ata-validator 1.31.1 → 1.31.2

package/compat.js

@@ -22,7 +22,7 @@ const { resolvePointer } = require('./lib/pointer.js');
 
 const { Validator } = require('./index');
 const { METASCHEMAS } = require('./lib/metaschemas');
-const { createShaper } = require('./lib/compat-errors');
+const { createShaper, asReferenceKeyword } = require('./lib/compat-errors');
 
 const DRAFT7 = 'http://json-schema.org/draft-07/schema#';
 const DRAFT2020 = 'https://json-schema.org/draft/2020-12/schema';
@@ -185,7 +185,7 @@ class Ata {
         validate.errors = null;
         return true;
       }
-      let errors = shaper === null ? result.errors : shaper(result.errors, data);
+      let errors = shaper === null ? result.errors.map(asReferenceKeyword) : shaper(result.errors, data);
       // Errors the shaper synthesises, the `if` wrapper among them, are built
       // from the group rather than carried up from the validator, so verbose
       // mode has to fill in the value they point at here or they would be the

package/lib/compat-errors.js

@@ -133,6 +133,16 @@ function escapePointer(s) {
 // validate() already reports them so.
 const WRAPPERS = new Set(['anyOf', 'oneOf', 'propertyNames', 'contains', 'not', 'if']);
 
+// ata names the keyword of a false schema `not`, at the root and nested alike,
+// which is what its own error codes and every consumer switch on. The
+// reference names it `false schema`. The root case used to come out of the
+// code generator as `false schema` by an inconsistency that has since been
+// fixed, so this shim matched the reference there and not for a nested false
+// schema; the rename here makes both match.
+function asReferenceKeyword(e) {
+  return e.keyword === 'not' && e.message === 'boolean schema is false' ? { ...e, keyword: 'false schema' } : e;
+}
+
 function createShaper({ Validator, rootId, rootDoc, schemas, options, allErrors, macroKeywords }) {
   const branchCache = new Map();
   const branchValidator = (pointer) => {
@@ -360,11 +370,11 @@ function createShaper({ Validator, rootId, rootDoc, schemas, options, allErrors,
   }
 
   return function shapeErrors(errors, data) {
-    const shaped = shape(errors, data, '');
+    const shaped = shape(errors, data, '').map(asReferenceKeyword);
     if (allErrors) return shaped;
     const n = groupEnd(shaped);
     return shaped.slice(0, n);
   };
 }
 
-module.exports = { createShaper, sortLikeReference, REFERENCE_ORDER };
+module.exports = { createShaper, sortLikeReference, REFERENCE_ORDER, asReferenceKeyword };

package/lib/js-compiler.js

@@ -157,10 +157,31 @@ const DOC_BASE = 'https://ata-validator.com/e/'
 // reader sorts by without deriving it from the path. Empty when the path is
 // not into the root document.
 function ordinalField (ctx, schemaPath) {
-  const o = ctx && ctx.rootSchema ? ordinalFor(ctx.rootSchema, schemaPath) : null
+  const o = ctx && ctx.rootSchema ? ordinalFor(ctx.rootSchema, unescapeSp(schemaPath)) : null
   return o === null ? '' : `,_o:${o}`
 }
 
+// A schema path as the generators hold it is text for a single-quoted source
+// literal: ptrSeg put a backslash before every backslash and quote in a key.
+// Anything that uses the path as a value, the ordinal lookup and the frozen
+// error objects below, has to take that backslash off again, or a key such as
+// `it's` reads as `it\'s` and the error names a path that does not exist.
+// The value of a string literal the generators built for source. One that does
+// not parse on its own (a key with a raw line break) would not parse inside the
+// generated function either, so the generator declines, as it would have when
+// that function failed to build.
+function literalValue (lit) {
+  try {
+    return Function('return ' + lit)()
+  } catch {
+    throw DECLINE
+  }
+}
+
+function unescapeSp (sp) {
+  return sp.indexOf('\\') === -1 ? sp : sp.replace(/\\(.)/g, '$1')
+}
+
 function buildErrorLiteral (opts) {
   const { keyword, format, schemaPath, sourceMap } = opts
   let code = (keyword === 'format' && format) ? codeFor('format', format) : codeFor(keyword)
@@ -340,7 +361,7 @@ function compileToJS(schema, defs, schemaMap) {
   // required applies to objects only; other types are ignored.
   if (schema.required && Array.isArray(schema.required)) {
     for (const key of schema.required) {
-      checks.push((d) => typeof d !== 'object' || d === null || Array.isArray(d) || d[key] !== undefined)
+      checks.push((d) => typeof d !== 'object' || d === null || Array.isArray(d) || hasOwnKey(d, key))
     }
   }
 
