ata-validator 1.21.0 → 1.22.0

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.22.0 - 2026-09-14
+
+### Fixed
+
+- A schema validated once with `isValidObject()` lost its generated error function for the rest of the process. The verdict-only fast path compiles that one function and seeds the shared compile cache with the other two set to null, meaning "not built yet"; the full compile read those nulls as "the compiler declined this schema" and never tried again, so errors fell back to the interpreted engine or the addon. Every server hits that order, because most documents are valid. Cache entries now record whether they are complete. Verdicts and error content were never affected, and `tests/test_compile_cache_order.js` runs both orders in separate processes and holds the engine and the error list equal.
+  - Measured on a five-field schema with an enum and a format, after validating one valid document: `validate(bad).errors` 3.89 µs to 0.66 µs, the Standard Schema path 3.52 µs to 0.07 µs. With no addon installed at all (`ATA_NO_NATIVE=1`), where the fallback was the interpreter rather than the addon, 1.05 µs to 0.66 µs and 0.42 µs to 0.07 µs.
+  - `engine()` reported `closure` for a schema that compiles, once a valid document had been validated first. It now reports `codegen` in either order.
+
+### Changed
+
+- The official test suite submodule moved 60 commits forward, to 2026-09-13. All three dialects stay at zero regressions and the case counts rose: Draft 2020-12 1299 to 1301, draft 7 927 to 929, the v1 dialect 1133 to 1135, identical with code generation blocked. The buffer path agrees with `validate()` on all 3365 of them. Every figure in the README, the docs and the contributor notes was remeasured and updated together, and the floors in `tests/test_no_eval.js` were raised so the new cases cannot be lost silently.
+
+- `uri` is one walk over the string instead of three, and reads its character classes out of tables instead of comparison chains. It was the most expensive thing an ordinary document carried: on a schema with five formats over a 1.6 KB payload, format assertion was 94 percent of the validation cost and `uri` was most of that, while the structural check of the whole nested document was 43 ns. The authority's landmarks, the last `@`, the colons after it and whether a bracket came before it, are now recorded during the character scan rather than by cutting the authority out with `slice` and asking the copy for `lastIndexOf` and two regular expressions.
+  - `format: uri` on one string, through a compiled validator: 92 to 42 ns. The same product schema's document: 697 to 423 ns. End to end, where `JSON.parse` is the other 75 percent: 2.98 to 2.69 µs.
+  - Measured, and not taken: nine `===` tests per character cost more than the loop they guarded, a lookup table is 2.3x that chain, and a three-regex formulation of the whole rule landed at 65 ns against the table walk's 41.
+  - The code generator hoists the walk once per compiled function and calls it, rather than inlining it at each call site where the tables would have to be rebuilt. This is the shape `email` already had. `tests/test_uri_helper_parity.js` holds the function, the generated text and a compiled validator to the same answer over 35,677 strings built from the walk's own boundaries.
+
+- Enriching a rejection no longer reads more of the document than the diagnostic it produces. `received` describes the offending value in at most 60 characters, and it used to find out whether a value fitted by serialising it whole, so a `required` error on a large payload cost a `JSON.stringify` of that payload, once per error. Sizing is now bounded by those 60 characters and stops as soon as they are spent. Enriching one error on a document holding a thousand rows: 61.5 µs to 160 ns, and flat in the size of the document rather than linear. On the schema-benchmarks product schema, where `validate()` reports 16 errors, reading `.errors` went from 9.84 to 5.10 µs (48 percent less) on the same machine, separate processes. Verdict paths, `isValidObject()` and the Standard Schema bridge are unchanged.
+- An object too large to show reports its shape rather than its serialised size: `[object, 5 keys]` where it used to say `[object, ~0.1KB]`. This is the only change to error output; every value that printed its body before prints the same body now, including nested objects, arrays and values with their own `toJSON`.
+- The error's value is resolved from its pointer once and handed to both the `received` repr and the suggestion sources. `lib/suggestions.js` had a second pointer walk that split the string and mapped over the segments; both paths now use `resolvePointer` in `lib/pointer.js`.
+- A `required` typo hint is offered on containers of up to 64 keys. Past that the nearest key stops being evidence of a typo, which is the cap `suggestEnumTypo` already applied to its candidate list, and the scan is a distance computation per key.
+- `levenshtein` reads characters by code and swaps its two rows through a temporary. The destructured swap it used built an array per row. About 9 percent faster on the key pairs the suggestion sources compare.
+- `tests/test_enrich_received.js` holds enrichment to within 4x across a hundredfold increase in document volume. Before this change the same measurement was 122x.
+
 ## 1.17.2 - 2026-09-13
 
 ### Changed

package/README.md

@@ -20,11 +20,11 @@ The `ata-validator` package itself is pure JavaScript. The native accelerator (s
 npm install ata-validator --omit=optional
 ```
 
-or set `ATA_NO_NATIVE=1` at runtime. Typical schemas compile to specialized JS; shapes the compiler cannot represent (some `$dynamicRef`, cyclic `$ref`, unusual keyword interactions) fall back to an interpreted engine, so every schema validates in every environment. The pure-JS setup scores the same on the official suite as the native one, 1299 of 1299 Draft 2020-12 cases. Only the buffer and parallel APIs (`isValid` on raw buffers, `countValid`, `batchIsValid`, `validateAndParse`) need the native engine and say so with a clear error.
+or set `ATA_NO_NATIVE=1` at runtime. Typical schemas compile to specialized JS; shapes the compiler cannot represent (some `$dynamicRef`, cyclic `$ref`, unusual keyword interactions) fall back to an interpreted engine, so every schema validates in every environment. The pure-JS setup scores the same on the official suite as the native one, 1301 of 1301 Draft 2020-12 cases. Only the buffer and parallel APIs (`isValid` on raw buffers, `countValid`, `batchIsValid`, `validateAndParse`) need the native engine and say so with a clear error.
