@zuplo/runtime 7.9.11 → 7.9.13

package/out/esm/mocks/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{E as p,J as c,M as u}from"../chunk-DDUIJEX3.js";import"../chunk-QTXBMT6O.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import"../chunk-7AHIER5R.js";import{aa as i}from"../chunk-KESHY2P3.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
+import{E as p,J as c,M as u}from"../chunk-2XSPVUOE.js";import"../chunk-VTO3F6DK.js";import{a as d}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import"../chunk-YJ2BHVUH.js";import{aa as i}from"../chunk-PBDT4FDO.js";import{a as o}from"../chunk-TYV53J3B.js";function w(l={request:new Request("https://api.example.com")}){let e=[];function t(s){e.push(Promise.resolve(s))}return o(t,"waitUntil"),{context:new a({event:{waitUntil:t},route:l.route,originalRequest:l.request}),invokeResponse:o(async()=>{await Promise.all(e)},"invokeResponse")}}o(w,"createMockContext");var g={path:"/",methods:["GET"],handler:{module:{},export:"default"},raw:o(()=>({}),"raw")},a=class extends EventTarget{static{o(this,"MockZuploContext")}#e;#t;contextId;requestId;log;route;custom;incomingRequestProperties;parentContext;analyticsContext;constructor({event:e,route:t=g,parentContext:n,originalRequest:r}){super(),this.requestId=crypto.randomUUID(),this.contextId=crypto.randomUUID(),this.log={info:i.console.info,log:i.console.log,debug:i.console.debug,warn:i.console.warn,error:i.console.error,setLogProperties:o(()=>{},"setLogProperties")},this.custom={},this.route=t,this.incomingRequestProperties={ip:"203.0.113.7",asn:1234,asOrganization:"ORGANIZATION",city:"Seattle",region:"Washington",regionCode:"WA",colo:"SEA",continent:"NA",country:"US",postalCode:"98004",metroCode:"SEA",latitude:void 0,longitude:void 0,timezone:void 0,httpProtocol:void 0,clientCert:void 0,clientMtlsVerificationStatus:void 0,clientMtlsVerificationReason:void 0,clientCertFingerprintSha256:void 0,clientCertNotBefore:void 0,clientCertNotAfter:void 0,clientCertIssuerDn:void 0,clientCertSubjectDn:void 0},this.parentContext=n,this.#e=e,this.#t=r,this.analyticsContext=new c(this.requestId)}waitUntil(e){this.#e.waitUntil(e)}invokeInboundPolicy(e,t){throw new Error("Not implemented")}invokeOutboundPolicy(e,t,n){throw new Error("Not implemented")}invokeRoute(e,t){throw new Error("Not implemented")}addResponseSendingHook(e){throw new Error("Not implemented")}addResponseSendingFinalHook(e){throw new Error("Not implemented")}addPreRequestHandler(e,t){let n;try{n=u.getContextExtensions(this)}catch{n=u.initialize(this,new d(this.#t??new Request("https://api.example.com")))}n.preRequestPhase??="active",p(this,n,e,t)}get preRequestHandlers(){let e;try{e=u.getContextExtensions(this)}catch{return[]}return(e.preRequestState?.entries??[]).map(t=>({policyName:t.policyName,name:t.name}))}addEventListener(e,t,n){let r=o(s=>{try{typeof t=="function"?t(s):t.handleEvent(s)}catch(m){throw this.log.error(`Error invoking event ${e}. See following logs for details.`),m}},"wrapped");super.addEventListener(e,r,n)}};export{a as MockZuploContext,w as createMockContext};
 //# sourceMappingURL=index.js.map

package/out/esm/sdks/aws/index.js

@@ -22,5 +22,5 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{H as a,I as l,J as c,K as o,N as p,O as y,P as m}from"../../chunk-7AHIER5R.js";import"../../chunk-KESHY2P3.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
+import{H as a,I as l,J as c,K as o,N as p,O as y,P as m}from"../../chunk-YJ2BHVUH.js";import"../../chunk-PBDT4FDO.js";import{a as i}from"../../chunk-TYV53J3B.js";async function g(r,e){let t=typeof e.credentials=="function"?await e.credentials():e.credentials,n=r.method,d=n!=="GET"&&n!=="HEAD"&&r.body!=null?await r.arrayBuffer():null,s=await new o({method:n,url:r.url,headers:r.headers,body:d,accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,service:e.service,region:e.region,signQuery:e.signQuery}).sign();return new Request(s.url.toString(),{method:s.method,headers:s.headers,body:s.body})}i(g,"signRequest");export{c as AwsClient,o as AwsV4Signer,p as fromTemporaryCredentials,y as fromWebToken,m as fromZuploIdentity,l as getAwsCredentialProvider,a as setAwsCredentialProvider,g as signRequest};
 //# sourceMappingURL=index.js.map

package/out/types/index.d.ts

@@ -526,59 +526,19 @@ export declare function aiGatewayHandlerV2(
 ): Promise<Response>;
 
