@amritk/lint 0.4.7 → 0.5.0

package/dist/core/jsonpath.js

@@ -1,12 +1,27 @@
 import { createBoundedCache } from "./bounded-cache.js";
 import { compileFilter } from "./filter.js";
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const hasMember = (value, name) => Object.prototype.propertyIsEnumerable.call(value, name);
+const isDigits = (value) => {
+  const length = value.length;
+  if (length === 0)
+    return false;
+  for (let i = 0; i < length; i++) {
+    const code = value.charCodeAt(i);
+    if (code < 48 || code > 57)
+      return false;
+  }
+  return true;
+};
+const childSelector = (name) => ({
+  kind: "child",
+  name,
+  index: isDigits(name) ? Number(name) : void 0
+});
 const normalizeSegment = (segment) => {
   if (typeof segment === "number")
     return segment;
-  if (segment.length > 0 && /^\d+$/.test(segment))
-    return Number(segment);
-  return segment;
+  return isDigits(segment) ? Number(segment) : segment;
 };
 const normalizePath = (path) => path.map(normalizeSegment);
 const pathToJsonPathString = (path) => {
@@ -143,7 +158,7 @@ const bracketSelector = (content, onError) => {
   }
   if (names.length === 1) {
     const only = names[0];
-    return typeof only === "number" ? { kind: "index", index: only } : { kind: "child", name: only };
+    return typeof only === "number" ? { kind: "index", index: only } : childSelector(only);
   }
   return { kind: "union", names };
 };
@@ -214,7 +229,7 @@ const compileQuery = (expression) => {
         continue;
       }
       const { name, end } = readName(expression, i);
-      steps.push({ recursive, selector: { kind: "child", name } });
+      steps.push({ recursive, selector: childSelector(name) });
       recursive = false;
       i = end;
       continue;
@@ -252,7 +267,7 @@ const compileQuery = (expression) => {
     if (recursive) {
       const { name, end } = readName(expression, i);
       if (end > i) {
-        steps.push({ recursive: true, selector: { kind: "child", name } });
+        steps.push({ recursive: true, selector: childSelector(name) });
         recursive = false;
         i = end;
         continue;
@@ -285,10 +300,10 @@ const applySelector = (node, selector, root, out) => {
   switch (selector.kind) {
     case "child": {
       if (isObject(value)) {
-        if (Object.hasOwn(value, selector.name))
+        if (hasMember(value, selector.name))
           out.push({ value: value[selector.name], parent: node, key: selector.name });
-      } else if (Array.isArray(value) && /^\d+$/.test(selector.name)) {
-        const idx = Number(selector.name);
+      } else if (Array.isArray(value) && selector.index !== void 0) {
+        const idx = selector.index;
         if (idx < value.length)
           out.push({ value: value[idx], parent: node, key: idx });
       }
@@ -299,7 +314,7 @@ const applySelector = (node, selector, root, out) => {
         const idx = selector.index < 0 ? value.length + selector.index : selector.index;
         if (idx >= 0 && idx < value.length)
           out.push({ value: value[idx], parent: node, key: idx });
-      } else if (isObject(value) && Object.hasOwn(value, selector.index)) {
+      } else if (isObject(value) && hasMember(value, selector.index)) {
         out.push({ value: value[selector.index], parent: node, key: selector.index });
       }
       return;
@@ -322,7 +337,7 @@ const applySelector = (node, selector, root, out) => {
             if (idx >= 0 && idx < value.length)
               out.push({ value: value[idx], parent: node, key: idx });
           }
-        } else if (isObject(value) && Object.hasOwn(value, name)) {
+        } else if (isObject(value) && hasMember(value, name)) {
           out.push({ value: value[name], parent: node, key: name });
         }
       }
@@ -467,11 +482,7 @@ const queryMany = (data, compiled) => {
   if (recursive.length > 0) {
     const firsts = recursive.map((i) => compiled[i].steps[0]);
     const seeds = recursive.map(() => []);
-    const root = { value: data, parent: void 0, key: void 0 };
-    walkDescendants(root, (node) => {
-      for (let r = 0; r < recursive.length; r++)
-        applySelector(node, firsts[r].selector, data, seeds[r]);
-    });
+    seedDescents(data, firsts, seeds);
     for (let r = 0; r < recursive.length; r++) {
       const c = compiled[recursive[r]];
       out[recursive[r]] = toMatches(applySteps(data, seeds[r], c.steps.slice(1)));
@@ -479,6 +490,53 @@ const queryMany = (data, compiled) => {
   }
   return out;
 };
+const seedDescents = (data, firsts, seeds) => {
+  const byName = /* @__PURE__ */ new Map();
+  const numericChild = [];
+  const others = [];
+  for (let r = 0; r < firsts.length; r++) {
+    const selector = firsts[r].selector;
+    if (selector.kind !== "child") {
+      others.push(r);
+      continue;
+    }
+    const existing = byName.get(selector.name);
+    if (existing === void 0)
+      byName.set(selector.name, [r]);
+    else
+      existing.push(r);
+    if (selector.index !== void 0)
+      numericChild.push(r);
+  }
+  const stack = [{ value: data, parent: void 0, key: void 0 }];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    const value = current.value;
+    if (Array.isArray(value)) {
+      for (let idx = value.length - 1; idx >= 0; idx--)
+        stack.push({ value: value[idx], parent: current, key: idx });
+      for (const r of numericChild)
+        applySelector(current, firsts[r].selector, data, seeds[r]);
+    } else if (isObject(value)) {
+      const base = stack.length;
+      for (const key of Object.keys(value)) {
+        const child = { value: value[key], parent: current, key };
+        stack.push(child);
+        const interested = byName.get(key);
+        if (interested !== void 0)
+          for (const r of interested)
+            seeds[r].push(child);
+      }
+      for (let i = base, j = stack.length - 1; i < j; i++, j--) {
+        const held = stack[i];
+        stack[i] = stack[j];
+        stack[j] = held;
+      }
+    }
+    for (const r of others)
+      applySelector(current, firsts[r].selector, data, seeds[r]);
+  }
+};
 const query = (data, expression) => queryCompiled(data, compileQuery(expression));
 export {
   compileQuery,

