ata-validator 1.17.2 → 1.18.1

package/README.md

@@ -51,9 +51,25 @@ if (isValid(req.body)) {
 
 The `.compiled.mjs` modules are self-contained: zero runtime dependency on ata-validator, fully tree-shakeable, with TypeScript types emitted alongside.
 
+## Measured by others
+
+Two public harnesses run ata without ata's involvement. Quote these before anything in this
+file.
+
+- [schemabenchmarks.dev](https://schemabenchmarks.dev), a benchmark of runtime validation
+  libraries maintained outside this project. On its validation page, valid data, the run of
+  2026-09-13 against ata 1.14.1 puts ata first at 603 ns, with the next entry at 1.77 times
+  that. The same site puts ata last on the download page, at 64.9 KB gzipped, because the entry
+  it bundles is the runtime compiler; the module `ata build` emits for that schema is 3.9 KB
+  minified and gzipped, and a compiled entry for the harness is in preparation.
+- [Bowtie](https://bowtie.report/), the cross-implementation JSON Schema test harness. ata's
+  harness runs Draft 2020-12 and draft 7 there; on the harness at ata 1.16.1 the official suite
+  passes with nothing failed, errored or skipped under Bowtie's own runner. The v1 dialect is
+  declared in a pending harness change that waits for a Bowtie release.
+
 ## Why AOT
 
-| Dimension | Schema | ata-AOT | AJV-runtime | Difference |
+| Dimension | Schema | ata-AOT | runtime validator | Difference |
 |---|---|---|---|---|
 | Bundle (gzipped) | simple | 1.0 KB | 52.7 KB | 50.5x smaller |
 | Bundle (gzipped) | complex | 4.8 KB | 52.7 KB | 11.0x smaller |
@@ -62,8 +78,8 @@ The `.compiled.mjs` modules are self-contained: zero runtime dependency on ata-v
 | Throughput (1M ops) | simple | 258 Mops/s | 102 Mops/s | 2.5x faster |
 | Compile time | simple | 8 µs | 1.61 ms | 191x faster |
 
-Reproduce on your machine with `npm run bench:aot-vs-ajv`. Numbers from one run on Apple
-M4 Pro, Node 25.2.1, 2026-08-13. Across three runs throughput moved between 258 and 278
+The runtime column is the default validator most frameworks ship. Reproduce on your machine
+with `npm run bench:aot-vs-ajv`. Numbers from one run on Apple M4 Pro, Node 25.2.1, 2026-08-13. Across three runs throughput moved between 258 and 278
 Mops/s and the compile ratio between 150x and 199x, so treat the last two rows as an order
 of magnitude rather than a constant.
 

package/index.js

@@ -10,7 +10,7 @@ const {
   compileToJSCodegenWithErrors,
   compileToJSCombined,
 } = require("./lib/js-compiler");
-const { normalizeDraft7, normalizeNullable, stripFormatAssertions } = require("./lib/draft7");
+const { normalizeDraft7, normalizeNullable, normalizeExclusiveBounds, stripFormatAssertions } = require("./lib/draft7");
 const { enabledKeywords, stripDisabledKeywords } = require("./lib/vocabularies");
 const { needsNormalization } = require("./lib/schema-scan");
 const { isV1Dialect } = require("./lib/dialect");
@@ -618,6 +618,7 @@ function _normalizeCallerSchema(s, inheritDraft7) {
   const copy = _deepCloneWithSymbols(s)
   if (needsDraft7) normalizeDraft7(copy, true)
   normalizeNullable(copy)
+  normalizeExclusiveBounds(copy)
   // Return original when normalization produced no change, copy otherwise.
   // Kept even though the walk has already said there is work, so that a walk
   // which over-reports still returns exactly what it returned before.

package/lib/aot-impl.js

@@ -202,6 +202,17 @@ function emitClone(node, access, depth) {
       // An array of primitives has nowhere to hide a key. The reference is
       // shared with the input, exactly as a shallow strip would leave it.
       value = read;
+    } else if (prop.type === 'array' && prop.items && typeof prop.items === 'object' &&
+               !Array.isArray(prop.items) && prop.items.type === 'object' &&
+               prop.items.properties) {
+      // An array of objects: rebuild each element the same way, so unknown
+      // keys inside the array are dropped too. Most real schemas have one of
+      // these, and declining them left parse() emitted only for shapes nobody
+      // writes.
+      const el = '_e' + depth;
+      const inner = emitClone(prop.items, el, depth + 1);
+      if (!inner) return null;
+      value = `${read}.map((${el}) => (${inner}))`;
     } else {
       return null;
     }

