ata-validator 1.39.1 → 1.40.0

package/README.md

@@ -4,6 +4,7 @@ JSON Schema validation that compiles for speed and still runs where code generat
 
 [![npm](https://img.shields.io/npm/v/ata-validator)](https://www.npmjs.com/package/ata-validator)
 [![License](https://img.shields.io/npm/l/ata-validator)](LICENSE)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ata-core/ata-validator/badge)](https://scorecard.dev/viewer/?uri=github.com/ata-core/ata-validator)
 
 1.0 is a stability commitment: see [docs/STABILITY.md](docs/STABILITY.md) for the semver, deprecation, and error-code guarantees.
 
@@ -69,6 +70,8 @@ if (isValid(req.body)) {
 
 The `.compiled.mjs` modules are self-contained: zero runtime dependency on ata-validator, fully tree-shakeable, with TypeScript types emitted alongside.
 
+Code already written with `new Validator(schema)` gets the same result from the bundler plugin, without changes: [`@ata-project/unplugin`](https://github.com/ata-core/unplugin-ata) replaces each call whose schema is known at build time with a compiled validator that answers the same, and the runtime leaves the bundle. For the plugin's three-schema test entry a minified Vite build goes from 122.5 KB to 16.7 KB gzipped on ata 1.39.2. Schemas that arrive at runtime keep the runtime, which is the right tool for them.
+
 ## Measured by others
 
 Public harnesses run ata without ata's involvement. Quote these before anything in this
@@ -187,16 +190,16 @@ const v = new Validator(schema, { source: { path: 'schemas/user.json', content:
 const r = v.validateJSON(input)
 if (!r.valid) {
   console.error(renderPretty(r.errors))
-  // error[ATA3001]: value does not match format "email"
-  //   --> schemas/user.json:5:7
+  // error[ATA3001]: not a valid email: "not-an-email"
+  //   --> schemas/user.json:5:44
   //    |
-  //  5 |       "email": { "type": "string", "format": "email" }
-  //    |       ^^^^^^^  expected format 'email'
+  //  5 |     "email": { "type": "string", "format": "email" },
+  //    |                                            ^  expected format 'email'
   //    |
-  //   --> input, byte 23
+  //   --> input:1:24  (body.email)
   //    |
-  //  1 | {"name":"M","email":"not-an-email","age":-3}
-  //    |                     ^^^^^^^^^^^^^^  got "not-an-email"
+  //  1 | {"name":"Mert","email":"not-an-email","age":26}
+  //    |                        ^^^^^^^^^^^^^^  found "not-an-email"
   //    |
   //    = help: missing '@' and domain part
   //    = note: see https://ata-validator.com/e/ATA3001
@@ -259,7 +262,8 @@ for. Speed is the same either way once warm.
 
 **In a browser, on an edge runtime, or anywhere cold starts are charged, compile.** This
 is where the difference is the whole story, and it is also where `new Function` is often
-blocked outright, which the compiled module does not need.
+blocked outright, which the compiled module does not need. With a bundler, adding `@ata-project/unplugin`
+is enough: it compiles `new Validator(schema)` calls at build time, and leaves the rest alone.
 
 ## When to use the runtime API instead
 
@@ -545,10 +549,12 @@ To get the compiled module without changing code written against the runtime API
 `new Validator(schema)` whose schema is known at build time is replaced with the compiled
 module wrapped by `fromCompiled()` from `ata-validator/compiled`, which answers `validate()`,
 `isValidObject()`, `validateJSON()` and `isValidJSON()` as the runtime does, defaults and errors
-included. For the plugin's three-schema test entry a minified Vite build goes from 115.7 KB to
-15.5 KB gzipped. In Node, loading the wrapper and a compiled module and answering the first two
+included. For the plugin's three-schema test entry a minified Vite build goes from 122.5 KB to
+16.7 KB gzipped on ata 1.39.2. In Node, loading the wrapper and a compiled module and answering the first two
 checks takes 1.12 ms where the runtime takes 6.63 ms (median of 15 fresh processes). Across
-SchemaStore's 977 schemas, 725 can be compiled away; the rest stay on the runtime.
+SchemaStore's 977 schemas, 725 can be compiled away; the rest stay on the runtime. Where the code only calls `isValidObject()` or `isValidJSON()`, the plugin uses
+`fromCompiledVerdict()` from `ata-validator/compiled-verdict` instead, which carries no error pipeline: a
+small app that only asks for a boolean bundles to 2.1 KB gzipped, against 11.5 KB with the full wrapper.
 
