ata-validator 1.10.0 → 1.11.0

package/CHANGELOG.md

@@ -2,6 +2,29 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.11.0 - 2026-08-31
+
+### Fixed
+
+- The verdict methods answer the same question as `validate()` again. With `coerceTypes`, `removeAdditional` or a schema `default` in play, `validate()` ran the preprocess pass and `isValidObject()`, `isValidJSON()` and `validateJSON()` did not, so the same validator answered `true` from one and `false` from another for the same document: `validate({ age: '26' })` accepted where `isValidObject({ age: '26' })` rejected. Every path now runs the same pass. Verdict methods on a validator configured this way rewrite the input in place, as `validate()` already did, and the cost of the correction is 0.5 ns on `isValidObject` and 2.7 ns on `isValidJSON`, measured interleaved; validators without those options are unchanged. `tests/test_verdict_preprocess.js` holds all four methods to the same answers.
+
+- The native engine's error codes no longer reach callers untranslated. A type failure answered by the addon came back as `code: 3` with no `keyword` and a `docUrl` pointing at a page that does not exist, while the same failure from the JavaScript engines came back as `ATA1001`; both now report the documented code, keyword and link. `tests/test_native_error_codes.js` holds the table against the enum in `include/ata.h`, so the two cannot drift apart silently.
+- The error generator declined self-referencing schemas by emitting nothing for the reference, which accepted whatever that reference guarded: `{ properties: { foo: { $ref: "#" } }, additionalProperties: false }` accepted `{ foo: { bar: false } }` on that path. It now declines the schema outright and the validator falls back to an engine that answers it correctly. The entry-point agreement test covers the shape.
+
+- `ipv6` gave two different answers depending on which engine ran it, and neither was right. The compiled path refused an IPv4-mapped address such as `::ffff:192.168.1.1`, the interpreted path accepted `::ffff:1.2.3.4.5`, and both accepted a group of five hex digits like `12345::1`. One implementation now answers for every engine, following RFC 4291, checked against Node's own `net.isIPv6` and the suite's corpus.
+
+- `date-time` refuses dates that do not exist. The check ran a regular expression for the shape and then handed the string to `Date.parse`, which rolls an out-of-range day into the next month, so `2026-02-30T00:00:00Z`, `2026-02-29T00:00:00Z` and `2026-12-31T24:00:00Z` were all accepted. The month, the day count for that month in that year, the clock and the offset are now checked directly, per RFC 3339. Schemas that relied on the old leniency will see those values rejected.
+
+- Data that points back at itself no longer exhausts the stack. A document with a cycle, which JSON text cannot express but an in-memory object graph can, threw `RangeError: Maximum call stack size exceeded` on the compiled path while the interpreted engine settled on an answer, so the two engines disagreed. Both now follow the same rule: a value already being checked against a schema is a fixed point and counts as satisfied, and a cycle no longer hides a real violation elsewhere in the document. Validation runs a fast pass that only counts depth and a guarded pass that runs when that depth is exceeded, so ordinary documents pay one integer operation per recursive call. Measured interleaved on a self-referencing schema: a four-node document 22.2 to 30.6 ns, a 200-node document 2077 to 1178 ns, non-recursive schemas unchanged at 3.8 ns. `tests/test_cyclic_input.js` holds all three engines to the same answers.
+
+### Performance
+
+- `ipv6` and `hostname` read the string once as well: 54.7 to 29.6 ns and 45.5 to 28.2 ns, interleaved medians. `ipv6` no longer allocates two arrays per check; `hostname` keeps the answers of the expression it replaces, fuzzed over 300k strings with 0 mismatches.
+
+- `date-time` reads the string once, with no regular expression, no date object and no allocation: 95.0 to 39.4 ns on a valid value with a `Z`, 103.8 to 45.3 ns with a numeric offset, interleaved medians. Fuzzed against a reference that spells out RFC 3339, with 0 mismatches over 300k strings; `tests/test_formats_single_pass.js` keeps both the predicate and the generated form on it.
+
+- A constructed Validator is roughly three times smaller on the heap until it is used. The public methods and the Standard Schema entry moved from per-instance closures built in the constructor to memoized prototype accessors, and the JSON position cache is only allocated when the JSON text path first needs it. Measured per instance on a 10-key object schema, double-gc deltas over 2000 instances: 1.61 KB to 0.43 KB with a shared schema object, 2.33 KB to 1.12 KB when each instance owns its schema, 3.93 KB to 3.30 KB once compiled and used. Construction alone went from 1504 to 855 ns; construction plus first validate pays about 0.9 microseconds more, once, because the compile step's method assignments now go through a defining setter. The hot validate() path is unchanged, measured interleaved. Detached method references (`const f = v.validate`) still work; `tests/test_lazy_instance.js` pins the shape.
+
 ## 1.10.0 - 2026-08-30
 
 ### Performance

package/index.js

@@ -15,6 +15,7 @@ const { needsNormalization } = require("./lib/schema-scan");
 const { isV1Dialect } = require("./lib/dialect");
 const { classify } = require("./lib/shape-classifier");
 const { buildTier0Plan, tier0Validate } = require("./lib/tier0");
+const { createCache: _createPosCache } = require("./lib/data-position-cache");
 
 // Extract default values from a schema tree. Returns a function that applies
 // defaults to an object in-place (mutates), or null if no defaults exist.
@@ -788,89 +789,15 @@ class Validator {
     // Per-validate data position cache. Populated by validateJSON before
     // dispatching to inner validate(); consulted by the rich-error wrap
     // to attach dataFrame entries to each enriched error.
-    this._posCache = require('./lib/data-position-cache').createCache();
+    this._posCache = null; // created by _pos() on first use, only the JSON text path needs it
     this._lastRawInput = null;
 
-    // Lazy stubs: trigger compilation on first call, then re-dispatch
-    this.validate = (data) => {
-      this._ensureCompiled();
-      return this.validate(data);
-    };
-    this.isValidObject = (data) => {
-      // Lazy: classify + build tier 0 plan on first call, not in constructor.
-      const _tier = classify(this._schemaObj);
-      if (_tier.tier === 0) {
-        const _plan = buildTier0Plan(this._schemaObj);
-        let _n = 0;
-        this.isValidObject = (d) => {
-          const r = tier0Validate(_plan, d);
-          if (++_n === 2) {
-            try { this._ensureCodegen(); } catch {}
-          }
-          return r;
-        };
-      } else {
-        this._ensureCodegen();
-        // Codegen can bail on shapes it cannot represent; the full compile
-        // binds the native path or the unsupported thrower instead of
-        // leaving this stub to re-dispatch to itself.
-        if (!this._jsFn) this._ensureCompiled();
-      }
-      return this.isValidObject(data);
-    };
-    this.validateJSON = (jsonStr) => {
-      this._ensureCompiled();
-      return this.validateJSON(jsonStr);
-    };
-    this.isValidJSON = (jsonStr) => {
-      this._ensureCompiled();
-      return this.isValidJSON(jsonStr);
-    };
-    this.validateAndParse = (jsonStr) => {
-      if (!native) throw new Error('Native addon required for validateAndParse()');
-      this._ensureCompiled();
-      return this.validateAndParse(jsonStr);
-    };
-    this.isValid = (buf) => {
-      if (!native) throw new Error('Native addon required for isValid() — use validate() or isValidObject() instead');
-      this._ensureCompiled();
-      return this.isValid(buf);
-    };
-    this.countValid = (ndjsonBuf) => {
-      if (!native) throw new Error('Native addon required for countValid()');
-      this._ensureCompiled();
-      return this.countValid(ndjsonBuf);
-    };
-    this.batchIsValid = (buffers) => {
-      if (!native) throw new Error('Native addon required for batchIsValid()');
-      this._ensureCompiled();
-      return this.batchIsValid(buffers);
-    };
+    // Public methods start as memoized accessors on the prototype; nothing is
+    // allocated per instance until one is first read. See _defineLazyMethod
+    // below the class.
 
