ata-validator 1.24.0 → 1.26.0

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.26.0 - 2026-09-17
+
+### Added
+
+- `toStandaloneModule(schema, { parse: true })` inlines local, acyclic `$ref`s before the clone proof runs, so schemas that keep their shapes in `$defs` and reference them, which is every schema a generator emits, now get a `parse()`. Only a node that is exactly a `$ref` plus annotations is inlined; a cycle, an external reference or a constraining sibling keyword leaves the reference in place and the clone declines as before. Defaults follow the runtime exactly: a `default` written next to the `$ref` fills, a `default` written inside the referenced definition does not, because `validate()` with `useDefaults` draws the same line and `parse()` must not be more generous than `validate()`. A new test holds `parse()` output equal to the runtime's `validate().data` on the same input.
+- When `parse: true` is requested and the clone still cannot be proven, the decline is loud: `onWarning` fires with the reason, and the emitted module carries a NOTE comment saying it has no `parse` export. Previously the only way to notice was reading the export list.
+
+### Fixed
+
+- The runtime compiler built `patternProperties` (and combined `additionalProperties`) child validators with `new Function`, which discarded the parent's helper scope: a child schema that needed a compiled pattern or format helper threw `ReferenceError` at validation time. Child checks are now generated inline in the parent validator and share its helper bindings. Reported and fixed by @jdalton in #46.
+- The TypeScript declarations emitted next to a compiled module now declare the `schemaHash` export; 1.25.0 added it to every module but not to the generated `.d.mts`, so importing it by name failed type checking while working at runtime.
+
+## 1.25.0 - 2026-09-17
+
+### Fixed
+
+- Emitted standalone modules compiled their regex patterns on every call. The compiler stores each pattern both as a closure variable and as an inline `const _reN = __ataSafeRe(...)` in the stored source; in process the inline line never runs (the closure binds the compiled matcher once), but every emitter placed it inside the emitted function, where it shadowed the module-scope binding and rebuilt the matcher per call. A schema with one `pattern` validated at 202 thousand ops/s as a standalone module while the in-process path ran at millions. Patterns are now declared once at load scope in all four emitters (`toStandalone`, `toStandaloneModule`, `bundleStandalone`, `bundleCompact`); the same document on the same schema now measures 27.0 million ops/s, 134x. `bundleCompact` needed care: its deduplication keyed on body text alone, and with the pattern no longer in the body, two schemas differing only in their pattern would have merged, so the key now includes the factory-scope declarations.
+
+### Added
+
+- Provably local `unevaluated*` compiles real error detail on the generated-code path, and therefore in standalone modules. When every occurrence of `unevaluatedProperties`/`unevaluatedItems` sits on a node with no `$ref` and no `patternProperties`, and every in-place applicator (`allOf`, `anyOf`, `oneOf`, `if`/`then`/`else`) contributes only property names the node's own `properties` already declares, the keyword is exactly `additionalProperties`/`items` in disguise and both the error and combined generators now emit it as such, keeping the keyword's own identity: one error per stray key with `params.unevaluatedProperty` (ATA7003), one error with `params.limit` for extra items. `toStandaloneModule` with error detail requested no longer degrades on these schemas; a config schema of the common `if/then/else` plus root `unevaluatedProperties: false` shape ships an AOT module with the same per-field errors the runtime reports. Schemas where the annotations cannot be proven local (`unevaluated*` next to a `$ref`, cousin-visible shapes) still decline, loudly, as before. Verified by the error-shape differential (2,816 cases), the engine differential (18,126 cases) and the official suite on all three dialects.
+- `toStandaloneModule(schema, { positions: true })` also exports `validateJSON(text)`: parse, validate, and on failure attach a `dataFrame` (`byteOffset`, `length`, `line`, `col`, `text`) to every error by walking the original text once. The mapping goes through `instancePath`, so a key that appears in several sections frames each error on its own occurrence, which a first-occurrence string search does not. A syntax error is the single ATA9001 error with a frame on the document. The walker is the runtime's own `buildDataPositionMap`, embedded verbatim so the two cannot drift, and it costs about 5 KB in the module (1.7 KB gzipped), which is why it is opt-in.
+- `toStandaloneModule(schema, { parse: true })`'s `parse(data)` now fills declared `default` values for absent optional properties (object and array defaults are fresh per call) and is emitted for composed schemas under the same proof the `unevaluated*` error generators use: in-place applicators are admitted when every property name they mention is already declared in the node's own `properties`. The common config shape, `if`/`then`/`else` over declared fields with root `unevaluatedProperties: false`, now gets a `parse` that enforces the conditional, rejects undeclared keys, and returns the ready object. Two default shapes decline because they are where `parse` and the runtime would disagree: a required property with a default, and a default the property's own schema rejects.
+- Every emitted module exports `schemaHash`, a 16 character content hash of the schema it was compiled from, over canonical JSON so key order does not matter, computed from the schema as the caller wrote it so dialect normalization does not break the comparison. `schemaHash(schema)` from `ata-validator/build` computes the same value; a build detects a stale artifact by comparing the two instead of embedding its own fingerprint.
+- The agreement between compiled modules and the runtime is now a stated contract, in `docs/STABILITY.md` and the API reference: same version, same verdict on every document, enforced by the differential test in every CI run, with the emitters declining or degrading loudly where they cannot prove equivalence.
+- The compat shim exports `attachDataFrames(errors, text)`: the same one-pass mapping for Ajv-shaped errors, for callers that keep the source text around. Not an Ajv API; it exists because hand-written line finders based on a string search get repeated keys wrong.
+
 ## 1.24.0 - 2026-09-16
 
 ### Added

package/README.md

@@ -60,7 +60,7 @@ file.
   libraries maintained outside this project. On its validation page, valid data, the run of
   2026-09-13 against ata 1.14.1 puts ata first at 603 ns, with the next entry at 1.77 times
   that. The same site puts ata last on the download page, at 64.9 KB gzipped, because the entry
-  it bundles is the runtime compiler; the module `ata build` emits for that schema is 3.9 KB
+  it bundles is the runtime compiler; the module `ata build` emits for that schema is 5.1 KB
   minified and gzipped, and a compiled entry for the harness is in preparation.
 - [Bowtie](https://bowtie.report/), the cross-implementation JSON Schema test harness. ata's
   harness runs Draft 2020-12 and draft 7 there; on the harness at ata 1.16.1 the official suite
@@ -71,17 +71,19 @@ file.
 
 | Dimension | Schema | ata-AOT | runtime validator | Difference |
 |---|---|---|---|---|
-| Bundle (gzipped) | simple | 1.0 KB | 52.7 KB | 50.5x smaller |
-| Bundle (gzipped) | complex | 4.8 KB | 52.7 KB | 11.0x smaller |
-| Bundle (gzipped) | nested | 2.3 KB | 52.7 KB | 23.1x smaller |
+| Bundle (gzipped) | simple | 1.1 KB | 52.7 KB | 48.1x smaller |
+| Bundle (gzipped) | complex | 7.6 KB | 52.7 KB | 7.0x smaller |
+| Bundle (gzipped) | nested | 4.1 KB | 52.7 KB | 13.0x smaller |
 | Cold start | simple | 21 ms | 40 ms | 1.9x faster |
-| Throughput (1M ops) | simple | 258 Mops/s | 102 Mops/s | 2.5x faster |
-| Compile time | simple | 8 µs | 1.61 ms | 191x faster |
+| Throughput (1M ops) | simple | 257 Mops/s | 114 Mops/s | 2.3x faster |
+| Compile time | simple | 14 µs | 1.52 ms | 111x faster |
 
 The runtime column is the default validator most frameworks ship. Reproduce on your machine
-with `npm run bench:aot-vs-ajv`. Numbers from one run on Apple M4 Pro, Node 25.2.1, 2026-08-13. Across three runs throughput moved between 258 and 278
-Mops/s and the compile ratio between 150x and 199x, so treat the last two rows as an order
-of magnitude rather than a constant.
+with `npm run bench:aot-vs-ajv`. Numbers from one run on Apple M4 Pro, Node 25.2.1, 2026-09-17,
+on ata-validator 1.25.0, whose emitted modules carry full error detail and a schema hash, which
+is where the growth over earlier 1.x module sizes comes from. Across three runs throughput moved
+between 257 and 297 Mops/s and the compile ratio between 104x and 112x, so treat the last two
+rows as an order of magnitude rather than a constant.
