@crewhaus/tool-schema 0.7.0 → 0.8.0

package/dist/lib/jsonschema.js

@@ -1,3 +1,4 @@
+import { checkFormat, isFormatName } from "./formats";
 /**
  * A JSON Schema Draft-07 validator, written out in full here so the package
  * has no runtime dependency and so its behaviour is auditable in one file.
@@ -49,11 +50,167 @@
  *   independently of the type.
  * - Errors stop accumulating at `maxErrors`, and the result says `truncated`.
  *
+ * ## A bounded amount of work, and "undetermined" when it runs out
+ *
+ * `anyOf`/`oneOf`/`allOf` over `$ref`s that share a target multiply: a
+ * 1.3 KB schema can ask for 2^30 subschema evaluations, and the walk is
+ * synchronous. Every subschema evaluation is counted against a budget. So
+ * is every check whose cost follows the value's size rather than the
+ * schema's — a string's length or pattern, uniqueItems, an object's keys,
+ * each enum candidate and each (key, patternProperties pattern) test, and
+ * each error message built — so a small schema cannot spend the value's
+ * size once per leaf. When the budget runs out the walk stops and the
+ * result is `undetermined`, with `valid: false` and the reason — never a
+ * verdict either way. A failing branch is summarised in a bounded message,
+ * and a message is built only when it will be kept.
+ *
+ * The default budget ({@link defaultWorkLimit}) follows what an honest walk
+ * can cost. A schema written out as a tree (no `$ref` reached twice at one
+ * place) evaluates each of its subschemas at most once per value node, so a
+ * value node is allowed as many units as the schema has subschemas (at
+ * least {@link WORK_PER_VALUE_NODE}, at most {@link MAX_SCHEMA_FANOUT}); a
+ * wide or nested union over thousands of valid rows is answered. Only
+ * repeating a `$ref` at one place goes past that, which is the shape that
+ * multiplies. The floor is {@link DEFAULT_MAX_WORK} and the ceiling
+ * {@link MAX_DEFAULT_WORK}, a few seconds of the worst schemas measured.
+ *
+ * ## Depth is the value's
+ *
+ * A recursive schema walks as deep as the value does, so nesting is counted
+ * where the value nests — into an item or a property — not per `$ref` or
+ * branch. A value deeper than {@link MAX_VALUE_DEPTH}, or a schema and value
+ * nesting past {@link MAX_NESTING} walk frames together, is `undetermined`:
+ * the part not walked may be valid or not. A `$ref` that reaches itself at
+ * one position with nothing consumed between is a cycle, and an error.
+ *
  * `pattern` is an unanchored ECMA-262 match, per the spec — `"pattern": "a"`
  * matches `"banana"`.
  */
-import { checkFormat, isFormatName } from "./formats";
-import { canonicalize, deepEqual, isPlainObject, joinPointer, matchesType, parsePointer, preview, resolveSegments, typeOf, } from "./value";
+import { runPatternSync, screenCallerPattern, } from "./regex-answers";
+import { canonicalize, isPlainObject, joinPointer, matchesType, parsePointer, preview as previewValue, resolveSegments, typeOf, } from "./value";
+/** The budget floor: about a third of a second of the worst schemas measured (Apple silicon). */
+export const DEFAULT_MAX_WORK = 500_000;
+/**
+ * The least work allowed per unit of the value's weight, so a large document
+ * is not refused for its size. A schema with more subschemas than this is
+ * allowed its subschema count instead.
+ */
+export const WORK_PER_VALUE_NODE = 64;
+/** The most work per unit of weight a schema's size earns. */
+export const MAX_SCHEMA_FANOUT = 1_024;
+/**
+ * The most work a default budget allows, however large the value: about
+ * seven seconds of the worst schemas measured (Apple silicon, 0.3-0.5 us a
+ * unit). The walk is synchronous, so this is how long one call can hold the
+ * harness's thread.
+ */
+export const MAX_DEFAULT_WORK = 20_000_000;
+/** Characters of a string (or key) that weigh, and cost, one unit. */
+const CHARS_PER_UNIT = 256;
+/** Keys or items that cost one unit to list or compare. */
+const MEMBERS_PER_UNIT = 16;
+/** Nodes in a JSON value (itself included), counted iteratively, stopping at `cap`. */
+export function countValueNodes(value, cap = Number.MAX_SAFE_INTEGER) {
+    let count = 0;
+    const stack = [value];
+    while (stack.length > 0 && count < cap) {
+        const node = stack.pop();
+        count++;
+        if (Array.isArray(node))
+            for (const item of node)
+                stack.push(item);
+        else if (isPlainObject(node))
+            for (const key of Object.keys(node))
+                stack.push(node[key]);
+    }
+    return count;
+}
+/**
+ * A value's weight: one per node, and one more per CHARS_PER_UNIT
+ * characters of each string and key — the size the size-bound checks are
+ * charged in, so the budget grows with the value in the same units.
