
+        documentUrl: served.path,
+        title: this.options.title ?? this.options.info.title,
+        ...(this.options.assets ? { assets: this.options.assets } : {}),
+      });
+    }
+
     const report = this.options.onWarning ?? warn;
 
     for (const warning of generated.warnings) {
@@ -156,18 +198,15 @@ export class DocsController<Path extends string, UiPath extends string> {
 export function docs<
   const Path extends string = "/openapi.json",
   const UiPath extends string = "/docs",
->(options: DocsOptions<Path, UiPath>): DocsController<Path, UiPath> {
-  const documentPath = options.path ?? "/openapi.json";
-  const uiPath = options.uiPath ?? "/docs";
-
-  const page = docsPage({
-    ui: options.ui ?? "scalar",
-    documentUrl: documentPath,
-    title: options.title ?? options.info.title,
-    ...(options.assets ? { assets: options.assets } : {}),
-  });
-
-  return new DocsController(options, documentPath, uiPath, page);
+  const Ui extends DocsUi | false = "scalar",
+>(
+  options: DocsOptions<Path, UiPath, Ui>,
+): DocsController<Path, UiPath, Ui extends false ? false : true> {
+  return new DocsController(
+    options,
+    options.path ?? "/openapi.json",
+    options.uiPath ?? "/docs",
+  ) as DocsController<Path, UiPath, Ui extends false ? false : true>;
 }
 
 function warn(warning: GeneratorWarning): void {

package/src/document.ts

@@ -15,6 +15,8 @@
  * @module
  */
 
+import type { JsonSchema } from "./json-schema.ts";
+
 /** Metadata every OpenAPI document must carry. */
 export interface DocumentInfo {
   readonly title: string;
@@ -44,9 +46,16 @@ export type ContentMap = Record<
   { readonly schema?: Record<string, unknown> }
 >;
 
+/** A header a response carries. */
+export interface HeaderObject {
+  readonly description?: string;
+  readonly schema: JsonSchema;
+}
+
 /** One response of an operation. */
 export interface ResponseObject {
   readonly description: string;
+  readonly headers?: Record<string, HeaderObject>;
   readonly content?: ContentMap;
 }
 

package/src/emit.ts

@@ -20,13 +20,15 @@ import { toJsonSchema } from "@tetsujs/core";
 const target = { target: "draft-2020-12" } as const;
 
 /**
- * A JSON Schema as the generator reads it: any keyword, with the two it
+ * A JSON Schema as the generator reads it: any keyword, with the ones it
  * looks into named, so reading them does not depend on the reader's
  * `noPropertyAccessFromIndexSignature`.
  */
 export interface JsonSchemaObject {
   properties?: unknown;
   required?: unknown;
+  anyOf?: unknown;
+  oneOf?: unknown;
   [keyword: string]: unknown;
 }