ata-validator 1.27.0 → 1.28.0

package/CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.28.0 - 2026-09-23
+
+### Added
+
+- `engine: 'interpreter'`, a per-validator setting that keeps a schema off code generation: no `new Function`, no shared compile cache; the eval-free interpreted engine answers `validate()`, `isValidObject()` and `validateJSON()`. The default is the right trade for a schema the application wrote. A schema that arrives at runtime from a plugin or a tenant is input, and until now the only way to validate against one without executing source derived from it was the process-wide `ATA_FORCE_NAPI` switch. `engine()` reports `'interpreter'` for such a validator; any value other than `'auto'` or `'interpreter'` throws, so a misspelling cannot fall through to the generator. `tests/test_engine_option.js` holds the verdicts equal across engines and proves, with `Function` guarded, that the interpreter validator never builds a function from source while the default one does. Contributed by @d4tocchini in #43.
+
+### Changed
+
+- The position map behind `dataFrame` is built without per-node work, which makes an invalid document cheaper to report on. It used to record an entry for every node in the document: a JSON pointer rebuilt from a path array with `concat`, `map` and `join`, a binary search and an object allocation for the value and another pair for its key, and a `JSON.parse` of every string value whose result was then discarded. String values are now spanned and not decoded, a key decodes only when its token holds an escape or a raw control character, the pointer is carried down the walk instead of being rebuilt, and line and column are resolved at the end for the nodes that were recorded. On a 132 KB config with three errors the map went from 2800 to about 1040 microseconds, which is 19.8x down to 7.3x the cost of `JSON.parse` on the same text, and the whole `validateJSON` call went from 3673 to 1825 microseconds. Output is unchanged: 112661 fuzzed documents, random and truncated and CRLF and BOM-prefixed and byte-punched, map identically against the previous walker, field order and throws included, so a document that declined to map still declines. Standalone modules built with `{ positions: true }` embed this walk, so they carry the same improvement once rebuilt. `tests/test_position_map_cost.js` gates it as a ratio to `JSON.parse` rather than as a time, because the cost is what regressed.
+
+## 1.27.1 - 2026-09-17
+
+### Fixed
+
+- A default fills a property the instance does not carry, and both engines asked `key in data` to find out, which also answers for what the instance inherits: a property named `constructor` never received its default, and one named `__proto__` sent its nested defaults to `Object.prototype`, since the interpreter's applier walked `data.__proto__` as the parent. Both now ask `Object.hasOwn`. `tests/test_defaults_own_keys.js` holds it for either engine. Reported and fixed by @d4tocchini in #43.
+- Completing that report, every remaining prototype-unsafe write and walk in the defaults machinery is closed. The nested-defaults applier now refuses to walk a parent the instance does not carry as an own key, which was the reachable pollution: a schema declaring a property named `__proto__` with nested defaults, no matter what the input held, resolved `data.__proto__` to `Object.prototype` and wrote the child defaults onto it, for every object in the realm, on both engines. Fills of a property named `__proto__` go through `Object.defineProperty`, because plain assignment of that name rewrites the object's prototype instead of creating a property; type coercion skips that name for the same reason, and the raw value still goes through validation. The AOT `parse()` emitter gets the same treatment defensively (computed keys in literals, `Object.hasOwn` presence checks, `defineProperty` for the one dangerous name), and its record loop, whose keys come from the input, now keeps a JSON-parsed own `__proto__` key as an own key in the output instead of silently rewriting the output's prototype.
+
 ## 1.27.0 - 2026-09-17
 
 ### Added

package/README.md

@@ -445,11 +445,14 @@ const v = new Validator(schema, {
   removeAdditional: true,  // strip properties not in schema
   schemas: [otherSchema],  // cross-schema $ref registry
   abortEarly: true,        // skip detailed error collection on failure (~4x faster on invalid data)
+  engine: 'interpreter',   // eval-free interpreted engine only: for a schema from outside the trust boundary
 });
 ```
 
 `abortEarly` returns a shared `{ valid: false, errors: [{ message: 'validation failed' }] }` on failure instead of running the detailed error collector. Useful when the caller only needs a pass/fail decision (Fastify route guards, high-throughput gatekeepers, request rejection at the edge).
