@amritk/lint 0.1.0 → 0.2.0

package/dist/rules/openapi/functions/oas-op-form-data-consume-check.js

@@ -0,0 +1,21 @@
+import { isObject } from './helpers.js';
+/** Validates OpenAPI v2 formData operations declare a compatible `consumes`. */
+export const oasOpFormDataConsumeCheck = (operation, _options, context) => {
+    if (!isObject(operation))
+        return [];
+    const params = Array.isArray(operation['parameters']) ? operation['parameters'] : [];
+    const hasFormData = params.some((param) => isObject(param) && param['in'] === 'formData');
+    if (!hasFormData)
+        return [];
+    const consumes = Array.isArray(operation['consumes']) ? operation['consumes'] : [];
+    const ok = consumes.some((type) => type === 'application/x-www-form-urlencoded' || type === 'multipart/form-data');
+    if (!ok) {
+        return [
+            {
+                message: 'Operations with formData parameters must consume application/x-www-form-urlencoded or multipart/form-data',
+                path: [...context.path, 'consumes'],
+            },
+        ];
+    }
+    return [];
+};

package/dist/rules/openapi/functions/oas-op-id-unique.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Ensures `operationId` values are unique across the document. */
+export declare const oasOpIdUnique: RulesetFunction;

package/dist/rules/openapi/functions/oas-op-id-unique.js

@@ -0,0 +1,27 @@
+import { isObject } from './helpers.js';
+/** Ensures `operationId` values are unique across the document. */
+export const oasOpIdUnique = (paths, _options, context) => {
+    if (!isObject(paths))
+        return [];
+    const seen = new Set();
+    const results = [];
+    for (const [path, item] of Object.entries(paths)) {
+        if (!isObject(item))
+            continue;
+        for (const [method, operation] of Object.entries(item)) {
+            if (!isObject(operation))
+                continue;
+            const id = operation['operationId'];
+            if (typeof id !== 'string')
+                continue;
+            if (seen.has(id)) {
+                results.push({
+                    message: `operationId "${id}" must be unique`,
+                    path: [...context.path, path, method, 'operationId'],
+                });
+            }
+            seen.add(id);
+        }
+    }
+    return results;
+};

package/dist/rules/openapi/functions/oas-op-params.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Flags duplicate `name`+`in` parameter combinations on an operation. */
+export declare const oasOpParams: RulesetFunction;

package/dist/rules/openapi/functions/oas-op-params.js

@@ -0,0 +1,21 @@
+import { isObject } from './helpers.js';
+/** Flags duplicate `name`+`in` parameter combinations on an operation. */
+export const oasOpParams = (params, _options, context) => {
+    if (!Array.isArray(params))
+        return [];
+    const seen = new Set();
+    const results = [];
+    params.forEach((param, index) => {
+        if (!isObject(param) || param['name'] === undefined || param['in'] === undefined)
+            return;
+        const key = `${String(param['in'])}:${String(param['name'])}`;
+        if (seen.has(key)) {
+            results.push({
+                message: `Duplicate parameter "${String(param['name'])}" in "${String(param['in'])}"`,
+                path: [...context.path, index],
+            });
+        }
+        seen.add(key);
+    });
+    return results;
+};

package/dist/rules/openapi/functions/oas-op-security-defined.d.ts

@@ -0,0 +1,5 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Validates that every referenced security scheme is defined. */
+export declare const oasOpSecurityDefined: RulesetFunction<Record<string, unknown>, {
+    schemesPath: string[];
+}>;