 Programmatic API if you prefer to script it:
 

package/compiled-verdict.d.ts

@@ -0,0 +1,11 @@
+// ata-validator/compiled-verdict: the wrapper a bundler plugin puts in place of
+// `new Validator(schema)` for a schema known at build time, when the code only
+// asks for a boolean. No error pipeline is included.
+import type { CompiledModule, CompiledOptions } from './compiled.js';
+
+export interface CompiledVerdictValidator<T = unknown> {
+  isValidObject(data: unknown): data is T;
+  isValidJSON(json: string): boolean;
+}
+
+export function fromCompiledVerdict<T = unknown>(mod: Pick<CompiledModule, 'isValid'>, schema: object, options?: CompiledOptions): CompiledVerdictValidator<T>;

package/compiled-verdict.js

@@ -0,0 +1,7 @@
+'use strict';
+
+// ata-validator/compiled-verdict: the wrapper a bundler plugin puts in place of
+// `new Validator(schema)` when the schema is known at build time and the code
+// only calls isValidObject() or isValidJSON(). It carries no error pipeline;
+// code that reads errors gets ata-validator/compiled instead.
+module.exports = require('./lib/compiled-verdict.js');

package/compiled-verdict.mjs

@@ -0,0 +1,3 @@
+import mod from './compiled-verdict.js';
+export const { fromCompiledVerdict } = mod;
+export default mod;

package/index.js

@@ -36,7 +36,7 @@ class TextRejection {
 }
 
 function installCodegenPaths (ctx) {
-  const { ABORT_EARLY_RESULT, HYBRID_TIER_CALLS, SIMDJSON_THRESHOLD, VALID_RESULT, _bindVerdict, _jsonSyntaxRejection, _mustReject, getNative, isV1Dialect, resolveSchemaByPath } = core._internals;
+  const { ABORT_EARLY_RESULT, HYBRID_TIER_CALLS, SIMDJSON_THRESHOLD, VALID_RESULT, _bindVerdict, _jsonSyntaxRejection, _mustReject, _verboseWrap, getNative, isV1Dialect, resolveSchemaByPath } = core._internals;
   const { jsFn, _isCodegen, preprocess, fusedRemove, options, schemaObj, useSimdjsonForLarge, _buildCombined, _buildErr } = ctx;
   // errFn: the generated error function when it is safe, else the
   // interpreted engine, on every platform alike.
@@ -222,6 +222,11 @@ function installCodegenPaths (ctx) {
     this.validate = preprocess
       ? (data) => { preprocess(data); return run(data); }
       : run;
+    // What validate() returns for a document already known to fail, without
+    // deciding again: the lazy layer in lib/validator-core.js has its verdict
+    // and used to call validate() to get the errors, which ran the verdict a
+    // second time and built a second rejection around it.
+    if (!preprocess) ctx.rejectBase = onReject;
   } else {
     // No hybrid factory, so the assembly needs the function itself rather
     // than a reference it can call later: build it now.
@@ -230,6 +235,7 @@ function installCodegenPaths (ctx) {
       this.validate = preprocess
         ? (data) => { preprocess(data); return safeCombinedFn(data); }
         : safeCombinedFn;
+      if (!preprocess) ctx.rejectBase = (data) => _mustReject(safeCombinedFn(data));
     } else {
       this.validate = preprocess
         ? (data) => {
@@ -237,6 +243,7 @@ function installCodegenPaths (ctx) {
             return jsFn(data) ? VALID_RESULT : errOnly(data);
           }
         : (data) => (jsFn(data) ? VALID_RESULT : errOnly(data));
+      if (!preprocess) ctx.rejectBase = errOnly;
     }
   }
   // Verbose mode: populate parentSchema, schema and data on each error, the
@@ -246,33 +253,10 @@ function installCodegenPaths (ctx) {
   // migration ended up writing by hand. Errors may be frozen, so clone
   // them with the extra fields.
   if (this._verbose) {
-    const inner = this.validate;
-    const root = this._schemaObj;
-    const { resolvePointer } = require('./lib/pointer.js');
-    this.validate = (data) => {
-      const result = inner(data);
-      if (result && !result.valid && result.errors) {
-        const enriched = result.errors.map((err) => {
-          if (!err || err.parentSchema !== undefined) return err;
-          const parentSchema = resolveSchemaByPath(root, err.schemaPath);
-          // The last segment of the schema path is the keyword that
-          // failed, so its value on the parent is that keyword's schema.
-          const sp = typeof err.schemaPath === 'string' ? err.schemaPath : '';
-          const last = sp.slice(sp.lastIndexOf('/') + 1).replace(/~1/g, '/').replace(/~0/g, '~');
-          const keywordSchema = (parentSchema !== null && typeof parentSchema === 'object' && last)
-            ? parentSchema[last]
-            : undefined;
-          return {
-            ...err,
-            parentSchema,
-            schema: keywordSchema,
-            data: resolvePointer(data, err.instancePath, undefined),
-          };
-        });
-        return { valid: false, errors: enriched };
-      }
-      return result;
-    };
+    // The verbose fields are added here, so a path around this layer would
+    // miss them.
+    ctx.rejectBase = null;
+    this.validate = _verboseWrap(this.validate, this._schemaObj);
   }
   // The verdict methods answer validate()'s question without building the
   // error list, so they run the same preprocess pass. Skipping it made the

