ata-validator 0.13.2 → 0.13.4

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 0.13.4 — 2026-05-14
+
+### Fixed
+
+- **macOS arm64 prebuild shipped with an invalid code signature.** The release workflow runs `pkg-prebuilds-copy --strip`, which on macOS runs `strip -Sx` on the addon. `strip` rewrites the Mach-O and invalidates the ad-hoc signature the linker applied, and it does not re-sign. arm64 macOS refuses to load unsigned code, so `require('ata-validator')` was killed with `SIGKILL (Code Signature Invalid)` the moment the binding loader called into the addon. Only `0.12.6` reached users this way because it was the one release published through CI rather than locally. The workflow now re-signs and verifies the macOS prebuild after `strip`, and `codesign --verify` gates the job so a broken signature cannot ship. Fixes #23.
+- **macOS x64 prebuild was never produced.** The prebuild matrix used `macos-14` for the x64 leg, but `macos-14` runners are Apple Silicon only, so that leg built an arm64 binary mislabeled as x64 and no `darwin-x64` prebuild ever ended up in the tarball.
+
+### Removed
+
+- **macOS x64 prebuild.** `macos-13` GitHub runners, the only ones that build x64 natively, are no longer reliably available. Since no published version ever shipped a working `darwin-x64` prebuild, this is not a regression. Intel Mac users fall back to the JS engine, which still works, only the buffer APIs are slower.
+
+### Changed
+
+- **`prepublishOnly` now blocks tarballs missing platform prebuilds.** A local `npm publish` only carries the publisher's own platform, silently dropping every other prebuild. Publishing now fails unless all seven platform prebuilds are present, and when run on a Mac it also verifies the darwin code signatures.
+
+## 0.13.3 — 2026-05-13
+
+### Fixed
+
+- **`Validator.bundleStandalone` dropped hoisted anyOf/oneOf branch helpers from the bundle output.** Schemas whose codegen hoists branch functions like `_af1_b0` to the per-schema preamble (e.g. allOf wrapping an anyOf, or schemas pulled into a cross-`$ref` bundle) emitted JS that referenced these helpers without defining them, so loading the bundle threw `ReferenceError: _af1_b0 is not defined` on first validation. The standalone preamble now propagates through to the bundle alongside the format-closure serialization that was already there. `toStandalone` (single-schema) was unaffected. Fixes #24.
+
 ## 0.13.2 — 2026-05-09
 
 ### Fixed

package/index.js

@@ -1256,6 +1256,12 @@ Validator.bundleStandalone = function (schemas, opts) {
         .map(({ name, fn }) => `var ${name}=${fn.toString()};`)
         .join('\n');
     }
+    // Include hoisted anyOf/oneOf branch helpers (e.g. `_af1_b0`) so the
+    // bundle output is self-contained. `toStandalone` emits this same source
+    // for single-schema standalone output.
+    if (jsFn._preambleSource) {
+      preamble = preamble ? `${preamble}\n${jsFn._preambleSource}` : jsFn._preambleSource;
+    }
     if (opts && opts.verbose) {
       // Embed the schema and a small resolver so errors carry parentSchema.
       const schemaLit = JSON.stringify(typeof schema === 'string' ? JSON.parse(schema) : schema);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "0.13.2",
+  "version": "0.13.4",
   "description": "Ultra-fast JSON Schema validator. 5x faster validation, 159,000x faster compilation. Works without native addon. Cross-schema $ref, Draft 2020-12 + Draft 7, V8-optimized JS codegen, simdjson, RE2, multi-core. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -36,11 +36,12 @@
   },
   "scripts": {
     "install": "node scripts/install.js",
+    "prepublishOnly": "node scripts/check-prebuilds.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
     "prebuild": "pkg-prebuilds-copy --baseDir build/Release --source ata.node --name=ata --strip --napi_version=10",
     "prebuild-all": "npm run prebuild -- --arch x64 && npm run prebuild -- --arch arm64",
-    "test": "node test.js && node tests/test_no_native.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js",
+    "test": "node test.js && node tests/test_no_native.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js",
     "test:suite": "node tests/run_suite.js",
     "test:compat": "node tests/test_compat.js",
     "test:standard-schema": "node tests/test_standard_schema.js",

package/scripts/check-prebuilds.js

@@ -0,0 +1,54 @@
+'use strict';
+
+// Refuse to publish a tarball that is missing platform prebuilds.
+// Local `npm publish` only carries whatever the publisher's machine built,
+// which silently drops every other platform's prebuild from the tarball.
+// Publishing must go through the release workflow so all platforms are present.
+
+const fs = require('fs');
+const path = require('path');
+const cp = require('child_process');
+
+const required = [
+  'ata-linux-x64',
+  'ata-linux-arm64',
+  'ata-linux-x64-musl',
+  'ata-linux-arm64-musl',
+  'ata-darwin-arm64',
+  'ata-win32-x64',
+];
+
+const root = path.resolve(__dirname, '..');
+const missing = required.filter(
+  (dir) => !fs.existsSync(path.join(root, 'prebuilds', dir, 'node-napi-v10.node')),
+);
+
+if (missing.length) {
+  console.error(
+    '\n[ata-validator] Refusing to publish, missing prebuilds:\n' +
+      missing.map((d) => '  - ' + d).join('\n') +
+      '\n\nPublish through the GitHub release workflow so every platform is built.\n',
+  );
+  process.exit(1);
+}
+
+// When publishing from a Mac, verify the darwin code signatures too. strip
+// invalidates the linker signature, and an unsigned arm64 addon is killed on
+// load. The release workflow re-signs and verifies, this is the local net.
+if (process.platform === 'darwin') {
+  for (const dir of required) {
+    if (!dir.startsWith('ata-darwin-')) continue;
+    const f = path.join(root, 'prebuilds', dir, 'node-napi-v10.node');
+    const r = cp.spawnSync('codesign', ['--verify', f], { encoding: 'utf8' });
+    if (r.status !== 0) {
+      console.error(
+        '\n[ata-validator] Refusing to publish, invalid code signature:\n' +
+          '  ' + f + '\n' + (r.stderr || '').trim() +
+          '\n\nRe-sign with: codesign --force --sign - "' + f + '"\n',
+      );
+      process.exit(1);
+    }
+  }
+}
+
+console.log('[ata-validator] prebuilds present for all ' + required.length + ' platforms');