ata-validator 1.17.1 → 1.18.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.17.2 - 2026-09-13
+
+### Changed
+
+- `new Validator(schema)` no longer walks the schema. Normalization (the draft-07 rewrites, `nullable`, `format` removal under `assertFormat: false`) and the scan that decides whether any of it is needed now run on the first read of the schema, which is the first compile. Construction is the instance and its fields. Measured on the schema-benchmarks product schema built fresh each time: 4.28 to 0.91 µs; with the `@ata-project/keywords` wrapper (0.3.1, which reads the schema lazily too) 6.70 to 2.81 µs. Nothing observable changes for a schema that is used: the same normalized document reaches the engines, and the identity cache, `keywords`, `assertFormat` and `source` options behave as before. `tests/test_lazy_normalization.js` counts property reads on the schema during construction and holds them at the dialect lookup alone.
+
 ## 1.17.1 - 2026-09-13
 
 ### Changed

package/README.md

@@ -51,9 +51,25 @@ if (isValid(req.body)) {
 
 The `.compiled.mjs` modules are self-contained: zero runtime dependency on ata-validator, fully tree-shakeable, with TypeScript types emitted alongside.
 
+## Measured by others
+
+Two public harnesses run ata without ata's involvement. Quote these before anything in this
+file.
+
+- [schemabenchmarks.dev](https://schemabenchmarks.dev), a benchmark of runtime validation
+  libraries maintained outside this project. On its validation page, valid data, the run of
+  2026-09-13 against ata 1.14.1 puts ata first at 603 ns, with the next entry at 1.77 times
+  that. The same site puts ata last on the download page, at 64.9 KB gzipped, because the entry
+  it bundles is the runtime compiler; the module `ata build` emits for that schema is 3.9 KB
+  minified and gzipped, and a compiled entry for the harness is in preparation.
+- [Bowtie](https://bowtie.report/), the cross-implementation JSON Schema test harness. ata's
+  harness runs Draft 2020-12 and draft 7 there; on the harness at ata 1.16.1 the official suite
+  passes with nothing failed, errored or skipped under Bowtie's own runner. The v1 dialect is
+  declared in a pending harness change that waits for a Bowtie release.
+
 ## Why AOT
 
-| Dimension | Schema | ata-AOT | AJV-runtime | Difference |
+| Dimension | Schema | ata-AOT | runtime validator | Difference |
 |---|---|---|---|---|
 | Bundle (gzipped) | simple | 1.0 KB | 52.7 KB | 50.5x smaller |
 | Bundle (gzipped) | complex | 4.8 KB | 52.7 KB | 11.0x smaller |
@@ -62,8 +78,8 @@ The `.compiled.mjs` modules are self-contained: zero runtime dependency on ata-v
 | Throughput (1M ops) | simple | 258 Mops/s | 102 Mops/s | 2.5x faster |
 | Compile time | simple | 8 µs | 1.61 ms | 191x faster |
 
-Reproduce on your machine with `npm run bench:aot-vs-ajv`. Numbers from one run on Apple
-M4 Pro, Node 25.2.1, 2026-08-13. Across three runs throughput moved between 258 and 278
+The runtime column is the default validator most frameworks ship. Reproduce on your machine
+with `npm run bench:aot-vs-ajv`. Numbers from one run on Apple M4 Pro, Node 25.2.1, 2026-08-13. Across three runs throughput moved between 258 and 278
 Mops/s and the compile ratio between 150x and 199x, so treat the last two rows as an order
 of magnitude rather than a constant.
 

package/index.js

@@ -797,6 +797,26 @@ function resolveSchemaForPreprocess(schema, schemaMap) {
   return cloned || s
 }
 
+// `_schemaObj` and `_usesKeywords` are materialized together on first read:
+// the caller's schema normalized on a clone (the caller's object is never
+// touched), `format` stripped under `assertFormat: false`, and the custom
+// keyword scan. The accessors then step aside for own data properties, so
+// every later read is a plain field.
+function _materializeSchema(self) {
+  const raw = self._rawSchema;
+  const options = self._options;
+  let schemaObj = _normalizeCallerSchema(raw);
+  const isCallers = self._rawIsCallers && schemaObj === raw;
+  if (options.assertFormat === false) {
+    schemaObj = stripFormatAssertions(isCallers ? _deepCloneWithSymbols(schemaObj) : schemaObj);
+  }
+  const usesKeywords = self._keywords !== null && schemaUsesKeywords(schemaObj, self._keywords);
+  Object.defineProperty(self, '_schemaObj', { value: schemaObj, writable: true, configurable: true, enumerable: true });
+  Object.defineProperty(self, '_usesKeywords', { value: usesKeywords, writable: true, configurable: true, enumerable: true });
+  Object.defineProperty(self, '_schemaIsCallers', { value: isCallers && schemaObj === raw, writable: true, configurable: true, enumerable: true });
+  return schemaObj;
+}
+
 class Validator {
   constructor(schema, opts) {
     const options = opts || {};
@@ -809,22 +829,16 @@ class Validator {
       if (hit) return hit;
     }
 
