ata-validator 0.2.0 → 0.4.0

package/lib/js-compiler.js

@@ -0,0 +1,845 @@
+'use strict'
+
+// Compile a JSON Schema into a pure JS validator function.
+// No eval, no new Function, CSP-safe.
+// Returns null if the schema is too complex for JS compilation.
+
+function compileToJS(schema, defs) {
+  if (typeof schema === 'boolean') {
+    return schema ? () => true : () => false
+  }
+  if (typeof schema !== 'object' || schema === null) return null
+
+  // Bail if schema has edge cases that JS fast path gets wrong
+  if (!defs && !codegenSafe(schema)) return null
+
+  // Collect $defs early so sub-schemas can resolve $ref
+  const rootDefs = defs || collectDefs(schema)
+
+  // Bail on features that are too complex for JS fast path
+  if (schema.patternProperties ||
+      schema.dependentSchemas ||
+      schema.propertyNames) {
+    return null
+  }
+
+  const checks = []
+
+  // $ref (local only)
+  if (schema.$ref) {
+    const refFn = resolveRef(schema.$ref, rootDefs)
+    if (!refFn) return null
+    checks.push(refFn)
+  }
+
+  // type
+  if (schema.type) {
+    const types = Array.isArray(schema.type) ? schema.type : [schema.type]
+    checks.push(buildTypeCheck(types))
+  }
+
+  // enum
+  if (schema.enum) {
+    const vals = schema.enum
+    const primitives = vals.filter(v => v === null || typeof v !== 'object')
+    const objects = vals.filter(v => v !== null && typeof v === 'object')
+    const primSet = new Set(primitives.map(v => v === null ? 'null' : typeof v === 'string' ? 's:' + v : 'n:' + v))
+    const objStrs = objects.map(v => JSON.stringify(v))
+    checks.push((d) => {
+      // Fast primitive check
+      const key = d === null ? 'null' : typeof d === 'string' ? 's:' + d : typeof d === 'number' || typeof d === 'boolean' ? 'n:' + d : null
+      if (key !== null && primSet.has(key)) return true
+      // Slow object check
+      const ds = JSON.stringify(d)
+      for (let i = 0; i < objStrs.length; i++) {
+        if (ds === objStrs[i]) return true
+      }
+      // Also check primitives by stringify for edge cases (boolean in enum)
+      for (let i = 0; i < primitives.length; i++) {
+        if (d === primitives[i]) return true
+      }
+      return false
+    })
+  }
+
+  // const
+  if (schema.const !== undefined) {
+    const cv = schema.const
+    if (cv === null || typeof cv !== 'object') {
+      checks.push((d) => d === cv)
+    } else {
+      const cs = JSON.stringify(cv)
+      checks.push((d) => JSON.stringify(d) === cs)
+    }
+  }
+
+  // required
+  if (schema.required && Array.isArray(schema.required)) {
+    for (const key of schema.required) {
+      checks.push((d) => typeof d === 'object' && d !== null && key in d)
+    }
+  }
+
+  // properties
+  if (schema.properties) {
+    for (const [key, prop] of Object.entries(schema.properties)) {
+      const propCheck = compileToJS(prop, rootDefs)
+      if (!propCheck) return null // bail if sub-schema too complex
+      checks.push((d) => {
+        if (typeof d !== 'object' || d === null || !(key in d)) return true
+        return propCheck(d[key])
+      })
+    }
+  }
+
+  // additionalProperties
+  if (schema.additionalProperties !== undefined && schema.properties) {
+    if (schema.additionalProperties === false) {
+      const allowed = new Set(Object.keys(schema.properties))
+      checks.push((d) => {
+        if (typeof d !== 'object' || d === null || Array.isArray(d)) return true
+        const keys = Object.keys(d)
+        for (let i = 0; i < keys.length; i++) {
+          if (!allowed.has(keys[i])) return false
+        }
+        return true
+      })
+    } else if (typeof schema.additionalProperties === 'object') {
+      const apCheck = compileToJS(schema.additionalProperties, rootDefs)
+      if (!apCheck) return null
+      const known = new Set(Object.keys(schema.properties || {}))
+      checks.push((d) => {
+        if (typeof d !== 'object' || d === null || Array.isArray(d)) return true
+        const keys = Object.keys(d)
+        for (let i = 0; i < keys.length; i++) {
+          if (!known.has(keys[i]) && !apCheck(d[keys[i]])) return false
+        }
+        return true
+      })
+    }
+  }
+
+  // dependentRequired
+  if (schema.dependentRequired) {
+    for (const [key, deps] of Object.entries(schema.dependentRequired)) {
+      checks.push((d) => {
+        if (typeof d !== 'object' || d === null || !(key in d)) return true
