ata-validator 1.22.1 → 1.24.0

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.24.0 - 2026-09-16
+
+### Added
+
+- A schema-directed scanner: `isValidJSON()` answers the verdict from the JSON text without building the document. Parsing is about three quarters of the cost of a request that only needs yes or no, and a rejection now stops at the byte that caused it. The scanner compiles per schema, on the codegen path only, after 64 calls (generating one costs about 20 µs, so a caller that checks one document never pays), and it declines anything outside its supported core: `type`, `properties`, `required`, `additionalProperties`, `items`, `prefixItems`, the length, size and range keywords, `pattern`, `format`, `const`, `enum`, local `$ref` (inlined, acyclic, no base-changing keywords below the root), `allOf` (merged, with the `additionalProperties` cross-branch rule written out in full), and `unevaluated*` where it is provably a synonym for `additionalProperties`/`items`. Whatever it cannot answer it declines at compile time or bails from at runtime, and the parse path takes over unchanged. `tests/test_scanner_differential.js` holds the scanner and `validate()` to the same verdict on the same text: 413,130 comparisons over the official suite, a malformed-JSON corpus and generated corruptions, zero disagreements, and the count must stay at zero.
+  - Cross-process medians against the same call forced through `JSON.parse`: accepted documents 1.19x to 1.43x by size; rejection at the first element 37x at 4 KB and 385x at 41 KB.
+  - Generated config schemas are first-class: up to 4096 properties per node, and past 48 names the dispatch is a rolling hash accumulated during the key scan, one lookup in a Map passed outside the source, one `startsWith` to confirm, bodies shared per distinct subschema, and an in-order fast path for machine-written JSON that resynchronises across omitted optional keys. A 26.6 KB config with 1300 declared properties: 136.7 µs by parse-and-validate, 43.8 µs by scan.
+  - `isValidJSON` also remembers the last (text, verdict) pair, since the verdict is a pure function of the text: a drift monitor re-reading an unchanged file answers in 0.44 µs by native string compare. Withheld when user formats or custom keywords are present, since user functions may not be pure.
+- Strict mode covers all four cases from issue #44: unknown keywords (with a spelling suggestion), unresolvable local `$ref`s, keywords the node's own `type` makes inert (`minimum` on a string can never fire), and `required` names nothing can satisfy (`additionalProperties: false` with the name absent from `properties`). `ata compile --strict-schema` and `build({ strictSchema: true })` run the same checks at build time and refuse to emit a module from a schema that fails them.
+
+### Fixed
+
+- An AOT module that cannot carry error detail says so. `toStandaloneModule` with error detail requested builds the error function from the error generator, which declines some schemas, `unevaluated*` among them; the runtime validator falls back to the interpreted engine there, but a standalone module has nothing to fall back to, so it shipped with an exact verdict and a single ATA9000 stub for every failure, silently. The module still ships, since the verdict is exact and validating the rare failing document with the runtime `Validator` is a legitimate pattern, but the degradation is loud in every layer: `onWarning` on the emitter, a NOTE in the module header, a `warnings` list in the `build()` report, a printed warning from `ata compile`, and a refused build under `--strict`. Found by a gateway team that lost their per-field startup errors to it.
+
+## 1.23.0 - 2026-09-16
+
+### Added
+
+- `strictSchema: true | 'log'`, and the compat shim's `strict`/`strictSchema` now enforce it: the authoring-time checks for the mistakes that fail open. An unknown keyword throws at construction with its path and the nearest known spelling, `strict mode: unknown keyword "maxLenght" (did you mean "maxLength"?) at #/properties/a/maxLenght`, and a local `$ref` that does not resolve in its own document throws instead of compiling a validator that rejects everything. `'log'` warns through the logger and continues. Off by default. The known-keyword list is derived from the vendored meta-schema documents rather than maintained by hand, plus the keywords ata implements beyond them; `x-` prefixed names and keywords registered through the `keywords` option pass. Property names, `enum` and `const` values, `default` and `examples` are data, not keywords, and the walk knows the difference, including the draft-07 `dependencies` form. `strictTypes`, `strictTuples` and `strictRequired` remain accepted and ignored, and `compat.d.ts` now says which is which. Reported as issue #44 by a migration that fuzzed 1,364 mutations against both validators, found zero divergence, and then shipped a typo.
+
+### Changed
+
+- The error and combined generators compile on the first rejection instead of at startup. Every schema compiled three functions eagerly: the verdict, the combined validate-and-collect form, and the error generator, which on a cold first call cost 8.2, 10.4 and 7.8 ms on a 120-property config schema, most of it V8 compiling each generator's own code the first time it is entered. A caller that never reads an error never needs the last two, and `validate()` on a passing document does not either, so they are built on the first rejection. Compile plus first verdict on that schema: 30.7 to 10.8 ms, interleaved runs of committed builds. The warm path measured the same on all ten cases checked. The shared compile cache keeps `undefined` meaning not built yet and `null` meaning the compiler declined, in both places that seed it, and `tests/test_compile_cache_order.js` caught the one seam where the two seeders disagreed during this change.
+- The static `unevaluatedProperties` tier stopped checking membership with a first-character switch. Keys sharing a first character, `ENV_0` through `ENV_999` say, all land in one case whose body chains every name, per key of the document: the `additionalProperties` quadratic in a different coat. Above 128 declared names the generated code reads the hoisted lookup that fixed the first one; below that the switch stays. A 1300-property config document with both of its objects closed: 87.7 to 24.5 µs, and the keyword now costs what `additionalProperties` costs, which is the membership test itself. Only the boolean generator has this code; the error and combined generators decline `unevaluated*` and the interpreted engine produces those errors.
+- The compat shim derives each error's pointer segments and kinds once, into a key map shared by the reference-order sort and the shaping loop. The sort comparator used to re-split and re-classify both errors' pointers on every one of its comparisons, and the loop derived the same segments again per error, with the `if` wrapper's flush doing it a third time. A seven-error rejection through `ata-validator/compat` with `allErrors`: 5.79 to 3.27 µs. The shim's own overhead over `Validator.validate` fell from 4.4 µs to 1.9. The compat surface is pinned by `test_compat`, 106 error-format cases, 36 parity cases and the error-shape differential, all green before and after.
+
+### Fixed
+
+- The API table said `verbose` attaches only `parentSchema`; it attaches `parentSchema`, `schema` and `data`, and the migration guide now lists which `params` key each keyword carries. The performance notes recorded "length-bucketed key comparison for `additionalProperties: false`" as measured and dropped on the grounds that each comparison is a pointer compare; that was right about one comparison and wrong about the total, and the note now carries the measurements that replaced it.
+
 ## 1.22.1 - 2026-09-16
 