 
-Those four now agree with `validate()` on every case of the official suite, 3359 across three dialects. The native walker behind them does not handle every shape (`contains`, `unevaluatedProperties`, `patternProperties`, tuple `items`, cross-document `$ref`, a few formats), so for schemas using one of those the buffer APIs parse the bytes and answer through `validate()`; the list is in `lib/buffer-gate.js`. Typical request schemas stay on the zero-copy path. `npm test` holds the disagreement count at zero.
+Those four now agree with `validate()` on every case of the official suite, 3365 across three dialects. The native walker behind them does not handle every shape (`contains`, `unevaluatedProperties`, `patternProperties`, tuple `items`, cross-document `$ref`, a few formats), so for schemas using one of those the buffer APIs parse the bytes and answer through `validate()`; the list is in `lib/buffer-gate.js`. Typical request schemas stay on the zero-copy path. `npm test` holds the disagreement count at zero.
 
-Where `new Function` is refused altogether, on Cloudflare Workers, Deno Deploy or under a strict Content-Security-Policy, ata drops to the interpreted engine and scores the same 1299 of 1299 with code generation blocked. No flags, and on Workers no `nodejs_compat` either. See [docs/edge-runtimes.md](docs/edge-runtimes.md).
+Where `new Function` is refused altogether, on Cloudflare Workers, Deno Deploy or under a strict Content-Security-Policy, ata drops to the interpreted engine and scores the same 1301 of 1301 with code generation blocked. No flags, and on Workers no `nodejs_compat` either. See [docs/edge-runtimes.md](docs/edge-runtimes.md).
 
 Node has a switch for exactly that environment, so this takes thirty seconds to check for yourself, on ata or on whatever you use today:
 
@@ -560,7 +560,7 @@ Both are implemented in the interpreted engine, so a v1 schema that uses `$dynam
 
 ### Known limitations
 
-Running the whole Draft 2020-12 suite with nothing excluded, `format` and `default` under specification semantics (`assertFormat: false`, `useDefaults: false`), gives 1299 of 1299 cases. Draft 7 gives 927 of 927. The v1 dialect gives 1133 of 1133. `npm run test:suite` reproduces all three.
+Running the whole Draft 2020-12 suite with nothing excluded, `format` and `default` under specification semantics (`assertFormat: false`, `useDefaults: false`), gives 1301 of 1301 cases. Draft 7 gives 929 of 929. The v1 dialect gives 1135 of 1135. `npm run test:suite` reproduces all three.
 
 Areas that remain deliberate scope decisions for 1.x:
 

package/index.js

@@ -458,13 +458,17 @@ Object.defineProperty(RichRejection.prototype, 'errors', {
       const enrich = this._enrich;
       let raw = this._result.errors || [];
       if (raw.length > 1) raw = sortErrorsBySchemaOrder(this._root, raw);
-      const cached = (enrich && raw.length)
-        ? raw.map((e) => enrich(e, {
+      // One options object for the whole list, not one per error.
+      const opts = enrich && raw.length
+        ? {
             data: this._data,
             positions: this._positions,
             schemaPositions: self._schemaPositions,
             schemaFile: self._source ? self._source.path : undefined,
-          }))
+          }
+        : null;
+      const cached = opts
+        ? raw.map((e) => enrich(e, opts))
         // The v0.14 shape is a fixed key set; the ordering key the
         // generated code carries is dropped from it here.
         : raw.map(stripOrdinal);
@@ -1005,7 +1009,12 @@ class Validator {
     // there.
     if (this._v1Dynamic || this._usesKeywords || !codegenAvailable()) {
       jsFn = null; jsCombinedFn = null; jsErrFn = null;
-    } else if (cached && !_forceNapi) {
+    // `full` separates an entry that holds every compiled function from one
+    // the verdict-only fast path seeded, where `combined` and `errFn` are null
+    // because nothing has tried to build them yet. Both halves of that
+    // distinction are null, and reading the second as the first costs this
+    // schema its generated error function for the life of the process.
+    } else if (cached && cached.full && !_forceNapi) {
       jsFn = cached.jsFn;
       jsCombinedFn = cached.combined;
       jsErrFn = cached.errFn;
@@ -1019,13 +1028,13 @@ class Validator {
       _isCodegen = !!_cgFn;
       this._engine = _cgFn ? 'codegen' : jsFn ? 'closure' : null;
       if (!uf) {
-        _compileCache.set(mapKey, { jsFn, combined: jsCombinedFn, errFn: jsErrFn, isCodegen: _isCodegen });
+        _compileCache.set(mapKey, { jsFn, combined: jsCombinedFn, errFn: jsErrFn, isCodegen: _isCodegen, full: true });
       }
     } else {
       jsFn = null; jsCombinedFn = null; jsErrFn = null;
     }
     this._jsFn = jsFn;
-    if (this._engine === undefined) this._engine = cached ? (cached.isCodegen ? 'codegen' : jsFn ? 'closure' : null) : null;
+    if (this._engine === undefined) this._engine = (cached && cached.full) ? (cached.isCodegen ? 'codegen' : jsFn ? 'closure' : null) : null;
 
     // Data mutators -- try codegen first (12x faster), fallback to closure arrays.
     // Follow cross-refs so coercion/defaults/removeAdditional see the referenced
@@ -1549,12 +1558,13 @@ class Validator {
               // Declaration order, as validate() applies it; the text path
               // used to enrich in emission order.
               const ordered = result.errors.length > 1 ? sortErrorsBySchemaOrder(this._schemaObj, result.errors) : result.errors;
-              const enriched = ordered.map((e) => enrich(e, {
+              const enrichOpts = {
                 data: parsedData,
                 positions,
                 schemaPositions: this._schemaPositions,
                 schemaFile: this._source ? this._source.path : undefined,
-              }));
+              };
+              const enriched = ordered.map((e) => enrich(e, enrichOpts));
               if (enriched.length > 1) attachRelated(enriched);
               attachDiagnosticSource(enriched, {
                 data: parsedData,
@@ -1776,9 +1786,11 @@ class Validator {
     this._jsFn = jsFn;
     if (jsFn) {
       this.isValidObject = jsFn;
-      // seed cache with codegen, combined/errFn filled later by _ensureCompiled
+      // A partial entry: the verdict function is real, the other two are not
+      // built yet rather than declined. `full: false` says so, so the next
+      // caller that needs errors compiles them instead of inheriting nulls.
       if (!uf) {
-        if (!cached) _compileCache.set(mapKey, { jsFn, combined: null, errFn: null });
+        if (!cached) _compileCache.set(mapKey, { jsFn, combined: null, errFn: null, full: false });
         else cached.jsFn = jsFn;
       }
     }

package/lib/enrich-error.js

@@ -2,9 +2,70 @@
 
 const { CODES, codeFor, fromNative } = require('./error-codes');
 const { suggestFor } = require('./suggestions');
+const { resolvePointer } = require('./pointer');
+
+// A pointer that walked out of the document: no value to report, not even the
+// word 'undefined', which is what an absent key reports.
