ata-validator 1.34.0 → 1.36.0

package/lib/js-compiler.js

@@ -72,6 +72,8 @@ function apMembershipCheck (ctx, names, v) {
       return `var _apk${i}=Object.keys(${v});for(var _api${i}=0;_api${i}<_apk${i}.length;_api${i}++)if(${id}[_apk${i}[_api${i}]]===undefined)return false`
     }
   }
+  // With nothing declared every key is additional; `if()` would not parse.
+  if (names.length === 0) return `for(var _k in ${v})return false`
   return `for(var _k in ${v})if(${names.map((k) => `_k!==${JSON.stringify(k)}`).join('&&')})return false`
 }
 
@@ -304,17 +306,13 @@ function compileToJS(schema, defs, schemaMap) {
   if (schema.$dynamicRef) {
     const ref = schema.$dynamicRef
     const anchorName = ref.startsWith('#') ? ref : '#' + ref
-    if (rootDefs && rootDefs[anchorName]) {
-      const entry = rootDefs[anchorName]
-      checks.push((d) => { const fn = entry.fn; return fn ? fn(d) : true })
-    } else {
-      // JSON pointer: "#/$defs/foo" or "#/definitions/foo"
-      const m = ref.match(/^#\/(?:\$defs|definitions)\/(.+)$/)
-      if (m && rootDefs && rootDefs[m[1]]) {
-        const entry = rootDefs[m[1]]
-        checks.push((d) => { const fn = entry.fn; return fn ? fn(d) : true })
-      }
-    }
+    // Resolved at compile time; one that resolves to nothing, or to a
+    // definition that cannot compile, declines instead of checking nothing.
+    const m = ref.match(/^#\/(?:\$defs|definitions)\/(.+)$/)
+    const entry = rootDefs && (rootDefs[anchorName] || (m && rootDefs[m[1]]))
+    const fn = entry ? entry.fn : null
+    if (!fn) return null
+    checks.push(fn)
   }
 
   // type
@@ -634,6 +632,8 @@ function compileToJS(schema, defs, schemaMap) {
     })
   }
 
+  // A definition reached through a cycle and found uncompilable only later.
+  if (!defs && rootDefs && rootDefs[DEF_FAILED]) return null
   if (checks.length === 0) return () => true
   if (checks.length === 1) return checks[0]
 
@@ -646,86 +646,48 @@ function compileToJS(schema, defs, schemaMap) {
   }
 }
 
+// A definition compiled on first use. A reference into it made while it is
+// still compiling (a cycle) gets a function that calls the finished one when
+// it runs. One that fails to compile yields null, which the reference turns
+// into a decline, and marks the set so the root declines too: a cycle may have
+// reached it before the failure was known. It used to return an always-true
+// function for both, so a definition this path could not compile, such as one
+// containing `$ref: '#'`, accepted every value that reached it.
+const DEF_FAILED = Symbol('ata.defFailed')
+function lazyDefEntry (def, defs) {
+  let state = 0
+  let compiled = null
+  return {
+    get fn () {
+      if (state === 0) {
+        state = 1
+        compiled = compileToJS(def, defs)
+        state = 2
+        if (!compiled) defs[DEF_FAILED] = true
+      }
+      if (state === 1) return (d) => (compiled ? compiled(d) : false)
+      return compiled
+    },
+    raw: def,
+  }
+}
+
 function collectDefs(schema) {
   const defs = {}
   const raw = schema.$defs || schema.definitions
   if (raw && typeof raw === 'object') {
     for (const [name, def] of Object.entries(raw)) {
-      // Lazy compile with circular guard — return true (permissive) on cycle
-      let cached = undefined
-      defs[name] = {
-        get fn() {
-          if (cached === undefined) {
-            cached = null // sentinel: compilation in progress
-            cached = compileToJS(def, defs)
-          }
-          // cached===null means circular ref or compile failure — be permissive
-          return cached || (() => true)
-        },
-        raw: def
-      }
+      defs[name] = lazyDefEntry(def, defs)
       // Register anchors
       if (def && typeof def === 'object') {
-        if (def.$anchor) {
-          const anchorDef = def
-          let anchorCached = undefined
-          defs['#' + def.$anchor] = {
-            get fn() {
-              if (anchorCached === undefined) {
-                anchorCached = null
-                anchorCached = compileToJS(anchorDef, defs)
-              }
-              return anchorCached || (() => true)
-            },
-            raw: anchorDef
-          }
-        }
-        if (def.$dynamicAnchor) {
-          const daDef = def
-          let daCached = undefined
-          defs['#' + def.$dynamicAnchor] = {
-            get fn() {
-              if (daCached === undefined) {
-                daCached = null
-                daCached = compileToJS(daDef, defs)
-              }
-              return daCached || (() => true)
-            },
-            raw: daDef
-          }
-        }
+        if (def.$anchor) defs['#' + def.$anchor] = lazyDefEntry(def, defs)
+        if (def.$dynamicAnchor) defs['#' + def.$dynamicAnchor] = lazyDefEntry(def, defs)
       }
     }
   }
   // Register root-level $anchor/$dynamicAnchor (self-referencing schemas)
-  if (schema.$anchor && !defs['#' + schema.$anchor]) {
-    const rootAnchorSchema = schema
-    let rootACached = undefined
-    defs['#' + schema.$anchor] = {
-      get fn() {
-        if (rootACached === undefined) {
-          rootACached = null
-          rootACached = compileToJS(rootAnchorSchema, defs)
-        }
-        return rootACached || (() => true)
-      },
-      raw: rootAnchorSchema
-    }
-  }
-  if (schema.$dynamicAnchor && !defs['#' + schema.$dynamicAnchor]) {
-    const rootDASchema = schema
-    let rootDACached = undefined
-    defs['#' + schema.$dynamicAnchor] = {
-      get fn() {
-        if (rootDACached === undefined) {
-          rootDACached = null
-          rootDACached = compileToJS(rootDASchema, defs)
-        }
-        return rootDACached || (() => true)
-      },
-      raw: rootDASchema
-    }
-  }
+  if (schema.$anchor && !defs['#' + schema.$anchor]) defs['#' + schema.$anchor] = lazyDefEntry(schema, defs)
+  if (schema.$dynamicAnchor && !defs['#' + schema.$dynamicAnchor]) defs['#' + schema.$dynamicAnchor] = lazyDefEntry(schema, defs)
   return defs
 }
 
