ata-validator 0.17.3 → 0.17.5

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 0.17.5 - 2026-05-25
+
+### Fixed
+
+- Compiled validators resolve draft-07 plain-name anchors. A `$defs`/`definitions` entry that declares an anchor with `$id: "#name"` and is referenced by `$ref: "#name"` now compiles through the codegen on every path (boolean, error, combined) instead of bailing. The bail forced a fallback that could not resolve sibling cross-schema refs, which surfaced as `cannot resolve $ref`. This is how shared schemas are referenced under Fastify.
+
+## 0.17.4 - 2026-05-25
+
+### Fixed
+
+- Standalone output now embeds user-supplied format functions. `toStandaloneModule` and `bundleCompact` referenced the `_uf_<name>` format helpers without declaring them, so the generated module threw `_uf_<name> is not defined` on the first validation, and their error path skipped the custom format entirely (so `validate` disagreed with `isValid`). Both now serialize the format functions via `Function#toString` and run them on the error path too, matching `bundleStandalone`.
+- Compiled validators report per-property errors for schema-valued `additionalProperties`. The AOT error path previously emitted a single generic `validation failed`; it now validates each undeclared property against the subschema and reports the precise `/<key>` error, matching the runtime validator.
+- `ata --version` (and `-V`) prints the CLI version instead of failing with `unknown command`.
+
 ## 0.17.3 - 2026-05-25
 
 ### Security

package/bin/ata.js

@@ -45,6 +45,7 @@ Build options:
   --dual                  Emit both .compiled.mjs (with source) and .compiled.min.mjs (without)
 
   -h, --help              Show this message
+  -V, --version           Print the ata-validator version
 
 Examples:
   ata compile schemas/user.json -o src/generated/user.validator.mjs
@@ -386,6 +387,10 @@ function main() {
 
   const cmd = argv[0];
   if (cmd === '-h' || cmd === '--help' || cmd === 'help') { usage(); return; }
+  if (cmd === '-V' || cmd === '--version' || cmd === 'version') {
+    process.stdout.write(require('../package.json').version + '\n');
+    return;
+  }
 
   const rest = argv.slice(1);
   let args;

package/index.js

@@ -1214,7 +1214,7 @@ module.exports = { boolFn, hybridFactory, errFn };
       jsErrFn = compileToJSCodegenWithErrors(
         typeof this._schemaObj === 'object' ? this._schemaObj : {},
         null,
-        undefined,
+        this._userFormats,
         (source && sourceMap && schemaFile) ? { sourceMap, schemaFile } : null,
       );
       const errSrc = jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : '';
@@ -1266,6 +1266,16 @@ module.exports = { boolFn, hybridFactory, errFn };
     // them at module scope too, or _fn references undefined names (e.g. _af1_b0).
     const preambleDecls = jsFn._preambleSource ? jsFn._preambleSource + '\n' : '';
 
+    // User-supplied format functions are referenced as _uf_<name> by both the
+    // boolean (_fn) and error (errFn) bodies. Embed them via Function#toString
+    // so the standalone module stays self-contained.
+    let formatDecls = '';
+    if (jsFn._formatClosures && jsFn._formatClosures.length > 0) {
+      formatDecls = jsFn._formatClosures
+        .map(({ name, fn }) => `const ${name} = ${fn.toString()};`)
+        .join('\n') + '\n';
+    }
+
     const validBody = errCore
       ? 'return _fn(data) ? VALID : { valid: false, errors: errFn(data, true).errors }'
       : 'return _fn(data) ? VALID : ABORT';
@@ -1288,7 +1298,7 @@ const ABORT = Object.freeze({
     path: '',
   })]),
 });
-${closureDecls}${preambleDecls}const _fn = function(d) {
+${closureDecls}${preambleDecls}${formatDecls}const _fn = function(d) {
   ${src}
 };
 ${errCore}function isValid(data) { return _fn(data); }
@@ -1575,6 +1585,7 @@ Validator.bundleCompact = function (schemas, opts) {
     const jsErrFn = compileToJSCodegenWithErrors(
       typeof schema === "string" ? JSON.parse(schema) : schema,
       v._schemaMap,
+      v._userFormats,
     );
     if (jsFn._usesSafeRe || (jsErrFn && jsErrFn._usesSafeRe)) bundleUsesSafeRe = true;
     // Hoisted anyOf/oneOf branch helpers (e.g. `_af1_b0`) must travel with the
@@ -1586,6 +1597,7 @@ Validator.bundleCompact = function (schemas, opts) {
     return {
       hybrid,
       err: jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : null,
+      fmt: jsFn._formatClosures || null,
     };
   });
 
@@ -1624,6 +1636,19 @@ Validator.bundleCompact = function (schemas, opts) {
   const declKW = isEsm ? "const" : "var";
   out += `${declKW} R=Object.freeze({valid:true,errors:Object.freeze([])});\n`;
 