+const MISSING = Symbol('ata.received.missing');
 
 const DOC_BASE = 'https://ata-validator.com/e/';
 
+// The number of characters JSON.stringify would emit for `v`, or -1 as soon as
+// that passes `budget` or the value holds something a plain walk cannot size.
+// The point is the bound: `reprValue` only ever shows a body of 60 characters,
+// so sizing one never needs to read further than that, and a `required` error
+// on a large document used to serialise the whole container to find out it was
+// too big. Keys are counted unescaped, which makes the result a lower bound,
+// and the caller rechecks the real length on the string it ends up building.
+function jsonSizeWithin (v, budget) {
+  if (budget < 0) return -1;
+  if (v === null) return 4;
+  const t = typeof v;
+  if (t === 'number') return Number.isFinite(v) ? String(v).length : 4;
+  if (t === 'boolean') return v ? 4 : 5;
+  if (t === 'string') return v.length + 2 > budget ? -1 : v.length + 2;
+  if (t !== 'object') return -1;
+  // A value with its own toJSON serialises to something only that method can
+  // say. Sizing it exactly would mean running it, and a Date's toJSON alone
+  // costs more than serialising the object around it, so this returns the
+  // smallest thing it could produce. Undershooting is safe: the caller only
+  // uses the estimate to decide whether to try, and rechecks the real length.
+  if (typeof v.toJSON === 'function') return 2;
+  if (Array.isArray(v)) {
+    let n = 2;
+    for (let i = 0; i < v.length; i++) {
+      n += i === 0 ? 0 : 1;
+      if (n > budget) return -1;
+      const c = jsonSizeWithin(v[i], budget - n);
+      if (c < 0) return -1;
+      n += c;
+      if (n > budget) return -1;
+    }
+    return n;
+  }
+  const proto = Object.getPrototypeOf(v);
+  if (proto !== Object.prototype && proto !== null) return -1;
+  let n = 2;
+  let first = true;
+  // for-in rather than Object.keys: the prototype is checked above, so there
+  // is nothing inherited to enumerate, and this walk runs per error.
+  for (const k in v) {
+    const val = v[k];
+    // Keys JSON drops cost nothing, but they also cost nothing to skip.
+    if (val === undefined || typeof val === 'function' || typeof val === 'symbol') continue;
+    // Charge the key before reading the value, so a budget already spent
+    // returns without descending into it.
+    n += k.length + 3 + (first ? 0 : 1);
+    if (n > budget) return -1;
+    first = false;
+    const c = jsonSizeWithin(val, budget - n);
+    if (c < 0) return -1;
+    n += c;
+    if (n > budget) return -1;
+  }
+  return n;
+}
+
 function reprValue (v) {
   if (v === undefined) return 'undefined';
   if (v === null) return 'null';
@@ -16,13 +77,21 @@ function reprValue (v) {
   if (t === 'number' || t === 'boolean') return String(v);
   if (Array.isArray(v)) return `[array, ${v.length} items]`;
   if (t === 'object') {
+    if (jsonSizeWithin(v, 60) >= 0) {
+      try {
+        const s = JSON.stringify(v);
+        if (s !== undefined && s.length <= 60) return s;
+      } catch {
+        return '[object, unserializable]';
+      }
+    }
+    let n;
     try {
-      const s = JSON.stringify(v);
-      if (s.length <= 60) return s;
-      return `[object, ~${(s.length / 1024).toFixed(1)}KB]`;
+      n = Object.keys(v).length;
     } catch {
       return '[object, unserializable]';
     }
+    return `[object, ${n} ${n === 1 ? 'key' : 'keys'}]`;
   }
   return `[${t}]`;
 }
@@ -45,28 +114,14 @@ function expectedFor (err) {
   }
 }
 
-function pickReceived (err, data) {
-  if (!data && data !== 0 && data !== false) return undefined;
-  // Walk JSON pointer to extract the actual offending value. This runs for
-  // every error on every rejected payload, so the walk reads segments straight
-  // out of the pointer: no leading-slash regex, no parts array, and no unescape
-  // pass on the segments that carry no `~`.
+// The value the error's pointer resolves to, or MISSING when the pointer walks
+// out of the document. Resolved once per error and handed to both the
+// `received` repr and the suggestion sources, which used to walk it each.
+function resolveAt (err, data) {
+  if (!data && data !== 0 && data !== false) return MISSING;
   const p = err.instancePath || err.path || '';
-  if (!p) return reprValue(data);
-  const len = p.length;
-  let cur = data;
-  let i = p.charCodeAt(0) === 47 ? 1 : 0; // 47 is '/'
-  for (;;) {
-    let j = p.indexOf('/', i);
-    if (j === -1) j = len;
-    let seg = p.slice(i, j);
-    if (seg.indexOf('~') !== -1) seg = seg.replace(/~1/g, '/').replace(/~0/g, '~');
-    if (cur == null) return undefined;
-    cur = cur[seg];
-    if (j === len) break;
-    i = j + 1;
-  }
-  return reprValue(cur);
+  if (!p) return data;
+  return resolvePointer(data, p, MISSING);
 }
 
 /**
@@ -146,13 +201,15 @@ function enrich (rawErr, opts) {
   const meta = CODES[code];
   const path = rawErr.instancePath != null ? rawErr.instancePath : (rawErr.path || '');
 
+  const at = data !== undefined ? resolveAt(rawErr, data) : MISSING;
+
   const out = {
     code,
     message: rawErr.message || (meta && meta.headline) || 'validation failed',
     keyword,
     path,
     expected: expectedFor(rawErr),
-    received: data !== undefined ? pickReceived(rawErr, data) : undefined,
+    received: at === MISSING ? undefined : reprValue(at),
     schemaPath: rawErr.schemaPath,
     docUrl: DOC_BASE + code,
     // Back-compat aliases (additive, present in both rich and legacy paths)
@@ -187,7 +244,7 @@ function enrich (rawErr, opts) {
   // Suggestion attachment runs last so it can read `received`, `params`, and
   // `keyword` from the enriched shape. `data` is the full input object so the
   // required-typo source can scan sibling keys.