@@ -350,7 +371,7 @@ function compileToJS(schema, defs, schemaMap) {
       const propCheck = compileToJS(prop, rootDefs)
       if (!propCheck) return null // bail if sub-schema too complex
       checks.push((d) => {
-        if (typeof d !== 'object' || d === null || !(key in d)) return true
+        if (typeof d !== 'object' || d === null || !hasOwnKey(d, key)) return true
         return propCheck(d[key])
       })
     }
@@ -387,9 +408,9 @@ function compileToJS(schema, defs, schemaMap) {
   if (schema.dependentRequired) {
     for (const [key, deps] of Object.entries(schema.dependentRequired)) {
       checks.push((d) => {
-        if (typeof d !== 'object' || d === null || !(key in d)) return true
+        if (typeof d !== 'object' || d === null || !hasOwnKey(d, key)) return true
         for (let i = 0; i < deps.length; i++) {
-          if (!(deps[i] in d)) return false
+          if (!hasOwnKey(d, deps[i])) return false
         }
         return true
       })
@@ -872,6 +893,44 @@ const FORMAT_CHECKS = {
 }
 
 // Dangerous JS property names that exist on Object.prototype
+// Presence is an own-property question: `required: ['toString']` is not
+// satisfied by `{}`. `'k' in v` and `v.k !== undefined` both answer yes for a
+// name found on the prototype chain, which accepted documents the interpreted
+// engine rejects. Object.hasOwn would be exact but is not inlined, about 5 ns
+// a key against well under 1 for `in`, so the check is split:
+//   - a name on Object.prototype (and `__proto__`) is always checked with
+//     hasOwnProperty; these are rare in schemas and known when compiling;
+//   - any other name can only be inherited from a prototype that is not
+//     Object.prototype, so an ordinary object answers with `in` and one
+//     comparison of its prototype, and anything else, a class instance, a
+//     null-prototype object, one from another realm, pays for hasOwnProperty.
+// `v.__proto__` is read rather than Object.getPrototypeOf(v) because the engine
+// inlines the accessor and not the call (0.8 ns against 8 for eleven keys). An
+// object whose own `__proto__` is a data property reads that value, which is
+// not Object.prototype, so it takes the exact path.
+const PROTO_NAMES = new Set([...Object.getOwnPropertyNames(Object.prototype), '__proto__'])
+// Declared once per compiled function and called by name: spelled out at each
+// property, the test grew a 50-property module by a tenth. Both are small
+// enough for the engine to inline.
+const OWN_HELPERS = 'const _hop=Object.prototype.hasOwnProperty;' +
+  'function _own(o,k){return o.__proto__===Object.prototype?k in o:_hop.call(o,k)}'
+function ownKeyExpr (ctx, v, key) {
+  hoistOnce(ctx, '_ownHoisted', OWN_HELPERS)
+  const k = JSON.stringify(key)
+  return PROTO_NAMES.has(key) ? `_hop.call(${v},${k})` : `_own(${v},${k})`
+}
+// For a value already read as `v[key]` and found not to be undefined: whether
+// it came from `v` itself. Same test; `in` is already known to hold.
+function ownGuard (ctx, v, key) {
+  return ownKeyExpr(ctx, v, key)
+}
+// The same test at run time, for the closure compiler.
+const _hop = Object.prototype.hasOwnProperty
+function hasOwnKey (d, key) {
+  if (PROTO_NAMES.has(key)) return _hop.call(d, key)
+  return key in d && (d.__proto__ === Object.prototype || _hop.call(d, key))
+}
+
 const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'toString', 'valueOf',
   'hasOwnProperty', 'isPrototypeOf', 'propertyIsEnumerable', 'toLocaleString'])
 