+        for (let i = 0; i < deps.length; i++) {
+          if (!(deps[i] in d)) return false
+        }
+        return true
+      })
+    }
+  }
+
+  // items
+  if (schema.items) {
+    const itemCheck = compileToJS(schema.items, rootDefs)
+    if (!itemCheck) return null
+    checks.push((d) => {
+      if (!Array.isArray(d)) return true
+      for (let i = 0; i < d.length; i++) {
+        if (!itemCheck(d[i])) return false
+      }
+      return true
+    })
+  }
+
+  // prefixItems
+  if (schema.prefixItems) {
+    const prefixChecks = []
+    for (const ps of schema.prefixItems) {
+      const pc = compileToJS(ps, rootDefs)
+      if (!pc) return null
+      prefixChecks.push(pc)
+    }
+    checks.push((d) => {
+      if (!Array.isArray(d)) return true
+      for (let i = 0; i < prefixChecks.length && i < d.length; i++) {
+        if (!prefixChecks[i](d[i])) return false
+      }
+      return true
+    })
+  }
+
+  // contains
+  if (schema.contains) {
+    const containsCheck = compileToJS(schema.contains, rootDefs)
+    if (!containsCheck) return null
+    const minC = schema.minContains !== undefined ? schema.minContains : 1
+    const maxC = schema.maxContains !== undefined ? schema.maxContains : Infinity
+    checks.push((d) => {
+      if (!Array.isArray(d)) return true
+      let count = 0
+      for (let i = 0; i < d.length; i++) {
+        if (containsCheck(d[i])) count++
+      }
+      return count >= minC && count <= maxC
+    })
+  }
+
+  // uniqueItems — sorted-key canonical form for correct object comparison
+  if (schema.uniqueItems) {
+    const canonical = (x) => {
+      if (x === null || typeof x !== 'object') return typeof x + ':' + x
+      if (Array.isArray(x)) return '[' + x.map(canonical).join(',') + ']'
+      return '{' + Object.keys(x).sort().map(k => JSON.stringify(k) + ':' + canonical(x[k])).join(',') + '}'
+    }
+    checks.push((d) => {
+      if (!Array.isArray(d)) return true
+      const seen = new Set()
+      for (let i = 0; i < d.length; i++) {
+        const key = canonical(d[i])
+        if (seen.has(key)) return false
+        seen.add(key)
+      }
+      return true
+    })
+  }
+
+  // numeric
+  if (schema.minimum !== undefined) {
+    const min = schema.minimum
+    checks.push((d) => typeof d !== 'number' || d >= min)
+  }
+  if (schema.maximum !== undefined) {
+    const max = schema.maximum
+    checks.push((d) => typeof d !== 'number' || d <= max)
+  }
+  if (schema.exclusiveMinimum !== undefined) {
+    const min = schema.exclusiveMinimum
+    checks.push((d) => typeof d !== 'number' || d > min)
+  }
+  if (schema.exclusiveMaximum !== undefined) {
+    const max = schema.exclusiveMaximum
+    checks.push((d) => typeof d !== 'number' || d < max)
+  }
+  if (schema.multipleOf !== undefined) {
+    const div = schema.multipleOf
+    checks.push((d) => typeof d !== 'number' || d % div === 0)
+  }
+
+  // string
+  if (schema.minLength !== undefined) {
+    const min = schema.minLength
+    checks.push((d) => typeof d !== 'string' || d.length >= min)
+  }
+  if (schema.maxLength !== undefined) {
+    const max = schema.maxLength
+    checks.push((d) => typeof d !== 'string' || d.length <= max)
+  }
+  if (schema.pattern) {
+    try {
+      const re = new RegExp(schema.pattern)
+      checks.push((d) => typeof d !== 'string' || re.test(d))
+    } catch {
+      return null
+    }
+  }
+
+  // format — hand-written fast checks
+  if (schema.format) {
+    const fc = FORMAT_CHECKS[schema.format]
+    if (fc) checks.push((d) => typeof d !== 'string' || fc(d))
+  }
+
+  // array size
+  if (schema.minItems !== undefined) {
+    const min = schema.minItems
+    checks.push((d) => !Array.isArray(d) || d.length >= min)
+  }
+  if (schema.maxItems !== undefined) {
+    const max = schema.maxItems
+    checks.push((d) => !Array.isArray(d) || d.length <= max)
+  }
+
+  // object size
+  if (schema.minProperties !== undefined) {
+    const min = schema.minProperties
+    checks.push((d) => typeof d !== 'object' || d === null || Object.keys(d).length >= min)
+  }
+  if (schema.maxProperties !== undefined) {
+    const max = schema.maxProperties
+    checks.push((d) => typeof d !== 'object' || d === null || Object.keys(d).length <= max)
+  }
+
+  // allOf
+  if (schema.allOf) {
+    const subs = []
+    for (const s of schema.allOf) {
+      const fn = compileToJS(s, rootDefs)
+      if (!fn) return null
+      subs.push(fn)
+    }