@@ -789,12 +751,12 @@ function resolveRef(ref, defs, schemaMap) {
     if (m) {
       const name = m[1]
       const entry = defs[name]
-      if (entry) return (d) => { const fn = entry.fn; return fn ? fn(d) : true }
+      if (entry) return entry.fn || null
     }
     // Anchor ref: "#foo"
     if (ref.startsWith('#') && !ref.startsWith('#/')) {
       const entry = defs[ref]
-      if (entry) return (d) => { const fn = entry.fn; return fn ? fn(d) : true }
+      if (entry) return entry.fn || null
     }
   }
   // A referenced schema that cannot itself be compiled must propagate the bail.
@@ -865,7 +827,7 @@ function _canonical(x) {
   return '{' + Object.keys(x).sort().map((k) => JSON.stringify(k) + ':' + _canonical(x[k])).join(',') + '}'
 }
 
-const _formats = require('./formats')
+const _formats = { ...require('./formats'), ...require('./formats-source') }
 // The closure path's formats. It carried its own idea of an email and knew
 // five formats in all, so a schema that reached it was told "valid" for
 // anything the other engines turned away; the first call on a fresh validator
@@ -953,9 +915,16 @@ function protoIs (ctx, v) {
   useOwnHelper(ctx, '_PN')
   return `((_PN?${v}.__proto__:_gp(${v}))===_OP)`
 }
+// The flag withPlain declared for `v`, if any, recorded as used when read so
+// withPlain can drop an unused declaration without searching the code for it.
+function plainFlag (ctx, v) {
+  const pk = ctx.plainOf ? ctx.plainOf.get(v) : undefined
+  if (pk !== undefined) (ctx.plainUsed || (ctx.plainUsed = new Set())).add(pk)
+  return pk
+}
 function ownKeyExpr (ctx, v, key) {
   const k = JSON.stringify(key)
-  const pk = ctx.plainOf ? ctx.plainOf.get(v) : undefined
+  const pk = plainFlag(ctx, v)
   useOwnHelper(ctx, PROTO_NAMES.has(key) || pk !== undefined ? '_h' : '_ok')
   if (PROTO_NAMES.has(key)) return `_h(${v},${k})`
   return pk !== undefined ? `(${pk}?${k} in ${v}:_h(${v},${k}))` : `(${k} in ${v}&&_ok(${v},${k}))`
@@ -964,7 +933,7 @@ function ownKeyExpr (ctx, v, key) {
 // it came from `v` itself. `in` is known to hold, so only the second half runs.
 function ownGuard (ctx, v, key) {
   const k = JSON.stringify(key)
-  const pk = ctx.plainOf ? ctx.plainOf.get(v) : undefined
+  const pk = plainFlag(ctx, v)
   useOwnHelper(ctx, PROTO_NAMES.has(key) || pk !== undefined ? '_h' : '_ok')
   if (PROTO_NAMES.has(key)) return `_h(${v},${k})`
   return pk !== undefined ? `(${pk}||_h(${v},${k}))` : `_ok(${v},${k})`
@@ -993,9 +962,10 @@ function withPlain (schema, v, lines, ctx, run) {
     else ctx.plainOf.set(v, prev)
     // A node whose keys are all typed never reads the flag; declaring it
     // anyway cost a strict-object check about five percent. Unused, it goes.
-    const re = new RegExp('\\b' + name + '\\b')
-    let used = false
-    for (let i = at + 1; i < lines.length && !used; i++) if (re.test(lines[i])) used = true
+    // Readers record the flag through plainFlag(); searching the lines this
+    // node emitted for its name instead made every ancestor scan its whole
+    // subtree again, 2.2 of the 5 seconds a 7.6 MB schema took to compile.
+    const used = ctx.plainUsed !== undefined && ctx.plainUsed.has(name)
     if (!used && lines[at] === decl) lines.splice(at, 1)
   }
 }
@@ -1157,6 +1127,21 @@ function hasNestedIdScope(node, isRoot = true) {
 // only safe way out.
 const DECLINE = Symbol('ata.decline')
 