-    // ~standard uses self.validate() -- works with lazy because it goes through
-    // the instance property which gets swapped after compilation
-    const self = this;
-    Object.defineProperty(this, "~standard", {
-      value: Object.freeze({
-        version: 1,
-        vendor: "ata-validator",
-        validate(value) {
-          const result = self.validate(value);
-          if (result.valid) {
-            return { value };
-          }
-          return {
-            issues: result.errors.map((err) => ({
-              message: err.message,
-              path: parsePointerPath(err.instancePath),
-            })),
-          };
-        },
-      }),
-      writable: false,
-      enumerable: false,
-      configurable: false,
-    });
+    // "~standard" (Standard Schema V1) is a lazy prototype accessor too;
+    // see below the class. Consumers only pay for it if they read it.
 
     // Populate identity cache so repeated `new Validator(sameSchema)` short-circuits.
     if (!opts && typeof schema === "object" && schema !== null) {
@@ -882,6 +809,22 @@ class Validator {
   // meta-schema, which addSchema() may only have registered just now. Run once,
   // before anything reads the schema, and before `_schemaStr` is computed from
   // it. After this addSchema() is refused, so the answer cannot go stale.
+  // Whether validation is preceded by a pass that rewrites the input:
+  // coercion, removal of undeclared keys, or filling in defaults. The verdict
+  // methods have to take the same path when it is, so the quick bindings that
+  // answer from the compiled function alone are not used for these validators.
+  _needsPreprocess() {
+    const o = this._options;
+    if (o.coerceTypes || o.removeAdditional) return true;
+    if (o.useDefaults === false) return false;
+    if (!this._schemaStr) this._schemaStr = JSON.stringify(this._schemaObj);
+    return this._schemaStr.includes('"default"');
+  }
+
+  _pos() {
+    return this._posCache || (this._posCache = _createPosCache());
+  }
+
   _ensureVocabularies() {
     if (this._vocabulariesApplied) return;
     this._vocabulariesApplied = true;
@@ -1180,14 +1123,26 @@ class Validator {
           return result;
         };
       }
-      this.isValidObject = jsFn;
+      // The verdict methods answer validate()'s question without building the
+      // error list, so they run the same preprocess pass. Skipping it made the
+      // two disagree on input that coercion or a default would have fixed.
+      this.isValidObject = preprocess
+        ? (data) => { preprocess(data); return jsFn(data) }
+        : jsFn;
       const hybridFn = jsFn._hybridFactory
         ? jsFn._hybridFactory(VALID_RESULT, errFn)
         : null;
-      const jsonValidateFn = safeCombinedFn
+      const jsonValidateInner = safeCombinedFn
         || hybridFn
         || ((obj) => (jsFn(obj) ? VALID_RESULT : errFn(obj)));
-      this.validateJSON = useSimdjsonForLarge && native
+      // Parsed text takes the same preprocess pass as a parsed object, so
+      // validate(obj) and validateJSON(text) answer the same for the same
+      // document. Without it, coercion, removal and defaults applied on one
+      // path and not the other.
+      const jsonValidateFn = preprocess
+        ? (obj) => { preprocess(obj); return jsonValidateInner(obj) }
+        : jsonValidateInner;
+      this.validateJSON = useSimdjsonForLarge && native && !preprocess
         ? (jsonStr) => {
             if (jsonStr.length >= SIMDJSON_THRESHOLD) {
               this._ensureNative();
@@ -1214,7 +1169,22 @@ class Validator {
             this._ensureNative();
             return this._compiled.validateJSON(jsonStr);
           };
-      this.isValidJSON = useSimdjsonForLarge && native
+      // The addon validates the bytes as they are, which is the wrong answer
+      // when the schema asks for coercion, removal or defaults: those change
+      // what counts as valid. With a preprocess pass configured the text is
+      // parsed and run through the same path validate() takes.
+      const verdictFromText = (jsonStr) => {
+        let parsed;
+        try {
+          parsed = JSON.parse(jsonStr);
+        } catch (e) {
+          if (!(e instanceof SyntaxError)) throw e;
+          return false;
+        }
+        if (preprocess) preprocess(parsed);
+        return jsFn(parsed);
+      };
+      this.isValidJSON = useSimdjsonForLarge && native && !preprocess
         ? (jsonStr) => {
             if (jsonStr.length >= SIMDJSON_THRESHOLD) {
               this._ensureNative();
@@ -1223,21 +1193,9 @@ class Validator {
                 Buffer.from(jsonStr),
               );
             }
-            try {
-              return jsFn(JSON.parse(jsonStr));
-            } catch (e) {
-              if (!(e instanceof SyntaxError)) throw e;
-              return false;
-            }
+            return verdictFromText(jsonStr);
           }
-        : (jsonStr) => {
-            try {
-              return jsFn(JSON.parse(jsonStr));
-            } catch (e) {
-              if (!(e instanceof SyntaxError)) throw e;
-              return false;
-            }
-          };
+        : verdictFromText;
       // validateAndParse: parse the JSON, then validate. Pure JS (JSON.parse +
       // validate) so it works with or without the native addon and in browsers.
       {
@@ -1416,7 +1374,7 @@ class Validator {
         if (result && result.valid === false && result !== ABORT_EARLY_RESULT) {
           // Positions come from the raw input when validateJSON set one;
           // resolved eagerly since the cache is reset per call.
-          const positions = (enrich && self._lastRawInput != null) ? self._posCache.get(self._lastRawInput) : null;
+          const positions = (enrich && self._lastRawInput != null) ? self._pos().get(self._lastRawInput) : null;
           if (positions) self._posCache.reset();
           let cached = null;
           return {
@@ -1481,7 +1439,7 @@ class Validator {
             let parsedData;
             try { parsedData = JSON.parse(jsonStr); } catch { parsedData = undefined; }
             if (!first || !first.docUrl) {
-              const positions = (this._lastRawInput != null) ? this._posCache.get(this._lastRawInput) : null;
+              const positions = (this._lastRawInput != null) ? this._pos().get(this._lastRawInput) : null;
               const enriched = result.errors.map((e) => enrich(e, {
                 data: parsedData,
                 positions,
@@ -1501,7 +1459,7 @@ class Validator {
               return { valid: false, errors: enriched };
             }
             // Already-enriched path: still attach dataFrame if missing.
-            const positions = (this._lastRawInput != null) ? this._posCache.get(this._lastRawInput) : null;
+            const positions = (this._lastRawInput != null) ? this._pos().get(this._lastRawInput) : null;
             if (positions) {
               for (const e of result.errors) {
                 if (e && !e.dataFrame) {
@@ -1673,6 +1631,13 @@ class Validator {
 
