ata-validator 1.12.1 → 1.13.1

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.13.1 - 2026-09-06
+
+### Fixed
+
+- The native engine stops printing to stderr for patterns outside RE2's subset. A pattern with lookahead or a backreference is an expected input, not a fault: construction is probed, and the JavaScript engines answer for the pattern instead. RE2 logged every such probe to stderr anyway, so a schema carrying zod's email pattern printed two C++ error lines on compile while validating correctly. RE2 is now constructed with logging off; verdicts are unchanged.
+
+## 1.13.0 - 2026-09-06
+
+### Changed
+
+- The default browser bundle stops carrying the AOT emitters. `lib/aot.js` has promised a browser stub via the package.json `browser` field since the fs-free build, but the mapping was never actually in the field, so every browser bundle shipped the emitters and the embedded safe-regex engine source they pull in, along with the native walker's routing table that only matters when the native addon loads. Both now map to stubs. Emitting validators in a browser still works, through the new `ata-validator/aot` entry, and the `Validator.bundle*` statics in a browser bundle throw a message that points there; `Validator.loadBundle` keeps working in the default bundle, since loading a bundle somebody already built is a runtime act. Measured with the schema-benchmarks rolldown pipeline: minified and gzipped 73,491 to 64,812 bytes, 11.8 percent smaller. The browser-imports guard now bans a token from each excluded file so the mapping cannot regress silently.
+
+### Added
+
+- `ata-validator/aot`: the standalone emitters (`toStandalone`, `toStandaloneModule`, `bundle`, `bundleStandalone`, `bundleCompact`, `loadBundle`) as an explicit, typed import. In Node it is the same module the statics use; in a browser it is the way to opt back into emission without paying for it on pages that never emit.
+
 ## 1.12.1 - 2026-09-06
 
 ### Fixed

package/README.md

@@ -358,7 +358,7 @@ const v = new Validator(schema, {
 
 ### Build-time compile (`ata compile`)
 
-The `ata` CLI turns a JSON Schema file into a self-contained JavaScript module. No runtime dependency on `ata-validator`, so only the generated validator ships to the browser. Typical output is ~1 KB gzipped compared to ~27 KB for the full runtime.
+The `ata` CLI turns a JSON Schema file into a self-contained JavaScript module. No runtime dependency on `ata-validator`, so only the generated validator ships to the browser. Typical output is ~1 KB gzipped compared to ~65 KB for the full runtime bundled for the browser.
 
 ```bash
 npx ata compile schemas/user.json -o src/generated/user.validator.mjs

package/aot.d.ts

@@ -0,0 +1,37 @@
+import { Validator, JSONSchema } from './index';
+
+/** Options accepted by the standalone emitters. See docs/aot.md. */
+export interface StandaloneOptions {
+  /** Module format for the emitted source. Default: 'esm'. */
+  format?: 'esm' | 'cjs';
+  /** Use stub error functions for the smallest output. Default: false. */
+  abortEarly?: boolean;
+  [key: string]: unknown;
+}
+
+/** The constructor of Validator, as the emitters take it explicitly. */
+export type ValidatorClass = typeof Validator;
+
+/** Emit one standalone module's source for one validator, or null when the
+ * schema compiled through an engine that has no source form. */
+export function toStandalone(validator: Validator<unknown>): string | null;
+
+/** Emit one standalone module (no runtime dependency) for one validator. */
+export function toStandaloneModule(validator: Validator<unknown>, opts?: StandaloneOptions): string;
+
+/** Emit a module of per-schema compiled validators that `loadBundle` consumes. */
+export function bundle(V: ValidatorClass, schemas: Array<JSONSchema | boolean>, opts?: StandaloneOptions): string;
+
+/** Emit one self-contained module for many schemas, zero runtime dependency. */
+export function bundleStandalone(V: ValidatorClass, schemas: Array<JSONSchema | boolean>, opts?: StandaloneOptions): string;
+
+/** Like bundleStandalone with shared helpers deduplicated across schemas. */
+export function bundleCompact(V: ValidatorClass, schemas: Array<JSONSchema | boolean>, opts?: StandaloneOptions): string;
+
+/** Turn the modules a bundle produced back into Validator instances. */
+export function loadBundle(
+  V: ValidatorClass,
+  mods: Array<unknown>,
+  schemas: Array<JSONSchema | boolean>,
+  opts?: object,
+): Array<Validator<unknown>>;

package/aot.js

@@ -0,0 +1,7 @@
+'use strict';
+
+// Explicit entry for the AOT emitters, `require('ata-validator/aot')`. In
+// Node this is the same module `Validator.bundleStandalone` and friends use.
+// In a browser bundle it is the only way to get the emitters: the default
+// entry maps them to a stub so pages that never emit code never carry it.
+module.exports = require('./lib/aot-impl.js');

package/aot.mjs

@@ -0,0 +1,3 @@
+import mod from './lib/aot-impl.js';
+export const { toStandalone, toStandaloneModule, bundle, bundleStandalone, bundleCompact, loadBundle } = mod;
+export default mod;

package/index.js

@@ -1602,7 +1602,7 @@ class Validator {
     // validate() on shapes listed in lib/buffer-gate.js. For those schemas
     // every buffer entry point goes through validate() instead.
     if (native) {
-      const { bufferNeedsSlowPath, installSlowBufferApis } = require('./lib/buffer-gate');
+      const { bufferNeedsSlowPath, installSlowBufferApis } = require('./lib/buffer-gate.js');
       if (bufferNeedsSlowPath(schemaObj, this._schemaMap)) installSlowBufferApis(this);
     }
 
@@ -1925,19 +1925,19 @@ function version() {
 // generated module shapes; browser bundles get `lib/aot.browser.js` (a stub
 // that throws) via the package.json `browser` field.
 Validator.bundle = function (schemas, opts) {
-  return require('./lib/aot').bundle(Validator, schemas, opts);
+  return require('./lib/aot.js').bundle(Validator, schemas, opts);
 };
 
 Validator.bundleStandalone = function (schemas, opts) {
-  return require('./lib/aot').bundleStandalone(Validator, schemas, opts);
+  return require('./lib/aot.js').bundleStandalone(Validator, schemas, opts);
 };
 
 Validator.bundleCompact = function (schemas, opts) {
-  return require('./lib/aot').bundleCompact(Validator, schemas, opts);
+  return require('./lib/aot.js').bundleCompact(Validator, schemas, opts);
 };
 
 Validator.loadBundle = function (mods, schemas, opts) {
-  return require('./lib/aot').loadBundle(Validator, mods, schemas, opts);
+  return require('./lib/aot.js').loadBundle(Validator, mods, schemas, opts);
 };
 
 const parseJSON = native ? native.parseJSON : JSON.parse;

package/lib/aot-impl.js

@@ -0,0 +1,470 @@
+'use strict';
+
+// All ahead-of-time (AOT) code generation lives here so the default and browser
+// entries can stay free of `fs`, `path`, and `__dirname`.
+// Browser bundles get `lib/aot.browser.js` instead (see package.json `browser`
+// field), which throws if anyone tries to call an AOT function from the browser.