+// How much source the verdict generator may hoist before it hands the schema to
+// the interpreted engine. Across the 977 SchemaStore schemas the median emits
+// 11 KB and the largest ordinary one, SARIF, 3.4 MB; Kestra's emitted 75 MB and
+// took 7.3 seconds and 1.6 GB before its first answer, which the interpreted
+// engine gives in about 0.4 seconds.
+const CODE_BUDGET = 16 * 1024 * 1024
+let codeBudget = CODE_BUDGET
+function hoist (ctx, code) {
+  ctx.preamble.push(code)
+  ctx.preambleChars = (ctx.preambleChars || 0) + code.length
+  if (ctx.preambleChars > codeBudget) throw DECLINE
+}
+// For tests: a budget small enough to reach with a schema that fits in a test.
+function _setCodeBudget (n) { codeBudget = n === undefined ? CODE_BUDGET : n }
+
 // The error and combined generators compile the subschemas of not, if, contains
 // and their anyOf/oneOf closures with the boolean generator. That generator
 // follows a reference back to the root with `_validate` and a reference cycle
@@ -1243,6 +1228,15 @@ function cyclicDefNames (defs) {
   return out
 }
 
+// Keys beside a $ref that change nothing about validation: schema organization,
+// the annotation vocabulary, and the annotation keys editors read.
+const REF_NEUTRAL_SIBLINGS = new Set([
+  '$ref', '$defs', 'definitions', '$schema', '$id', '$dynamicAnchor', '$anchor', '$comment',
+  'title', 'description', 'default', 'examples', 'deprecated', 'readOnly', 'writeOnly',
+  'markdownDescription', 'deprecationMessage', 'markdownDeprecationMessage', 'enumDescriptions',
+  'markdownEnumDescriptions', 'defaultSnippets', 'doNotSuggest', 'suggestSortText',
+])
+
 function codegenSafe(schema, schemaMap) {
   if (typeof schema === 'boolean') return true
   if (typeof schema !== 'object' || schema === null) return true
@@ -1258,7 +1252,10 @@ function codegenSafe(schema, schemaMap) {
   // Boolean sub-schemas anywhere cause bail — codegen doesn't handle schema=false correctly
   // items: false and items: true are constants; every generator handles a
   // boolean child at its head, so neither falls through as "nothing".
-  if (schema.additionalProperties === true) return true // permissive — fine
+  // `additionalProperties: true` needs no check of its own, and it says nothing
+  // about the rest of the node: returning early here waved the whole subtree
+  // through, so a nested construct the generator cannot express was dropped
+  // instead of declined, from 1.0.0 to 1.35.0.
   if (schema.properties) {
     for (const v of Object.values(schema.properties)) {
       if (typeof v === 'boolean') continue // constants; every generator handles them at its head
@@ -1316,10 +1313,15 @@ function codegenSafe(schema, schemaMap) {
       if (!targetSimple && schema.unevaluatedProperties === undefined && schema.unevaluatedItems === undefined) return false
     }
     // In Draft 2020-12, $ref with siblings is allowed. Only bail if no unevaluated* keyword
-    // (unevaluated schemas need $ref + siblings to work properly)
-    // Schema-organization keywords ($dynamicAnchor, $anchor) are not validation siblings
-    const SCHEMA_ORG_KEYS = new Set(['$ref', '$defs', 'definitions', '$schema', '$id', '$dynamicAnchor', '$anchor'])
-    const siblings = Object.keys(schema).filter(k => !SCHEMA_ORG_KEYS.has(k))
+    // (unevaluated schemas need $ref + siblings to work properly): without one, the
+    // generators emit the $ref and skip the rest of the node, so a sibling that
+    // validates would be dropped. Schema-organization keywords and annotations
+    // validate nothing and do not count. Annotations are listed rather than
+    // inferred from what is not a validation keyword, so a keyword this list
+    // does not know still declines instead of being skipped. Measured on the
+    // 977 SchemaStore schemas: a $ref with a description or title beside it sent
+    // 223 of them to the interpreted engine.
+    const siblings = Object.keys(schema).filter(k => !REF_NEUTRAL_SIBLINGS.has(k) && !k.startsWith('x-'))
     if (siblings.length > 0 && schema.unevaluatedProperties === undefined && schema.unevaluatedItems === undefined) return false
   }
 
@@ -1333,7 +1335,6 @@ function codegenSafe(schema, schemaMap) {
   if (typeof schema.additionalProperties === 'object' && schema.additionalProperties !== null) {
     if (!codegenSafe(schema.additionalProperties, schemaMap)) return false
   }
-  if (schema.additionalProperties === false && !schema.properties) return false
 
