@amritk/lint 0.1.0 → 0.3.0

package/dist/rules/openapi/functions/example-validation.js

@@ -0,0 +1,160 @@
+import { validate } from '@amritk/runtime-validators';
+import { isObject } from './helpers.js';
+// The example schemas come from the *linted document*, so they are only known at
+// runtime. `@amritk/runtime-validators` interprets a schema directly — no
+// `ajv.compile` (whose codegen dominated lint time on large specs, recompiling
+// `$ref`-duplicated schemas tens of thousands of times) and no `new Function`,
+// so it is also CSP/edge-runtime safe. Returns undefined for a non-object or a
+// schema the validator can't build (mirrors the old skip-on-compile-failure
+// behavior).
+//
+// Formats are asserted (`formats: 'all'`) to match Spectral, whose example rules
+// run ajv with `ajv-formats` enabled — otherwise a format-violating example (a
+// bad `email`/`date`/`uuid`) would slip through. This mirrors the core `schema`
+// built-in's option exactly; `@amritk/runtime-validators` treats the OAS-specific
+// numeric/binary formats (`int32`/`int64`/`float`/`byte`/`binary`) as non-failing.
+const buildValidator = (schema) => {
+    if (!isObject(schema))
+        return undefined;
+    let validator;
+    try {
+        validator = validate(schema, { formats: 'all' });
+    }
+    catch {
+        return undefined;
+    }
+    // A schema can carry a `$ref` the runtime validator cannot resolve (an external
+    // or cyclic ref left behind after `$ref` inlining), which throws at *run* time
+    // rather than build time. Treat that as "cannot validate — skip" (returning a
+    // valid result) so an unresolvable example schema never crashes the whole lint.
+    return (input) => {
+        try {
+            return validator(input);
+        }
+        catch {
+            return true;
+        }
+    };
+};
+const buildValidatorOrNull = (schema) => buildValidator(schema) ?? null;
+// Keyed by the Schema Object node; `oasSchemaExample` validates a schema's own
+// `example`/`default` against the schema minus its `example`/`examples` keywords.
+const schemaExampleResults = new WeakMap();
+// Keyed by the Media Type / Response Object node; `oasMediaExample` validates the
+// object's example(s) against its `schema`. The node (not the schema) is the cache
+// key because two media objects can share a `schema` but carry different examples.
+const mediaExampleResults = new WeakMap();
+const withPath = (findings, path) => {
+    if (findings.length === 0)
+        return [];
+    return findings.map((finding) => ({ message: finding.message, path: [...path, ...finding.suffix] }));
+};
+// A schema node reached via `$..[?(...)]` might be a `properties`/`patternProperties`
+// *map* whose keys happen to look like schema keywords (e.g. a property literally
+// named `type`). Those maps are not Schema Objects, so we never validate them.
+const isPropertiesMap = (path) => {
+    const tail = path[path.length - 1];
+    return tail === 'properties' || tail === 'patternProperties';
+};
+/** Validates a schema object's inline `example` and `default` against the schema itself. */
+export const oasSchemaExample = (schema, _options, context) => {
+    if (!isObject(schema))
+        return [];
+    if (schema['example'] === undefined && schema['default'] === undefined)
+        return [];
+    if (isPropertiesMap(context.path))
+        return [];
+    let findings = schemaExampleResults.get(schema);
+    if (findings === undefined) {
+        findings = [];
+        // `example`/`examples` are annotations, not constraints, so drop them before
+        // building the validator; `default` stays (it is not a validation keyword).
+        const { example, examples, ...rest } = schema;
+        void example;
+        void examples;
+        const check = buildValidatorOrNull(rest);
+        if (check) {
+            for (const field of ['example', 'default']) {
+                if (schema[field] === undefined)
+                    continue;
+                const result = check(schema[field]);
+                if (result !== true) {
+                    for (const error of result.errors)
+                        findings.push({ message: `"${field}" ${error.message}`.trim(), suffix: [field] });
+                }
+            }
+        }
+        schemaExampleResults.set(schema, findings);
+    }
+    return withPath(findings, context.path);
+};
+/**
+ * Validates a Media Type / Response / Parameter object's examples against its
+ * `schema`. Version-split because OpenAPI 2.0 and 3.x model examples differently:
+ * - OAS3: a singular `example` value plus an `examples` map of Example Objects,
+ *   each of which carries the value under `value`.
+ * - OAS2: `examples` is a MIME-type → value map (`{ 'application/json': value }`),
+ *   with no Example Objects and no singular `example` on the media object — so the
+ *   3.x logic validated nothing at all for a real 2.0 document.
+ */
+export const oasMediaExample = (media, options, context) => {
+    if (!isObject(media) || !isObject(media['schema']))
+        return [];
+    const oasVersion = options?.oasVersion ?? 3;
+    // Skip building a validator when there is nothing to check — most media objects
+    // in a large spec have a schema but no example. (OAS2 only has the map form.)
+    const hasExample = (oasVersion !== 2 && media['example'] !== undefined) || isObject(media['examples']);
+    if (!hasExample)
+        return [];
+    let findings = mediaExampleResults.get(media);
+    if (findings === undefined) {
+        findings = [];
+        const check = buildValidatorOrNull(media['schema']);
+        if (check) {
+            if (oasVersion === 2)
+                collectOas2(media, check, findings);
+            else
+                collectOas3(media, check, findings);
+        }
+        mediaExampleResults.set(media, findings);
+    }
+    return withPath(findings, context.path);
+};
+/** OAS2: validate each `examples[mimeType]` value against the sibling `schema`. */
+const collectOas2 = (media, check, findings) => {
+    const examples = isObject(media['examples']) ? media['examples'] : undefined;
+    if (!examples)
+        return;
+    for (const [mimeType, value] of Object.entries(examples)) {
+        const result = check(value);
+        if (result !== true) {
+            for (const error of result.errors) {
+                findings.push({ message: `Example "${mimeType}" ${error.message}`.trim(), suffix: ['examples', mimeType] });
+            }
+        }
+    }
+};
+/** OAS3: validate the singular `example` and each `examples[name].value` against the `schema`. */
+const collectOas3 = (media, check, findings) => {
+    if (media['example'] !== undefined) {
+        const result = check(media['example']);
+        if (result !== true) {
+            for (const error of result.errors)
+                findings.push({ message: `"example" ${error.message}`.trim(), suffix: ['example'] });
+        }
+    }
+    const examples = isObject(media['examples']) ? media['examples'] : undefined;
+    if (!examples)
+        return;
+    for (const [name, example] of Object.entries(examples)) {
+        // An external-value example is fetched elsewhere, so there is nothing inline to check.
+        if (isObject(example) && example['value'] !== undefined) {
+            const result = check(example['value']);
+            if (result !== true) {
+                for (const error of result.errors) {
+                    findings.push({ message: `Example "${name}" ${error.message}`.trim(), suffix: ['examples', name, 'value'] });
+                }
+            }
+        }
+    }
+};

