ata-validator 1.0.1 → 1.1.0

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.1.0 - 2026-07-18
+
+### Added
+
+- TypeBox-style modifier combinators on `ata-validator/t`: `t.pick`, `t.omit`, `t.partial`, `t.required`, `t.composite`, and `t.recursive`. All six emit plain JSON Schema, so `Infer`, the runtime validator, and the AOT pipeline consume them with no adapter. This closes the authoring-parity gap for TypeBox migrations. Note: `t.recursive` schemas validate through the interpreted engine and are not AOT-precompilable; the other five combinators AOT-compile like any schema.
+
+### Changed
+
+- The `ata-validator` package is now pure JavaScript: no bundled binaries, no vendored C++ sources, no install script. The native engine moved to per-platform `@ata-validator/native-*` packages, installed automatically as optional dependencies (the same pattern Vite uses for esbuild). The tarball shrinks from ~5.3 MB to under 300 KB. `npm install --omit=optional` or `ATA_NO_NATIVE=1` gives a guaranteed zero-binary setup; validation behavior is identical for every schema shape the JS engine compiles, and the few shapes that still need the native engine now throw a clear error instead (see Fixed below).
+
+### Fixed
+
+- Schemas the JS engine cannot compile (some `$dynamicRef`, cyclic `$ref`, and unusual keyword interactions) crashed with `Maximum call stack size exceeded` in environments without the native addon: the lazy `validate` stub and the rich-error wrapper dispatched to each other forever. These schemas now throw a clear "not supported by the pure-JS engine" error on first use. The same cycle could hit `isValidObject` even with the native addon present when it was the first method called; it now falls through to the full compile and validates correctly.
+
+## 1.0.2 - 2026-07-17
+
+### Fixed
+
+- Cross-schema `$ref` pointers into `#/definitions/...` resolved to nothing after draft-07 normalization renamed the target to `$defs`, and the generated validator silently accepted invalid data. The pointer walk now treats `definitions` and `$defs` as aliases.
+- Schemas passed by the caller (the `schemas` option, `addSchema()`, and the root schema) were normalized in place, mutating objects the caller still owns. Anyone reusing those objects afterwards, such as Fastify handing the same shared schema to its serializer, saw corrupted keys. Normalization now works on a copy; caller objects are never touched.
+- The new copy preserves symbol-keyed markers, so `t.refine` refinements survive normalization and `validateAsync` keeps enforcing them.
+
 ## 1.0.1 - 2026-07-16
 
 ### Fixed

package/README.md

@@ -14,6 +14,14 @@ npm install --save-dev ata-validator
 npx ata build 'schemas/*.json' --out-dir src/generated
 ```
 
+The `ata-validator` package itself is pure JavaScript. The native accelerator (simdjson parsing, parallel NDJSON, buffer APIs) ships as per-platform optional packages that npm installs automatically where they fit, the same pattern Vite uses for esbuild. For a guaranteed zero-binary install:
+
+```bash
+npm install ata-validator --omit=optional
+```
+
+or set `ATA_NO_NATIVE=1` at runtime. Validation behavior is identical for the schema shapes the JS engine compiles, which covers typical API payload schemas. The buffer and parallel APIs, plus a small set of complex shapes (some `$dynamicRef`, cyclic `$ref`, and unusual keyword interactions), currently need the native engine and throw a clear error without it rather than validating incorrectly.
+
 In your code:
 