package/dist/core/lint.d.ts

@@ -1,7 +1,7 @@
 import { type Document, type IDocumentOptions } from './document.js';
 import type { LintPlugin } from './plugin.js';
 import type { Ruleset } from './ruleset.js';
-import { type IDiagnostic, type ISourceSet } from './types.js';
+import type { IDiagnostic, ISourceSet } from './types.js';
 /**
  * What a {@link LintResolver} returns: the dereferenced tree, an optional source
  * set mapping inlined nodes back to their origin, and any diagnostics raised
@@ -20,6 +20,13 @@ export type LintResolverResult = {
  * example wrapping `@amritk/resolve-refs`). Returning no `sources` means
  * findings map back to the root document only; `diagnostics` reports refs that
  * failed to resolve.
+ *
+ * The `resolved` tree must be **acyclic**. Rules are evaluated by walking it, and
+ * the walk is depth-unbounded by design (document depth is attacker-controlled,
+ * so it keeps its own stack rather than recursing) — which means a cycle is an
+ * infinite loop, not a `RangeError`. Shared subtrees are fine and expected;
+ * `@amritk/resolve-refs` keeps the `$ref` node in place when a chain would close
+ * a cycle, which is what makes its output safe here.
  */
 export type LintResolver = (document: Document, context: {
     input: string;