+//
+// Public surface (called by index.js and ata-validator/build):
+//   toStandalone(validator)
+//   toStandaloneModule(validator, opts)
+//   bundle(Validator, schemas, opts)
+//   bundleStandalone(Validator, schemas, opts)
+//   bundleCompact(Validator, schemas, opts)
+//   loadBundle(Validator, mods, schemas, opts)
+
+const { compileToJSCodegenWithErrors } = require('./js-compiler');
+const SAFE_REGEX_SOURCE = require('./safe-regex-source');
+
+// Embedded verbatim in standalone modules so the output file has no runtime
+// dependency on ata-validator. ASCII fast-path plus surrogate-aware slow path.
+const _CP_LEN_SOURCE = `function _cpLen(s) {
+  const len = s.length;
+  for (let i = 0; i < len; i++) {
+    if (((s.charCodeAt(i) - 0xD800) >>> 0) < 0x400) {
+      let n = 0; for (const _ of s) n++; return n;
+    }
+  }
+  return len;
+}`;
+
+// The linear-time regex engine, inlined verbatim into standalone output so a
+// compiled module that uses safe `pattern` matchers has no runtime dependency
+// on ata-validator. The engine source is baked into `lib/safe-regex-source.js`
+// at build time (see `scripts/regen-safe-regex-source.js`), so this path has
+// no `fs`/`path`/`__dirname` reads — safe in browser bundles too. The embed
+// strips the strict directive and CommonJS exports and adds the `__ataSafeRe`
+// alias the emitted code calls. The engine has no eval/new Function, so the
+// embed is CSP-safe.
+let _safeRegexEmbed = null;
+function getSafeRegexEmbed() {
+  if (_safeRegexEmbed === null) {
+    const body = SAFE_REGEX_SOURCE
+      .replace(/^'use strict'\s*\n/, '')
+      .replace(/\nmodule\.exports[^\n]*\n?/, '\n');
+    _safeRegexEmbed = body.trimEnd() + '\nconst __ataSafeRe = compileSafe;';
+  }
+  return _safeRegexEmbed;
+}
+
+// Returns the engine embed when any supplied compiled function references the
+// safe matcher (jsFn._usesSafeRe), else an empty string so non-pattern modules
+// pay zero bytes.
+function safeRePrelude(...fns) {
+  return fns.some((f) => f && f._usesSafeRe) ? getSafeRegexEmbed() + '\n' : '';
+}
+
+// --- Standalone pre-compilation ---
+// Generate a JS module string that can be written to a file.
+// On next startup, load with Validator.fromStandalone() -- zero compile time.
+function toStandalone(validator) {
+  validator._ensureCompiled();
+  const jsFn = validator._jsFn;
+  if (!jsFn || !jsFn._source) return null;
+  const src = jsFn._source;
+  const hybridSrc = jsFn._hybridSource || '';
+  const preambleSrc = jsFn._preambleSource || '';
+
+  // Also capture error function source for zero-compile standalone load
+  const jsErrFn = compileToJSCodegenWithErrors(
+    typeof validator._schemaObj === 'object' ? validator._schemaObj : {},
+  );
+  const errSrc = jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : '';
+
+  return `// Auto-generated by ata-validator — do not edit
+'use strict';
+${_CP_LEN_SOURCE}
+${safeRePrelude(jsFn, jsErrFn)}${preambleSrc}
+const boolFn = function(d) {
+  ${src}
+};
+const hybridFactory = function(R, E) {
+  return function(d) {
+    ${hybridSrc}
+  };
+};
+${errSrc ? `const errFn = function(d, _all) {\n  ${errSrc}\n};` : 'const errFn = null;'}
+module.exports = { boolFn, hybridFactory, errFn };
+`;
+}
+
+// --- Fully standalone module ---
+// Generates a self-contained module that can be imported directly without
+// pulling in ata-validator at runtime. Browser bundle gets only the
+// generated validator (~2 KB typical) instead of the 165 KB compiler.
+//
+//   import { validate, isValid } from './user-validator.mjs'
+//   if (isValid(data)) { ... }
+//
+// format: 'esm' | 'cjs'. Default 'esm'.
+// abortEarly: if true, invalid result is a shared stub; smaller output.
+
+// Custom format functions in standalone output.
+//
+// 'embed' (default) writes each function's source into the module through
+// Function#toString. That only works for a plain function: one that closes
+// over nothing and is not rewritten by a coverage or transpile step (istanbul
+// injects `cov_` counters; a bundler may hoist helpers). The check below
+// rejects those at build time with a named error instead of emitting a module
+// that throws on first use.
+//
+// 'inject' writes no function source. The module exports `setFormats(map)`
+// and each format is looked up from that registry when a value is checked,
+// so the caller supplies the functions at load time.
+function emitFormatDecls(closures, mode, declKW) {
+  if (!closures || closures.length === 0) return { decls: '', exportsSetFormats: false };
+  if (mode === 'inject') {
+    let out = `${declKW} __formats = Object.create(null);\n`;
+    out += `function setFormats(map) { for (const k in map) __formats[k] = map[k]; }\n`;
+    for (const { name, format } of closures) {
+      const key = JSON.stringify(format === null ? name.slice(4) : format);
+      out += `${declKW} ${name} = function (v) { const f = __formats[${key}]; if (typeof f !== 'function') throw new Error('ata: format ' + ${key} + ' is not registered; call setFormats({ [' + ${key} + ']: fn }) before validating'); return f(v); };\n`;
+    }
+    return { decls: out, exportsSetFormats: true };
+  }
+  let out = '';
+  for (const { name, fn, format } of closures) {
+    const src = fn.toString();
+    const label = format === null ? name : format;
+    if (/\bcov_[A-Za-z0-9_$]+\b/.test(src)) {
+      throw new Error(`ata: custom format "${label}" is instrumented for coverage and cannot be embedded; use { formatMode: 'inject' } and register it with setFormats() at load time`);
+    }
+    try {
+      // eslint-disable-next-line no-new-func
+      new Function('return (' + src + ')');
+    } catch {
+      throw new Error(`ata: custom format "${label}" has no standalone source (a bound function, a class method, or a native); use { formatMode: 'inject' } and register it with setFormats() at load time`);
+    }
+    out += `${declKW} ${name} = ${src};\n`;
+  }
+  return { decls: out, exportsSetFormats: false };
+}
+
+function toStandaloneModule(validator, opts) {
+  validator._ensureCompiled();
+  const jsFn = validator._jsFn;
+  if (!jsFn || !jsFn._source) return null;
+  const format = (opts && opts.format) || 'esm';
+  const abortEarly = !!(opts && opts.abortEarly);
+  const source = !!(opts && opts.source);
+  const sourceMap = opts && opts.sourceMap ? opts.sourceMap : null;
+  const schemaFile = opts && opts.schemaFile ? opts.schemaFile : null;
+  const src = jsFn._source;
+
+  let errCore = '';
+  let jsErrFn = null;
+  if (!abortEarly) {
+    jsErrFn = compileToJSCodegenWithErrors(
+      typeof validator._schemaObj === 'object' ? validator._schemaObj : {},
+      null,
+      validator._userFormats,
+      (source && sourceMap && schemaFile) ? { sourceMap, schemaFile } : null,
+    );
+    const errSrc = jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : '';
+    if (errSrc) {
+      errCore = `const errFn = function(d, _all) {\n  ${errSrc}\n};\n`;
+    }
+  }
+
+  // Schema-source frames are baked as literals inside each emitted error so
+  // consumers don't need a runtime lookup. We still expose the schema file
+  // as a sentinel constant when --source is on — handy for introspection
+  // and visible in source graphs. With --no-source, the constant is omitted
+  // entirely so size budgets and grep-based "is this source-mapped?" checks
+  // both work.