+    checks.push((d) => {
+      for (let i = 0; i < subs.length; i++) {
+        if (!subs[i](d)) return false
+      }
+      return true
+    })
+  }
+
+  // anyOf
+  if (schema.anyOf) {
+    const subs = []
+    for (const s of schema.anyOf) {
+      const fn = compileToJS(s, rootDefs)
+      if (!fn) return null
+      subs.push(fn)
+    }
+    checks.push((d) => {
+      for (let i = 0; i < subs.length; i++) {
+        if (subs[i](d)) return true
+      }
+      return false
+    })
+  }
+
+  // oneOf
+  if (schema.oneOf) {
+    const subs = []
+    for (const s of schema.oneOf) {
+      const fn = compileToJS(s, rootDefs)
+      if (!fn) return null
+      subs.push(fn)
+    }
+    checks.push((d) => {
+      let count = 0
+      for (let i = 0; i < subs.length; i++) {
+        if (subs[i](d)) count++
+        if (count > 1) return false
+      }
+      return count === 1
+    })
+  }
+
+  // not
+  if (schema.not) {
+    const notFn = compileToJS(schema.not, rootDefs)
+    if (!notFn) return null
+    checks.push((d) => !notFn(d))
+  }
+
+  // if/then/else
+  if (schema.if) {
+    const ifFn = compileToJS(schema.if, rootDefs)
+    if (!ifFn) return null
+    const thenFn = schema.then ? compileToJS(schema.then, rootDefs) : null
+    const elseFn = schema.else ? compileToJS(schema.else, rootDefs) : null
+    if (schema.then && !thenFn) return null
+    if (schema.else && !elseFn) return null
+    checks.push((d) => {
+      if (ifFn(d)) {
+        return thenFn ? thenFn(d) : true
+      } else {
+        return elseFn ? elseFn(d) : true
+      }
+    })
+  }
+
+  if (checks.length === 0) return () => true
+  if (checks.length === 1) return checks[0]
+
+  // Flatten to a single function — V8 JIT will inline
+  return (data) => {
+    for (let i = 0; i < checks.length; i++) {
+      if (!checks[i](data)) return false
+    }
+    return true
+  }
+}
+
+function collectDefs(schema) {
+  const defs = {}
+  const raw = schema.$defs || schema.definitions
+  if (raw && typeof raw === 'object') {
+    for (const [name, def] of Object.entries(raw)) {
+      // Lazy compile with circular guard — return true (permissive) on cycle
+      let cached = undefined
+      defs[name] = {
+        get fn() {
+          if (cached === undefined) {
+            cached = null // sentinel: compilation in progress
+            cached = compileToJS(def, defs)
+          }
+          // cached===null means circular ref or compile failure — be permissive
+          return cached || (() => true)
+        },
+        raw: def
+      }
+    }
+  }
+  return defs
+}
+
+function resolveRef(ref, defs) {
+  if (!defs) return null
+  // #/$defs/Name or #/definitions/Name
+  const m = ref.match(/^#\/(?:\$defs|definitions)\/(.+)$/)
+  if (!m) return null
+  const name = m[1]
+  const entry = defs[name]
+  if (!entry) return null
+  return (d) => {
+    const fn = entry.fn
+    return fn ? fn(d) : true
+  }
+}
+
+function buildTypeCheck(types) {
+  if (types.length === 1) {
+    return TYPE_CHECKS[types[0]] || (() => true)
+  }
+  const fns = types.map(t => TYPE_CHECKS[t]).filter(Boolean)
+  return (d) => {
+    for (let i = 0; i < fns.length; i++) {
+      if (fns[i](d)) return true
+    }
+    return false
+  }
+}
+
+const TYPE_CHECKS = {
+  string: (d) => typeof d === 'string',
+  number: (d) => typeof d === 'number' && isFinite(d),
+  integer: (d) => Number.isInteger(d),
+  boolean: (d) => typeof d === 'boolean',
+  null: (d) => d === null,
+  array: (d) => Array.isArray(d),
+  object: (d) => typeof d === 'object' && d !== null && !Array.isArray(d),
+}
+
+const FORMAT_CHECKS = {
+  email: (s) => { const at = s.indexOf('@'); return at > 0 && at < s.length - 1 && s.indexOf('.', at) > at + 1 },
+  date: (s) => s.length === 10 && /^\d{4}-\d{2}-\d{2}$/.test(s),
+  uuid: (s) => s.length === 36 && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s),
+  ipv4: (s) => { const p = s.split('.'); return p.length === 4 && p.every(n => { const v = +n; return v >= 0 && v <= 255 && String(v) === n }) },
+  hostname: (s) => s.length > 0 && s.length <= 253 && /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i.test(s),
+}
+
+// Dangerous JS property names that exist on Object.prototype
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'toString', 'valueOf',
+  'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable', 'toLocaleString'])
+
+// Recursively check if a schema can be safely compiled to JS codegen.