@@ -2077,24 +2136,34 @@ function genCode(schema, v, lines, ctx, knownType) {
   const hoisted = {} // key -> access expression
   if (schema.required && schema.properties && isObj) {
     const reqChecks = []
+    const typed = []
     for (const key of schema.required) {
       hoisted[key] = `${v}[${JSON.stringify(key)}]`
       const prop = schema.properties[key]
       const hasTypeCheck = prop && (prop.type || prop.enum || prop.const !== undefined)
-      if (!hasTypeCheck) {
-        reqChecks.push(`${v}[${JSON.stringify(key)}]===undefined`)
+      // A typed property needs no separate presence check on an ordinary
+      // object: its type check fails on undefined. A name on Object.prototype
+      // is never absent that way, and it is checked explicitly.
+      if (!hasTypeCheck || PROTO_NAMES.has(key)) {
+        reqChecks.push(`!${ownKeyExpr(ctx, v, key)}`)
+      } else {
+        typed.push(key)
       }
     }
     if (reqChecks.length > 0) {
       lines.push(`if(${reqChecks.join('||')})return false`)
     }
+    // On an object with another prototype the typed ones may be inherited.
+    if (typed.length > 0) {
+      hoistOnce(ctx, '_ownHoisted', OWN_HELPERS)
+      lines.push(`if(${v}.__proto__!==Object.prototype&&!(${typed.map((k) => `_hop.call(${v},${JSON.stringify(k)})`).join('&&')}))return false`)
+    }
   } else if (schema.required && schema.required.length > 0) {
+    const checks = schema.required.map(key => `!${ownKeyExpr(ctx, v, key)}`)
     if (isObj) {
-      const checks = schema.required.map(key => `${v}[${JSON.stringify(key)}]===undefined`)
       lines.push(`if(${checks.join('||')})return false`)
     } else {
       // required applies to objects only; other types are ignored.
-      const checks = schema.required.map(key => `${v}[${JSON.stringify(key)}]===undefined`)
       lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&(${checks.join('||')}))return false`)
     }
   }
@@ -2287,8 +2356,8 @@ function genCode(schema, v, lines, ctx, knownType) {
   // dependentRequired
   if (schema.dependentRequired) {
     for (const [key, deps] of Object.entries(schema.dependentRequired)) {
-      const depChecks = deps.map(d => `!('${esc(d)}' in ${v})`).join('||')
-      lines.push(`if(${objGuard}'${esc(key)}' in ${v}&&(${depChecks}))return false`)
+      const depChecks = deps.map(d => `!${ownKeyExpr(ctx, v, d)}`).join('||')
+      lines.push(`if(${objGuard}${ownKeyExpr(ctx, v, key)}&&(${depChecks}))return false`)
     }
   }
 