+ */
+export function valueWeight(value) {
+    let weight = 0;
+    const stack = [value];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        weight += 1;
+        if (typeof node === "string")
+            weight += Math.floor(node.length / CHARS_PER_UNIT);
+        else if (Array.isArray(node))
+            for (const item of node)
+                stack.push(item);
+        else if (isPlainObject(node)) {
+            for (const key of Object.keys(node)) {
+                weight += Math.floor(key.length / CHARS_PER_UNIT);
+                stack.push(node[key]);
+            }
+        }
+    }
+    return weight;
+}
+/**
+ * Subschemas in `schema` written out as a tree, `$ref`s not followed, up to
+ * `cap`: what one value node can honestly be checked against. Counted
+ * iteratively, since a schema may nest deeper than the stack.
+ */
+export function schemaFanout(schema, cap = MAX_SCHEMA_FANOUT) {
+    let count = 0;
+    const stack = [schema];
+    while (stack.length > 0 && count < cap) {
+        const node = stack.pop();
+        if (typeof node === "boolean") {
+            count += 1;
+            continue;
+        }
+        if (!isPlainObject(node))
+            continue;
+        count += 1;
+        for (const keyword of ["properties", "patternProperties", "$defs", "definitions"]) {
+            const map = node[keyword];
+            if (isPlainObject(map))
+                for (const key of Object.keys(map))
+                    stack.push(map[key]);
+        }
+        for (const keyword of ["allOf", "anyOf", "oneOf"]) {
+            const list = node[keyword];
+            if (Array.isArray(list))
+                for (const branch of list)
+                    stack.push(branch);
+        }
+        const items = node["items"];
+        if (Array.isArray(items))
+            for (const item of items)
+                stack.push(item);
+        else if (items !== undefined)
+            stack.push(items);
+        for (const keyword of [
+            "additionalItems",
+            "additionalProperties",
+            "contains",
+            "propertyNames",
+            "not",
+            "if",
+            "then",
+            "else",
+        ]) {
+            if (node[keyword] !== undefined)
+                stack.push(node[keyword]);
+        }
+    }
+    return Math.min(count, cap);
+}
+/**
+ * The default budget for validating `value` against `schema`: the value's
+ * weight times what the schema allows per unit of it, between
+ * DEFAULT_MAX_WORK and MAX_DEFAULT_WORK.
+ */
+export function defaultWorkLimit(value, schema) {
+    const perUnit = Math.max(WORK_PER_VALUE_NODE, schema === undefined ? 0 : schemaFanout(schema, MAX_SCHEMA_FANOUT));
+    const weighted = valueWeight(value) * perUnit;
+    return Math.max(DEFAULT_MAX_WORK, Math.min(weighted, MAX_DEFAULT_WORK));
+}
 /** Keywords that constrain a value and are implemented here. */
 const SUPPORTED = new Set([
     "type",
@@ -107,30 +264,214 @@ const ANNOTATIONS = new Set([
     "$defs",
     "definitions",
 ]);
+/** Deepest value the walk follows; past it the answer is undetermined. */
+export const MAX_VALUE_DEPTH = 512;
+/**
+ * Most walk frames (a subschema evaluation inside another) at once, value
+ * and schema nesting together; past it the answer is undetermined. It keeps
+ * a deeply nested schema from overflowing the stack.
+ */
+export const MAX_NESTING = 2_048;
+/** How deep `checkSchemaShape` descends; it only guards a hand-built cyclic object. */
+const MAX_SHAPE_DEPTH = 100;
+/** Thrown when the work budget runs out; caught only in `validateValue`. */
+class WorkExhausted extends Error {
+}
+/** Thrown when the walk cannot reach a verdict for another reason; caught only in `validateValue`. */
+class Undetermined extends Error {
+}
+/** Where in the whole value `path` is, for a message. */
+function where(ctx, path) {
+    const absolute = `${ctx.refBase}${path}`;
+    return absolute === "" ? "the top" : clip(absolute, 120);
+}
+/** Spend `units` of the budget, stopping the walk once it is gone. */
+function charge(ctx, units) {
+    ctx.work.used += units;
+    if (ctx.work.used > ctx.work.limit)
+        throw new WorkExhausted();
+}
+/** A bounded preview, reusing the walk's renderings of the value's objects. */
+function preview(ctx, value, maxChars) {
+    return previewValue(value, maxChars, ctx.previews);
+}
+/** Longest message one error carries; nested branch reasons are cut here. */
+export const MAX_MESSAGE_CHARS = 1_000;
+/** The shortest a branch's reason is cut to before later branches are dropped instead. */
+const MIN_REASON_CHARS = 48;
+function clip(text, max) {
+    return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
 /**
- * Depth ceiling for the walk. It guards a schema that references itself
- * through a value that never shrinks, and it also stops a value nested past
- * this many levels — both are counted, so the message names either cause.
+ * Record a failure. The message is built only when it will be kept: past
+ * `maxErrors` a failure costs nothing to report, and one that is kept is
+ * charged for the text it builds.