+// Returns false if any sub-schema contains features codegen gets wrong.
+function codegenSafe(schema) {
+  if (typeof schema === 'boolean') return true
+  if (typeof schema !== 'object' || schema === null) return true
+
+  // Boolean sub-schemas anywhere cause bail — codegen doesn't handle schema=false correctly
+  if (schema.items === false || schema.items === true) return false
+  if (schema.additionalProperties === true) return true // permissive — fine
+  if (schema.properties) {
+    for (const v of Object.values(schema.properties)) {
+      if (typeof v === 'boolean') return false
+      if (!codegenSafe(v)) return false
+    }
+  }
+
+  // Required keys that collide with Object.prototype
+  if (schema.required) {
+    for (const k of schema.required) {
+      if (UNSAFE_KEYS.has(k)) return false
+    }
+  }
+
+  // Unicode property escapes in pattern need 'u' flag — codegen uses RegExp without it
+  if (schema.pattern && /\\[pP]\{/.test(schema.pattern)) return false
+
+  // $ref — bail entirely from codegen; ref resolution has too many edge cases
+  if (schema.$ref) return false
+
+  // additionalProperties as schema — bail entirely, too many edge cases with allOf interaction
+  if (typeof schema.additionalProperties === 'object') return false
+  if (schema.additionalProperties === false && !schema.properties) return false
+
+  // propertyNames: false — codegen doesn't handle this
+  if (schema.propertyNames === false) return false
+
+  // Recurse into sub-schemas — bail on boolean schemas in any position
+  const subs = [
+    schema.items, schema.contains, schema.not,
+    schema.if, schema.then, schema.else,
+    ...(schema.prefixItems || []),
+    ...(schema.allOf || []),
+    ...(schema.anyOf || []),
+    ...(schema.oneOf || []),
+  ]
+  if (typeof schema.additionalProperties === 'object') subs.push(schema.additionalProperties)
+  for (const s of subs) {
+    if (s === undefined || s === null) continue
+    if (typeof s === 'boolean') return false // boolean sub-schema
+    if (!codegenSafe(s)) return false
+  }
+
+  return true
+}
+
+// --- Codegen mode: generates a single Function (NOT CSP-safe) ---
+// This matches ajv's approach: one monolithic function, V8 JIT fully inlines it
+function compileToJSCodegen(schema) {
+  if (typeof schema === 'boolean') return schema ? () => true : () => false
+  if (typeof schema !== 'object' || schema === null) return null
+
+  // Bail if schema contains features that codegen can't handle correctly
+  if (!codegenSafe(schema)) return null
+
+  // Collect defs for $ref resolution
+  const rootDefs = schema.$defs || schema.definitions || null
+
+  // Bail only on truly unsupported features
+  if (schema.patternProperties ||
+      schema.dependentSchemas ||
+      schema.propertyNames) return null
+
+  const ctx = { varCounter: 0, helpers: [], helperCode: [], rootDefs, refStack: new Set() }
+  const lines = []
+  genCode(schema, 'd', lines, ctx)
+  if (lines.length === 0) return () => true
+
+  const body = (ctx.helperCode.length ? ctx.helperCode.join('\n  ') + '\n  ' : '') +
+               lines.join('\n  ') + '\n  return true'
+  try {
+    return new Function('d', body)
+  } catch {
+    return null
+  }
+}
+
+// knownType: if parent already verified the type, skip redundant guards.