@@ -2425,7 +2494,7 @@ function genCode(schema, v, lines, ctx, knownType) {
   if (schema.dependentSchemas) {
     for (const [key, depSchema] of Object.entries(schema.dependentSchemas)) {
       const guard = isObj ? '' : `typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&`
-      lines.push(`if(${guard}${JSON.stringify(key)} in ${v}){`)
+      lines.push(`if(${guard}${ownKeyExpr(ctx, v, key)}){`)
       ctx.condDepth = (ctx.condDepth || 0) + 1
       genCode(depSchema, v, lines, ctx, effectiveType)
       ctx.condDepth--
@@ -2491,7 +2560,7 @@ function genCode(schema, v, lines, ctx, knownType) {
         // Optional — hoist to local, check undefined
         const oi = ctx.varCounter++
         const local = `_o${oi}`
-        lines.push(`{const ${local}=${v}[${JSON.stringify(key)}];if(${local}!==undefined){`)
+        lines.push(`{const ${local}=${v}[${JSON.stringify(key)}];if(${local}!==undefined&&${ownGuard(ctx, v, key)}){`)
         const combined = tryGenCombined(prop, local, ctx)
         if (combined) {
           lines.push(combined)
@@ -2500,7 +2569,7 @@ function genCode(schema, v, lines, ctx, knownType) {
         }
         lines.push(`}}`)
       } else {
-        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${JSON.stringify(key)} in ${v}){`)
+        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${ownKeyExpr(ctx, v, key)}){`)
         genCode(prop, `${v}[${JSON.stringify(key)}]`, lines, ctx)
         lines.push(`}`)
       }
@@ -2864,7 +2933,7 @@ function genCode(schema, v, lines, ctx, knownType) {
           for (const [trigger, depSchema] of Object.entries(schema.dependentSchemas)) {
             const depResult = collectEvaluated(depSchema, ctx.schemaMap, ctx.rootDefs)
             if (depResult.props && depResult.props.length > 0) {
-              lines.push(`if(${JSON.stringify(trigger)} in ${v}){${depResult.props.map(k => `${evVar}[${JSON.stringify(k)}]=1`).join(';')}}`)
+              lines.push(`if(${ownKeyExpr(ctx, v, trigger)}){${depResult.props.map(k => `${evVar}[${JSON.stringify(k)}]=1`).join(';')}}`)
             }
           }
           const inner = `for(var _k in ${v}){if(!${evVar}[_k])return false}`
@@ -3462,7 +3531,7 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
   if (typeof schema === 'boolean') {
     return schema
       ? () => ({ valid: true, errors: [] })
-      : () => ({ valid: false, errors: [{ keyword: 'false schema', instancePath: '', schemaPath: '#', params: {}, message: 'boolean schema is false' }] })
+      : () => ({ valid: false, errors: [{ keyword: 'not', instancePath: '', schemaPath: '#', params: {}, message: 'boolean schema is false' }] })
   }
   if (typeof schema !== 'object' || schema === null) return null
   if (!sharedCodegenGate(schema, schemaMap)) return null
@@ -3823,7 +3892,7 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     const reqSp = `${schemaPrefix}/required`
     const reqLit = buildErrorLiteral({ keyword: 'required', schemaPath: reqSp, sourceMap: ctx.sourceMap })
     for (const key of schema.required) {
-      lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&!(${JSON.stringify(key)} in ${v})){_e.push({code:'${reqLit.codeStr}',keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${reqSp}'${ordinalField(ctx, `${reqSp}`)},params:{missingProperty:'${esc(key)}'},message:"must have required property '${esc(key)}'",docUrl:'${reqLit.docUrl}'${reqLit.frame}});if(!_all)return{valid:false,errors:_e}}`)
+      lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&!${ownKeyExpr(ctx, v, key)}){_e.push({code:'${reqLit.codeStr}',keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${reqSp}'${ordinalField(ctx, `${reqSp}`)},params:{missingProperty:'${esc(key)}'},message:"must have required property '${esc(key)}'",docUrl:'${reqLit.docUrl}'${reqLit.frame}});if(!_all)return{valid:false,errors:_e}}`)
     }
   }
 