   _ensureCodegen() {
     if (this._jsFn) return;
+    // A validator that rewrites its input cannot use the binding below: that
+    // one answers from the compiled function alone and would skip the rewrite,
+    // so isValidObject() and validate() would disagree.
+    if (this._needsPreprocess()) {
+      this._ensureCompiled();
+      return;
+    }
     this._ensureVocabularies();
     if (typeof process !== 'undefined' && process.env && process.env.ATA_FORCE_NAPI) return;
     if (!this._schemaStr) this._schemaStr = JSON.stringify(this._schemaObj);
@@ -2032,6 +1997,120 @@ function defineSchema (schema) {
   return schema;
 }
 
+// Public methods start as memoized accessors on the prototype. A fresh
+// Validator allocates none of them; the first read of a method builds the
+// bound closure, stores it on the instance as an ordinary writable property
+// and returns it. The setter keeps the compile step's plain assignments
+// (`this.validate = fn`) working before the getter has ever run. Detached
+// use (`const f = v.validate`) keeps working because the closure binds the
+// instance.
+// Standard Schema V1. Built on first read, then pinned to the instance with
+// the same descriptor the constructor used to install eagerly.
+Object.defineProperty(Validator.prototype, "~standard", {
+  configurable: true,
+  get() {
+    const self = this;
+    const std = Object.freeze({
+      version: 1,
+      vendor: "ata-validator",
+      validate(value) {
+        const result = self.validate(value);
+        if (result.valid) {
+          return { value };
+        }
+        return {
+          issues: result.errors.map((err) => ({
+            message: err.message,
+            path: parsePointerPath(err.instancePath),
+          })),
+        };
+      },
+    });
+    Object.defineProperty(this, "~standard", {
+      value: std,
+      writable: false,
+      enumerable: false,
+      configurable: false,
+    });
+    return std;
+  },
+});
+
+function _defineLazyMethod(name, maker) {
+  Object.defineProperty(Validator.prototype, name, {
+    configurable: true,
+    get() {
+      const fn = maker(this);
+      Object.defineProperty(this, name, { value: fn, writable: true, configurable: true, enumerable: true });
+      return fn;
+    },
+    set(fn) {
+      Object.defineProperty(this, name, { value: fn, writable: true, configurable: true, enumerable: true });
+    },
+  });
+}
+
+_defineLazyMethod('validate', (self) => (data) => {
+  self._ensureCompiled();
+  return self.validate(data);
+});
+_defineLazyMethod('isValidObject', (self) => (data) => {
+  // A validator that rewrites its input goes through the full compile, which
+  // binds a verdict method that runs the rewrite first.
+  if (self._needsPreprocess()) {
+    self._ensureCompiled();
+    return self.isValidObject(data);
+  }
+  // Lazy: classify + build tier 0 plan on first call, not in constructor.
+  const _tier = classify(self._schemaObj);
+  if (_tier.tier === 0) {
+    const _plan = buildTier0Plan(self._schemaObj);
+    let _n = 0;
+    self.isValidObject = (d) => {
+      const r = tier0Validate(_plan, d);
+      if (++_n === 2) {
+        try { self._ensureCodegen(); } catch {}
+      }
+      return r;
+    };
+  } else {
+    self._ensureCodegen();
+    // Codegen can bail on shapes it cannot represent; the full compile
+    // binds the native path or the unsupported thrower instead of
+    // leaving this stub to re-dispatch to itself.
+    if (!self._jsFn) self._ensureCompiled();
+  }
+  return self.isValidObject(data);
+});
+_defineLazyMethod('validateJSON', (self) => (jsonStr) => {
+  self._ensureCompiled();
+  return self.validateJSON(jsonStr);
+});
+_defineLazyMethod('isValidJSON', (self) => (jsonStr) => {
+  self._ensureCompiled();
+  return self.isValidJSON(jsonStr);
+});
+_defineLazyMethod('validateAndParse', (self) => (jsonStr) => {
+  if (!native) throw new Error('Native addon required for validateAndParse()');
+  self._ensureCompiled();
+  return self.validateAndParse(jsonStr);
+});
+_defineLazyMethod('isValid', (self) => (buf) => {
+  if (!native) throw new Error('Native addon required for isValid() — use validate() or isValidObject() instead');
+  self._ensureCompiled();
+  return self.isValid(buf);
+});
+_defineLazyMethod('countValid', (self) => (ndjsonBuf) => {
+  if (!native) throw new Error('Native addon required for countValid()');
+  self._ensureCompiled();
+  return self.countValid(ndjsonBuf);
+});
+_defineLazyMethod('batchIsValid', (self) => (buffers) => {
+  if (!native) throw new Error('Native addon required for batchIsValid()');
+  self._ensureCompiled();
+  return self.batchIsValid(buffers);
+});
+
 module.exports = {
   Validator,
   compile,

package/lib/enrich-error.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { CODES, codeFor } = require('./error-codes');
+const { CODES, codeFor, fromNative } = require('./error-codes');
 const { suggestFor } = require('./suggestions');
 
 const DOC_BASE = 'https://ata-validator.com/e/';
@@ -130,12 +130,19 @@ function rankFor (keyword) {
 function enrich (rawErr, opts) {
   const data = opts && opts.data;
   const positions = opts && opts.positions;
-  const keyword = rawErr.keyword;
   const format = rawErr.params && rawErr.params.format;
+  // The native engine reports its own enum as a number. Translate it to the
+  // keyword and public code the JavaScript engines use, so an error means the
+  // same thing whichever engine produced it.
+  const fromAddon = typeof rawErr.code === 'number' ? fromNative(rawErr.code, format) : null;
+  const keyword = rawErr.keyword || (fromAddon && fromAddon.keyword);
   // Prefer a code the codegen already attached (e.g. branch-collapse emits
   // ATA4001/4002/4003 distinguishing zero/multi/anyOf failure modes). The
   // keyword-derived lookup only finds the first match for `keyword: 'oneOf'`.
-  const code = rawErr.code || codeFor(keyword, format) || 'ATA9001';
+  const code = (fromAddon && fromAddon.code) ||
+    (typeof rawErr.code === 'string' && rawErr.code) ||
+    codeFor(keyword, format) ||
+    'ATA9001';
   const meta = CODES[code];
   const path = rawErr.instancePath != null ? rawErr.instancePath : (rawErr.path || '');
 

package/lib/error-codes.js

@@ -100,4 +100,57 @@ function codeFor (keyword, format) {
   return hit === undefined ? null : hit;
 }
 