   // propertyNames: false — codegen doesn't handle this
   // propertyNames: false is emitted as a per-key rejection by every generator.
@@ -1386,6 +1387,26 @@ function codegenSafe(schema, schemaMap) {
     }
   }
 
+  // The same checks compileToJSCodegen makes on the root, at every depth. They
+  // were made on the root only, so a nested patternProperties with a Unicode
+  // property escape, or a nested propertyNames the generators cannot express,
+  // compiled to code that ignored it.
+  if (schema.patternProperties) {
+    for (const [pat, sub] of Object.entries(schema.patternProperties)) {
+      if (/\\[pP]\{/.test(pat)) return false
+      if (typeof sub === 'object' && sub !== null && !codegenSafe(sub, schemaMap)) return false
+    }
+  }
+  if (schema.dependentSchemas) {
+    for (const sub of Object.values(schema.dependentSchemas)) {
+      if (typeof sub === 'object' && sub !== null && !codegenSafe(sub, schemaMap)) return false
+    }
+  }
+  if (typeof schema.propertyNames === 'object' && schema.propertyNames !== null) {
+    const supported = ['maxLength', 'minLength', 'pattern', 'const', 'enum']
+    if (Object.keys(schema.propertyNames).some(k => k !== '$schema' && !supported.includes(k))) return false
+  }
+
   // Recurse into sub-schemas — bail on boolean schemas in any position
   // A boolean subschema is a constant that every generator emits at its
   // head with the child's own path. The emitters below test for presence,
@@ -1749,7 +1770,12 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
 
   const ctx = { varCounter: 0, helpers: [], helperCode: [], preamble: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen], rootDefs, refStack: new Set(), schemaMap: schemaMap || null, anchors, rootSchema: schema, userFormats: userFormats || null, removeNodes }
   const lines = []
-  genCode(schema, 'd', lines, ctx)
+  try {
+    genCode(schema, 'd', lines, ctx)
+  } catch (e) {
+    if (e === DECLINE) return null
+    throw e
+  }
 
   // Append deferred checks (additionalProperties, unevaluatedProperties) at the end
   if (ctx.deferredChecks) {
@@ -2224,7 +2250,7 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
       // When withPlain already holds the answer for this object in a flag,
       // read the flag: the prototype test is an accessor call, and making it
       // twice per object was a tenth of a plain order's verdict.
-      const pk = ctx.plainOf ? ctx.plainOf.get(v) : undefined
+      const pk = plainFlag(ctx, v)
       lines.push(`if(!${pk || protoIs(ctx, v)}&&!_hall(${v},${JSON.stringify(typed)}))return false`)
     }
   } else if (schema.required && schema.required.length > 0) {
@@ -2375,14 +2401,17 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
       loop = `{var ${n}=0;for(var ${kv} in ${v})${n}++;if(${n}!==${declared.length}){${loop}}}`
     }
     _deferOrInline(ctx, lines, v, isObj ? loop : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${loop}}`)
-  } else if (schema.additionalProperties === false && schema.properties && !schema.patternProperties) {
-    const propCount = Object.keys(schema.properties).length
+  } else if (schema.additionalProperties === false && !schema.patternProperties) {
+    // No `properties` means nothing is declared, so every key is additional.
+    // The generators used to emit nothing for that shape, and the safety gate
+    // declined it everywhere; at any depth it now compiles.
+    const propCount = Object.keys(schema.properties || {}).length
     const allRequired = schema.required && schema.required.length === propCount
     const inner = allRequired
       ? (propCount <= 15
           ? `var _n=0;for(var _k in ${v})_n++;if(_n!==${propCount})return false`
           : `if(Object.keys(${v}).length!==${propCount})return false`)
-      : apMembershipCheck(ctx, Object.keys(schema.properties), v)
+      : apMembershipCheck(ctx, Object.keys(schema.properties || {}), v)
         _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
   }
 
@@ -2650,18 +2679,33 @@ function genContainsNode(schema, v, lines, ctx, knownType, isArr) {
 function genAnyOfNode(schema, v, lines, ctx, knownType) {
   const fi = ctx.varCounter++
   const branchBodies = []
+  const reused = []
   let canHoist = !!ctx.preamble
+  // Branch reuse as in genOneOfNode; anyOf branches take `_av`, so they keep
+  // their own map.
+  if (canHoist && !ctx.hoistedAny) ctx.hoistedAny = new Map()
   for (let i = 0; i < schema.anyOf.length; i++) {
+    const sub = schema.anyOf[i]
+    const key = canHoist ? branchKey(sub, ctx) : undefined
+    const known = key !== undefined ? ctx.hoistedAny.get(key) : undefined
+    if (known !== undefined) {
+      reused[i] = known.name
+      branchBodies.push(known.body)
+      continue
+    }
     const subLines = []
-    genCode(schema.anyOf[i], '_av', subLines, ctx)
+    genCode(sub, '_av', subLines, ctx)
     const body = subLines.length === 0 ? 'return true' : `${subLines.join(';')};return true`
     if (/\b_validate\b/.test(body)) canHoist = false
     branchBodies.push(body)
   }
   if (canHoist) {
     const names = branchBodies.map((body, i) => {
+      if (reused[i] !== undefined) return reused[i]
       const name = `_af${fi}_b${i}`
-      ctx.preamble.push(`function ${name}(_av){${body}}`)
+      hoist(ctx, `function ${name}(_av){${body}}`)
+      const key = branchKey(schema.anyOf[i], ctx)
+      if (key !== undefined) ctx.hoistedAny.set(key, { name, body })
       return name
     })
     const checks = names.map(n => `${n}(${v})`).join('||')
@@ -2672,13 +2716,46 @@ function genAnyOfNode(schema, v, lines, ctx, knownType) {
   }
 }
 
