ata-validator 1.22.1 → 1.23.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.23.0 - 2026-09-16
+
+### Added
+
+- `strictSchema: true | 'log'`, and the compat shim's `strict`/`strictSchema` now enforce it: the authoring-time checks for the mistakes that fail open. An unknown keyword throws at construction with its path and the nearest known spelling, `strict mode: unknown keyword "maxLenght" (did you mean "maxLength"?) at #/properties/a/maxLenght`, and a local `$ref` that does not resolve in its own document throws instead of compiling a validator that rejects everything. `'log'` warns through the logger and continues. Off by default. The known-keyword list is derived from the vendored meta-schema documents rather than maintained by hand, plus the keywords ata implements beyond them; `x-` prefixed names and keywords registered through the `keywords` option pass. Property names, `enum` and `const` values, `default` and `examples` are data, not keywords, and the walk knows the difference, including the draft-07 `dependencies` form. `strictTypes`, `strictTuples` and `strictRequired` remain accepted and ignored, and `compat.d.ts` now says which is which. Reported as issue #44 by a migration that fuzzed 1,364 mutations against both validators, found zero divergence, and then shipped a typo.
+
+### Changed
+
+- The error and combined generators compile on the first rejection instead of at startup. Every schema compiled three functions eagerly: the verdict, the combined validate-and-collect form, and the error generator, which on a cold first call cost 8.2, 10.4 and 7.8 ms on a 120-property config schema, most of it V8 compiling each generator's own code the first time it is entered. A caller that never reads an error never needs the last two, and `validate()` on a passing document does not either, so they are built on the first rejection. Compile plus first verdict on that schema: 30.7 to 10.8 ms, interleaved runs of committed builds. The warm path measured the same on all ten cases checked. The shared compile cache keeps `undefined` meaning not built yet and `null` meaning the compiler declined, in both places that seed it, and `tests/test_compile_cache_order.js` caught the one seam where the two seeders disagreed during this change.
+- The static `unevaluatedProperties` tier stopped checking membership with a first-character switch. Keys sharing a first character, `ENV_0` through `ENV_999` say, all land in one case whose body chains every name, per key of the document: the `additionalProperties` quadratic in a different coat. Above 128 declared names the generated code reads the hoisted lookup that fixed the first one; below that the switch stays. A 1300-property config document with both of its objects closed: 87.7 to 24.5 µs, and the keyword now costs what `additionalProperties` costs, which is the membership test itself. Only the boolean generator has this code; the error and combined generators decline `unevaluated*` and the interpreted engine produces those errors.
+- The compat shim derives each error's pointer segments and kinds once, into a key map shared by the reference-order sort and the shaping loop. The sort comparator used to re-split and re-classify both errors' pointers on every one of its comparisons, and the loop derived the same segments again per error, with the `if` wrapper's flush doing it a third time. A seven-error rejection through `ata-validator/compat` with `allErrors`: 5.79 to 3.27 µs. The shim's own overhead over `Validator.validate` fell from 4.4 µs to 1.9. The compat surface is pinned by `test_compat`, 106 error-format cases, 36 parity cases and the error-shape differential, all green before and after.
+
+### Fixed
+
+- The API table said `verbose` attaches only `parentSchema`; it attaches `parentSchema`, `schema` and `data`, and the migration guide now lists which `params` key each keyword carries. The performance notes recorded "length-bucketed key comparison for `additionalProperties: false`" as measured and dropped on the grounds that each comparison is a pointer compare; that was right about one comparison and wrong about the total, and the note now carries the measurements that replaced it.
+
 ## 1.22.1 - 2026-09-16
 
 ### Fixed

package/compat.d.ts

@@ -78,10 +78,15 @@ declare namespace Ata {
     formats?: Record<string, Format>;
     keywords?: KeywordDefinition[];
     schemas?: object[] | Record<string, object>;
+    /** Enforced: unknown keywords and dangling local $refs throw at compile ('log' warns instead). */
     strict?: boolean | 'log';
+    /** Same checks as `strict`; the specific option wins over the umbrella one. */
     strictSchema?: boolean | 'log';
+    /** Accepted for API compatibility; not enforced. */
     strictTypes?: boolean | 'log';
+    /** Accepted for API compatibility; not enforced. */
     strictTuples?: boolean | 'log';
+    /** Accepted for API compatibility; not enforced. */
     strictRequired?: boolean | 'log';
     allowUnionTypes?: boolean;
     logger?: { log(...args: unknown[]): void; warn(...args: unknown[]): void; error(...args: unknown[]): void } | false;

package/compat.js

@@ -15,8 +15,10 @@ const { resolvePointer } = require('./lib/pointer.js');
 //   - `$data` references;
 //   - keywords defined only through `code` (a code generator hook);
 //   - the reference formats plugin, whose formats are built in here.
-// Strict-mode schema checks (`strict`, `strictTypes`, ...) are accepted and
-// ignored: an unknown keyword is an annotation, as the specification says.
+// Strict-mode schema checks: `strict` and `strictSchema` are enforced for the
+// checks that fail open, an unknown keyword (`maxLenght` compiles and the
+// constraint is simply absent) and a dangling local `$ref`. `strictTypes`,
+// `strictTuples` and `strictRequired` are accepted and ignored.
 
