ata-validator 1.13.2 → 1.14.0

package/index.js

@@ -216,6 +216,31 @@ function collectRemovals(schema, actions, path) {
   }
 }
 
+// Emit the in-place strip for one schema node and everything under its
+// `properties`. Scope matches collectRemovals(): object properties only, so
+// the two paths keep the same answer.
+function emitRemovals(node, access, lines, depth, seen) {
+  if (!node || typeof node !== 'object' || !node.properties) return;
+  if (seen.has(node)) return;
+  seen.add(node);
+  const keys = Object.keys(node.properties);
+  if (node.additionalProperties === false && keys.length > 0) {
+    const kv = '_k' + depth;
+    const checks = keys.map((k) => `${kv}!==${JSON.stringify(k)}`).join('&&');
+    const guard = depth === 0
+      ? ''
+      : `if(${access}!==null&&typeof ${access}==='object'&&!Array.isArray(${access}))`;
+    lines.push(`${guard}for(var ${kv} in ${access})if(${checks})delete ${access}[${kv}]`);
+  }
+  for (const key of keys) {
+    const prop = node.properties[key];
+    if (prop && typeof prop === 'object' && prop.properties) {
+      emitRemovals(prop, `${access}[${JSON.stringify(key)}]`, lines, depth + 1, seen);
+    }
+  }
+  seen.delete(node);
+}
+
 // Generate a fast preprocess function via codegen instead of closure arrays
 function buildPreprocessCodegen(schema, options) {
   if (typeof schema !== 'object' || schema === null || !schema.properties) return null;
@@ -223,10 +248,14 @@ function buildPreprocessCodegen(schema, options) {
   const props = schema.properties;
   const keys = Object.keys(props);
 
-  // removeAdditional: inline key check
-  if (options.removeAdditional && schema.additionalProperties === false) {
-    const checks = keys.map(k => `_k!==${JSON.stringify(k)}`).join('&&');
-    lines.push(`for(var _k in d)if(${checks})delete d[_k]`);
+  // removeAdditional: strip unknown keys at every level the schema describes,
+  // not just the top one. The closure path below (collectRemovals) always
+  // recursed; this one did not, so the same schema and the same document got
+  // opposite verdicts depending on whether the runtime allowed code
+  // generation, and the codegen answer was the one that disagreed with both
+  // the interpreter and the default validator this aims to match.
+  if (options.removeAdditional) {
+    emitRemovals(schema, 'd', lines, 0, new Set());
   }
 
   // coerceTypes: inline per property

package/lib/aot-impl.js

@@ -140,6 +140,84 @@ function emitFormatDecls(closures, mode, declKW) {
   return { decls: out, exportsSetFormats: false };
 }
 
+// Emit an expression that rebuilds `access` from the properties the schema
+// declares, dropping everything else. This is the sanitising counterpart to
+// removeAdditional: instead of enumerating the input and deleting the keys
+// that do not belong, it reads only the keys that do. That is O(schema)
+// rather than O(input), it leaves the caller's object untouched, and it keeps
+// one hidden class instead of walking the object through a transition per
+// delete.
+//
+// Returns null when the clone cannot be proven exact, and the module then
+// simply has no parse(). Declining is recoverable; a sanitiser that quietly
+// drops a property the schema allows is not.
+function emitClone(node, access, depth) {
+  if (!node || typeof node !== 'object') return null;
+  if (depth > 12) return null;
+  // Only plain object nodes are cloneable, and only when the schema names
+  // every property it keeps. A union type, a $ref, or any composition means
+  // the set of allowed keys is not this node's to decide.
+  if (node.$ref || node.allOf || node.anyOf || node.oneOf || node.not ||
+      node.if || node.patternProperties || node.unevaluatedProperties ||
+      node.additionalProperties === true ||
+      (node.additionalProperties && typeof node.additionalProperties === 'object')) {
+    return null;
+  }
+  if (node.type !== 'object' || !node.properties) return null;
+  const keys = Object.keys(node.properties);
+  if (keys.length === 0) return null;
+  const required = new Set(Array.isArray(node.required) ? node.required : []);
+
+  // A property is copyable only when the emitter can name everything that
+  // may live under it: a primitive holds nothing, and an object with declared
+  // properties is rebuilt the same way. A $ref, a composition, an array of
+  // objects or an untyped node could all carry keys this code cannot see, and
+  // copying the reference would smuggle them into a value that claims to be
+  // sanitised, so the whole clone is declined instead.
+  const PRIMITIVE = new Set(['string', 'number', 'integer', 'boolean', 'null']);
+  const fixed = [];
+  const conditional = [];
+  for (const key of keys) {
+    const prop = node.properties[key];
+    if (!prop || typeof prop !== 'object') return null;
+    if (prop.$ref || prop.allOf || prop.anyOf || prop.oneOf || prop.not || prop.if) return null;
+    const read = `${access}[${JSON.stringify(key)}]`;
+    let value;
+    const types = Array.isArray(prop.type) ? prop.type : [prop.type];
+    if (types.every((t) => PRIMITIVE.has(t))) {
+      value = read;
+    } else if (prop.type === 'object' && prop.properties) {
+      const nested = emitClone(prop, read, depth + 1);
+      if (!nested) return null;
+      // The nested schema may also admit null, in which case there is nothing
+      // to rebuild and the value passes through.
+      value = required.has(key) ? nested : nested;
+    } else if (prop.type === 'array' && prop.items && typeof prop.items === 'object' &&
+               !Array.isArray(prop.items) &&
+               (Array.isArray(prop.items.type) ? prop.items.type : [prop.items.type])
+                 .every((t) => PRIMITIVE.has(t))) {
+      // An array of primitives has nowhere to hide a key. The reference is
+      // shared with the input, exactly as a shallow strip would leave it.
+      value = read;
+    } else {
+      return null;
+    }
+    if (required.has(key)) fixed.push(`${JSON.stringify(key)}: ${value}`);
+    else conditional.push({ key, value });
+  }
+  if (fixed.length === 0 && conditional.length === 0) return null;
+
+  const literal = `{ ${fixed.join(', ')} }`;
+  if (conditional.length === 0) return literal;
+  // Optional properties are added only when present, so the result never
+  // gains a key the input did not have.
+  const tmp = `_c${depth}`;
+  const adds = conditional
+    .map(({ key, value }) => `if (${JSON.stringify(key)} in ${access}) ${tmp}[${JSON.stringify(key)}] = ${value};`)
+    .join(' ');
+  return `(function(){ const ${tmp} = ${literal}; ${adds} return ${tmp}; })()`;
+}
+
 function toStandaloneModule(validator, opts) {
   validator._ensureCompiled();
   const jsFn = validator._jsFn;
@@ -219,10 +297,30 @@ function toStandaloneModule(validator, opts) {
     ? 'return _fn(data) ? VALID : { valid: false, errors: errFn(data, true).errors }'
     : 'return _fn(data) ? VALID : ABORT';
 