+// What identifies a oneOf branch for reuse: the schema object, or for a branch
+// that is only a local $ref beside annotations, the reference itself, since
+// `{ $ref: '#/definitions/X' }` is a new object at every place it is written.
+// A reference means the same thing everywhere only when no nested $id opens
+// another base URI, so that is checked once per compilation.
+const SCOPE_KEYS = new Set(['$id', '$defs', 'definitions', '$schema', '$anchor', '$dynamicAnchor'])
+function branchKey (sub, ctx) {
+  if (typeof sub !== 'object' || sub === null) return undefined
+  if (typeof sub.$ref === 'string' && sub.$ref.startsWith('#') &&
+      Object.keys(sub).every(k => (REF_NEUTRAL_SIBLINGS.has(k) && !SCOPE_KEYS.has(k)) || k.startsWith('x-'))) {
+    if (ctx.refKeysSafe === undefined) ctx.refKeysSafe = !hasNestedIdScope(ctx.rootSchema)
+    if (ctx.refKeysSafe) return 'ref:' + sub.$ref
+  }
+  return sub
+}
+
 function genOneOfNode(schema, v, lines, ctx, knownType) {
   const fi = ctx.varCounter++
   const branchBodies = []
+  const reused = []
   let canHoist = !!ctx.preamble
+  // A branch schema object already emitted as a hoisted function is called
+  // again rather than generated again. The same oneOf reached through many
+  // $refs was expanded at every one: SchemaStore's Kestra schema, a oneOf of
+  // several hundred task types referenced from each task list, produced
+  // 86919 branch functions and 197 MB of source, and took seconds to build.
+  // A hoisted branch takes its input as a parameter and reads only
+  // module-level names, so the same schema object gives the same function.
+  if (canHoist && !ctx.hoistedBranch) ctx.hoistedBranch = new Map()
   for (let i = 0; i < schema.oneOf.length; i++) {
+    const sub = schema.oneOf[i]
+    const key = canHoist ? branchKey(sub, ctx) : undefined
+    const known = key !== undefined ? ctx.hoistedBranch.get(key) : undefined
+    if (known !== undefined) {
+      reused[i] = known.name
+      branchBodies.push(known.body)
+      continue
+    }
     const subLines = []
-    genCode(schema.oneOf[i], '_ov', subLines, ctx)
+    genCode(sub, '_ov', subLines, ctx)
     const body = subLines.length === 0 ? 'return true' : `${subLines.join(';')};return true`
     // _validate is the recursive entry — hoisting branches above it breaks scope.
     if (/\b_validate\b/.test(body)) canHoist = false
@@ -2686,8 +2763,11 @@ function genOneOfNode(schema, v, lines, ctx, knownType) {
   }
   if (canHoist) {
     const names = branchBodies.map((body, i) => {
+      if (reused[i] !== undefined) return reused[i]
       const name = `_of${fi}_b${i}`
-      ctx.preamble.push(`function ${name}(_ov){${body}}`)
+      hoist(ctx, `function ${name}(_ov){${body}}`)
+      const key = branchKey(schema.oneOf[i], ctx)
+      if (key !== undefined) ctx.hoistedBranch.set(key, { name, body })
       return name
     })
     const calls = names.map(n => `if(${n}(${v})){_oc${fi}++;if(_oc${fi}>1)return false}`).join(';')
@@ -2769,11 +2849,17 @@ function genRefNode(schema, v, lines, ctx, knownType, hasSiblings) {
         genCode(ctx.rootDefs[defName], 'd', bodyLines, ctx)
         if (ctx.deferredChecks) for (const dc of ctx.deferredChecks) bodyLines.push(dc)
         ctx.deferredChecks = outerDeferred
+        // The def is hoisted above the entry function, where the recursive
+        // entry `_validate` is not in scope; a body that calls it (a `$ref: '#'`
+        // inside the def) threw a ReferenceError at the first document that
+        // reached it. SchemaStore's jsone schema is such a case. Decline, as
+        // oneOf and anyOf do not hoist such a branch.
+        if (bodyLines.some((l) => /\b_validate\b/.test(l))) throw DECLINE
         // Entered through the cycle guard: see emitGuardState. In the fast
         // pass the wrapper only counts depth; the set is used by the second,
         // guarded pass that runs when data turns out to point back at
         // itself.
-        ctx.preamble.push(
+        hoist(ctx,
           `const ${fnName}_s=new Set()\n  function ${fnName}(d){\n  ` +
             `if(_sg){if(typeof d!=='object'||d===null)return ${fnName}_b(d);if(${fnName}_s.has(d))return true;${fnName}_s.add(d);try{return ${fnName}_b(d)}finally{${fnName}_s.delete(d)}}\n  ` +
             `if(++_sd>${CYCLE_DEPTH})throw _CYC\n  const _r=${fnName}_b(d)\n  _sd--\n  return _r\n  }\n  ` +
@@ -2864,7 +2950,7 @@ function genPatternPropertiesNode(schema, v, lines, ctx, knownType, isObj) {
   const guard = isObj ? '' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v}))`
 