package/dist/rules/openapi/functions/oas-op-security-defined.js

@@ -0,0 +1,44 @@
+import { HTTP_METHODS, isObject } from './helpers.js';
+/** Walks `path` into `root`, returning the nested value or undefined. */
+const getIn = (root, path) => {
+    let current = root;
+    for (const key of path) {
+        if (!isObject(current))
+            return undefined;
+        current = current[key];
+    }
+    return current;
+};
+/** Validates that every referenced security scheme is defined. */
+export const oasOpSecurityDefined = (root, options, context) => {
+    if (!isObject(root))
+        return [];
+    const schemes = getIn(root, options?.schemesPath ?? []);
+    const defined = new Set(isObject(schemes) ? Object.keys(schemes) : []);
+    const results = [];
+    const check = (security, path) => {
+        if (!Array.isArray(security))
+            return;
+        security.forEach((requirement, index) => {
+            if (!isObject(requirement))
+                return;
+            for (const name of Object.keys(requirement)) {
+                if (!defined.has(name)) {
+                    results.push({ message: `Security scheme "${name}" is not defined`, path: [...path, index, name] });
+                }
+            }
+        });
+    };
+    check(root['security'], [...context.path, 'security']);
+    const paths = isObject(root['paths']) ? root['paths'] : {};
+    for (const [path, item] of Object.entries(paths)) {
+        if (!isObject(item))
+            continue;
+        for (const [method, operation] of Object.entries(item)) {
+            if (HTTP_METHODS.has(method) && isObject(operation)) {
+                check(operation['security'], [...context.path, 'paths', path, method, 'security']);
+            }
+        }
+    }
+    return results;
+};

package/dist/rules/openapi/functions/oas-op-success-response.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Ensures every operation declares at least one 2xx or 3xx response. */
+export declare const oasOpSuccessResponse: RulesetFunction;

package/dist/rules/openapi/functions/oas-op-success-response.js

@@ -0,0 +1,11 @@
+import { isObject } from './helpers.js';
+/** Ensures every operation declares at least one 2xx or 3xx response. */
+export const oasOpSuccessResponse = (responses) => {
+    if (!isObject(responses))
+        return [];
+    const hasSuccess = Object.keys(responses).some((code) => /^[23]\d\d$/.test(code) || code === 'default');
+    if (!hasSuccess) {
+        return [{ message: 'Operation must define at least one 2xx or 3xx response' }];
+    }
+    return [];
+};

package/dist/rules/openapi/functions/oas-path-param.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Validates path templating: declared `{params}` must have matching path parameters. */
+export declare const oasPathParam: RulesetFunction;

package/dist/rules/openapi/functions/oas-path-param.js

@@ -0,0 +1,45 @@
+import { HTTP_METHODS, isObject } from './helpers.js';
+/** Validates path templating: declared `{params}` must have matching path parameters. */
+export const oasPathParam = (paths, _options, context) => {
+    if (!isObject(paths))
+        return [];
+    const results = [];
+    for (const [path, item] of Object.entries(paths)) {
+        if (!isObject(item))
+            continue;
+        const templates = [...path.matchAll(/\{([^}]+)\}/g)].map((m) => m[1]);
+        const seen = new Set();
+        for (const template of templates) {
+            if (seen.has(template)) {
+                results.push({
+                    message: `Path "${path}" uses parameter "{${template}}" more than once`,
+                    path: [...context.path, path],
+                });
+            }
+            seen.add(template);
+        }
+        const declared = new Set();
+        const collect = (params) => {
+            if (!Array.isArray(params))
+                return;
+            for (const param of params) {
+                if (isObject(param) && param['in'] === 'path' && typeof param['name'] === 'string')
+                    declared.add(param['name']);
+            }
+        };
+        collect(item['parameters']);
+        for (const [method, operation] of Object.entries(item)) {
+            if (HTTP_METHODS.has(method) && isObject(operation))
+                collect(operation['parameters']);
+        }
+        for (const template of seen) {
+            if (!declared.has(template)) {
+                results.push({
+                    message: `Path parameter "{${template}}" in "${path}" has no matching path parameter definition`,
+                    path: [...context.path, path],
+                });
+            }
+        }
+    }
+    return results;
+};