package/dist/rules/openapi/functions/helpers.d.ts

@@ -0,0 +1,4 @@
+/** True for a non-null, non-array object (an OpenAPI "object" value). */
+export declare const isObject: (value: unknown) => value is Record<string, unknown>;
+export declare const HTTP_METHODS: Set<string>;
+export declare const OPERATION_METHODS: Set<string>;

package/dist/rules/openapi/functions/helpers.js

@@ -0,0 +1,10 @@
+/** True for a non-null, non-array object (an OpenAPI "object" value). */
+export const isObject = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+// The eight standard HTTP methods that have a dedicated fixed field on the Path
+// Item Object. Shared by the rules that iterate a path item's operations.
+export const HTTP_METHODS = new Set(['get', 'put', 'post', 'delete', 'options', 'head', 'patch', 'trace']);
+// OpenAPI 3.2 promoted `query` to a fixed Path Item Object operation field, so the
+// rules that walk a path item's operations must consider it too. Including it is
+// harmless on older versions, which never carry a `query` operation, so the same
+// set works across every OpenAPI version.
+export const OPERATION_METHODS = new Set([...HTTP_METHODS, 'query']);

package/dist/rules/openapi/functions/index.d.ts

@@ -0,0 +1,26 @@
+import type { FunctionRegistry } from '../../../core/index.js';
+export { type IOasExampleOptions, oasMediaExample, oasSchemaExample } from './example-validation.js';
+export { oasAdditionalOperations } from './oas-additional-operations.js';
+export { oasDiscriminator } from './oas-discriminator.js';
+export { oasExampleExternalValue } from './oas-example-external-value.js';
+export { oasExampleValue } from './oas-example-value.js';
+export { oasMutuallyExclusive } from './oas-mutually-exclusive.js';
+export { oasNoNullable } from './oas-no-nullable.js';
+export { oasOpFormDataConsumeCheck } from './oas-op-form-data-consume-check.js';
+export { oasOpIdUnique } from './oas-op-id-unique.js';
+export { oasOpParams } from './oas-op-params.js';
+export { oasOpSecurityDefined } from './oas-op-security-defined.js';
+export { oasOpSuccessResponse } from './oas-op-success-response.js';
+export { oasPathParam } from './oas-path-param.js';
+export { type IOasSchemaOptions, oasSchema } from './oas-schema.js';
+export { oasSchemaExampleDeprecated } from './oas-schema-example-deprecated.js';
+export { oasServerNameUnique } from './oas-server-name-unique.js';
+export { oasServerVariables } from './oas-server-variables.js';
+export { oasTagDefined } from './oas-tag-defined.js';
+export { oasTagKind } from './oas-tag-kind.js';
+export { oasTagParentDefined } from './oas-tag-parent-defined.js';
+export { oasTagsUnique } from './oas-tags-unique.js';
+export { oasUnusedComponent } from './oas-unused-component.js';
+export { refSiblings } from './ref-siblings.js';
+/** The OpenAPI-specific custom functions, keyed by name for ruleset `then` references. */
+export declare const oasFunctions: FunctionRegistry;

package/dist/rules/openapi/functions/index.js

@@ -0,0 +1,73 @@
+import { oasMediaExample, oasSchemaExample } from './example-validation.js';
+import { oasAdditionalOperations } from './oas-additional-operations.js';
+import { oasDiscriminator } from './oas-discriminator.js';
+import { oasExampleExternalValue } from './oas-example-external-value.js';
+import { oasExampleValue } from './oas-example-value.js';