+// 'object' = we know v is a non-null non-array object
+// 'array'  = we know v is an array
+// 'string' / 'number' / 'integer' = we know the primitive type
+function genCode(schema, v, lines, ctx, knownType) {
+  if (typeof schema !== 'object' || schema === null) return
+
+  // $ref — guard against circular references
+  if (schema.$ref && ctx.rootDefs) {
+    const m = schema.$ref.match(/^#\/(?:\$defs|definitions)\/(.+)$/)
+    if (m && ctx.rootDefs[m[1]]) {
+      if (ctx.refStack.has(schema.$ref)) return // circular — bail
+      ctx.refStack.add(schema.$ref)
+      genCode(ctx.rootDefs[m[1]], v, lines, ctx, knownType)
+      ctx.refStack.delete(schema.$ref)
+    } else {
+      return
+    }
+  }
+
+  // Determine the single known type after this schema's type check
+  const types = schema.type ? (Array.isArray(schema.type) ? schema.type : [schema.type]) : null
+  let effectiveType = knownType
+  if (types) {
+    if (!knownType) {
+      // Emit the type check
+      const conds = types.map(t => {
+        switch (t) {
+          case 'object': return `(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v}))`
+          case 'array': return `Array.isArray(${v})`
+          case 'string': return `typeof ${v}==='string'`
+          case 'number': return `(typeof ${v}==='number'&&isFinite(${v}))`
+          case 'integer': return `Number.isInteger(${v})`
+          case 'boolean': return `typeof ${v}==='boolean'`
+          case 'null': return `${v}===null`
+          default: return 'true'
+        }
+      })
+      lines.push(`if(!(${conds.join('||')}))return false`)
+    }
+    // If single type, downstream checks can skip guards
+    if (types.length === 1) effectiveType = types[0]
+  }
+
+  const isObj = effectiveType === 'object'
+  const isArr = effectiveType === 'array'
+  const isStr = effectiveType === 'string'
+  const isNum = effectiveType === 'number' || effectiveType === 'integer'
+  const objGuard = isObj ? '' : `typeof ${v}==='object'&&${v}!==null&&`
+  const objCheck = isObj ? '' : `if(typeof ${v}!=='object'||${v}===null)return false;`
+
+  // enum
+  if (schema.enum) {
+    const vals = schema.enum
+    const primitives = vals.filter(v => v === null || typeof v !== 'object')
+    const objects = vals.filter(v => v !== null && typeof v === 'object')
+    const primChecks = primitives.map(p => `${v}===${JSON.stringify(p)}`).join('||')
+    const objChecks = objects.map(o => `JSON.stringify(${v})===${JSON.stringify(JSON.stringify(o))}`).join('||')
+    const allChecks = [primChecks, objChecks].filter(Boolean).join('||')
+    lines.push(`if(!(${allChecks || 'false'}))return false`)
+  }
+
+  // const
+  if (schema.const !== undefined) {
+    const cv = schema.const
+    if (cv === null || typeof cv !== 'object') {
+      lines.push(`if(${v}!==${JSON.stringify(cv)})return false`)
+    } else {
+      lines.push(`if(JSON.stringify(${v})!==${JSON.stringify(JSON.stringify(cv))})return false`)
+    }
+  }
+
+  // Collect required keys so property checks can skip 'in' guard
+  const requiredSet = new Set(schema.required || [])
+
+  // required + property hoisting via destructuring.
+  // V8 TurboFan optimizes destructuring into a single batch hidden-class-aware read.
+  // `d.key !== undefined` is faster than `'key' in d` (no prototype chain walk).
+  const hoisted = {} // key -> local var name
+  if (schema.required && schema.properties && isObj) {
+    const destructKeys = []
+    const reqChecks = []
+    for (const key of schema.required) {
+      if (schema.properties[key]) {
+        const localVar = `_h${ctx.varCounter++}`
+        hoisted[key] = localVar
+        destructKeys.push(`${JSON.stringify(key)}:${localVar}`)
+        reqChecks.push(`${localVar}===undefined`)
+      } else {
+        // Required but no property schema — just check existence
+        reqChecks.push(`${v}[${JSON.stringify(key)}]===undefined`)
+      }
+    }
+    if (destructKeys.length > 0) {
+      lines.push(`const{${destructKeys.join(',')}}=${v}`)
