What

Extracts the kin-openapi error → formatters.Finding mapping out of internal/validate.go into a new public validate package with one entry point:

package validate

// Validate validates the spec against the OpenAPI and JSON Schema rules
// and returns a flat list of findings.
func Validate(spec *openapi3.T, source string) formatters.Findings

This mirrors how diff.Get and checker.CheckBackwardCompatibility are publicly callable from any consumer; the validation logic now follows the same convention.

Why

oasdiff validate shipped in v1.16.0 (#894) but its kin-error → Finding mapping (rule IDs, severities, source locations, dedup-preferring-components, fingerprints) lives entirely in internal/validate.go. That locks ~800 lines of validation logic inside the CLI binary; anything else that wants the same structured output (oasdiff-service, third-party Go tools) has to either duplicate it or shell out to the CLI.

The immediate driver is oasdiff-service#200: the calculator at oasdiff.com/diff needs a /public/validate endpoint, and the cleanest way to wire that up is to call validate.Validate(spec, source) the same way the diff endpoint calls diff.Get(config, s1, s2). The longer-term driver is that any future Go consumer (a linter wrapper, an IDE extension, an enterprise pipeline tool) should be able to import oasdiff and call validate.Validate(...) without copying internals.

What moves vs stays

Moves to validate/validate.go (public):

• mapKinErrors, flattenKinErrors, dedupePreferringComponents
• severityForKinError, sectionForKinError, sectionFromField
• pathOperationForKinError, unwrapContext
• argsForKinError, lineForKinError, columnForKinError
• locationForKinError, fieldLoc
• ruleIDForKinError, joinFieldsForRuleID, ruleIDFromField
• unknownValidationID const

All helpers stay unexported in the new package; only Validate is the public surface.

Stays in internal/validate.go (CLI plumbing):

• getValidateCmd (cobra command + flag wiring)
• runValidate (load spec via flags, call validate.Validate, route through formatter)
• outputFindings (formatter lookup + render to stdout)

Behaviour is unchanged

All 471 lines of internal/validate_test.go exercise the full CLI command, not the internal helpers directly. They all pass against the lifted code without modification. No fixture changes, no output changes.

Full Go suite green:

ok  	github.com/oasdiff/oasdiff/checker
ok  	github.com/oasdiff/oasdiff/diff
ok  	github.com/oasdiff/oasdiff/internal
?   	github.com/oasdiff/oasdiff/validate   [no test files]
... (all others ok)

The new package has no tests of its own in this PR — the existing CLI tests cover every mapping path. Direct unit tests for validate.Validate(...) would be a useful follow-up but are not required for behaviour preservation.

Small incidental rename

internal/viper.go had a local helper named validate(IViper) that validated viper-loaded config values. The new package import would collide with that name (Go does not allow a package and a top-level identifier to share a name in the same file). Renamed it to validateViperConfig — descriptive of what it actually validates, no external API impact (it was a package-internal function).

What's next

• oasdiff-service#200: add /public/validate endpoint that calls validate.Validate(...) and returns findings as JSON. Will pin to a main pseudoversion of this PR.
• oasdiff/w3#227: add the calculator's fourth analysis mode (Validate). Depends on the service endpoint.

File count / line count

 3 files changed, 852 insertions(+), 815 deletions(-)
 create mode 100644 validate/validate.go

The +37 net is the public package's doc comment + one nil-spec guard in Validate (returns nil rather than panicking on a nil spec, since the public surface should be defensive).