 ### Fixed

package/bin/ata.js

@@ -38,6 +38,10 @@ Build options:
   --cache-file <path>     Cache file for incremental builds (default: cache disabled)
   --max-size <bytes>      Fail build if any compiled module exceeds this gzipped size
   --strict                Treat any AOT-incompatible schema as a build error (default: skip + warn)
+  --strict-schema         Fail the build on schema authoring mistakes: unknown
+                          keywords (with a spelling suggestion), keywords the
+                          node's type makes inert, unresolvable local $refs,
+                          and required names nothing can satisfy
   --watch                 Re-emit on schema change (Ctrl-C to exit)
   --no-types              Skip .d.mts/.d.cts emission alongside compiled modules
   --source                Embed schema source map (default in development)
@@ -80,6 +84,7 @@ function parseArgs(argv) {
     if (a === '--abort-early') { out.opts.abortEarly = true; continue; }
     if (a === '--check') { out.opts.check = true; continue; }
     if (a === '--strict') { out.opts.strict = true; continue; }
+    if (a === '--strict-schema') { out.opts.strictSchema = true; continue; }
     if (a === '--out-dir') { out.opts.outDir = argv[++i]; continue; }
     if (a === '--suffix') { out.opts.suffix = argv[++i]; continue; }
     if (a === '--cache-file') { out.opts.cacheFile = argv[++i]; continue; }
@@ -180,6 +185,19 @@ function cmdCompile(args) {
     process.exit(1);
   }
 