 const { Validator } = require('./index');
 const { METASCHEMAS } = require('./lib/metaschemas');
@@ -99,6 +101,13 @@ class Ata {
       removeAdditional: !!o.removeAdditional,
       verbose: !!o.verbose,
     };
+    // `strict` and `strictSchema`: the unknown-keyword and dangling-local-$ref
+    // checks are enforced; `strictTypes`, `strictTuples` and `strictRequired`
+    // are still accepted and ignored. The specific keyword option wins over
+    // the umbrella one, which is how the reference class reads them.
+    const strictness = o.strictSchema !== undefined ? o.strictSchema : o.strict;
+    if (strictness === true || strictness === 'log') out.strictSchema = strictness;
+    if (o.logger !== undefined) out.logger = o.logger;
     if (o.validateFormats === false) out.assertFormat = false;
     const formatNames = Object.keys(this._formats);
     if (formatNames.length > 0) out.formats = { ...this._formats };

package/index.js

@@ -885,6 +885,29 @@ class Validator {
     // produced the error). Matches ajv's `verbose: true` behavior.
     this._verbose = !!options.verbose;
 
+    // strictSchema: authoring-time checks, off by default. A mistyped keyword
+    // is the one schema mistake that fails open: to every dialect `maxLenght`
+    // is an annotation, so the constraint the author meant is simply absent
+    // and previously invalid data validates. `true` throws here, at
+    // construction, with every finding; `'log'` reports through
+    // `options.logger` or the console and continues. The check runs on the
+    // schema as written, before any normalization touches it.
+    if (options.strictSchema === true || options.strictSchema === 'log') {
+      const { checkSchemaStrict } = require('./lib/strict-check');
+      const problems = checkSchemaStrict(schema, { userKeywords: options.keywords || null });
+      if (problems.length > 0) {
+        const text = problems.map((x) => `strict mode: ${x.message} at ${x.path}`).join('\n');
+        if (options.strictSchema === true) {
+          throw new Error(text);
+        }
+        const logger = options.logger;
+        if (logger !== false) {
+          const warn = logger && typeof logger.warn === 'function' ? logger.warn.bind(logger) : console.warn;
+          warn(text);
+        }
+      }
+    }
+
     // richErrors: default true. Only the literal `false` opts back into the
     // v0.14 error shape (no code/expected/received/docUrl, no aliases).
     this._richErrors = options && options.richErrors === false ? false : true;
@@ -1014,27 +1037,40 @@ class Validator {
     // because nothing has tried to build them yet. Both halves of that
     // distinction are null, and reading the second as the first costs this
     // schema its generated error function for the life of the process.
-    } else if (cached && cached.full && !_forceNapi) {
+    } else if (cached && cached.jsFn !== undefined && !_forceNapi) {
+      // `full` says the error and combined functions exist too. An entry
+      // without it still carries a verdict function worth reusing; the pair is
+      // built by _buildDeferred below if something asks for an error, and the
+      // entry is upgraded then. `undefined` in `combined`/`errFn` means not
+      // built yet; `null` means the compiler declined. Those two must never
+      // blur: reading the first as the second is the bug this cache had once
+      // already, and it silently cost schemas their generated error function.
       jsFn = cached.jsFn;
       jsCombinedFn = cached.combined;
       jsErrFn = cached.errFn;
       _isCodegen = !!cached.isCodegen;
+      this._engine = _isCodegen ? 'codegen' : jsFn ? 'closure' : null;
     } else if (!_forceNapi) {
       const uf = this._userFormats;
       const _cgFn = compileToJSCodegen(schemaObj, sm, uf);
       jsFn = _cgFn || compileToJS(schemaObj, null, sm);
-      jsCombinedFn = compileToJSCombined(schemaObj, VALID_RESULT, sm, uf);
-      jsErrFn = compileToJSCodegenWithErrors(schemaObj, sm, uf);
+      // Only the verdict is compiled here. The error and combined generators
+      // are the other two thirds of a cold first call (8.2, 10.4 and 7.8 ms on
+      // a 120-property config schema, most of it V8 compiling each generator
+      // the first time it is entered), and a caller that never reads an error
+      // never needs them. _buildDeferred compiles them on the first rejection.
+      jsCombinedFn = undefined;
+      jsErrFn = undefined;
       _isCodegen = !!_cgFn;
       this._engine = _cgFn ? 'codegen' : jsFn ? 'closure' : null;
       if (!uf) {
-        _compileCache.set(mapKey, { jsFn, combined: jsCombinedFn, errFn: jsErrFn, isCodegen: _isCodegen, full: true });
+        _compileCache.set(mapKey, { jsFn, combined: undefined, errFn: undefined, isCodegen: _isCodegen, full: false });
       }
     } else {
       jsFn = null; jsCombinedFn = null; jsErrFn = null;
     }
     this._jsFn = jsFn;
-    if (this._engine === undefined) this._engine = (cached && cached.full) ? (cached.isCodegen ? 'codegen' : jsFn ? 'closure' : null) : null;
+    if (this._engine === undefined) this._engine = null;
 