 /**
- * Accepts only requests that this gateway made itself with
- * `context.invokeRoute`, and rejects every request that arrived over the
- * network with `403 Forbidden`.
- *
- * Use it in place of AI Gateway Authentication on an application that is only
- * ever called by other routes and policies on the same gateway, such as the
- * classifier application behind the Smart Router or Prompt Injection
- * Protection policies. Those calls never leave the gateway, so an API key on
- * them protects nothing. This policy asserts the one thing that matters: the
- * request originated inside the deployment.
- *
- * The check reads `context.parentContext`, which the runtime sets only on the
- * child context that `context.invokeRoute` creates. A client cannot supply it
- * through a header, the URL, or the body. The policy has no options, makes no
- * network calls, reads no body, and leaves `request.user` unset.
- *
- * @title Ensure Gateway Internal Invocation Only
- * @product ai-gateway
- * @requiresAI
+ * @deprecated Use InternalOnlyInboundPolicy instead. This name is from before
+ * the policy moved out of the AI Gateway.
  * @public
- *
- * @param request - The incoming ZuploRequest
- * @param context - The ZuploContext
- * @param _options - The policy options set in policies.json (this policy has none)
- * @param policyName - The name of the policy as set in policies.json
- * @returns The request when the gateway made it with `context.invokeRoute`, otherwise a 403 response
- *
- * @example
- * ```json
- * // policies.json - Declare the policy so an application chain can select it
- * {
- *   "name": "ai-gateway-internal-only-inbound",
- *   "policyType": "ai-gateway-internal-only",
- *   "handler": {
- *     "export": "AIGatewayInternalOnlyInboundPolicy",
- *     "module": "$import(@zuplo/runtime)",
- *     "options": {}
- *   }
- * }
- * ```
  */
-export declare function AIGatewayInternalOnlyInboundPolicy(
-  request: ZuploRequest,
-  context: ZuploContext,
-  _options: AIGatewayInternalOnlyInboundPolicyOptions,
-  policyName: string
-): Promise<ZuploRequest | Response>;
+export declare const AIGatewayInternalOnlyInboundPolicy: typeof InternalOnlyInboundPolicy;
 
 /**
- * The options for this policy. It has none.
+ * @deprecated Use InternalOnlyInboundPolicyOptions instead. This name is from
+ * before the policy moved out of the AI Gateway.
  * @public
  */
-export declare interface AIGatewayInternalOnlyInboundPolicyOptions {}
+export declare type AIGatewayInternalOnlyInboundPolicyOptions =
+  InternalOnlyInboundPolicyOptions;
 
 /* Excluded from this release type: AIGatewayMeterIncrements */
 
@@ -1813,7 +1773,7 @@ export declare interface ApiAuthKeyInboundPolicyOptions {
 declare type APIKey = string;
 
 /**
- * Credential used to run the classifier. Without `appId` this is the API key for the OpenAI-compatible service at `baseUrl`, and it is required. With `appId` it is optional: omit it when the classifier app runs the Ensure Gateway Internal Invocation Only policy, which authorizes the in-process invocation itself, and set it only when that app authenticates callers with API keys, in which case it is sent as `Authorization: Bearer`.
+ * Credential used to run the classifier. Without `appId` this is the API key for the OpenAI-compatible service at `baseUrl`, and it is required. With `appId` it is optional: omit it when the classifier app runs the Internal Only policy, which authorizes the in-process invocation itself, and set it only when that app authenticates callers with API keys, in which case it is sent as `Authorization: Bearer`.
  * @public
  */
 declare type APIKey_2 = string;
@@ -3750,7 +3710,8 @@ declare interface ChatCompletionResponse {
 }
 
 /**
- * Classify by calling an OpenAI-compatible Chat Completions API directly, outside the gateway. The model must support structured outputs (`response_format` with a JSON schema).
+ * @deprecated
+ * Deprecated: use classifier.adapter with flat apiKey, model, and baseUrl fields. Classify by calling an OpenAI-compatible Chat Completions API directly, outside the gateway. The model must support structured outputs (`response_format` with a JSON schema).
  * @public
  */
 declare interface ChatCompletionsAPI {
@@ -3796,15 +3757,31 @@ declare type Claim = string;
 declare type ClaimCheck = EqualsRule | InRule | StartsWithRule;
 