+  // The build is where an authoring mistake is cheapest to stop: a typo like
+  // maxLenght compiles into a module that simply lacks the rule, and nobody
+  // revisits a compiled module. Findings fail the compile, with the path and
+  // the suggested spelling.
+  if (args.opts.strictSchema) {
+    const { checkSchemaStrict } = require('../lib/strict-check');
+    const problems = checkSchemaStrict(schema, {});
+    if (problems.length > 0) {
+      for (const x of problems) reportCompileError(input, `strict mode: ${x.message} at ${x.path}`);
+      process.exit(1);
+    }
+  }
+
   const { Validator } = require('..');
   const aot = require('../lib/aot');
   let v;
@@ -200,7 +218,15 @@ function cmdCompile(args) {
     }
   }
   const schemaFile = path.relative(process.cwd(), input) || input;
-  const src = aot.toStandaloneModule(v, { format, abortEarly, source, sourceMap, schemaFile });
+  const compileWarnings = [];
+  const src = aot.toStandaloneModule(v, { format, abortEarly, source, sourceMap, schemaFile, onWarning: (w) => compileWarnings.push(w) });
+  if (compileWarnings.length > 0) {
+    if (args.opts.strict) {
+      for (const w of compileWarnings) reportCompileError(input, w);
+      process.exit(1);
+    }
+    for (const w of compileWarnings) process.stderr.write(`ata: warning: ${input}: ${w}\n`);
+  }
   if (!src) {
     reportCompileError(input, 'schema is too complex for standalone compilation');
     process.exit(1);

package/compat.d.ts

@@ -78,10 +78,15 @@ declare namespace Ata {
     formats?: Record<string, Format>;
     keywords?: KeywordDefinition[];
     schemas?: object[] | Record<string, object>;
+    /** Enforced: unknown keywords and dangling local $refs throw at compile ('log' warns instead). */
     strict?: boolean | 'log';
+    /** Same checks as `strict`; the specific option wins over the umbrella one. */
     strictSchema?: boolean | 'log';
+    /** Accepted for API compatibility; not enforced. */
     strictTypes?: boolean | 'log';
+    /** Accepted for API compatibility; not enforced. */
     strictTuples?: boolean | 'log';
+    /** Accepted for API compatibility; not enforced. */
     strictRequired?: boolean | 'log';
     allowUnionTypes?: boolean;
     logger?: { log(...args: unknown[]): void; warn(...args: unknown[]): void; error(...args: unknown[]): void } | false;

package/compat.js

@@ -15,8 +15,10 @@ const { resolvePointer } = require('./lib/pointer.js');
 //   - `$data` references;
 //   - keywords defined only through `code` (a code generator hook);
 //   - the reference formats plugin, whose formats are built in here.
-// Strict-mode schema checks (`strict`, `strictTypes`, ...) are accepted and
-// ignored: an unknown keyword is an annotation, as the specification says.
+// Strict-mode schema checks: `strict` and `strictSchema` are enforced for the
+// checks that fail open, an unknown keyword (`maxLenght` compiles and the
+// constraint is simply absent) and a dangling local `$ref`. `strictTypes`,
+// `strictTuples` and `strictRequired` are accepted and ignored.
 
 const { Validator } = require('./index');
 const { METASCHEMAS } = require('./lib/metaschemas');
@@ -99,6 +101,13 @@ class Ata {
       removeAdditional: !!o.removeAdditional,
       verbose: !!o.verbose,
     };
+    // `strict` and `strictSchema`: the unknown-keyword and dangling-local-$ref
+    // checks are enforced; `strictTypes`, `strictTuples` and `strictRequired`
+    // are still accepted and ignored. The specific keyword option wins over
+    // the umbrella one, which is how the reference class reads them.
+    const strictness = o.strictSchema !== undefined ? o.strictSchema : o.strict;
+    if (strictness === true || strictness === 'log') out.strictSchema = strictness;
+    if (o.logger !== undefined) out.logger = o.logger;
     if (o.validateFormats === false) out.assertFormat = false;
     const formatNames = Object.keys(this._formats);
     if (formatNames.length > 0) out.formats = { ...this._formats };

package/index.js

@@ -885,6 +885,29 @@ class Validator {
     // produced the error). Matches ajv's `verbose: true` behavior.
     this._verbose = !!options.verbose;
 
+    // strictSchema: authoring-time checks, off by default. A mistyped keyword
+    // is the one schema mistake that fails open: to every dialect `maxLenght`
+    // is an annotation, so the constraint the author meant is simply absent
+    // and previously invalid data validates. `true` throws here, at
+    // construction, with every finding; `'log'` reports through
+    // `options.logger` or the console and continues. The check runs on the
+    // schema as written, before any normalization touches it.
+    if (options.strictSchema === true || options.strictSchema === 'log') {
+      const { checkSchemaStrict } = require('./lib/strict-check');
+      const problems = checkSchemaStrict(schema, { userKeywords: options.keywords || null });
+      if (problems.length > 0) {
+        const text = problems.map((x) => `strict mode: ${x.message} at ${x.path}`).join('\n');
+        if (options.strictSchema === true) {
+          throw new Error(text);
+        }
+        const logger = options.logger;
+        if (logger !== false) {
+          const warn = logger && typeof logger.warn === 'function' ? logger.warn.bind(logger) : console.warn;
+          warn(text);
+        }
+      }
+    }
+
     // richErrors: default true. Only the literal `false` opts back into the
     // v0.14 error shape (no code/expected/received/docUrl, no aliases).
     this._richErrors = options && options.richErrors === false ? false : true;
@@ -910,6 +933,8 @@ class Validator {
     // to attach dataFrame entries to each enriched error.
     this._posCache = null; // created by _pos() on first use, only the JSON text path needs it
     this._lastRawInput = null;
+    // undefined: not built yet. null: this schema has no scanner.
+    this._scanner = undefined;
 