     // Data mutators -- try codegen first (12x faster), fallback to closure arrays.
     // Follow cross-refs so coercion/defaults/removeAdditional see the referenced
@@ -1080,14 +1116,26 @@ class Validator {
           )));
     const useSimdjsonForLarge = !hasArrayTraversal;
 
-    if (jsFn) {
-      let safeErrFn = null;
-      if (jsErrFn) {
-        try {
-          jsErrFn({}, true);
-          safeErrFn = (d) => jsErrFn(d, true);
-        } catch {}
+    // Builds the two generators the compile step left out, once, and upgrades
+    // the shared cache entry. `undefined` means not built yet; `null` means the
+    // compiler declined. Conflating those is what once cost every schema its
+    // generated error function for the life of the process, so they stay apart.
+    const _buildDeferred = () => {
+      if (jsCombinedFn !== undefined && jsErrFn !== undefined) return;
+      const uf2 = this._userFormats;
+      if (jsCombinedFn === undefined) jsCombinedFn = compileToJSCombined(schemaObj, VALID_RESULT, sm, uf2) || null;
+      if (jsErrFn === undefined) jsErrFn = compileToJSCodegenWithErrors(schemaObj, sm, uf2) || null;
+      if (!uf2) {
+        const entry = _compileCache.get(mapKey);
+        if (entry && entry.jsFn === jsFn) {
+          entry.combined = jsCombinedFn;
+          entry.errFn = jsErrFn;
+          entry.full = true;
+        }
       }
+    };
+
+    if (jsFn) {
       // errFn: use JS codegen if safe, else native fallback (only when native
       // is available). Environments without the native addon — Cloudflare
       // Workers, browser, Bun without N-API — get a JS-only fallback so the
@@ -1126,19 +1174,38 @@ class Validator {
       // reports those schemas correctly, so failing data is re-validated
       // there. This used to be a placeholder error with no keyword and no
       // path, which hid whatever had actually failed.
-      const errFn =
-        safeErrFn ||
-        (hasUnevaluated || !native
-          ? jsOnlyFallback
-            : hasDynRef
-              ? (d) => {
-                  this._ensureNative();
-                  return this._compiled.validateJSON(JSON.stringify(d));
-                }
-              : (d) => {
-                  this._ensureNative();
-                  return this._compiled.validate(d);
-                });
+      // Resolved on the first rejection rather than at compile time, because
+      // building the generator behind it is two thirds of what a first call
+      // costs and a caller that never reads an error never needs it. The probe
+      // moves here with it: it calls the generated function, so it cannot run
+      // before the function exists.
+      let _errOnlyImpl = null;
+      const errOnly = (d) => {
+        if (_errOnlyImpl === null) {
+          _buildDeferred();
+          let safe = null;
+          if (jsErrFn) {
+            try {
+              jsErrFn({}, true);
+              safe = (x) => jsErrFn(x, true);
+            } catch {}
+          }
+          _errOnlyImpl =
+            safe ||
+            (hasUnevaluated || !native
+              ? jsOnlyFallback
+                : hasDynRef
+                  ? (x) => {
+                      this._ensureNative();
+                      return this._compiled.validateJSON(JSON.stringify(x));
+                    }
+                  : (x) => {
+                      this._ensureNative();
+                      return this._compiled.validate(x);
+                    });
+        }
+        return _errOnlyImpl(d);
+      };
 