   const apSchema = typeof schema.additionalProperties === 'object' && schema.additionalProperties !== null ? schema.additionalProperties : null
-  if ((schema.additionalProperties === false && schema.properties) || apSchema) {
+  if (schema.additionalProperties === false || apSchema) {
     // Unified loop: properties + patterns + propertyNames + additionalProperties.
     // A key that is neither declared nor matched by any pattern is
     // additional: rejected outright, or run through the additionalProperties
@@ -4231,7 +4317,7 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     const inlineCheck = compilePatternInline(schema.pattern, v)
     if (inlineCheck) {
       const c = isStr ? `!(${inlineCheck})` : `typeof ${v}==='string'&&!(${inlineCheck})`
-      lines.push(`if(${c}){${fail('pattern', 'pattern', `{pattern:${JSON.stringify(schema.pattern)}}`, `'must match pattern "${schema.pattern}"'`)}}`)
+      lines.push(`if(${c}){${fail('pattern', 'pattern', `{pattern:${JSON.stringify(schema.pattern)}}`, JSON.stringify(`must match pattern "${schema.pattern}"`))}}`)
     } else {
       const pattern = JSON.stringify(schema.pattern);
       if (!ctx.regExpMap.has(pattern)) {
@@ -4246,7 +4332,7 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       }
       const ri = ctx.regExpMap.get(pattern);
       const c = isStr ? `!_re${ri}.test(${v})` : `typeof ${v}==='string'&&!_re${ri}.test(${v})`
-      lines.push(`if(${c}){${fail('pattern', 'pattern', `{pattern:${JSON.stringify(schema.pattern)}}`, `'must match pattern "${schema.pattern}"'`)}}`)
+      lines.push(`if(${c}){${fail('pattern', 'pattern', `{pattern:${JSON.stringify(schema.pattern)}}`, JSON.stringify(`must match pattern "${schema.pattern}"`))}}`)
     }
   }
   if (schema.format) {
@@ -4301,7 +4387,7 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
 