+  const schemaSourceConst = (source && schemaFile)
+    ? `const __ATA_SCHEMA_SOURCE__ = ${JSON.stringify({ file: schemaFile })};\n`
+    : '';
+
+  // Serialize closure vars referenced in _fn body: regex, sub-validators, sets.
+  let closureDecls = '';
+  if (jsFn._closures && jsFn._closures.length > 0) {
+    const lines = [];
+    for (const { name, val } of jsFn._closures) {
+      if (Array.isArray(val)) {
+        lines.push(`const ${name} = ${JSON.stringify(val)};`);
+        continue;
+      }
+      if (val && val.__ataSafe) {
+        lines.push(`const ${name} = __ataSafeRe(${JSON.stringify(val.source)});`);
+      } else if (val instanceof RegExp) {
+        const flags = val.flags;
+        lines.push(`const ${name} = new RegExp(${JSON.stringify(val.source)}${flags ? ', ' + JSON.stringify(flags) : ''});`);
+      } else if (val instanceof Set) {
+        lines.push(`const ${name} = new Set(${JSON.stringify([...val])});`);
+      } else if (typeof val === 'function') {
+        // new Function('_ppv', body) — extract body from toString()
+        const str = val.toString();
+        // Matches: "function anonymous(_ppv\n) {\nbody\n}" or "function(_ppv){body}"
+        const m = str.match(/^function[^(]*\([^)]*\)\s*\{([\s\S]*)\}$/)
+        const body = m ? m[1].trim() : str;
+        lines.push(`const ${name} = function(_ppv) { ${body} };`);
+      }
+    }
+    if (lines.length) closureDecls = lines.join('\n') + '\n';
+  }
+
+  // Hoisted oneOf/anyOf branch checks live in the boolean fn's preamble (the
+  // runtime emits them before the function). The standalone module must declare
+  // them at module scope too, or _fn references undefined names (e.g. _af1_b0).
+  const preambleDecls = jsFn._preambleSource ? jsFn._preambleSource + '\n' : '';
+
+  // User-supplied format functions are referenced as _uf_<name> by both the
+  // boolean (_fn) and error (errFn) bodies. Embed them via Function#toString
+  // so the standalone module stays self-contained.
+  const fmt = emitFormatDecls(jsFn._formatClosures, opts && opts.formatMode, 'const');
+  const formatDecls = fmt.decls;
+
+  const validBody = errCore
+    ? 'return _fn(data) ? VALID : { valid: false, errors: errFn(data, true).errors }'
+    : 'return _fn(data) ? VALID : ABORT';
+
+  const names = fmt.exportsSetFormats ? 'validate, isValid, setFormats' : 'validate, isValid';
+  const exports = format === 'esm'
+    ? `export { ${names} };\nexport default { ${names} };\n`
+    : `module.exports = { ${names} };\nmodule.exports.default = module.exports;\n`;
+
+  return `// Auto-generated by ata-validator — do not edit.
+// Schema is embedded; runtime has zero dependency on ata-validator.
+'use strict';
+${_CP_LEN_SOURCE}
+${safeRePrelude(jsFn, jsErrFn)}${schemaSourceConst}const VALID = Object.freeze({ valid: true, errors: Object.freeze([]) });
+const ABORT = Object.freeze({
+  valid: false,
+  errors: Object.freeze([Object.freeze({
+    code: 'ATA9000',
+    message: 'validation failed',
+    keyword: '__abort_early__',
+    path: '',
+  })]),
+});
+${closureDecls}${preambleDecls}${formatDecls}const _fn = function(d) {
+  ${src}
+};
+${errCore}function isValid(data) { return _fn(data); }
+function validate(data) { ${validBody}; }
+${exports}`;
+}
+
+// Bundle multiple validators into a single JS file for fast startup.
+// Usage:
+//   const bundle = Validator.bundle([schema1, schema2, ...]);
+//   fs.writeFileSync('validators.js', bundle);
+//   // On startup:
+//   const validators = Validator.loadBundle(require('./validators.js'), [schema1, schema2, ...]);
+function bundle(Validator, schemas, opts) {
+  const parts = schemas.map((schema) => {
+    const v = new Validator(schema, opts);
+    const standalone = toStandalone(v);
+    if (!standalone) return 'null';
+    return (
+      '(function(){' +
+      standalone
+        .replace("'use strict';", '')
+        .replace('module.exports = ', 'return ') +
+      '})()'
+    );
+  });
+  return "'use strict';\nmodule.exports = [\n" + parts.join(',\n') + '\n];\n';
+}
+
+// Zero-dependency self-contained bundle — no require('ata-validator') needed at runtime.
+// opts.format: 'cjs' (default) or 'esm'.
+// opts.formats: { name: fn } — embedded in the output via Function#toString.
+function bundleStandalone(Validator, schemas, opts) {
+  // Cross-schema $ref resolution: only meaningful when at least one schema has
+  // an $id. Skip the schemas-as-map plumbing when none of them do.
+  const haveIds = schemas.some((s) => s && typeof s === 'object' && s.$id);
+  const bundleOpts = haveIds ? { ...(opts || {}), schemas } : (opts || {});
+  const format = (opts && opts.format) || 'cjs';
+  const R = 'Object.freeze({valid:true,errors:Object.freeze([])})';
+  let bundleUsesSafeRe = false;
+  let bundleInjects = false;
+  const fns = schemas.map((schema) => {
+    const v = new Validator(schema, bundleOpts);
+    v._ensureCompiled();
+    const jsFn = v._jsFn;
+    if (!jsFn || !jsFn._hybridSource) return 'null';
+    // The schema the validator compiled, not the one the caller passed. They
+    // differ whenever anything prepared the schema: draft-07 normalization,
+    // `format` removed under assertFormat: false, keywords outside the
+    // dialect's vocabularies. Reading the original here would leave the
+    // boolean path and the error path disagreeing about the same document.
+    const jsErrFn = compileToJSCodegenWithErrors(
+      v._schemaObj,
+      v._schemaMap,
+      v._userFormats,
+    );
+    if (jsFn._usesSafeRe || (jsErrFn && jsErrFn._usesSafeRe)) bundleUsesSafeRe = true;
+    const errBody =
+      jsErrFn && jsErrFn._errSource
+        ? jsErrFn._errSource
+        : "return{valid:false,errors:[{code:'error',path:'',message:'validation failed'}]}";
+    // Custom format closures: embedded, or bound to the bundle-level
+    // registry when opts.formats is 'inject'.