  */
-const MAX_DEPTH = 100;
 function fail(ctx, path, keyword, schemaPath, message) {
     if (ctx.errors.length >= ctx.opts.maxErrors) {
         ctx.truncated = true;
         return false;
     }
-    ctx.errors.push({ path, keyword, message, schemaPath });
+    const text = clip(typeof message === "string" ? message : message(), MAX_MESSAGE_CHARS);
+    charge(ctx, 1 + Math.floor(text.length / 512));
+    ctx.errors.push({ path, keyword, message: text, schemaPath });
+    return false;
+}
+/** Code points in `text`, counted without building an array of them. */
+function codePointLength(text) {
+    let length = text.length;
+    for (let i = 0; i < text.length - 1; i++) {
+        const unit = text.charCodeAt(i);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = text.charCodeAt(i + 1);
+            if (next >= 0xdc00 && next <= 0xdfff) {
+                length -= 1;
+                i += 1;
+            }
+        }
+    }
+    return length;
+}
+/**
+ * `deepEqual`, charged for what it reads: listing an object's keys and
+ * comparing long strings cost the value's size, not the schema's.
+ */
+function sameJson(a, b, ctx) {
+    if (typeof a === "string" && typeof b === "string") {
+        charge(ctx, Math.floor(Math.min(a.length, b.length) / CHARS_PER_UNIT));
+        return a === b;
+    }
+    if (a === b)
+        return true;
+    if (typeof a !== typeof b)
+        return false;
+    if (Array.isArray(a) || Array.isArray(b)) {
+        if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+            return false;
+        charge(ctx, Math.floor(a.length / MEMBERS_PER_UNIT));
+        for (let i = 0; i < a.length; i++)
+            if (!sameJson(a[i], b[i], ctx))
+                return false;
+        return true;
+    }
+    if (isPlainObject(a) && isPlainObject(b)) {
+        const aKeys = Object.keys(a);
+        const bKeys = Object.keys(b);
+        charge(ctx, Math.floor((aKeys.length + bKeys.length) / MEMBERS_PER_UNIT));
+        if (aKeys.length !== bKeys.length)
+            return false;
+        return aKeys.every((k) => Object.hasOwn(b, k) && sameJson(a[k], b[k], ctx));
+    }
     return false;
 }
+const enumIndexes = new WeakMap();
+function enumIndex(candidates, ctx) {
+    const known = enumIndexes.get(candidates);
+    if (known !== undefined)
+        return known;
+    charge(ctx, 1 + Math.floor(candidates.length / MEMBERS_PER_UNIT));
+    const primitives = new Set();
+    const others = [];
+    for (const candidate of candidates) {
+        if (candidate === null || typeof candidate !== "object") {
+            if (typeof candidate === "string") {
+                charge(ctx, Math.floor(candidate.length / CHARS_PER_UNIT));
+            }
+            primitives.add(candidate);
+        }
+        else
+            others.push(candidate);
+    }
+    const index = { primitives, others };
+    enumIndexes.set(candidates, index);
+    return index;
+}
+/** `sameJson(candidate, value)` for some candidate, charged for what it compares. */
+function inEnum(candidates, value, ctx) {
+    const index = enumIndex(candidates, ctx);
+    if (value === null || typeof value !== "object") {
+        // Hashing a string reads it; everything else is one lookup. A primitive
+        // equals only a primitive, and a Set's equality is sameJson's for JSON.
+        if (typeof value === "string")
+            charge(ctx, Math.floor(value.length / CHARS_PER_UNIT));
+        return index.primitives.has(value);
+    }
+    charge(ctx, Math.floor(index.others.length / MEMBERS_PER_UNIT));
+    return index.others.some((candidate) => sameJson(candidate, value, ctx));
+}
+const compiledPatterns = new WeakMap();
+function patternsOf(map, ctx) {
+    const known = compiledPatterns.get(map);
+    if (known !== undefined)
+        return known;
+    const valid = [];
+    const invalid = [];
+    for (const source of Object.keys(map)) {
+        charge(ctx, 1 + Math.floor(source.length / CHARS_PER_UNIT));
+        try {
+            // Compiling reads only the pattern; the match is what is not run here.
+            new RegExp(source);
+            valid.push({ source });
+        }
+        catch (err) {
+            invalid.push({ source, error: err.message });
+        }
+    }
+    const out = { valid, invalid };
+    compiledPatterns.set(map, out);
+    return out;
+}
+/**
+ * Does the schema's `pattern` (or a `patternProperties` key) match `input`?
+ * The pattern is the caller's, so it is never run here: the answer comes
+ * from `ctx.regex`, resolved in the worker, or from the bounded fallback
+ * when there is none. A pattern that could not be run to an answer, or that
+ * the screen refuses as a shape that backtracks exponentially, leaves the
+ * whole result undetermined: the validator reports no verdict rather than
+ * "invalid" (or "valid"). A question not answered yet reads as "no match"
+ * for this pass; the caller runs the walk again once it is answered.