 
+`engine: 'interpreter'` keeps one validator off code generation: no `new Function`, no shared compile cache, the interpreted engine answers every call. The default turns a schema into JavaScript source, which is the right trade for a schema you wrote; a schema that arrives at runtime from a plugin or a tenant is input, and this option validates against it without ever executing anything derived from it. Same verdict, higher per-call cost; `ATA_FORCE_NAPI=1` does the same for a whole process.
+
 ### Build-time compile (`ata compile`)
 
 The `ata` CLI turns a JSON Schema file into a self-contained JavaScript module. No runtime dependency on `ata-validator`, so only the generated validator ships to the browser. Typical output is about 4.5 KB gzipped for a ten-field schema, full error detail included, against 87 KB for the runtime bundled for the browser.

package/index.d.ts

@@ -425,6 +425,17 @@ export interface ValidatorOptions {
    * v0.14 error shape.
    */
   richErrors?: boolean;
+  /**
+   * Which engine may answer this validator. 'auto' (default) picks the fastest
+   * engine that handles the schema, generated JavaScript for most schemas.
+   * 'interpreter' keeps the schema off code generation entirely: no
+   * `new Function`, no shared compile cache; the eval-free interpreted engine
+   * answers `validate()`, `isValidObject()` and `validateJSON()`. For a schema
+   * that arrives from outside the trust boundary. The verdict is the same on
+   * every engine; the cost is not. The buffer APIs (`isValid`, `countValid`,
+   * `batchIsValid`) are native-only and unaffected.
+   */
+  engine?: 'auto' | 'interpreter';
 }
 
 export interface BundleStandaloneOptions extends ValidatorOptions {
@@ -473,7 +484,7 @@ export interface Validator<T = unknown> {
    * Which engine answers `validate()` for this schema: 'codegen' (generated
    * JS), 'closure' (the closure compiler) or 'interpreter'; 'native' is
    * reserved. The verdict is the same on every engine; the cost is not.
-   * A diagnostic, not a configuration.
+   * A diagnostic; the `engine` option is the setting.
    */
   engine(): 'codegen' | 'closure' | 'native' | 'interpreter';
 

package/index.js

@@ -30,6 +30,23 @@ function buildDefaultsApplier(schema) {
   };
 }
 
+// Write an own property. Plain assignment of a key named `__proto__` does
+// not create a property at all: it hits the Object.prototype setter and
+// rewrites the object's prototype, which is how a schema could reach
+// Object.prototype itself. defineProperty has no such special case.
+function setOwn(obj, key, val) {
+  if (key === "__proto__") {
+    Object.defineProperty(obj, key, {
+      value: val,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    });
+  } else {
+    obj[key] = val;
+  }
+}
+
 function collectDefaults(schema, actions, path) {
   if (typeof schema !== "object" || schema === null) return;
   const props = schema.properties;
@@ -39,11 +56,12 @@ function collectDefaults(schema, actions, path) {
       const defaultVal = prop.default;
       if (!path) {
         actions.push((data) => {
-          if (typeof data === "object" && data !== null && !(key in data)) {
-            data[key] =
+          if (typeof data === "object" && data !== null && !Object.hasOwn(data, key)) {
+            setOwn(data,
+              key,
               typeof defaultVal === "object" && defaultVal !== null
                 ? JSON.parse(JSON.stringify(defaultVal))
-                : defaultVal;
+                : defaultVal);
           }
         });
       } else {
@@ -52,17 +70,23 @@ function collectDefaults(schema, actions, path) {
           let target = data;
           for (let j = 0; j < parentPath.length; j++) {
             if (typeof target !== "object" || target === null) return;
+            // Own keys only. `target[key]` for an inherited name walks the
+            // prototype chain: a parent named `__proto__` that the instance
+            // does not carry resolved to Object.prototype, and the child
+            // defaults were written onto it, for every object in the realm.