       // Best path: combined validator (single pass, validates + collects errors)
       // Valid data: returns VALID_RESULT, no allocation
@@ -1148,24 +1215,41 @@ class Validator {
       // Test combined at compile time -- some schemas (e.g. if/then/else)
       // produce broken combined code that crashes on certain inputs.
       // We probe with diverse data; if any throws, fall back to hybrid.
-      let safeCombinedFn = null;
-      if (jsCombinedFn) {
-        try {
-          const probe = {};
-          // Populate probe with one key per known property to trigger nested paths
-          if (schemaObj && schemaObj.properties) {
-            for (const k of Object.keys(schemaObj.properties)) probe[k] = "";
-          }
-          if (schemaObj && schemaObj.if && schemaObj.if.properties) {
-            for (const k of Object.keys(schemaObj.if.properties)) probe[k] = "";
-          }
-          jsCombinedFn(probe);
-          jsCombinedFn({});
-          jsCombinedFn(null);
-          jsCombinedFn(0);
-          safeCombinedFn = jsCombinedFn;
-        } catch {}
-      }
+      let _combinedProbed = false;
+      let _safeCombined = null;
+      const combinedIfSafe = () => {
+        if (_combinedProbed) return _safeCombined;
+        _combinedProbed = true;
+        _buildDeferred();
+        if (jsCombinedFn) {
+          try {
+            const probe = {};
+            // Populate probe with one key per known property to trigger nested paths
+            if (schemaObj && schemaObj.properties) {
+              for (const k of Object.keys(schemaObj.properties)) probe[k] = "";
+            }
+            if (schemaObj && schemaObj.if && schemaObj.if.properties) {
+              for (const k of Object.keys(schemaObj.if.properties)) probe[k] = "";
+            }
+            jsCombinedFn(probe);
+            jsCombinedFn({});
+            jsCombinedFn(null);
+            jsCombinedFn(0);
+            _safeCombined = jsCombinedFn;
+          } catch {}
+        }
+        return _safeCombined;
+      };
+
+      // What the hybrid path hands to its error slot: the combined function
+      // when it is usable, since it validates and collects in one pass, and
+      // the error generator otherwise. Same order the eager code chose, just
+      // chosen on the first rejection.
+      let _errPreferredImpl = null;
+      const errPreferCombined = (d) => {
+        if (_errPreferredImpl === null) _errPreferredImpl = combinedIfSafe() || errOnly;
+        return _errPreferredImpl(d);
+      };
 