+    // The schema is not walked here. Normalization (draft-07 rewrites,
+    // nullable, `assertFormat: false`) and the scan that decides whether any
+    // of it is needed run on the first read of `_schemaObj`, which is the
+    // first compile. Construction is the object and its fields; a server
+    // building a validator per request pays nothing for a schema it never
+    // uses, and a benchmark timing construction measures construction.
     // When schema is a string, JSON.parse already produces a fresh object.
-    // When schema is an object, normalization runs on a clone so the caller's
-    // object is never touched.
-    let schemaObj = typeof schema === "string"
-      ? _normalizeCallerSchema(JSON.parse(schema))
-      : _normalizeCallerSchema(schema);
-    const rootIsDraft7 = !!(schemaObj && typeof schemaObj === 'object' && typeof schemaObj.$schema === 'string' &&
-      (schemaObj.$schema === 'http://json-schema.org/draft-07/schema#' || schemaObj.$schema === 'http://json-schema.org/draft-07/schema'));
-
-    // assertFormat: false makes `format` annotation-only. Strip it on a clone
-    // so the caller's schema keeps the keyword.
-    if (options.assertFormat === false) {
-      schemaObj = stripFormatAssertions(
-        schemaObj === schema ? _deepCloneWithSymbols(schemaObj) : schemaObj,
-      );
-    }
+    const raw = typeof schema === "string" ? JSON.parse(schema) : schema;
+    const rootIsDraft7 = !!(raw && typeof raw === 'object' && typeof raw.$schema === 'string' &&
+      (raw.$schema === 'http://json-schema.org/draft-07/schema#' || raw.$schema === 'http://json-schema.org/draft-07/schema'));
 
     // Built here rather than below because `$vocabulary` is resolved against
     // it, and that resolution waits until compilation so a meta-schema
@@ -832,21 +846,17 @@ class Validator {
     const shared = buildSchemaMap(options.schemas, rootIsDraft7);
     const schemaMap = shared || new Map();
     this._schemaMapShared = shared !== null;
-    this._schemaIsCallers = schemaObj === schema;
     this._vocabulariesApplied = false;
 
-    // Custom keywords, normalized once. `_usesKeywords` is what routes the
-    // schema to the interpreted engine and keeps it out of the shared
-    // compile cache; a schema that registers keywords but uses none of them
-    // takes the ordinary path.
+    // Custom keywords, normalized once. `_usesKeywords` (resolved with the
+    // schema) is what routes the schema to the interpreted engine and keeps
+    // it out of the shared compile cache; a schema that registers keywords
+    // but uses none of them takes the ordinary path.
     this._keywords = normalizeKeywords(options.keywords);
-    this._usesKeywords = false;
-    if (this._keywords !== null && schemaUsesKeywords(schemaObj, this._keywords)) {
-      this._usesKeywords = true;
-    }
 
     this._schemaStr = null; // lazy: computed on first use
-    this._schemaObj = schemaObj;
+    this._rawSchema = raw;
+    this._rawIsCallers = typeof schema !== "string";
     this._options = options;
     this._noOpts = !opts;
     this._initialized = false;
@@ -2162,6 +2172,18 @@ function _defineLazyMethod(name, maker) {
   });
 }
 
+for (const [name, pick] of [
+  ['_schemaObj', (self) => _materializeSchema(self)],
+  ['_usesKeywords', (self) => { _materializeSchema(self); return self._usesKeywords; }],
+  ['_schemaIsCallers', (self) => { _materializeSchema(self); return self._schemaIsCallers; }],
+]) {
+  Object.defineProperty(Validator.prototype, name, {
+    configurable: true,
+    get() { return pick(this); },
+    set(v) { Object.defineProperty(this, name, { value: v, writable: true, configurable: true, enumerable: true }); },
+  });
+}
+
 _defineLazyMethod('validate', (self) => (data) => {
   self._ensureCompiled();
   return self.validate(data);

package/lib/aot-impl.js

@@ -202,6 +202,17 @@ function emitClone(node, access, depth) {
       // An array of primitives has nowhere to hide a key. The reference is
       // shared with the input, exactly as a shallow strip would leave it.
       value = read;
+    } else if (prop.type === 'array' && prop.items && typeof prop.items === 'object' &&
+               !Array.isArray(prop.items) && prop.items.type === 'object' &&
+               prop.items.properties) {
+      // An array of objects: rebuild each element the same way, so unknown
+      // keys inside the array are dropped too. Most real schemas have one of
+      // these, and declining them left parse() emitted only for shapes nobody
+      // writes.
+      const el = '_e' + depth;
+      const inner = emitClone(prop.items, el, depth + 1);
+      if (!inner) return null;
+      value = `${read}.map((${el}) => (${inner}))`;
     } else {
       return null;
     }

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.17.1';
+module.exports = '1.18.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.17.1",
+  "version": "1.18.0",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -51,7 +51,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -122,13 +122,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.17.1",
-    "@ata-validator/native-darwin-x64": "1.17.1",
-    "@ata-validator/native-linux-arm64-gnu": "1.17.1",
-    "@ata-validator/native-linux-arm64-musl": "1.17.1",
-    "@ata-validator/native-linux-x64-gnu": "1.17.1",
-    "@ata-validator/native-linux-x64-musl": "1.17.1",
-    "@ata-validator/native-win32-x64": "1.17.1"
+    "@ata-validator/native-darwin-arm64": "1.18.0",
+    "@ata-validator/native-darwin-x64": "1.18.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.18.0",
+    "@ata-validator/native-linux-arm64-musl": "1.18.0",
+    "@ata-validator/native-linux-x64-gnu": "1.18.0",
+    "@ata-validator/native-linux-x64-musl": "1.18.0",
+    "@ata-validator/native-win32-x64": "1.18.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"