@@ -4040,7 +4109,7 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     const drLit = buildErrorLiteral({ keyword: 'dependentRequired', schemaPath: drSp, sourceMap: ctx.sourceMap })
     for (const [key, deps] of Object.entries(schema.dependentRequired)) {
       for (const dep of deps) {
-        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${JSON.stringify(key)} in ${v}&&!(${JSON.stringify(dep)} in ${v})){_e.push({code:'${drLit.codeStr}',keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${drSp}'${ordinalField(ctx, `${drSp}`)},params:{missingProperty:'${esc(dep)}'},message:"must have required property '${esc(dep)}'",docUrl:'${drLit.docUrl}'${drLit.frame}});if(!_all)return{valid:false,errors:_e}}`)
+        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${ownKeyExpr(ctx, v, key)}&&!${ownKeyExpr(ctx, v, dep)}){_e.push({code:'${drLit.codeStr}',keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${drSp}'${ordinalField(ctx, `${drSp}`)},params:{missingProperty:'${esc(dep)}'},message:"must have required property '${esc(dep)}'",docUrl:'${drLit.docUrl}'${drLit.frame}});if(!_all)return{valid:false,errors:_e}}`)
       }
     }
   }
@@ -4049,7 +4118,7 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   if (schema.properties) {
     for (const [key, prop] of Object.entries(schema.properties)) {
       const childPath = childPathExpr(pathExpr, ptrSeg(key))
-      lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&${JSON.stringify(key)} in ${v}){`)
+      lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&${ownKeyExpr(ctx, v, key)}){`)
       genCodeE(prop, `${v}[${JSON.stringify(key)}]`, childPath, lines, ctx, schemaPrefix+'/properties/'+ptrSeg(key))
       lines.push(`}`)
     }
@@ -4118,7 +4187,7 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   // dependentSchemas
   if (schema.dependentSchemas) {
     for (const [key, depSchema] of Object.entries(schema.dependentSchemas)) {
-      lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&${JSON.stringify(key)} in ${v}){`)
+      lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&${ownKeyExpr(ctx, v, key)}){`)
       genCodeE(depSchema, v, pathExpr, lines, ctx, schemaPrefix+'/dependentSchemas/'+ptrSeg(key))
       lines.push(`}`)
     }
@@ -4286,7 +4355,7 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats) {
   if (typeof schema === 'boolean') {
     return schema
       ? () => VALID_RESULT
-      : () => ({ valid: false, errors: [{ keyword: 'false schema', instancePath: '', schemaPath: '#', params: {}, message: 'boolean schema is false' }] })
+      : () => ({ valid: false, errors: [{ keyword: 'not', instancePath: '', schemaPath: '#', params: {}, message: 'boolean schema is false' }] })
   }
   if (typeof schema !== 'object' || schema === null) return null
   if (!sharedCodegenGate(schema, schemaMap)) return null
@@ -4473,14 +4542,28 @@ function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
         // Static error: pre-allocate as frozen closure variable
         const ei = ctx.varCounter++
         const errVar = `_E${ei}`
-        const pathVal = pathExpr ? pathExpr.slice(1, -1) : ''
-        const msgVal = msgCode.slice(1, -1)
+        // The path and message are source literals; evaluate them rather than
+        // strip the quotes, so an escaped quote or backslash in a key comes
+        // out as the character and not as the escape.
+        let pathVal, msgVal
+        try {
+          pathVal = pathExpr ? Function('return ' + pathExpr)() : ''
+          msgVal = Function('return ' + msgCode)()
+        } catch {
+          // Not a literal that parses on its own (a key with a raw line break):
+          // leave it to the inline form below, which declines the same way the
+          // whole function would.
+          pathVal = undefined
+        }
+        if (pathVal !== undefined) {
+        const spVal = unescapeSp(sp)
         ctx.closureVars.push(errVar)
-        const o = ordinalFor(ctx.rootSchema, sp)