package/dist/rules/openapi/functions/oas-schema-example-deprecated.d.ts

@@ -0,0 +1,10 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/**
+ * Flags a Schema Object's singular `example`, deprecated in OpenAPI 3.1 (JSON
+ * Schema 2020-12) in favor of the `examples` array. Targets the parent of an
+ * `example` key (`$..example^`); to avoid false positives it only fires when the
+ * parent looks like a Schema Object — it carries a JSON Schema keyword and is not
+ * a Media Type / Parameter / Header object (those have a `schema` field and keep
+ * a valid singular `example`).
+ */
+export declare const oasSchemaExampleDeprecated: RulesetFunction;

package/dist/rules/openapi/functions/oas-schema-example-deprecated.js

@@ -0,0 +1,42 @@
+import { isObject } from './helpers.js';
+// JSON Schema keywords that mark an object as a Schema Object (vs. a Media Type
+// or Parameter Object, whose singular `example` is *not* deprecated in 3.1+).
+const SCHEMA_KEYWORDS = new Set([
+    'type',
+    'properties',
+    'items',
+    'allOf',
+    'anyOf',
+    'oneOf',
+    'not',
+    'enum',
+    'format',
+    'required',
+    'additionalProperties',
+    'patternProperties',
+    'prefixItems',
+    '$ref',
+]);
+/**
+ * Flags a Schema Object's singular `example`, deprecated in OpenAPI 3.1 (JSON
+ * Schema 2020-12) in favor of the `examples` array. Targets the parent of an
+ * `example` key (`$..example^`); to avoid false positives it only fires when the
+ * parent looks like a Schema Object — it carries a JSON Schema keyword and is not
+ * a Media Type / Parameter / Header object (those have a `schema` field and keep
+ * a valid singular `example`).
+ */
+export const oasSchemaExampleDeprecated = (input, _options, context) => {
+    if (!isObject(input) || input['example'] === undefined)
+        return [];
+    if ('schema' in input)
+        return [];
+    const looksLikeSchema = Object.keys(input).some((key) => SCHEMA_KEYWORDS.has(key));
+    if (!looksLikeSchema)
+        return [];
+    return [
+        {
+            message: 'Schema "example" is deprecated in OpenAPI 3.1; use "examples" instead.',
+            path: [...context.path, 'example'],
+        },
+    ];
+};

package/dist/rules/openapi/functions/oas-schema.d.ts

@@ -0,0 +1,15 @@
+import type { RulesetFunction } from '../../../core/index.js';
+import { type OasVersion } from '../schemas/index.js';
+/** Options for {@link oasSchema}: which OpenAPI version's meta-schema to validate against. */
+export type IOasSchemaOptions = {
+    version: OasVersion;
+};
+/**
+ * Validates a whole OpenAPI document against the official structural meta-schema
+ * for a given `version`, loading that version's schema lazily on first use. The
+ * `*-schema` rules are format-gated to a single version, so linting a document
+ * only ever reads its own version's schema file — the other versions' schemas
+ * are never loaded. Delegates the actual validation to the built-in `schema`
+ * function (which caches the prepared validator by schema identity).
+ */
+export declare const oasSchema: RulesetFunction<unknown, IOasSchemaOptions>;

package/dist/rules/openapi/functions/oas-schema.js

@@ -0,0 +1,15 @@
+import { schema as schemaFunction } from '../../../functions/index.js';
+import { loadOasSchema } from '../schemas/index.js';
+/**
+ * Validates a whole OpenAPI document against the official structural meta-schema
+ * for a given `version`, loading that version's schema lazily on first use. The
+ * `*-schema` rules are format-gated to a single version, so linting a document
+ * only ever reads its own version's schema file — the other versions' schemas
+ * are never loaded. Delegates the actual validation to the built-in `schema`
+ * function (which caches the prepared validator by schema identity).
+ */
+export const oasSchema = (input, options, context) => {
+    if (!options?.version)
+        return [];
+    return schemaFunction(input, { schema: loadOasSchema(options.version) }, context);
+};

package/dist/rules/openapi/functions/oas-server-name-unique.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Flags duplicate OpenAPI 3.2 Server Object `name` values across the servers array. */
+export declare const oasServerNameUnique: RulesetFunction;