+    let preamble = '';
+    if (jsFn._formatClosures) {
+      const f = emitFormatDecls(jsFn._formatClosures, opts && opts.formatMode, 'var');
+      preamble = f.decls.replace(/^var __formats = [^\n]*\n|^function setFormats[^\n]*\n/gm, '');
+      if (f.exportsSetFormats) bundleInjects = true;
+    }
+    // Include hoisted anyOf/oneOf branch helpers (e.g. `_af1_b0`) so the
+    // bundle output is self-contained. `toStandalone` emits this same source
+    // for single-schema standalone output.
+    if (jsFn._preambleSource) {
+      preamble = preamble ? `${preamble}\n${jsFn._preambleSource}` : jsFn._preambleSource;
+    }
+    if (opts && opts.verbose) {
+      // Embed the schema and a small resolver so errors carry parentSchema.
+      const schemaLit = JSON.stringify(v._schemaObj);
+      return `(function(R){${preamble}var _S=${schemaLit};function _PS(p){if(!p||p[0]!=='#')return undefined;var s=p.slice(1);if(!s)return _S;var ps=s.split('/').filter(Boolean).map(function(x){return x.replace(/~1/g,'/').replace(/~0/g,'~')});var t=_S;for(var i=0;i<ps.length-1;i++){if(t==null||typeof t!=='object')return undefined;t=t[ps[i]]}return t}var E=function(d){var _all=true;${errBody}};var _v=function(d){${jsFn._hybridSource}};return function(d){var r=_v(d);if(r&&r.valid===false&&r.errors){var es=[];for(var i=0;i<r.errors.length;i++){var e=r.errors[i];es.push(Object.assign({},e,{parentSchema:_PS(e.schemaPath)}))}return{valid:false,errors:es}}return r}})(R)`;
+    }
+    return `(function(R){${preamble}var E=function(d){var _all=true;${errBody}};return function(d){${jsFn._hybridSource}}})(R)`;
+  });
+  const arr = `[${fns.join(',')}]`;
+  const safeEmbed = bundleUsesSafeRe ? getSafeRegexEmbed() + '\n' : '';
+  const registry = bundleInjects
+    ? `var __formats=Object.create(null);\nfunction setFormats(map){for(var k in map)__formats[k]=map[k]}\n`
+    : '';
+  if (format === 'esm') {
+    const extra = bundleInjects ? 'export { validators, setFormats };' : 'export { validators };';
+    return `// Auto-generated by ata-validator — do not edit\n${safeEmbed}${registry}const R=${R};\nconst validators=${arr};\nexport default validators;\n${extra}\n`;
+  }
+  const attach = bundleInjects ? 'module.exports.setFormats=setFormats;\n' : '';
+  return `'use strict';\n${safeEmbed}${registry}var R=${R};\nmodule.exports=[${fns.join(',')}];\n${attach}`;
+}
+
+// Compact bundle: deduplicated code. Shared template functions + per-schema params.
+// Much smaller file → faster V8 parse → faster startup.
+// opts.format: 'cjs' (default) or 'esm'.
+function bundleCompact(Validator, schemas, opts) {
+  const haveIds = schemas.some((s) => s && typeof s === 'object' && s.$id);
+  const bundleOpts = haveIds ? { ...(opts || {}), schemas } : (opts || {});
+  const format = (opts && opts.format) || 'cjs';
+  let bundleUsesSafeRe = false;
+  // Analyze schemas and group by structure
+  const entries = schemas.map((schema) => {
+    const v = new Validator(schema, bundleOpts);
+    v._ensureCompiled();
+    const jsFn = v._jsFn;
+    if (!jsFn || !jsFn._hybridSource) return null;
+    // The schema the validator compiled, not the one the caller passed. They
+    // differ whenever anything prepared the schema: draft-07 normalization,
+    // `format` removed under assertFormat: false, keywords outside the
+    // dialect's vocabularies. Reading the original here would leave the
+    // boolean path and the error path disagreeing about the same document.
+    const jsErrFn = compileToJSCodegenWithErrors(
+      v._schemaObj,
+      v._schemaMap,
+      v._userFormats,
+    );
+    if (jsFn._usesSafeRe || (jsErrFn && jsErrFn._usesSafeRe)) bundleUsesSafeRe = true;
+    // Hoisted anyOf/oneOf branch helpers (e.g. `_af1_b0`) must travel with the
+    // hybrid body or it references undefined names. Prepending keeps dedup honest:
+    // schemas with different branch sets no longer collide on body alone.
+    const hybrid = jsFn._preambleSource
+      ? `${jsFn._preambleSource}\n${jsFn._hybridSource}`
+      : jsFn._hybridSource;
+    return {
+      hybrid,
+      err: jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : null,
+      fmt: jsFn._formatClosures || null,
+    };
+  });
+
+  // Deduplicate function bodies — many schemas produce identical or near-identical code
+  const bodyMap = new Map(); // body → index
+  const bodies = [];
+  const errMap = new Map();
+  const errBodies = [];
+
+  const indices = entries.map((e) => {
+    if (!e) return [-1, -1];
+    let hi = bodyMap.get(e.hybrid);
+    if (hi === undefined) {
+      hi = bodies.length;
+      bodies.push(e.hybrid);
+      bodyMap.set(e.hybrid, hi);
+    }
+    let ei = -1;
+    if (e.err) {
+      ei = errMap.get(e.err);
+      if (ei === undefined) {
+        ei = errBodies.length;
+        errBodies.push(e.err);
+        errMap.set(e.err, ei);
+      }
+    }
+    return [hi, ei];
+  });
+
+  // Generate compact bundle
+  const isEsm = format === 'esm';
+  let out = isEsm
+    ? '// Auto-generated by ata-validator — do not edit\n'
+    : "'use strict';\n";
+  if (bundleUsesSafeRe) out += getSafeRegexEmbed() + '\n';
+  const declKW = isEsm ? 'const' : 'var';
+  out += `${declKW} R=Object.freeze({valid:true,errors:Object.freeze([])});\n`;
+
+  // User format functions are referenced as _uf_<name> by the hybrid and error
+  // bodies. Collect them across all schemas (deduped by name) and embed via
+  // Function#toString so the bundle stays self-contained.
