ata-validator 1.2.0 → 1.2.2

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.2.2 - 2026-07-26
+
+### Fixed
+
+- The `uri` format was too permissive: it only checked for a scheme prefix, so a string like `https: not a url` passed. It now also rejects any whitespace or control character, so values that carry a scheme but are not URIs are caught. Real URIs, including `mailto:` and `urn:` forms and hyphenated hosts, still pass. `uri-reference` now rejects the same characters and accepts the empty string (a valid same-document reference), which the codegen path had wrongly rejected.
+- `date-time` now accepts lowercase `t` and `z` separators per RFC 3339, matching the interpreted engine. `duration` now rejects a trailing `T` with no time component (`PT`, `P1DT`), which are not valid ISO 8601 durations.
+- These format checks are emitted in two places, the JS compiler and the interpreted engine, and had drifted apart on the cases above. A new differential test (`tests/test_format_engine_parity.js`) runs every built-in format through both engines over a shared corpus and fails on any disagreement, so the two stay in lockstep.
+
+## 1.2.1 - 2026-07-18
+
+### Fixed
+
+- Schemas the JS compiler cannot represent now validate on the engine that gets them right, instead of always preferring the native addon when it is installed. The native resolver mishandles several `$id` base-URI corners (URN bases, absolute-path references, empty JSON-pointer tokens, nested `$id` scopes) and silently skips regex patterns its engine cannot parse; all of these now route to the interpreted engine. Pure dynamic-ref schemas stay on the native path, which tracks `$dynamicRef` scopes more completely. Buffer and parallel APIs are unchanged.
+- The JS compiler no longer compiles two shapes it got wrong: `unevaluatedItems` with `contains` in scope (contains-matched items were never credited as evaluated, rejecting valid arrays) and plain-anchor schemas that open nested `$id` scopes (same-named anchors in different base-URI scopes resolved to the wrong target). Both now go to the interpreted engine.
+- Official draft 2020-12 suite: 1190 of 1190 applicable cases with the native accelerator (up from 1175), 1188 of 1190 (99.8%) pure-JS (up from 1184). Draft 7 suite gains four `ref.json` cases.
+
 ## 1.2.0 - 2026-07-18
 
 ### Added

package/README.md

@@ -20,7 +20,7 @@ The `ata-validator` package itself is pure JavaScript. The native accelerator (s
 npm install ata-validator --omit=optional
 ```
 
-or set `ATA_NO_NATIVE=1` at runtime. Typical schemas compile to specialized JS; shapes the compiler cannot represent (some `$dynamicRef`, cyclic `$ref`, unusual keyword interactions) fall back to an interpreted engine, so every schema validates in every environment. The pure-JS setup passes 99.5% of the official draft 2020-12 test suite. Only the buffer and parallel APIs (`isValid` on raw buffers, `countValid`, `batchIsValid`, `validateAndParse`) need the native engine and say so with a clear error.
+or set `ATA_NO_NATIVE=1` at runtime. Typical schemas compile to specialized JS; shapes the compiler cannot represent (some `$dynamicRef`, cyclic `$ref`, unusual keyword interactions) fall back to an interpreted engine, so every schema validates in every environment. The pure-JS setup passes 99.8% of the official draft 2020-12 test suite. Only the buffer and parallel APIs (`isValid` on raw buffers, `countValid`, `batchIsValid`, `validateAndParse`) need the native engine and say so with a clear error.
 
 In your code:
 
@@ -396,6 +396,8 @@ const result = v['~standard'].validate(data);
 
 ### Fastify Plugin
 
+Measured against Fastify's own schema and validation test files with ata swapped in as the default validator: 181 of 187 tests pass, and the remaining six assert the default validator's own extension API rather than validation behavior. Validation errors follow the schema's keyword declaration order, so error-message plugins and `transformErrors` hooks written against the default validator see the same order.
+
 ```bash
 npm install fastify-ata
 ```
@@ -464,7 +466,7 @@ Copy-paste recipes for the common frameworks. Most need 10-20 lines of glue. See
 
 ### Known limitations
 
-The 98.5% Draft 2020-12 pass rate excludes areas that are deliberate scope decisions for 1.x:
+The Draft 2020-12 pass rate (1188 of 1190 applicable cases, 99.8%, in the pure-JS configuration; 1190 of 1190 with the native accelerator installed, which covers the two remaining `$dynamicRef` scope corners) excludes areas that are deliberate scope decisions for 1.x:
 
 - **Remote `$ref` over the network** is not fetched. Register cross-schema refs explicitly with `schemas: [...]` or `addSchema()`.