       // The boolean engine is the verdict authority for these paths; the
       // final lazy wrapper uses it to skip error construction entirely.
@@ -1182,7 +1266,7 @@ class Validator {
           : (data) => (_fn(data) ? VALID_RESULT : ABORT_EARLY_RESULT);
       } else if (hasDynRef && _isCodegen && jsFn) {
         // $dynamicRef with JS codegen: direct path, no wrapper layers
-        const _fn = jsFn, _efn = safeErrFn || errFn, _R = VALID_RESULT;
+        const _fn = jsFn, _efn = errOnly, _R = VALID_RESULT;
         this.validate = preprocess
           ? (data) => { preprocess(data); return _fn(data) ? _R : _efn(data); }
           : (data) => _fn(data) ? _R : _efn(data);
@@ -1207,31 +1291,29 @@ class Validator {
       } else if (jsFn && jsFn._hybridFactory) {
         // Zero-wrapper: hybridFactory bakes VALID_RESULT + errFn into a single function
         // No arrow function wrapper, no ternary, one function call
-        const hybridFn = jsFn._hybridFactory(VALID_RESULT, safeCombinedFn || errFn);
+        // The factory bakes the error function in as an argument and never
+        // calls it for a document that passes, so a resolver here costs the
+        // accepted path nothing and keeps the compile off the first call.
+        const hybridFn = jsFn._hybridFactory(VALID_RESULT, errPreferCombined);
         this.validate = preprocess
           ? (data) => { preprocess(data); return hybridFn(data); }
           : hybridFn;
-      } else if (safeCombinedFn) {
-        this.validate = preprocess
-          ? (data) => { preprocess(data); return safeCombinedFn(data); }
-          : safeCombinedFn;
       } else {
-        const hybridFn = jsFn && jsFn._hybridFactory
-          ? jsFn._hybridFactory(VALID_RESULT, errFn)
-          : null;
-        this.validate = hybridFn
-          ? preprocess
+        // No hybrid factory, so the assembly needs the function itself rather
+        // than a reference it can call later: build it now.
+        const safeCombinedFn = combinedIfSafe();
+        if (safeCombinedFn) {
+          this.validate = preprocess
+            ? (data) => { preprocess(data); return safeCombinedFn(data); }
+            : safeCombinedFn;
+        } else {
+          this.validate = preprocess
             ? (data) => {
                 preprocess(data);
-                return hybridFn(data);
+                return jsFn(data) ? VALID_RESULT : errOnly(data);
               }
-            : hybridFn
-          : preprocess
-            ? (data) => {
-                preprocess(data);
-                return jsFn(data) ? VALID_RESULT : errFn(data);
-              }
-            : (data) => (jsFn(data) ? VALID_RESULT : errFn(data));
+            : (data) => (jsFn(data) ? VALID_RESULT : errOnly(data));
+        }
       }
       // Verbose mode: populate parentSchema, schema and data on each error, the
       // three fields the default error shape carries under the same option.
@@ -1274,12 +1356,15 @@ class Validator {
       this.isValidObject = preprocess
         ? (data) => { preprocess(data); return jsFn(data) }
         : jsFn;
+      // Same preference as the object path: the combined function first, since
+      // it validates and collects in one pass, and the error generator behind
+      // it. `errPreferCombined` is that order, resolved on the first rejection
+      // instead of at compile time.
       const hybridFn = jsFn._hybridFactory
-        ? jsFn._hybridFactory(VALID_RESULT, errFn)
+        ? jsFn._hybridFactory(VALID_RESULT, errPreferCombined)
         : null;
-      const jsonValidateInner = safeCombinedFn
-        || hybridFn
-        || ((obj) => (jsFn(obj) ? VALID_RESULT : errFn(obj)));
+      const jsonValidateInner = hybridFn
+        || ((obj) => (jsFn(obj) ? VALID_RESULT : errPreferCombined(obj)));
       // Parsed text takes the same preprocess pass as a parsed object, so
       // validate(obj) and validateJSON(text) answer the same for the same
       // document. Without it, coercion, removal and defaults applied on one
@@ -1799,15 +1884,20 @@ class Validator {
       return;
     }
     const uf = this._userFormats;
-    const jsFn = compileToJSCodegen(this._schemaObj, sm, uf) || compileToJS(this._schemaObj, null, sm);
+    const _cg = compileToJSCodegen(this._schemaObj, sm, uf);
+    const jsFn = _cg || compileToJS(this._schemaObj, null, sm);
     this._jsFn = jsFn;
     if (jsFn) {
       this.isValidObject = jsFn;
       // A partial entry: the verdict function is real, the other two are not
-      // built yet rather than declined. `full: false` says so, so the next
-      // caller that needs errors compiles them instead of inheriting nulls.
+      // built yet rather than declined. `undefined` is the not-built marker
+      // the full compile's _buildDeferred looks for; `null` would read as
+      // "the compiler declined" and cost the schema its error function, which
+      // is the bug this cache had once already. `isCodegen` rides along so a
+      // validator that later reuses this entry reports the same engine it
+      // would have compiled to.
       if (!uf) {
-        if (!cached) _compileCache.set(mapKey, { jsFn, combined: null, errFn: null, full: false });
+        if (!cached) _compileCache.set(mapKey, { jsFn, combined: undefined, errFn: undefined, isCodegen: !!_cg, full: false });
         else cached.jsFn = jsFn;
       }
     }

package/lib/compat-errors.js

@@ -49,7 +49,14 @@ function pointerOf(schemaPath) {
 }
 
 function segments(pointer) {
-  return pointer === '' ? [] : pointer.split('/').slice(1);
+  // split-then-slice built two arrays per call, and this is called for every
+  // error's pointer and every pointer walk. Dropping everything before the
+  // first '/' first builds one. Same answer for every input shape, including
+  // a pointer with no slash at all, which the old form turned into [].
+  if (pointer === '') return [];
+  const i = pointer.indexOf('/');
+  if (i < 0) return [];
+  return pointer.slice(i + 1).split('/');
 }
 
 // Walks a pointer's segments and reports, per position, whether that segment
@@ -67,24 +74,41 @@ function classify(segs) {
   return kinds;
 }
 