+            if (!Object.hasOwn(target, parentPath[j])) return;
             target = target[parentPath[j]];
           }
           if (
             typeof target === "object" &&
             target !== null &&
-            !(key in target)
+            !Object.hasOwn(target, key)
           ) {
-            target[key] =
+            setOwn(target,
+              key,
               typeof defaultVal === "object" && defaultVal !== null
                 ? JSON.parse(JSON.stringify(defaultVal))
-                : defaultVal;
+                : defaultVal);
           }
         });
       }
@@ -263,6 +287,10 @@ function buildPreprocessCodegen(schema, options) {
   if (options.coerceTypes) {
     for (const [key, prop] of Object.entries(props)) {
       if (!prop || typeof prop !== 'object' || !prop.type) continue;
+      // Coercion writes with plain assignment, which for a key named
+      // __proto__ rewrites the prototype instead. The raw value still goes
+      // through validation, so skipping is a refusal to coerce, not a hole.
+      if (key === '__proto__') continue;
       const t = Array.isArray(prop.type) ? null : prop.type;
       if (!t) continue;
       const k = JSON.stringify(key);
@@ -289,7 +317,11 @@ function buildPreprocessCodegen(schema, options) {
       if (prop && typeof prop === 'object' && prop.default !== undefined) {
         const k = JSON.stringify(key);
         const def = JSON.stringify(prop.default);
-        lines.push(`if(!(${k} in d))d[${k}]=${def}`);
+        // Assignment to a key named __proto__ hits the prototype setter
+        // instead of creating a property; defineProperty writes an own key.
+        lines.push(key === '__proto__'
+          ? `if(!Object.hasOwn(d,${k}))Object.defineProperty(d,${k},{value:${def},writable:true,enumerable:true,configurable:true})`
+          : `if(!Object.hasOwn(d,${k}))d[${k}]=${def}`);
       }
     }
   }
@@ -864,6 +896,18 @@ class Validator {
     this._rawIsCallers = typeof schema !== "string";
     this._options = options;
     this._noOpts = !opts;
+    // engine: 'interpreter' keeps this validator off code generation: no
+    // `new Function`, no shared compile cache, the eval-free interpreted
+    // engine answers validate(), isValidObject() and validateJSON(). For a
+    // schema that arrives from outside the trust boundary (a plugin's
+    // declared config shape, a tenant's upload), where turning it into source
+    // is not an acceptable execution model. ATA_FORCE_NAPI does this for the
+    // whole process; the option does it for one validator. A misspelling
+    // must not fall through to codegen, so anything else is refused.
+    if (options.engine !== undefined && options.engine !== 'auto' && options.engine !== 'interpreter') {
+      throw new TypeError("engine must be 'auto' or 'interpreter', got " + JSON.stringify(options.engine));
+    }
+    this._interpretOnly = options.engine === 'interpreter';
     this._initialized = false;
     this._nativeReady = false;
     this._compiled = null;
@@ -1012,11 +1056,14 @@ class Validator {
     // Check cache first -- reuse compiled functions for same schema
     const sm = this._schemaMap.size > 0 ? this._schemaMap : null;
     const mapKey = compileCacheKey(this._schemaStr, this._schemaMap);
+    var _forceNapi = this._interpretOnly || (typeof process !== 'undefined' && process.env && process.env.ATA_FORCE_NAPI);
     // Custom formats are JS functions: bypass the compile cache since they can
-    // differ between validators that share the same schema string.
-    const cached = (this._userFormats || this._usesKeywords) ? null : _compileCache.get(mapKey);
+    // differ between validators that share the same schema string. An
+    // interpreter-only validator never touches it either way: a function a
+    // trusted validator compiled for the same schema string must not answer
+    // for it.
+    const cached = (this._userFormats || this._usesKeywords || _forceNapi) ? null : _compileCache.get(mapKey);
     let jsFn, jsCombinedFn, jsErrFn, _isCodegen = false;
-    var _forceNapi = typeof process !== 'undefined' && process.env && process.env.ATA_FORCE_NAPI;
     // v1 removes the bookending requirement for $dynamicRef. Only the
     // interpreted engine implements that; the JS compiler and the native
     // engine both resolve the 2020-12 way, so a v1 schema using the keyword
@@ -1031,15 +1078,16 @@ class Validator {
     // either. The closure path does not call `new Function` itself, so it
     // survives the block and would quietly handle schemas it gets wrong; the
     // interpreted engine is both eval-free and more correct, so go straight
-    // there.