+import { oasMutuallyExclusive } from './oas-mutually-exclusive.js';
+import { oasNoNullable } from './oas-no-nullable.js';
+import { oasOpFormDataConsumeCheck } from './oas-op-form-data-consume-check.js';
+import { oasOpIdUnique } from './oas-op-id-unique.js';
+import { oasOpParams } from './oas-op-params.js';
+import { oasOpSecurityDefined } from './oas-op-security-defined.js';
+import { oasOpSuccessResponse } from './oas-op-success-response.js';
+import { oasPathParam } from './oas-path-param.js';
+import { oasSchema } from './oas-schema.js';
+import { oasSchemaExampleDeprecated } from './oas-schema-example-deprecated.js';
+import { oasServerNameUnique } from './oas-server-name-unique.js';
+import { oasServerVariables } from './oas-server-variables.js';
+import { oasTagDefined } from './oas-tag-defined.js';
+import { oasTagKind } from './oas-tag-kind.js';
+import { oasTagParentDefined } from './oas-tag-parent-defined.js';
+import { oasTagsUnique } from './oas-tags-unique.js';
+import { oasUnusedComponent } from './oas-unused-component.js';
+import { refSiblings } from './ref-siblings.js';
+export { oasMediaExample, oasSchemaExample } from './example-validation.js';
+export { oasAdditionalOperations } from './oas-additional-operations.js';
+export { oasDiscriminator } from './oas-discriminator.js';
+export { oasExampleExternalValue } from './oas-example-external-value.js';
+export { oasExampleValue } from './oas-example-value.js';
+export { oasMutuallyExclusive } from './oas-mutually-exclusive.js';
+export { oasNoNullable } from './oas-no-nullable.js';
+export { oasOpFormDataConsumeCheck } from './oas-op-form-data-consume-check.js';
+export { oasOpIdUnique } from './oas-op-id-unique.js';
+export { oasOpParams } from './oas-op-params.js';
+export { oasOpSecurityDefined } from './oas-op-security-defined.js';
+export { oasOpSuccessResponse } from './oas-op-success-response.js';
+export { oasPathParam } from './oas-path-param.js';
+export { oasSchema } from './oas-schema.js';
+export { oasSchemaExampleDeprecated } from './oas-schema-example-deprecated.js';
+export { oasServerNameUnique } from './oas-server-name-unique.js';
+export { oasServerVariables } from './oas-server-variables.js';
+export { oasTagDefined } from './oas-tag-defined.js';
+export { oasTagKind } from './oas-tag-kind.js';
+export { oasTagParentDefined } from './oas-tag-parent-defined.js';
+export { oasTagsUnique } from './oas-tags-unique.js';
+export { oasUnusedComponent } from './oas-unused-component.js';
+export { refSiblings } from './ref-siblings.js';
+/** The OpenAPI-specific custom functions, keyed by name for ruleset `then` references. */
+export const oasFunctions = {
+    refSiblings,
+    oasOpSuccessResponse,
+    oasTagDefined,
+    oasOpIdUnique,
+    oasPathParam,
+    oasOpParams,
+    oasTagsUnique,
+    oasOpSecurityDefined: oasOpSecurityDefined,
+    oasOpFormDataConsumeCheck,
+    oasDiscriminator,
+    oasServerVariables,
+    oasSchemaExample,
+    oasMediaExample: oasMediaExample,
+    oasUnusedComponent,
+    oasMutuallyExclusive: oasMutuallyExclusive,
+    oasNoNullable,
+    oasSchema: oasSchema,
+    oasAdditionalOperations,
+    oasServerNameUnique,
+    oasTagParentDefined,
+    oasSchemaExampleDeprecated,
+    oasTagKind,
+    oasExampleValue,
+    oasExampleExternalValue,
+};