 
 The wins are largest on bundle size and compile time because AOT moves work from runtime to
 build time. Throughput and cold start are also faster because the compiled validator is a
@@ -209,19 +211,19 @@ is the most common way to get a misleading number out of this library.
 
 | | compiled with `ata build` | runtime `new Validator(schema)` |
 |---|---|---|
-| In a bundle, gzipped | **1.9 KB** | 75.6 KB |
-| Time to a served request | **3.5 ms** | 10.7 ms |
+| In a bundle, gzipped | **4.5 KB** | 87.0 KB |
+| Time to a served request | **3.4 ms** | 10.6 ms |
 | Schema known when | build time | any time |
 
 The bundle row is a ten-field user schema built with
 `bun build --minify --target=browser`. The startup row is a Hono route on Bun 1.4, best
-of seven, against 3.6 ms for the same app doing no validation at all, so the compiled
+of seven, against 3.7 ms for the same app doing no validation at all, so the compiled
 path costs nothing measurable to start. The runtime
 figure is what it is because a schema that arrives at run time can use any keyword, so
 the whole engine has to be there. The compiled module imports nothing and contains only
 the checks your schema asks for.
 
-**On a server, use whichever fits your schemas.** 76 KB of JavaScript on a Node or Bun
+**On a server, use whichever fits your schemas.** 87 KB of JavaScript on a Node or Bun
 process is not a cost anyone notices, and the runtime API is the simpler thing to reach
 for. Speed is the same either way once warm.
 
@@ -450,7 +452,7 @@ const v = new Validator(schema, {
 
 ### Build-time compile (`ata compile`)
 
-The `ata` CLI turns a JSON Schema file into a self-contained JavaScript module. No runtime dependency on `ata-validator`, so only the generated validator ships to the browser. Typical output is about 2 KB gzipped for a ten-field schema, against 74 KB for the runtime bundled for the browser.
+The `ata` CLI turns a JSON Schema file into a self-contained JavaScript module. No runtime dependency on `ata-validator`, so only the generated validator ships to the browser. Typical output is about 4.5 KB gzipped for a ten-field schema, full error detail included, against 87 KB for the runtime bundled for the browser.
 
 ```bash
 npx ata compile schemas/user.json -o src/generated/user.validator.mjs

package/bin/ata.js

@@ -161,7 +161,13 @@ function cmdCompile(args) {
     process.exit(1);
   }
   const input = args._[0];
-  const format = args.opts.format || 'esm';
+  // With no --format, the output filename already says what the caller wants:
+  // -o validator.cjs used to emit an ES module into a .cjs file, which Node
+  // then refused to load.
+  const extFormat = args.opts.output && /\.cjs$/.test(args.opts.output) ? 'cjs'
+    : args.opts.output && /\.mjs$/.test(args.opts.output) ? 'esm'
+    : null;
+  const format = args.opts.format || extFormat || 'esm';
   if (format !== 'esm' && format !== 'cjs') {
     process.stderr.write(`error: --format must be esm or cjs (got "${format}")\n`);
     process.exit(1);

package/build.d.ts

@@ -89,6 +89,18 @@ export interface BundleStandaloneOptions {
 }
 
 export interface ToStandaloneModuleOptions {
+  /**
+   * Run the authoring-time schema checks before emitting: unknown keywords
+   * (with a spelling suggestion), inert keywords, unsatisfiable required
+   * names, unresolvable local $refs. Throws with every finding.
+   */
+  strictSchema?: boolean;
+  /**
+   * Called when the module ships degraded: error detail was requested but the
+   * error generator declined this schema, so failures report the single
+   * ATA9000 abort-early error while the verdict stays exact.
+   */
+  onWarning?: (message: string) => void;
   format?: 'cjs' | 'esm';
   abortEarly?: boolean;
   source?: boolean;
@@ -99,12 +111,27 @@ export interface ToStandaloneModuleOptions {
   formatMode?: 'embed' | 'inject';
   /**
    * Also export `parse(data)`: validate, then return a copy of the input
-   * holding only the properties the schema declares. Off by default because
-   * it adds to the emitted module's size. Emitted only where the copy is
-   * provably exact; a schema using `$ref`, a composition, `patternProperties`,
-   * an `additionalProperties` schema or an array of objects gets no `parse`.
+   * holding only the properties the schema declares, with declared `default`
+   * values filled in for absent optional properties (object and array
+   * defaults are fresh per call). Off by default because it adds to the
+   * emitted module's size. Emitted only where the copy is provably exact:
+   * `$ref` and `patternProperties` decline; in-place applicators (`allOf`,
+   * `anyOf`, `oneOf`, `if`/`then`/`else`, and `unevaluatedProperties: false`)
+   * are admitted when every property name they mention is already declared
+   * in the node's own `properties`. A required property with a default, or
+   * a default its own schema rejects, also declines, because those are the
+   * two shapes where parse() and the runtime would disagree.
    */
   parse?: boolean;
+  /**
+   * Also export `validateJSON(text)`: parse the JSON text, validate, and on
+   * failure attach a `dataFrame` ({ byteOffset, length, line, col, text })
+   * to every error by walking the original text once, so errors point at the
+   * right occurrence even when the same key appears in several sections.
+   * Off by default because the embedded position walker adds to the emitted
+   * module's size.
+   */
+  positions?: boolean;
 }
 
 /** Bundle multiple schemas into one self-contained module (no ata-validator runtime). */
@@ -113,6 +140,16 @@ export function bundleStandalone(schemas: unknown[], options?: BundleStandaloneO
 /** Like {@link bundleStandalone} but deduplicates shared bodies for smaller output. */
 export function bundleCompact(schemas: unknown[], options?: BundleStandaloneOptions): string;
 
+/**
+ * Stable content hash of a schema, 16 hex characters, over a canonical JSON
+ * form (keys sorted at every level). Every module from
+ * {@link toStandaloneModule} exports its own `schemaHash`; comparing that
+ * against `schemaHash(currentSchema)` tells a build the module is stale.
+ * An integrity aid, not a security boundary.
+ */
+export function schemaHash(schema: unknown): string;
+
 /** Emit a self-contained `validate`/`isValid` module string for a single
- * schema, plus `parse` when {@link ToStandaloneModuleOptions.parse} is set. */
+ * schema, plus `parse` when {@link ToStandaloneModuleOptions.parse} is set
+ * and `validateJSON` when {@link ToStandaloneModuleOptions.positions} is. */
 export function toStandaloneModule(schema: unknown, options?: ToStandaloneModuleOptions): string | null;

package/compat.d.ts

@@ -25,6 +25,14 @@ declare class Ata {
   removeKeyword(keyword: string): this;
 
   errorsText(errors?: Ata.ErrorObject[] | null, options?: { separator?: string; dataVar?: string }): string;
+
+  /**
+   * Attach a `dataFrame` ({ byteOffset, length, line, col, text }) to each
+   * error by mapping its `instancePath` into the JSON text the data was
+   * parsed from. One walk of the text; correct when the same key appears in
+   * several sections. Not an Ajv API. Mutates and returns `errors`.
+   */
+  static attachDataFrames(errors: Ata.ErrorObject[] | null | undefined, text: string | Buffer): Ata.ErrorObject[] | null | undefined;
 }
 
 declare namespace Ata {

package/compat.js

@@ -409,6 +409,26 @@ function metaValidator(id) {
   return v;
 }
 
+// Maps each error's instancePath to its position in the JSON text the data
+// was parsed from and attaches it as `dataFrame` ({ byteOffset, length,
+// line, col, text }). One walk of the text, and correct when the same key
+// appears in several sections, which a first-occurrence string search is
+// not. Not an Ajv API: exported for callers that keep the source text
+// around and want file positions on Ajv-shaped errors.