-        const lit = {keyword, instancePath: pathVal, schemaPath: sp, params: Object.freeze(paramsVal), message: msgVal}
+        const o = ordinalFor(ctx.rootSchema, spVal)
+        const lit = {keyword, instancePath: pathVal, schemaPath: spVal, params: Object.freeze(paramsVal), message: msgVal}
         if (o !== null) lit._o = o
         ctx.closureVals.push(Object.freeze(lit))
         return `(_e||(_e=[])).push(${errVar})`
+        }
       }
     }
     // Dynamic path (e.g., array index): inline as before
@@ -4543,15 +4626,22 @@ function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
         destructKeys.push(`${JSON.stringify(key)}:${lv}`)
       }
     }
-    if (destructKeys.length > 0) lines.push(`const{${destructKeys.join(',')}}=${v}`)
+    if (destructKeys.length > 0) {
+      lines.push(`let{${destructKeys.join(',')}}=${v}`)
+      // A value the object only inherits reads as absent, here and in the
+      // property checks that use the same local below.
+      for (const key of schema.required) {
+        if (hoisted[key]) lines.push(`if(${hoisted[key]}!==undefined&&!${ownGuard(ctx, v, key)})${hoisted[key]}=undefined`)
+      }
+    }
     for (const key of schema.required) {
-      const check = hoisted[key] ? `${hoisted[key]}===undefined` : `${v}[${JSON.stringify(key)}]===undefined`
+      const check = hoisted[key] ? `${hoisted[key]}===undefined` : `!${ownKeyExpr(ctx, v, key)}`
       if (isStaticPath) {
         const ei = ctx.varCounter++
         const errVar = `_E${ei}`
-        const pathVal = pathExpr ? pathExpr.slice(1, -1) : ''
+        const pathVal = pathExpr ? literalValue(pathExpr) : ''
         ctx.closureVars.push(errVar)
-        ctx.closureVals.push(Object.freeze({keyword: 'required', instancePath: pathVal, schemaPath: `${schemaPrefix}/required`, params: Object.freeze({missingProperty: key}), message: `must have required property '${key}'`}))
+        ctx.closureVals.push(Object.freeze({keyword: 'required', instancePath: pathVal, schemaPath: unescapeSp(`${schemaPrefix}/required`), params: Object.freeze({missingProperty: key}), message: `must have required property '${key}'`}))
         lines.push(`if(${check}){(_e||(_e=[])).push(${errVar})}`)
       } else {
         lines.push(`if(${check}){(_e||(_e=[])).push({keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/required'${ordinalField(ctx, `${schemaPrefix}/required`)},params:{missingProperty:'${esc(key)}'},message:"must have required property '${esc(key)}'"})}`)
@@ -4563,12 +4653,12 @@ function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       if (isStatic) {
         const ei = ctx.varCounter++
         const errVar = `_E${ei}`
-        const pathVal = pathExpr ? pathExpr.slice(1, -1) : ''
+        const pathVal = pathExpr ? literalValue(pathExpr) : ''
         ctx.closureVars.push(errVar)
-        ctx.closureVals.push(Object.freeze({keyword: 'required', instancePath: pathVal, schemaPath: `${schemaPrefix}/required`, params: Object.freeze({missingProperty: key}), message: `must have required property '${key}'`}))
-        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&!(${JSON.stringify(key)} in ${v})){(_e||(_e=[])).push(${errVar})}`)
+        ctx.closureVals.push(Object.freeze({keyword: 'required', instancePath: pathVal, schemaPath: unescapeSp(`${schemaPrefix}/required`), params: Object.freeze({missingProperty: key}), message: `must have required property '${key}'`}))
+        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&!${ownKeyExpr(ctx, v, key)}){(_e||(_e=[])).push(${errVar})}`)
       } else {
-        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&!(${JSON.stringify(key)} in ${v})){(_e||(_e=[])).push({keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/required'${ordinalField(ctx, `${schemaPrefix}/required`)},params:{missingProperty:'${esc(key)}'},message:"must have required property '${esc(key)}'"})}`)
+        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&!${ownKeyExpr(ctx, v, key)}){(_e||(_e=[])).push({keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/required'${ordinalField(ctx, `${schemaPrefix}/required`)},params:{missingProperty:'${esc(key)}'},message:"must have required property '${esc(key)}'"})}`)