package/dist/rules/openapi/functions/oas-server-name-unique.js

@@ -0,0 +1,20 @@
+import { isObject } from './helpers.js';
+/** Flags duplicate OpenAPI 3.2 Server Object `name` values across the servers array. */
+export const oasServerNameUnique = (servers, _options, context) => {
+    if (!Array.isArray(servers))
+        return [];
+    const seen = new Set();
+    const results = [];
+    servers.forEach((server, index) => {
+        if (!isObject(server) || typeof server['name'] !== 'string')
+            return;
+        if (seen.has(server['name'])) {
+            results.push({
+                message: `Server name "${server['name']}" must be unique`,
+                path: [...context.path, index, 'name'],
+            });
+        }
+        seen.add(server['name']);
+    });
+    return results;
+};

package/dist/rules/openapi/functions/oas-server-variables.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Validates server variables are declared and used. */
+export declare const oasServerVariables: RulesetFunction;

package/dist/rules/openapi/functions/oas-server-variables.js

@@ -0,0 +1,23 @@
+import { isObject } from './helpers.js';
+/** Validates server variables are declared and used. */
+export const oasServerVariables = (server, _options, context) => {
+    if (!isObject(server) || typeof server['url'] !== 'string')
+        return [];
+    const templates = [...server['url'].matchAll(/\{([^}]+)\}/g)].map((m) => m[1]);
+    const variables = isObject(server['variables']) ? server['variables'] : {};
+    const results = [];
+    for (const template of templates) {
+        if (!(template in variables)) {
+            results.push({ message: `Server variable "${template}" is not defined`, path: [...context.path, 'variables'] });
+        }
+    }
+    for (const name of Object.keys(variables)) {
+        if (!templates.includes(name)) {
+            results.push({
+                message: `Server variable "${name}" is not used in the URL`,
+                path: [...context.path, 'variables', name],
+            });
+        }
+    }
+    return results;
+};

package/dist/rules/openapi/functions/oas-tag-defined.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Ensures each operation tag is declared in the global `tags` list. */
+export declare const oasTagDefined: RulesetFunction;

package/dist/rules/openapi/functions/oas-tag-defined.js

@@ -0,0 +1,21 @@
+import { isObject } from './helpers.js';
+/** Ensures each operation tag is declared in the global `tags` list. */
+export const oasTagDefined = (input, _options, context) => {
+    const root = context.document.data;
+    if (!isObject(root) || !isObject(input))
+        return [];
+    const globalTags = new Set((Array.isArray(root['tags']) ? root['tags'] : [])
+        .map((tag) => (isObject(tag) ? tag['name'] : undefined))
+        .filter((name) => typeof name === 'string'));
+    const tags = Array.isArray(input['tags']) ? input['tags'] : [];
+    const results = [];
+    tags.forEach((tag, index) => {
+        if (typeof tag === 'string' && !globalTags.has(tag)) {
+            results.push({
+                message: `Operation tag "${tag}" is not defined in the global tags`,
+                path: [...context.path, 'tags', index],
+            });
+        }
+    });
+    return results;
+};

package/dist/rules/openapi/functions/oas-tag-kind.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Flags a present-but-unregistered OpenAPI 3.2 Tag Object `kind` value. */
+export declare const oasTagKind: RulesetFunction;

package/dist/rules/openapi/functions/oas-tag-kind.js

@@ -0,0 +1,17 @@
+import { isObject } from './helpers.js';
+// Registered OpenAPI 3.2 Tag `kind` values (the field is extensible via a
+// community registry, so this rule is recommended: false / opt-in).
+const REGISTERED_TAG_KINDS = new Set(['nav', 'badge', 'audience']);
+/** Flags a present-but-unregistered OpenAPI 3.2 Tag Object `kind` value. */
+export const oasTagKind = (tag, _options, context) => {
+    if (!isObject(tag) || typeof tag['kind'] !== 'string')
+        return [];
+    if (REGISTERED_TAG_KINDS.has(tag['kind']))
+        return [];
+    return [
+        {
+            message: `Tag kind "${tag['kind']}" is not a registered value (${[...REGISTERED_TAG_KINDS].join(', ')})`,
+            path: [...context.path, 'kind'],
+        },
+    ];
+};