package/lib/draft7.js

@@ -105,6 +105,50 @@ function _normalize(schema) {
 // 'null' (`{ type: 'X', nullable: true }` -> `{ type: ['X', 'null'] }`), the
 // same shape AJV produces under its `nullable` option. Recurses only through
 // schema-bearing keywords so it never touches data values (default, const, etc.).
+
+// draft-04 spelled the exclusive bounds as booleans modifying `minimum` and
+// `maximum`; every dialect since spells them as the bound itself. The engines
+// read the numeric form, and the codegen path compared the value against the
+// boolean directly, so `true` became 1: a schema saying "below 5, exclusive"
+// rejected 1 and a schema saying "above 3, exclusive" accepted 3. Rewriting
+// the pair here gives every engine the same numeric keyword, which is also
+// what makes the two agree.
+function normalizeExclusiveBounds(schema) {
+  _walkExclusive(schema, new Set())
+  return schema
+}
+
+function _walkExclusive(node, seen) {
+  if (typeof node !== 'object' || node === null) return
+  if (Array.isArray(node)) {
+    for (const item of node) _walkExclusive(item, seen)
+    return
+  }
+  if (seen.has(node)) return
+  seen.add(node)
+
+  if (typeof node.exclusiveMinimum === 'boolean') {
+    if (node.exclusiveMinimum === true && typeof node.minimum === 'number') {
+      node.exclusiveMinimum = node.minimum
+      delete node.minimum
+    } else {
+      // `false` restates the inclusive bound, and a boolean with no bound
+      // beside it says nothing at all.
+      delete node.exclusiveMinimum
+    }
+  }
+  if (typeof node.exclusiveMaximum === 'boolean') {
+    if (node.exclusiveMaximum === true && typeof node.maximum === 'number') {
+      node.exclusiveMaximum = node.maximum
+      delete node.maximum
+    } else {
+      delete node.exclusiveMaximum
+    }
+  }
+
+  for (const key of Object.keys(node)) _walkExclusive(node[key], seen)
+}
+
 function normalizeNullable(schema) {
   if (typeof schema !== 'object' || schema === null) return schema
   _normalizeNullable(schema)
@@ -190,4 +234,4 @@ function _stripFormat(schema, seen) {
   }
 }
 
-module.exports = { isDraft7, normalizeDraft7, normalizeNullable, stripFormatAssertions }
+module.exports = { isDraft7, normalizeDraft7, normalizeNullable, normalizeExclusiveBounds, stripFormatAssertions }

package/lib/schema-scan.js

@@ -27,6 +27,7 @@ const ANCHOR_ID = 1 << 2;        // a fragment-only `$id`, which is an anchor in
 const DEFINITIONS = 1 << 3;      // `definitions`, renamed to `$defs`
 const DEPENDENCIES = 1 << 4;     // `dependencies`, split into two keywords
 const TUPLE_ITEMS = 1 << 5;      // array-valued `items`, split into `prefixItems`
+const EXCLUSIVE_BOOL = 1 << 6;   // draft-04's boolean `exclusiveMinimum`/`exclusiveMaximum`
 
 // Everything only draft-07 normalization acts on. A schema of another dialect
 // can carry these without them meaning anything, so they are read together
@@ -74,6 +75,9 @@ function scan(schema) {
     if (node.definitions !== undefined && node.$defs === undefined) bits |= DEFINITIONS;
     if (node.dependencies !== undefined) bits |= DEPENDENCIES;
     if (Array.isArray(node.items)) bits |= TUPLE_ITEMS;
+    if (typeof node.exclusiveMinimum === 'boolean' || typeof node.exclusiveMaximum === 'boolean') {
+      bits |= EXCLUSIVE_BOOL;
+    }
     if (typeof node.$id === 'string' && ANCHOR_ID_RE.test(node.$id)) bits |= ANCHOR_ID;
 
     // `Object.keys` rather than `for...in`: the prototype chain has nothing
@@ -99,6 +103,10 @@ function scan(schema) {
 function needsNormalization(schema, isDraft7) {
   const bits = scan(schema);
   if (bits & NULLABLE) return true;
+  // The boolean form of the exclusive bounds is draft-04's, and it is
+  // unambiguous wherever it appears: no later dialect gives a boolean any
+  // meaning there. Normalizing it is not gated on the declared dialect.
+  if (bits & EXCLUSIVE_BOOL) return true;
   return isDraft7 ? (bits & DRAFT7_WORK) !== 0 : false;
 }
 
@@ -111,5 +119,6 @@ module.exports = {
   DEFINITIONS,
   DEPENDENCIES,
   TUPLE_ITEMS,
+  EXCLUSIVE_BOOL,
   DRAFT7_WORK,
 };

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.17.2';
+module.exports = '1.18.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.17.2",
+  "version": "1.18.1",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -51,7 +51,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -122,13 +122,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.17.2",
-    "@ata-validator/native-darwin-x64": "1.17.2",
-    "@ata-validator/native-linux-arm64-gnu": "1.17.2",
-    "@ata-validator/native-linux-arm64-musl": "1.17.2",
-    "@ata-validator/native-linux-x64-gnu": "1.17.2",
-    "@ata-validator/native-linux-x64-musl": "1.17.2",
-    "@ata-validator/native-win32-x64": "1.17.2"
+    "@ata-validator/native-darwin-arm64": "1.18.1",
+    "@ata-validator/native-darwin-x64": "1.18.1",
+    "@ata-validator/native-linux-arm64-gnu": "1.18.1",
+    "@ata-validator/native-linux-arm64-musl": "1.18.1",
+    "@ata-validator/native-linux-x64-gnu": "1.18.1",
+    "@ata-validator/native-linux-x64-musl": "1.18.1",
+    "@ata-validator/native-win32-x64": "1.18.1"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"