 - **`$vocabulary`** is not implemented; custom vocabularies are ignored rather than enforced.

package/index.js

@@ -1017,14 +1017,38 @@ class Validator {
         };
       }
     } else if (native) {
-      // Native-only path: no JS codegen, use native for everything
+      // No JS codegen: buffer/parallel APIs always come from the native
+      // engine, but the object-validation entry points go to whichever
+      // engine is more correct for the schema shape. Pure dynamic-ref
+      // schemas stay on the C++ path (full $dynamicRef scope tracking);
+      // everything else uses the interpreted engine, which handles the
+      // $id/URN base-URI resolution corners the native resolver gets wrong.
       this._ensureNative();
-      const _hasDynamic = this._schemaStr.includes('"$dynamicRef"') || this._schemaStr.includes('"$dynamicAnchor"') || this._schemaStr.includes('"$anchor"')
-      // For schemas with dynamic refs/anchors, use validateJSON (C++ path with full support)
-      // instead of validate (NAPI direct V8 path without anchor maps)
-      const _validate = _hasDynamic
-        ? (data) => this._compiled.validateJSON(JSON.stringify(data))
-        : (data) => this._compiled.validate(data);
+      const _hasDynRef = this._schemaStr.includes('"$dynamicRef"') || this._schemaStr.includes('"$dynamicAnchor"')
+      const _hasUneval = this._schemaStr.includes('"unevaluatedProperties"') || this._schemaStr.includes('"unevaluatedItems"')
+      let _validate;
+      if (_hasDynRef && !_hasUneval) {
+        // validateJSON is the C++ path with full anchor-map support; the NAPI
+        // direct V8 `validate` path has no anchor maps.
+        _validate = (data) => this._compiled.validateJSON(JSON.stringify(data));
+        this.validateJSON = (jsonStr) => this._compiled.validateJSON(jsonStr);
+        this.isValidJSON = (jsonStr) => this._compiled.isValidJSON(jsonStr);
+      } else {
+        const { createInterpreter } = require('./lib/interpreter');
+        const interp = createInterpreter(schemaObj, {
+          schemaMap: this._schemaMap.size > 0 ? this._schemaMap : null,
+          formats: this._userFormats,
+        });
+        _validate = (data) => interp.validate(data);
+        this.validateJSON = (jsonStr) => {
+          try {
+            return _validate(JSON.parse(jsonStr));
+          } catch (e) {
+            return { valid: false, errors: [{ keyword: 'syntax', instancePath: '', schemaPath: '#', params: {}, message: e.message }] };
+          }
+        };
+        this.isValidJSON = (jsonStr) => this.validateJSON(jsonStr).valid;
+      }
       this.validate = preprocess
         ? (data) => {
             preprocess(data);
@@ -1032,8 +1056,6 @@ class Validator {
           }
         : _validate;
       this.isValidObject = (data) => _validate(data).valid;
-      this.validateJSON = (jsonStr) => this._compiled.validateJSON(jsonStr);
-      this.isValidJSON = (jsonStr) => this._compiled.isValidJSON(jsonStr);
       this.validateAndParse = (jsonStr) => this._compiled.validateAndParse(jsonStr);
       {
         const slot = this._fastSlot;

package/lib/interpreter.js

@@ -225,8 +225,8 @@ const FORMAT_CHECKS = {
   time: (s) => /^([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d+)?([Zz]|[+-]\d{2}:\d{2})?$/.test(s),