+Ata.attachDataFrames = function attachDataFrames(errors, text) {
+  if (!errors || !errors.length || text == null) return errors;
+  const { buildDataPositionMap } = require('./lib/data-positions');
+  let map;
+  try { map = buildDataPositionMap(text); } catch { return errors; }
+  for (const e of errors) {
+    if (!e || e.dataFrame) continue;
+    const ptr = e.instancePath != null ? e.instancePath : (e.dataPath || '');
+    const p = map[ptr];
+    if (p) e.dataFrame = { byteOffset: p.byteOffset, length: p.length, line: p.line, col: p.col, text: p.text };
+  }
+  return errors;
+};
+
 module.exports = Ata;
 module.exports.default = Ata;
 module.exports.Ata = Ata;

package/index.d.ts

@@ -395,9 +395,20 @@ export interface ValidatorOptions {
   keywords?: Record<string, KeywordDefinition | KeywordValidate>;
   /**
    * When true, validation errors include `parentSchema` (the schema object
-   * that produced the error). Matches ajv's `verbose: true`.
+   * that produced the error), `schema` (the failing keyword's own value) and
+   * `data` (the value the error points at). Matches ajv's `verbose: true`.
    */
   verbose?: boolean;
+  /**
+   * Authoring-time schema checks, run at construction on the schema as
+   * written: unknown keywords (with a spelling suggestion), keywords the
+   * node's own `type` makes inert, `required` names nothing can satisfy, and
+   * local `$ref`s that do not resolve. `true` throws with every finding;
+   * `'log'` warns through `logger` (or the console) and continues.
+   */
+  strictSchema?: boolean | 'log';
+  /** Receives `strictSchema: 'log'` warnings; `false` silences them. */
+  logger?: { warn(...args: unknown[]): void } | false;
   /**
    * When true, validate() returns a shared frozen result on the first failure
    * instead of collecting full error details. Smaller hot-path allocation.

package/lib/aot-build.js

@@ -270,10 +270,22 @@ function bundleCompact(schemas, opts) {
 }
 
 function toStandaloneModule(schema, opts) {
+  // The same authoring-time checks `ata compile --strict-schema` runs, for
+  // callers driving the build API directly: a typo in a schema headed for a
+  // compiled module is the quietest place a typo can live.
+  if (opts && opts.strictSchema) {
+    const { checkSchemaStrict } = require('./strict-check');
+    const problems = checkSchemaStrict(schema, {});
+    if (problems.length > 0) {
+      throw new Error(problems.map((x) => `strict mode: ${x.message} at ${x.path}`).join('\n'));
+    }
+  }
   const v = schema instanceof Validator ? schema : new Validator(schema, opts);
   return aot.toStandaloneModule(v, opts);
 }
 
+const { schemaHash } = require('./schema-hash');
+
 module.exports = {
   build,
   expandGlobs,
@@ -283,4 +295,5 @@ module.exports = {
   bundleStandalone,
   bundleCompact,
   toStandaloneModule,
+  schemaHash,
 };

package/lib/aot-impl.js

@@ -13,7 +13,9 @@
 //   bundleCompact(Validator, schemas, opts)
 //   loadBundle(Validator, mods, schemas, opts)
 
-const { compileToJSCodegenWithErrors } = require('./js-compiler');
+const { compileToJSCodegenWithErrors, compileToJSCodegen, unevalContributions } = require('./js-compiler');
+const { buildDataPositionMap } = require('./data-positions');
+const { schemaHash } = require('./schema-hash');
 const SAFE_REGEX_SOURCE = require('./safe-regex-source');
 
 // Embedded verbatim in standalone modules so the output file has no runtime
@@ -54,6 +56,35 @@ function safeRePrelude(...fns) {
   return fns.some((f) => f && f._usesSafeRe) ? getSafeRegexEmbed() + '\n' : '';
 }
 
+// Serialize the closure variables a compiled function referenced (regexes,
+// sets, lookup tables, preprocessor functions) into declarations for load
+// scope. Regex lines are no longer inlined into _source, so every emitter
+// must declare them exactly once outside the emitted function; inlining them
+// in the body recompiled the pattern on every call.
+function closureDeclLines(jsFn, declKW) {
+  const kw = declKW || 'const';
+  const lines = [];
+  if (!jsFn || !jsFn._closures || jsFn._closures.length === 0) return lines;
+  for (const { name, val } of jsFn._closures) {
+    if (Array.isArray(val)) { lines.push(`${kw} ${name} = ${JSON.stringify(val)};`); continue; }
+    if (val && val.__ataSafe) {
+      lines.push(`${kw} ${name} = __ataSafeRe(${JSON.stringify(val.source)});`);
+    } else if (val instanceof RegExp) {
+      const flags = val.flags;
+      lines.push(`${kw} ${name} = new RegExp(${JSON.stringify(val.source)}${flags ? ', ' + JSON.stringify(flags) : ''});`);
+    } else if (val instanceof Set) {
+      lines.push(`${kw} ${name} = new Set(${JSON.stringify([...val])});`);
+    } else if (typeof val === 'function') {
+      // new Function('_ppv', body) — extract body from toString()
+      const str = val.toString();
+      const m = str.match(/^function[^(]*\([^)]*\)\s*\{([\s\S]*)\}$/);
+      const body = m ? m[1].trim() : str;
+      lines.push(`${kw} ${name} = function(_ppv) { ${body} };`);
+    }
+  }
+  return lines;
+}
+
 // A validator can enforce more than its schema says. `withKeywords` from
 // @ata-project/keywords wraps an instance's entry points, and a wrapper
 // declares that by setting `_externalChecks`. The emitters below build their
@@ -87,11 +118,12 @@ function toStandalone(validator) {
   );
   const errSrc = jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : '';
 
+  const closureSrc = closureDeclLines(jsFn).join('\n');
   return `// Auto-generated by ata-validator — do not edit
 'use strict';
 ${_CP_LEN_SOURCE}
 ${safeRePrelude(jsFn, jsErrFn)}${preambleSrc}
-const boolFn = function(d) {
+${closureSrc ? closureSrc + '\n' : ''}const boolFn = function(d) {
   ${src}
 };
 const hybridFactory = function(R, E) {
@@ -167,21 +199,112 @@ function emitFormatDecls(closures, mode, declKW) {
 // Returns null when the clone cannot be proven exact, and the module then
 // simply has no parse(). Declining is recoverable; a sanitiser that quietly
 // drops a property the schema allows is not.
+// Resolve a local JSON pointer ('#', '#/$defs/x', draft-7 '#/definitions/x',
+// any '#/...' path) against the schema root. Returns null for anything else:
+// external documents, anchors, URNs. Those stay with the runtime engines.
+function resolveLocalPointer(root, ref) {
+  if (ref === '#') return root;
+  if (typeof ref !== 'string' || !ref.startsWith('#/')) return null;
+  let cur = root;
+  for (const raw of ref.slice(2).split('/')) {
+    let seg = raw.replace(/~1/g, '/').replace(/~0/g, '~');
+    if (cur === null || typeof cur !== 'object') return null;
+    if (!Object.prototype.hasOwnProperty.call(cur, seg)) {
+      try { seg = decodeURIComponent(seg); } catch (_) { return null; }
+      if (!Object.prototype.hasOwnProperty.call(cur, seg)) return null;
+    }
+    cur = cur[seg];
+  }
+  return cur;
+}
+
+// Inline local, acyclic $refs before the clone proof runs, so a generated
+// schema ($defs + $ref, the shape every schema generator emits) can still get
+// a parse(). Only a node that is exactly a $ref plus annotations is replaced;
+// a $ref with a constraining sibling, a cycle, an unresolvable target or an
+// external reference is left in place, and emitClone declines it as before.
+// The walk never mutates its input and never descends into data positions
+// (default, const, enum, examples), where an object holding a "$ref" key is
+// a value, not a schema.
+const _INLINE_ANNOTATIONS = new Set(['$ref', 'title', 'description', '$comment', 'examples', 'deprecated', 'readOnly', 'writeOnly', 'default']);
+const _INLINE_DATA_KEYS = new Set(['default', 'const', 'enum', 'examples']);
+function inlineRefsForClone(root) {
+  const state = { budget: 512 };
+  // `inRef` marks content brought in from behind a reference. The runtime's
+  // useDefaults fills a default written next to the $ref, and does not fill
+  // defaults written inside the referenced definition, so the inlined copy
+  // keeps the first and drops the second. parse() must stay exactly as
+  // generous as validate(); a parse that fills more is a disagreement, not a
+  // feature.
