ata-validator 1.0.0 → 1.0.2

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.0.2 - 2026-07-17
+
+### Fixed
+
+- Cross-schema `$ref` pointers into `#/definitions/...` resolved to nothing after draft-07 normalization renamed the target to `$defs`, and the generated validator silently accepted invalid data. The pointer walk now treats `definitions` and `$defs` as aliases.
+- Schemas passed by the caller (the `schemas` option, `addSchema()`, and the root schema) were normalized in place, mutating objects the caller still owns. Anyone reusing those objects afterwards, such as Fastify handing the same shared schema to its serializer, saw corrupted keys. Normalization now works on a copy; caller objects are never touched.
+- The new copy preserves symbol-keyed markers, so `t.refine` refinements survive normalization and `validateAsync` keeps enforcing them.
+
+## 1.0.1 - 2026-07-16
+
+### Fixed
+
+- `version()` reported 0.10.4 on platforms with a native prebuild: the `ATA_VERSION` constant in `include/ata.h` had not been bumped since 0.10.4 and the native answer takes precedence over `lib/version.js`. The header now carries the real version and the version-sync test checks it, so it cannot drift again.
+
 ## 1.0.0 - 2026-07-15
 
 1.0 is a stability commitment, not a feature release. The API surface, the error result shape, and the error code registry are now covered by the semver guarantees in [docs/STABILITY.md](docs/STABILITY.md).

package/include/ata.h

@@ -8,16 +8,16 @@
 #include <variant>
 #include <vector>
 
-#define ATA_VERSION "0.10.4"
+#define ATA_VERSION "1.0.2"
 
 namespace ata {
 
-inline constexpr uint32_t VERSION_MAJOR = 0;
-inline constexpr uint32_t VERSION_MINOR = 10;
-inline constexpr uint32_t VERSION_REVISION = 4;
+inline constexpr uint32_t VERSION_MAJOR = 1;
+inline constexpr uint32_t VERSION_MINOR = 0;
+inline constexpr uint32_t VERSION_REVISION = 2;
 
 inline constexpr std::string_view version() noexcept {
-  return "0.10.4";
+  return ATA_VERSION;
 }
 
 enum class error_code : uint8_t {

package/index.js

@@ -344,22 +344,57 @@ function createPaddedBuffer(jsonStr) {
   return { buffer: padded, length: jsonBuf.length };
 }
 