-  const names = fmt.exportsSetFormats ? 'validate, isValid, setFormats' : 'validate, isValid';
+  // parse(): validate, then hand back a copy holding only the properties the
+  // schema declares. Off by default: it costs bytes in every emitted module,
+  // and the reason to compile a schema ahead of time is usually to ship as
+  // little as possible. Ask for it with { parse: true }.
+  const cloneExpr = !(opts && opts.parse) ? null : emitClone(
+    typeof validator._schemaObj === 'object' ? validator._schemaObj : null,
+    'data',
+    0,
+  );
+  // Named _ataParse rather than parse: the emitted module also carries the
+  // safe-regex prelude, which has a module-scope parse() of its own for
+  // reading patterns. A second declaration of that name shadowed it and the
+  // prelude called this one instead, reaching _fn before its initialiser ran.
+  const parseCore = cloneExpr
+    ? `function _ataParse(data) {\n  if (!_fn(data)) { const e = new Error('validation failed'); e.name = 'AtaValidationError'; throw e; }\n  return ${cloneExpr};\n}\n`
+    : '';
+
+  const baseNames = cloneExpr ? 'validate, isValid' : 'validate, isValid';
+  const names = fmt.exportsSetFormats ? baseNames + ', setFormats' : baseNames;
+  const parseAlias = cloneExpr ? ', _ataParse as parse' : '';
+  const parseProp = cloneExpr ? ', parse: _ataParse' : '';
   const exports = format === 'esm'
-    ? `export { ${names} };\nexport default { ${names} };\n`
-    : `module.exports = { ${names} };\nmodule.exports.default = module.exports;\n`;
+    ? `export { ${names}${parseAlias} };\nexport default { ${names}${parseProp} };\n`
+    : `module.exports = { ${names}${parseProp} };\nmodule.exports.default = module.exports;\n`;
 
   return `// Auto-generated by ata-validator — do not edit.
 // Schema is embedded; runtime has zero dependency on ata-validator.
@@ -243,7 +341,7 @@ ${closureDecls}${preambleDecls}${formatDecls}const _fn = function(d) {
 };
 ${errCore}function isValid(data) { return _fn(data); }
 function validate(data) { ${validBody}; }
-${exports}`;
+${parseCore}${exports}`;
 }
 
 // Bundle multiple validators into a single JS file for fast startup.

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.13.2';
+module.exports = '1.14.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.13.2",
+  "version": "1.14.0",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -51,7 +51,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -122,13 +122,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.13.2",
-    "@ata-validator/native-darwin-x64": "1.13.2",
-    "@ata-validator/native-linux-x64-gnu": "1.13.2",
-    "@ata-validator/native-linux-arm64-gnu": "1.13.2",
-    "@ata-validator/native-linux-x64-musl": "1.13.2",
-    "@ata-validator/native-linux-arm64-musl": "1.13.2",
-    "@ata-validator/native-win32-x64": "1.13.2"
+    "@ata-validator/native-darwin-arm64": "1.14.0",
+    "@ata-validator/native-darwin-x64": "1.14.0",
+    "@ata-validator/native-linux-x64-gnu": "1.14.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.14.0",
+    "@ata-validator/native-linux-x64-musl": "1.14.0",
+    "@ata-validator/native-linux-arm64-musl": "1.14.0",
+    "@ata-validator/native-win32-x64": "1.14.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"