-  const sugg = suggestFor(out, opts && opts.data);
+  const sugg = suggestFor(out, data, at === MISSING ? undefined : at);
   if (sugg) out.suggestion = sugg;
 
   const detail = detailFor(rawErr, out);

package/lib/formats.js

@@ -224,24 +224,102 @@ function hostname (s) {
   return labelLength !== 0 && previous !== 45;
 }
 
-// A scheme followed by a colon, and no control characters or spaces after it.
-// Two expressions became one pass: the scheme is read from the front and the
-// rest of the string is scanned once for characters a URI cannot hold.
+// Character classes as tables rather than comparison chains. Nine `===` tests
+// per character more than doubled the cost of the scan they guarded, measured
+// against the same loop doing a single range check; an indexed byte read costs
+// the same whatever the class holds.
+const URI_CHAR = new Uint8Array(128);
+for (let i = 33; i < 127; i++) URI_CHAR[i] = 1;
+// " < > \ ^ ` { | } are printable and still not allowed in a URI.
+for (const c of [34, 60, 62, 92, 94, 96, 123, 124, 125]) URI_CHAR[c] = 0;
+const HEX_CHAR = new Uint8Array(128);
+for (let i = 48; i < 58; i++) HEX_CHAR[i] = 1;
+for (let i = 97; i < 103; i++) HEX_CHAR[i] = 1;
+for (let i = 65; i < 71; i++) HEX_CHAR[i] = 1;
+// Scheme characters: letters, digits, "+", "-", ".".
+const SCHEME_CHAR = new Uint8Array(128);
+for (let i = 48; i < 58; i++) SCHEME_CHAR[i] = 1;
+for (let i = 97; i < 123; i++) SCHEME_CHAR[i] = 1;
+for (let i = 65; i < 91; i++) SCHEME_CHAR[i] = 1;
+SCHEME_CHAR[43] = 1; SCHEME_CHAR[45] = 1; SCHEME_CHAR[46] = 1;
+
+// A scheme followed by a colon, an optional authority, and no character a URI
+// cannot hold anywhere after the colon.
+//
+// One walk answers all of it. The authority's landmarks, the last "@", the
+// colons after it and whether a bracket appeared before it, are recorded while
+// the characters are being checked, so the authority is never cut out of the
+// string or scanned again. Reading it out with `slice` and asking the copy for
+// `lastIndexOf` and two regular expressions allocated a string per URI, and a
+// document carrying a handful of URLs paid that per field.
 function uri (s) {
   const n = s.length;
   if (n === 0) return false;
-  const first = s.charCodeAt(0);
-  if (!((first >= 97 && first <= 122) || (first >= 65 && first <= 90))) return false;
+  let c = s.charCodeAt(0);
+  // A scheme opens with a letter, never a digit or a sign.
+  if (c > 127 || SCHEME_CHAR[c] === 0 || (c >= 48 && c <= 57) || c === 43 || c === 45 || c === 46) return false;
   let colon = -1;
   for (let i = 1; i < n; i++) {
-    const c = s.charCodeAt(i);
+    c = s.charCodeAt(i);
     if (c === 58) { colon = i; break; }
-    // scheme characters: letters, digits, "+", "-", "."
-    if (!(isDigit(c) || (c >= 97 && c <= 122) || (c >= 65 && c <= 90) ||
-      c === 43 || c === 45 || c === 46)) return false;
+    if (c > 127 || SCHEME_CHAR[c] === 0) return false;
   }
   if (colon === -1) return false;
-  return uriChars(s, colon + 1) && uriAuthority(s, colon + 1);
+
+  let i = colon + 1;
+  let authEnd = n;
+  if (s.charCodeAt(i) === 47 && s.charCodeAt(i + 1) === 47) {
+    const authStart = i + 2;
+    let at = -1, firstColon = -1, lastColon = -1, sawBracket = 0, bracketBeforeAt = 0;
+    let hostStart = authStart;
+    authEnd = -1;
+    for (i = authStart; i < n; i++) {
+      c = s.charCodeAt(i);
+      if (c > 127 || URI_CHAR[c] === 0) return false;
+      if (c === 47 || c === 63 || c === 35) { authEnd = i; break; }
+      if (c === 37) {
+        const h1 = s.charCodeAt(i + 1), h2 = s.charCodeAt(i + 2);
+        // A "%" at the end of the string reads as NaN, which no comparison
+        // admits; `<= 127` is written that way so NaN takes the reject.
+        if (!(h1 <= 127) || !(h2 <= 127) || HEX_CHAR[h1] === 0 || HEX_CHAR[h2] === 0) return false;
+        i += 2;
+        continue;
+      }
+      // The last "@" ends userinfo, so everything recorded before it belongs
+      // to a part that has its own rules and is dropped here.
+      if (c === 64) { bracketBeforeAt = sawBracket; at = i; firstColon = -1; lastColon = -1; hostStart = i + 1; }
+      else if (c === 58) { if (firstColon === -1) firstColon = i; lastColon = i; }
+      else if (c === 91 || c === 93) { sawBracket = 1; }
+    }
+    if (authEnd === -1) authEnd = n;
+    // Brackets belong to the host, so one before the "@" is not userinfo.