 ```ts
@@ -227,7 +235,14 @@ type User = Infer<typeof User>
 const v = new Validator(User)
 ```
 
-The builder covers primitives (`string`, `number`, `integer`, `boolean`, `null`), composites (`object` with `optional` keys, `array`, `tuple`, `record`, `union`, `intersect`, `literal`, `const`, `enum`), and refs (`ref`). Optionality is carried by a Symbol marker that the emitted JSON Schema and ata's codegen never see, so the output is still a plain JSON Schema literal that you can pass to anything that takes one.
+The builder covers primitives (`string`, `number`, `integer`, `boolean`, `null`), composites (`object` with optional keys, `array`, `tuple`, `record`, `union`, `intersect`, `literal`, `const`, `enum`), plus the TypeBox-style modifiers `pick`, `omit`, `partial`, `required`, `composite`, and `recursive`. Optionality is carried by a Symbol marker that the emitted JSON Schema and ata's codegen never see, so the output is still a plain JSON Schema literal that you can pass to anything that takes one.
+
+```ts
+const User = t.object({ id: t.integer(), name: t.string(), email: t.optional(t.string()) })
+const Patch = t.partial(t.omit(User, ['id']))
+type Patch = Infer<typeof Patch>
+// { name?: string; email?: string }
+```
 
 #### Async refinement
 
@@ -462,6 +477,8 @@ If one of these blocks you, open an issue; scope decisions get revisited with re
 
 ## Building from Source
 
+This section applies to contributors building the repository. Regular `npm install` users need not have a C++ toolchain.
+
 ### Development prerequisites
 
 Native builds require C/C++ toolchain support and the following libraries:
@@ -470,7 +487,7 @@ Native builds require C/C++ toolchain support and the following libraries:
 - `abseil`
 - `mimalloc`
 
-Install them before running `npm install` / `npm run build`:
+Install them before running `npm run build`:
 
 ```bash
 # macOS (Homebrew)

package/index.js

@@ -1,7 +1,7 @@
 // Native addon: optional. Core validate() uses JS codegen and works without it.
 // Buffer APIs (isValid, countValid, isValidParallel) require native.
-// Loading is delegated so this file stays free of `pkg-prebuilds`/`__dirname`/
-// `path` (the browser entry must not pull those in via the bundler).
+// Loading is delegated to lib/native-load.js so this file stays free of
+// platform probing and `path` (the browser entry must not pull those in).
 const native = require("./lib/native-load")();
 const {
   compileToJS,
@@ -344,22 +344,57 @@ function createPaddedBuffer(jsonStr) {
   return { buffer: padded, length: jsonBuf.length };
 }
 
+// Deep-clone a value, copying own symbol keys by reference at every level.
+// Arrays and plain objects are cloned recursively; primitives, RegExp,
+// functions, and other non-plain values are returned as-is. Symbol values
+// (e.g. refinement lists, OPTIONAL markers) are owned by the caller's builder
+// and sharing them is correct — they are never mutated by normalization.
+function _deepCloneWithSymbols(v) {
+  if (v === null || typeof v !== 'object') return v;
+  if (Array.isArray(v)) {
+    const a = new Array(v.length);
+    for (let i = 0; i < v.length; i++) a[i] = _deepCloneWithSymbols(v[i]);
+    return a;
+  }
+  // Only clone plain objects (skip RegExp, Date, etc.).
+  if (Object.getPrototypeOf(v) !== Object.prototype && Object.getPrototypeOf(v) !== null) return v;
+  const out = Object.create(null);
+  for (const k of Object.keys(v)) Object.defineProperty(out, k, { value: _deepCloneWithSymbols(v[k]), writable: true, enumerable: true, configurable: true });
+  for (const sym of Object.getOwnPropertySymbols(v)) out[sym] = v[sym];
+  return Object.setPrototypeOf(out, Object.prototype);
+}
+
+// Normalize a caller-provided schema without mutating the original.
+// Clones only when normalization would change the object (draft-07 keys
+// present or nullable fields present). Internal-only — not exported.
+function _normalizeCallerSchema(s) {
+  const needsDraft7 = s && s.$schema && (
+    s.$schema === 'http://json-schema.org/draft-07/schema#' ||
+    s.$schema === 'http://json-schema.org/draft-07/schema'
+  )
+  const str = JSON.stringify(s)
+  const copy = _deepCloneWithSymbols(s)
+  if (needsDraft7) normalizeDraft7(copy)
+  normalizeNullable(copy)
+  // Return original when normalization produced no change, copy otherwise.
+  // Change-detection uses JSON content only; symbols do not affect it.
+  return JSON.stringify(copy) === str ? s : copy
+}
+
 function buildSchemaMap(schemas) {
   if (!schemas) return null
   const map = new Map()
   if (Array.isArray(schemas)) {
     for (const s of schemas) {
-      normalizeDraft7(s)
-      normalizeNullable(s)
-      const id = s.$id
+      const normalized = _normalizeCallerSchema(s)
+      const id = normalized.$id
       if (!id) throw new Error('Schema in schemas option must have $id')
-      map.set(id, s)
+      map.set(id, normalized)
     }
   } else {
     for (const [key, s] of Object.entries(schemas)) {
-      normalizeDraft7(s)
-      normalizeNullable(s)
-      map.set(s.$id || key, s)
+      const normalized = _normalizeCallerSchema(s)
+      map.set(normalized.$id || key, normalized)
     }
   }
   return map
@@ -449,7 +484,6 @@ function resolveSchemaForPreprocess(schema, schemaMap) {
 class Validator {
   constructor(schema, opts) {
     const options = opts || {};
-    const schemaObj = typeof schema === "string" ? JSON.parse(schema) : schema;
 