+  // User format functions are referenced as _uf_<name> by the hybrid and error
+  // bodies. Collect them across all schemas (deduped by name) and embed via
+  // Function#toString so the bundle stays self-contained.
+  const fmtSeen = new Set();
+  for (const e of entries) {
+    if (!e || !e.fmt) continue;
+    for (const { name, fn } of e.fmt) {
+      if (fmtSeen.has(name)) continue;
+      fmtSeen.add(name);
+      out += `${declKW} ${name}=${fn.toString()};\n`;
+    }
+  }
+
   // Shared hybrid factories
   out += `${declKW} H=[\n`;
   out += bodies

package/lib/js-compiler.js

@@ -699,23 +699,6 @@ function canResolveDynamicRefs(target, callingSchema, schemaMap) {
 
 // Recursively check if a schema can be safely compiled to JS codegen.
 // Returns false if any sub-schema contains features codegen gets wrong.
-// Does the schema (recursively) contain an anchor-style `$ref` equal to anchorId
-// (e.g. `$ref: '#address'`)? Used to keep codegen away from anchor refs it can't
-// resolve in the combined/error paths.
-function schemaHasAnchorRef(node, anchorId) {
-  if (!node || typeof node !== 'object') return false
-  if (Array.isArray(node)) {
-    for (const x of node) if (schemaHasAnchorRef(x, anchorId)) return true
-    return false
-  }
-  if (node.$ref === anchorId) return true
-  for (const k in node) {
-    if (k === '$ref') continue
-    if (schemaHasAnchorRef(node[k], anchorId)) return true
-  }
-  return false
-}
-
 function codegenSafe(schema, schemaMap) {
   if (typeof schema === 'boolean') return true
   if (typeof schema !== 'object' || schema === null) return true
@@ -826,14 +809,10 @@ function codegenSafe(schema, schemaMap) {
       if (typeof def === 'boolean') return false
       if (typeof def === 'object' && def !== null) {
         // A non-fragment $id (e.g. 'sub.json', 'http://...') opens a new base URI
-        // scope — bail. A fragment-only $id ('#name') is a draft-07 anchor; it is
-        // safe to codegen when reached by JSON pointer (#/definitions/name), but the
-        // combined/error codegen paths do not resolve anchor refs (`$ref: '#name'`)
-        // to it, so bail if the schema anchor-references this def.
-        if (def.$id) {
-          if (!def.$id.startsWith('#')) return false
-          if (schemaHasAnchorRef(schema, def.$id)) return false
-        }
+        // scope — bail. A fragment-only $id ('#name') is a draft-07 anchor; the
+        // codegen anchor maps register it (see "Build anchors map"), so anchor
+        // refs (`$ref: '#name'`) resolve to it on all paths.
+        if (def.$id && !def.$id.startsWith('#')) return false
         if (def.$ref) return false // nested ref chain — bail
         if (!codegenSafe(def, schemaMap)) return false
       }
@@ -933,12 +912,15 @@ function compileToJSCodegen(schema, schemaMap, userFormats) {
   // Root schema's own $dynamicAnchor / $anchor
   if (schema.$dynamicAnchor) anchors['#' + schema.$dynamicAnchor] = schema
   if (schema.$anchor) anchors['#' + schema.$anchor] = schema
+  // Draft-07 plain-name anchor: declared as `$id: "#name"`.
+  if (typeof schema.$id === 'string' && schema.$id.startsWith('#')) anchors[schema.$id] = schema
   // Anchors from $defs
   if (rootDefs) {
     for (const def of Object.values(rootDefs)) {
       if (def && typeof def === 'object') {
         if (def.$dynamicAnchor) anchors['#' + def.$dynamicAnchor] = def
         if (def.$anchor) anchors['#' + def.$anchor] = def
+        if (typeof def.$id === 'string' && def.$id.startsWith('#')) anchors[def.$id] = def
       }
     }
   }
@@ -948,6 +930,7 @@ function compileToJSCodegen(schema, schemaMap, userFormats) {
       if (ext && typeof ext === 'object') {
         if (ext.$dynamicAnchor && !anchors['#' + ext.$dynamicAnchor]) anchors['#' + ext.$dynamicAnchor] = ext
         if (ext.$anchor && !anchors['#' + ext.$anchor]) anchors['#' + ext.$anchor] = ext
+        if (typeof ext.$id === 'string' && ext.$id.startsWith('#') && !anchors[ext.$id]) anchors[ext.$id] = ext
       }
     }
   }
@@ -2558,9 +2541,6 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
     if (s.includes('unevaluatedProperties') || s.includes('unevaluatedItems')) return null
     // Bail on self-referencing schemas — error codegen doesn't support recursion
     if (s.includes('"$ref":"#"')) return null
-    // Bail on additionalProperties as a schema — genCodeE does not emit the
-    // per-key sub-schema loop. Let the closure path handle detailed errors.
-    if (hasAdditionalPropertiesSchema(schema)) return null
   }
   if (typeof schema === 'boolean') {
     return schema
@@ -2595,11 +2575,13 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
   const eAnchors = {}
   if (schema.$dynamicAnchor) eAnchors['#' + schema.$dynamicAnchor] = schema
   if (schema.$anchor) eAnchors['#' + schema.$anchor] = schema
+  if (typeof schema.$id === 'string' && schema.$id.startsWith('#')) eAnchors[schema.$id] = schema
   if (eRootDefs) {
     for (const def of Object.values(eRootDefs)) {
       if (def && typeof def === 'object') {
         if (def.$dynamicAnchor) eAnchors['#' + def.$dynamicAnchor] = def
         if (def.$anchor) eAnchors['#' + def.$anchor] = def
+        if (typeof def.$id === 'string' && def.$id.startsWith('#')) eAnchors[def.$id] = def
       }
     }
   }
@@ -2608,6 +2590,7 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
       if (ext && typeof ext === 'object') {
         if (ext.$dynamicAnchor && !eAnchors['#' + ext.$dynamicAnchor]) eAnchors['#' + ext.$dynamicAnchor] = ext
         if (ext.$anchor && !eAnchors['#' + ext.$anchor]) eAnchors['#' + ext.$anchor] = ext
+        if (typeof ext.$id === 'string' && ext.$id.startsWith('#') && !eAnchors[ext.$id]) eAnchors[ext.$id] = ext
       }
     }
   }
@@ -3012,6 +2995,21 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     }
   }
 