package/dist/core/lint.js

@@ -1,29 +1,15 @@
 import { detectFormat } from "../parsers/index.js";
 import { createDocument } from "./document.js";
+import { bySourceThenPosition, withoutDuplicates } from "./order.js";
 import { runPlugins } from "./plugin.js";
 import { createLinter } from "./runner.js";
-import { DiagnosticSeverity } from "./types.js";
+import { severityFromName } from "./severity.js";
 const toParserSeverity = (value) => {
   if (value === void 0)
     return void 0;
   if (typeof value === "number")
     return value;
-  if (value === "off")
-    return "off";
-  const names = {
-    error: DiagnosticSeverity.Error,
-    warn: DiagnosticSeverity.Warning,
-    info: DiagnosticSeverity.Information,
-    hint: DiagnosticSeverity.Hint
-  };
-  return names[value];
-};
-const byPosition = (a, b) => {
-  const sa = a.source ?? "";
-  const sb = b.source ?? "";
-  if (sa !== sb)
-    return sa < sb ? -1 : 1;
-  return a.range.start.line - b.range.start.line || a.range.start.character - b.range.start.character;
+  return severityFromName(value);
 };
 const lintWithResult = async (input, options) => {
   const { ruleset, resolve, skip, plugins, ...documentOptions } = options;
@@ -59,7 +45,7 @@ const lintWithResult = async (input, options) => {
       result.source = document.source;
     return result;
   });
-  const diagnostics = [...parserResults, ...resolverDiagnostics, ...ruleResults].sort(byPosition);
+  const diagnostics = withoutDuplicates([...parserResults, ...resolverDiagnostics, ...ruleResults].sort(bySourceThenPosition));
   if (!plugins || plugins.length === 0)
     return { diagnostics, pluginData: {} };
   const format = documentOptions.format ?? detectFormat(input);

package/dist/core/order.d.ts

@@ -0,0 +1,30 @@
+import type { IDiagnostic } from './types.js';
+/**
+ * Orders findings by source, then line, then character.
+ *
+ * Sorting by position alone interleaves findings from different files once a run
+ * spans multiple sources; grouping by `source` first keeps each file's findings
+ * contiguous. The runner and the lint pipeline both sort — the runner over the
+ * rule results, the pipeline over those merged with parser and resolver
+ * diagnostics — and they have to agree, so they share this comparator rather
+ * than each carrying a copy.
+ */
+export declare const bySourceThenPosition: (a: IDiagnostic, b: IDiagnostic) => number;
+/**
+ * Drops findings that name the same problem at the same authored node: same
+ * rule, severity, message, path, range and source.
+ *
+ * A rule with `resolved: true` walks the dereferenced tree, where one reusable
+ * `components` entry appears once per `$ref` reaching it *and* once at its
+ * declaration. Each copy is reported against the authored node it came from (see
+ * `locate`), so the copies are identical in every field a reader sees — and the
+ * second and third tell them nothing the first did not.
+ *
+ * The `path` is part of the key, and load-bearing. Ranges alone do not identify
+ * a node: `getLocationForJsonPath` falls back to the closest existing ancestor,
+ * so findings about *absent* sibling fields — `info.contact` missing `name`,
+ * `url` and `email` — all carry the enclosing object's range. They are three
+ * distinct problems and keep three distinct paths, so they survive. An earlier
+ * version of this keyed on the range alone and collapsed them into one.
+ */
+export declare const withoutDuplicates: (diagnostics: readonly IDiagnostic[]) => IDiagnostic[];

package/dist/core/order.js

@@ -0,0 +1,36 @@
+const bySourceThenPosition = (a, b) => {
+  const sourceA = a.source ?? "";
+  const sourceB = b.source ?? "";
+  if (sourceA !== sourceB)
+    return sourceA < sourceB ? -1 : 1;
+  return a.range.start.line - b.range.start.line || a.range.start.character - b.range.start.character;
+};
+const withoutDuplicates = (diagnostics) => {
+  const seen = /* @__PURE__ */ new Set();
+  const kept = [];
+  for (const diagnostic of diagnostics) {
+    const { start, end } = diagnostic.range;
+    const key = [
+      diagnostic.source ?? "",
+      String(diagnostic.code),
+      diagnostic.severity,
+      start.line,
+      start.character,
+      end.line,
+      end.character,
+      // Segments are joined with a character a JSON key cannot contain
+      // unescaped, so `['a.b']` and `['a','b']` do not collide.
+      diagnostic.path.map(String).join("\0"),
+      diagnostic.message
+    ].join("
");
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    kept.push(diagnostic);
+  }
+  return kept;
+};
+export {
+  bySourceThenPosition,
+  withoutDuplicates
+};