     // Ultra-fast path: same schema object reference -> return cached instance
     // JS constructor returning an object makes `new` return that object
@@ -459,10 +493,12 @@ class Validator {
       if (hit) return hit;
     }
 
-    // Draft 7 normalization — convert keywords to 2020-12 equivalents in-place
-    normalizeDraft7(schemaObj);
-    // OpenAPI nullable -> type union with 'null'
-    normalizeNullable(schemaObj);
+    // When schema is a string, JSON.parse already produces a fresh object.
+    // When schema is an object, normalization runs on a clone so the caller's
+    // object is never touched.
+    const schemaObj = typeof schema === "string"
+      ? JSON.parse(schema)
+      : _normalizeCallerSchema(schema);
 
     this._schemaStr = null; // lazy: computed on first use
     this._schemaObj = schemaObj;
@@ -533,6 +569,10 @@ class Validator {
         };
       } else {
         this._ensureCodegen();
+        // Codegen can bail on shapes it cannot represent; the full compile
+        // binds the native path or the unsupported thrower instead of
+        // leaving this stub to re-dispatch to itself.
+        if (!this._jsFn) this._ensureCompiled();
       }
       return this.isValidObject(data);
     };
@@ -968,6 +1008,18 @@ class Validator {
           return valid;
         };
       }
+    } else {
+      // No JS codegen and no native engine. Leaving the lazy stubs in place
+      // makes them re-dispatch to themselves forever, so bind a clear error.
+      const unsupported = () => {
+        throw new Error(
+          'This schema is not supported by the pure-JS engine and the native addon is unavailable in this environment'
+        );
+      };
+      this.validate = unsupported;
+      this.isValidObject = unsupported;
+      this.validateJSON = unsupported;
+      this.isValidJSON = unsupported;
     }
 
     // richErrors enrichment: layered on top of whichever validate path was
@@ -1132,10 +1184,9 @@ class Validator {
     if (!schema || !schema.$id) {
       throw new Error('Schema must have $id')
     }
-    // Apply Draft 7 normalization if needed
-    normalizeDraft7(schema)
-    normalizeNullable(schema)
-    this._schemaMap.set(schema.$id, schema)
+    // Normalize a copy so the caller's object is never mutated.
+    const normalized = _normalizeCallerSchema(schema)
+    this._schemaMap.set(normalized.$id, normalized)
   }
 
   _ensureCodegen() {

package/lib/aot.js

@@ -1,7 +1,7 @@
 'use strict';
 
 // All ahead-of-time (AOT) code generation lives here so the default and browser
-// entries can stay free of `fs`, `path`, `__dirname`, and `pkg-prebuilds`.
+// entries can stay free of `fs`, `path`, and `__dirname`.
 // Browser bundles get `lib/aot.browser.js` instead (see package.json `browser`
 // field), which throws if anyone tries to call an AOT function from the browser.
 //

package/lib/js-compiler.js

@@ -549,6 +549,11 @@ function walkJsonPointer(root, fragment) {
   let target = root
   for (const p of parts) {
     if (target == null || typeof target !== 'object') return null
+    if (!(p in target)) {
+      const alt = p === 'definitions' ? '$defs' : p === '$defs' ? 'definitions' : null
+      if (alt !== null && alt in target) { target = target[alt]; continue }
+      return null
+    }
     target = target[p]
   }
   return target == null ? null : target
@@ -697,6 +702,27 @@ function canResolveDynamicRefs(target, callingSchema, schemaMap) {
   return refs.every(r => anchors.has(r))
 }
 