       }
     }
   }
@@ -4728,12 +4818,12 @@ function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
         if (isStatic) {
           const ei = ctx.varCounter++
           const errVar = `_E${ei}`
-          const pathVal = pathExpr ? pathExpr.slice(1, -1) : ''
+          const pathVal = pathExpr ? literalValue(pathExpr) : ''
           ctx.closureVars.push(errVar)
-          ctx.closureVals.push(Object.freeze({keyword: 'required', instancePath: pathVal, schemaPath: `${schemaPrefix}/dependentRequired`, params: Object.freeze({missingProperty: dep}), message: `must have required property '${dep}'`}))
-          lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${JSON.stringify(key)} in ${v}&&!(${JSON.stringify(dep)} in ${v})){(_e||(_e=[])).push(${errVar})}`)
+          ctx.closureVals.push(Object.freeze({keyword: 'required', instancePath: pathVal, schemaPath: unescapeSp(`${schemaPrefix}/dependentRequired`), params: Object.freeze({missingProperty: dep}), message: `must have required property '${dep}'`}))
+          lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${ownKeyExpr(ctx, v, key)}&&!${ownKeyExpr(ctx, v, dep)}){(_e||(_e=[])).push(${errVar})}`)
         } else {
-          lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${JSON.stringify(key)} in ${v}&&!(${JSON.stringify(dep)} in ${v})){(_e||(_e=[])).push({keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/dependentRequired'${ordinalField(ctx, `${schemaPrefix}/dependentRequired`)},params:{missingProperty:'${esc(dep)}'},message:"must have required property '${esc(dep)}'"})}`)
+          lines.push(`if(typeof ${v}==='object'&&${v}!==null&&${ownKeyExpr(ctx, v, key)}&&!${ownKeyExpr(ctx, v, dep)}){(_e||(_e=[])).push({keyword:'required',instancePath:${pathExpr||'""'},schemaPath:'${schemaPrefix}/dependentRequired'${ordinalField(ctx, `${schemaPrefix}/dependentRequired`)},params:{missingProperty:'${esc(dep)}'},message:"must have required property '${esc(dep)}'"})}`)
         }
       }
     }
@@ -4745,16 +4835,17 @@ function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       const pv = hoisted[key] || `${v}[${JSON.stringify(key)}]`
       const childPath = childPathExpr(pathExpr, ptrSeg(key))
       if (requiredSet.has(key) && isObj) {
-        lines.push(`if(${pv}!==undefined){`)
+        // A hoisted local was already cleared if the value is only inherited.
+        lines.push(`if(${pv}!==undefined${hoisted[key] ? '' : '&&' + ownGuard(ctx, v, key)}){`)
         genCodeC(prop, pv, childPath, lines, ctx, schemaPrefix+'/properties/'+ptrSeg(key))
         lines.push(`}`)
       } else if (isObj) {
         const oi = ctx.varCounter++
-        lines.push(`{const _o${oi}=${v}[${JSON.stringify(key)}];if(_o${oi}!==undefined){`)
+        lines.push(`{const _o${oi}=${v}[${JSON.stringify(key)}];if(_o${oi}!==undefined&&${ownGuard(ctx, v, key)}){`)
         genCodeC(prop, `_o${oi}`, childPath, lines, ctx, schemaPrefix+'/properties/'+ptrSeg(key))
         lines.push(`}}`)
       } else {
-        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&${JSON.stringify(key)} in ${v}){`)
+        lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&${ownKeyExpr(ctx, v, key)}){`)
         genCodeC(prop, `${v}[${JSON.stringify(key)}]`, childPath, lines, ctx, schemaPrefix+'/properties/'+ptrSeg(key))
         lines.push(`}`)
       }
@@ -4870,7 +4961,7 @@ function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   // dependentSchemas
   if (schema.dependentSchemas) {
     for (const [key, depSchema] of Object.entries(schema.dependentSchemas)) {
-      lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&${JSON.stringify(key)} in ${v}){`)
+      lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&${ownKeyExpr(ctx, v, key)}){`)
       genCodeC(depSchema, v, pathExpr, lines, ctx, schemaPrefix+'/dependentSchemas/'+ptrSeg(key))
       lines.push(`}`)
     }