package/dist/rules/openapi/functions/oas-additional-operations.d.ts

@@ -0,0 +1,8 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/**
+ * Flags standard HTTP methods inside an OpenAPI 3.2 `additionalOperations` map.
+ * The spec reserves that map for methods without a dedicated fixed field, so a
+ * standard method key (sent uppercase, e.g. `POST`) belongs in the lowercase
+ * fixed field (`post`) instead.
+ */
+export declare const oasAdditionalOperations: RulesetFunction;

package/dist/rules/openapi/functions/oas-additional-operations.js

@@ -0,0 +1,25 @@
+import { isObject, OPERATION_METHODS } from './helpers.js';
+// Methods that have a dedicated fixed field on the Path Item Object (the eight
+// standard methods plus 3.2's `query`). These MUST NOT be redefined inside the
+// new `additionalOperations` map, which is reserved for non-standard methods.
+const FIXED_PATH_ITEM_METHODS = OPERATION_METHODS;
+/**
+ * Flags standard HTTP methods inside an OpenAPI 3.2 `additionalOperations` map.
+ * The spec reserves that map for methods without a dedicated fixed field, so a
+ * standard method key (sent uppercase, e.g. `POST`) belongs in the lowercase
+ * fixed field (`post`) instead.
+ */
+export const oasAdditionalOperations = (input, _options, context) => {
+    if (!isObject(input))
+        return [];
+    const results = [];
+    for (const method of Object.keys(input)) {
+        if (FIXED_PATH_ITEM_METHODS.has(method.toLowerCase())) {
+            results.push({
+                message: `"additionalOperations" must not redefine the standard method "${method}"; use the "${method.toLowerCase()}" field instead`,
+                path: [...context.path, method],
+            });
+        }
+    }
+    return results;
+};

package/dist/rules/openapi/functions/oas-discriminator.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Validates a v2 discriminator references a required property. */
+export declare const oasDiscriminator: RulesetFunction;

package/dist/rules/openapi/functions/oas-discriminator.js

@@ -0,0 +1,23 @@
+import { isObject } from './helpers.js';
+/** Validates a v2 discriminator references a required property. */
+export const oasDiscriminator = (schema, _options, context) => {
+    if (!isObject(schema) || typeof schema['discriminator'] !== 'string')
+        return [];
+    const property = schema['discriminator'];
+    const required = Array.isArray(schema['required']) ? schema['required'] : [];
+    const properties = isObject(schema['properties']) ? schema['properties'] : {};
+    const results = [];
+    if (!(property in properties)) {
+        results.push({
+            message: `Discriminator "${property}" must be defined in properties`,
+            path: [...context.path, 'discriminator'],
+        });
+    }
+    if (!required.includes(property)) {
+        results.push({
+            message: `Discriminator "${property}" must be a required property`,
+            path: [...context.path, 'discriminator'],
+        });
+    }
+    return results;
+};