+  const walk = (node, active, inRef) => {
+    if (!node || typeof node !== 'object') return node;
+    if (Array.isArray(node)) return node.map((n) => walk(n, active, inRef));
+    let cur = node;
+    let entered = false;
+    let siblingDefault;
+    while (cur && typeof cur === 'object' && !Array.isArray(cur) && typeof cur.$ref === 'string') {
+      for (const k of Object.keys(cur)) if (!_INLINE_ANNOTATIONS.has(k)) return node;
+      if (active.has(cur.$ref) || state.budget-- <= 0) return node;
+      const target = resolveLocalPointer(root, cur.$ref);
+      if (!target || typeof target !== 'object' || Array.isArray(target)) return node;
+      if (!entered && !inRef && cur.default !== undefined) siblingDefault = cur.default;
+      active = new Set(active);
+      active.add(cur.$ref);
+      cur = target;
+      entered = true;
+    }
+    const strip = inRef || entered;
+    const out = {};
+    for (const k of Object.keys(cur)) {
+      if (strip && k === 'default') continue;
+      const v = cur[k];
+      if (_INLINE_DATA_KEYS.has(k) || k === '$defs' || k === 'definitions') { out[k] = v; continue; }
+      out[k] = walk(v, active, strip);
+    }
+    if (siblingDefault !== undefined) out.default = siblingDefault;
+    return out;
+  };
+  return walk(root, new Set(), false);
+}
+
 function emitClone(node, access, depth) {
   if (!node || typeof node !== 'object') return null;
   if (depth > 12) return null;
   // Only plain object nodes are cloneable, and only when the schema names
-  // every property it keeps. A union type, a $ref, or any composition means
-  // the set of allowed keys is not this node's to decide.
-  if (node.$ref || node.allOf || node.anyOf || node.oneOf || node.not ||
-      node.if || node.patternProperties || node.unevaluatedProperties ||
+  // every property it keeps. A $ref means the set of allowed keys is not
+  // this node's to decide. In-place applicators (allOf, anyOf, oneOf,
+  // if/then/else) are admitted under the same proof the unevaluated* error
+  // generators use: every property name they contribute must already be
+  // declared in this node's own `properties`, so they constrain values but
+  // never widen the key set. `not` never widens it. `unevaluatedProperties`
+  // is admitted only as `false` under that proof, where it is exactly
+  // `additionalProperties: false`.
+  if (node.$ref || node.patternProperties ||
       node.additionalProperties === true ||
       (node.additionalProperties && typeof node.additionalProperties === 'object')) {
     return null;
   }
+  if (node.unevaluatedProperties !== undefined && node.unevaluatedProperties !== false) return null;
   if (node.type !== 'object' || !node.properties) return null;
   const keys = Object.keys(node.properties);
   if (keys.length === 0) return null;
+  if (node.allOf || node.anyOf || node.oneOf || node.if || node.then || node.else ||
+      node.unevaluatedProperties === false) {
+    if (node.$dynamicRef !== undefined || node.$recursiveRef !== undefined ||
+        node.dependentSchemas !== undefined || node.dependencies !== undefined) return null;
+    const names = new Set();
+    const state = { prefix: 0 };
+    for (const k of ['allOf', 'anyOf', 'oneOf']) {
+      if (node[k] !== undefined) {
+        if (!Array.isArray(node[k])) return null;
+        for (const b of node[k]) if (!unevalContributions(b, 'props', names, state, 0)) return null;
+      }
+    }
+    for (const k of ['if', 'then', 'else']) {
+      if (node[k] !== undefined && !unevalContributions(node[k], 'props', names, state, 0)) return null;
+    }
+    for (const n of names) if (!Object.prototype.hasOwnProperty.call(node.properties, n)) return null;
+  }
   const required = new Set(Array.isArray(node.required) ? node.required : []);
 
   // A property is copyable only when the emitter can name everything that
@@ -196,7 +319,22 @@ function emitClone(node, access, depth) {
   for (const key of keys) {
     const prop = node.properties[key];
     if (!prop || typeof prop !== 'object') return null;
-    if (prop.$ref || prop.allOf || prop.anyOf || prop.oneOf || prop.not || prop.if) return null;
+    if (prop.$ref) return null;
+    // A property that is required and carries a default is the one place the
+    // runtime and a raw-input validation disagree: the runtime fills the
+    // default before checking `required`, so `{}` validates there and would
+    // throw here. Declining keeps parse() exactly as strict as validate().
+    if (required.has(key) && prop.default !== undefined) return null;
+    // A default the property's own schema rejects would make parse() hand
+    // back a document validate() refuses: the runtime fills defaults before
+    // validating, so it catches the bad default, and a raw-input check here
+    // never sees it. Probe the default at emit time and decline when it does
+    // not hold, or when the subschema cannot be compiled to check it.
+    if (prop.default !== undefined) {
+      let probe = null;
+      try { probe = compileToJSCodegen(prop, null, null); } catch (_) { probe = null; }
+      if (!probe || !probe(prop.default)) return null;
+    }
     const read = `${access}[${JSON.stringify(key)}]`;
     let value;
     const types = Array.isArray(prop.type) ? prop.type : [prop.type];
@@ -230,7 +368,7 @@ function emitClone(node, access, depth) {
       return null;
     }
     if (required.has(key)) fixed.push(`${JSON.stringify(key)}: ${value}`);
-    else conditional.push({ key, value });
+    else conditional.push({ key, value, dflt: prop.default });
   }
   if (fixed.length === 0 && conditional.length === 0) return null;
 
@@ -240,7 +378,12 @@ function emitClone(node, access, depth) {
   // gains a key the input did not have.
   const tmp = `_c${depth}`;
   const adds = conditional
-    .map(({ key, value }) => `if (${JSON.stringify(key)} in ${access}) ${tmp}[${JSON.stringify(key)}] = ${value};`)
+    .map(({ key, value, dflt }) => {
+      const set = `if (${JSON.stringify(key)} in ${access}) ${tmp}[${JSON.stringify(key)}] = ${value};`;
+      // The default is emitted as a literal inside the call, so an object or
+      // array default is a fresh value on every parse, never shared state.
+      return dflt === undefined ? set : `${set} else ${tmp}[${JSON.stringify(key)}] = ${JSON.stringify(dflt)};`;
+    })
     .join(' ');
   return `(function(){ const ${tmp} = ${literal}; ${adds} return ${tmp}; })()`;
 }
@@ -294,29 +437,8 @@ function toStandaloneModule(validator, opts) {
 
   // Serialize closure vars referenced in _fn body: regex, sub-validators, sets.
   let closureDecls = '';
-  if (jsFn._closures && jsFn._closures.length > 0) {
-    const lines = [];
-    for (const { name, val } of jsFn._closures) {
-      if (Array.isArray(val)) {
-        lines.push(`const ${name} = ${JSON.stringify(val)};`);
-        continue;
-      }
-      if (val && val.__ataSafe) {
-        lines.push(`const ${name} = __ataSafeRe(${JSON.stringify(val.source)});`);
-      } else if (val instanceof RegExp) {
-        const flags = val.flags;
-        lines.push(`const ${name} = new RegExp(${JSON.stringify(val.source)}${flags ? ', ' + JSON.stringify(flags) : ''});`);
-      } else if (val instanceof Set) {
-        lines.push(`const ${name} = new Set(${JSON.stringify([...val])});`);
-      } else if (typeof val === 'function') {
-        // new Function('_ppv', body) — extract body from toString()
-        const str = val.toString();
-        // Matches: "function anonymous(_ppv\n) {\nbody\n}" or "function(_ppv){body}"
-        const m = str.match(/^function[^(]*\([^)]*\)\s*\{([\s\S]*)\}$/)
-        const body = m ? m[1].trim() : str;
-        lines.push(`const ${name} = function(_ppv) { ${body} };`);
-      }
-    }
+  {
+    const lines = closureDeclLines(jsFn);
     if (lines.length) closureDecls = lines.join('\n') + '\n';
   }
 
@@ -368,11 +490,21 @@ function toStandaloneModule(validator, opts) {
   // schema declares. Off by default: it costs bytes in every emitted module,
   // and the reason to compile a schema ahead of time is usually to ship as
   // little as possible. Ask for it with { parse: true }.