+// Deep-clone a value, copying own symbol keys by reference at every level.
+// Arrays and plain objects are cloned recursively; primitives, RegExp,
+// functions, and other non-plain values are returned as-is. Symbol values
+// (e.g. refinement lists, OPTIONAL markers) are owned by the caller's builder
+// and sharing them is correct — they are never mutated by normalization.
+function _deepCloneWithSymbols(v) {
+  if (v === null || typeof v !== 'object') return v;
+  if (Array.isArray(v)) {
+    const a = new Array(v.length);
+    for (let i = 0; i < v.length; i++) a[i] = _deepCloneWithSymbols(v[i]);
+    return a;
+  }
+  // Only clone plain objects (skip RegExp, Date, etc.).
+  if (Object.getPrototypeOf(v) !== Object.prototype && Object.getPrototypeOf(v) !== null) return v;
+  const out = Object.create(null);
+  for (const k of Object.keys(v)) Object.defineProperty(out, k, { value: _deepCloneWithSymbols(v[k]), writable: true, enumerable: true, configurable: true });
+  for (const sym of Object.getOwnPropertySymbols(v)) out[sym] = v[sym];
+  return Object.setPrototypeOf(out, Object.prototype);
+}
+
+// Normalize a caller-provided schema without mutating the original.
+// Clones only when normalization would change the object (draft-07 keys
+// present or nullable fields present). Internal-only — not exported.
+function _normalizeCallerSchema(s) {
+  const needsDraft7 = s && s.$schema && (
+    s.$schema === 'http://json-schema.org/draft-07/schema#' ||
+    s.$schema === 'http://json-schema.org/draft-07/schema'
+  )
+  const str = JSON.stringify(s)
+  const copy = _deepCloneWithSymbols(s)
+  if (needsDraft7) normalizeDraft7(copy)
+  normalizeNullable(copy)
+  // Return original when normalization produced no change, copy otherwise.
+  // Change-detection uses JSON content only; symbols do not affect it.
+  return JSON.stringify(copy) === str ? s : copy
+}
+
 function buildSchemaMap(schemas) {
   if (!schemas) return null
   const map = new Map()
   if (Array.isArray(schemas)) {
     for (const s of schemas) {
-      normalizeDraft7(s)
-      normalizeNullable(s)
-      const id = s.$id
+      const normalized = _normalizeCallerSchema(s)
+      const id = normalized.$id
       if (!id) throw new Error('Schema in schemas option must have $id')
-      map.set(id, s)
+      map.set(id, normalized)
     }
   } else {
     for (const [key, s] of Object.entries(schemas)) {
-      normalizeDraft7(s)
-      normalizeNullable(s)
-      map.set(s.$id || key, s)
+      const normalized = _normalizeCallerSchema(s)
+      map.set(normalized.$id || key, normalized)
     }
   }
   return map
@@ -449,7 +484,6 @@ function resolveSchemaForPreprocess(schema, schemaMap) {
 class Validator {
   constructor(schema, opts) {
     const options = opts || {};
-    const schemaObj = typeof schema === "string" ? JSON.parse(schema) : schema;
 
     // Ultra-fast path: same schema object reference -> return cached instance
     // JS constructor returning an object makes `new` return that object
@@ -459,10 +493,12 @@ class Validator {
       if (hit) return hit;
     }
 
-    // Draft 7 normalization — convert keywords to 2020-12 equivalents in-place
-    normalizeDraft7(schemaObj);
-    // OpenAPI nullable -> type union with 'null'
-    normalizeNullable(schemaObj);
+    // When schema is a string, JSON.parse already produces a fresh object.
+    // When schema is an object, normalization runs on a clone so the caller's
+    // object is never touched.
+    const schemaObj = typeof schema === "string"
+      ? JSON.parse(schema)
+      : _normalizeCallerSchema(schema);
 
     this._schemaStr = null; // lazy: computed on first use
     this._schemaObj = schemaObj;
@@ -1132,10 +1168,9 @@ class Validator {
     if (!schema || !schema.$id) {
       throw new Error('Schema must have $id')
     }
-    // Apply Draft 7 normalization if needed
-    normalizeDraft7(schema)
-    normalizeNullable(schema)
-    this._schemaMap.set(schema.$id, schema)
+    // Normalize a copy so the caller's object is never mutated.
+    const normalized = _normalizeCallerSchema(schema)
+    this._schemaMap.set(normalized.$id, normalized)
   }
 
   _ensureCodegen() {

package/lib/js-compiler.js

@@ -549,6 +549,11 @@ function walkJsonPointer(root, fragment) {
   let target = root
   for (const p of parts) {
     if (target == null || typeof target !== 'object') return null
+    if (!(p in target)) {
+      const alt = p === 'definitions' ? '$defs' : p === '$defs' ? 'definitions' : null
+      if (alt !== null && alt in target) { target = target[alt]; continue }
+      return null
+    }
     target = target[p]
   }
   return target == null ? null : target

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.0.0';
+module.exports = '1.0.2';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -48,7 +48,7 @@
     "rebuild": "cmake-js rebuild --target ata",
     "prebuild": "pkg-prebuilds-copy --baseDir build/Release --source ata.node --name=ata --strip --napi_version=10",
     "prebuild-all": "npm run prebuild -- --arch x64 && npm run prebuild -- --arch arm64",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_defs_pointer_alias.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js",
     "test:compat": "node tests/test_compat.js",