+    if (at !== -1 && bracketBeforeAt) return false;
+    if (s.charCodeAt(hostStart) === 91) { // '['
+      let close = -1;
+      for (let j = hostStart + 1; j < authEnd; j++) { if (s.charCodeAt(j) === 93) { close = j; break; } }
+      if (close === -1) return false;
+      if (close + 1 !== authEnd) {
+        if (s.charCodeAt(close + 1) !== 58) return false;
+        if (!allDigits(s, close + 2, authEnd)) return false;
+      }
+    } else if (lastColon !== -1) {
+      // A host holding more than one colon is an IPv6 address, and those must
+      // be bracketed. Without that rule the last group reads as a port number.
+      if (firstColon !== lastColon) return false;
+      if (!allDigits(s, lastColon + 1, authEnd)) return false;
+    }
+    i = authEnd;
+  }
+  for (; i < n; i++) {
+    c = s.charCodeAt(i);
+    if (c > 127 || URI_CHAR[c] === 0) return false;
+    if (c === 37) {
+      const h1 = s.charCodeAt(i + 1), h2 = s.charCodeAt(i + 2);
+      if (!(h1 <= 127) || !(h2 <= 127) || HEX_CHAR[h1] === 0 || HEX_CHAR[h2] === 0) return false;
+      i += 2;
+    }
+  }
+  return true;
 }
 
 // The characters a URI cannot hold: C0 controls, space, DEL, and the rest of
@@ -287,34 +365,68 @@ const uriCharsSource = (v, from) =>
   'if(!((_h1>=48&&_h1<=57)||(_h1>=97&&_h1<=102)||(_h1>=65&&_h1<=70))||' +
   '!((_h2>=48&&_h2<=57)||(_h2>=97&&_h2<=102)||(_h2>=65&&_h2<=70)))return false;_ri+=2}}';
 
+function allDigits (s, from, to) {
+  for (let i = from; i < to; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 48 || c > 57) return false;
+  }
+  return true;
+}
+
 // The authority sits between "//" and the next "/", "?" or "#". A bracketed
 // host must close, and a port is digits.
+//
+// Everything here reads the original string through index bounds. Cutting the
+// authority out with `slice` and asking it for `lastIndexOf` and two regular
+// expressions allocated a string for every URI validated, and a document
+// carrying a handful of URLs paid that per field; the authority of an ordinary
+// URL is a dozen characters, so walking it twice costs less than copying it
+// once.
 function uriAuthority (s, start) {
   if (s.charCodeAt(start) !== 47 || s.charCodeAt(start + 1) !== 47) return true;
-  let end = s.length;
-  for (let i = start + 2; i < s.length; i++) {
+  const n = s.length;
+  const authStart = start + 2;
+  let authEnd = n;
+  for (let i = authStart; i < n; i++) {
     const c = s.charCodeAt(i);
-    if (c === 47 || c === 63 || c === 35) { end = i; break; }
-  }
-  const auth = s.slice(start + 2, end);
-  const at = auth.lastIndexOf('@');
-  // Brackets belong to the host, so one before the "@" is not userinfo.
-  if (at !== -1 && /[[\]]/.test(auth.slice(0, at))) return false;
-  const hostPort = at === -1 ? auth : auth.slice(at + 1);
-  if (hostPort.charCodeAt(0) === 91) { // '['
-    const close = hostPort.indexOf(']');
+    if (c === 47 || c === 63 || c === 35) { authEnd = i; break; }
+  }
+  // The last "@" splits userinfo from the host. Brackets belong to the host,
+  // so one before the "@" is not userinfo.
+  let at = -1;
+  for (let i = authEnd - 1; i >= authStart; i--) {
+    if (s.charCodeAt(i) === 64) { at = i; break; }
+  }
+  if (at !== -1) {
+    for (let i = authStart; i < at; i++) {
+      const c = s.charCodeAt(i);
+      if (c === 91 || c === 93) return false;
+    }
+  }
+  const hpStart = at === -1 ? authStart : at + 1;
+  if (s.charCodeAt(hpStart) === 91) { // '['
+    let close = -1;
+    for (let i = hpStart + 1; i < authEnd; i++) {
+      if (s.charCodeAt(i) === 93) { close = i; break; }
+    }
     if (close === -1) return false;
-    const rest = hostPort.slice(close + 1);
-    if (rest === '') return true;
-    if (rest.charCodeAt(0) !== 58) return false;
-    return /^[0-9]*$/.test(rest.slice(1));
+    if (close + 1 === authEnd) return true;
+    if (s.charCodeAt(close + 1) !== 58) return false;
+    return allDigits(s, close + 2, authEnd);
+  }
+  let firstColon = -1;
+  let lastColon = -1;
+  for (let i = hpStart; i < authEnd; i++) {
+    if (s.charCodeAt(i) === 58) {
+      if (firstColon === -1) firstColon = i;
+      lastColon = i;
+    }
   }
-  const colon = hostPort.lastIndexOf(':');
-  if (colon === -1) return true;
+  if (lastColon === -1) return true;
   // A host holding more than one colon is an IPv6 address, and those must be
   // bracketed. Without that rule the last group reads as a port number.
-  if (hostPort.indexOf(':') !== colon) return false;
-  return /^[0-9]*$/.test(hostPort.slice(colon + 1));
+  if (firstColon !== lastColon) return false;
+  return allDigits(s, lastColon + 1, authEnd);
 }
 const uriAuthoritySource = (v, start) =>
   `if(${v}.charCodeAt(${start})===47&&${v}.charCodeAt(${start}+1)===47){` +
@@ -622,6 +734,22 @@ function timeSource (v, isStr) {
     'if(_u!==1439)return false}');
 }
 
+// The same walk as `uri` above, as source, for the code generator to hoist
+// once per compiled function and call. Two copies of one algorithm is what
+// this file has always done for every format, so they sit together here and
+// tests/test_uri_helper_parity.js holds them to the same answer over a corpus
+// built from the walk's own boundaries.