+// Returns true if the node's subtree contains a local $ref pointing to one of
+// the given def names (i.e., '#/$defs/Name' or '#/definitions/Name' where Name
+// is in defNames). Used to detect whether a $defs body cycles back to a sibling.
+function subtreeRefersToLocalDef(node, defNames) {
+  if (typeof node !== 'object' || node === null) return false
+  if (node.$ref) {
+    const m = /^#\/(?:\$defs|definitions)\/([^/]+)$/.exec(node.$ref)
+    if (m && defNames.has(m[1])) return true
+  }
+  for (const val of Object.values(node)) {
+    if (typeof val === 'object' && val !== null) {
+      if (Array.isArray(val)) {
+        for (const item of val) { if (subtreeRefersToLocalDef(item, defNames)) return true }
+      } else {
+        if (subtreeRefersToLocalDef(val, defNames)) return true
+      }
+    }
+  }
+  return false
+}
+
 // Recursively check if a schema can be safely compiled to JS codegen.
 // Returns false if any sub-schema contains features codegen gets wrong.
 function codegenSafe(schema, schemaMap) {
@@ -804,6 +830,17 @@ function codegenSafe(schema, schemaMap) {
   // Check $defs: targets must be safe, names must be simple, no nested $ref chains
   const defs = schema.$defs || schema.definitions
   if (defs) {
+    const defNames = new Set(Object.keys(defs))
+    // Detect cyclic local refs: if any def's own body references back to a sibling
+    // def, the schema contains a cycle. The JS codegen returns (() => true) on cycle
+    // (permissive), so cyclic schemas must route to the interpreted engine instead.
+    // We check only the def bodies, not the top-level schema, so that a plain
+    // { $ref: '#/$defs/Name', $defs: { Name: { type: 'string' } } } (no cycle)
+    // still compiles.
+    const hasCycle = Object.values(defs).some(
+      (def) => typeof def === 'object' && def !== null && subtreeRefersToLocalDef(def, defNames)
+    )
+    if (hasCycle) return false
     for (const [name, def] of Object.entries(defs)) {
       if (/[~/"']/.test(name)) return false // special chars in def name
       if (typeof def === 'boolean') return false

package/lib/native-load.browser.js

@@ -1,7 +1,7 @@
 'use strict';
 
 // Browser stub: there is no native addon in the browser. Swapped in via the
-// package.json `browser` field so bundlers never resolve `pkg-prebuilds`.
+// package.json `browser` field so bundlers skip native platform probing.
 
 module.exports = function loadNative() {
   return null;

package/lib/native-load.js

@@ -1,21 +1,93 @@
 'use strict';
 
-// Locate and load the optional native addon (pkg-prebuilds). Lives in its own
-// module so the default and browser entries can stay free of `pkg-prebuilds`,
-// `__dirname`, and `path` references. In browser bundles this file is replaced
-// with `native-load.browser.js` via the package.json `browser` field, so the
-// `pkg-prebuilds` import never enters the bundle in the first place.
+// Locate the optional native engine. Resolution order:
+//   1. ATA_NO_NATIVE set        -> null (explicit pure-JS mode)
+//   2. @ata-validator/native-*  -> the per-platform optional package
+//   3. other libc variant       -> linux only, in case detection misfired
+//   4. repo-local dev build     -> contributors working from source
+//   5. null                     -> JS codegen covers all core validation
 //
-// Returns the loaded native binding object, or `null` if no prebuild matches
-// (musl/Alpine, unsupported arch, devs running before `npm run build`, etc.).
-// The JS codegen path covers all core validation when this returns null.
+// Lives in its own module so the default and browser entries stay free of
+// platform probing; browser bundles swap this file for
+// `native-load.browser.js` via the package.json `browser` field.
+
+const VERSION = require('./version');
+
+function nativePackageName(platform, arch, isMusl) {
+  if (platform === 'darwin') return arch === 'arm64' ? '@ata-validator/native-darwin-arm64' : null;
+  if (platform === 'win32') return arch === 'x64' ? '@ata-validator/native-win32-x64' : null;
+  if (platform === 'linux') {
+    if (arch !== 'x64' && arch !== 'arm64') return null;
+    return `@ata-validator/native-linux-${arch}-${isMusl ? 'musl' : 'gnu'}`;
+  }
+  return null;
+}
+
+function detectMusl() {
+  // glibc exposes its version in the process report header; musl does not.
+  try {
+    const report = process.report && process.report.getReport && process.report.getReport();
+    return !!report && !!report.header && !report.header.glibcVersionRuntime;
+  } catch {
+    return false;
+  }
+}
+
+let warned = false;
+function checkVersion(binding, source) {
+  if (!binding) return null;
+  try {
+    const v = typeof binding.version === 'function' ? binding.version() : null;
+    if (v && v !== VERSION) {
+      if (!warned) {
+        warned = true;
+        process.emitWarning(
+          `ata-validator ${VERSION} found a native engine reporting ${v} (${source}); ` +
+          'ignoring it and using the pure-JS engine. Reinstall to realign versions.',
+        );
+      }
+      return null;
+    }
+  } catch {
+    return null;
+  }
+  return binding;
+}
 