+ */
+function patternMatches(ctx, pattern, input, where, compiled) {
+    // The read is charged by the caller: validateString per string, and
+    // validateObject per (key, pattern) test.
+    let answer;
+    if (ctx.regex !== undefined) {
+        answer = ctx.regex.lookup(pattern, "", input);
+    }
+    else {
+        let screened = compiled?.screened;
+        if (screened === undefined) {
+            screened = screenCallerPattern(pattern, "");
+            if (compiled !== undefined)
+                compiled.screened = screened;
+        }
+        answer = screened.ok ? runPatternSync(screened.regex, input) : screened.answer;
+    }
+    if (answer === undefined)
+        return false;
+    if (typeof answer === "boolean")
+        return answer;
+    const shown = pattern.length > 80 ? `${pattern.slice(0, 79)}…` : pattern;
+    if ("refused" in answer) {
+        throw new Undetermined(`the schema's pattern /${shown}/ at ${where} was not run: ${answer.refused}, so no verdict was reached`);
+    }
+    throw new Undetermined(`the schema's pattern /${shown}/ at ${where} could not be run to an answer: ${answer.undetermined}, so no verdict was reached`);
+}
 /** Does `schema` reject `value`? Runs in a scratch context so no errors leak. */
-function branchErrors(value, schema, ctx, schemaPath) {
+function branchErrors(value, schema, ctx, path, schemaPath) {
     const scratch = {
         root: ctx.root,
         opts: { assertFormat: ctx.opts.assertFormat, maxErrors: 20 },
         errors: [],
         truncated: false,
         unsupported: ctx.unsupported,
-        refStack: ctx.refStack,
-        depth: ctx.depth,
+        refs: ctx.refs,
+        refBase: `${ctx.refBase}${path}`,
+        valueDepth: ctx.valueDepth,
+        nesting: ctx.nesting,
+        work: ctx.work,
+        previews: ctx.previews,
+        regex: ctx.regex,
     };
     validateNode(value, schema, "", schemaPath, scratch);
     return scratch.errors;
@@ -142,6 +483,45 @@ function summarizeBranch(errors) {
     const where = first.path === "" ? "" : ` at ${first.path}`;
     return `${first.message}${where}`;
 }
+/**
+ * The reasons of every failing alternative, joined, within MAX_MESSAGE_CHARS.
+ *
+ * When they do not all fit, each is cut to an equal share rather than the
+ * last ones dropped, and a reason shorter than its share keeps all of it. A
+ * nested union's reason is itself a joined list whose decisive entry is
+ * often last: cutting every branch to a fixed 200 characters took
+ * `property "chanel_fallback" is not allowed` off the end of the only reason
+ * that named the mistake. Past MIN_REASON_CHARS a share, later branches are
+ * counted instead of shown.
+ */
+function joinReasons(reasons) {
+    const room = MAX_MESSAGE_CHARS - 80;
+    const separators = 2 * Math.max(0, reasons.length - 1);
+    let total = separators;
+    for (const reason of reasons)
+        total += reason.length;
+    if (total <= room)
+        return reasons.join("; ");
+    // How many fit at the shortest share, and the share they each get.
+    const shown = Math.max(1, Math.min(reasons.length, Math.floor((room + 2) / (MIN_REASON_CHARS + 2))));
+    const kept = reasons.slice(0, shown);
+    // Water-fill: short reasons keep their length, the rest share what is left.
+    let left = room - 2 * (kept.length - 1);
+    const sorted = kept.map((r) => r.length).sort((a, b) => a - b);
+    let share = Math.floor(left / kept.length);
+    for (let i = 0; i < sorted.length; i++) {
+        const length = sorted[i];
+        const fair = Math.floor(left / (sorted.length - i));
+        if (length <= fair) {
+            left -= length;
+            continue;
+        }
+        share = fair;
+        break;
+    }
+    const out = kept.map((r) => clip(r, Math.max(share, MIN_REASON_CHARS))).join("; ");
+    return shown < reasons.length ? `${out} … (+${reasons.length - shown} more)` : out;
+}
 function validateNumber(value, schema, path, sp, ctx) {
     const { minimum, maximum, exclusiveMinimum, exclusiveMaximum, multipleOf } = schema;
     if (typeof minimum === "number" && value < minimum) {
@@ -174,9 +554,15 @@ function validateNumber(value, schema, path, sp, ctx) {
 }
 function validateString(value, schema, path, sp, ctx) {
     const { minLength, maxLength, pattern, format } = schema;
+    const checksLength = typeof minLength === "number" || typeof maxLength === "number";
+    const checksFormat = typeof format === "string" && ctx.opts.assertFormat;
+    // Each of these reads the whole string, so each is charged for its length.
+    const reads = (checksLength ? 1 : 0) + (typeof pattern === "string" ? 1 : 0) + (checksFormat ? 1 : 0);
+    if (reads > 0)
+        charge(ctx, reads * Math.floor(value.length / CHARS_PER_UNIT));
     // Length is counted in code points, as the spec requires, so an emoji
     // counts as one character rather than as its two UTF-16 units.