+  const fmtSeen = new Set();
+  const fmtAll = [];
+  for (const e of entries) {
+    if (!e || !e.fmt) continue;
+    for (const entry of e.fmt) {
+      if (fmtSeen.has(entry.name)) continue;
+      fmtSeen.add(entry.name);
+      fmtAll.push(entry);
+    }
+  }
+  const fmtOut = emitFormatDecls(fmtAll, opts && opts.formatMode, declKW);
+  out += fmtOut.decls;
+
+  // Shared hybrid factories
+  out += `${declKW} H=[\n`;
+  out += bodies
+    .map((b) => `function(R,E){return function(d){${b}}}`)
+    .join(',\n');
+  out += '\n];\n';
+
+  // Shared error functions
+  out += `${declKW} EF=[\n`;
+  out += errBodies.map((b) => `function(d){var _all=true;${b}}`).join(',\n');
+  out += '\n];\n';
+
+  // Build validators from shared templates
+  const arrBody = indices
+    .map(([hi, ei]) => {
+      if (hi < 0) return 'null';
+      if (ei >= 0) return `H[${hi}](R,EF[${ei}])`;
+      return `H[${hi}](R,function(){return{valid:false,errors:[]}})`;
+    })
+    .join(',');
+  if (isEsm) {
+    out += `const validators=[${arrBody}];\nexport default validators;\nexport { validators${fmtOut.exportsSetFormats ? ', setFormats' : ''} };\n`;
+  } else {
+    out += `module.exports=[${arrBody}];\n`;
+    if (fmtOut.exportsSetFormats) out += 'module.exports.setFormats=setFormats;\n';
+  }
+
+  return out;
+}
+
+function loadBundle(Validator, mods, schemas, opts) {
+  return schemas.map((schema, i) => {
+    if (mods[i]) return Validator.fromStandalone(mods[i], schema, opts);
+    return new Validator(schema, opts);
+  });
+}
+
+module.exports = {
+  toStandalone,
+  toStandaloneModule,
+  bundle,
+  bundleStandalone,
+  bundleCompact,
+  loadBundle,
+};

package/lib/aot.browser.js

@@ -0,0 +1,33 @@
+'use strict';
+
+// Browser twin of lib/aot.js, wired by the package.json `browser` field. The
+// emitters write module source for a bundler or the filesystem, which is build
+// tooling, not something a page does; leaving them out keeps their code and
+// the embedded safe-regex engine source out of the browser bundle. Loading a
+// bundle somebody already built is a runtime act, so that one works here too.
+
+function unavailable(name) {
+  return function () {
+    throw new Error(
+      name + '() is not in the default browser bundle. ' +
+      "Import it from 'ata-validator/aot', which works in the browser too; " +
+      'pages that never emit code stay free of the emitters this way.'
+    );
+  };
+}
+
+function loadBundle(Validator, mods, schemas, opts) {
+  return schemas.map((schema, i) => {
+    if (mods[i]) return Validator.fromStandalone(mods[i], schema, opts);
+    return new Validator(schema, opts);
+  });
+}
+
+module.exports = {
+  toStandalone: unavailable('toStandalone'),
+  toStandaloneModule: unavailable('toStandaloneModule'),
+  bundle: unavailable('bundle'),
+  bundleStandalone: unavailable('bundleStandalone'),
+  bundleCompact: unavailable('bundleCompact'),
+  loadBundle,
+};

package/lib/aot.js

@@ -1,470 +1,8 @@
 'use strict';
 
-// All ahead-of-time (AOT) code generation lives here so the default and browser
-// entries can stay free of `fs`, `path`, and `__dirname`.
-// Browser bundles get `lib/aot.browser.js` instead (see package.json `browser`
-// field), which throws if anyone tries to call an AOT function from the browser.
-//
-// Public surface (called by index.js and ata-validator/build):
-//   toStandalone(validator)
-//   toStandaloneModule(validator, opts)
-//   bundle(Validator, schemas, opts)
-//   bundleStandalone(Validator, schemas, opts)
-//   bundleCompact(Validator, schemas, opts)
-//   loadBundle(Validator, mods, schemas, opts)
-
-const { compileToJSCodegenWithErrors } = require('./js-compiler');
-const SAFE_REGEX_SOURCE = require('./safe-regex-source');
-
-// Embedded verbatim in standalone modules so the output file has no runtime
-// dependency on ata-validator. ASCII fast-path plus surrogate-aware slow path.
-const _CP_LEN_SOURCE = `function _cpLen(s) {
-  const len = s.length;
-  for (let i = 0; i < len; i++) {
-    if (((s.charCodeAt(i) - 0xD800) >>> 0) < 0x400) {
-      let n = 0; for (const _ of s) n++; return n;
-    }
-  }
-  return len;
-}`;
-
-// The linear-time regex engine, inlined verbatim into standalone output so a
-// compiled module that uses safe `pattern` matchers has no runtime dependency
-// on ata-validator. The engine source is baked into `lib/safe-regex-source.js`
-// at build time (see `scripts/regen-safe-regex-source.js`), so this path has
-// no `fs`/`path`/`__dirname` reads — safe in browser bundles too. The embed
-// strips the strict directive and CommonJS exports and adds the `__ataSafeRe`
-// alias the emitted code calls. The engine has no eval/new Function, so the
-// embed is CSP-safe.
-let _safeRegexEmbed = null;
-function getSafeRegexEmbed() {
-  if (_safeRegexEmbed === null) {
-    const body = SAFE_REGEX_SOURCE
-      .replace(/^'use strict'\s*\n/, '')
-      .replace(/\nmodule\.exports[^\n]*\n?/, '\n');
-    _safeRegexEmbed = body.trimEnd() + '\nconst __ataSafeRe = compileSafe;';
-  }
-  return _safeRegexEmbed;
-}
-
-// Returns the engine embed when any supplied compiled function references the
-// safe matcher (jsFn._usesSafeRe), else an empty string so non-pattern modules
-// pay zero bytes.
-function safeRePrelude(...fns) {
-  return fns.some((f) => f && f._usesSafeRe) ? getSafeRegexEmbed() + '\n' : '';
-}
-
-// --- Standalone pre-compilation ---
-// Generate a JS module string that can be written to a file.
-// On next startup, load with Validator.fromStandalone() -- zero compile time.
-function toStandalone(validator) {
-  validator._ensureCompiled();
-  const jsFn = validator._jsFn;
-  if (!jsFn || !jsFn._source) return null;
-  const src = jsFn._source;
-  const hybridSrc = jsFn._hybridSource || '';
-  const preambleSrc = jsFn._preambleSource || '';
-
-  // Also capture error function source for zero-compile standalone load
-  const jsErrFn = compileToJSCodegenWithErrors(
-    typeof validator._schemaObj === 'object' ? validator._schemaObj : {},
-  );
-  const errSrc = jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : '';
-
-  return `// Auto-generated by ata-validator — do not edit
-'use strict';
-${_CP_LEN_SOURCE}
-${safeRePrelude(jsFn, jsErrFn)}${preambleSrc}
-const boolFn = function(d) {
-  ${src}
-};
-const hybridFactory = function(R, E) {
-  return function(d) {
-    ${hybridSrc}
-  };
-};
-${errSrc ? `const errFn = function(d, _all) {\n  ${errSrc}\n};` : 'const errFn = null;'}
-module.exports = { boolFn, hybridFactory, errFn };
-`;
-}
-
-// --- Fully standalone module ---
-// Generates a self-contained module that can be imported directly without
-// pulling in ata-validator at runtime. Browser bundle gets only the
-// generated validator (~2 KB typical) instead of the 165 KB compiler.
-//
-//   import { validate, isValid } from './user-validator.mjs'
-//   if (isValid(data)) { ... }
-//
-// format: 'esm' | 'cjs'. Default 'esm'.
-// abortEarly: if true, invalid result is a shared stub; smaller output.
-
-// Custom format functions in standalone output.