-    if (this._v1Dynamic || this._usesKeywords || !codegenAvailable()) {
+    // there. The forced case is decided before the probe: the probe is a
+    // `new Function` too, and a validator that promised none must not run it.
+    if (_forceNapi || this._v1Dynamic || this._usesKeywords || !codegenAvailable()) {
       jsFn = null; jsCombinedFn = null; jsErrFn = null;
     // `full` separates an entry that holds every compiled function from one
     // the verdict-only fast path seeded, where `combined` and `errFn` are null
     // because nothing has tried to build them yet. Both halves of that
     // distinction are null, and reading the second as the first costs this
     // schema its generated error function for the life of the process.
-    } else if (cached && cached.jsFn !== undefined && !_forceNapi) {
+    } else if (cached && cached.jsFn !== undefined) {
       // `full` says the error and combined functions exist too. An entry
       // without it still carries a verdict function worth reusing; the pair is
       // built by _buildDeferred below if something asks for an error, and the
@@ -1052,7 +1100,7 @@ class Validator {
       jsErrFn = cached.errFn;
       _isCodegen = !!cached.isCodegen;
       this._engine = _isCodegen ? 'codegen' : jsFn ? 'closure' : null;
-    } else if (!_forceNapi) {
+    } else {
       const uf = this._userFormats;
       const _cgFn = compileToJSCodegen(schemaObj, sm, uf);
       jsFn = _cgFn || compileToJS(schemaObj, null, sm);
@@ -1068,8 +1116,6 @@ class Validator {
       if (!uf) {
         _compileCache.set(mapKey, { jsFn, combined: undefined, errFn: undefined, isCodegen: _isCodegen, full: false });
       }
-    } else {
-      jsFn = null; jsCombinedFn = null; jsErrFn = null;
     }
     this._jsFn = jsFn;
     if (this._engine === undefined) this._engine = null;
@@ -1079,7 +1125,10 @@ class Validator {
     // shape (e.g. Fastify `params: { $ref: 'shared#' }` or property refs like
     // `{ id: { $ref: 'shared#/properties/id' } }`).
     const preprocessSchema = resolveSchemaForPreprocess(schemaObj, this._schemaMap);
-    let preprocess = buildPreprocessCodegen(preprocessSchema, options);
+    // The mutator pass (defaults, coercion, removal) is generated source too,
+    // with the schema's `default` values embedded; an interpreter-only
+    // validator takes the closure mutators instead.
+    let preprocess = this._interpretOnly ? null : buildPreprocessCodegen(preprocessSchema, options);
     if (!preprocess) {
       const applyDefaults = options.useDefaults === false ? null : buildDefaultsApplier(preprocessSchema);
       const applyCoerce = options.coerceTypes ? buildCoercer(preprocessSchema) : null;
@@ -1967,7 +2016,7 @@ class Validator {
       return;
     }
     this._ensureVocabularies();
-    if (typeof process !== 'undefined' && process.env && process.env.ATA_FORCE_NAPI) return;
+    if (this._interpretOnly || (typeof process !== 'undefined' && process.env && process.env.ATA_FORCE_NAPI)) return;
     if (!this._schemaStr) this._schemaStr = JSON.stringify(this._schemaObj);
     const sm = this._schemaMap.size > 0 ? this._schemaMap : null;
     const mapKey = compileCacheKey(this._schemaStr, this._schemaMap);

package/lib/aot-impl.js

@@ -351,7 +351,9 @@ function emitClone(node, access, depth) {
     const read = `${access}[${JSON.stringify(key)}]`;
     const value = emitValueExpr(prop, read, depth);
     if (value === null) return null;
-    if (required.has(key)) fixed.push(`${JSON.stringify(key)}: ${value}`);
+    // Computed key syntax: a plain `"__proto__":` in an object literal is
+    // the prototype slot, not a property; `["__proto__"]:` is a property.