package/dist/rules/openapi/functions/oas-example-external-value.d.ts

@@ -0,0 +1,11 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/**
+ * Enforces that an Example Object carries exactly one inline value source. Across
+ * all of OpenAPI 3.x an Example must use either `value` or `externalValue` (not
+ * both, not neither). OpenAPI 3.2 added `dataValue`/`serializedValue` as further
+ * ways to supply the example, so their presence also satisfies the "has an
+ * example" requirement — otherwise a valid 3.2 `dataValue`-only example would be
+ * wrongly flagged. The mutual exclusivity of the new fields is policed separately
+ * by `oas3_2-example-value`.
+ */
+export declare const oasExampleExternalValue: RulesetFunction;

package/dist/rules/openapi/functions/oas-example-external-value.js

@@ -0,0 +1,23 @@
+import { isObject } from './helpers.js';
+/**
+ * Enforces that an Example Object carries exactly one inline value source. Across
+ * all of OpenAPI 3.x an Example must use either `value` or `externalValue` (not
+ * both, not neither). OpenAPI 3.2 added `dataValue`/`serializedValue` as further
+ * ways to supply the example, so their presence also satisfies the "has an
+ * example" requirement — otherwise a valid 3.2 `dataValue`-only example would be
+ * wrongly flagged. The mutual exclusivity of the new fields is policed separately
+ * by `oas3_2-example-value`.
+ */
+export const oasExampleExternalValue = (example) => {
+    if (!isObject(example))
+        return [];
+    // A 3.2 dataValue/serializedValue already provides the example, so value /
+    // externalValue are optional in that case.
+    if (example['dataValue'] !== undefined || example['serializedValue'] !== undefined)
+        return [];
+    const present = ['value', 'externalValue'].filter((property) => property in example);
+    if (present.length !== 1) {
+        return [{ message: 'Example object must have exactly one of "value" or "externalValue"' }];
+    }
+    return [];
+};

package/dist/rules/openapi/functions/oas-example-value.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Flags forbidden field combinations on an OpenAPI 3.2 Example Object. */
+export declare const oasExampleValue: RulesetFunction;

package/dist/rules/openapi/functions/oas-example-value.js

@@ -0,0 +1,31 @@
+import { isObject } from './helpers.js';
+// OpenAPI 3.2 Example Object exclusivity (MUST-level, per the spec's field
+// table). The `value`/`externalValue` pair is intentionally omitted here — the
+// 3.x-wide `oas3-examples-value-or-externalValue` rule already covers it, so we
+// only police the constraints introduced with the new `dataValue` /
+// `serializedValue` fields to avoid double-reporting.
+const EXAMPLE_EXCLUSIONS = [
+    // dataValue MUST NOT accompany value.
+    { field: 'dataValue', conflicts: ['value'] },
+    // serializedValue MUST NOT accompany value or externalValue.
+    { field: 'serializedValue', conflicts: ['value', 'externalValue'] },
+];
+/** Flags forbidden field combinations on an OpenAPI 3.2 Example Object. */
+export const oasExampleValue = (example, _options, context) => {
+    if (!isObject(example))
+        return [];
+    const results = [];
+    for (const { field, conflicts } of EXAMPLE_EXCLUSIONS) {
+        if (example[field] === undefined)
+            continue;
+        for (const other of conflicts) {
+            if (example[other] !== undefined) {
+                results.push({
+                    message: `"${field}" must not be used together with "${other}"`,
+                    path: [...context.path, other],
+                });
+            }
+        }
+    }
+    return results;
+};

package/dist/rules/openapi/functions/oas-mutually-exclusive.d.ts

@@ -0,0 +1,10 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/**
+ * Flags objects that carry more than one of a set of mutually exclusive
+ * properties. OpenAPI 3.1's License Object, for example, defines `identifier`
+ * (SPDX) as "mutually exclusive of the url field" — neither, or exactly one, is
+ * allowed, but not both.
+ */
+export declare const oasMutuallyExclusive: RulesetFunction<Record<string, unknown>, {
+    properties: string[];
+}>;