-module.exports = { CODES, get, all, codeFor };
+
+// The native engine reports its own `error_code` enum from include/ata.h as an
+// ordinal. Nothing outside the addon should ever see one: an error that came
+// from there carries the same public code and keyword as the same failure from
+// the JavaScript engines. Ordinals are positional, so this table follows the
+// enum's declaration order and `tests/test_native_error_codes.js` fails if the
+// two drift apart.
+const NATIVE_KEYWORDS = [
+  null,                     // 0 ok
+  '__parse__',              // 1 invalid_json
+  '__compile__',            // 2 invalid_schema
+  'type',                   // 3 type_mismatch
+  'required',               // 4 required_property_missing
+  'additionalProperties',   // 5 additional_property_not_allowed
+  'enum',                   // 6 enum_mismatch
+  'const',                  // 7 const_mismatch
+  'minimum',                // 8 minimum_violation
+  'maximum',                // 9 maximum_violation
+  'exclusiveMinimum',       // 10 exclusive_minimum_violation
+  'exclusiveMaximum',       // 11 exclusive_maximum_violation
+  'minLength',              // 12 min_length_violation
+  'maxLength',              // 13 max_length_violation
+  'pattern',                // 14 pattern_mismatch
+  'format',                 // 15 format_mismatch
+  'minItems',               // 16 min_items_violation
+  'maxItems',               // 17 max_items_violation
+  'uniqueItems',            // 18 unique_items_violation
+  'minProperties',          // 19 min_properties_violation
+  'maxProperties',          // 20 max_properties_violation
+  'multipleOf',             // 21 multiple_of_violation
+  'allOf',                  // 22 all_of_failed
+  'anyOf',                  // 23 any_of_failed
+  'oneOf',                  // 24 one_of_failed
+  'not',                    // 25 not_failed
+  '$ref',                   // 26 ref_not_found
+  'if',                     // 27 if_then_else_failed
+]
+
+// Keyword and public code for a native ordinal, or null when the ordinal is
+// outside the enum, which would mean the addon is newer than this table.
+function fromNative (ordinal, format) {
+  if (typeof ordinal !== 'number' || !Number.isInteger(ordinal)) return null
+  const keyword = NATIVE_KEYWORDS[ordinal]
+  if (!keyword) return null
+  // codeFor('format') answers with the first format code, which names a
+  // specific format. Without knowing which format failed, the generic one is
+  // the honest answer.
+  const code = keyword === 'format'
+    ? (format ? codeFor('format', format) || 'ATA3099' : 'ATA3099')
+    : codeFor(keyword) || 'ATA9001'
+  return { keyword, code }
+}
+
+module.exports = { CODES, get, all, codeFor, fromNative, NATIVE_KEYWORDS };

package/lib/formats.js

@@ -21,13 +21,83 @@ function date (s) {
   return m >= 1 && m <= 12 && d >= 1 && d <= 31;
 }
 
+// RFC 3339 date-time, read once. The form this replaces ran a regular
+// expression for the shape and then `Date.parse` for the calendar, which
+// builds a date object to answer a question about the string. Everything the
+// parse rejected is checked here directly: month, the day count for that month
+// in that year, and the ranges of the clock and the offset.
+function daysInMonth (year, month) {
+  if (month === 2) {
+    const leap = (year % 4 === 0 && year % 100 !== 0) || year % 400 === 0;
+    return leap ? 29 : 28;
+  }
+  return month === 4 || month === 6 || month === 9 || month === 11 ? 30 : 31;
+}
+
+function twoDigits (s, i) {
+  return (s.charCodeAt(i) - 48) * 10 + (s.charCodeAt(i + 1) - 48);
+}
+
+function dateTime (s) {
+  const n = s.length;
+  // The shortest accepted form is 2026-08-31T12:00:00Z
+  if (n < 20) return false;
+  for (let i = 0; i < 19; i++) {
+    const c = s.charCodeAt(i);
+    if (i === 4 || i === 7) { if (c !== 45) return false; continue; }
+    if (i === 10) { if (c !== 84 && c !== 116) return false; continue; }
+    if (i === 13 || i === 16) { if (c !== 58) return false; continue; }
+    if (c < 48 || c > 57) return false;
+  }
+
+  const year = (s.charCodeAt(0) - 48) * 1000 + (s.charCodeAt(1) - 48) * 100 +
+    (s.charCodeAt(2) - 48) * 10 + (s.charCodeAt(3) - 48);
+  const month = twoDigits(s, 5);
+  if (month < 1 || month > 12) return false;
+  const day = twoDigits(s, 8);
+  if (day < 1 || day > daysInMonth(year, month)) return false;
+  if (twoDigits(s, 11) > 23) return false;
+  if (twoDigits(s, 14) > 59) return false;
+  if (twoDigits(s, 17) > 59) return false;
+
+  let i = 19;
+  if (s.charCodeAt(i) === 46) {
+    i++;
+    const start = i;
+    while (i < n) {
+      const c = s.charCodeAt(i);
+      if (c < 48 || c > 57) break;
+      i++;
+    }
+    if (i === start) return false;
+  }
+
+  const c = s.charCodeAt(i);
+  if (c === 90 || c === 122) return i === n - 1;
+  if (c !== 43 && c !== 45) return false;
+  if (n - i !== 6) return false;
+  if (!isDigit(s.charCodeAt(i + 1)) || !isDigit(s.charCodeAt(i + 2))) return false;
+  if (s.charCodeAt(i + 3) !== 58) return false;
+  if (!isDigit(s.charCodeAt(i + 4)) || !isDigit(s.charCodeAt(i + 5))) return false;
+  if (twoDigits(s, i + 1) > 23) return false;
+  if (twoDigits(s, i + 4) > 59) return false;
+  return true;
+}
+
 // Four decimal octets, no leading zeros, no empty octets, nothing else.
+// Also used for the dotted tail of an IPv4-mapped IPv6 address, which is why
+// the work is done over a range rather than a whole string: taking a slice for
+// it would allocate on a path that exists to avoid allocating.
 function ipv4 (s) {
-  const n = s.length;
+  return ipv4Range(s, 0, s.length);
+}
+
+function ipv4Range (s, from, to) {
+  const n = to - from;
   if (n < 7 || n > 15) return false;
   let octets = 0, value = 0, digits = 0;
-  for (let i = 0; i <= n; i++) {
-    const c = i < n ? s.charCodeAt(i) : 46;
+  for (let i = from; i <= to; i++) {
+    const c = i < to ? s.charCodeAt(i) : 46;
     if (c === 46) {
       if (digits === 0 || value > 255) return false;
       octets++; value = 0; digits = 0;
@@ -41,6 +111,90 @@ function ipv4 (s) {
   return octets === 4;
 }
 