+const URI_HELPER_TABLES = 'const _uct=new Uint8Array(128);for(let _i=33;_i<127;_i++)_uct[_i]=1;' +
+  '_uct[34]=_uct[60]=_uct[62]=_uct[92]=_uct[94]=_uct[96]=_uct[123]=_uct[124]=_uct[125]=0;' +
+  'const _uch=new Uint8Array(128);for(let _i=48;_i<58;_i++)_uch[_i]=1;' +
+  'for(let _i=97;_i<103;_i++)_uch[_i]=1;for(let _i=65;_i<71;_i++)_uch[_i]=1;' +
+  'const _ucs=new Uint8Array(128);for(let _i=48;_i<58;_i++)_ucs[_i]=1;' +
+  'for(let _i=97;_i<123;_i++)_ucs[_i]=1;for(let _i=65;_i<91;_i++)_ucs[_i]=1;' +
+  '_ucs[43]=1;_ucs[45]=1;_ucs[46]=1';
+const URI_HELPER_BODY = 'const _n=_s.length;if(_n===0)return false;let _c=_s.charCodeAt(0);if(_c>127||_ucs[_c]===0||(_c>=48&&_c<=57)||_c===43||_c===45||_c===46)return false;let _co=-1;for(let _i=1;_i<_n;_i++){_c=_s.charCodeAt(_i);if(_c===58){_co=_i;break}if(_c>127||_ucs[_c]===0)return false}if(_co===-1)return false;let _i=_co+1;let _ae=_n;if(_s.charCodeAt(_i)===47&&_s.charCodeAt(_i+1)===47){const _as=_i+2;let _at=-1,_fc=-1,_lc=-1,_br=0,_ba=0,_hs=_as;_ae=-1;for(_i=_as;_i<_n;_i++){_c=_s.charCodeAt(_i);if(_c>127||_uct[_c]===0)return false;if(_c===47||_c===63||_c===35){_ae=_i;break}if(_c===37){const _h1=_s.charCodeAt(_i+1),_h2=_s.charCodeAt(_i+2);if(!(_h1<=127)||!(_h2<=127)||_uch[_h1]===0||_uch[_h2]===0)return false;_i+=2;continue}if(_c===64){_ba=_br;_at=_i;_fc=-1;_lc=-1;_hs=_i+1}else if(_c===58){if(_fc===-1)_fc=_i;_lc=_i}else if(_c===91||_c===93){_br=1}}if(_ae===-1)_ae=_n;if(_at!==-1&&_ba)return false;if(_s.charCodeAt(_hs)===91){let _cl=-1;for(let _j=_hs+1;_j<_ae;_j++){if(_s.charCodeAt(_j)===93){_cl=_j;break}}if(_cl===-1)return false;if(_cl+1!==_ae){if(_s.charCodeAt(_cl+1)!==58)return false;for(let _j=_cl+2;_j<_ae;_j++){const _d=_s.charCodeAt(_j);if(_d<48||_d>57)return false}}}else if(_lc!==-1){if(_fc!==_lc)return false;for(let _j=_lc+1;_j<_ae;_j++){const _d=_s.charCodeAt(_j);if(_d<48||_d>57)return false}}_i=_ae}for(;_i<_n;_i++){_c=_s.charCodeAt(_i);if(_c>127||_uct[_c]===0)return false;if(_c===37){const _h1=_s.charCodeAt(_i+1),_h2=_s.charCodeAt(_i+2);if(!(_h1<=127)||!(_h2<=127)||_uch[_h1]===0||_uch[_h2]===0)return false;_i+=2}}return true;';
+const uriHelperSource = (name) =>
+  URI_HELPER_TABLES + ';function ' + name + '(_s){' + URI_HELPER_BODY + '}';
+
 function uriSource (v, isStr) {
   return guard(v, isStr, `const _n=${v}.length;if(_n===0)return false;` +
     `const _f=${v}.charCodeAt(0);if(!((_f>=97&&_f<=122)||(_f>=65&&_f<=90)))return false;` +
@@ -814,4 +942,4 @@ function durationSource (v, isStr) {
   return isStr ? inner : `if(typeof ${v}==='string'&&${inner.slice(3)}`;
 }
 
-module.exports = { date, ipv4, dateTime, ipv6, hostname, uri, uriReference, uuid, time, noReserved, jsonPointer, relativeJsonPointer, uriTemplate, email, duration, uriChars, uriAuthority, uriCharsSource, uriAuthoritySource, iri, iriReference, idnEmail, iriSource, iriReferenceSource, idnEmailSource, dateSource, ipv4Source, dateTimeSource, ipv6Source, hostnameSource, uriSource, uuidSource, timeSource, noReservedSource, jsonPointerSource, relativeJsonPointerSource, uriTemplateSource, emailSource, durationSource };
+module.exports = { uriHelperSource, date, ipv4, dateTime, ipv6, hostname, uri, uriReference, uuid, time, noReserved, jsonPointer, relativeJsonPointer, uriTemplate, email, duration, uriChars, uriAuthority, uriCharsSource, uriAuthoritySource, iri, iriReference, idnEmail, iriSource, iriReferenceSource, idnEmailSource, dateSource, ipv4Source, dateTimeSource, ipv6Source, hostnameSource, uriSource, uuidSource, timeSource, noReservedSource, jsonPointerSource, relativeJsonPointerSource, uriTemplateSource, emailSource, durationSource };

package/lib/js-compiler.js

@@ -3037,6 +3037,13 @@ function genCode(schema, v, lines, ctx, knownType) {
 // the check was inlined at each of them.
 const EMAIL_HELPER = `function _em(_s){${_formats.emailSource('_s', true)}return true}`
 
+// `uri` is the most expensive format an ordinary document carries: a schema
+// with a handful of URL fields spent more time here than on every structural
+// check put together. The walk reads its character classes out of hoisted
+// tables, so it is declared once per compiled function rather than inlined at
+// each call site, where the tables would have to be rebuilt.