-//
-// 'embed' (default) writes each function's source into the module through
-// Function#toString. That only works for a plain function: one that closes
-// over nothing and is not rewritten by a coverage or transpile step (istanbul
-// injects `cov_` counters; a bundler may hoist helpers). The check below
-// rejects those at build time with a named error instead of emitting a module
-// that throws on first use.
-//
-// 'inject' writes no function source. The module exports `setFormats(map)`
-// and each format is looked up from that registry when a value is checked,
-// so the caller supplies the functions at load time.
-function emitFormatDecls(closures, mode, declKW) {
-  if (!closures || closures.length === 0) return { decls: '', exportsSetFormats: false };
-  if (mode === 'inject') {
-    let out = `${declKW} __formats = Object.create(null);\n`;
-    out += `function setFormats(map) { for (const k in map) __formats[k] = map[k]; }\n`;
-    for (const { name, format } of closures) {
-      const key = JSON.stringify(format === null ? name.slice(4) : format);
-      out += `${declKW} ${name} = function (v) { const f = __formats[${key}]; if (typeof f !== 'function') throw new Error('ata: format ' + ${key} + ' is not registered; call setFormats({ [' + ${key} + ']: fn }) before validating'); return f(v); };\n`;
-    }
-    return { decls: out, exportsSetFormats: true };
-  }
-  let out = '';
-  for (const { name, fn, format } of closures) {
-    const src = fn.toString();
-    const label = format === null ? name : format;
-    if (/\bcov_[A-Za-z0-9_$]+\b/.test(src)) {
-      throw new Error(`ata: custom format "${label}" is instrumented for coverage and cannot be embedded; use { formatMode: 'inject' } and register it with setFormats() at load time`);
-    }
-    try {
-      // eslint-disable-next-line no-new-func
-      new Function('return (' + src + ')');
-    } catch {
-      throw new Error(`ata: custom format "${label}" has no standalone source (a bound function, a class method, or a native); use { formatMode: 'inject' } and register it with setFormats() at load time`);
-    }
-    out += `${declKW} ${name} = ${src};\n`;
-  }
-  return { decls: out, exportsSetFormats: false };
-}
-
-function toStandaloneModule(validator, opts) {
-  validator._ensureCompiled();
-  const jsFn = validator._jsFn;
-  if (!jsFn || !jsFn._source) return null;
-  const format = (opts && opts.format) || 'esm';
-  const abortEarly = !!(opts && opts.abortEarly);
-  const source = !!(opts && opts.source);
-  const sourceMap = opts && opts.sourceMap ? opts.sourceMap : null;
-  const schemaFile = opts && opts.schemaFile ? opts.schemaFile : null;
-  const src = jsFn._source;
-
-  let errCore = '';
-  let jsErrFn = null;
-  if (!abortEarly) {
-    jsErrFn = compileToJSCodegenWithErrors(
-      typeof validator._schemaObj === 'object' ? validator._schemaObj : {},
-      null,
-      validator._userFormats,
-      (source && sourceMap && schemaFile) ? { sourceMap, schemaFile } : null,
-    );
-    const errSrc = jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : '';
-    if (errSrc) {
-      errCore = `const errFn = function(d, _all) {\n  ${errSrc}\n};\n`;
-    }
-  }
-
-  // Schema-source frames are baked as literals inside each emitted error so
-  // consumers don't need a runtime lookup. We still expose the schema file
-  // as a sentinel constant when --source is on — handy for introspection
-  // and visible in source graphs. With --no-source, the constant is omitted
-  // entirely so size budgets and grep-based "is this source-mapped?" checks
-  // both work.
-  const schemaSourceConst = (source && schemaFile)
-    ? `const __ATA_SCHEMA_SOURCE__ = ${JSON.stringify({ file: schemaFile })};\n`
-    : '';
-
-  // Serialize closure vars referenced in _fn body: regex, sub-validators, sets.
-  let closureDecls = '';
-  if (jsFn._closures && jsFn._closures.length > 0) {
-    const lines = [];
-    for (const { name, val } of jsFn._closures) {
-      if (Array.isArray(val)) {
-        lines.push(`const ${name} = ${JSON.stringify(val)};`);
-        continue;
-      }
-      if (val && val.__ataSafe) {
-        lines.push(`const ${name} = __ataSafeRe(${JSON.stringify(val.source)});`);
-      } else if (val instanceof RegExp) {
-        const flags = val.flags;
-        lines.push(`const ${name} = new RegExp(${JSON.stringify(val.source)}${flags ? ', ' + JSON.stringify(flags) : ''});`);
-      } else if (val instanceof Set) {
-        lines.push(`const ${name} = new Set(${JSON.stringify([...val])});`);
-      } else if (typeof val === 'function') {
-        // new Function('_ppv', body) — extract body from toString()
-        const str = val.toString();
-        // Matches: "function anonymous(_ppv\n) {\nbody\n}" or "function(_ppv){body}"
-        const m = str.match(/^function[^(]*\([^)]*\)\s*\{([\s\S]*)\}$/)
-        const body = m ? m[1].trim() : str;
-        lines.push(`const ${name} = function(_ppv) { ${body} };`);
-      }
-    }
-    if (lines.length) closureDecls = lines.join('\n') + '\n';
-  }
-
-  // Hoisted oneOf/anyOf branch checks live in the boolean fn's preamble (the
-  // runtime emits them before the function). The standalone module must declare
-  // them at module scope too, or _fn references undefined names (e.g. _af1_b0).
-  const preambleDecls = jsFn._preambleSource ? jsFn._preambleSource + '\n' : '';
-
-  // User-supplied format functions are referenced as _uf_<name> by both the
-  // boolean (_fn) and error (errFn) bodies. Embed them via Function#toString
-  // so the standalone module stays self-contained.
-  const fmt = emitFormatDecls(jsFn._formatClosures, opts && opts.formatMode, 'const');
-  const formatDecls = fmt.decls;
-
-  const validBody = errCore
-    ? 'return _fn(data) ? VALID : { valid: false, errors: errFn(data, true).errors }'
-    : 'return _fn(data) ? VALID : ABORT';
-
-  const names = fmt.exportsSetFormats ? 'validate, isValid, setFormats' : 'validate, isValid';
-  const exports = format === 'esm'
-    ? `export { ${names} };\nexport default { ${names} };\n`
-    : `module.exports = { ${names} };\nmodule.exports.default = module.exports;\n`;
-
-  return `// Auto-generated by ata-validator — do not edit.
-// Schema is embedded; runtime has zero dependency on ata-validator.
-'use strict';
-${_CP_LEN_SOURCE}
-${safeRePrelude(jsFn, jsErrFn)}${schemaSourceConst}const VALID = Object.freeze({ valid: true, errors: Object.freeze([]) });
-const ABORT = Object.freeze({
-  valid: false,
-  errors: Object.freeze([Object.freeze({
-    code: 'ATA9000',
-    message: 'validation failed',
-    keyword: '__abort_early__',
-    path: '',
-  })]),
-});
-${closureDecls}${preambleDecls}${formatDecls}const _fn = function(d) {
-  ${src}
-};
-${errCore}function isValid(data) { return _fn(data); }
-function validate(data) { ${validBody}; }
-${exports}`;
-}
-
-// Bundle multiple validators into a single JS file for fast startup.
