
Security News
Risky Biz Podcast: Making Reachability Analysis Work in Real-World Codebases
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
@basketry/ir
Advanced tools
This package defines the formal Basketry Intermediate Representation format.
View the human-readable documentation at basketry.io/docs/specification/v0.2.
The Basketry Intermediate Representation (IR) is the shared data model that connects all Basketry components. Every Basketry pipeline passes data in this format, making the IR the single source of truth for how services, methods, types, etc are represented. The IR is defined in an authoritative JSON Schema and serves as the foundation for the entire Basketry ecosystem.
Types can be imported from package:
import { Service } from '@basketry/ir';
function doSomething(service: Service): void {
// TODO: Do something with the service
}
For tooling that produces IR (like a Parser), you can use the validate method to ensure your IR conforms to the schema:
import { validate } from '@basketry/ir';
const ir: any = {
// TODO: Define a service object
};
// `service` will be a valid Service or `undefined`
// `errors` is an array of any errors
const { service, errors } = validate(ir);
The raw JSON Schema is also included in the package:
import schema from '@basketry/ir/lib/schema.json';
// TODO: Do something with the schema
The IR’s JSON Schema also serves as the source for the published specification at basketry.io/docs/specification/v0.2. This documentation is generated directly from the schema, ensuring it’s always in sync with the actual contract used by Basketry core and its components. Contributors updating the schema can automatically update the public-facing spec, making it a reliable reference for anyone building with or on top of Basketry.
Parsers are responsible for converting human-oriented service definition formats (like OpenAPI, JSON Schema, or other SDLs) into the Basketry IR. With the authoritative JSON Schema as a guide, parser authors can ensure their output matches the IR exactly, making it immediately compatible with any generator or rule in the ecosystem. This reduces the need for format-specific generators and encourages a healthy, shared tooling ecosystem.
Rules act as automated reviewers, inspecting the IR to enforce architectural, style, or compliance guidelines. By working against the IR, rules can be applied universally, regardless of the original service definition format. This allows organizations to maintain high standards across diverse APIs and tech stacks, with validation that’s both consistent and easy to maintain.
Generators take the IR as input and produce tangible outputs — code, documentation, SDKs, tests, or anything else that can be derived from a service definition. Because the IR is consistent and language-agnostic, generator authors can focus entirely on producing quality output without worrying about inconsistencies in the input.
npm ci
npx basketry
npm run build
Note that the lint
script is run prior to build
. Auto-fixable linting or formatting errors may be fixed by running npm run fix
.
.test.ts
suffixnpm t
/coverage/lcov-report/index.html
FAQs
Low-level Basketry IR components
The npm package @basketry/ir receives a total of 393 weekly downloads. As such, @basketry/ir popularity was classified as not popular.
We found that @basketry/ir demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.