package/dist/rules/openapi/functions/oas-tag-parent-defined.d.ts

@@ -0,0 +1,7 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/**
+ * Validates the OpenAPI 3.2 Tag Object `parent` hierarchy: every `parent` must
+ * name a tag that exists in the top-level `tags` list, a tag must not be its own
+ * parent, and the parent chain must not form a cycle.
+ */
+export declare const oasTagParentDefined: RulesetFunction;

package/dist/rules/openapi/functions/oas-tag-parent-defined.js

@@ -0,0 +1,45 @@
+import { isObject } from './helpers.js';
+/**
+ * Validates the OpenAPI 3.2 Tag Object `parent` hierarchy: every `parent` must
+ * name a tag that exists in the top-level `tags` list, a tag must not be its own
+ * parent, and the parent chain must not form a cycle.
+ */
+export const oasTagParentDefined = (tags, _options, context) => {
+    if (!Array.isArray(tags))
+        return [];
+    const byName = new Map();
+    for (const tag of tags) {
+        if (isObject(tag) && typeof tag['name'] === 'string')
+            byName.set(tag['name'], tag);
+    }
+    const results = [];
+    tags.forEach((tag, index) => {
+        if (!isObject(tag) || typeof tag['parent'] !== 'string')
+            return;
+        const parent = tag['parent'];
+        const name = typeof tag['name'] === 'string' ? tag['name'] : undefined;
+        if (!byName.has(parent)) {
+            results.push({
+                message: `Tag parent "${parent}" is not defined in the global tags`,
+                path: [...context.path, index, 'parent'],
+            });
+            return;
+        }
+        // Walk the parent chain from this tag; a repeat means a cycle (incl. self-parent).
+        const visited = new Set(name ? [name] : []);
+        let current = parent;
+        while (current !== undefined) {
+            if (visited.has(current)) {
+                results.push({
+                    message: `Tag "${name ?? '(unnamed)'}" has a circular parent reference via "${current}"`,
+                    path: [...context.path, index, 'parent'],
+                });
+                break;
+            }
+            visited.add(current);
+            const next = byName.get(current)?.['parent'];
+            current = typeof next === 'string' ? next : undefined;
+        }
+    });
+    return results;
+};

package/dist/rules/openapi/functions/oas-tags-unique.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Flags duplicate global tag names. */
+export declare const oasTagsUnique: RulesetFunction;

package/dist/rules/openapi/functions/oas-tags-unique.js

@@ -0,0 +1,17 @@
+import { isObject } from './helpers.js';
+/** Flags duplicate global tag names. */
+export const oasTagsUnique = (tags, _options, context) => {
+    if (!Array.isArray(tags))
+        return [];
+    const seen = new Set();
+    const results = [];
+    tags.forEach((tag, index) => {
+        if (!isObject(tag) || typeof tag['name'] !== 'string')
+            return;
+        if (seen.has(tag['name'])) {
+            results.push({ message: `Duplicate tag name "${tag['name']}"`, path: [...context.path, index, 'name'] });
+        }
+        seen.add(tag['name']);
+    });
+    return results;
+};

package/dist/rules/openapi/functions/oas-unused-component.d.ts

@@ -0,0 +1,7 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/**
+ * Flags reusable `components/*` entries that nothing `$ref`s. Spectral's
+ * `oas3-unused-component` checks every reusable component type (not just
+ * schemas), so we do too — run on the unresolved document.
+ */
+export declare const oasUnusedComponent: RulesetFunction;