package/dist/rules/openapi/functions/oas-mutually-exclusive.js

@@ -0,0 +1,20 @@
+import { isObject } from './helpers.js';
+/**
+ * Flags objects that carry more than one of a set of mutually exclusive
+ * properties. OpenAPI 3.1's License Object, for example, defines `identifier`
+ * (SPDX) as "mutually exclusive of the url field" — neither, or exactly one, is
+ * allowed, but not both.
+ */
+export const oasMutuallyExclusive = (input, options, context) => {
+    if (!isObject(input))
+        return [];
+    const present = (options?.properties ?? []).filter((property) => input[property] !== undefined);
+    if (present.length <= 1)
+        return [];
+    // The first present property is the "anchor"; flag every later one as the conflict.
+    const [anchor, ...conflicts] = present;
+    return conflicts.map((property) => ({
+        message: `"${property}" must not be used together with "${anchor}" (mutually exclusive)`,
+        path: [...context.path, property],
+    }));
+};

package/dist/rules/openapi/functions/oas-no-nullable.d.ts

@@ -0,0 +1,13 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/**
+ * Flags a Schema Object's `nullable` keyword, removed in OpenAPI 3.1+ (JSON
+ * Schema 2020-12 uses a `"null"` type instead). Targets the *parent* of a
+ * `nullable` key (`$..nullable^`) rather than `$..nullable` directly, which fixes
+ * two problems with the naive `then: falsy` approach:
+ *   - a property literally named `nullable` (`properties: { nullable: {...} }`)
+ *     is no longer flagged, because there the `nullable` value is a Schema Object,
+ *     not the boolean keyword, and
+ *   - `nullable: false` is flagged too (a boolean of either value counts as the
+ *     keyword being present), so the migration fixer can drop it.
+ */
+export declare const oasNoNullable: RulesetFunction;

package/dist/rules/openapi/functions/oas-no-nullable.js

@@ -0,0 +1,22 @@
+import { isObject } from './helpers.js';
+/**
+ * Flags a Schema Object's `nullable` keyword, removed in OpenAPI 3.1+ (JSON
+ * Schema 2020-12 uses a `"null"` type instead). Targets the *parent* of a
+ * `nullable` key (`$..nullable^`) rather than `$..nullable` directly, which fixes
+ * two problems with the naive `then: falsy` approach:
+ *   - a property literally named `nullable` (`properties: { nullable: {...} }`)
+ *     is no longer flagged, because there the `nullable` value is a Schema Object,
+ *     not the boolean keyword, and
+ *   - `nullable: false` is flagged too (a boolean of either value counts as the
+ *     keyword being present), so the migration fixer can drop it.
+ */
+export const oasNoNullable = (parent, _options, context) => {
+    if (!isObject(parent) || typeof parent['nullable'] !== 'boolean')
+        return [];
+    return [
+        {
+            message: 'nullable is not available in OpenAPI 3.1 or later; use a "null" type instead.',
+            path: [...context.path, 'nullable'],
+        },
+    ];
+};

package/dist/rules/openapi/functions/oas-op-form-data-consume-check.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Validates OpenAPI v2 formData operations declare a compatible `consumes`. */
+export declare const oasOpFormDataConsumeCheck: RulesetFunction;

package/dist/rules/openapi/functions/oas-op-form-data-consume-check.js

@@ -0,0 +1,21 @@
+import { isObject } from './helpers.js';
+/** Validates OpenAPI v2 formData operations declare a compatible `consumes`. */
+export const oasOpFormDataConsumeCheck = (operation, _options, context) => {
+    if (!isObject(operation))
+        return [];
+    const params = Array.isArray(operation['parameters']) ? operation['parameters'] : [];
+    const hasFormData = params.some((param) => isObject(param) && param['in'] === 'formData');
+    if (!hasFormData)
+        return [];
+    const consumes = Array.isArray(operation['consumes']) ? operation['consumes'] : [];
+    const ok = consumes.some((type) => type === 'application/x-www-form-urlencoded' || type === 'multipart/form-data');
+    if (!ok) {
+        return [
+            {
+                message: 'Operations with formData parameters must consume application/x-www-form-urlencoded or multipart/form-data',
+                path: [...context.path, 'consumes'],
+            },
+        ];
+    }
+    return [];
+};