+const URI_HELPER = _formats.uriHelperSource('_uri')
+
 const FORMAT_CODEGEN = {
   email: (v, isStr, ctx) => {
     if (!ctx) return _formats.emailSource(v, isStr)
@@ -3058,7 +3065,11 @@ const FORMAT_CODEGEN = {
   'date-time': _formats.dateTimeSource,
   time: _formats.timeSource,
   duration: _formats.durationSource,
-  uri: _formats.uriSource,
+  uri: (v, isStr, ctx) => {
+    if (!ctx) return _formats.uriSource(v, isStr)
+    hoistOnce(ctx, '_uriHoisted', URI_HELPER)
+    return isStr ? `if(!_uri(${v}))return false` : `if(typeof ${v}==='string'&&!_uri(${v}))return false`
+  },
   'uri-reference': (v, isStr) => isStr
     ? `{${_formats.uriCharsSource(v, '0')}}`
     : `if(typeof ${v}==='string'){${_formats.uriCharsSource(v, '0')}}`,

package/lib/levenshtein.js

@@ -21,19 +21,31 @@ function levenshtein (a, b, maxDistance) {
   }
   let prev = scratchA;
   let curr = scratchB;
-  for (let j = 0; j <= b.length; j++) prev[j] = j;
+  const bn = b.length;
+  for (let j = 0; j <= bn; j++) prev[j] = j;
   for (let i = 1; i <= a.length; i++) {
     curr[0] = i;
     let rowMin = i;
-    for (let j = 1; j <= b.length; j++) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
-      if (curr[j] < rowMin) rowMin = curr[j];
+    // charCodeAt rather than indexing: reading a character by index allocates
+    // a one-character string, and this is the innermost loop.
+    const ca = a.charCodeAt(i - 1);
+    for (let j = 1; j <= bn; j++) {
+      const cost = ca === b.charCodeAt(j - 1) ? 0 : 1;
+      let m = prev[j - 1] + cost;
+      const del = curr[j - 1] + 1;
+      if (del < m) m = del;
+      const ins = prev[j] + 1;
+      if (ins < m) m = ins;
+      curr[j] = m;
+      if (m < rowMin) rowMin = m;
     }
     if (rowMin > max) return Infinity;
-    [prev, curr] = [curr, prev];
+    // A destructured swap builds an array per row; a temporary does not.
+    const t = prev;
+    prev = curr;
+    curr = t;
   }
-  return prev[b.length];
+  return prev[bn];
 }
 
 module.exports = { levenshtein };

package/lib/pointer.js

@@ -0,0 +1,46 @@
+'use strict';
+
+/**
+ * Resolve a JSON pointer against a document, for the diagnostic paths that run
+ * once per error on a rejected payload.
+ *
+ * Segments are read straight out of the pointer string: no leading-slash
+ * regex, no parts array, and no unescape pass on the segments that carry no
+ * `~`. A pointer that leaves the document returns rather than throwing,
+ * because a diagnostic must not fail where validation succeeded.
+ *
+ * `missing` separates the two ways a pointer yields nothing: a key that is
+ * absent from a container that exists resolves to undefined, while a pointer
+ * that walks through a null or a primitive returns `missing`. Callers that
+ * format the value need that apart, since the first is a value worth printing
+ * and the second is a path that was never in the document.
+ *
+ * @param {*} data the document the pointer is read against
+ * @param {string} pointer an RFC 6901 pointer, '' for the document itself
+ * @param {*} [missing] returned when the walk leaves the document
+ * @returns {*} the value at the pointer, `missing` if the walk broke
+ */
+function resolvePointer (data, pointer, missing) {
+  if (!pointer) return data;
+  const len = pointer.length;
+  let cur = data;
+  let i = pointer.charCodeAt(0) === 47 ? 1 : 0; // 47 is '/'
+  for (;;) {
+    let j = pointer.indexOf('/', i);
+    if (j === -1) j = len;
+    let seg = pointer.slice(i, j);
+    if (seg.indexOf('~') !== -1) seg = seg.replace(/~1/g, '/').replace(/~0/g, '~');
+    if (cur == null) return missing;
+    cur = cur[seg];
+    if (j === len) break;
+    i = j + 1;
+  }
+  return cur;
+}
+
+// Passed where a caller has no resolved value to offer, which is not the same
+// as resolving to undefined: the first means walk it yourself, the second
+// means the document really holds nothing there.
+const UNRESOLVED = Symbol('ata.pointer.unresolved');
+
+module.exports = { resolvePointer, UNRESOLVED };

package/lib/retry-message.js

@@ -22,15 +22,39 @@
 // `received`. The trap is that joining `message`, which is the obvious thing to
 // do, throws both away. So this is one call that does not.
 
+// `multipleOf: 0.01` is how a schema says money, and a model acts on "rounded
+// to 2 decimal places" where it does not reliably act on "a multiple of 0.01".
+// describeSchema found that by measurement; the same wording belongs here, or
+// the two halves of the loop describe the same rule differently.
+function phrase (error) {
+  const p = error.params || {};
+  if (error.keyword === 'multipleOf' && typeof p.multipleOf === 'number') {
+    const m = p.multipleOf;
+    if (m > 0 && m < 1) {
+      const places = Math.round(Math.log10(1 / m));
+      if (Math.abs(Math.pow(10, -places) - m) < Number.EPSILON * 8) {
+        return `must be rounded to ${places} decimal place${places === 1 ? '' : 's'}`;
+      }
+    }
+  }
+  return null;
+}
+
 function line (error) {
   const where = error.instancePath || error.path || '';
-  const body = typeof error.detail === 'string' && error.detail ? error.detail : error.message;
+  const body = phrase(error) ||
+    (typeof error.detail === 'string' && error.detail ? error.detail : error.message);
   // `detail` usually quotes the offending value already; saying it twice reads
   // like a stutter in a string that is going into a prompt. A container is
   // summarised as `[object, ~0.1KB]` rather than shown, which tells a model
   // nothing it cannot see in its own output, so that is left out too.
   const raw = error.received === undefined || error.received === null ? '' : String(error.received);
-  const useless = raw.charAt(0) === '[' && /^\[(object|array)\b/.test(raw);
+  // A container tells a model nothing its own output does not already show,
+  // and it is the most expensive thing you can put in a prompt. That covers
+  // both the `[object, ~0.1KB]` summary and a whole serialized object.