     // Public methods start as memoized accessors on the prototype; nothing is
     // allocated per instance until one is first read. See _defineLazyMethod
@@ -1014,27 +1039,40 @@ class Validator {
     // because nothing has tried to build them yet. Both halves of that
     // distinction are null, and reading the second as the first costs this
     // schema its generated error function for the life of the process.
-    } else if (cached && cached.full && !_forceNapi) {
+    } else if (cached && cached.jsFn !== undefined && !_forceNapi) {
+      // `full` says the error and combined functions exist too. An entry
+      // without it still carries a verdict function worth reusing; the pair is
+      // built by _buildDeferred below if something asks for an error, and the
+      // entry is upgraded then. `undefined` in `combined`/`errFn` means not
+      // built yet; `null` means the compiler declined. Those two must never
+      // blur: reading the first as the second is the bug this cache had once
+      // already, and it silently cost schemas their generated error function.
       jsFn = cached.jsFn;
       jsCombinedFn = cached.combined;
       jsErrFn = cached.errFn;
       _isCodegen = !!cached.isCodegen;
+      this._engine = _isCodegen ? 'codegen' : jsFn ? 'closure' : null;
     } else if (!_forceNapi) {
       const uf = this._userFormats;
       const _cgFn = compileToJSCodegen(schemaObj, sm, uf);
       jsFn = _cgFn || compileToJS(schemaObj, null, sm);
-      jsCombinedFn = compileToJSCombined(schemaObj, VALID_RESULT, sm, uf);
-      jsErrFn = compileToJSCodegenWithErrors(schemaObj, sm, uf);
+      // Only the verdict is compiled here. The error and combined generators
+      // are the other two thirds of a cold first call (8.2, 10.4 and 7.8 ms on
+      // a 120-property config schema, most of it V8 compiling each generator
+      // the first time it is entered), and a caller that never reads an error
+      // never needs them. _buildDeferred compiles them on the first rejection.
+      jsCombinedFn = undefined;
+      jsErrFn = undefined;
       _isCodegen = !!_cgFn;
       this._engine = _cgFn ? 'codegen' : jsFn ? 'closure' : null;
       if (!uf) {
-        _compileCache.set(mapKey, { jsFn, combined: jsCombinedFn, errFn: jsErrFn, isCodegen: _isCodegen, full: true });
+        _compileCache.set(mapKey, { jsFn, combined: undefined, errFn: undefined, isCodegen: _isCodegen, full: false });
       }
     } else {
       jsFn = null; jsCombinedFn = null; jsErrFn = null;
     }
     this._jsFn = jsFn;
-    if (this._engine === undefined) this._engine = (cached && cached.full) ? (cached.isCodegen ? 'codegen' : jsFn ? 'closure' : null) : null;
+    if (this._engine === undefined) this._engine = null;
 
     // Data mutators -- try codegen first (12x faster), fallback to closure arrays.
     // Follow cross-refs so coercion/defaults/removeAdditional see the referenced
@@ -1080,14 +1118,26 @@ class Validator {
           )));
     const useSimdjsonForLarge = !hasArrayTraversal;
 