-// Usage:
-//   const bundle = Validator.bundle([schema1, schema2, ...]);
-//   fs.writeFileSync('validators.js', bundle);
-//   // On startup:
-//   const validators = Validator.loadBundle(require('./validators.js'), [schema1, schema2, ...]);
-function bundle(Validator, schemas, opts) {
-  const parts = schemas.map((schema) => {
-    const v = new Validator(schema, opts);
-    const standalone = toStandalone(v);
-    if (!standalone) return 'null';
-    return (
-      '(function(){' +
-      standalone
-        .replace("'use strict';", '')
-        .replace('module.exports = ', 'return ') +
-      '})()'
-    );
-  });
-  return "'use strict';\nmodule.exports = [\n" + parts.join(',\n') + '\n];\n';
-}
-
-// Zero-dependency self-contained bundle — no require('ata-validator') needed at runtime.
-// opts.format: 'cjs' (default) or 'esm'.
-// opts.formats: { name: fn } — embedded in the output via Function#toString.
-function bundleStandalone(Validator, schemas, opts) {
-  // Cross-schema $ref resolution: only meaningful when at least one schema has
-  // an $id. Skip the schemas-as-map plumbing when none of them do.
-  const haveIds = schemas.some((s) => s && typeof s === 'object' && s.$id);
-  const bundleOpts = haveIds ? { ...(opts || {}), schemas } : (opts || {});
-  const format = (opts && opts.format) || 'cjs';
-  const R = 'Object.freeze({valid:true,errors:Object.freeze([])})';
-  let bundleUsesSafeRe = false;
-  let bundleInjects = false;
-  const fns = schemas.map((schema) => {
-    const v = new Validator(schema, bundleOpts);
-    v._ensureCompiled();
-    const jsFn = v._jsFn;
-    if (!jsFn || !jsFn._hybridSource) return 'null';
-    // The schema the validator compiled, not the one the caller passed. They
-    // differ whenever anything prepared the schema: draft-07 normalization,
-    // `format` removed under assertFormat: false, keywords outside the
-    // dialect's vocabularies. Reading the original here would leave the
-    // boolean path and the error path disagreeing about the same document.
-    const jsErrFn = compileToJSCodegenWithErrors(
-      v._schemaObj,
-      v._schemaMap,
-      v._userFormats,
-    );
-    if (jsFn._usesSafeRe || (jsErrFn && jsErrFn._usesSafeRe)) bundleUsesSafeRe = true;
-    const errBody =
-      jsErrFn && jsErrFn._errSource
-        ? jsErrFn._errSource
-        : "return{valid:false,errors:[{code:'error',path:'',message:'validation failed'}]}";
-    // Custom format closures: embedded, or bound to the bundle-level
-    // registry when opts.formats is 'inject'.
-    let preamble = '';
-    if (jsFn._formatClosures) {
-      const f = emitFormatDecls(jsFn._formatClosures, opts && opts.formatMode, 'var');
-      preamble = f.decls.replace(/^var __formats = [^\n]*\n|^function setFormats[^\n]*\n/gm, '');
-      if (f.exportsSetFormats) bundleInjects = true;
-    }
-    // Include hoisted anyOf/oneOf branch helpers (e.g. `_af1_b0`) so the
-    // bundle output is self-contained. `toStandalone` emits this same source
-    // for single-schema standalone output.
-    if (jsFn._preambleSource) {
-      preamble = preamble ? `${preamble}\n${jsFn._preambleSource}` : jsFn._preambleSource;
-    }
-    if (opts && opts.verbose) {
-      // Embed the schema and a small resolver so errors carry parentSchema.
-      const schemaLit = JSON.stringify(v._schemaObj);
-      return `(function(R){${preamble}var _S=${schemaLit};function _PS(p){if(!p||p[0]!=='#')return undefined;var s=p.slice(1);if(!s)return _S;var ps=s.split('/').filter(Boolean).map(function(x){return x.replace(/~1/g,'/').replace(/~0/g,'~')});var t=_S;for(var i=0;i<ps.length-1;i++){if(t==null||typeof t!=='object')return undefined;t=t[ps[i]]}return t}var E=function(d){var _all=true;${errBody}};var _v=function(d){${jsFn._hybridSource}};return function(d){var r=_v(d);if(r&&r.valid===false&&r.errors){var es=[];for(var i=0;i<r.errors.length;i++){var e=r.errors[i];es.push(Object.assign({},e,{parentSchema:_PS(e.schemaPath)}))}return{valid:false,errors:es}}return r}})(R)`;
-    }
-    return `(function(R){${preamble}var E=function(d){var _all=true;${errBody}};return function(d){${jsFn._hybridSource}}})(R)`;
-  });
-  const arr = `[${fns.join(',')}]`;
-  const safeEmbed = bundleUsesSafeRe ? getSafeRegexEmbed() + '\n' : '';
-  const registry = bundleInjects
-    ? `var __formats=Object.create(null);\nfunction setFormats(map){for(var k in map)__formats[k]=map[k]}\n`
-    : '';
-  if (format === 'esm') {
-    const extra = bundleInjects ? 'export { validators, setFormats };' : 'export { validators };';
-    return `// Auto-generated by ata-validator — do not edit\n${safeEmbed}${registry}const R=${R};\nconst validators=${arr};\nexport default validators;\n${extra}\n`;
-  }
-  const attach = bundleInjects ? 'module.exports.setFormats=setFormats;\n' : '';
-  return `'use strict';\n${safeEmbed}${registry}var R=${R};\nmodule.exports=[${fns.join(',')}];\n${attach}`;
-}
-
-// Compact bundle: deduplicated code. Shared template functions + per-schema params.
-// Much smaller file → faster V8 parse → faster startup.
-// opts.format: 'cjs' (default) or 'esm'.
-function bundleCompact(Validator, schemas, opts) {
-  const haveIds = schemas.some((s) => s && typeof s === 'object' && s.$id);
-  const bundleOpts = haveIds ? { ...(opts || {}), schemas } : (opts || {});
-  const format = (opts && opts.format) || 'cjs';
-  let bundleUsesSafeRe = false;
-  // Analyze schemas and group by structure
-  const entries = schemas.map((schema) => {
-    const v = new Validator(schema, bundleOpts);
-    v._ensureCompiled();
-    const jsFn = v._jsFn;
-    if (!jsFn || !jsFn._hybridSource) return null;
-    // The schema the validator compiled, not the one the caller passed. They
-    // differ whenever anything prepared the schema: draft-07 normalization,
-    // `format` removed under assertFormat: false, keywords outside the
-    // dialect's vocabularies. Reading the original here would leave the
-    // boolean path and the error path disagreeing about the same document.
-    const jsErrFn = compileToJSCodegenWithErrors(
-      v._schemaObj,
-      v._schemaMap,
-      v._userFormats,
-    );
-    if (jsFn._usesSafeRe || (jsErrFn && jsErrFn._usesSafeRe)) bundleUsesSafeRe = true;
-    // Hoisted anyOf/oneOf branch helpers (e.g. `_af1_b0`) must travel with the
-    // hybrid body or it references undefined names. Prepending keeps dedup honest:
-    // schemas with different branch sets no longer collide on body alone.