+    }
+    if (reqChecks.length > 0) {
+      lines.push(`if(${reqChecks.join('||')})return false`)
+    }
+  } else if (schema.required) {
+    if (isObj) {
+      const checks = schema.required.map(key => `${v}[${JSON.stringify(key)}]===undefined`)
+      lines.push(`if(${checks.join('||')})return false`)
+    } else {
+      for (const key of schema.required) {
+        lines.push(`if(typeof ${v}!=='object'||${v}===null||!(${JSON.stringify(key)} in ${v}))return false`)
+      }
+    }
+  }
+
+  // numeric — skip type guard if known numeric
+  if (schema.minimum !== undefined) lines.push(isNum ? `if(${v}<${schema.minimum})return false` : `if(typeof ${v}==='number'&&${v}<${schema.minimum})return false`)
+  if (schema.maximum !== undefined) lines.push(isNum ? `if(${v}>${schema.maximum})return false` : `if(typeof ${v}==='number'&&${v}>${schema.maximum})return false`)
+  if (schema.exclusiveMinimum !== undefined) lines.push(isNum ? `if(${v}<=${schema.exclusiveMinimum})return false` : `if(typeof ${v}==='number'&&${v}<=${schema.exclusiveMinimum})return false`)
+  if (schema.exclusiveMaximum !== undefined) lines.push(isNum ? `if(${v}>=${schema.exclusiveMaximum})return false` : `if(typeof ${v}==='number'&&${v}>=${schema.exclusiveMaximum})return false`)
+  if (schema.multipleOf !== undefined) lines.push(isNum ? `if(${v}%${schema.multipleOf}!==0)return false` : `if(typeof ${v}==='number'&&${v}%${schema.multipleOf}!==0)return false`)
+
+  // string — skip type guard if known string
+  if (schema.minLength !== undefined) lines.push(isStr ? `if(${v}.length<${schema.minLength})return false` : `if(typeof ${v}==='string'&&${v}.length<${schema.minLength})return false`)
+  if (schema.maxLength !== undefined) lines.push(isStr ? `if(${v}.length>${schema.maxLength})return false` : `if(typeof ${v}==='string'&&${v}.length>${schema.maxLength})return false`)
+
+  // array size — skip guard if known array
+  if (schema.minItems !== undefined) lines.push(isArr ? `if(${v}.length<${schema.minItems})return false` : `if(Array.isArray(${v})&&${v}.length<${schema.minItems})return false`)
+  if (schema.maxItems !== undefined) lines.push(isArr ? `if(${v}.length>${schema.maxItems})return false` : `if(Array.isArray(${v})&&${v}.length>${schema.maxItems})return false`)
+
+  // object size
+  if (schema.minProperties !== undefined) lines.push(`if(${objGuard}Object.keys(${v}).length<${schema.minProperties})return false`)
+  if (schema.maxProperties !== undefined) lines.push(`if(${objGuard}Object.keys(${v}).length>${schema.maxProperties})return false`)
+
+  if (schema.pattern) {
+    // Use RegExp constructor via helper to avoid injection from untrusted patterns
+    const ri = ctx.varCounter++
+    ctx.helperCode.push(`const _re${ri}=new RegExp(${JSON.stringify(schema.pattern)})`)
+    lines.push(isStr ? `if(!_re${ri}.test(${v}))return false` : `if(typeof ${v}==='string'&&!_re${ri}.test(${v}))return false`)
+  }
+
+  if (schema.format) {
+    const fc = FORMAT_CODEGEN[schema.format]
+    if (fc) lines.push(fc(v, isStr))
+  }
+
+  // uniqueItems — fast path for primitive arrays (no JSON.stringify)
+  if (schema.uniqueItems) {
+    const si = ctx.varCounter++
+    // If items schema is a primitive type, skip JSON.stringify entirely
+    const itemType = schema.items && typeof schema.items === 'object' && schema.items.type
+    const isPrimItems = itemType === 'string' || itemType === 'number' || itemType === 'integer'
+    // For objects: use sorted-key JSON.stringify to handle key order correctly per spec
+    const inner = isPrimItems
+      ? `const _s${si}=new Set();for(let _i=0;_i<${v}.length;_i++){if(_s${si}.has(${v}[_i]))return false;_s${si}.add(${v}[_i])}`
+      : `const _cn${si}=function(x){if(x===null||typeof x!=='object')return typeof x+':'+x;if(Array.isArray(x))return'['+x.map(_cn${si}).join(',')+']';return'{'+Object.keys(x).sort().map(function(k){return JSON.stringify(k)+':'+_cn${si}(x[k])}).join(',')+'}'};const _s${si}=new Set();for(let _i=0;_i<${v}.length;_i++){const _k=_cn${si}(${v}[_i]);if(_s${si}.has(_k))return false;_s${si}.add(_k)}`