-function compareReferenceOrder(a, b) {
-  const pa = segments(pointerOf(a.schemaPath || ''));
-  const pb = segments(pointerOf(b.schemaPath || ''));
-  const ka = classify(pa);
-  const n = Math.min(pa.length, pb.length);
-  for (let i = 0; i < n; i++) {
-    if (pa[i] === pb[i]) continue;
-    if (ka[i] !== 'kw') return 0;
-    const ra = REFERENCE_RANK.get(pa[i]);
-    const rb = REFERENCE_RANK.get(pb[i]);
-    if (ra === undefined || rb === undefined) return 0;
-    return ra - rb;
-  }
-  return 0;
+// One derived key per error: its pointer relative to the hash, the split
+// segments, and each segment's kind. Everything below used to re-derive these
+// wherever it needed them, which for one shaped rejection meant splitting the
+// same pointer three times per error.
+function keyFor(e) {
+  const rel = pointerOf(e && e.schemaPath ? e.schemaPath : '#');
+  const segs = segments(rel);
+  return { rel, segs, kinds: classify(segs) };
+}
+
+function sortByKeys(errors, keys) {
+  if (errors.length < 2) return errors.slice();
+  const keyed = errors.map((e) => ({ e, k: keys.get(e) }));
+  keyed.sort((A, B) => {
+    const pa = A.k.segs, pb = B.k.segs, ka = A.k.kinds;
+    const n = Math.min(pa.length, pb.length);
+    for (let i = 0; i < n; i++) {
+      if (pa[i] === pb[i]) continue;
+      if (ka[i] !== 'kw') return 0;
+      const ra = REFERENCE_RANK.get(pa[i]);
+      const rb = REFERENCE_RANK.get(pb[i]);
+      if (ra === undefined || rb === undefined) return 0;
+      return ra - rb;
+    }
+    return 0;
+  });
+  for (let i = 0; i < keyed.length; i++) keyed[i] = keyed[i].e;
+  return keyed;
 }
 
 function sortLikeReference(errors) {
-  return errors.length < 2 ? errors : errors.slice().sort(compareReferenceOrder);
+  if (errors.length < 2) return errors;
+  const keys = new Map();
+  for (const e of errors) keys.set(e, keyFor(e));
+  return sortByKeys(errors, keys);
 }
 
 function walkPointer(node, pointer) {
@@ -151,14 +175,16 @@ function createShaper({ Validator, rootId, rootDoc, schemas, options, allErrors,
   // `basePointer` is where `errors` were produced relative to the root
   // document; a branch validator reports paths relative to its branch.
   function shape(errors, data, basePointer) {
-    const sorted = sortLikeReference(errors);
+    const keys = new Map();
+    for (const e of errors) keys.set(e, keyFor(e));
+    const sorted = sortByKeys(errors, keys);
     const out = [];
     const consumed = new Set();
     let thenGroup = null; // { prefix, which } for the pending `if` wrapper
 
     const flushIf = (e) => {
       if (thenGroup === null) return;
-      const segs = segments(pointerOf(e ? e.schemaPath : ''));
+      const segs = e ? keys.get(e).segs : [];
       const still = e && segs.length > thenGroup.depth && segs[thenGroup.depth] === thenGroup.which &&
         segs.slice(0, thenGroup.depth).join('/') === thenGroup.prefixSegs;
       if (still) return;
@@ -170,10 +196,11 @@ function createShaper({ Validator, rootId, rootDoc, schemas, options, allErrors,
     for (let idx = 0; idx < sorted.length; idx++) {
       const e = sorted[idx];
       if (consumed.has(e)) continue;
-      const rel = pointerOf(e.schemaPath || '#');
+      const K = keys.get(e);
+      const rel = K.rel;
       const abs = basePointer + rel;
-      const segs = segments(rel);
-      const kinds = classify(segs);
+      const segs = K.segs;
+      const kinds = K.kinds;
       const schemaPrefix = (e.schemaPath || '#').slice(0, (e.schemaPath || '#').indexOf('#') + 1);
 
       if (allErrors) flushIf(e);
@@ -234,7 +261,7 @@ function createShaper({ Validator, rootId, rootDoc, schemas, options, allErrors,
           // instance is replaced by the regenerated sequence.
           for (let j = idx; j < sorted.length; j++) {
             const o = sorted[j];
-            if ((o.instancePath || '') === (e.instancePath || '') && pointerOf(o.schemaPath || '#').startsWith(pnPointer + '/')) consumed.add(o);
+            if ((o.instancePath || '') === (e.instancePath || '') && keys.get(o).rel.startsWith(pnPointer + '/')) consumed.add(o);
           }
           const pnSchemaPath = schemaPrefix + pnPointer;
           for (const name of Object.keys(object)) {

