fix: improve built-in decorator validation in config

[tatomyr]

What/Why/How?

• Added built-in decorators/preprocessors list. This should allow detecting wrong decorator names in the config.
• Differentiated built-in and custom rules when validating the config.
• Refactored types and e2e tests.

Check yourself

• This PR follows the contributing guide
• All new/updated code is covered by tests
• Core code changed? - Tested with other Redocly products (internal contributions only)
• New package installed? - Tested in different environments (browser/node)
• Documentation update has been considered

Security

• The security impact of the change has been considered
• Code follows company security practices and guidelines

---

Note

Medium Risk
Changes affect config schema/type resolution for rules, decorators, and preprocessors, which could alter validation outcomes for existing configs (especially around key recognition and error reporting). Coverage is improved via unit and e2e tests, reducing but not eliminating regression risk.

Overview
Config validation is enhanced to detect unknown built-in decorator/preprocessor keys by introducing explicit built-in decorator lists and schema node types (BuiltinDecorator/CustomDecorator and BuiltinPreprocessor/CustomPreprocessor) and using additionalProperties resolvers to reject invalid names.

Rule validation is refined to separate built-in vs plugin rules (BuiltinRule vs new CustomRule), and TypeScript types are updated so built-in decorator/preprocessor maps are keyed by known IDs (with preprocessors treated as decorator aliases). Tests and snapshots are updated/added to cover resolver behavior and new e2e config-lint scenarios.

^{Reviewed by Cursor Bugbot for commit 46f6d2b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 46f6d2b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@redocly/openapi-core	Patch
@redocly/cli	Patch
@redocly/respect-core	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	80.08% (🎯 80%)	7128 / 8900
🔵	Statements	79.49% (🎯 79%)	7407 / 9317
🔵	Functions	83.47% (🎯 83%)	1430 / 1713
🔵	Branches	71.56% (🎯 71%)	4821 / 6737

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
packages/core/src/oas-types.ts	100%	100%	100%	100%
packages/core/src/visitors.ts	92.94%	90.12%	90%	92.5%	557, 594, 597, 618, 650, 664
packages/core/src/decorators/oas2/index.ts	100%	100%	100%	100%
packages/core/src/decorators/oas3/index.ts	100%	100%	100%	100%
packages/core/src/types/redocly-yaml.ts	91.75%	83.01%	100%	91.48%	406, 438, 444, 487-494, 496, 641-646, 649-654, 657-662

Generated in workflow #9655 for commit 46f6d2b by the Vitest Coverage Report Action

[github-actions]

CLI Version	Mean Time ± Std Dev (s)	Relative Performance (Lower is Faster)
cli-latest	3.215s ± 0.027s	▓ 1.00x (Fastest)
cli-next	3.256s ± 0.015s	▓ 1.01x

[github-actions]

📦 A new experimental 🧪 version v0.0.0-snapshot.1777296698 of Redocly CLI has been published for testing.

Install with NPM:

npm install @redocly/cli@0.0.0-snapshot.1777296698
# or
npm install @redocly/openapi-core@0.0.0-snapshot.1777296698
# or
npm install @redocly/respect-core@0.0.0-snapshot.1777296698

⚠️ Note: This is a development build and may contain unstable features.

[tatomyr]

This test was incorrect (not testing what it meant to).

[tatomyr]

Redundant and pointing to an unexisting file.

[github-actions]

📦 A new experimental 🧪 version v0.0.0-snapshot.1777357717 of Redocly CLI has been published for testing.

Install with NPM:

npm install @redocly/cli@0.0.0-snapshot.1777357717
# or
npm install @redocly/openapi-core@0.0.0-snapshot.1777357717
# or
npm install @redocly/respect-core@0.0.0-snapshot.1777357717

⚠️ Note: This is a development build and may contain unstable features.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6702cb2. Configure here.}