 module.exports = function loadNative() {
+  if (process.env.ATA_NO_NATIVE) return null;
+
+  const isMusl = process.platform === 'linux' ? detectMusl() : false;
+  const candidates = [];
+  const primary = nativePackageName(process.platform, process.arch, isMusl);
+  if (primary) candidates.push(primary);
+  if (process.platform === 'linux') {
+    const alt = nativePackageName(process.platform, process.arch, !isMusl);
+    if (alt) candidates.push(alt);
+  }
+
+  for (const name of candidates) {
+    try {
+      const binding = checkVersion(require(name), name);
+      if (binding) return binding;
+    } catch {
+      // not installed on this platform; keep going
+    }
+  }
+
+  // Contributors running from a source checkout.
   try {
     const path = require('path');
-    const pkg = require('pkg-prebuilds');
-    return pkg(path.join(__dirname, '..'), require('../binding-options'));
+    const binding = checkVersion(
+      require(path.join(__dirname, '..', 'build', 'Release', 'ata.node')),
+      'local build',
+    );
+    if (binding) return binding;
   } catch {
-    return null;
+    // no dev build; fall through
   }
+
+  return null;
 };
+
+module.exports.nativePackageName = nativePackageName;

package/lib/t.js

@@ -124,6 +124,90 @@ function refine(schema, check, opts) {
   return attachRefine(schema, check, opts);
 }
 
+function assertObjectSchema(schema, fn) {
+  if (!schema || typeof schema !== 'object' || schema.type !== 'object' ||
+      !schema.properties || typeof schema.properties !== 'object') {
+    throw new Error(`t.${fn}: expected an object schema with properties`);
+  }
+}
+
+// Copy every top-level keyword except the two the combinator recomputes.
+function cloneMeta(schema) {
+  const out = {};
+  for (const key of Object.keys(schema)) {
+    if (key !== 'properties' && key !== 'required') out[key] = schema[key];
+  }
+  return out;
+}
+
+function pick(schema, keys) {
+  assertObjectSchema(schema, 'pick');
+  const keep = new Set(keys);
+  const props = {};
+  for (const key of Object.keys(schema.properties)) {
+    if (keep.has(key)) props[key] = schema.properties[key];
+  }
+  const required = (schema.required || []).filter((key) => keep.has(key));
+  const out = Object.assign(cloneMeta(schema), { properties: props });
+  if (required.length) out.required = required;
+  return out;
+}
+
+function omit(schema, keys) {
+  assertObjectSchema(schema, 'omit');
+  const drop = new Set(keys);
+  const props = {};
+  for (const key of Object.keys(schema.properties)) {
+    if (!drop.has(key)) props[key] = schema.properties[key];
+  }
+  const required = (schema.required || []).filter((key) => !drop.has(key));
+  const out = Object.assign(cloneMeta(schema), { properties: props });
+  if (required.length) out.required = required;
+  return out;
+}
+
+function partial(schema) {
+  assertObjectSchema(schema, 'partial');
+  return Object.assign(cloneMeta(schema), { properties: schema.properties });
+}
+
+function requiredOf(schema, keys) {
+  assertObjectSchema(schema, 'required');
+  const propKeys = Object.keys(schema.properties);
+  let required;
+  if (keys === undefined) {
+    required = propKeys.slice();
+  } else {
+    const known = new Set(propKeys);
+    required = Array.from(new Set([...(schema.required || []), ...keys])).filter((k) => known.has(k));
+  }
+  const out = Object.assign(cloneMeta(schema), { properties: schema.properties });
+  if (required.length) out.required = required;
+  return out;
+}
+
+function recursive(build, opts) {
+  // Single fixed def name; nesting t.recursive inside itself is unsupported
+  // (both layers would claim '#/$defs/self') and documented as such.
+  const self = { $ref: '#/$defs/self' };
+  const body = build(self);
+  return Object.assign({ $ref: '#/$defs/self', $defs: { self: body } }, opts);
+}
+
+function composite(schemas, opts) {
+  const props = {};
+  const requiredSet = new Set();
+  for (const schema of schemas) {
+    assertObjectSchema(schema, 'composite');
+    for (const key of Object.keys(schema.properties)) props[key] = schema.properties[key];
+    for (const key of schema.required || []) requiredSet.add(key);
+  }
+  const required = Array.from(requiredSet).filter((key) => Object.hasOwn(props, key));
+  const out = { type: 'object', properties: props };
+  if (required.length) out.required = required;
+  return Object.assign(out, opts);
+}
+
 module.exports = {
   string,
   number,
@@ -146,4 +230,10 @@ module.exports = {
   never,
   refine,
   OPTIONAL,
+  pick,
+  omit,
+  partial,
+  required: requiredOf,
+  composite,
+  recursive,
 };