-    const length = [...value].length;
+    const length = checksLength ? codePointLength(value) : 0;
     if (typeof minLength === "number" && length < minLength) {
         fail(ctx, path, "minLength", joinPointer(sp, "minLength"), `length ${length} is under the minimum of ${minLength}`);
     }
@@ -184,15 +570,17 @@ function validateString(value, schema, path, sp, ctx) {
         fail(ctx, path, "maxLength", joinPointer(sp, "maxLength"), `length ${length} is over the maximum of ${maxLength}`);
     }
     if (typeof pattern === "string") {
-        let re = null;
+        let valid = true;
         try {
-            re = new RegExp(pattern);
+            // Compiling reads only the pattern; the match is what is not run here.
+            new RegExp(pattern);
         }
         catch (err) {
+            valid = false;
             fail(ctx, path, "pattern", joinPointer(sp, "pattern"), `the schema's pattern is not a valid regular expression: ${err.message}`);
         }
-        if (re !== null && !re.test(value)) {
-            fail(ctx, path, "pattern", joinPointer(sp, "pattern"), `${preview(value, 60)} does not match /${pattern}/`);
+        if (valid && !patternMatches(ctx, pattern, value, joinPointer(sp, "pattern"))) {
+            fail(ctx, path, "pattern", joinPointer(sp, "pattern"), () => `${preview(ctx, value, 60)} does not match /${pattern}/`);
         }
     }
     if (typeof format === "string" && ctx.opts.assertFormat) {
@@ -202,7 +590,7 @@ function validateString(value, schema, path, sp, ctx) {
         else {
             const result = checkFormat(value, format);
             if (!result.valid) {
-                fail(ctx, path, "format", joinPointer(sp, "format"), `${preview(value, 60)} is not a valid ${format}: ${result.reason}`);
+                fail(ctx, path, "format", joinPointer(sp, "format"), () => `${preview(ctx, value, 60)} is not a valid ${format}: ${result.reason}`);
             }
         }
     }
@@ -219,14 +607,17 @@ function validateArray(value, schema, path, sp, ctx) {
         const seen = new Map();
         for (let i = 0; i < value.length; i++) {
             const key = canonicalize(value[i]);
+            // An item's canonical form is as long as the item: charged per item.
+            charge(ctx, 1 + Math.floor(key.length / CHARS_PER_UNIT));
             const previous = seen.get(key);
             if (previous !== undefined) {
-                fail(ctx, path, "uniqueItems", joinPointer(sp, "uniqueItems"), `items ${previous} and ${i} are equal (${preview(value[i], 60)})`);
+                fail(ctx, path, "uniqueItems", joinPointer(sp, "uniqueItems"), () => `items ${previous} and ${i} are equal (${preview(ctx, value[i], 60)})`);
                 break;
             }
             seen.set(key, i);
         }
     }
+    ctx.valueDepth += 1;
     if (Array.isArray(items)) {
         // Tuple form: schema i applies to item i; the rest fall to additionalItems.
         for (let i = 0; i < value.length; i++) {
@@ -251,15 +642,20 @@ function validateArray(value, schema, path, sp, ctx) {
         }
     }
     if (contains !== undefined) {
-        const matched = value.some((item) => branchErrors(item, contains, ctx, joinPointer(sp, "contains")).length === 0);
+        const matched = value.some((item, i) => branchErrors(item, contains, ctx, joinPointer(path, i), joinPointer(sp, "contains")).length === 0);
         if (!matched) {
+            ctx.valueDepth -= 1;
             fail(ctx, path, "contains", joinPointer(sp, "contains"), "no item matches the contains schema");
+            return;
         }
     }
+    ctx.valueDepth -= 1;
 }
 function validateObject(value, schema, path, sp, ctx) {
     const { properties, patternProperties, additionalProperties, propertyNames, required, minProperties, maxProperties, } = schema;
     const keys = Object.keys(value);
+    // Listing the keys, and the loop over them below, cost the object's size.