 /**
- * Where the user's prompt is classified. Required unless the deprecated `classifierAppID` and `classifierModel` are set. Set exactly one of `app`, `chatCompletions`, or `jev`; setting more than one is a configuration error.
+ * Where the prompt is classified. For a direct API, set adapter, apiKey, model, and optional baseUrl. Alternatively set app. Legacy chatCompletions and jev sections remain supported; do not mix forms.
  * @public
  */
 declare interface Classifier {
   app?: ClassifierApp;
   chatCompletions?: ChatCompletionsAPI;
   jev?: JevTypeSafe;
+  adapter?: ClassifierAdapter;
+  apiKey?: ClassifierAPIKey;
+  model?: ClassifierModel1;
+  baseUrl?: ClassifierBaseURL;
 }
 
+/**
+ * API contract for direct classification. chatCompletions requires a model supporting JSON-schema structured outputs. systemOne uses the existing Jev typed-question implementation; it does not accept classifierPrompt.
+ * @public
+ */
+declare type ClassifierAdapter = "chatCompletions" | "systemOne";
+
+/**
+ * API key for the direct classifier, sent as Authorization: Bearer.
+ * @public
+ */
+declare type ClassifierAPIKey = string;
+
 /**
  * Classify with another AI Gateway app in this project. The call runs in-process and never leaves the gateway, so the classifier uses that app's providers, routing, and quotas.
  * @public
@@ -3816,7 +3793,7 @@ declare interface ClassifierApp {
 }
 
 /**
- * API key sent as `Authorization: Bearer` when invoking the classifier app. Omit it when the classifier app runs the Ensure Gateway Internal Invocation Only policy: the classifier call never leaves the gateway, so that policy accepts it and rejects everything arriving over the network, and no credential is sent. Set it only when the classifier app authenticates callers with API keys.
+ * API key sent as `Authorization: Bearer` when invoking the classifier app. Omit it when the classifier app runs the Internal Only policy: the classifier call never leaves the gateway, so that policy accepts it and rejects everything arriving over the network, and no credential is sent. Set it only when the classifier app authenticates callers with API keys.
  * @public
  */
 declare type ClassifierAppAPIKey = string;
@@ -3828,7 +3805,7 @@ declare type ClassifierAppAPIKey = string;
 declare type ClassifierAppAPIKeyDeprecated = string;
 
 /**
- * Run the classifier on another AI Gateway app instead of calling an external API directly. The gateway invokes that app in-process — no outbound HTTP hop — so the classifier inherits its provider credentials, model routing, fallbacks and quotas, and provider keys stay on one app. Give that app the Ensure Gateway Internal Invocation Only policy and `apiKey` is not needed at all. When set, `model` must name a routed model as `provider/model` and `baseUrl` must not be set. The target app must not itself run this policy: it would be asked to classify its own classification request, which is rejected as a configuration error rather than silently skipped. Omit to call `baseUrl` directly.
+ * Run the classifier on another AI Gateway app instead of calling an external API directly. The gateway invokes that app in-process — no outbound HTTP hop — so the classifier inherits its provider credentials, model routing, fallbacks and quotas, and provider keys stay on one app. Give that app the Internal Only policy and `apiKey` is not needed at all. When set, `model` must name a routed model as `provider/model` and `baseUrl` must not be set. The target app must not itself run this policy: it would be asked to classify its own classification request, which is rejected as a configuration error rather than silently skipped. Omit to call `baseUrl` directly.
  * @public
  */
 declare type ClassifierAppID = string;
@@ -3845,12 +3822,24 @@ declare type ClassifierAppID_2 = string;
  */
 declare type ClassifierAppIDDeprecated = string;
 
+/**
+ * HTTP(S) API root. chatCompletions defaults to https://api.openai.com/v1 and appends /chat/completions. systemOne defaults to https://api.typesafe.ai and appends /v1/systemone.
+ * @public
+ */
+declare type ClassifierBaseURL = string;
+
 /**
  * Tool-calling capable model used to classify prompts. Prefer a small, fast model; the classification runs before every inspected request reaches the upstream model. With `appId` set this must name a model the classifier app routes, written as `provider/model` (for example `openai/gpt-4o-mini`), and has no default.
  * @public
  */
 declare type ClassifierModel = string;
 
