ata-validator 0.13.3 → 0.14.0

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 0.14.0 - 2026-05-16
+
+### Added
+
+- Generic `Validator<T>` with type predicate `isValidObject(data): data is T`. Pairs naturally with TypeBox, Zod-from-JSON-Schema, Valibot, or hand-written types over JSON Schema literals.
+- `ValidationResult<T>` and `ValidateAndParseResult<T>` are discriminated unions. On the `valid: true` branch the parsed data is typed; on `valid: false` the `errors` array carries the diagnostic information.
+
+### Changed
+
+- Type-level only: accessing `result.data` (or `result.value` on `validateAndParse`) without first checking `result.valid` is now a TypeScript compile error. Runtime behavior is unchanged. The previous shape returned `undefined` in that position, so this surfaces an existing latent bug at compile time.
+
+### Notes
+
+- Pure `.d.ts` change. No JS, C++, AOT, or CLI behavior is affected. Bundle size unchanged. Runtime performance unchanged.
+
+## 0.13.4 — 2026-05-14
+
+### Fixed
+
+- **macOS arm64 prebuild shipped with an invalid code signature.** The release workflow runs `pkg-prebuilds-copy --strip`, which on macOS runs `strip -Sx` on the addon. `strip` rewrites the Mach-O and invalidates the ad-hoc signature the linker applied, and it does not re-sign. arm64 macOS refuses to load unsigned code, so `require('ata-validator')` was killed with `SIGKILL (Code Signature Invalid)` the moment the binding loader called into the addon. Only `0.12.6` reached users this way because it was the one release published through CI rather than locally. The workflow now re-signs and verifies the macOS prebuild after `strip`, and `codesign --verify` gates the job so a broken signature cannot ship. Fixes #23.
+- **macOS x64 prebuild was never produced.** The prebuild matrix used `macos-14` for the x64 leg, but `macos-14` runners are Apple Silicon only, so that leg built an arm64 binary mislabeled as x64 and no `darwin-x64` prebuild ever ended up in the tarball.
+
+### Removed
+
+- **macOS x64 prebuild.** `macos-13` GitHub runners, the only ones that build x64 natively, are no longer reliably available. Since no published version ever shipped a working `darwin-x64` prebuild, this is not a regression. Intel Mac users fall back to the JS engine, which still works, only the buffer APIs are slower.
+
+### Changed
+
+- **`prepublishOnly` now blocks tarballs missing platform prebuilds.** A local `npm publish` only carries the publisher's own platform, silently dropping every other prebuild. Publishing now fails unless all seven platform prebuilds are present, and when run on a Mac it also verifies the darwin code signatures.
+
 ## 0.13.3 — 2026-05-13
 
 ### Fixed

package/README.md

@@ -90,6 +90,39 @@ v.isValidParallel(ndjson);  // bool[]
 v.countValid(ndjson);        // number
 ```
 
+### Type-safe schemas
+
+`Validator` is generic. Pair it with any schema authoring tool, or a hand-written type, to get TypeScript narrowing in your handler code.
+
+```ts
+import { Type, type Static } from '@sinclair/typebox'
+import { Validator } from 'ata-validator'
+
+const UserSchema = Type.Object({
+  id: Type.Integer({ minimum: 1 }),
+  name: Type.String({ minLength: 1 }),
+  email: Type.String({ format: 'email' }),
+})
+
+type User = Static<typeof UserSchema>
+
+const v = new Validator<User>(UserSchema)
+
+if (v.isValidObject(data)) {
+  // data is narrowed to User, no cast needed
+  console.log(data.name)
+}
+
+const result = v.validate(data)
+if (result.valid) {
+  // result.data is User
+} else {
+  // result.errors: ValidationError[]
+}
+```
+
+The same pattern works with Zod-from-JSON-Schema, Valibot, or a hand-written `type User = {...}` alongside a JSON Schema literal. `Validator<T>` makes no library-specific assumption.
+
 ### Cross-Schema `$ref`
 