+    charge(ctx, Math.floor(keys.length / MEMBERS_PER_UNIT));
     if (Array.isArray(required)) {
         for (const key of required) {
             if (typeof key === "string" && !Object.hasOwn(value, key)) {
@@ -273,23 +669,21 @@ function validateObject(value, schema, path, sp, ctx) {
     if (typeof maxProperties === "number" && keys.length > maxProperties) {
         fail(ctx, path, "maxProperties", joinPointer(sp, "maxProperties"), `${keys.length} properties, more than ${maxProperties}`);
     }
+    ctx.valueDepth += 1;
     if (propertyNames !== undefined) {
         for (const key of keys) {
-            const errors = branchErrors(key, propertyNames, ctx, joinPointer(sp, "propertyNames"));
+            const errors = branchErrors(key, propertyNames, ctx, joinPointer(path, key), joinPointer(sp, "propertyNames"));
             if (errors.length > 0) {
                 fail(ctx, joinPointer(path, key), "propertyNames", joinPointer(sp, "propertyNames"), `property name "${key}" is not allowed: ${summarizeBranch(errors)}`);
             }
         }
     }
-    const patterns = [];
+    let patterns = [];
     if (isPlainObject(patternProperties)) {
-        for (const source of Object.keys(patternProperties)) {
-            try {
-                patterns.push([source, new RegExp(source)]);
-            }
-            catch (err) {
-                fail(ctx, path, "patternProperties", joinPointer(joinPointer(sp, "patternProperties"), source), `the schema's pattern is not a valid regular expression: ${err.message}`);
-            }
+        const compiled = patternsOf(patternProperties, ctx);
+        patterns = compiled.valid;
+        for (const bad of compiled.invalid) {
+            fail(ctx, path, "patternProperties", joinPointer(joinPointer(sp, "patternProperties"), bad.source), `the schema's pattern is not a valid regular expression: ${bad.error}`);
         }
     }
     for (const key of keys) {
@@ -298,8 +692,15 @@ function validateObject(value, schema, path, sp, ctx) {
             covered = true;
             validateNode(value[key], properties[key], joinPointer(path, key), joinPointer(joinPointer(sp, "properties"), key), ctx);
         }
-        for (const [source, re] of patterns) {
-            if (!re.test(key))
+        // Every (key, pattern) test is charged: 8,000 keys under 8,000 patterns
+        // ran 64 million tests for 11 s and then answered valid.
+        if (patterns.length > 0) {
+            charge(ctx, patterns.length * (1 + Math.floor(key.length / CHARS_PER_UNIT)));
+        }
+        for (const compiled of patterns) {
+            const source = compiled.source;
+            const at = joinPointer(joinPointer(sp, "patternProperties"), source);
+            if (!patternMatches(ctx, source, key, at, compiled))
                 continue;
             covered = true;
             validateNode(value[key], patternProperties[source], joinPointer(path, key), joinPointer(joinPointer(sp, "patternProperties"), source), ctx);
@@ -314,6 +715,7 @@ function validateObject(value, schema, path, sp, ctx) {
             validateNode(value[key], additionalProperties, joinPointer(path, key), joinPointer(sp, "additionalProperties"), ctx);
         }
     }
+    ctx.valueDepth -= 1;
 }
 function validateLogic(value, schema, path, sp, ctx) {
     const { allOf, anyOf, oneOf, not } = schema;
@@ -326,40 +728,40 @@ function validateLogic(value, schema, path, sp, ctx) {
         const reasons = [];
         let anyPassed = false;
         for (let i = 0; i < anyOf.length && !anyPassed; i++) {
-            const errors = branchErrors(value, anyOf[i], ctx, joinPointer(joinPointer(sp, "anyOf"), i));
+            const errors = branchErrors(value, anyOf[i], ctx, path, joinPointer(joinPointer(sp, "anyOf"), i));
             if (errors.length === 0)
                 anyPassed = true;
             else
                 reasons.push(`[${i}] ${summarizeBranch(errors)}`);
         }
         if (!anyPassed) {
-            fail(ctx, path, "anyOf", joinPointer(sp, "anyOf"), `matched none of the ${anyOf.length} alternatives — ${reasons.join("; ")}`);
+            fail(ctx, path, "anyOf", joinPointer(sp, "anyOf"), `matched none of the ${anyOf.length} alternatives — ${joinReasons(reasons)}`);
         }
     }
     if (Array.isArray(oneOf)) {
         const passing = [];
         const reasons = [];
         for (let i = 0; i < oneOf.length; i++) {
-            const errors = branchErrors(value, oneOf[i], ctx, joinPointer(joinPointer(sp, "oneOf"), i));
+            const errors = branchErrors(value, oneOf[i], ctx, path, joinPointer(joinPointer(sp, "oneOf"), i));
             if (errors.length === 0)
                 passing.push(i);
             else
                 reasons.push(`[${i}] ${summarizeBranch(errors)}`);
         }
         if (passing.length === 0) {
-            fail(ctx, path, "oneOf", joinPointer(sp, "oneOf"), `matched none of the ${oneOf.length} alternatives — ${reasons.join("; ")}`);
+            fail(ctx, path, "oneOf", joinPointer(sp, "oneOf"), `matched none of the ${oneOf.length} alternatives — ${joinReasons(reasons)}`);
         }
         else if (passing.length > 1) {
             fail(ctx, path, "oneOf", joinPointer(sp, "oneOf"), `matched ${passing.length} alternatives (${passing.join(", ")}) but oneOf allows exactly one`);
         }
     }
     if (not !== undefined) {
-        if (branchErrors(value, not, ctx, joinPointer(sp, "not")).length === 0) {