+// RFC 4291 address: up to eight groups of one to four hex digits, at most one
+// run of "::" standing in for the zero groups, and an optional dotted IPv4
+// tail in the last position, which counts as two groups. The forms this
+// replaces were a character-class test plus two `split(':')` calls, which
+// allocated twice and accepted things like "12345::1"; they also disagreed
+// with each other about an IPv4 tail. Answers match Node's own `net.isIPv6`,
+// which the test uses as its oracle.
+function ipv6 (s) {
+  const n = s.length;
+  if (n < 2 || n > 45) return false;
+
+  let end = n;
+  let groups = 0;
+  // A dot can only belong to a trailing IPv4 address, which fills two groups.
+  const dot = s.indexOf('.');
+  if (dot !== -1) {
+    const lastColon = s.lastIndexOf(':', dot);
+    if (lastColon === -1) return false;
+    if (!ipv4Range(s, lastColon + 1, n)) return false;
+    end = lastColon + 1;   // keep the colon: the group scan ends on it
+    groups = 2;
+  }
+
+  let compressed = false;
+  let digits = 0;
+  let i = 0;
+
+  if (s.charCodeAt(0) === 58 && s.charCodeAt(1) !== 58) return false;
+
+  while (i < end) {
+    const c = s.charCodeAt(i);
+    if (c === 58) {
+      if (digits > 0) { groups++; digits = 0; }
+      if (i + 1 < n && s.charCodeAt(i + 1) === 58) {
+        if (compressed) return false;
+        compressed = true;
+        i += 2;
+        if (i < n && s.charCodeAt(i) === 58) return false;
+        continue;
+      }
+      i++;
+      // A single colon must have something on both sides, and the group scan
+      // ending on a colon only happens when an IPv4 tail follows it.
+      if (i === end && end === n) return false;
+      continue;
+    }
+    if (isDigit(c) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70)) {
+      if (++digits > 4) return false;
+      i++;
+      continue;
+    }
+    return false;
+  }
+  if (digits > 0) groups++;
+
+  if (groups > 8) return false;
+  return compressed ? groups < 8 : groups === 8;
+}
+
+// Labels of letters, digits and hyphens, each 1 to 63 characters, none
+// starting or ending with a hyphen, joined by single dots, 253 characters at
+// most. Same answers as the expression it replaces, read once.
+function hostname (s) {
+  const n = s.length;
+  if (n === 0 || n > 253) return false;
+  let labelLength = 0;
+  let previous = 46; // a dot, so a leading hyphen is refused like a leading dot
+  for (let i = 0; i < n; i++) {
+    const c = s.charCodeAt(i);
+    if (c === 46) {
+      if (labelLength === 0 || previous === 45) return false;
+      labelLength = 0;
+      previous = c;
+      continue;
+    }
+    const alnum = isDigit(c) || (c >= 97 && c <= 122) || (c >= 65 && c <= 90);
+    if (!alnum && c !== 45) return false;
+    if (c === 45 && previous === 46) return false; // label starts with a hyphen
+    if (++labelLength > 63) return false;
+    previous = c;
+  }
+  return labelLength !== 0 && previous !== 45;
+}
+
 // Source twins. `v` is the expression holding the string; when `isStr` is
 // false the check is wrapped in a typeof guard, matching FORMAT_CODEGEN's
 // convention. Each returns a statement that `return false`s on mismatch.
@@ -50,8 +204,59 @@ function dateSource (v, isStr) {
   return guard(v, isStr, `if(${v}.length!==10)return false;for(let _i=0;_i<10;_i++){const _c=${v}.charCodeAt(_i);if(_i===4||_i===7){if(_c!==45)return false}else if(_c<48||_c>57)return false}const _m=(${v}.charCodeAt(5)-48)*10+(${v}.charCodeAt(6)-48),_d=(${v}.charCodeAt(8)-48)*10+(${v}.charCodeAt(9)-48);if(_m<1||_m>12||_d<1||_d>31)return false`);
 }
 