package/lib/js-compiler.js

@@ -2612,8 +2612,14 @@ function genCode(schema, v, lines, ctx, knownType) {
           }
           // else: already emitted early (before properties)
         } else if (propCount > 0) {
-          // TRICK 3: charCodeAt switch tree
-          inner = genCharCodeSwitch(knownKeys, v)
+          // TRICK 3: charCodeAt switch tree. Above the lookup threshold it is
+          // the additionalProperties quadratic wearing a disguise: keys that
+          // share a first character, ENV_0 through ENV_999 say, all land in
+          // one case whose body is a chain of every name, per key of the
+          // document. The hoisted name lookup is the same cure it was there.
+          inner = propCount >= AP_LOOKUP_MIN
+            ? apMembershipCheck(ctx, knownKeys, v)
+            : genCharCodeSwitch(knownKeys, v)
                     _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
         } else {
           inner = `for(var _k in ${v})return false`
@@ -2627,8 +2633,13 @@ function genCode(schema, v, lines, ctx, knownType) {
         genCode(schema.unevaluatedProperties, `${v}[${ukVar}]`, subLines, ctx)
         if (subLines.length > 0) {
           const check = subLines.join(';')
-          const keyChecks = knownKeys.map(k => `${ukVar}===${JSON.stringify(k)}`).join('||')
-          const skipKnown = knownKeys.length > 0 ? `if(${keyChecks})continue;` : ''
+          let skipKnown = ''
+          if (knownKeys.length >= AP_LOOKUP_MIN) {
+            const id = emitNameLookup(ctx, knownKeys)
+            skipKnown = id !== null ? `if(${id}[${ukVar}]!==undefined)continue;` : `if(${knownKeys.map(k => `${ukVar}===${JSON.stringify(k)}`).join('||')})continue;`
+          } else if (knownKeys.length > 0) {
+            skipKnown = `if(${knownKeys.map(k => `${ukVar}===${JSON.stringify(k)}`).join('||')})continue;`
+          }
           const inner = `for(var ${ukVar} in ${v}){${skipKnown}${check}}`
                     _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
         }