   duration: (s) => /^P(?:\d+Y)?(?:\d+M)?(?:\d+W)?(?:\d+D)?(?:T(?:\d+H)?(?:\d+M)?(?:\d+(?:\.\d+)?S)?)?$/.test(s) && s !== 'P' && !s.endsWith('T'),
   uuid: (s) => s.length === 36 && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(s),
-  uri: (s) => /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(s),
-  'uri-reference': (s) => s === '' || !/\s/.test(s),
+  uri: (s) => /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(s) && !/[\s\u0000-\u001f\u007f]/.test(s),
+  'uri-reference': (s) => !/[\s\u0000-\u001f\u007f]/.test(s),
   ipv4: (s) => { const p = s.split('.'); return p.length === 4 && p.every((n) => { const v = +n; return n !== '' && v >= 0 && v <= 255 && String(v) === n; }); },
   ipv6: (s) => s !== '' && /^[0-9a-fA-F:.]+$/.test(s) && s.split(':').length >= 3 && s.split(':').length <= 8,
   hostname: (s) => s.length > 0 && s.length <= 253 && /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(s),

package/lib/js-compiler.js

@@ -99,7 +99,12 @@ function compileToJS(schema, defs, schemaMap) {
   // Exception: $dynamicRef/$anchor are handled by the interpretive path even though codegen can't
   if (!defs && !codegenSafe(schema, schemaMap)) {
     const str = JSON.stringify(schema)
-    if (!str.includes('"$dynamicRef"') && !str.includes('"$dynamicAnchor"') && !str.includes('"$anchor"')) return null
+    const hasDynamic = str.includes('"$dynamicRef"') || str.includes('"$dynamicAnchor"')
+    if (!hasDynamic && !str.includes('"$anchor"')) return null
+    // The flat anchor map resolves "#name" without regard to $id base-URI
+    // scopes. When a plain-anchor schema opens nested $id scopes, same-named
+    // anchors can shadow each other, so those schemas must not use codegen.
+    if (!hasDynamic && hasNestedIdScope(schema)) return null
   }
 
   // Collect $defs early so sub-schemas can resolve $ref
@@ -723,6 +728,23 @@ function subtreeRefersToLocalDef(node, defNames) {
   return false
 }
 
+// Returns true if any sub-schema below the root declares a non-fragment $id,
+// i.e. opens a new base-URI scope. Fragment-only ids ('#name') are draft-07
+// anchors, not scope changes.
+function hasNestedIdScope(node, isRoot = true) {
+  if (typeof node !== 'object' || node === null) return false
+  if (!isRoot && typeof node.$id === 'string' && !node.$id.startsWith('#')) return true
+  for (const val of Object.values(node)) {
+    if (typeof val !== 'object' || val === null) continue
+    if (Array.isArray(val)) {
+      for (const item of val) { if (hasNestedIdScope(item, false)) return true }
+    } else if (hasNestedIdScope(val, false)) {
+      return true
+    }
+  }
+  return false
+}
+
 // Recursively check if a schema can be safely compiled to JS codegen.
 // Returns false if any sub-schema contains features codegen gets wrong.
 function codegenSafe(schema, schemaMap) {
@@ -822,6 +844,10 @@ function codegenSafe(schema, schemaMap) {
   }
   // unevaluatedItems: allow boolean and schema values
   if (schema.unevaluatedItems !== undefined) {
+    // contains marks matched items as evaluated; the generated evaluated-item
+    // tracking never credits contains matches, so any contains in scope of an
+    // unevaluatedItems keyword must go to the interpreted engine.