+function dateTimeSource (v, isStr) {
+  return guard(v, isStr, `const _n=${v}.length;if(_n<20)return false;for(let _i=0;_i<19;_i++){const _c=${v}.charCodeAt(_i);if(_i===4||_i===7){if(_c!==45)return false;continue}if(_i===10){if(_c!==84&&_c!==116)return false;continue}if(_i===13||_i===16){if(_c!==58)return false;continue}if(_c<48||_c>57)return false}` +
+    `const _y=(${v}.charCodeAt(0)-48)*1000+(${v}.charCodeAt(1)-48)*100+(${v}.charCodeAt(2)-48)*10+(${v}.charCodeAt(3)-48);` +
+    `const _mo=(${v}.charCodeAt(5)-48)*10+(${v}.charCodeAt(6)-48);if(_mo<1||_mo>12)return false;` +
+    `const _dm=_mo===2?(((_y%4===0&&_y%100!==0)||_y%400===0)?29:28):(_mo===4||_mo===6||_mo===9||_mo===11?30:31);` +
+    `const _d=(${v}.charCodeAt(8)-48)*10+(${v}.charCodeAt(9)-48);if(_d<1||_d>_dm)return false;` +
+    `if((${v}.charCodeAt(11)-48)*10+(${v}.charCodeAt(12)-48)>23)return false;` +
+    `if((${v}.charCodeAt(14)-48)*10+(${v}.charCodeAt(15)-48)>59)return false;` +
+    `if((${v}.charCodeAt(17)-48)*10+(${v}.charCodeAt(18)-48)>59)return false;` +
+    `let _i2=19;if(${v}.charCodeAt(19)===46){_i2=20;const _st=_i2;while(_i2<_n){const _c2=${v}.charCodeAt(_i2);if(_c2<48||_c2>57)break;_i2++}if(_i2===_st)return false}` +
+    `const _tz=${v}.charCodeAt(_i2);` +
+    `if(_tz===90||_tz===122){if(_i2!==_n-1)return false}` +
+    `else{if(_tz!==43&&_tz!==45)return false;if(_n-_i2!==6)return false;` +
+    `const _oh=${v}.charCodeAt(_i2+1),_oh2=${v}.charCodeAt(_i2+2),_om=${v}.charCodeAt(_i2+4),_om2=${v}.charCodeAt(_i2+5);` +
+    `if(_oh<48||_oh>57||_oh2<48||_oh2>57||_om<48||_om>57||_om2<48||_om2>57)return false;` +
+    `if(${v}.charCodeAt(_i2+3)!==58)return false;` +
+    `if((_oh-48)*10+(_oh2-48)>23)return false;if((_om-48)*10+(_om2-48)>59)return false}`);
+}
+
+function hostnameSource (v, isStr) {
+  return guard(v, isStr, `const _n=${v}.length;if(_n===0||_n>253)return false;let _ll=0,_pv=46;` +
+    `for(let _i=0;_i<_n;_i++){const _c=${v}.charCodeAt(_i);` +
+    `if(_c===46){if(_ll===0||_pv===45)return false;_ll=0;_pv=_c;continue}` +
+    `const _an=(_c>=48&&_c<=57)||(_c>=97&&_c<=122)||(_c>=65&&_c<=90);` +
+    `if(!_an&&_c!==45)return false;` +
+    `if(_c===45&&_pv===46)return false;` +
+    `if(++_ll>63)return false;_pv=_c}` +
+    `if(_ll===0||_pv===45)return false`);
+}
+
+function ipv6Source (v, isStr) {
+  return guard(v, isStr, `const _n=${v}.length;if(_n<2||_n>45)return false;let _end=_n,_g=0;` +
+    `const _dot=${v}.indexOf('.');` +
+    `if(_dot!==-1){const _lc=${v}.lastIndexOf(':',_dot);if(_lc===-1)return false;` +
+    `{const _f=_lc+1,_t=_n,_ln=_t-_f;if(_ln<7||_ln>15)return false;let _o=0,_val=0,_dg=0;` +
+    `for(let _i=_f;_i<=_t;_i++){const _c=_i<_t?${v}.charCodeAt(_i):46;` +
+    `if(_c===46){if(_dg===0||_val>255)return false;_o++;_val=0;_dg=0;if(_o>4)return false}` +
+    `else if(_c>=48&&_c<=57){if(_dg===1&&_val===0)return false;_val=_val*10+(_c-48);_dg++;if(_dg>3)return false}` +
+    `else return false}if(_o!==4)return false}` +
+    `_end=_lc+1;_g=2}` +
+    `let _cp=false,_dg2=0,_i2=0;` +
+    `if(${v}.charCodeAt(0)===58&&${v}.charCodeAt(1)!==58)return false;` +
+    `while(_i2<_end){const _c2=${v}.charCodeAt(_i2);` +
+    `if(_c2===58){if(_dg2>0){_g++;_dg2=0}` +
+    `if(_i2+1<_n&&${v}.charCodeAt(_i2+1)===58){if(_cp)return false;_cp=true;_i2+=2;if(_i2<_n&&${v}.charCodeAt(_i2)===58)return false;continue}` +
+    `_i2++;if(_i2===_end&&_end===_n)return false;continue}` +
+    `if((_c2>=48&&_c2<=57)||(_c2>=97&&_c2<=102)||(_c2>=65&&_c2<=70)){if(++_dg2>4)return false;_i2++;continue}` +
+    `return false}` +
+    `if(_dg2>0)_g++;if(_g>8)return false;if(_cp){if(_g>=8)return false}else if(_g!==8)return false`);
+}
+
 function ipv4Source (v, isStr) {
   return guard(v, isStr, `const _n=${v}.length;if(_n<7||_n>15)return false;let _o=0,_val=0,_dg=0;for(let _i=0;_i<=_n;_i++){const _c=_i<_n?${v}.charCodeAt(_i):46;if(_c===46){if(_dg===0||_val>255)return false;_o++;_val=0;_dg=0;if(_o>4)return false}else if(_c>=48&&_c<=57){if(_dg===1&&_val===0)return false;_val=_val*10+(_c-48);_dg++;if(_dg>3)return false}else return false}if(_o!==4)return false`);
 }
 
-module.exports = { date, ipv4, dateSource, ipv4Source };
+module.exports = { date, ipv4, dateTime, ipv6, hostname, dateSource, ipv4Source, dateTimeSource, ipv6Source, hostnameSource };

package/lib/interpreter.js

@@ -251,15 +251,15 @@ const _formats = require('./formats');
 const FORMAT_CHECKS = {
   email: (s) => { const at = s.indexOf('@'); return at > 0 && at < s.length - 1 && s.indexOf('.', at) > at + 1; },
   date: _formats.date,
-  'date-time': (s) => /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/.test(s) && !isNaN(Date.parse(s)),
+  'date-time': _formats.dateTime,
   time: (s) => /^([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d+)?([Zz]|[+-]\d{2}:\d{2})?$/.test(s),
   duration: (s) => /^P(?:\d+Y)?(?:\d+M)?(?:\d+W)?(?:\d+D)?(?:T(?:\d+H)?(?:\d+M)?(?:\d+(?:\.\d+)?S)?)?$/.test(s) && s !== 'P' && !s.endsWith('T'),
   uuid: (s) => s.length === 36 && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s),
   uri: (s) => /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(s) && !/[\s\u0000-\u001f\u007f]/.test(s),
   'uri-reference': (s) => !/[\s\u0000-\u001f\u007f]/.test(s),
   ipv4: _formats.ipv4,
-  ipv6: (s) => s !== '' && /^[0-9a-fA-F:.]+$/.test(s) && s.split(':').length >= 3 && s.split(':').length <= 8,
-  hostname: (s) => s.length > 0 && s.length <= 253 && /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(s),
+  ipv6: _formats.ipv6,
+  hostname: _formats.hostname,
   regex: (s) => { try { new RegExp(s, 'u'); return true; } catch { try { new RegExp(s); return true; } catch { return false; } } },
   'json-pointer': (s) => s === '' || (/^\//.test(s) && !/~(?![01])/.test(s)),
 };

package/lib/js-compiler.js

@@ -764,7 +764,7 @@ const FORMAT_CHECKS = {
   date: _formats.date,
   uuid: (s) => s.length === 36 && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s),
   ipv4: _formats.ipv4,
-  hostname: (s) => s.length > 0 && s.length <= 253 && /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)*$/i.test(s),
+  hostname: _formats.hostname,
 }
 