-    if (jsFn) {
-      let safeErrFn = null;
-      if (jsErrFn) {
-        try {
-          jsErrFn({}, true);
-          safeErrFn = (d) => jsErrFn(d, true);
-        } catch {}
+    // Builds the two generators the compile step left out, once, and upgrades
+    // the shared cache entry. `undefined` means not built yet; `null` means the
+    // compiler declined. Conflating those is what once cost every schema its
+    // generated error function for the life of the process, so they stay apart.
+    const _buildDeferred = () => {
+      if (jsCombinedFn !== undefined && jsErrFn !== undefined) return;
+      const uf2 = this._userFormats;
+      if (jsCombinedFn === undefined) jsCombinedFn = compileToJSCombined(schemaObj, VALID_RESULT, sm, uf2) || null;
+      if (jsErrFn === undefined) jsErrFn = compileToJSCodegenWithErrors(schemaObj, sm, uf2) || null;
+      if (!uf2) {
+        const entry = _compileCache.get(mapKey);
+        if (entry && entry.jsFn === jsFn) {
+          entry.combined = jsCombinedFn;
+          entry.errFn = jsErrFn;
+          entry.full = true;
+        }
       }
+    };
+
+    if (jsFn) {
       // errFn: use JS codegen if safe, else native fallback (only when native
       // is available). Environments without the native addon — Cloudflare
       // Workers, browser, Bun without N-API — get a JS-only fallback so the
@@ -1126,19 +1176,38 @@ class Validator {
       // reports those schemas correctly, so failing data is re-validated
       // there. This used to be a placeholder error with no keyword and no
       // path, which hid whatever had actually failed.
-      const errFn =
-        safeErrFn ||
-        (hasUnevaluated || !native
-          ? jsOnlyFallback
-            : hasDynRef
-              ? (d) => {
-                  this._ensureNative();
-                  return this._compiled.validateJSON(JSON.stringify(d));
-                }
-              : (d) => {
-                  this._ensureNative();
-                  return this._compiled.validate(d);
-                });
+      // Resolved on the first rejection rather than at compile time, because
+      // building the generator behind it is two thirds of what a first call
+      // costs and a caller that never reads an error never needs it. The probe
+      // moves here with it: it calls the generated function, so it cannot run
+      // before the function exists.
+      let _errOnlyImpl = null;
+      const errOnly = (d) => {
+        if (_errOnlyImpl === null) {
+          _buildDeferred();
+          let safe = null;
+          if (jsErrFn) {
+            try {
+              jsErrFn({}, true);
+              safe = (x) => jsErrFn(x, true);
+            } catch {}
+          }
+          _errOnlyImpl =
+            safe ||
+            (hasUnevaluated || !native
+              ? jsOnlyFallback
+                : hasDynRef
+                  ? (x) => {
+                      this._ensureNative();
+                      return this._compiled.validateJSON(JSON.stringify(x));
+                    }
+                  : (x) => {
+                      this._ensureNative();
+                      return this._compiled.validate(x);
+                    });
+        }
+        return _errOnlyImpl(d);
+      };
 
       // Best path: combined validator (single pass, validates + collects errors)
       // Valid data: returns VALID_RESULT, no allocation
@@ -1148,24 +1217,41 @@ class Validator {
       // Test combined at compile time -- some schemas (e.g. if/then/else)
       // produce broken combined code that crashes on certain inputs.
       // We probe with diverse data; if any throws, fall back to hybrid.
-      let safeCombinedFn = null;
-      if (jsCombinedFn) {
-        try {
-          const probe = {};
-          // Populate probe with one key per known property to trigger nested paths
-          if (schemaObj && schemaObj.properties) {
-            for (const k of Object.keys(schemaObj.properties)) probe[k] = "";
-          }
-          if (schemaObj && schemaObj.if && schemaObj.if.properties) {
-            for (const k of Object.keys(schemaObj.if.properties)) probe[k] = "";
-          }
-          jsCombinedFn(probe);
-          jsCombinedFn({});
-          jsCombinedFn(null);
-          jsCombinedFn(0);
-          safeCombinedFn = jsCombinedFn;
-        } catch {}
-      }
+      let _combinedProbed = false;
+      let _safeCombined = null;
+      const combinedIfSafe = () => {
+        if (_combinedProbed) return _safeCombined;
+        _combinedProbed = true;
+        _buildDeferred();
+        if (jsCombinedFn) {
+          try {
+            const probe = {};
+            // Populate probe with one key per known property to trigger nested paths
+            if (schemaObj && schemaObj.properties) {
+              for (const k of Object.keys(schemaObj.properties)) probe[k] = "";
+            }
+            if (schemaObj && schemaObj.if && schemaObj.if.properties) {
+              for (const k of Object.keys(schemaObj.if.properties)) probe[k] = "";
+            }
+            jsCombinedFn(probe);
+            jsCombinedFn({});
+            jsCombinedFn(null);
+            jsCombinedFn(0);
+            _safeCombined = jsCombinedFn;
+          } catch {}
+        }
+        return _safeCombined;
+      };
+
+      // What the hybrid path hands to its error slot: the combined function
+      // when it is usable, since it validates and collects in one pass, and
+      // the error generator otherwise. Same order the eager code chose, just
+      // chosen on the first rejection.
+      let _errPreferredImpl = null;
+      const errPreferCombined = (d) => {
+        if (_errPreferredImpl === null) _errPreferredImpl = combinedIfSafe() || errOnly;
+        return _errPreferredImpl(d);
+      };
 