+        if (branchErrors(value, not, ctx, path, joinPointer(sp, "not")).length === 0) {
             fail(ctx, path, "not", joinPointer(sp, "not"), "matched a schema it must not match");
         }
     }
     if (schema["if"] !== undefined) {
-        const conditionHolds = branchErrors(value, schema["if"], ctx, joinPointer(sp, "if")).length === 0;
+        const conditionHolds = branchErrors(value, schema["if"], ctx, path, joinPointer(sp, "if")).length === 0;
         const branch = conditionHolds ? schema["then"] : schema["else"];
         if (branch !== undefined) {
             validateNode(value, branch, path, joinPointer(sp, conditionHolds ? "then" : "else"), ctx);
@@ -391,10 +793,22 @@ function resolveRef(ref, ctx) {
 }
 /** Validate one value against one schema, appending any failures to `ctx`. */
 function validateNode(value, schema, path, sp, ctx) {
-    if (ctx.depth > MAX_DEPTH) {
-        fail(ctx, path, "depth", sp, `nesting passed ${MAX_DEPTH} levels — either the value is that deep or a $ref is cycling`);
-        return;
+    charge(ctx, 1);
+    if (ctx.valueDepth > MAX_VALUE_DEPTH) {
+        throw new Undetermined(`the value nests deeper than ${MAX_VALUE_DEPTH} levels (at ${where(ctx, path)}), and nothing below that was checked`);
+    }
+    if (ctx.nesting >= MAX_NESTING) {
+        throw new Undetermined(`the schema and value nest past ${MAX_NESTING} checks inside one another (at ${where(ctx, path)}), and nothing below that was checked`);
     }
+    ctx.nesting += 1;
+    try {
+        checkNode(value, schema, path, sp, ctx);
+    }
+    finally {
+        ctx.nesting -= 1;
+    }
+}
+function checkNode(value, schema, path, sp, ctx) {
     if (schema === true)
         return;
     if (schema === false) {
@@ -418,8 +832,10 @@ function validateNode(value, schema, path, sp, ctx) {
     // Draft-07: a `$ref` replaces its sibling keywords entirely.
     if (typeof schema["$ref"] === "string") {
         const ref = schema["$ref"];
-        const marker = `${ref}@${path}`;
-        if (ctx.refStack.includes(marker)) {
+        // Keyed on the ABSOLUTE instance position: the same $ref twice at one
+        // place in the value, with nothing consumed between, is a real cycle.
+        const marker = `${ref}@${ctx.refBase}${path}`;
+        if (ctx.refs.has(marker)) {
             fail(ctx, path, "$ref", joinPointer(sp, "$ref"), `$ref "${ref}" cycles at this position`);
             return;
         }
@@ -428,11 +844,13 @@ function validateNode(value, schema, path, sp, ctx) {
             fail(ctx, path, "$ref", joinPointer(sp, "$ref"), resolved.error);
             return;
         }
-        ctx.refStack.push(marker);
-        ctx.depth += 1;
-        validateNode(value, resolved.schema, path, ref, ctx);
-        ctx.depth -= 1;
-        ctx.refStack.pop();
+        ctx.refs.add(marker);
+        try {
+            validateNode(value, resolved.schema, path, ref, ctx);
+        }
+        finally {
+            ctx.refs.delete(marker);
+        }
         return;
     }
     const actual = typeOf(value);
@@ -440,21 +858,21 @@ function validateNode(value, schema, path, sp, ctx) {
     if (typeof declared === "string" || Array.isArray(declared)) {
         const allowed = (Array.isArray(declared) ? declared : [declared]).filter((t) => typeof t === "string");
         if (allowed.length > 0 && !allowed.some((t) => matchesType(actual, t))) {
-            fail(ctx, path, "type", joinPointer(sp, "type"), `expected ${allowed.join(" or ")}, found ${actual} (${preview(value, 60)})`);
+            fail(ctx, path, "type", joinPointer(sp, "type"), () => `expected ${allowed.join(" or ")}, found ${actual} (${preview(ctx, value, 60)})`);
             // A wrong type makes every type-specific keyword below noise.
             validateLogic(value, schema, path, sp, ctx);
             return;
         }
     }
     if (Array.isArray(schema["enum"])) {
-        if (!schema["enum"].some((candidate) => deepEqual(candidate, value))) {
-            fail(ctx, path, "enum", joinPointer(sp, "enum"), `${preview(value, 60)} is not one of ${preview(schema["enum"], 120)}`);
+        const candidates = schema["enum"];
+        if (!inEnum(candidates, value, ctx)) {
+            fail(ctx, path, "enum", joinPointer(sp, "enum"), () => `${preview(ctx, value, 60)} is not one of ${preview(ctx, candidates, 120)}`);
         }
     }
-    if (Object.hasOwn(schema, "const") && !deepEqual(schema["const"], value)) {
-        fail(ctx, path, "const", joinPointer(sp, "const"), `expected ${preview(schema["const"], 60)}, found ${preview(value, 60)}`);
+    if (Object.hasOwn(schema, "const") && !sameJson(schema["const"], value, ctx)) {
+        fail(ctx, path, "const", joinPointer(sp, "const"), () => `expected ${preview(ctx, schema["const"], 60)}, found ${preview(ctx, value, 60)}`);
     }
-    ctx.depth += 1;
     if (typeof value === "number")
         validateNumber(value, schema, path, sp, ctx);
     else if (typeof value === "string")
@@ -464,7 +882,6 @@ function validateNode(value, schema, path, sp, ctx) {
     else if (isPlainObject(value))
         validateObject(value, schema, path, sp, ctx);
     validateLogic(value, schema, path, sp, ctx);
-    ctx.depth -= 1;
 }
 /**
  * Validate `value` against `schema`, returning every failure with a JSON
@@ -473,23 +890,73 @@ function validateNode(value, schema, path, sp, ctx) {
  * validator did not enforce, so a pass can be read honestly.