 // Dangerous JS property names that exist on Object.prototype
@@ -850,6 +850,49 @@ function hasNestedIdScope(node, isRoot = true) {
 // the generated code the same way `$ref: "#"` does at the root. A plain
 // cross-reference (A -> B where B does not refer back) is not on a cycle and
 // still inlines.
+// Data can point back at itself, and a schema that references itself would
+// then recurse until the stack runs out. Validation runs in two passes: the
+// fast one counts depth and gives up past CYCLE_DEPTH, the second re-runs with
+// a set of the values currently under check, where a value met twice is a
+// fixed point and counts as satisfied. That is what the interpreted engine
+// does, so both engines answer the same on cyclic input. Legitimate documents
+// never reach the threshold, so they only pay the counter.
+// Raised by a generator that meets a construct it cannot express. The entry
+// point turns it into a decline, so the caller falls back to an engine that
+// can. Emitting nothing would mean "everything is valid", which is the failure
+// mode this project has shipped three times in $ref handling; declining is the
+// only safe way out.
+const DECLINE = Symbol('ata.decline')
+
+const CYCLE_DEPTH = 512
+
+// Declarations the guarded functions close over. Emitted once, ahead of them.
+function emitGuardState () {
+  return 'const _CYC={};const _stk=new Set();let _sd=0,_sg=false\n  '
+}
+
+// Wraps a self-recursive root: `name` is the guarded entry, `name`_b the body.
+function emitRootGuard (name, args, onRepeat) {
+  const call = `${name}_b(${args})`
+  return (
+    `function ${name}(${args}){\n  ` +
+    `if(_sg){if(typeof d!=='object'||d===null)return ${call};if(_stk.has(d))return ${onRepeat};_stk.add(d);try{return ${call}}finally{_stk.delete(d)}}\n  ` +
+    `if(++_sd>${CYCLE_DEPTH})throw _CYC\n  const _r=${call}\n  _sd--\n  return _r\n  }\n  `
+  )
+}
+
+// Runs `attempt`, and on the depth signal runs it again under the guard.
+// `reset` clears anything the abandoned pass left behind.
+function emitGuardedRun (attempt, reset, defSets) {
+  const clears = ['_stk.clear()'].concat(defSets.map((n) => `${n}_s.clear()`)).join(';')
+  return (
+    `_sd=0\n  try{${attempt}}catch(_err){\n  ` +
+    `if(_err!==_CYC)throw _err\n  ` +
+    `${reset}_sg=true;${clears}\n  ` +
+    `try{${attempt}}finally{_sg=false}\n  }\n  `
+  )
+}
+
 function cyclicDefNames (defs) {
   const out = new Set()
   if (!defs || typeof defs !== 'object') return out
@@ -1417,18 +1460,33 @@ function compileToJSCodegen(schema, schemaMap, userFormats) {
     }
   }
 
+  const defSets = ctx.defFns ? Array.from(ctx.defFns.values()) : []
+  const needsGuard = ctx.usesRecursion || defSets.length > 0
+
   let body, hybridBody
   if (ctx.usesRecursion) {
-    // Self-recursive: wrap in named function
-    body = `function _validate(d){\n  ${checkStr}\n  return true\n  }\n  return _validate(d)`
-    // Hybrid: keep _validate as boolean, wrap only the outer call
-    hybridBody = `function _validate(d){\n  ${checkStr}\n  return true\n  }\n  return _validate(d)?R:E(d)`
+    // Self-recursive: a named body reached through the cycle guard, so data
+    // that points back at itself settles instead of exhausting the stack.
+    const decl = emitRootGuard('_validate', 'd', 'true') +
+      `function _validate_b(d){\n  ${checkStr}\n  return true\n  }\n  `
+    const run = emitGuardedRun('return _validate(d)', '', defSets)
+    body = `${decl}function _run(d){\n  ${run}\n  }\n  return _run(d)`
+    // Hybrid: keep the boolean answer, wrap only the outer call
+    hybridBody = `${decl}function _run(d){\n  ${run}\n  }\n  return _run(d)?R:E(d)`
+  } else if (defSets.length > 0) {
+    // No self-reference at the root, but a def on a cycle can still be
+    // re-entered with the same value; the guarded functions need their state.
+    const run = emitGuardedRun(`return _body(d)`, '', defSets)
+    body = `function _body(d){\n  ${checkStr}\n  return true\n  }\n  function _run(d){\n  ${run}\n  }\n  return _run(d)`
+    hybridBody = `function _body(d){\n  ${checkStr}\n  return true\n  }\n  function _run(d){\n  ${run}\n  }\n  return _run(d)?R:E(d)`
   } else {
     body = checkStr + '\n  return true'
     hybridBody = replaceTopLevel(checkStr + '\n  return R')
   }
 
-  const preambleStr = ctx.preamble && ctx.preamble.length ? ctx.preamble.join('\n  ') + '\n  ' : ''
+  const guardStr = needsGuard ? emitGuardState() : ''
+  const preambleStr = guardStr +
+    (ctx.preamble && ctx.preamble.length ? ctx.preamble.join('\n  ') + '\n  ' : '')
 
   try {
     let boolFn
@@ -1695,7 +1753,16 @@ function genCode(schema, v, lines, ctx, knownType) {
           ctx.defFns.set(defName, fnName)
           const bodyLines = []
           genCode(ctx.rootDefs[defName], 'd', bodyLines, ctx)
-          ctx.preamble.push(`function ${fnName}(d){${bodyLines.join('\n  ')}\n  return true}`)
+          // Entered through the cycle guard: see emitGuardState. In the fast
+          // pass the wrapper only counts depth; the set is used by the second,
+          // guarded pass that runs when data turns out to point back at
+          // itself.
+          ctx.preamble.push(
+            `const ${fnName}_s=new Set()\n  function ${fnName}(d){\n  ` +
+              `if(_sg){if(typeof d!=='object'||d===null)return ${fnName}_b(d);if(${fnName}_s.has(d))return true;${fnName}_s.add(d);try{return ${fnName}_b(d)}finally{${fnName}_s.delete(d)}}\n  ` +
+              `if(++_sd>${CYCLE_DEPTH})throw _CYC\n  const _r=${fnName}_b(d)\n  _sd--\n  return _r\n  }\n  ` +
+              `function ${fnName}_b(d){${bodyLines.join('\n  ')}\n  return true}`,
+          )
         }
         lines.push(`if(!${fnName}(${v}))return false`)
         if (!hasSiblings) return
@@ -2903,9 +2970,7 @@ const FORMAT_CODEGEN = {
   uuid: (v, isStr) => isStr
     ? `if(${v}.length!==36||!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(${v}))return false`
     : `if(typeof ${v}==='string'&&(${v}.length!==36||!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(${v})))return false`,
-  'date-time': (v, isStr) => isStr
-    ? `if(!/^\\d{4}-\\d{2}-\\d{2}[Tt]\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?([Zz]|[+-]\\d{2}:\\d{2})$/.test(${v})||isNaN(Date.parse(${v})))return false`
-    : `if(typeof ${v}==='string'&&(!/^\\d{4}-\\d{2}-\\d{2}[Tt]\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?([Zz]|[+-]\\d{2}:\\d{2})$/.test(${v})||isNaN(Date.parse(${v}))))return false`,
+  'date-time': _formats.dateTimeSource,
   time: (v, isStr) => isStr
     ? `if(!/^([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})?$/.test(${v}))return false`
     : `if(typeof ${v}==='string'&&!/^([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})?$/.test(${v}))return false`,
@@ -2919,12 +2984,8 @@ const FORMAT_CODEGEN = {
     ? `if(/[\\s\\u0000-\\u001f\\u007f]/.test(${v}))return false`
     : `if(typeof ${v}==='string'&&/[\\s\\u0000-\\u001f\\u007f]/.test(${v}))return false`,
   ipv4: _formats.ipv4Source,
-  ipv6: (v, isStr) => isStr
-    ? `{const _s=${v};if(_s===''||!/^[0-9a-fA-F:]+$/.test(_s)||_s.split(':').length<3||_s.split(':').length>8)return false}`
-    : `if(typeof ${v}==='string'){const _s=${v};if(_s===''||!/^[0-9a-fA-F:]+$/.test(_s)||_s.split(':').length<3||_s.split(':').length>8)return false}`,
-  hostname: (v, isStr) => isStr
-    ? `if(!/^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(${v}))return false`
-    : `if(typeof ${v}==='string'&&!/^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(${v}))return false`,
+  ipv6: _formats.ipv6Source,
+  hostname: _formats.hostnameSource,
 }
 