-  const cloneExpr = !(opts && opts.parse) ? null : emitClone(
-    typeof validator._schemaObj === 'object' ? validator._schemaObj : null,
-    'data',
-    0,
-  );
+  // Local acyclic $refs are inlined first, so the schemas generators emit
+  // ($defs + $ref everywhere) still get a parse(). When the clone is still
+  // not provable, the decline is loud: the caller asked for parse and is not
+  // getting it, and discovering that by reading the export list cost a user
+  // an afternoon. Same channel as the error-detail decline above.
+  let cloneExpr = null;
+  if (opts && opts.parse) {
+    const baseSchema = typeof validator._schemaObj === 'object' ? validator._schemaObj : null;
+    cloneExpr = baseSchema ? emitClone(inlineRefsForClone(baseSchema), 'data', 0) : null;
+    if (!cloneExpr && typeof opts.onWarning === 'function') {
+      opts.onWarning(
+        'parse() could not be generated for this schema: the rebuild is only emitted where the allowed key set is provable, and a remaining $ref (cyclic, external, or carrying constraining siblings), patternProperties, or an additionalProperties schema makes it someone else\'s decision. The module ships without a parse export; validate and strip with the runtime Validator instead.'
+      );
+    }
+  }
   // Named _ataParse rather than parse: the emitted module also carries the
   // safe-regex prelude, which has a module-scope parse() of its own for
   // reading patterns. A second declaration of that name shadowed it and the
@@ -381,17 +513,60 @@ function toStandaloneModule(validator, opts) {
     ? `function _ataParse(data) {\n  if (!_fn(data)) { const e = new Error('validation failed'); e.name = 'AtaValidationError'; throw e; }\n  return ${cloneExpr};\n}\n`
     : '';
 
+  // validateJSON(): parse the text, validate, and on failure attach a
+  // dataFrame (byte offset, line, col, source line) to every error by
+  // walking the original text once. Off by default for the same reason as
+  // parse(): it costs bytes in every emitted module. Ask for it with
+  // { positions: true }. The walker is the runtime's buildDataPositionMap,
+  // embedded verbatim via toString so the two cannot drift; that is why the
+  // function in lib/data-positions.js must stay self-contained.
+  const positionsCore = !(opts && opts.positions) ? '' : `const _ataPosMap = ${buildDataPositionMap.toString()};
+function _ataFrame(p) { return { byteOffset: p.byteOffset, length: p.length, line: p.line, col: p.col, text: p.text }; }
+function validateJSON(text) {
+  const s = String(text);
+  let data;
+  try { data = JSON.parse(s); } catch (e) {
+    const nl = s.indexOf(String.fromCharCode(10));
+    let frame = { byteOffset: 0, length: s.length, line: 1, col: 1, text: nl === -1 ? s : s.slice(0, nl) };
+    try { const m = _ataPosMap(s); if (m['']) frame = _ataFrame(m['']); } catch (_) {}
+    return { valid: false, errors: [{ code: 'ATA9001', message: 'invalid JSON document', keyword: '__parse__', path: '', instancePath: '', dataFrame: frame }] };
+  }
+  const r = validate(data);
+  if (r.valid || !r.errors || !r.errors.length) return r;
+  let map;
+  try { map = _ataPosMap(s); } catch (_) { return r; }
+  const errors = r.errors.map((e) => {
+    const ptr = e.instancePath != null ? e.instancePath : (e.path || '');
+    const p = map[ptr];
+    return p ? Object.assign({}, e, { dataFrame: _ataFrame(p) }) : e;
+  });
+  return { valid: false, errors };
+}
+`;
+
   const baseNames = cloneExpr ? 'validate, isValid' : 'validate, isValid';
-  const names = fmt.exportsSetFormats ? baseNames + ', setFormats' : baseNames;
+  // The content hash of the schema this module was compiled from, over the
+  // schema as the caller wrote it (before dialect normalization), so a build
+  // can compare it against schemaHash(currentSchema) and know the module is
+  // stale without embedding its own fingerprint.
+  const hashSrc = schemaHash(validator._rawSchema !== undefined ? validator._rawSchema : validator._schemaObj);
+  const hashDecl = `const schemaHash = ${JSON.stringify(hashSrc)};\n`;
+
+  let names = fmt.exportsSetFormats ? baseNames + ', setFormats' : baseNames;
+  names += ', schemaHash';
+  if (positionsCore) names += ', validateJSON';
   const parseAlias = cloneExpr ? ', _ataParse as parse' : '';
   const parseProp = cloneExpr ? ', parse: _ataParse' : '';
   const exports = format === 'esm'
     ? `export { ${names}${parseAlias} };\nexport default { ${names}${parseProp} };\n`
     : `module.exports = { ${names}${parseProp} };\nmodule.exports.default = module.exports;\n`;
 
-  const degradedNote = (!abortEarly && !errCore)
+  let degradedNote = (!abortEarly && !errCore)
     ? '// NOTE: error detail was requested but could not be generated for this\n// schema; failures report the single ATA9000 abort-early error. The verdict\n// is exact. Validate failing documents with the runtime Validator for detail.\n'
     : '';
+  if (opts && opts.parse && !cloneExpr) {
+    degradedNote += '// NOTE: parse() was requested but could not be generated for this schema;\n// the module has no parse export. Validate and strip with the runtime Validator.\n';
+  }
   return `// Auto-generated by ata-validator — do not edit.
 // Schema is embedded; runtime has zero dependency on ata-validator.
 ${degradedNote}'use strict';
@@ -411,7 +586,7 @@ ${closureDecls}${sharedBlock}${preambleDecls}${formatDecls}const _fn = function(
 };
 ${errCore}function isValid(data) { return _fn(data); }
 function validate(data) { ${validBody}; }
-${parseCore}${exports}`;
+${parseCore}${positionsCore}${hashDecl}${exports}`;
 }
 
 // Bundle multiple validators into a single JS file for fast startup.
@@ -517,6 +692,8 @@ function bundleStandalone(Validator, schemas, opts) {
       ? (jsFn._preambleGuard || '') + (kept.length ? kept.join('\n  ') + '\n  ' : '')
       : (jsFn._preambleSource || '');
     if (preambleSrc) preamble = preamble ? `${preamble}\n${preambleSrc}` : preambleSrc;
+    const closureSrc = closureDeclLines(jsFn, 'var').join('\n');
+    if (closureSrc) preamble = preamble ? `${preamble}\n${closureSrc}\n` : closureSrc + '\n';
     if (opts && opts.verbose) {
       // Embed the schema and a small resolver so errors carry parentSchema.
       const schemaLit = JSON.stringify(v._schemaObj);
@@ -573,6 +750,7 @@ function bundleCompact(Validator, schemas, opts) {
       guard: jsFn._preambleGuard || '',
       parts: jsFn._preambleParts || null,
       preamble: jsFn._preambleSource || '',
+      closures: closureDeclLines(jsFn, 'var').join('\n'),
       hybridBody: jsFn._hybridSource,
       err: jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : null,
       fmt: jsFn._formatClosures || null,
@@ -602,7 +780,11 @@ function bundleCompact(Validator, schemas, opts) {
     const preamble = kept !== null
       ? e.guard + (kept.length ? kept.join('\n  ') + '\n  ' : '')
       : e.preamble;
-    e.hybrid = preamble ? `${preamble}\n${e.hybridBody}` : e.hybridBody;
+    // Factory-scope code: guard state, hoisted branch helpers, and the
+    // closure declarations (regexes above all), matching where the
+    // in-process compiler places them. Keeping them per call recompiled
+    // every pattern on every validation.
+    e.factory = (preamble ? preamble + '\n' : '') + (e.closures ? e.closures + '\n' : '');
     if (e.err) for (const h of sharedDecls) e.err = e.err.split(h).join('');
   }
 
@@ -614,11 +796,15 @@ function bundleCompact(Validator, schemas, opts) {
 
   const indices = entries.map((e) => {
     if (!e) return [-1, -1];
-    let hi = bodyMap.get(e.hybrid);
+    // The dedupe key must include the factory code: two schemas can emit an
+    // identical body that references _re1 with different patterns, and the
+    // pattern now lives only in the factory-scope declaration.
