jamdesk 1.1.165 → 1.1.167

package/vendored/lib/openapi/validator.ts

@@ -11,6 +11,25 @@ import path from 'path';
 import type { OpenAPI } from 'openapi-types';
 import type { ValidationResult, OpenApiValidationError } from './types';
 import { formatOpenApiError, createFileNotFoundError } from './errors';
+import { patchOpenApiSchemasInMemory } from './patch-openapi-schemas-runtime';
+import { logger } from '../../shared/logger';
+
+/**
+ * The self-heal tripwire warn is per-process, not per-spec: validateOpenApiSpecs()
+ * loops over every spec in docs.json, and a schema that can't be verified once
+ * can't be verified for any of them — without this flag a project with N specs
+ * logs the identical warning N times.
+ */
+let selfHealWarned = false;
+
+function warnSelfHealOnce(): void {
+  if (selfHealWarned) return;
+  selfHealWarned = true;
+  logger.warn(
+    '[jamdesk] OpenAPI 3.1 meta-schema self-heal could not verify the expected schema shape; ' +
+      'validation may falsely reject server-variable descriptions or name-only licenses.'
+  );
+}
 
 /**
  * Detect OpenAPI version from a parsed spec
@@ -82,6 +101,15 @@ export async function validateOpenApiSpec(
   specPath: string,
   projectDir: string
 ): Promise<ValidationResult> {
+  // Self-heal the 3.1 meta-schema before every validation: postinstall may
+  // never have run (npm 12 blocks install scripts by default). Idempotent,
+  // O(1) after the first call. A false return = heal couldn't verify the
+  // schema shape — warn (once per process) so users don't hit the original
+  // opaque error blind.
+  if (!patchOpenApiSchemasInMemory()) {
+    warnSelfHealOnce();
+  }
+
   const isUrl = specPath.startsWith('http://') || specPath.startsWith('https://');
 
   let target: string;

package/vendored/next.config.js

@@ -47,10 +47,22 @@ const nextConfig = {
     ],
   },
   // Keep swagger-parser external (uses Node.js APIs).
+  // @apidevtools/openapi-schemas MUST stay external alongside it — the pairing
+  // is load-bearing, not cosmetic. patchOpenApiSchemasInMemory() heals the
+  // openapi-schemas module singleton that swagger-parser reads at validate()
+  // time; if one package is external and the other is bundled, Next produces
+  // TWO module instances and the self-heal patches a bundled duplicate,
+  // verifies THAT copy, and returns true while swagger-parser keeps reading
+  // the untouched node_modules copy — a silent no-op that reports success.
+  // Pinned by build-service/__tests__/next-config-external-packages.test.ts.
   // @terrastruct/d2 ships a WASM binary; keep it external so it loads from
   // node_modules at runtime instead of being bundled by Turbopack — the
   // same mitigation pattern used for the Shiki/oniguruma WASM landmine.
-  serverExternalPackages: ['@apidevtools/swagger-parser', '@terrastruct/d2'],
+  serverExternalPackages: [
+    '@apidevtools/swagger-parser',
+    '@apidevtools/openapi-schemas',
+    '@terrastruct/d2',
+  ],
   // Turbopack config - only resolveAlias, NOT root (root causes caching issues)
   turbopack: {
     resolveAlias: {

package/vendored/workspace-package-lock.json

@@ -6,7 +6,8 @@
     "": {
       "name": "jamdesk-workspace",
       "dependencies": {
-        "@apidevtools/swagger-parser": "^12.1.0",
+        "@apidevtools/openapi-schemas": "2.1.0",
+        "@apidevtools/swagger-parser": "12.1.0",
         "@babel/standalone": "^8.0.4",
         "@fortawesome/fontawesome-svg-core": "^7.1.0",
         "@fortawesome/free-brands-svg-icons": "^7.1.0",