package/dist/core/own-key.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Own-property reads and writes for maps keyed by names the ruleset or the
+ * linted document supplies.
+ *
+ * Those names are author-chosen, so `constructor`, `toString` and `__proto__`
+ * are all names someone may legitimately use — and a bare index answers them
+ * from `Object.prototype` while a bare assignment on `__proto__` sets the map's
+ * prototype instead of adding a key. Neither is ever what the caller meant.
+ *
+ * `@amritk/helpers` carries the same pair, but `@amritk/lint` depends on
+ * nothing beyond `@amritk/runtime-validators` and `@amritk/yaml` by design (see
+ * `.claude/architecture.md`), so it keeps its own. One copy inside the package,
+ * not one per call site.
+ */
+/** The value at `key`, or `undefined` when the map does not own that name. */
+export declare const ownKey: <T>(source: Readonly<Record<string, T>>, key: string) => T | undefined;
+/** Assigns `value` under `key` as an own data property, `__proto__` included. */
+export declare const setOwnKey: <T>(target: Record<string, T>, key: string, value: NoInfer<T>) => void;

package/dist/core/own-key.js

@@ -0,0 +1,12 @@
+const ownKey = (source, key) => Object.hasOwn(source, key) ? source[key] : void 0;
+const setOwnKey = (target, key, value) => {
+  if (key === "__proto__") {
+    Object.defineProperty(target, key, { value, writable: true, enumerable: true, configurable: true });
+  } else {
+    target[key] = value;
+  }
+};
+export {
+  ownKey,
+  setOwnKey
+};

package/dist/core/pointers.d.ts

@@ -6,7 +6,7 @@ export declare const pointerToPath: (pointer: string) => JsonPath | undefined;
  * equivalent path in the *original* source document, following internal `$ref`s.
  * This lets findings produced against the resolved tree resolve to the exact
  * line:column of the original `$ref` target. External refs stop the walk at the
- * `$ref` site.
+ * `$ref` site, and so does a segment written as a sibling of the `$ref`.
  */
 export declare const resolveSourcePath: (root: unknown, path: JsonPath) => JsonPath;
 /**
@@ -19,7 +19,8 @@ export declare const resolveSourcePath: (root: unknown, path: JsonPath) => JsonP
  *
  * The walk re-derives the resolver's traversal over the *unresolved* documents,
  * so a `$ref` whose target file is not in the registry (e.g. it failed to load)
- * stops the walk at the last known location rather than guessing. Prefer
+ * stops the walk at the last known location rather than guessing, and a segment
+ * written as a sibling of the `$ref` is read at the `$ref` site. Prefer
  * {@link resolveSourceOriginFromMap} when the resolver supplies an origin map —
  * it avoids re-deriving this traversal.
  */