+    const key = e.factory + '\u0000' + e.hybridBody;
+    let hi = bodyMap.get(key);
     if (hi === undefined) {
       hi = bodies.length;
-      bodies.push(e.hybrid);
-      bodyMap.set(e.hybrid, hi);
+      bodies.push({ factory: e.factory, body: e.hybridBody });
+      bodyMap.set(key, hi);
     }
     let ei = -1;
     if (e.err) {
@@ -661,7 +847,7 @@ function bundleCompact(Validator, schemas, opts) {
   // Shared hybrid factories
   out += `${declKW} H=[\n`;
   out += bodies
-    .map((b) => `function(R,E){return function(d){${b}}}`)
+    .map((b) => `function(R,E){${b.factory}return function(d){${b.body}}}`)
     .join(',\n');
   out += '\n];\n';
 

package/lib/data-positions.js

@@ -6,10 +6,13 @@
  * AND abortEarly is off. Zero cost on the valid path.
  */
 
-const { escapePtr } = require('./source-positions');
-
+// Self-contained on purpose: `toStandaloneModule({ positions: true })` embeds
+// this function verbatim via Function.prototype.toString, so it may not close
+// over anything in this module and may not assume Node globals. The inlined
+// escapePtr below duplicates lib/source-positions.js for that reason.
 function buildDataPositionMap (input) {
-  const text = Buffer.isBuffer(input) ? input.toString('utf8') : String(input);
+  const escapePtr = (s) => s.replace(/~/g, '~0').replace(/\//g, '~1');
+  const text = (typeof Buffer !== 'undefined' && Buffer.isBuffer(input)) ? input.toString('utf8') : String(input);
   const map = Object.create(null);
   const lines = text.split('\n');
   const lineStart = new Array(lines.length + 1);

package/lib/js-compiler.js

@@ -1610,8 +1610,14 @@ function compileToJSCodegen(schema, schemaMap, userFormats) {
       boolFn._hybridFactory = (R, E) => hybridFactory(...closureValues, R, E)
     } catch {}
 
-    // Store source for standalone compilation (includes regex inline for file output)
-    const helperStr = ctx.helperCode.length ? ctx.helperCode.join('\n  ') + '\n  ' : ''
+    // Store source for standalone compilation. Regex declarations are NOT
+    // inlined into the body: they are carried by _closures and the emitters
+    // declare them once at load scope. Inlining them here put a
+    // `const _reN=__ataSafeRe(...)` inside the emitted function, which
+    // shadowed the module-scope binding and recompiled the pattern on every
+    // call, 25x on a schema with one pattern.
+    const emitHelpers = ctx.helperCode.filter((c) => !/^const _re\d+=(?:__ataSafeRe|new RegExp)\(/.test(c))
+    const helperStr = emitHelpers.length ? emitHelpers.join('\n  ') + '\n  ' : ''
     boolFn._source = helperStr + body
     boolFn._preambleSource = preambleStr
     boolFn._preambleGuard = guardStr
@@ -2240,15 +2246,13 @@ function genCode(schema, v, lines, ctx, knownType) {
       }
     }
 
-    // Build sub-schema validators as closure vars
+    // Build sub-schema checks inline so they share the parent helper scope.
+    const subChecks = []
     for (let i = 0; i < ppEntries.length; i++) {
       const [, sub] = ppEntries[i]
       const subLines = []
       genCode(sub, `_ppv`, subLines, ctx)
-      const fnBody = subLines.length === 0 ? `return true` : `${subLines.join(';')};return true`
-      const fnVar = `_ppf${pi}_${i}`
-      ctx.closureVars.push(fnVar)
-      ctx.closureVals.push(new Function('_ppv', fnBody))
+      subChecks.push(subLines.join(';'))
     }
 
     const guard = isObj ? '' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v}))`
@@ -2262,13 +2266,11 @@ function genCode(schema, v, lines, ctx, knownType) {
       ctx._ppHandledAdditional = true
       ctx._ppHandledPropertyNames = !!pn
       const propKeys = Object.keys(schema.properties || {})
-      let apFn = null
+      let apCheck = null
       if (apSchema) {
         const apLines = []
         genCode(apSchema, '_apv', apLines, ctx)
-        apFn = `_apf${pi}`
-        ctx.closureVars.push(apFn)
-        ctx.closureVals.push(new Function('_apv', apLines.length === 0 ? 'return true' : `${apLines.join(';')};return true`))
+        apCheck = apLines.join(';')
       }
       lines.push(`${guard}{for(const ${kVar} in ${v}){`)
       // propertyNames checks (merged into same loop)
@@ -2302,14 +2304,14 @@ function genCode(schema, v, lines, ctx, knownType) {
       if (ppEntries.length > 0) {
         lines.push(`let _pm${pi}=false`)
         for (let i = 0; i < ppEntries.length; i++) {
-          lines.push(`if(${matchers[i].check}){_pm${pi}=true;if(!_ppf${pi}_${i}(${v}[${kVar}]))return false}`)
+          lines.push(`if(${matchers[i].check}){_pm${pi}=true;const _ppv=${v}[${kVar}];${subChecks[i]}}`)
         }
       }
       // A key that is neither declared nor matched is additional. switch on
       // the declared names (V8 compiles string cases to a jump table); no
       // switch at all when nothing is declared, since a switch with no case
       // clause is a syntax error.
-      const additional = apFn ? `if(!${apFn}(${v}[${kVar}]))return false` : `return false`
+      const additional = apCheck !== null ? `const _apv=${v}[${kVar}];${apCheck}` : `return false`
       const notMatched = ppEntries.length > 0 ? `if(!_pm${pi}){${additional}}` : additional
       if (propKeys.length) {
         const switchCases = propKeys.map(k => `case ${JSON.stringify(k)}:`).join('')
@@ -2346,7 +2348,7 @@ function genCode(schema, v, lines, ctx, knownType) {
         }
       }
       for (let i = 0; i < ppEntries.length; i++) {
-        lines.push(`if(${matchers[i].check}&&!_ppf${pi}_${i}(${v}[${kVar}]))return false`)
+        lines.push(`if(${matchers[i].check}){const _ppv=${v}[${kVar}];${subChecks[i]}}`)
       }
       lines.push(`}}`)
     }
@@ -3219,6 +3221,110 @@ function childPathDynExpr(parentExpr, indexExpr) {
   return `${parentExpr}+'/'+${indexExpr}`
 }
 
+// unevaluated* differs from additionalProperties/items only through
+// annotations contributed by in-place applicators at the same schema object.
+// When every applicator subschema is provably free of the annotating keywords
+// for that kind, the keyword is exactly its plain counterpart, and the error
+// generators can emit real detail for it instead of declining. `required`
+// inside a then-branch annotates nothing, which is precisely the shape a
+// config schema has; a then-branch carrying `properties` does, and stays
+// declined. `not` never keeps its annotations, so it is skipped. A reference
+// or dependency keyword makes the node ineligible outright: resolving what
+// they might contribute is not this function's job.
+// Collects what an in-place applicator subschema can contribute: property
+// names into `names`, and the deepest tuple prefix it may evaluate into
+// `state.prefix`. Returns false when the contribution cannot be bounded
+// (patternProperties, additionalProperties, a reference, item schemas, and so
+// on), which makes the node ineligible outright.