  */
 export function validateValue(value, schema, options = {}) {
+    const work = options.budget ?? {
+        used: 0,
+        limit: options.maxWork ?? defaultWorkLimit(value, schema),
+    };
     const ctx = {
         root: schema,
         opts: { assertFormat: options.assertFormat ?? false, maxErrors: options.maxErrors ?? 100 },
         errors: [],
         truncated: false,
         unsupported: new Set(),
-        refStack: [],
-        depth: 0,
+        refs: new Set(),
+        refBase: "",
+        valueDepth: 0,
+        nesting: 0,
+        work,
+        previews: new WeakMap(),
+        regex: options.regex,
     };
-    validateNode(value, schema, "", "", ctx);
+    let undetermined = null;
+    let workExhausted = false;
+    try {
+        validateNode(value, schema, "", "", ctx);
+    }
+    catch (err) {
+        if (err instanceof WorkExhausted) {
+            workExhausted = true;
+            undetermined = `the schema needed more than ${work.limit} subschema evaluations for this value, so no verdict was reached — anyOf, oneOf and allOf over shared $refs multiply, and so do many patternProperties over many keys`;
+        }
+        else if (err instanceof Undetermined) {
+            undetermined = err.message;
+        }
+        else if (err instanceof RangeError && /call stack/i.test(err.message)) {
+            // The caps above stop the walk first on the shapes measured; a value
+            // item compared whole (uniqueItems) can still nest past the stack.
+            undetermined =
+                "the schema or value nests too deep for this validator to walk, so no verdict was reached";
+        }
+        else {
+            throw err;
+        }
+    }
     return {
-        valid: ctx.errors.length === 0,
+        valid: undetermined === null && ctx.errors.length === 0,
+        undetermined,
+        workExhausted,
         errors: ctx.errors,
         truncated: ctx.truncated,
         unsupportedKeywords: [...ctx.unsupported].sort(),
     };
 }
+/**
+ * Why a schema's pattern will not be run, or null: it does not compile, or
+ * the caller-pattern screen refuses it (a shape that backtracks
+ * exponentially, such as `(a+)+`, or one too long to analyse). Either way
+ * the schema is reported as malformed before anything is validated, rather
+ * than run and answered "no match" by an engine that gave up.
+ */
+function refusedPattern(pattern) {
+    try {
+        new RegExp(pattern);
+    }
+    catch (err) {
+        return err.message;
+    }
+    const screened = screenCallerPattern(pattern, "");
+    return screened.ok ? null : screened.answer.refused;
+}
 /**
  * A structural sanity check on the schema itself, run before validation so a
  * typo like `{"type": "sting"}` is reported as a bad schema rather than as
@@ -511,7 +978,7 @@ export function checkSchemaShape(schema, path = "", depth = 0) {
     }
     // A schema is finite JSON, so this only guards against a hand-built cyclic
     // object; it costs nothing and cannot be hit by a parsed document.
-    if (depth > MAX_DEPTH)
+    if (depth > MAX_SHAPE_DEPTH)
         return problems;
     const validTypes = ["null", "boolean", "object", "array", "number", "string", "integer"];
     const declared = schema["type"];
@@ -544,12 +1011,9 @@ export function checkSchemaShape(schema, path = "", depth = 0) {
         }
     }
     if (typeof schema["pattern"] === "string") {
-        try {
-            new RegExp(schema["pattern"]);
-        }
-        catch (err) {
-            problems.push(`${joinPointer(path, "pattern")}: ${err.message}`);
-        }
+        const refused = refusedPattern(schema["pattern"]);
+        if (refused !== null)
+            problems.push(`${joinPointer(path, "pattern")}: ${refused}`);
     }
     const descend = (child, childPath) => {
         problems.push(...checkSchemaShape(child, childPath, depth + 1));
@@ -561,11 +1025,9 @@ export function checkSchemaShape(schema, path = "", depth = 0) {
             continue;
         if (keyword === "patternProperties") {
             for (const source of Object.keys(map)) {
-                try {
-                    new RegExp(source);
-                }
-                catch (err) {
-                    problems.push(`${joinPointer(joinPointer(path, keyword), source)}: ${err.message}`);
+                const refused = refusedPattern(source);
+                if (refused !== null) {
+                    problems.push(`${joinPointer(joinPointer(path, keyword), source)}: ${refused}`);
                 }
             }
         }