+    if (JSON.stringify(schema).includes('"contains"')) return false
     if (typeof schema.unevaluatedItems === 'object' && schema.unevaluatedItems !== null) {
       if (!codegenSafe(schema.unevaluatedItems, schemaMap)) return false
     }
@@ -2412,20 +2438,20 @@ const FORMAT_CODEGEN = {
     ? `if(${v}.length!==36||!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(${v}))return false`
     : `if(typeof ${v}==='string'&&(${v}.length!==36||!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(${v})))return false`,
   'date-time': (v, isStr) => isStr
-    ? `if(!/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/.test(${v})||isNaN(Date.parse(${v})))return false`
-    : `if(typeof ${v}==='string'&&(!/^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$/.test(${v})||isNaN(Date.parse(${v}))))return false`,
+    ? `if(!/^\\d{4}-\\d{2}-\\d{2}[Tt]\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?([Zz]|[+-]\\d{2}:\\d{2})$/.test(${v})||isNaN(Date.parse(${v})))return false`
+    : `if(typeof ${v}==='string'&&(!/^\\d{4}-\\d{2}-\\d{2}[Tt]\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?([Zz]|[+-]\\d{2}:\\d{2})$/.test(${v})||isNaN(Date.parse(${v}))))return false`,
   time: (v, isStr) => isStr
     ? `if(!/^([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})?$/.test(${v}))return false`
     : `if(typeof ${v}==='string'&&!/^([01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})?$/.test(${v}))return false`,
   duration: (v, isStr) => isStr
-    ? `if(!/^P(?:\\d+Y)?(?:\\d+M)?(?:\\d+W)?(?:\\d+D)?(?:T(?:\\d+H)?(?:\\d+M)?(?:\\d+(?:\\.\\d+)?S)?)?$/.test(${v})||${v}==='P')return false`
-    : `if(typeof ${v}==='string'&&(!/^P(?:\\d+Y)?(?:\\d+M)?(?:\\d+W)?(?:\\d+D)?(?:T(?:\\d+H)?(?:\\d+M)?(?:\\d+(?:\\.\\d+)?S)?)?$/.test(${v})||${v}==='P'))return false`,
+    ? `if(!/^P(?:\\d+Y)?(?:\\d+M)?(?:\\d+W)?(?:\\d+D)?(?:T(?:\\d+H)?(?:\\d+M)?(?:\\d+(?:\\.\\d+)?S)?)?$/.test(${v})||${v}==='P'||${v}.endsWith('T'))return false`
+    : `if(typeof ${v}==='string'&&(!/^P(?:\\d+Y)?(?:\\d+M)?(?:\\d+W)?(?:\\d+D)?(?:T(?:\\d+H)?(?:\\d+M)?(?:\\d+(?:\\.\\d+)?S)?)?$/.test(${v})||${v}==='P'||${v}.endsWith('T')))return false`,
   uri: (v, isStr) => isStr
-    ? `if(!/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(${v}))return false`
-    : `if(typeof ${v}==='string'&&!/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(${v}))return false`,
+    ? `if(!/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(${v})||/[\\s\\u0000-\\u001f\\u007f]/.test(${v}))return false`
+    : `if(typeof ${v}==='string'&&(!/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(${v})||/[\\s\\u0000-\\u001f\\u007f]/.test(${v})))return false`,
   'uri-reference': (v, isStr) => isStr
-    ? `if(${v}===''||/\\s/.test(${v}))return false`
-    : `if(typeof ${v}==='string'&&(${v}===''||/\\s/.test(${v})))return false`,
+    ? `if(/[\\s\\u0000-\\u001f\\u007f]/.test(${v}))return false`
+    : `if(typeof ${v}==='string'&&/[\\s\\u0000-\\u001f\\u007f]/.test(${v}))return false`,
   ipv4: (v, isStr) => isStr
     ? `{const _p=${v}.split('.');if(_p.length!==4||!_p.every(function(n){var x=+n;return x>=0&&x<=255&&String(x)===n}))return false}`
     : `if(typeof ${v}==='string'){const _p=${v}.split('.');if(_p.length!==4||!_p.every(function(n){var x=+n;return x>=0&&x<=255&&String(x)===n}))return false}`,

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.2.0';
+module.exports = '1.2.2';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -44,7 +44,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_defs_pointer_alias.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_order.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_format_engine_parity.js && node tests/test_defs_pointer_alias.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_order.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js",
     "test:compat": "node tests/test_compat.js",
@@ -112,12 +112,12 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.2.0",
-    "@ata-validator/native-linux-x64-gnu": "1.2.0",
-    "@ata-validator/native-linux-arm64-gnu": "1.2.0",
-    "@ata-validator/native-linux-x64-musl": "1.2.0",
-    "@ata-validator/native-linux-arm64-musl": "1.2.0",
-    "@ata-validator/native-win32-x64": "1.2.0"
+    "@ata-validator/native-darwin-arm64": "1.2.2",
+    "@ata-validator/native-linux-x64-gnu": "1.2.2",
+    "@ata-validator/native-linux-arm64-gnu": "1.2.2",
+    "@ata-validator/native-linux-x64-musl": "1.2.2",
+    "@ata-validator/native-linux-arm64-musl": "1.2.2",
+    "@ata-validator/native-win32-x64": "1.2.2"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"