package/dist/rules/openapi/functions/oas-unused-component.js

@@ -0,0 +1,52 @@
+import { isObject } from './helpers.js';
+// Reusable component types that are referenced via `$ref` (securitySchemes are
+// referenced by name in `security`, not via `$ref`, so they are excluded).
+const REUSABLE_COMPONENT_TYPES = [
+    'schemas',
+    'responses',
+    'parameters',
+    'examples',
+    'requestBodies',
+    'headers',
+    'links',
+    'callbacks',
+];
+/** Collects every `$ref` string anywhere in `node` into `into`. */
+const collectRefs = (node, into) => {
+    if (Array.isArray(node)) {
+        for (const item of node)
+            collectRefs(item, into);
+        return;
+    }
+    if (isObject(node)) {
+        for (const [key, value] of Object.entries(node)) {
+            if (key === '$ref' && typeof value === 'string')
+                into.add(value);
+            else
+                collectRefs(value, into);
+        }
+    }
+};
+/**
+ * Flags reusable `components/*` entries that nothing `$ref`s. Spectral's
+ * `oas3-unused-component` checks every reusable component type (not just
+ * schemas), so we do too — run on the unresolved document.
+ */
+export const oasUnusedComponent = (components, _options, context) => {
+    if (!isObject(components))
+        return [];
+    const refs = new Set();
+    collectRefs(context.document.data, refs);
+    const results = [];
+    for (const type of REUSABLE_COMPONENT_TYPES) {
+        const group = components[type];
+        if (!isObject(group))
+            continue;
+        for (const key of Object.keys(group)) {
+            if (!refs.has(`#/components/${type}/${key}`)) {
+                results.push({ message: 'Potentially unused component has been detected.', path: [...context.path, type, key] });
+            }
+        }
+    }
+    return results;
+};

package/dist/rules/openapi/functions/ref-siblings.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Flags objects that mix `$ref` with sibling keys (which are ignored per spec). */
+export declare const refSiblings: RulesetFunction;

package/dist/rules/openapi/functions/ref-siblings.js

@@ -0,0 +1,13 @@
+import { isObject } from './helpers.js';
+/** Flags objects that mix `$ref` with sibling keys (which are ignored per spec). */
+export const refSiblings = (input, _options, context) => {
+    if (!isObject(input) || !('$ref' in input))
+        return [];
+    const results = [];
+    for (const key of Object.keys(input)) {
+        if (key !== '$ref') {
+            results.push({ message: `$ref must not be placed next to "${key}"`, path: [...context.path, key] });
+        }
+    }
+    return results;
+};

package/dist/rules/openapi/index.d.ts

@@ -0,0 +1,25 @@
+import { type FunctionRegistry, type ResolvedExtend, type Ruleset, type RulesetDefinition } from '../../core/index.js';
+export { oasFixers } from './fixers.js';
+export { oas2, oas3, oas3_0, oas3_1, oas3_2, oasFormats } from './formats.js';
+export { oasFunctions } from './functions/index.js';
+export { oas } from './oas.js';
+export { loadOasSchema, type OasVersion } from './schemas/index.js';
+/** The built-in `@amritk/lint` functions plus the OpenAPI-specific ones, keyed by name. */
+export declare const allFunctions: FunctionRegistry;
+/**
+ * Resolves an `extends` reference to a ruleset definition. Extends the generic
+ * file/package resolution with the OpenAPI preset names:
+ * - `oas` / `loupe:oas` / `spectral:oas` → the built-in {@link oas} ruleset,
+ * - local file paths (relative to `basePath`, or absolute): `.yaml` / `.yml` / `.json` / `.js`,
+ * - npm package specifiers (resolved from `basePath`), including subpaths.
+ */
+export declare const resolveOpenApiRuleset: (name: string, basePath?: string) => ResolvedExtend;
+/**
+ * Builds a runnable {@link Ruleset} for OpenAPI, layering the built-in and
+ * OpenAPI functions (plus any custom ones the definition declares), the OpenAPI
+ * `formats`, and `extends` resolution that understands the `oas` / `loupe:oas` /
+ * `spectral:oas` names. With no definition it defaults to `extends: [oas]`
+ * (recommended rules only). Feed the result to `@amritk/lint`'s core
+ * `lintWithResult` (with a `$ref` resolver for `resolved: true` rules).
+ */
+export declare const createOpenApiRuleset: (definition?: RulesetDefinition, basePath?: string) => Ruleset;