package/lib/version.js

@@ -2,9 +2,9 @@
 
 // The package version, exported as a plain string so neither the default nor
 // the browser entry has to `require('./package.json')`. Bundling package.json
-// would drag dependency strings (e.g. `pkg-prebuilds`) into browser builds
-// even though the runtime never touches them.
+// would drag dependency strings into browser builds even though the runtime
+// never touches them.
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.0.1';
+module.exports = '1.1.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -37,18 +37,14 @@
     "ata": "bin/ata.js"
   },
   "browser": {
-    "pkg-prebuilds": false,
     "./lib/native-load.js": "./lib/native-load.browser.js"
   },
   "scripts": {
-    "install": "node scripts/install.js",
-    "prepublishOnly": "node scripts/regen-safe-regex-source.js && node scripts/check-prebuilds.js && ATA_ALLOW_DOC_PLACEHOLDERS=1 node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
-    "release:check": "node scripts/regen-safe-regex-source.js && node scripts/check-prebuilds.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
+    "prepublishOnly": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && ATA_ALLOW_DOC_PLACEHOLDERS=1 node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
+    "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "prebuild": "pkg-prebuilds-copy --baseDir build/Release --source ata.node --name=ata --strip --napi_version=10",
-    "prebuild-all": "npm run prebuild -- --arch x64 && npm run prebuild -- --arch arm64",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_defs_pointer_alias.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js",
     "test:compat": "node tests/test_compat.js",
@@ -110,22 +106,18 @@
     "t.js",
     "t.mjs",
     "t.d.ts",
-    "binding-options.js",
-    "binding/",
-    "include/",
-    "src/",
-    "deps/",
-    "prebuilds/",
-    "scripts/",
-    "CMakeLists.txt",
+    "bin/",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"
   ],
-  "dependencies": {
-    "node-addon-api": "^8.7.0",
-    "node-api-headers": "^1.8.0",
-    "pkg-prebuilds": "^1.0.0"
+  "optionalDependencies": {
+    "@ata-validator/native-darwin-arm64": "1.1.0",
+    "@ata-validator/native-linux-x64-gnu": "1.1.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.1.0",
+    "@ata-validator/native-linux-x64-musl": "1.1.0",
+    "@ata-validator/native-linux-arm64-musl": "1.1.0",
+    "@ata-validator/native-win32-x64": "1.1.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"
@@ -142,6 +134,8 @@
     "esbuild": "^0.28.0",
     "jsonc-parser": "^3.3.1",
     "mitata": "^1.0.34",
+    "node-addon-api": "^8.7.0",
+    "node-api-headers": "^1.8.0",
     "typebox": "^1.1.7",
     "typescript": "^6.0.3",
     "valibot": "^1.3.1",