+    if (required.has(key)) fixed.push(`[${JSON.stringify(key)}]: ${value}`);
     else conditional.push({ key, value, dflt: prop.default });
   }
   if (fixed.length === 0 && conditional.length === 0 && !apSchema) return null;
@@ -377,7 +379,10 @@ function emitClone(node, access, depth) {
     } else if (keys.length > 0) {
       skip = `if (${keys.map((k) => `${kVar} === ${JSON.stringify(k)}`).join(' || ')}) continue; `;
     }
-    recordLoop = ` ${declSet}for (const ${kVar} of Object.keys(${access})) { ${skip}const ${vVar} = ${access}[${kVar}]; ${tmp}[${kVar}] = ${valueExpr}; }`;
+    // The key comes from the input, so it can be the string "__proto__" (an
+    // own key only JSON.parse writes); assignment would hit the prototype
+    // setter, so that one key goes through defineProperty.
+    recordLoop = ` ${declSet}for (const ${kVar} of Object.keys(${access})) { ${skip}const ${vVar} = ${access}[${kVar}]; if (${kVar} === "__proto__") Object.defineProperty(${tmp}, ${kVar}, { value: ${valueExpr}, writable: true, enumerable: true, configurable: true }); else ${tmp}[${kVar}] = ${valueExpr}; }`;
   }
 
   const literal = `{ ${fixed.join(', ')} }`;
@@ -386,10 +391,22 @@ function emitClone(node, access, depth) {
   // gains a key the input did not have.
   const adds = conditional
     .map(({ key, value, dflt }) => {
-      const set = `if (${JSON.stringify(key)} in ${access}) ${tmp}[${JSON.stringify(key)}] = ${value};`;
+      // Object.hasOwn, not `in`: `in` also answers for what the instance
+      // inherits, so a property named `constructor` would copy the inherited
+      // function into the output that validate().data does not carry. And a
+      // key named `__proto__` cannot be written by assignment, which hits
+      // the prototype setter; defineProperty writes an own key.
+      const assign = key === '__proto__'
+        ? `Object.defineProperty(${tmp}, ${JSON.stringify(key)}, { value: ${value}, writable: true, enumerable: true, configurable: true });`
+        : `${tmp}[${JSON.stringify(key)}] = ${value};`;
+      const set = `if (Object.hasOwn(${access}, ${JSON.stringify(key)})) ${assign}`;
       // The default is emitted as a literal inside the call, so an object or
       // array default is a fresh value on every parse, never shared state.
-      return dflt === undefined ? set : `${set} else ${tmp}[${JSON.stringify(key)}] = ${JSON.stringify(dflt)};`;
+      if (dflt === undefined) return set;
+      const setDflt = key === '__proto__'
+        ? `Object.defineProperty(${tmp}, ${JSON.stringify(key)}, { value: ${JSON.stringify(dflt)}, writable: true, enumerable: true, configurable: true });`
+        : `${tmp}[${JSON.stringify(key)}] = ${JSON.stringify(dflt)};`;
+      return `${set} else ${setDflt}`;
     })
     .join(' ');
   return `(function(){ const ${tmp} = ${literal}; ${adds}${recordLoop} return ${tmp}; })()`;

package/lib/data-positions.js

@@ -9,27 +9,22 @@
 // Self-contained on purpose: `toStandaloneModule({ positions: true })` embeds
 // this function verbatim via Function.prototype.toString, so it may not close
 // over anything in this module and may not assume Node globals. The inlined
-// escapePtr below duplicates lib/source-positions.js for that reason.
+// pointer escaping below duplicates lib/source-positions.js for that reason.
 function buildDataPositionMap (input) {
-  const escapePtr = (s) => s.replace(/~/g, '~0').replace(/\//g, '~1');
   const text = (typeof Buffer !== 'undefined' && Buffer.isBuffer(input)) ? input.toString('utf8') : String(input);
   const map = Object.create(null);
-  const lines = text.split('\n');
-  const lineStart = new Array(lines.length + 1);
-  lineStart[0] = 0;
-  for (let i = 0; i < lines.length; i++) lineStart[i + 1] = lineStart[i] + lines[i].length + 1;
+  const n = text.length;
 
-  function offsetToLineCol (off) {
-    let lo = 0, hi = lineStart.length - 1;
-    while (lo < hi) {
-      const mid = (lo + hi + 1) >> 1;
-      if (lineStart[mid] <= off) lo = mid; else hi = mid - 1;
-    }
-    return { line: lo + 1, col: off - lineStart[lo] + 1, text: lines[lo] || '' };
-  }
+  // Offsets during the walk, line and column afterwards. Resolving them here
+  // cost a binary search and an object allocation for every node in the
+  // document, when only the nodes an error names are ever read.