+/**
+ * Model id sent to the direct API. Required for chatCompletions; defaults to jev-latest for systemOne.
+ * @public
+ */
+declare type ClassifierModel1 = string;
+
 /**
  * The model (`providerName/model`) the classifier app uses to evaluate the user's request. E.g. `openai/gpt-4o-mini`.
  * @public
@@ -3870,7 +3859,7 @@ declare type ClassifierModelDeprecated = string;
 declare type ClassifierPrompt = string | [string, ...string[]];
 
 /**
- * Prompt used to analyze and classify the user message with `classifier.app` or `classifier.chatCompletions`. Omit to use the built-in classifier prompt. Jev takes no prompt, so setting this with `classifier.jev` is a configuration error.
+ * Prompt for classifier.app or the chatCompletions adapter (including its legacy section). Omit to use the built-in prompt. The systemOne adapter and legacy jev section take no prompt; combining them with classifierPrompt is a configuration error.
  * @public
  */
 declare type ClassifierPrompt_2 = string | [string, ...string[]];
@@ -4147,6 +4136,38 @@ declare interface CompatibilityFlags {
    * discover tools with `tools/list`, as the MCP spec defines.
    */
   removeMcpToolsCapabilityExtension: boolean;
+  /**
+   * Whether OpenAPI schema combinators (`allOf`, `oneOf`, `anyOf`, `not`) are
+   * applied with JSON Schema semantics when an operation's schemas are turned
+   * into runtime validators. Today that is the MCP server handler: a tool's
+   * advertised `inputSchema`/`outputSchema` and its argument validation.
+   * `request-validation-inbound` already uses Ajv and is unaffected.
+   *
+   * Before this flag:
+   * - A top-level combinator is used on its own, and every keyword beside it
+   *   (`type`, `properties`, `required`, `additionalProperties`, `nullable`,
+   *   `description`, ...) is ignored. A body of
+   *   `{ type: object, properties, required, oneOf: [...] }` can be advertised
+   *   as `{ anyOf: [{}, {}] }` and accept any value.
+   * - `oneOf` behaves like `anyOf`: a value matching several branches is
+   *   accepted, and `oneOf` is advertised as `anyOf`.
+   *
+   * After this flag:
+   * - The schema's own keywords and every combinator beside them all apply,
+   *   intersected.
+   * - `oneOf` accepts a value only when exactly one branch matches, and is
+   *   advertised as `oneOf`.
+   * - Within a combinator schema and its branches: `required`,
+   *   `additionalProperties`, `minProperties` or `maxProperties` without a
+   *   `type` mark an object schema, an object schema rejects non-objects, a
+   *   `required` name that `properties` omits is enforced, a numeric or
+   *   boolean `enum` is enforced, and `unevaluatedProperties: false` is
+   *   enforced. A schema with no combinator is unchanged.
+   *
+   * The advertised schema changes for every affected tool, and calls the
+   * gateway's request validation would reject are rejected with -32602.
+   */
+  enforceOpenApiCombinatorSemantics: boolean;
 }
 
 declare interface CompletionsFallbacks {
@@ -7831,6 +7852,82 @@ declare type Intents = [
   }[],
 ];
 