+function unevalContributions (sub, kind, names, state, depth) {
+  if (depth > 24) return false
+  if (sub === true || sub === false) return true
+  if (typeof sub !== 'object' || sub === null) return false
+  if (kind === 'props') {
+    if (sub.patternProperties !== undefined || sub.additionalProperties !== undefined || sub.unevaluatedProperties !== undefined) return false
+    if (sub.properties !== undefined) {
+      if (typeof sub.properties !== 'object' || sub.properties === null) return false
+      for (const k of Object.keys(sub.properties)) names.add(k)
+    }
+  } else {
+    if (sub.items !== undefined || sub.additionalItems !== undefined || sub.contains !== undefined || sub.unevaluatedItems !== undefined) return false
+    if (sub.prefixItems !== undefined) {
+      if (!Array.isArray(sub.prefixItems)) return false
+      if (sub.prefixItems.length > state.prefix) state.prefix = sub.prefixItems.length
+    }
+  }
+  if (sub.$ref !== undefined || sub.$dynamicRef !== undefined || sub.$recursiveRef !== undefined) return false
+  if (sub.dependentSchemas !== undefined || sub.dependencies !== undefined) return false
+  for (const k of ['allOf', 'anyOf', 'oneOf']) {
+    if (sub[k] !== undefined) {
+      if (!Array.isArray(sub[k])) return false
+      for (const b of sub[k]) if (!unevalContributions(b, kind, names, state, depth + 1)) return false
+    }
+  }
+  for (const k of ['if', 'then', 'else']) {
+    if (sub[k] !== undefined && !unevalContributions(sub[k], kind, names, state, depth + 1)) return false
+  }
+  return true
+}
+
+// A contribution that names only what the node's own adjacent keywords
+// already evaluate unconditionally changes nothing: a key in the node's own
+// `properties` is evaluated whether or not the branch that also names it
+// passes, and a branch prefix no longer than the node's own is covered
+// position for position. Anything beyond those bounds is conditional
+// evaluation the plain counterpart cannot express, and the node stays with
+// the interpreted engine.
+function unevalLocalOk (node, key) {
+  if (node[key] !== false) return false
+  if (node.$ref !== undefined || node.$dynamicRef !== undefined || node.$recursiveRef !== undefined) return false
+  if (node.dependentSchemas !== undefined || node.dependencies !== undefined) return false
+  const kind = key === 'unevaluatedProperties' ? 'props' : 'items'
+  if (kind === 'props' && node.patternProperties !== undefined) return false
+  if (kind === 'items' && node.contains !== undefined) return false
+  const names = new Set()
+  const state = { prefix: 0 }
+  for (const k of ['allOf', 'anyOf', 'oneOf']) {
+    if (node[k] !== undefined) {
+      if (!Array.isArray(node[k])) return false
+      for (const b of node[k]) if (!unevalContributions(b, kind, names, state, 0)) return false
+    }
+  }
+  for (const k of ['if', 'then', 'else']) {
+    if (node[k] !== undefined && !unevalContributions(node[k], kind, names, state, 0)) return false
+  }
+  if (kind === 'props') {
+    const own = node.properties && typeof node.properties === 'object' ? node.properties : {}
+    for (const n of names) if (!Object.prototype.hasOwnProperty.call(own, n)) return false
+  } else {
+    const ownPrefix = Array.isArray(node.prefixItems) ? node.prefixItems.length
+      : (Array.isArray(node.items) ? node.items.length : 0)
+    if (node.items !== undefined && !Array.isArray(node.items)) { /* all evaluated; any prefix is covered */ }
+    else if (state.prefix > ownPrefix) return false
+  }
+  return true
+}
+
+// Every occurrence in the document must qualify or the generator declines the
+// whole schema, exactly as the string scan it replaces did. The walk is
+// generic and may visit data positions (an enum value, say); judging those is
+// harmless, since a data node that fails the test only makes the answer more
+// conservative and the generators never read data positions as schemas.
+function unevalAllProvablyLocal (root) {
+  const seen = new Set()
+  const stack = [root]
+  while (stack.length) {
+    const n = stack.pop()
+    if (n === null || typeof n !== 'object' || seen.has(n)) continue
+    seen.add(n)
+    if (!Array.isArray(n)) {
+      if (n.unevaluatedProperties !== undefined && !unevalLocalOk(n, 'unevaluatedProperties')) return false
+      if (n.unevaluatedItems !== undefined && !unevalLocalOk(n, 'unevaluatedItems')) return false
+    }
+    for (const k of Array.isArray(n) ? n : Object.values(n)) stack.push(k)
+  }
+  return true
+}
+
 // Detect simple prefix patterns like "^x-", "^_", "^prefix" and generate fast charCodeAt checks
 // Returns a JS expression string or null if pattern is too complex
 function fastPrefixCheck(pattern, keyVar) {
@@ -3267,10 +3373,12 @@ function genCharCodeSwitch(keys, v) {
 // Returns a function: (data, allErrors) => { valid, errors }
 // Valid path is still fast — only error path does extra work.
 function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts) {
-  // Bail on unevaluated keywords — error codegen doesn't support them yet
+  // unevaluated* is generated only where it is provably its plain counterpart
+  // (see unevalLocalOk); any occurrence that is not keeps the whole schema on
+  // the interpreted engine's error path, exactly as before.
   if (typeof schema === 'object' && schema !== null) {
     const s = JSON.stringify(schema)
-    if (s.includes('unevaluatedProperties') || s.includes('unevaluatedItems')) return null
+    if ((s.includes('unevaluatedProperties') || s.includes('unevaluatedItems')) && !unevalAllProvablyLocal(schema)) return null
   }
   if (typeof schema === 'boolean') {
     return schema
@@ -3409,7 +3517,11 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
       })
     }
     return fn
-  } catch {
+  } catch (e) {
+    // Declining here is safe (the interpreter takes over) but silent, which
+    // is how every past regression in this file hid. The env hook makes the
+    // decline visible without changing behavior.
+    if (process.env.ATA_DEBUG_ERRGEN) console.error('error codegen declined:', e.message)
     return null
   }
 }
@@ -3774,6 +3886,52 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     lines.push(isObj ? `{${inner}}` : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
   }
 
+  // unevaluatedProperties: false, on a node where it is provably its plain
+  // counterpart (the bail above guaranteed that for every occurrence). With
+  // additionalProperties present everything is evaluated and there is nothing
+  // to emit. The error keeps the keyword's own identity: the interpreted
+  // engine reports these as unevaluatedProperties with the key named, and the
+  // two engines are pinned to identical output.
+  if (schema.unevaluatedProperties === false && schema.additionalProperties === undefined) {
+    const allowedU = Object.keys(schema.properties || {}).map(k => `${JSON.stringify(k)}`).join(',')
+    const ui = ctx.varCounter++
+    const upSp = `${schemaPrefix}/unevaluatedProperties`
+    const upLit = buildErrorLiteral({ keyword: 'unevaluatedProperties', schemaPath: upSp, sourceMap: ctx.sourceMap })
+    const patChecksU = []
+    for (const pat of Object.keys(schema.patternProperties || {})) {
+      const pattern = JSON.stringify(pat)
+      if (!ctx.regExpMap.has(pattern)) {
+        const ri = ctx.varCounter++
+        ctx.regExpMap.set(pattern, ri)
+        if (patternIsSafe(pat)) {
+          ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`)
+          ctx.usesSafeRe = true
+        } else {
+          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`)
+        }
+      }
+      patChecksU.push(`_re${ctx.regExpMap.get(pattern)}.test(_k${ui}[_i])`)
+    }
+    const isUneval = patChecksU.length ? `!_a${ui}.has(_k${ui}[_i])&&!(${patChecksU.join('||')})` : `!_a${ui}.has(_k${ui}[_i])`
+    const innerU = `const _k${ui}=Object.keys(${v});const _a${ui}=new Set([${allowedU}]);for(let _i=0;_i<_k${ui}.length;_i++){if(${isUneval}){_e.push({code:'${upLit.codeStr}',keyword:'unevaluatedProperties',instancePath:${pathExpr||'""'},schemaPath:'${upSp}'${ordinalField(ctx, `${upSp}`)},params:{unevaluatedProperty:_k${ui}[_i]},message:'must NOT have unevaluated properties',docUrl:'${upLit.docUrl}'${upLit.frame}});if(!_all)return{valid:false,errors:_e}}}`
+    lines.push(isObj ? `{${innerU}}` : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${innerU}}`)
+  }
+
+  // unevaluatedItems: false under the same rule. The interpreted engine
+  // reports one error for the array with the first unevaluated position as
+  // the limit; with adjacent `items` everything is evaluated. The draft-07
+  // array form of items acts as the prefix.