package/dist/core/pointers.js

@@ -1,5 +1,6 @@
 import { dirname, resolve as resolvePath } from "node:path";
 const isContainer = (value) => typeof value === "object" && value !== null;
+const childOf = (node, segment) => Object.hasOwn(node, segment) ? node[segment] : void 0;
 const decodeSegment = (segment) => {
   let decoded = segment;
   try {
@@ -20,8 +21,13 @@ const isRemote = (location) => /^https?:\/\//i.test(location);
 const joinLocation = (base, ref) => {
   if (isRemote(ref))
     return ref;
-  if (isRemote(base))
-    return new URL(ref, base).href;
+  if (isRemote(base)) {
+    try {
+      return new URL(ref, base).href;
+    } catch {
+      return void 0;
+    }
+  }
   return resolvePath(dirname(base), ref);
 };
 const splitRef = (ref) => {
@@ -41,30 +47,31 @@ const getAtPath = (root, path) => {
   for (const segment of path) {
     if (!isContainer(node))
       return void 0;
-    node = node[segment];
+    node = childOf(node, segment);
   }
   return node;
 };
+const stepsThroughRef = (node, next) => isContainer(node) && !Array.isArray(node) && typeof node["$ref"] === "string" && (next === void 0 || !Object.hasOwn(node, next));
 const resolveSourcePath = (root, path) => {
   let originalPath = [];
   let node = root;
-  const followRefs = () => {
+  const followRefs = (next) => {
     let guard = 0;
-    while (isContainer(node) && !Array.isArray(node) && typeof node["$ref"] === "string" && guard++ < 100) {
-      const target = pointerToPath(node["$ref"]);
+    while (stepsThroughRef(node, next) && guard++ < 100) {
+      const target = pointerToPath(node.$ref);
       if (!target)
         return;
       originalPath = [...target];
       node = getAtPath(root, target);
     }
   };
-  followRefs();
-  for (const segment of path) {
+  followRefs(path[0]);
+  for (const [index, segment] of path.entries()) {
     if (!isContainer(node))
       break;
     originalPath.push(segment);
-    node = node[segment];
-    followRefs();
+    node = childOf(node, segment);
+    followRefs(path[index + 1]);
   }
   return originalPath;
 };
@@ -73,12 +80,14 @@ const resolveSourceOrigin = (registry, path) => {
   let root = registry.get(location)?.data;
   let originalPath = [];
   let node = root;
-  const followRefs = () => {
+  const followRefs = (next) => {
     let guard = 0;
-    while (isContainer(node) && !Array.isArray(node) && typeof node["$ref"] === "string" && guard++ < 1e3) {
-      const { filePart, fragment } = splitRef(node["$ref"]);
+    while (stepsThroughRef(node, next) && guard++ < 1e3) {
+      const { filePart, fragment } = splitRef(node.$ref);
       if (filePart !== "") {
         const target = joinLocation(location, filePart);
+        if (target === void 0)
+          return;
         const doc = registry.get(target);
         if (!doc)
           return;
@@ -89,13 +98,13 @@ const resolveSourceOrigin = (registry, path) => {
       node = getAtPath(root, originalPath);
     }
   };
-  followRefs();
-  for (const segment of path) {
+  followRefs(path[0]);
+  for (const [index, segment] of path.entries()) {
     if (!isContainer(node))
       break;
     originalPath.push(segment);
-    node = node[segment];
-    followRefs();
+    node = childOf(node, segment);
+    followRefs(path[index + 1]);
   }
   return { location, path: originalPath };
 };
@@ -106,7 +115,7 @@ const resolveSourceOriginFromMap = (resolved, origins, rootLocation, path) => {
   for (const segment of path) {
     if (!isContainer(node))
       break;
-    node = node[segment];
+    node = childOf(node, segment);
     const stamp = isContainer(node) ? origins.get(node) : void 0;
     if (stamp) {
       location = stamp.location;