+  // additionalProperties as a schema — validate each property not declared in
+  // `properties` against the subschema, with a dynamic /<key> path. codegenSafe
+  // guarantees no patternProperties or composition here, so "additional" is
+  // simply "not declared".
+  if (typeof schema.additionalProperties === 'object' && schema.additionalProperties !== null) {
+    const ki = ctx.varCounter++
+    const known = Object.keys(schema.properties || {})
+    const guard = known.length ? `const _ak${ki}=new Set([${known.map((k) => JSON.stringify(k)).join(',')}]);` : ''
+    const keep = known.length ? `if(!_ak${ki}.has(_k${ki})){` : `{`
+    lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${guard}for(const _k${ki} in ${v}){${keep}`)
+    const p = pathExpr ? `${pathExpr}+'/'+_k${ki}` : `'/'+_k${ki}`
+    genCodeE(schema.additionalProperties, `${v}[_k${ki}]`, p, lines, ctx, schemaPrefix + '/additionalProperties')
+    lines.push(`}}}`)
+  }
+
   // dependentSchemas
   if (schema.dependentSchemas) {
     for (const [key, depSchema] of Object.entries(schema.dependentSchemas)) {
@@ -3198,11 +3196,13 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats) {
   const cAnchors = {}
   if (schema.$dynamicAnchor) cAnchors['#' + schema.$dynamicAnchor] = schema
   if (schema.$anchor) cAnchors['#' + schema.$anchor] = schema
+  if (typeof schema.$id === 'string' && schema.$id.startsWith('#')) cAnchors[schema.$id] = schema
   if (cRootDefs) {
     for (const def of Object.values(cRootDefs)) {
       if (def && typeof def === 'object') {
         if (def.$dynamicAnchor) cAnchors['#' + def.$dynamicAnchor] = def
         if (def.$anchor) cAnchors['#' + def.$anchor] = def
+        if (typeof def.$id === 'string' && def.$id.startsWith('#')) cAnchors[def.$id] = def
       }
     }
   }
@@ -3211,6 +3211,7 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats) {
       if (ext && typeof ext === 'object') {
         if (ext.$dynamicAnchor && !cAnchors['#' + ext.$dynamicAnchor]) cAnchors['#' + ext.$dynamicAnchor] = ext
         if (ext.$anchor && !cAnchors['#' + ext.$anchor]) cAnchors['#' + ext.$anchor] = ext
+        if (typeof ext.$id === 'string' && ext.$id.startsWith('#') && !cAnchors[ext.$id]) cAnchors[ext.$id] = ext
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "0.17.3",
+  "version": "0.17.5",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -42,7 +42,7 @@
     "rebuild": "cmake-js rebuild --target ata",
     "prebuild": "pkg-prebuilds-copy --baseDir build/Release --source ata.node --name=ata --strip --napi_version=10",
     "prebuild-all": "npm run prebuild -- --arch x64 && npm run prebuild -- --arch arm64",
-    "test": "node test.js && node tests/test_no_native.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_no_native.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js",
     "test:compat": "node tests/test_compat.js",