       // The boolean engine is the verdict authority for these paths; the
       // final lazy wrapper uses it to skip error construction entirely.
@@ -1182,7 +1268,7 @@ class Validator {
           : (data) => (_fn(data) ? VALID_RESULT : ABORT_EARLY_RESULT);
       } else if (hasDynRef && _isCodegen && jsFn) {
         // $dynamicRef with JS codegen: direct path, no wrapper layers
-        const _fn = jsFn, _efn = safeErrFn || errFn, _R = VALID_RESULT;
+        const _fn = jsFn, _efn = errOnly, _R = VALID_RESULT;
         this.validate = preprocess
           ? (data) => { preprocess(data); return _fn(data) ? _R : _efn(data); }
           : (data) => _fn(data) ? _R : _efn(data);
@@ -1207,31 +1293,29 @@ class Validator {
       } else if (jsFn && jsFn._hybridFactory) {
         // Zero-wrapper: hybridFactory bakes VALID_RESULT + errFn into a single function
         // No arrow function wrapper, no ternary, one function call
-        const hybridFn = jsFn._hybridFactory(VALID_RESULT, safeCombinedFn || errFn);
+        // The factory bakes the error function in as an argument and never
+        // calls it for a document that passes, so a resolver here costs the
+        // accepted path nothing and keeps the compile off the first call.
+        const hybridFn = jsFn._hybridFactory(VALID_RESULT, errPreferCombined);
         this.validate = preprocess
           ? (data) => { preprocess(data); return hybridFn(data); }
           : hybridFn;
-      } else if (safeCombinedFn) {
-        this.validate = preprocess
-          ? (data) => { preprocess(data); return safeCombinedFn(data); }
-          : safeCombinedFn;
       } else {
-        const hybridFn = jsFn && jsFn._hybridFactory
-          ? jsFn._hybridFactory(VALID_RESULT, errFn)
-          : null;
-        this.validate = hybridFn
-          ? preprocess
-            ? (data) => {
-                preprocess(data);
-                return hybridFn(data);
-              }
-            : hybridFn
-          : preprocess
+        // No hybrid factory, so the assembly needs the function itself rather
+        // than a reference it can call later: build it now.
+        const safeCombinedFn = combinedIfSafe();
+        if (safeCombinedFn) {
+          this.validate = preprocess
+            ? (data) => { preprocess(data); return safeCombinedFn(data); }
+            : safeCombinedFn;
+        } else {
+          this.validate = preprocess
             ? (data) => {
                 preprocess(data);
-                return jsFn(data) ? VALID_RESULT : errFn(data);
+                return jsFn(data) ? VALID_RESULT : errOnly(data);
               }
-            : (data) => (jsFn(data) ? VALID_RESULT : errFn(data));
+            : (data) => (jsFn(data) ? VALID_RESULT : errOnly(data));
+        }
       }
       // Verbose mode: populate parentSchema, schema and data on each error, the
       // three fields the default error shape carries under the same option.
@@ -1274,12 +1358,15 @@ class Validator {
       this.isValidObject = preprocess
         ? (data) => { preprocess(data); return jsFn(data) }
         : jsFn;
+      // Same preference as the object path: the combined function first, since
+      // it validates and collects in one pass, and the error generator behind
+      // it. `errPreferCombined` is that order, resolved on the first rejection
+      // instead of at compile time.
       const hybridFn = jsFn._hybridFactory
-        ? jsFn._hybridFactory(VALID_RESULT, errFn)
+        ? jsFn._hybridFactory(VALID_RESULT, errPreferCombined)
         : null;
-      const jsonValidateInner = safeCombinedFn
-        || hybridFn
-        || ((obj) => (jsFn(obj) ? VALID_RESULT : errFn(obj)));
+      const jsonValidateInner = hybridFn
+        || ((obj) => (jsFn(obj) ? VALID_RESULT : errPreferCombined(obj)));
       // Parsed text takes the same preprocess pass as a parsed object, so
       // validate(obj) and validateJSON(text) answer the same for the same
       // document. Without it, coercion, removal and defaults applied on one
@@ -1341,6 +1428,23 @@ class Validator {
             return verdictFromText(jsonStr);
           }
         : verdictFromText;
+
+      // A schema-directed scanner answers the verdict from the JSON text
+      // without building the document. Parsing is around three quarters of the
+      // cost of a real request, and a caller that only wants yes or no should
+      // not pay it; a rejection can also stop at the byte that caused it
+      // instead of parsing the rest of a document that is already refused.
+      //
+      // It is wired only where the verdict IS the answer. On a path that has
+      // to produce errors, scanning an invalid document is work thrown away,
+      // so those keep parsing. `abortEarly` has no errors to produce, so it
+      // counts as a verdict path.
+      //
+      // Not wired when a preprocess pass is configured: coercion, removal and
+      // defaults rewrite the document before it is judged, and the scanner
+      // reads what arrived. The compiler declines any schema it cannot answer
+      // and a compiled scanner returns BAIL for a document shape it cannot
+      // answer, and then the parse path below takes over unchanged.
       // validateAndParse: parse the JSON, then validate. Pure JS (JSON.parse +
       // validate) so it works with or without the native addon and in browsers.
       {
@@ -1714,6 +1818,83 @@ class Validator {
       const { bufferNeedsSlowPath, installSlowBufferApis } = require('./lib/buffer-gate.js');
       if (bufferNeedsSlowPath(schemaObj, this._schemaMap, this._keywords)) installSlowBufferApis(this);
     }
+    // Installed after the buffer gate on purpose: the gate replaces
+    // isValidJSON for schemas whose shapes the native walker gets wrong,
+    // unevaluatedProperties among them, and the scanner wiring has to wrap
+    // whatever answers last or a gated schema silently loses its scanner.
+    if (this._jsFn && !this._preprocess) {
+        const self = this;
+        // Generating a scanner costs about 20 microseconds, measured, and it
+        // saves from around 85 nanoseconds on a small accepted document to
+        // several microseconds on a rejected one. Building it on the first
+        // call would therefore be a straight loss for a caller that checks one
+        // document and exits, so it is built once a caller has asked often
+        // enough that it is plainly doing this in a loop. A server passes the
+        // line during warm-up and never sees it.
+        const SCAN_AFTER = 64;
+        let calls = 0;
+        // undefined: not built. null: this schema has no scanner. Passing true
+        // builds it now, which is how the differential test reaches it.
+        this._ensureScanner = (now) => {
+          if (self._scanner === undefined) {
+            if (!now && ++calls < SCAN_AFTER) return undefined;
+            const built = require('./lib/scan-compiler').compileScanner(schemaObj, { userFormats: self._userFormats });
+            self._scanner = built ? built.scan : null;
+          }
+          return self._scanner;
+        };
+        const byParsing = this.isValidJSON;
+        // The verdict is a pure function of the text, and the caller a
+        // gateway or a drift monitor keeps asking about is usually the same
+        // text: a config file re-read on a timer, a heartbeat body. One
+        // remembered (text, verdict) pair answers that case with a native
+        // string compare, which is a memcmp, instead of a scan. Withheld when
+        // user formats or custom keywords are present, since those are user
+        // functions and nothing guarantees they are pure.
+        const memoizable = !self._userFormats && !self._usesKeywords;
+        let _memoText = null;
+        let _memoVerdict = false;
+        this.isValidJSON = (jsonStr) => {
+          const scan = self._ensureScanner();
+          if (scan === undefined) return byParsing(jsonStr);
+          if (scan === null) { self.isValidJSON = byParsing; return byParsing(jsonStr); }
+          self.isValidJSON = memoizable
+            ? (text) => {
+                if (typeof text !== 'string') return byParsing(text);
+                if (text === _memoText) return _memoVerdict;
+                const r = scan(text);
+                const verdict = r === -1 ? byParsing(text) : r === 1;
+                _memoText = text;
+                _memoVerdict = verdict;
+                return verdict;
+              }
+            : (text) => {
+                if (typeof text !== 'string') return byParsing(text);
+                const r = scan(text);
+                if (r === -1) return byParsing(text);
+                return r === 1;
+              };
+          return self.isValidJSON(jsonStr);
+        };
+        if (options.abortEarly) {
+          const validateByParsing = this.validateJSON;
+          this.validateJSON = (jsonStr) => {
+            const scan = self._ensureScanner();
+            if (scan === undefined) return validateByParsing(jsonStr);
+            if (scan === null) { self.validateJSON = validateByParsing; return validateByParsing(jsonStr); }
+            self.validateJSON = (text) => {
+              if (typeof text === 'string') {
+                const r = scan(text);
+                if (r === 1) return VALID_RESULT;
+                if (r === 0) return ABORT_EARLY_RESULT;
+              }
+              return validateByParsing(text);
+            };
+            return self.validateJSON(jsonStr);
+          };
+        }
+      }
+
 