 ```javascript

package/index.d.ts

@@ -15,16 +15,13 @@ export interface ValidationError {
 /** A user-supplied format checker. Receives the candidate value, returns true if valid. */
 export type FormatChecker = (value: string) => boolean;
 
-export interface ValidationResult {
-  valid: boolean;
-  errors: ValidationError[];
-}
+export type ValidationResult<T = unknown> =
+  | { valid: true;  data: T;       errors: ValidationError[] }
+  | { valid: false; data?: never;  errors: ValidationError[] };
 
-export interface ValidateAndParseResult {
-  valid: boolean;
-  value: unknown;
-  errors: ValidationError[];
-}
+export type ValidateAndParseResult<T = unknown> =
+  | { valid: true;  value: T;       errors: ValidationError[] }
+  | { valid: false; value: unknown; errors: ValidationError[] };
 
 export interface ValidatorOptions {
   coerceTypes?: boolean;
@@ -74,26 +71,26 @@ export interface StandaloneModule {
   errFn: ((data: unknown, allErrors?: boolean) => ValidationResult) | null;
 }
 
-export class Validator {
+export class Validator<T = unknown> {
   constructor(schema: object | string, options?: ValidatorOptions);
 
   /** Add a schema to the registry for cross-schema $ref resolution */
   addSchema(schema: object): void;
 
   /** Validate data, returns result with errors. Applies defaults, coerceTypes, removeAdditional. */
-  validate(data: unknown): ValidationResult;
+  validate(data: unknown): ValidationResult<T>;
 
   /** Fast boolean check via JS codegen or tier 0 interpreter. No error collection. */
-  isValidObject(data: unknown): boolean;
+  isValidObject(data: unknown): data is T;
 
   /** Validate a JSON string. Uses simdjson fast path for large documents. */
-  validateJSON(jsonString: string): ValidationResult;
+  validateJSON(jsonString: string): ValidationResult<T>;
 
   /** Fast boolean check for a JSON string */
   isValidJSON(jsonString: string): boolean;
 
   /** Parse JSON with simdjson + validate against schema. Returns parsed value and validation result. Requires native addon. */
-  validateAndParse(jsonString: string | Buffer): ValidateAndParseResult;
+  validateAndParse(jsonString: string | Buffer): ValidateAndParseResult<T>;
 
   /** Ultra-fast buffer validation via native addon */
   isValid(input: Buffer | Uint8Array | string): boolean;
@@ -128,7 +125,7 @@ export class Validator {
   toStandaloneModule(options?: { format?: 'esm' | 'cjs'; abortEarly?: boolean }): string | null;
 
   /** Load a pre-compiled standalone module. Zero schema compilation at startup. */
-  static fromStandalone(mod: StandaloneModule, schema: object | string, options?: ValidatorOptions): Validator;
+  static fromStandalone<T = unknown>(mod: StandaloneModule, schema: object | string, options?: ValidatorOptions): Validator<T>;
 
   /** Bundle multiple schemas into a single JS module string. Load with Validator.loadBundle(). */
   static bundle(schemas: object[], options?: ValidatorOptions): string;
@@ -155,16 +152,16 @@ export class Validator {
 }
 
 /** One-shot validate: creates a Validator, validates data, returns result. */
-export function validate(
+export function validate<T = unknown>(
   schema: object | string,
   data: unknown
-): ValidationResult;
+): ValidationResult<T>;
 
 /** Fast compile: returns a validate function directly. WeakMap cached, second call with same schema is near-zero cost. */
-export function compile(
+export function compile<T = unknown>(
   schema: object | string,
   options?: ValidatorOptions
-): (data: unknown) => ValidationResult;
+): (data: unknown) => ValidationResult<T>;
 