+  const ptrs = [];
+  const starts = [];
+  const lens = [];
+  const keyStarts = [];
+  const keyLens = [];
 
   let i = 0;
-  const n = text.length;
 
   function skipWs () {
     while (i < n) {
@@ -38,28 +33,40 @@ function buildDataPositionMap (input) {
     }
   }
 
-  function readString () {
+  // Span the string token, leaving `i` just past the closing quote. A plain
+  // token is sliced; one holding an escape or a raw control character goes
+  // through JSON.parse, which is what decodes `é` and what rejects a
+  // literal newline or a bad escape. Values are spanned and not decoded, but a
+  // malformed one still has to be rejected, so it is parsed for the throw.
+  //
+  // A token that does not open with a quote is not simple either. Object keys
+  // are read here unconditionally, so a document whose opening quote is missing
+  // (`{ mo": 1 }`) arrives with `m` under the cursor, and slicing it would map a
+  // key nobody wrote. Parsing the span rejects it instead.
+  function readString (decode) {
     const start = i;
+    let simple = text.charCodeAt(i) === 0x22;
     i++;
+    let closed = false;
     while (i < n) {
       const ch = text.charCodeAt(i);
-      if (ch === 0x5c) { i += 2; continue; }
-      if (ch === 0x22) { i++; return JSON.parse(text.slice(start, i)); }
+      if (ch === 0x5c) { simple = false; i += 2; continue; }
+      if (ch === 0x22) { i++; closed = true; break; }
+      if (ch < 0x20) simple = false;
       i++;
     }
-    throw new Error('unterminated string at offset ' + start);
+    if (!closed) throw new Error('unterminated string at offset ' + start);
+    if (simple) return decode ? text.slice(start + 1, i - 1) : null;
+    const decoded = JSON.parse(text.slice(start, i));
+    return decode ? decoded : null;
   }
 
-  function pointerOf (path) {
-    if (path.length === 0) return '';
-    return '/' + path.map(escapePtr).join('/');
-  }
-
-  function walk (path, keySpan) {
+  // The pointer is carried down the walk. Rebuilding it per node from a path
+  // array cost an array copy, a map and a join for every node.
+  function walk (ptr, keyStart, keyLen) {
     skipWs();
     if (i >= n) return;
     const start = i;
-    const pos = offsetToLineCol(start);
 
     const ch = text.charCodeAt(i);
     if (ch === 0x7b) {
@@ -76,19 +83,16 @@ function buildDataPositionMap (input) {
         // Record the key token before consuming it. The caret for an error
         // that names a property belongs on the property, not on the value and
         // not on the enclosing object.
-        const keyStart = i;
-        const keyPos = offsetToLineCol(keyStart);
-        const key = readString();
-        const span = {
-          keyOffset: keyStart,
-          keyLength: i - keyStart,
-          keyLine: keyPos.line,
-          keyCol: keyPos.col,
-        };
+        const memberKeyStart = i;
+        const key = readString(true);
+        const memberKeyLen = i - memberKeyStart;
         skipWs();
         if (text.charCodeAt(i) !== 0x3a) throw new Error('expected ":" at offset ' + i);
         i++;
-        walk(path.concat([key]), span);
+        const seg = (key.indexOf('~') === -1 && key.indexOf('/') === -1)
+          ? key
+          : key.replace(/~/g, '~0').replace(/\//g, '~1');
+        walk(ptr + '/' + seg, memberKeyStart, memberKeyLen);
       }
     } else if (ch === 0x5b) {
       i++;
@@ -99,7 +103,7 @@ function buildDataPositionMap (input) {
         if (text.charCodeAt(i) === 0x5d) { i++; break; }
         if (text.charCodeAt(i) === 0x2c) { i++; continue; }
         const before = i;
-        walk(path.concat([String(idx)]));
+        walk(ptr + '/' + idx, -1, 0);
         // A character that begins no value at all, a stray `}` for instance,
         // leaves the position where it was, and a loop that does not advance
         // does not end. `validateJSON('[')` hung here on one byte.