+    lines.push(isArr ? `{${inner}}` : `if(Array.isArray(${v})){${inner}}`)
+  }
+
+  // additionalProperties
+  if (schema.additionalProperties === false && schema.properties) {
+    const allowed = Object.keys(schema.properties).map(k => `'${esc(k)}'`).join(',')
+    const ci = ctx.varCounter++
+    const inner = `const _k${ci}=Object.keys(${v});const _a${ci}=new Set([${allowed}]);for(let _i=0;_i<_k${ci}.length;_i++)if(!_a${ci}.has(_k${ci}[_i]))return false`
+    lines.push(isObj ? `{${inner}}` : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
+  }
+
+  // dependentRequired
+  if (schema.dependentRequired) {
+    for (const [key, deps] of Object.entries(schema.dependentRequired)) {
+      const depChecks = deps.map(d => `!('${esc(d)}' in ${v})`).join('||')
+      lines.push(`if(${objGuard}'${esc(key)}' in ${v}&&(${depChecks}))return false`)
+    }
+  }
+
+  // properties — use hoisted vars for required props, hoist optional to locals too
+  if (schema.properties) {
+    for (const [key, prop] of Object.entries(schema.properties)) {
+      if (requiredSet.has(key) && isObj) {
+        // Required + type:object — property exists, use destructured local
+        genCode(prop, hoisted[key] || `${v}[${JSON.stringify(key)}]`, lines, ctx)
+      } else if (isObj) {
+        // Optional — hoist to local, check undefined
+        const oi = ctx.varCounter++
+        const local = `_o${oi}`
+        lines.push(`{const ${local}=${v}[${JSON.stringify(key)}];if(${local}!==undefined){`)
+        genCode(prop, local, lines, ctx)
+        lines.push(`}}`)
+      } else {
+        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${JSON.stringify(key)} in ${v}){`)
+        genCode(prop, `${v}[${JSON.stringify(key)}]`, lines, ctx)
+        lines.push(`}`)
+      }
+    }
+  }
+
+  // items — pass known type info to children
+  if (schema.items) {
+    const idx = `_j${ctx.varCounter}`
+    const elem = `_e${ctx.varCounter}`
+    ctx.varCounter++
+    lines.push(isArr
+      ? `for(let ${idx}=0;${idx}<${v}.length;${idx}++){const ${elem}=${v}[${idx}]`
+      : `if(Array.isArray(${v})){for(let ${idx}=0;${idx}<${v}.length;${idx}++){const ${elem}=${v}[${idx}]`)
+    genCode(schema.items, elem, lines, ctx)
+    lines.push(isArr ? `}` : `}}`)
+  }
+
+  // prefixItems
+  if (schema.prefixItems) {
+    for (let i = 0; i < schema.prefixItems.length; i++) {
+      const elem = `_p${ctx.varCounter}_${i}`
+      lines.push(isArr
+        ? `if(${v}.length>${i}){const ${elem}=${v}[${i}]`
+        : `if(Array.isArray(${v})&&${v}.length>${i}){const ${elem}=${v}[${i}]`)
+      genCode(schema.prefixItems[i], elem, lines, ctx)
+      lines.push(`}`)
+    }
+    ctx.varCounter++
+  }
+
+  // contains — use helper function to avoid try/catch overhead
+  if (schema.contains) {
+    const ci = ctx.varCounter++
+    const minC = schema.minContains !== undefined ? schema.minContains : 1
+    const maxC = schema.maxContains !== undefined ? schema.maxContains : Infinity
+    const subLines = []
+    genCode(schema.contains, `_cv`, subLines, ctx)
+    const fnBody = subLines.length === 0 ? `return true` : `${subLines.join(';')};return true`
+    const guard = isArr ? '' : `if(!Array.isArray(${v})){}else `
+    lines.push(`${guard}{const _cf${ci}=function(_cv){${fnBody}};let _cc${ci}=0`)
+    lines.push(`for(let _ci${ci}=0;_ci${ci}<${v}.length;_ci${ci}++){if(_cf${ci}(${v}[_ci${ci}]))_cc${ci}++}`)
+    if (maxC === Infinity) {
+      lines.push(`if(_cc${ci}<${minC})return false}`)
+    } else {
+      lines.push(`if(_cc${ci}<${minC}||_cc${ci}>${maxC})return false}`)
+    }
+  }
+
+  // allOf — pass known type through
+  if (schema.allOf) {
+    for (const sub of schema.allOf) {
+      genCode(sub, v, lines, ctx, effectiveType)
+    }
+  }
+
+  // anyOf — need function wrappers since genCode uses return false
+  if (schema.anyOf) {
+    const fns = []