package/dist/core/ruleset.js

@@ -1,19 +1,14 @@
 import { DiagnosticSeverity } from "../parsers/index.js";
 import { matchesGlob } from "./glob.js";
 import { compileQuery } from "./jsonpath.js";
-const SEVERITY_NAMES = {
-  error: DiagnosticSeverity.Error,
-  warn: DiagnosticSeverity.Warning,
-  info: DiagnosticSeverity.Information,
-  hint: DiagnosticSeverity.Hint,
-  off: "off"
-};
+import { ownKey, setOwnKey } from "./own-key.js";
+import { severityFromName } from "./severity.js";
 const parseSeverity = (value) => {
   if (value === void 0)
     return { severity: DiagnosticSeverity.Warning, enabled: true };
   if (typeof value === "number")
     return { severity: value, enabled: true };
-  const mapped = SEVERITY_NAMES[value];
+  const mapped = severityFromName(value);
   if (mapped === "off")
     return { severity: DiagnosticSeverity.Warning, enabled: false };
   if (mapped === void 0)
@@ -21,11 +16,42 @@ const parseSeverity = (value) => {
   return { severity: mapped, enabled: true };
 };
 const toArray = (value) => Array.isArray(value) ? value : [value];
+const isRuleDefinition = (entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry);
+const assertRuleEntry = (name, entry) => {
+  if (typeof entry === "boolean" || typeof entry === "number" || typeof entry === "string")
+    return;
+  if (isRuleDefinition(entry))
+    return;
+  const kind = entry === null ? "null" : Array.isArray(entry) ? "an array" : `\`${typeof entry}\``;
+  throw new Error(`Rule "${name}" must be a rule definition, a boolean, or a severity \u2014 got ${kind}`);
+};
+const assertFormats = (name, formats) => {
+  if (formats === void 0 || Array.isArray(formats))
+    return;
+  throw new Error(`Rule "${name}" has an invalid \`formats\`: expected an array of format names`);
+};
+const assertGiven = (name, given) => {
+  if (given.length === 0)
+    throw new Error(`Rule "${name}" is missing \`given\``);
+  for (const expression of given) {
+    if (typeof expression !== "string") {
+      const kind = expression === null ? "null" : `\`${typeof expression}\``;
+      throw new Error(`Rule "${name}" has an invalid \`given\`: expected a JSONPath string, got ${kind}`);
+    }
+    if (expression.startsWith("#"))
+      continue;
+    const compiled = compileQuery(expression);
+    if (compiled.error !== void 0) {
+      throw new Error(`Rule "${name}" has an invalid \`given\` "${expression}": ${compiled.error}`);
+    }
+  }
+};
 const normalizeRule = (name, def, modifier, declaring = {}) => {
   const { severity, enabled } = parseSeverity(def.severity);
   const recommended = def.recommended ?? true;
   const modifierEnabled = modifier === "off" ? false : modifier === "recommended" ? recommended : true;
   const formats = def.formats ?? declaring.formats;
+  assertFormats(name, formats);
   const documentationUrl = def.documentationUrl ?? (declaring.documentationUrl ? `${declaring.documentationUrl}#${name}` : void 0);
   return {
     name,
@@ -33,8 +59,11 @@ const normalizeRule = (name, def, modifier, declaring = {}) => {
     message: def.message,
     severity,
     enabled: enabled && modifierEnabled,
-    given: toArray(def.given),
-    then: toArray(def.then),
+    // `?? []` so a definition missing either field normalizes to "nothing to do"
+    // instead of a one-element `[undefined]` that blows up further downstream;
+    // `assertGiven` is what reports a missing `given` as the authoring error it is.
+    given: toArray(def.given ?? []),
+    then: toArray(def.then ?? []),
     formats: formats ? new Set(formats) : void 0,
     recommended,
     resolved: def.resolved ?? true,
@@ -42,6 +71,7 @@ const normalizeRule = (name, def, modifier, declaring = {}) => {
   };
 };
 const applyEntry = (rules, name, entry, throwOnMissing = false) => {
+  assertRuleEntry(name, entry);
   if (typeof entry === "boolean") {
     const existing = rules.get(name);
     if (existing)
@@ -50,7 +80,7 @@ const applyEntry = (rules, name, entry, throwOnMissing = false) => {
       throw new Error(`Cannot extend non-existing rule "${name}"`);
     return;
   }
-  if (typeof entry === "string") {
+  if (typeof entry === "string" || typeof entry === "number") {
     const existing = rules.get(name);
     if (!existing) {
       if (throwOnMissing)
@@ -65,19 +95,19 @@ const applyEntry = (rules, name, entry, throwOnMissing = false) => {
   rules.set(name, normalizeRule(name, entry, "all"));