package/dist/rules/openapi/functions/oas-op-id-unique.d.ts

@@ -0,0 +1,3 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Ensures `operationId` values are unique across the document. */
+export declare const oasOpIdUnique: RulesetFunction;

package/dist/rules/openapi/functions/oas-op-id-unique.js

@@ -0,0 +1,29 @@
+import { isObject, OPERATION_METHODS } from './helpers.js';
+/** Ensures `operationId` values are unique across the document. */
+export const oasOpIdUnique = (paths, _options, context) => {
+    if (!isObject(paths))
+        return [];
+    const seen = new Set();
+    const results = [];
+    for (const [path, item] of Object.entries(paths)) {
+        if (!isObject(item))
+            continue;
+        for (const [method, operation] of Object.entries(item)) {
+            // Only real operations carry an `operationId`; an `x-`extension object with
+            // an `operationId`-looking key would otherwise create a phantom duplicate.
+            if (!OPERATION_METHODS.has(method) || !isObject(operation))
+                continue;
+            const id = operation['operationId'];
+            if (typeof id !== 'string')
+                continue;
+            if (seen.has(id)) {
+                results.push({
+                    message: `operationId "${id}" must be unique`,
+                    path: [...context.path, path, method, 'operationId'],
+                });
+            }
+            seen.add(id);
+        }
+    }
+    return results;
+};

package/dist/rules/openapi/functions/oas-op-params.d.ts

@@ -0,0 +1,9 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/**
+ * Validates an operation's `parameters` array, mirroring Spectral's `oasOpParams`:
+ * flags duplicate `name`+`in` combinations, and — for OpenAPI 2.0, where the body
+ * is a parameter — flags more than one `in: body` parameter (even with different
+ * names) as well as mixing `in: body` with `in: formData`. `$ref` entries are
+ * skipped because their real `name`/`in` is only known after resolution.
+ */
+export declare const oasOpParams: RulesetFunction;

package/dist/rules/openapi/functions/oas-op-params.js

@@ -0,0 +1,46 @@
+import { isObject } from './helpers.js';
+/**
+ * Validates an operation's `parameters` array, mirroring Spectral's `oasOpParams`:
+ * flags duplicate `name`+`in` combinations, and — for OpenAPI 2.0, where the body
+ * is a parameter — flags more than one `in: body` parameter (even with different
+ * names) as well as mixing `in: body` with `in: formData`. `$ref` entries are
+ * skipped because their real `name`/`in` is only known after resolution.
+ */
+export const oasOpParams = (params, _options, context) => {
+    if (!Array.isArray(params))
+        return [];
+    const results = [];
+    const seen = new Set();
+    const bodyIndices = [];
+    const formDataIndices = [];
+    params.forEach((param, index) => {
+        if (!isObject(param) || '$ref' in param)
+            return;
+        if (param['name'] !== undefined && param['in'] !== undefined) {
+            const key = `${String(param['in'])}:${String(param['name'])}`;
+            if (seen.has(key)) {
+                results.push({
+                    message: `Duplicate parameter "${String(param['name'])}" in "${String(param['in'])}"`,
+                    path: [...context.path, index],
+                });
+            }
+            seen.add(key);
+        }
+        if (param['in'] === 'body')
+            bodyIndices.push(index);
+        else if (param['in'] === 'formData')
+            formDataIndices.push(index);
+    });
+    // OAS2 allows at most one body parameter, and body and formData are mutually
+    // exclusive within a single operation.
+    if (bodyIndices.length > 0 && formDataIndices.length > 0) {
+        results.push({ message: 'Operation must not have both "in:body" and "in:formData" parameters' });
+    }
+    for (let i = 1; i < bodyIndices.length; i++) {
+        results.push({
+            message: 'Operation must not have more than a single instance of the "in:body" parameter',
+            path: [...context.path, bodyIndices[i]],
+        });
+    }
+    return results;
+};

package/dist/rules/openapi/functions/oas-op-security-defined.d.ts

@@ -0,0 +1,5 @@
+import type { RulesetFunction } from '../../../core/index.js';
+/** Validates that every referenced security scheme is defined. */
+export declare const oasOpSecurityDefined: RulesetFunction<Record<string, unknown>, {
+    schemesPath: string[];
+}>;