package/lib/shape-classifier.js

@@ -69,6 +69,15 @@ function isTier0Object(schema) {
     for (const r of schema.required) if (typeof r !== 'string') return false;
   }
   const props = schema.properties;
+  // The tier-0 validator checks presence through the per-property constraints,
+  // so a required name with no entry in properties was never checked at all:
+  // `{ type: 'object', required: ['id'] }` accepted `{}` until the schema moved
+  // to generated code, and for good when the generator declined it.
+  if (schema.required !== undefined) {
+    for (const r of schema.required) {
+      if (props === undefined || props === null || typeof props !== 'object' || !Object.prototype.hasOwnProperty.call(props, r)) return false;
+    }
+  }
   if (props === undefined) return true;
   if (typeof props !== 'object' || props === null || Array.isArray(props)) return false;
   const keys = Object.keys(props);

package/lib/tier0.js

@@ -41,6 +41,12 @@ const F_MULT = 16;
 
 // Build a constraint tuple for one primitive-typed property.
 // All fields have the same layout so every constraint shares one hidden class.
+// Names found on Object.prototype. For these a read of data[key] finds the
+// inherited value on every ordinary object, so presence is asked of the object
+// itself; see ownKeyExpr in js-compiler.js.
+const PROTO_NAMES = new Set([...Object.getOwnPropertyNames(Object.prototype), '__proto__']);
+const _hop = Object.prototype.hasOwnProperty;
+
 function primConstraint(key, propSchema) {
   const t = propSchema.type;
   const hasEnum = Array.isArray(propSchema.enum);
@@ -53,6 +59,7 @@ function primConstraint(key, propSchema) {
   if (typeof propSchema.multipleOf === 'number') numFlags |= F_MULT;
   return {
     key,
+    protoName: PROTO_NAMES.has(key),
     typeMask: TYPE_MASK[t] | 0,
     numFlags,
     hasEnum,
@@ -159,7 +166,10 @@ function tier0ValidateObject(plan, data) {
   let seenMask = 0;
   for (let i = 0; i < n; i++) {
     const c = cs[i];
-    const v = data[c.key];
+    let v = data[c.key];
+    // Presence is an own-property question: a value the object inherits is
+    // treated as absent, as the interpreted engine treats it.
+    if (v !== undefined && (c.protoName || data.__proto__ !== Object.prototype) && !_hop.call(data, c.key)) v = undefined;
     if (v === undefined) {
       if (reqMask & (1 << i)) return false;
       continue;

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.31.1';
+module.exports = '1.31.2';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.31.1",
+  "version": "1.31.2",
   "description": "JSON Schema validation that compiles for speed and still runs where code generation is blocked. Compiled and interpreted engines answer identically at 100% of the official suite. TypeScript inference, Standard Schema V1, and a build step that emits dependency-free modules.",
   "main": "index.js",
   "module": "index.mjs",
@@ -51,7 +51,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_scanner_differential.js && node tests/test_validate_json_scanner_cost.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_option.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_error_accumulator_collision.js && node tests/test_uri_helper_parity.js && node tests/test_uri_fast_path.js && node tests/test_extend_verdict.js && node tests/test_ipv4_regex.js && node tests/test_ipv6_fast_path.js && node tests/test_nested_recursion_decline.js && node tests/test_formats_single_pass.js && node tests/test_email_format_cost.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_deferred_def_scope.js && node tests/test_node_scoped_ctx_flags.js && node tests/test_fast_slot_exhaustion.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_additional_props_combined_cost.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_single_pass_errors.js && node tests/test_lazy_json_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_defaults_own_keys.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_targeted_positions.js && node tests/test_position_map_cost.js && node tests/test_targeted_positions_cost.js && node tests/test_aot_staleness.js && node tests/test_file_positions.js && node tests/test_aot_positions_cost.js && node tests/test_schema_hash.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_scanner_differential.js && node tests/test_validate_json_scanner_cost.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_option.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_error_accumulator_collision.js && node tests/test_uri_helper_parity.js && node tests/test_uri_fast_path.js && node tests/test_extend_verdict.js && node tests/test_ipv4_regex.js && node tests/test_ipv6_fast_path.js && node tests/test_nested_recursion_decline.js && node tests/test_generator_error_content.js && node tests/test_inherited_key_presence.js && node tests/test_formats_single_pass.js && node tests/test_email_format_cost.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_deferred_def_scope.js && node tests/test_node_scoped_ctx_flags.js && node tests/test_fast_slot_exhaustion.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_additional_props_combined_cost.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_single_pass_errors.js && node tests/test_lazy_json_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_defaults_own_keys.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_targeted_positions.js && node tests/test_position_map_cost.js && node tests/test_targeted_positions_cost.js && node tests/test_aot_staleness.js && node tests/test_file_positions.js && node tests/test_aot_positions_cost.js && node tests/test_schema_hash.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -121,13 +121,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.31.1",
-    "@ata-validator/native-darwin-x64": "1.31.1",
-    "@ata-validator/native-linux-arm64-gnu": "1.31.1",
-    "@ata-validator/native-linux-arm64-musl": "1.31.1",
-    "@ata-validator/native-linux-x64-gnu": "1.31.1",
-    "@ata-validator/native-linux-x64-musl": "1.31.1",
-    "@ata-validator/native-win32-x64": "1.31.1"
+    "@ata-validator/native-darwin-arm64": "1.31.2",
+    "@ata-validator/native-darwin-x64": "1.31.2",
+    "@ata-validator/native-linux-arm64-gnu": "1.31.2",
+    "@ata-validator/native-linux-arm64-musl": "1.31.2",
+    "@ata-validator/native-linux-x64-gnu": "1.31.2",
+    "@ata-validator/native-linux-x64-musl": "1.31.2",
+    "@ata-validator/native-win32-x64": "1.31.2"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"