+  if (schema.unevaluatedItems === false) {
+    const itemsIsPrefix = Array.isArray(schema.items)
+    const allEval = schema.items !== undefined && !itemsIsPrefix
+    if (!allEval) {
+      const plen = itemsIsPrefix ? schema.items.length : (Array.isArray(schema.prefixItems) ? schema.prefixItems.length : 0)
+      const uiSp = `${schemaPrefix}/unevaluatedItems`
+      const uiLit = buildErrorLiteral({ keyword: 'unevaluatedItems', schemaPath: uiSp, sourceMap: ctx.sourceMap })
+      lines.push(`if(Array.isArray(${v})&&${v}.length>${plen}){_e.push({code:'${uiLit.codeStr}',keyword:'unevaluatedItems',instancePath:${pathExpr||'""'},schemaPath:'${uiSp}'${ordinalField(ctx, `${uiSp}`)},params:{limit:${plen}},message:'must NOT have more than ${plen} items',docUrl:'${uiLit.docUrl}'${uiLit.frame}});if(!_all)return{valid:false,errors:_e}}`)
+    }
+  }
+
   // dependentRequired
   if (schema.dependentRequired) {
     const drSp = `${schemaPrefix}/dependentRequired`
@@ -4004,10 +4162,10 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
 // Avoids double-pass (jsFn → false → errFn runs same checks again).
 // Uses type-aware optimizations: after type check passes, skip guards.
 function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats) {
-  // Bail on unevaluated keywords — combined codegen doesn't support them yet
+  // Same provably-local rule as the error generator above.
   if (typeof schema === 'object' && schema !== null) {
     const s = JSON.stringify(schema)
-    if (s.includes('unevaluatedProperties') || s.includes('unevaluatedItems')) return null
+    if ((s.includes('unevaluatedProperties') || s.includes('unevaluatedItems')) && !unevalAllProvablyLocal(schema)) return null
     // Bail on self-referencing schemas — combined codegen doesn't support recursion
     if (s.includes('"$ref":"#"')) return null
     // Defs on a $ref cycle compile as named functions in the boolean and
@@ -4403,6 +4561,39 @@ function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     }
   }
 
+  // unevaluatedProperties: false where it is provably additionalProperties
+  // (the entry bail guaranteed that), keeping the keyword's own identity so
+  // the two engines report the same error.
+  if (schema.unevaluatedProperties === false && schema.additionalProperties === undefined && !schema.patternProperties) {
+    const propKeysU = Object.keys(schema.properties || {})
+    const ui = ctx.varCounter++
+    const failU = fail('unevaluatedProperties', 'unevaluatedProperties', `{unevaluatedProperty:_k${ui}[_i]}`, "'must NOT have unevaluated properties'")
+    let innerU
+    if (propKeysU.length === 0) {
+      innerU = `const _k${ui}=Object.keys(${v});for(let _i=0;_i<_k${ui}.length;_i++){${failU}}`
+    } else if (propKeysU.length <= 8) {
+      const checksU = propKeysU.map(k => `_k${ui}[_i]!==${JSON.stringify(k)}`).join('&&')
+      innerU = `const _k${ui}=Object.keys(${v});for(let _i=0;_i<_k${ui}.length;_i++)if(${checksU}){${failU}}`
+    } else {
+      const allowedU = propKeysU.map(k => JSON.stringify(k)).join(',')
+      innerU = `const _k${ui}=Object.keys(${v});const _a${ui}=new Set([${allowedU}]);for(let _i=0;_i<_k${ui}.length;_i++)if(!_a${ui}.has(_k${ui}[_i])){${failU}}`
+    }
+    lines.push(isObj ? `{${innerU}}` : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${innerU}}`)
+  }
+
+  // unevaluatedItems: false under the same rule: one error for the array,
+  // the first uncovered position as the limit. Adjacent schema-form `items`
+  // evaluates everything; the draft-07 array form acts as the prefix.
+  if (schema.unevaluatedItems === false) {
+    const itemsIsPrefixC = Array.isArray(schema.items)
+    const allEvalC = schema.items !== undefined && !itemsIsPrefixC
+    if (!allEvalC) {
+      const plenC = itemsIsPrefixC ? schema.items.length : (Array.isArray(schema.prefixItems) ? schema.prefixItems.length : 0)
+      const failI = fail('unevaluatedItems', 'unevaluatedItems', `{limit:${plenC}}`, `'must NOT have more than ${plenC} items'`)
+      lines.push(`if(Array.isArray(${v})&&${v}.length>${plenC}){${failI}}`)
+    }
+  }
+
   // dependentRequired
   if (schema.dependentRequired) {
     for (const [key, deps] of Object.entries(schema.dependentRequired)) {
@@ -4807,4 +4998,4 @@ function _collectEval(schema, result, defs, schemaMap, refStack, isRoot) {
   // not → contributes nothing (spec: annotations from not are discarded)
 }
 
-module.exports = { compileToJS, compileToJSCodegen, compileToJSCodegenWithErrors, compileToJSCombined, collectEvaluated, AJV_MESSAGES }
+module.exports = { compileToJS, compileToJSCodegen, compileToJSCodegenWithErrors, compileToJSCombined, collectEvaluated, unevalContributions, AJV_MESSAGES }

package/lib/schema-hash.js

@@ -0,0 +1,39 @@
+'use strict';
+
+// A stable content hash for a schema, so a compiled artifact can say which
+// schema it came from and a build can detect staleness by comparing hashes
+// instead of embedding its own. The hash is over a canonical JSON form
+// (object keys sorted at every level), so the same schema hashes the same
+// however its keys were ordered, and it is FNV-1a with two independent
+// bases, 16 hex characters. This is an integrity aid, not a security
+// boundary: it detects drift, it does not authenticate anything.
+
+function canonical (value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return '[' + value.map(canonical).join(',') + ']';
+  const keys = Object.keys(value).sort();
+  const parts = [];
+  for (const k of keys) {
+    if (value[k] === undefined) continue;
+    parts.push(JSON.stringify(k) + ':' + canonical(value[k]));
+  }
+  return '{' + parts.join(',') + '}';
+}
+
+function fnv1a (str, seed) {
+  let h = seed >>> 0;
+  for (let i = 0; i < str.length; i++) {
+    h ^= str.charCodeAt(i);
+    h = Math.imul(h, 0x01000193) >>> 0;
+  }
+  return h >>> 0;
+}
+
+function schemaHash (schema) {
+  const text = canonical(schema);
+  const a = fnv1a(text, 0x811c9dc5);
+  const b = fnv1a(text, 0xcbf29ce4);
+  return a.toString(16).padStart(8, '0') + b.toString(16).padStart(8, '0');
+}
+
+module.exports = { schemaHash };

package/lib/ts-gen.js

@@ -238,7 +238,8 @@ export type Result = ValidResult | InvalidResult;
 
 export declare function isValid(data: unknown): data is ${rootName};
 export declare function validate(data: unknown): Result;
-declare const _default: { validate: typeof validate; isValid: typeof isValid };
+export declare const schemaHash: string;
+declare const _default: { validate: typeof validate; isValid: typeof isValid; schemaHash: typeof schemaHash };
 export default _default;
 `;
 }

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.24.0';
+module.exports = '1.26.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.24.0",
+  "version": "1.26.0",
   "description": "JSON Schema validation that compiles for speed and still runs where code generation is blocked. Compiled and interpreted engines answer identically at 100% of the official suite. TypeScript inference, Standard Schema V1, and a build step that emits dependency-free modules.",
   "main": "index.js",
   "module": "index.mjs",
@@ -51,7 +51,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_scanner_differential.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_uri_helper_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_scanner_differential.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_uri_helper_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_file_positions.js && node tests/test_schema_hash.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -122,13 +122,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.24.0",
-    "@ata-validator/native-darwin-x64": "1.24.0",
-    "@ata-validator/native-linux-arm64-gnu": "1.24.0",
-    "@ata-validator/native-linux-arm64-musl": "1.24.0",
-    "@ata-validator/native-linux-x64-gnu": "1.24.0",
-    "@ata-validator/native-linux-x64-musl": "1.24.0",
-    "@ata-validator/native-win32-x64": "1.24.0"
+    "@ata-validator/native-darwin-arm64": "1.26.0",
+    "@ata-validator/native-darwin-x64": "1.26.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.26.0",
+    "@ata-validator/native-linux-arm64-musl": "1.26.0",
+    "@ata-validator/native-linux-x64-gnu": "1.26.0",
+    "@ata-validator/native-linux-x64-musl": "1.26.0",
+    "@ata-validator/native-win32-x64": "1.26.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"