-    const hybrid = jsFn._preambleSource
-      ? `${jsFn._preambleSource}\n${jsFn._hybridSource}`
-      : jsFn._hybridSource;
-    return {
-      hybrid,
-      err: jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : null,
-      fmt: jsFn._formatClosures || null,
-    };
-  });
-
-  // Deduplicate function bodies — many schemas produce identical or near-identical code
-  const bodyMap = new Map(); // body → index
-  const bodies = [];
-  const errMap = new Map();
-  const errBodies = [];
-
-  const indices = entries.map((e) => {
-    if (!e) return [-1, -1];
-    let hi = bodyMap.get(e.hybrid);
-    if (hi === undefined) {
-      hi = bodies.length;
-      bodies.push(e.hybrid);
-      bodyMap.set(e.hybrid, hi);
-    }
-    let ei = -1;
-    if (e.err) {
-      ei = errMap.get(e.err);
-      if (ei === undefined) {
-        ei = errBodies.length;
-        errBodies.push(e.err);
-        errMap.set(e.err, ei);
-      }
-    }
-    return [hi, ei];
-  });
-
-  // Generate compact bundle
-  const isEsm = format === 'esm';
-  let out = isEsm
-    ? '// Auto-generated by ata-validator — do not edit\n'
-    : "'use strict';\n";
-  if (bundleUsesSafeRe) out += getSafeRegexEmbed() + '\n';
-  const declKW = isEsm ? 'const' : 'var';
-  out += `${declKW} R=Object.freeze({valid:true,errors:Object.freeze([])});\n`;
-
-  // User format functions are referenced as _uf_<name> by the hybrid and error
-  // bodies. Collect them across all schemas (deduped by name) and embed via
-  // Function#toString so the bundle stays self-contained.
-  const fmtSeen = new Set();
-  const fmtAll = [];
-  for (const e of entries) {
-    if (!e || !e.fmt) continue;
-    for (const entry of e.fmt) {
-      if (fmtSeen.has(entry.name)) continue;
-      fmtSeen.add(entry.name);
-      fmtAll.push(entry);
-    }
-  }
-  const fmtOut = emitFormatDecls(fmtAll, opts && opts.formatMode, declKW);
-  out += fmtOut.decls;
-
-  // Shared hybrid factories
-  out += `${declKW} H=[\n`;
-  out += bodies
-    .map((b) => `function(R,E){return function(d){${b}}}`)
-    .join(',\n');
-  out += '\n];\n';
-
-  // Shared error functions
-  out += `${declKW} EF=[\n`;
-  out += errBodies.map((b) => `function(d){var _all=true;${b}}`).join(',\n');
-  out += '\n];\n';
-
-  // Build validators from shared templates
-  const arrBody = indices
-    .map(([hi, ei]) => {
-      if (hi < 0) return 'null';
-      if (ei >= 0) return `H[${hi}](R,EF[${ei}])`;
-      return `H[${hi}](R,function(){return{valid:false,errors:[]}})`;
-    })
-    .join(',');
-  if (isEsm) {
-    out += `const validators=[${arrBody}];\nexport default validators;\nexport { validators${fmtOut.exportsSetFormats ? ', setFormats' : ''} };\n`;
-  } else {
-    out += `module.exports=[${arrBody}];\n`;
-    if (fmtOut.exportsSetFormats) out += 'module.exports.setFormats=setFormats;\n';
-  }
-
-  return out;
-}
-
-function loadBundle(Validator, mods, schemas, opts) {
-  return schemas.map((schema, i) => {
-    if (mods[i]) return Validator.fromStandalone(mods[i], schema, opts);
-    return new Validator(schema, opts);
-  });
-}
-
-module.exports = {
-  toStandalone,
-  toStandaloneModule,
-  bundle,
-  bundleStandalone,
-  bundleCompact,
-  loadBundle,
-};
+// Node resolution of the AOT emitters. Browser bundles swap this file for
+// `lib/aot.browser.js` via the package.json `browser` field, so the default
+// browser bundle carries no emitters and no embedded safe-regex source; a
+// page that wants to emit validators imports `ata-validator/aot`, which
+// reaches `lib/aot-impl.js` directly and works without `fs`.
+module.exports = require('./aot-impl.js');

package/lib/buffer-gate.browser.js

@@ -0,0 +1,13 @@
+'use strict';
+
+// Browser twin of lib/buffer-gate.js, wired by the package.json `browser`
+// field. The gate exists to route schemas the native walker answers wrongly;
+// a browser bundle never loads the native walker, so there is nothing to
+// route and the shape list can stay out of the bundle. index.js only consults
+// the gate when the native addon loaded, which it never does here, so these
+// are unreachable, kept callable for safety.
+
+module.exports = {
+  bufferNeedsSlowPath: () => false,
+  installSlowBufferApis() {},
+};

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.12.1';
+module.exports = '1.13.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.12.1",
+  "version": "1.13.1",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -20,6 +20,11 @@
       "import": "./compat.mjs",
       "require": "./compat.js"
     },
+    "./aot": {
+      "types": "./aot.d.ts",
+      "import": "./aot.mjs",
+      "require": "./aot.js"
+    },
     "./build": {
       "types": "./build.d.ts",
       "import": "./build.mjs",
@@ -37,7 +42,9 @@
     "ata": "bin/ata.js"
   },
   "browser": {
-    "./lib/native-load.js": "./lib/native-load.browser.js"
+    "./lib/native-load.js": "./lib/native-load.browser.js",
+    "./lib/aot.js": "./lib/aot.browser.js",
+    "./lib/buffer-gate.js": "./lib/buffer-gate.browser.js"
   },
   "scripts": {
     "prepublishOnly": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && ATA_ALLOW_DOC_PLACEHOLDERS=1 node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
@@ -96,6 +103,9 @@
     "index.mjs",
     "index.browser.mjs",
     "index.d.ts",
+    "aot.js",
+    "aot.mjs",
+    "aot.d.ts",
     "lib/",
     "compat.js",
     "compat.mjs",
@@ -112,13 +122,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.12.1",
-    "@ata-validator/native-darwin-x64": "1.12.1",
-    "@ata-validator/native-linux-x64-gnu": "1.12.1",
-    "@ata-validator/native-linux-arm64-gnu": "1.12.1",
-    "@ata-validator/native-linux-x64-musl": "1.12.1",
-    "@ata-validator/native-linux-arm64-musl": "1.12.1",
-    "@ata-validator/native-win32-x64": "1.12.1"
+    "@ata-validator/native-darwin-arm64": "1.13.1",
+    "@ata-validator/native-darwin-x64": "1.13.1",
+    "@ata-validator/native-linux-x64-gnu": "1.13.1",
+    "@ata-validator/native-linux-arm64-gnu": "1.13.1",
+    "@ata-validator/native-linux-x64-musl": "1.13.1",
+    "@ata-validator/native-linux-arm64-musl": "1.13.1",
+    "@ata-validator/native-win32-x64": "1.13.1"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"