 /** Parse JSON using simdjson (native addon) or JSON.parse (fallback). */
 export function parseJSON(jsonString: string | Buffer): unknown;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "0.13.3",
+  "version": "0.14.0",
   "description": "Ultra-fast JSON Schema validator. 5x faster validation, 159,000x faster compilation. Works without native addon. Cross-schema $ref, Draft 2020-12 + Draft 7, V8-optimized JS codegen, simdjson, RE2, multi-core. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -36,11 +36,12 @@
   },
   "scripts": {
     "install": "node scripts/install.js",
+    "prepublishOnly": "node scripts/check-prebuilds.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
     "prebuild": "pkg-prebuilds-copy --baseDir build/Release --source ata.node --name=ata --strip --napi_version=10",
     "prebuild-all": "npm run prebuild -- --arch x64 && npm run prebuild -- --arch arm64",
-    "test": "node test.js && node tests/test_no_native.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js",
+    "test": "node test.js && node tests/test_no_native.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_typed_validator_runner.js",
     "test:suite": "node tests/run_suite.js",
     "test:compat": "node tests/test_compat.js",
     "test:standard-schema": "node tests/test_standard_schema.js",
@@ -48,6 +49,7 @@
     "test:ts": "node tests/test_ts_gen.js",
     "test:ts-corpus": "node tests/test_ts_corpus.js",
     "test:ts-differential": "node tests/test_ts_differential.js",
+    "test:typed": "node tests/test_typed_validator_runner.js",
     "bench": "node benchmark/bench_large.js",
     "fuzz": "node tests/fuzz_differential.js",
     "fuzz:long": "FUZZ_ITERATIONS=100000 node tests/fuzz_differential.js",
@@ -118,10 +120,13 @@
     "yaml": "^2.0.0"
   },
   "peerDependenciesMeta": {
-    "yaml": { "optional": true }
+    "yaml": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@sinclair/typebox": "^0.34.49",
+    "@types/node": "^25.8.0",
     "cmake-js": "^8.0.0",
     "mitata": "^1.0.34",
     "typebox": "^1.1.7",

package/scripts/check-prebuilds.js

@@ -0,0 +1,54 @@
+'use strict';
+
+// Refuse to publish a tarball that is missing platform prebuilds.
+// Local `npm publish` only carries whatever the publisher's machine built,
+// which silently drops every other platform's prebuild from the tarball.
+// Publishing must go through the release workflow so all platforms are present.
+
+const fs = require('fs');
+const path = require('path');
+const cp = require('child_process');
+
+const required = [
+  'ata-linux-x64',
+  'ata-linux-arm64',
+  'ata-linux-x64-musl',
+  'ata-linux-arm64-musl',
+  'ata-darwin-arm64',
+  'ata-win32-x64',
+];
+
+const root = path.resolve(__dirname, '..');
+const missing = required.filter(
+  (dir) => !fs.existsSync(path.join(root, 'prebuilds', dir, 'node-napi-v10.node')),
+);
+
+if (missing.length) {
+  console.error(
+    '\n[ata-validator] Refusing to publish, missing prebuilds:\n' +
+      missing.map((d) => '  - ' + d).join('\n') +
+      '\n\nPublish through the GitHub release workflow so every platform is built.\n',
+  );
+  process.exit(1);
+}
+
+// When publishing from a Mac, verify the darwin code signatures too. strip
+// invalidates the linker signature, and an unsigned arm64 addon is killed on
+// load. The release workflow re-signs and verifies, this is the local net.
+if (process.platform === 'darwin') {
+  for (const dir of required) {
+    if (!dir.startsWith('ata-darwin-')) continue;
+    const f = path.join(root, 'prebuilds', dir, 'node-napi-v10.node');
+    const r = cp.spawnSync('codesign', ['--verify', f], { encoding: 'utf8' });
+    if (r.status !== 0) {
+      console.error(
+        '\n[ata-validator] Refusing to publish, invalid code signature:\n' +
+          '  ' + f + '\n' + (r.stderr || '').trim() +
+          '\n\nRe-sign with: codesign --force --sign - "' + f + '"\n',
+      );
+      process.exit(1);
+    }
+  }
+}
+
+console.log('[ata-validator] prebuilds present for all ' + required.length + ' platforms');