 // Safe key escaping: use JSON.stringify to handle all special chars (newlines, null bytes, etc.)
@@ -3069,8 +3130,6 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
   if (typeof schema === 'object' && schema !== null) {
     const s = JSON.stringify(schema)
     if (s.includes('unevaluatedProperties') || s.includes('unevaluatedItems')) return null
-    // Bail on self-referencing schemas — error codegen doesn't support recursion
-    if (s.includes('"$ref":"#"')) return null
   }
   if (typeof schema === 'boolean') {
     return schema
@@ -3133,7 +3192,12 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
                   : null }
   ctx.helperCode.push('const _cpLen=s=>{let n=0;for(const _ of s)n++;return n}')
   const lines = []
-  genCodeE(schema, 'd', '', lines, ctx, '#')
+  try {
+    genCodeE(schema, 'd', '', lines, ctx, '#')
+  } catch (e) {
+    if (e === DECLINE) return null
+    throw e
+  }
   // Inline branch-collapse helper only when the schema actually used a
   // oneOf/anyOf branch path (tracked via ctx.usesBranchCollapse). Keeps the
   // AOT output small for schemas that don't compose. Standalone modules can't
@@ -3144,16 +3208,28 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
   if (lines.length === 0) return (d) => ({ valid: true, errors: [] })
 
   const checkStr = lines.join('\n  ')
+  const defSetsE = ctx.defFns ? Array.from(ctx.defFns.values()) : []
+  const needsGuardE = ctx.usesRecursion || defSetsE.length > 0
+  const guardStrE = needsGuardE ? emitGuardState() : ''
+  const helpersE = ctx.helperCode.length ? ctx.helperCode.join('\n  ') + '\n  ' : ''
+
   let body
   if (ctx.usesRecursion) {
-    body = `const _e=[];\n  ` +
-      (ctx.helperCode.length ? ctx.helperCode.join('\n  ') + '\n  ' : '') +
-      `function _validateE(d,_all,_e){\n  ${checkStr}\n  }\n  _validateE(d,_all,_e);\n  ` +
+    // The abandoned first pass may have pushed errors, so the retry starts
+    // from an empty list and the reported errors come from the guarded run
+    // alone.
+    body = `const _e=[];\n  ` + guardStrE + helpersE +
+      emitRootGuard('_validateE', 'd,_all,_e', '') +
+      `function _validateE_b(d,_all,_e){\n  ${checkStr}\n  }\n  ` +
+      emitGuardedRun('_validateE(d,_all,_e)', '_e.length=0;', defSetsE) +
+      `return{valid:_e.length===0,errors:_e}`
+  } else if (defSetsE.length > 0) {
+    body = `const _e=[];\n  ` + guardStrE + helpersE +
+      `function _bodyE(d,_all,_e){\n  ${checkStr}\n  }\n  ` +
+      emitGuardedRun('_bodyE(d,_all,_e)', '_e.length=0;', defSetsE) +
       `return{valid:_e.length===0,errors:_e}`
   } else {
-    body = `const _e=[];\n  ` +
-      (ctx.helperCode.length ? ctx.helperCode.join('\n  ') + '\n  ' : '') +
-      checkStr +
+    body = `const _e=[];\n  ` + helpersE + checkStr +
       `\n  return{valid:_e.length===0,errors:_e}`
   }
   try {
@@ -3232,8 +3308,11 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   }
   // $ref — resolve local and cross-schema refs
   if (schema.$ref) {
-    // Self-reference "#" — no-op (permissive) to avoid infinite recursion
-    if (schema.$ref === '#') return
+    // A self-reference cannot be expressed here yet: the root helper takes no
+    // path argument, so errors raised through it would carry the path of the
+    // root rather than of the value that failed. This used to fall through as
+    // a permissive no-op, which accepted whatever the reference guarded.
+    if (schema.$ref === '#') throw DECLINE
     const m = schema.$ref.match(/^#\/(?:\$defs|definitions)\/(.+)$/)
     if (m && ctx.rootDefs && ctx.rootDefs[m[1]]) {
       const defName = m[1]
@@ -3248,7 +3327,12 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
           ctx.defFns.set(defName, fnName)
           const bodyLines = []
           genCodeE(ctx.rootDefs[defName], 'd', '_p', bodyLines, ctx, '#/$defs/' + defName)
-          ctx.helperCode.push(`function ${fnName}(d,_p,_all,_e){${bodyLines.join('\n  ')}}`)
+          ctx.helperCode.push(
+            `const ${fnName}_s=new Set()\n  function ${fnName}(d,_p,_all,_e){\n  ` +
+              `if(_sg){if(typeof d!=='object'||d===null)return ${fnName}_b(d,_p,_all,_e);if(${fnName}_s.has(d))return;${fnName}_s.add(d);try{return ${fnName}_b(d,_p,_all,_e)}finally{${fnName}_s.delete(d)}}\n  ` +
+              `if(++_sd>${CYCLE_DEPTH})throw _CYC\n  const _r=${fnName}_b(d,_p,_all,_e)\n  _sd--\n  return _r\n  }\n  ` +
+              `function ${fnName}_b(d,_p,_all,_e){${bodyLines.join('\n  ')}}`,
+          )
         }
         lines.push(`${fnName}(${v},${pathExpr || '""'},_all,_e);if(!_all&&_e.length)return{valid:false,errors:_e}`)
         return

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.10.0';
+module.exports = '1.11.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -44,7 +44,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_formats_single_pass.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_formats_single_pass.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -112,13 +112,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.10.0",
-    "@ata-validator/native-darwin-x64": "1.10.0",
-    "@ata-validator/native-linux-x64-gnu": "1.10.0",
-    "@ata-validator/native-linux-arm64-gnu": "1.10.0",
-    "@ata-validator/native-linux-x64-musl": "1.10.0",
-    "@ata-validator/native-linux-arm64-musl": "1.10.0",
-    "@ata-validator/native-win32-x64": "1.10.0"
+    "@ata-validator/native-darwin-arm64": "1.11.0",
+    "@ata-validator/native-darwin-x64": "1.11.0",
+    "@ata-validator/native-linux-x64-gnu": "1.11.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.11.0",
+    "@ata-validator/native-linux-x64-musl": "1.11.0",
+    "@ata-validator/native-linux-arm64-musl": "1.11.0",
+    "@ata-validator/native-win32-x64": "1.11.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"