 };
 const registerAlias = (ctx, declaringAliases, name, ruleName) => {
-  const alias = declaringAliases[name];
+  const alias = ownKey(declaringAliases, name);
   if (!alias)
     throw new Error(`Rule "${ruleName}" references undefined alias "#${name}"`);
-  const existing = ctx.aliases[name];
+  const existing = ownKey(ctx.aliases, name);
   if (existing === void 0 || existing === alias) {
-    ctx.aliases[name] = alias;
+    setOwnKey(ctx.aliases, name, alias);
     return name;
   }
   for (let n = 0; ; n++) {
     const key = `${name}__${n}`;
-    const at = ctx.aliases[key];
+    const at = ownKey(ctx.aliases, key);
     if (at === void 0 || at === alias) {
-      ctx.aliases[key] = alias;
+      setOwnKey(ctx.aliases, key, alias);
       return key;
     }
   }
@@ -101,6 +131,10 @@ const collectExtends = (extendsValue, defaultModifier, basePath, ctx) => {
     } else {
       target = entry;
     }
+    if (typeof target !== "string" && (typeof target !== "object" || target === null)) {
+      const kind = target === null ? "null" : `\`${typeof target}\``;
+      throw new Error(`An \`extends\` entry must be a ruleset object or a reference string \u2014 got ${kind}`);
+    }
     if (typeof target === "string") {
       const key = `${basePath}\0${target}`;
       if (ctx.seen.has(key))
@@ -131,7 +165,7 @@ const mergeInto = (definition, modifier, extendsModifier, basePath, ctx) => {
   };
   if (definition.rules) {
     for (const [name, entry] of Object.entries(definition.rules)) {
-      if (typeof entry === "object") {
+      if (isRuleDefinition(entry)) {
         const rule = normalizeRule(name, entry, modifier, declaring);
         rule.given = rewriteGiven(ctx, definition.aliases ?? {}, name, rule.given);
         ctx.into.set(name, rule);
@@ -150,9 +184,14 @@ const cloneRule = (rule) => ({
   formats: rule.formats ? new Set(rule.formats) : void 0
 });
 const createRuleset = (definition, options = {}) => {
+  if (typeof definition !== "object" || definition === null || Array.isArray(definition)) {
+    throw new Error("A ruleset must be an object");
+  }
   const functions = options.functions ?? {};
   const formats = options.formats ?? {};
   const overrides = definition.overrides ?? [];
+  if (!Array.isArray(overrides))
+    throw new Error("`overrides` must be an array");
   const ctx = {
     into: /* @__PURE__ */ new Map(),
     resolve: options.resolve,
@@ -167,18 +206,22 @@ const createRuleset = (definition, options = {}) => {
   mergeInto(definition, "all", "recommended", options.basePath ?? process.cwd(), ctx);
   const rules = [...ctx.into.values()];
   const aliases = ctx.aliases;
-  for (const rule of rules) {
-    for (const expression of rule.given) {
-      if (expression.startsWith("#"))
-        continue;
-      const compiled = compileQuery(expression);
-      if (compiled.error !== void 0) {
-        throw new Error(`Rule "${rule.name}" has an invalid \`given\` "${expression}": ${compiled.error}`);
-      }
+  for (const rule of rules)
+    assertGiven(rule.name, rule.given);
+  for (const [index, override] of overrides.entries()) {
+    if (!Array.isArray(override?.files)) {
+      throw new Error(`Override at index ${index} must have a \`files\` array of globs`);
+    }
+    if (!override.rules)
+      continue;
+    for (const [name, entry] of Object.entries(override.rules)) {
+      assertRuleEntry(name, entry);
+      if (isRuleDefinition(entry))
+        assertGiven(name, toArray(entry.given ?? []));
     }
   }
   const resolveAlias = (name, documentFormats) => {
-    const alias = aliases[name];
+    const alias = ownKey(aliases, name);
     if (!alias)
       return [];
     if (Array.isArray(alias))
@@ -199,7 +242,11 @@ const createRuleset = (definition, options = {}) => {
     overrides,
     parserOptions,
     enabledRules: rules.filter((rule) => rule.enabled),
-    getFunction: (name) => functions[name],
+    // `Object.hasOwn`, not a bare index: `then.function` is ruleset input, so
+    // `"toString"` otherwise resolved to `Function.prototype.toString` and ran
+    // as a rule function instead of being reported as unknown — its string
+    // return value then read as an iterable of per-character diagnostics.
+    getFunction: (name) => ownKey(functions, name),
     rulesForSource: (source) => {
       if (!source || !hasOverrides)
         return rules;