+  const head = raw.charAt(0);
+  const useless = (head === '[' && /^\[(object|array)\b/.test(raw)) || head === '{' ||
+    (head === '[' && raw.charAt(raw.length - 1) === ']');
   const received = useless ? '' : raw;
   const got = received && body && !body.includes(received) ? `, got ${received}` : '';
   return `${where || '/'}: ${body}${got}`;

package/lib/suggestions.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { levenshtein } = require('./levenshtein');
+const { resolvePointer: walk, UNRESOLVED } = require('./pointer');
 
 // Hand-coded format hints. Keep <=60 chars per text.
 const FORMAT_HINTS = {
@@ -46,8 +47,15 @@ function suggestEnumTypo (received, enumValues) {
   return null;
 }
 
+// The widest container a typo hint is offered on. `suggestEnumTypo` caps its
+// candidate list for the same two reasons: past a certain width the nearest
+// key stops being evidence of a typo, and the scan is a distance computation
+// per key on a value the caller has already rejected.
+const MAX_TYPO_CANDIDATES = 64;
+
 function suggestRequiredTypo (missing, presentKeys) {
   if (!missing || !Array.isArray(presentKeys)) return null;
+  if (presentKeys.length > MAX_TYPO_CANDIDATES) return null;
   for (const k of presentKeys) {
     if (typeof k !== 'string') continue;
     const d = levenshtein(missing, k, 2);
@@ -58,22 +66,14 @@ function suggestRequiredTypo (missing, presentKeys) {
   return null;
 }
 
-function suggestFormat (format, received) {
+function suggestFormat (format, raw) {
   const fn = FORMAT_HINTS[format];
   if (!fn) return null;
-  // received is repr-truncated string like '"foo"'; unwrap for testing
-  let raw = received;
-  if (typeof raw === 'string' && raw.startsWith('"') && raw.endsWith('"')) {
-    try { raw = JSON.parse(raw); } catch {}
-  }
   const text = fn(raw);
   return text ? { text, kind: 'format' } : null;
 }
 
-function suggestCoercion (expectedType, received) {
-  if (typeof received !== 'string' || !received.startsWith('"') || !received.endsWith('"')) return null;
-  let raw;
-  try { raw = JSON.parse(received); } catch { return null; }
+function suggestCoercion (expectedType, raw) {
   if (typeof raw !== 'string') return null;
   if (expectedType === 'integer' && /^-?\d+$/.test(raw)) {
     return { text: 'value would coerce; enable `coerceTypes` or pass an integer', kind: 'coercion' };
@@ -91,26 +91,37 @@ function suggestCoercion (expectedType, received) {
  * Apply suggestion sources in priority order. Returns the first hit, or null.
  * @param err Enriched ValidationError (with `received`, `params`, `keyword`)
  * @param data The full input data (for required-typo)
+ * @param at The value at `err.path`, already resolved by the caller, or
+ *   UNRESOLVED when the caller has none to offer
  */
-function suggestFor (err, data) {
+function suggestFor (err, data, at = UNRESOLVED) {
+  // The offending value itself. The caller resolves it once per error and
+  // passes it here rather than having each source walk the document again.
+  // A caller that passes only an enriched error falls back to un-quoting the
+  // repr, which is what every source used to read.
+  const raw = at !== UNRESOLVED ? at : parseReceived(err.received);
   if (err.keyword === 'enum') {
-    return suggestEnumTypo(parseReceived(err.received), err.params && err.params.allowedValues);
+    return suggestEnumTypo(raw, err.params && err.params.allowedValues);
   }
   if (err.keyword === 'required') {
     const missing = err.params && err.params.missingProperty;
-    let parentPath = err.path || '';
+    const path = err.path || '';
+    let parentPath = path;
     if (parentPath.endsWith('/' + missing)) parentPath = parentPath.slice(0, -missing.length - 1);
-    const parent = walk(data, parentPath);
+    // A `required` error usually names the container it failed on, so the
+    // value the caller already resolved is the parent. Only the spelling that
+    // points at the missing key itself needs a second walk.
+    const parent = (parentPath === path && at !== UNRESOLVED) ? at : walk(data, parentPath);
     if (parent && typeof parent === 'object') {
       return suggestRequiredTypo(missing, Object.keys(parent));
     }
     return null;
   }
   if (err.keyword === 'format') {
-    return suggestFormat(err.params && err.params.format, err.received);
+    return suggestFormat(err.params && err.params.format, raw);
   }
   if (err.keyword === 'type') {
-    return suggestCoercion(err.params && err.params.type, err.received);
+    return suggestCoercion(err.params && err.params.type, raw);
   }
   return null;
 }
@@ -121,12 +132,4 @@ function parseReceived (r) {
   return r;
 }
 
-function walk (data, pointer) {
-  if (!pointer) return data;
-  const parts = pointer.replace(/^\//, '').split('/').map(s => s.replace(/~1/g, '/').replace(/~0/g, '~'));
-  let cur = data;
-  for (const p of parts) { if (cur == null) return undefined; cur = cur[p]; }
-  return cur;
-}
-
 module.exports = { suggestFor, suggestEnumTypo, suggestRequiredTypo, suggestFormat, suggestCoercion };

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.21.0';
+module.exports = '1.22.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -51,7 +51,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_uri_helper_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -122,13 +122,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.21.0",
-    "@ata-validator/native-darwin-x64": "1.21.0",
-    "@ata-validator/native-linux-arm64-gnu": "1.21.0",
-    "@ata-validator/native-linux-arm64-musl": "1.21.0",
-    "@ata-validator/native-linux-x64-gnu": "1.21.0",
-    "@ata-validator/native-linux-x64-musl": "1.21.0",
-    "@ata-validator/native-win32-x64": "1.21.0"
+    "@ata-validator/native-darwin-arm64": "1.22.0",
+    "@ata-validator/native-darwin-x64": "1.22.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.22.0",
+    "@ata-validator/native-linux-arm64-musl": "1.22.0",
+    "@ata-validator/native-linux-x64-gnu": "1.22.0",
+    "@ata-validator/native-linux-x64-musl": "1.22.0",
+    "@ata-validator/native-win32-x64": "1.22.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"