+    for (let i = 0; i < schema.anyOf.length; i++) {
+      const subLines = []
+      genCode(schema.anyOf[i], '_av', subLines, ctx)
+      if (subLines.length === 0) {
+        fns.push(`function(_av){return true}`)
+      } else {
+        fns.push(`function(_av){${subLines.join(';')};return true}`)
+      }
+    }
+    const fi = ctx.varCounter++
+    lines.push(`{const _af${fi}=[${fns.join(',')}];let _am${fi}=false;for(let _ai=0;_ai<_af${fi}.length;_ai++){if(_af${fi}[_ai](${v})){_am${fi}=true;break}}if(!_am${fi})return false}`)
+  }
+
+  // oneOf
+  if (schema.oneOf) {
+    const fns = []
+    for (let i = 0; i < schema.oneOf.length; i++) {
+      const subLines = []
+      genCode(schema.oneOf[i], '_ov', subLines, ctx)
+      if (subLines.length === 0) {
+        fns.push(`function(_ov){return true}`)
+      } else {
+        fns.push(`function(_ov){${subLines.join(';')};return true}`)
+      }
+    }
+    const fi = ctx.varCounter++
+    lines.push(`{const _of${fi}=[${fns.join(',')}];let _oc${fi}=0;for(let _oi=0;_oi<_of${fi}.length;_oi++){if(_of${fi}[_oi](${v}))_oc${fi}++;if(_oc${fi}>1)return false}if(_oc${fi}!==1)return false}`)
+  }
+
+  // not
+  if (schema.not) {
+    const subLines = []
+    genCode(schema.not, '_nv', subLines, ctx)
+    if (subLines.length === 0) {
+      lines.push(`return false`) // not:{} means nothing is valid
+    } else {
+      const fi = ctx.varCounter++
+      lines.push(`{const _nf${fi}=(function(_nv){${subLines.join(';')};return true});if(_nf${fi}(${v}))return false}`)
+    }
+  }
+
+  // if/then/else
+  if (schema.if) {
+    const ifLines = []
+    genCode(schema.if, '_iv', ifLines, ctx)
+    const fi = ctx.varCounter++
+    const ifFn = ifLines.length === 0
+      ? `function(_iv){return true}`
+      : `function(_iv){${ifLines.join(';')};return true}`
+
+    let thenFn = 'null', elseFn = 'null'
+    if (schema.then) {
+      const thenLines = []
+      genCode(schema.then, '_tv', thenLines, ctx)
+      thenFn = thenLines.length === 0
+        ? `function(_tv){return true}`
+        : `function(_tv){${thenLines.join(';')};return true}`
+    }
+    if (schema.else) {
+      const elseLines = []
+      genCode(schema.else, '_ev', elseLines, ctx)
+      elseFn = elseLines.length === 0
+        ? `function(_ev){return true}`
+        : `function(_ev){${elseLines.join(';')};return true}`
+    }
+    lines.push(`{const _if${fi}=${ifFn};const _th${fi}=${thenFn};const _el${fi}=${elseFn}`)
+    lines.push(`if(_if${fi}(${v})){if(_th${fi}&&!_th${fi}(${v}))return false}else{if(_el${fi}&&!_el${fi}(${v}))return false}}`)
+  }
+}
+
+const FORMAT_CODEGEN = {
+  email: (v, isStr) => {
+    const guard = isStr ? '' : `typeof ${v}==='string'&&`
+    return isStr
+      ? `{const _at=${v}.indexOf('@');if(_at<=0||_at>=${v}.length-1||${v}.indexOf('.',_at)<=_at+1)return false}`
+      : `if(typeof ${v}==='string'){const _at=${v}.indexOf('@');if(_at<=0||_at>=${v}.length-1||${v}.indexOf('.',_at)<=_at+1)return false}`
+  },
+  date: (v, isStr) => isStr
+    ? `if(${v}.length!==10||!/^\\d{4}-\\d{2}-\\d{2}$/.test(${v}))return false`
+    : `if(typeof ${v}==='string'&&(${v}.length!==10||!/^\\d{4}-\\d{2}-\\d{2}$/.test(${v})))return false`,
+  uuid: (v, isStr) => isStr
+    ? `if(${v}.length!==36||!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(${v}))return false`
+    : `if(typeof ${v}==='string'&&(${v}.length!==36||!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(${v})))return false`,
+  ipv4: (v, isStr) => isStr
+    ? `{const _p=${v}.split('.');if(_p.length!==4||!_p.every(function(n){var x=+n;return x>=0&&x<=255&&String(x)===n}))return false}`
+    : `if(typeof ${v}==='string'){const _p=${v}.split('.');if(_p.length!==4||!_p.every(function(n){var x=+n;return x>=0&&x<=255&&String(x)===n}))return false}`,
+}
+
+// Safe key escaping: use JSON.stringify to handle all special chars (newlines, null bytes, etc.)
+function esc(s) { return JSON.stringify(s).slice(1, -1) }
+
+module.exports = { compileToJS, compileToJSCodegen }