     // Save to identity cache for ultra-fast reuse with same schema object.
     // Only an instance built without options may answer a later
@@ -1799,15 +1980,20 @@ class Validator {
       return;
     }
     const uf = this._userFormats;
-    const jsFn = compileToJSCodegen(this._schemaObj, sm, uf) || compileToJS(this._schemaObj, null, sm);
+    const _cg = compileToJSCodegen(this._schemaObj, sm, uf);
+    const jsFn = _cg || compileToJS(this._schemaObj, null, sm);
     this._jsFn = jsFn;
     if (jsFn) {
       this.isValidObject = jsFn;
       // A partial entry: the verdict function is real, the other two are not
-      // built yet rather than declined. `full: false` says so, so the next
-      // caller that needs errors compiles them instead of inheriting nulls.
+      // built yet rather than declined. `undefined` is the not-built marker
+      // the full compile's _buildDeferred looks for; `null` would read as
+      // "the compiler declined" and cost the schema its error function, which
+      // is the bug this cache had once already. `isCodegen` rides along so a
+      // validator that later reuses this entry reports the same engine it
+      // would have compiled to.
       if (!uf) {
-        if (!cached) _compileCache.set(mapKey, { jsFn, combined: null, errFn: null, full: false });
+        if (!cached) _compileCache.set(mapKey, { jsFn, combined: undefined, errFn: undefined, isCodegen: !!_cg, full: false });
         else cached.jsFn = jsFn;
       }
     }