package/lib/strict-check.js

@@ -0,0 +1,142 @@
+'use strict';
+
+// The authoring-time check behind `strictSchema`. A mistyped keyword is the
+// one schema mistake that fails open: `maxLenght` is not an error to any
+// JSON Schema dialect, it is an annotation, so the intended constraint is
+// simply absent and previously invalid data starts validating. A validator
+// cannot make that safe at validation time. It can be loud about it when the
+// schema is compiled, which is what this is.
+//
+// The known-keyword list is not written out here. Each vendored meta-schema's
+// `properties` are precisely its dialect's keywords, so the list comes from
+// the specification documents in `metaschemas.js` rather than from a copy
+// someone keeps in step. The union across vendored dialects is used, not the
+// schema's own dialect: a draft-07 keyword in a 2020-12 schema is a real
+// authoring question but not a fail-open one, and a union cannot produce a
+// false positive on a valid document.
+
+const { METASCHEMAS } = require('./metaschemas');
+const { levenshtein } = require('./levenshtein');
+
+// Keywords ata implements beyond the official vocabularies.
+const ATA_KEYWORDS = ['nullable', 'errorMessage', 'propertyDependencies', 'discriminator'];
+
+let SPEC_KEYWORDS = null;
+function specKeywords() {
+  if (SPEC_KEYWORDS === null) {
+    SPEC_KEYWORDS = new Set(ATA_KEYWORDS);
+    for (const doc of METASCHEMAS.values()) {
+      if (doc && doc.properties) for (const k of Object.keys(doc.properties)) SPEC_KEYWORDS.add(k);
+    }
+  }
+  return SPEC_KEYWORDS;
+}
+
+// Where subschemas live, so the walk knows a key under `properties` is a
+// property name and a key directly on a schema object is a keyword.
+const SCHEMA_MAPS = new Set(['properties', 'patternProperties', '$defs', 'definitions', 'dependentSchemas']);
+const SCHEMA_LISTS = new Set(['allOf', 'anyOf', 'oneOf', 'prefixItems']);
+const SCHEMA_SINGLE = new Set([
+  'items', 'additionalItems', 'additionalProperties', 'unevaluatedProperties',
+  'unevaluatedItems', 'contains', 'propertyNames', 'not', 'if', 'then', 'else',
+  'contentSchema',
+]);
+// Values that are data, never schemas, however object-shaped they look.
+const DATA_VALUED = new Set(['enum', 'const', 'default', 'examples', 'required', 'type', '$vocabulary']);
+
+function nearest(word, known) {
+  let best = null;
+  let bestD = Infinity;
+  for (const k of known) {
+    // A candidate further away than half the word is noise, not a typo.
+    const d = levenshtein(word, k);
+    if (d < bestD) { bestD = d; best = k; }
+  }
+  return bestD > 0 && bestD <= 2 && best !== null ? best : null;
+}
+
+function resolveLocalPointer(root, ref) {
+  let node = root;
+  for (const raw of ref.slice(2).split('/')) {
+    const token = raw.replace(/~1/g, '/').replace(/~0/g, '~');
+    if (node === null || typeof node !== 'object') return false;
+    if (Array.isArray(node)) {
+      if (!/^\d+$/.test(token) || Number(token) >= node.length) return false;
+      node = node[Number(token)];
+    } else {
+      if (!Object.prototype.hasOwnProperty.call(node, token)) return false;
+      node = node[token];
+    }
+  }
+  return node !== undefined;
+}
+
+/**
+ * Walks a schema and reports the authoring mistakes the validator would
+ * otherwise ignore. Returns an array of { path, message }, empty when clean.
+ *
+ * `userKeywords` are names registered through the `keywords` option, and
+ * `x-` prefixed names pass without comment: they are the conventional
+ * extension namespace and rejecting them would flag real documents.
+ */
+function checkSchemaStrict(root, options) {
+  const known = specKeywords();
+  const user = options && options.userKeywords ? options.userKeywords : null;
+  const problems = [];
+  const seen = new Set();
+
+  function isKnown(key) {
+    if (known.has(key)) return true;
+    if (user && (Array.isArray(user) ? user.includes(key) : Object.prototype.hasOwnProperty.call(user, key))) return true;
+    if (key.startsWith('x-')) return true;
+    return false;
+  }
+
+  function walkSchema(node, path) {
+    if (node === null || typeof node !== 'object' || Array.isArray(node)) return;
+    if (seen.has(node)) return;
+    seen.add(node);
+    for (const key of Object.keys(node)) {
+      const value = node[key];
+      const at = path + '/' + key;
+      if (!isKnown(key)) {
+        const hint = nearest(key, known);
+        problems.push({
+          path: at,
+          message: hint
+            ? `unknown keyword "${key}" (did you mean "${hint}"?)`
+            : `unknown keyword "${key}"`,
+        });
+        continue;
+      }
+      if (key === '$ref' && typeof value === 'string' && value.startsWith('#/') && !resolveLocalPointer(root, value)) {
+        problems.push({ path: at, message: `$ref "${value}" does not resolve in this document` });
+        continue;
+      }
+      if (DATA_VALUED.has(key)) continue;
+      if (SCHEMA_MAPS.has(key)) {
+        if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+          for (const name of Object.keys(value)) walkSchema(value[name], at + '/' + name.replace(/~/g, '~0').replace(/\//g, '~1'));
+        }
+      } else if (SCHEMA_LISTS.has(key)) {
+        if (Array.isArray(value)) for (let i = 0; i < value.length; i++) walkSchema(value[i], at + '/' + i);
+      } else if (SCHEMA_SINGLE.has(key)) {
+        // draft-07 lets `items` be an array of schemas.
+        if (Array.isArray(value)) { for (let i = 0; i < value.length; i++) walkSchema(value[i], at + '/' + i); }
+        else walkSchema(value, at);
+      } else if (key === 'dependencies') {
+        // draft-07: each value is either a schema or an array of names.
+        if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+          for (const name of Object.keys(value)) {
+            if (!Array.isArray(value[name])) walkSchema(value[name], at + '/' + name);
+          }
+        }
+      }
+    }
+  }
+
+  walkSchema(root, '#');
+  return problems;
+}
+
+module.exports = { checkSchemaStrict };

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.22.1';
+module.exports = '1.23.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.22.1",
+  "version": "1.23.0",
   "description": "JSON Schema validation that compiles for speed and still runs where code generation is blocked. Compiled and interpreted engines answer identically at 100% of the official suite. TypeScript inference, Standard Schema V1, and a build step that emits dependency-free modules.",
   "main": "index.js",
   "module": "index.mjs",
@@ -51,7 +51,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_uri_helper_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_uri_helper_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -122,13 +122,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.22.1",
-    "@ata-validator/native-darwin-x64": "1.22.1",
-    "@ata-validator/native-linux-arm64-gnu": "1.22.1",
-    "@ata-validator/native-linux-arm64-musl": "1.22.1",
-    "@ata-validator/native-linux-x64-gnu": "1.22.1",
-    "@ata-validator/native-linux-x64-musl": "1.22.1",
-    "@ata-validator/native-win32-x64": "1.22.1"
+    "@ata-validator/native-darwin-arm64": "1.23.0",
+    "@ata-validator/native-darwin-x64": "1.23.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.23.0",
+    "@ata-validator/native-linux-arm64-musl": "1.23.0",
+    "@ata-validator/native-linux-x64-gnu": "1.23.0",
+    "@ata-validator/native-linux-x64-musl": "1.23.0",
+    "@ata-validator/native-win32-x64": "1.23.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"