   // additionalProperties: false. A key matched by any patternProperties
   // entry is not additional, so those patterns are consulted here as well.
-  if (schema.additionalProperties === false && (schema.properties || schema.patternProperties)) {
+  if (schema.additionalProperties === false) {
     const allowed = Object.keys(schema.properties || {}).map(k => `${JSON.stringify(k)}`).join(',')
     const ci = ctx.varCounter++
     const apSp = `${schemaPrefix}/additionalProperties`
@@ -4519,7 +4605,7 @@ function genPatternPropertiesE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     const _peFn = emitPtrEsc(ctx)
     const p = pathExpr ? `${pathExpr}+'/'+${_peFn}(_k${ki})` : `'/'+${_peFn}(_k${ki})`
     // The real pointer, so source maps can locate the failing keyword.
-    genCodeE(sub, `${v}[_k${ki}]`, p, lines, ctx, schemaPrefix + '/patternProperties/' + pat.replace(/~/g, '~0').replace(/\//g, '~1'))
+    genCodeE(sub, `${v}[_k${ki}]`, p, lines, ctx, schemaPrefix + '/patternProperties/' + ptrSeg(pat))
     lines.push(`}}}`)
   }
 }
@@ -4595,7 +4681,7 @@ function genPropertyNamesE(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
       }
     }
     const ri = ctx.regExpMap.get(pattern);
-    lines.push(`if(!_re${ri}.test(_k${ki})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, `'must match pattern "${pn.pattern}"'`)}}`)
+    lines.push(`if(!_re${ri}.test(_k${ki})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, JSON.stringify(`must match pattern "${pn.pattern}"`))}}`)
   }
   if (pn.const !== undefined) {
     lines.push(`if(_k${ki}!==${JSON.stringify(pn.const)}){${fail('const', 'propertyNames/const', `{allowedValue:${JSON.stringify(pn.const)}}`, "'must be equal to constant'")}}`)
@@ -4625,9 +4711,9 @@ function genContainsE(schema, v, pathExpr, lines, ctx, schemaPrefix, fail) {
   const minC = schema.minContains !== undefined ? schema.minContains : 1
   const maxC = schema.maxContains
   lines.push(`if(Array.isArray(${v})){const _cf${ci}=function(_cv){${fnBody}};let _cc${ci}=0;for(let _ci${ci}=0;_ci${ci}<${v}.length;_ci${ci}++){if(_cf${ci}(${v}[_ci${ci}]))_cc${ci}++}`)
-  lines.push(`if(_cc${ci}<${minC}){${fail('contains', 'contains', `{minContains:${minC}}`, `'contains: need at least ${minC} match(es)'`)}}`)
+  lines.push(`if(_cc${ci}<${minC}){${fail('contains', 'contains', `{minContains:${minC}}`, `'must contain at least ${minC} valid item(s)'`)}}`)
   if (maxC !== undefined) {
-    lines.push(`if(_cc${ci}>${maxC}){${fail('contains', 'contains', `{minContains:${minC},maxContains:${maxC}}`, `'contains: at most ${maxC} match(es)'`)}}`)
+    lines.push(`if(_cc${ci}>${maxC}){${fail('contains', 'contains', `{minContains:${minC},maxContains:${maxC}}`, `'must NOT contain more than ${maxC} valid item(s)'`)}}`)
   }
   lines.push(`}`)
 }
@@ -5019,14 +5105,14 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     const inlineCheck = compilePatternInline(schema.pattern, v)
     if (inlineCheck) {
       const c = isStr ? `!(${inlineCheck})` : `typeof ${v}==='string'&&!(${inlineCheck})`
-      lines.push(`if(${c}){${fail('pattern', 'pattern', `{pattern:${JSON.stringify(schema.pattern)}}`, `'must match pattern "${schema.pattern}"'`)}}`)
+      lines.push(`if(${c}){${fail('pattern', 'pattern', `{pattern:${JSON.stringify(schema.pattern)}}`, JSON.stringify(`must match pattern "${schema.pattern}"`))}}`)
     } else {
       const ri = ctx.varCounter++
       const reVar = `_re${ri}`
       ctx.closureVars.push(reVar)
       ctx.closureVals.push(patternIsSafe(schema.pattern) ? compileSafe(schema.pattern) : new RegExp(schema.pattern))
       const c = isStr ? `!${reVar}.test(${v})` : `typeof ${v}==='string'&&!${reVar}.test(${v})`
-      lines.push(`if(${c}){${fail('pattern', 'pattern', `{pattern:${JSON.stringify(schema.pattern)}}`, `'must match pattern "${schema.pattern}"'`)}}`)
+      lines.push(`if(${c}){${fail('pattern', 'pattern', `{pattern:${JSON.stringify(schema.pattern)}}`, JSON.stringify(`must match pattern "${schema.pattern}"`))}}`)
     }
   }
   if (schema.format) {
@@ -5062,8 +5148,8 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
 
   // additionalProperties — skip if patternProperties present (handled in unified loop below)
   // Small property sets: direct === chain (no Set allocation)
-  if (schema.additionalProperties === false && schema.properties && !schema.patternProperties) {
-    const propKeys = Object.keys(schema.properties)
+  if (schema.additionalProperties === false && !schema.patternProperties) {
+    const propKeys = Object.keys(schema.properties || {})
     const ci = ctx.varCounter++
     // The error has to name the offending property, so the keys have to be
     // materialised to report one. They do not have to be materialised to find
@@ -5077,8 +5163,10 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     let body
     if (propKeys.length <= 8) {
       // Direct chain: no Set allocation for small schemas
-      const gate = propKeys.map(k => `_f${ci}!==${JSON.stringify(k)}`).join('&&')
-      const checks = propKeys.map(k => `_k${ci}[_i]!==${JSON.stringify(k)}`).join('&&')
+      // With nothing declared every key is additional: an empty chain would
+      // leave `if()`, so the test is `true`.
+      const gate = propKeys.map(k => `_f${ci}!==${JSON.stringify(k)}`).join('&&') || 'true'
+      const checks = propKeys.map(k => `_k${ci}[_i]!==${JSON.stringify(k)}`).join('&&') || 'true'
       body = `let _x${ci}=0;for(const _f${ci} in ${v}){if(${gate}){_x${ci}=1;break}}if(_x${ci}){${detail(checks)}}`
     } else {
       const allowed = propKeys.map(k => JSON.stringify(k)).join(',')
@@ -5297,9 +5385,9 @@ function genPatternPropertiesC(schema, v, pathExpr, lines, ctx, schemaPrefix, fa
   const guard = isObj ? '' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v}))`
   const kVar = `_k${pi}`
 