package/lib/aot-build.js

@@ -94,6 +94,7 @@ async function build(opts) {
   const cached = [];
   const skipped = [];
   const failed = [];
+  const warnings = [];
 
   for (const input of inputs) {
     try {
@@ -126,6 +127,18 @@ async function build(opts) {
         continue;
       }
       const schema = parseSchemaFile(input);
+      // The build is where an authoring mistake is cheapest to stop: a typo
+      // like maxLenght compiles into a validator that simply lacks the rule,
+      // and a compiled module fails even more quietly than a runtime one,
+      // since nobody ever revisits it. Findings fail the input's build.
+      if (opts.strictSchema) {
+        const { checkSchemaStrict } = require('./strict-check');
+        const problems = checkSchemaStrict(schema, {});
+        if (problems.length > 0) {
+          failed.push({ input, error: problems.map((x) => `strict mode: ${x.message} at ${x.path}`).join('; ') });
+          continue;
+        }
+      }
       const v = new Validator(schema);
       const source = resolveSourceDefault(opts);
       let sourceMap = null;
@@ -138,6 +151,7 @@ async function build(opts) {
         }
       }
       const schemaFile = path.relative(process.cwd(), input) || input;
+      const inputWarnings = [];
       const src = aot.toStandaloneModule(v, {
         format,
         abortEarly: !!opts.abortEarly,
@@ -145,7 +159,15 @@ async function build(opts) {
         sourceMap,
         schemaFile,
         formatMode: opts.formatMode,
+        onWarning: (w) => inputWarnings.push(w),
       });
+      if (inputWarnings.length > 0) {
+        if (opts.strict) {
+          failed.push({ input, error: inputWarnings.join('; ') });
+          continue;
+        }
+        for (const w of inputWarnings) warnings.push({ input, warning: w });
+      }
       if (!src) {
         const reason = 'schema is not AOT-compatible (toStandaloneModule returned null)';
         if (opts.strict) failed.push({ input, error: reason });
@@ -190,12 +212,12 @@ async function build(opts) {
 
   if (opts.check) {
     const staleCount = inputs.length - cached.length;
-    return { compiled: [], cached, skipped, failed, staleCount };
+    return { compiled: [], cached, skipped, failed, warnings, staleCount };
   }
 
   writeCache(opts.cacheFile, newCache);
 
-  return { compiled, cached, skipped, failed };
+  return { compiled, cached, skipped, failed, warnings };
 }
 
 async function watch(opts, onReport) {