@@ -107,7 +111,7 @@ function buildDataPositionMap (input) {
         idx++;
       }
     } else if (ch === 0x22) {
-      readString();
+      readString(false);
     } else {
       while (i < n) {
         const c = text.charCodeAt(i);
@@ -116,19 +120,51 @@ function buildDataPositionMap (input) {
       }
     }
 
-    const length = i - start;
-    const entry = { byteOffset: start, length, line: pos.line, col: pos.col, text: pos.text };
-    if (keySpan) {
-      entry.keyOffset = keySpan.keyOffset;
-      entry.keyLength = keySpan.keyLength;
-      entry.keyLine = keySpan.keyLine;
-      entry.keyCol = keySpan.keyCol;
-    }
-    map[pointerOf(path)] = entry;
+    ptrs.push(ptr);
+    starts.push(start);
+    lens.push(i - start);
+    keyStarts.push(keyStart);
+    keyLens.push(keyLen);
   }
 
   if (text.charCodeAt(0) === 0xfeff) i = 1;
-  walk([]);
+  walk('', -1, 0);
+
+  if (ptrs.length === 0) return map;
+
+  const lines = text.split('\n');
+  const lineStart = new Array(lines.length + 1);
+  lineStart[0] = 0;
+  for (let k = 0; k < lines.length; k++) lineStart[k + 1] = lineStart[k] + lines[k].length + 1;
+
+  function lineOf (off) {
+    let lo = 0, hi = lineStart.length - 1;
+    while (lo < hi) {
+      const mid = (lo + hi + 1) >> 1;
+      if (lineStart[mid] <= off) lo = mid; else hi = mid - 1;
+    }
+    return lo;
+  }
+
+  for (let k = 0; k < ptrs.length; k++) {
+    const off = starts[k];
+    const line = lineOf(off);
+    const entry = {
+      byteOffset: off,
+      length: lens[k],
+      line: line + 1,
+      col: off - lineStart[line] + 1,
+      text: lines[line] || '',
+    };
+    if (keyStarts[k] >= 0) {
+      const keyLine = lineOf(keyStarts[k]);
+      entry.keyOffset = keyStarts[k];
+      entry.keyLength = keyLens[k];
+      entry.keyLine = keyLine + 1;
+      entry.keyCol = keyStarts[k] - lineStart[keyLine] + 1;
+    }
+    map[ptrs[k]] = entry;
+  }
   return map;
 }
 

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.27.0';
+module.exports = '1.28.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "description": "JSON Schema validation that compiles for speed and still runs where code generation is blocked. Compiled and interpreted engines answer identically at 100% of the official suite. TypeScript inference, Standard Schema V1, and a build step that emits dependency-free modules.",
   "main": "index.js",
   "module": "index.mjs",
@@ -51,7 +51,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_scanner_differential.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_uri_helper_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_file_positions.js && node tests/test_schema_hash.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_scanner_differential.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_option.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_uri_helper_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_defaults_own_keys.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_position_map_cost.js && node tests/test_file_positions.js && node tests/test_schema_hash.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -122,13 +122,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.27.0",
-    "@ata-validator/native-darwin-x64": "1.27.0",
-    "@ata-validator/native-linux-arm64-gnu": "1.27.0",
-    "@ata-validator/native-linux-arm64-musl": "1.27.0",
-    "@ata-validator/native-linux-x64-gnu": "1.27.0",
-    "@ata-validator/native-linux-x64-musl": "1.27.0",
-    "@ata-validator/native-win32-x64": "1.27.0"
+    "@ata-validator/native-darwin-arm64": "1.28.0",
+    "@ata-validator/native-darwin-x64": "1.28.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.28.0",
+    "@ata-validator/native-linux-arm64-musl": "1.28.0",
+    "@ata-validator/native-linux-x64-gnu": "1.28.0",
+    "@ata-validator/native-linux-x64-musl": "1.28.0",
+    "@ata-validator/native-win32-x64": "1.28.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"