-  if (schema.additionalProperties === false && schema.properties) {
+  if (schema.additionalProperties === false) {
     handledPropertyNames = !!pn
-    const propKeys = Object.keys(schema.properties)
+    const propKeys = Object.keys(schema.properties || {})
     // Inline key comparison for small property sets
     const keyCheck = propKeys.length <= 8
       ? propKeys.map(k => `${kVar}===${JSON.stringify(k)}`).join('||')
@@ -5318,12 +5406,12 @@ function genPatternPropertiesC(schema, v, pathExpr, lines, ctx, schemaPrefix, fa
       if (pn.pattern) {
         const fast = fastPrefixCheck(pn.pattern, kVar)
         if (fast) {
-          lines.push(`if(!(${fast})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, `'must match pattern "${pn.pattern}"'`)}}`)
+          lines.push(`if(!(${fast})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, JSON.stringify(`must match pattern "${pn.pattern}"`))}}`)
         } else {
           const ri = ctx.varCounter++
           ctx.closureVars.push(`_re${ri}`)
           ctx.closureVals.push(safeReClosure(ctx, pn.pattern))
-          lines.push(`if(!_re${ri}.test(${kVar})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, `'must match pattern "${pn.pattern}"'`)}}`)
+          lines.push(`if(!_re${ri}.test(${kVar})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, JSON.stringify(`must match pattern "${pn.pattern}"`))}}`)
         }
       }
       if (pn.const !== undefined) lines.push(`if(${kVar}!==${JSON.stringify(pn.const)}){${fail('const', 'propertyNames/const', `{allowedValue:${JSON.stringify(pn.const)}}`, "'must be equal to constant'")}}`)
@@ -5354,12 +5442,12 @@ function genPatternPropertiesC(schema, v, pathExpr, lines, ctx, schemaPrefix, fa
       if (pn.pattern) {
         const fast = fastPrefixCheck(pn.pattern, kVar)
         if (fast) {
-          lines.push(`if(!(${fast})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, `'must match pattern "${pn.pattern}"'`)}}`)
+          lines.push(`if(!(${fast})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, JSON.stringify(`must match pattern "${pn.pattern}"`))}}`)
         } else {
           const ri = ctx.varCounter++
           ctx.closureVars.push(`_re${ri}`)
           ctx.closureVals.push(safeReClosure(ctx, pn.pattern))
-          lines.push(`if(!_re${ri}.test(${kVar})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, `'must match pattern "${pn.pattern}"'`)}}`)
+          lines.push(`if(!_re${ri}.test(${kVar})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, JSON.stringify(`must match pattern "${pn.pattern}"`))}}`)
         }
       }
       if (pn.const !== undefined) lines.push(`if(${kVar}!==${JSON.stringify(pn.const)}){${fail('const', 'propertyNames/const', `{allowedValue:${JSON.stringify(pn.const)}}`, "'must be equal to constant'")}}`)
@@ -5408,7 +5496,7 @@ function genPropertyNamesC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
     const ri = ctx.varCounter++
     ctx.closureVars.push(`_re${ri}`)
     ctx.closureVals.push(safeReClosure(ctx, pn.pattern))
-    lines.push(`if(!_re${ri}.test(_k${ki})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, `'must match pattern "${pn.pattern}"'`)}}`)
+    lines.push(`if(!_re${ri}.test(_k${ki})){${fail('pattern', 'propertyNames/pattern', `{pattern:${JSON.stringify(pn.pattern)}}`, JSON.stringify(`must match pattern "${pn.pattern}"`))}}`)
   }
   if (pn.const !== undefined) {
     lines.push(`if(_k${ki}!==${JSON.stringify(pn.const)}){${fail('const', 'propertyNames/const', `{allowedValue:${JSON.stringify(pn.const)}}`, "'must be equal to constant'")}}`)
@@ -5439,8 +5527,8 @@ function genContainsC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail) {
   const minC = schema.minContains !== undefined ? schema.minContains : 1
   const maxC = schema.maxContains
   lines.push(`if(Array.isArray(${v})){const _cf${ci}=function(_cv){${fnBody}};let _cc${ci}=0;for(let _ci${ci}=0;_ci${ci}<${v}.length;_ci${ci}++){if(_cf${ci}(${v}[_ci${ci}]))_cc${ci}++}`)
-  lines.push(`if(_cc${ci}<${minC}){${fail('contains', 'contains', `{minContains:${minC}}`, `'contains: need at least ${minC} match(es)'`)}}`)
-  if (maxC !== undefined) lines.push(`if(_cc${ci}>${maxC}){${fail('contains', 'contains', `{minContains:${minC},maxContains:${maxC}}`, `'contains: at most ${maxC} match(es)'`)}}`)
+  lines.push(`if(_cc${ci}<${minC}){${fail('contains', 'contains', `{minContains:${minC}}`, `'must contain at least ${minC} valid item(s)'`)}}`)
+  if (maxC !== undefined) lines.push(`if(_cc${ci}>${maxC}){${fail('contains', 'contains', `{minContains:${minC},maxContains:${maxC}}`, `'must NOT contain more than ${maxC} valid item(s)'`)}}`)
   lines.push(`}`)
 }
 
@@ -5609,4 +5697,4 @@ function _collectEval(schema, result, defs, schemaMap, refStack, isRoot) {
   // not → contributes nothing (spec: annotations from not are discarded)
 }
 
-module.exports = { compileToJS, compileToJSCodegen, compileToJSCodegenWithErrors, compileToJSCombined, collectEvaluated, unevalContributions, AJV_MESSAGES }
+module.exports = { compileToJS, compileToJSCodegen, compileToJSCodegenWithErrors, compileToJSCombined, collectEvaluated, unevalContributions, AJV_MESSAGES, _setCodeBudget }