+/**
+ * Accepts only requests that this gateway made itself with
+ * `context.invokeRoute`, and rejects every request that arrived over the
+ * network.
+ *
+ * Use it on a route that only other routes, handlers, and policies on the same
+ * gateway call: a REST endpoint that an MCP server exposes as a tool, or the
+ * classifier application behind the Smart Router or Prompt Injection
+ * Protection policies. Those calls never leave the gateway, so an API key on
+ * them protects nothing. This policy asserts the one thing that matters: the
+ * request originated inside the deployment.
+ *
+ * The check reads `context.parentContext`, which the runtime sets only on the
+ * child context that `context.invokeRoute` creates. A client cannot supply it
+ * through a header, the URL, or the body. The policy makes no network calls,
+ * reads no body, and leaves `request.user` unset.
+ *
+ * A rejected request gets a `403 Forbidden` problem response with no `detail`
+ * by default, so the caller learns nothing about how the gateway works; the
+ * reason goes to the request log. Set `status` to answer with another client
+ * error, such as `404` to hide the route or `401`, `statusText` to change the
+ * status text, and `detail` to add a message.
+ *
+ * @title Internal Only
+ * @product api-gateway
+ * @product ai-gateway
+ * @public
+ *
+ * @param request - The incoming ZuploRequest
+ * @param context - The ZuploContext
+ * @param options - The policy options set in policies.json
+ * @param policyName - The name of the policy as set in policies.json
+ * @returns The request when the gateway made it with `context.invokeRoute`, otherwise the rejection response
+ *
+ * @example
+ * ```json
+ * // policies.json - Hide a REST route that an MCP server calls as a tool
+ * {
+ *   "name": "internal-only-inbound",
+ *   "policyType": "internal-only-inbound",
+ *   "handler": {
+ *     "export": "InternalOnlyInboundPolicy",
+ *     "module": "$import(@zuplo/runtime)",
+ *     "options": {
+ *       "status": 404
+ *     }
+ *   }
+ * }
+ * ```
+ */
+export declare function InternalOnlyInboundPolicy(
+  request: ZuploRequest,
+  context: ZuploContext,
+  options: InternalOnlyInboundPolicyOptions,
+  policyName: string
+): Promise<ZuploRequest | Response>;
+
+/**
+ * The options for this policy.
+ * @public
+ */
+export declare interface InternalOnlyInboundPolicyOptions {
+  /**
+   * The HTTP status code returned to a request that did not come from inside the gateway. Any client error status from 400 to 499 is allowed. Use `404` to answer as if the route did not exist, or `401` to answer as an authentication policy does.
+   */
+  status?: number;
+  /**
+   * The status text returned with `status`, such as `Not Found`. When it is omitted, the response uses the standard text for the status. Clients don't always receive it: HTTP/2 and HTTP/3 have no status text, and Managed Dedicated and self-hosted gateways always send the standard text.
+   */
+  statusText?: string;
+  /**
+   * The `detail` of the problem response returned to a rejected request. Every caller outside the gateway receives it, so don't describe how the route is called. When it is omitted, the response has no `detail`, and a `404` matches the response for a route that does not exist.
+   */
+  detail?: string;
+}
+
 /**
  * Restricts which client IP addresses can call a route using an allow list, a
  * deny list, or both. Entries are individual IP addresses or CIDR ranges, in
@@ -8159,7 +8256,8 @@ declare type JevBaseURL = string;
 declare type JevModel = string;
 
 /**
- * Classify with Jev, TypeSafe's classification model, by calling a System One API directly: TypeSafe's by default, or another host such as OpenRouter through `baseUrl`. Jev answers typed questions instead of generating text, so it takes no `classifierPrompt`.
+ * @deprecated
+ * Deprecated: use classifier.adapter with flat apiKey, model, and baseUrl fields. Classify with Jev, TypeSafe's classification model, by calling a System One API directly: TypeSafe's by default, or another host such as OpenRouter through `baseUrl`. Jev answers typed questions instead of generating text, so it takes no `classifierPrompt`.
  * @public
  */
 declare interface JevTypeSafe {

package/out/types/internal/index.d.ts

@@ -154,6 +154,38 @@ declare interface CompatibilityFlags {
    * discover tools with `tools/list`, as the MCP spec defines.
    */
   removeMcpToolsCapabilityExtension: boolean;
+  /**
+   * Whether OpenAPI schema combinators (`allOf`, `oneOf`, `anyOf`, `not`) are
+   * applied with JSON Schema semantics when an operation's schemas are turned
+   * into runtime validators. Today that is the MCP server handler: a tool's
+   * advertised `inputSchema`/`outputSchema` and its argument validation.
+   * `request-validation-inbound` already uses Ajv and is unaffected.
+   *
+   * Before this flag:
+   * - A top-level combinator is used on its own, and every keyword beside it
+   *   (`type`, `properties`, `required`, `additionalProperties`, `nullable`,
+   *   `description`, ...) is ignored. A body of
+   *   `{ type: object, properties, required, oneOf: [...] }` can be advertised
+   *   as `{ anyOf: [{}, {}] }` and accept any value.
+   * - `oneOf` behaves like `anyOf`: a value matching several branches is
+   *   accepted, and `oneOf` is advertised as `anyOf`.
+   *
+   * After this flag:
+   * - The schema's own keywords and every combinator beside them all apply,
+   *   intersected.
+   * - `oneOf` accepts a value only when exactly one branch matches, and is
+   *   advertised as `oneOf`.
+   * - Within a combinator schema and its branches: `required`,
+   *   `additionalProperties`, `minProperties` or `maxProperties` without a
+   *   `type` mark an object schema, an object schema rejects non-objects, a
+   *   `required` name that `properties` omits is enforced, a numeric or
+   *   boolean `enum` is enforced, and `unevaluatedProperties: false` is
+   *   enforced. A schema with no combinator is unchanged.
+   *
+   * The advertised schema changes for every affected tool, and calls the
+   * gateway's request validation would reject are rejected with -32602.
+   */
+  enforceOpenApiCombinatorSemantics: boolean;
 }
 
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zuplo/runtime",
   "type": "module",
-  "version": "7.9.11",
+  "version": "7.9.13",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",
   "exports": {