package/lib/aot-impl.js

@@ -186,6 +186,24 @@ function emitFormatDecls(closures, mode, declKW) {
 
 const { emitClone, inlineRefsForClone } = require('./clone-emit');
 
+// The schema-source frames the error function names, as `__ataSS[i]`. Each
+// is built once, frozen, from a [line, col, text index] row, with every source
+// line's text written once. Frozen, so sharing one object between reads is safe.
+function sourceFrameDecls(frames, schemaFile) {
+  if (!frames || frames.size === 0) return '';
+  const texts = [];
+  const textIndex = new Map();
+  const rows = [];
+  for (const f of frames.values()) {
+    let i = textIndex.get(f.text);
+    if (i === undefined) { i = texts.length; texts.push(f.text); textIndex.set(f.text, i); }
+    rows[f.index] = `[${f.line},${f.col},${i}]`;
+  }
+  return `const __ataSF = ${JSON.stringify(schemaFile)};\n` +
+    `const __ataSL = ${JSON.stringify(texts)};\n` +
+    `const __ataSS = [${rows.join(',')}].map((r) => Object.freeze({ file: __ataSF, line: r[0], col: r[1], text: __ataSL[r[2]] }));\n`;
+}
+
 function toStandaloneModule(validator, opts) {
   assertEmittable(validator, 'toStandaloneModule');
   validator._ensureCompiled();
@@ -200,12 +218,13 @@ function toStandaloneModule(validator, opts) {
 
   let errCore = '';
   let jsErrFn = null;
+  const sourceFrames = new Map();
   if (!abortEarly) {
     jsErrFn = compileToJSCodegenWithErrors(
       typeof validator._schemaObj === 'object' ? validator._schemaObj : {},
       null,
       validator._userFormats,
-      (source && sourceMap && schemaFile) ? { sourceMap, schemaFile } : null,
+      (source && sourceMap && schemaFile) ? { sourceMap, schemaFile, frames: sourceFrames } : null,
     );
     const errSrc = jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : '';
     if (errSrc && jsErrFn._errFactory) {
@@ -245,7 +264,7 @@ function toStandaloneModule(validator, opts) {
   // entirely so size budgets and grep-based "is this source-mapped?" checks
   // both work.
   const schemaSourceConst = (source && schemaFile)
-    ? `const __ATA_SCHEMA_SOURCE__ = ${JSON.stringify({ file: schemaFile })};\n`
+    ? `const __ATA_SCHEMA_SOURCE__ = ${JSON.stringify({ file: schemaFile })};\n` + sourceFrameDecls(sourceFrames, schemaFile)
     : '';
 
   // Serialize closure vars referenced in _fn body: regex, sub-validators, sets.

package/lib/compiled-common.js

@@ -0,0 +1,117 @@
+'use strict';
+
+// What the two compiled wrappers share: which Validator options they accept,
+// the defaults pass, and JSON parsing. lib/compiled.js answers all four entry
+// points; lib/compiled-verdict.js answers only the two that return a boolean,
+// so a bundle that never reads errors does not carry the error pipeline.
+
+const { buildDefaultsApplier } = require('./defaults');
+
+// The Validator options the wrapper answers the same way as the runtime.
+// Anything else changes what the runtime does in a way the wrapper does not
+// reproduce, so it is refused rather than ignored.
+const COMPILED_OPTIONS = Object.freeze(['useDefaults']);
+
+// With defaults, the document is filled in before it is checked, on every
+// entry point, as the runtime does.
+function prepare(mod, schema, options, name) {
+  if (options !== undefined && (options === null || typeof options !== 'object')) {
+    throw new TypeError(`${name} options must be an object`);
+  }
+  for (const key of Object.keys(options || {})) {
+    if (!COMPILED_OPTIONS.includes(key)) {
+      throw new TypeError(`${name} does not support the ${key} option; a Validator with it has to stay on the runtime`);
+    }
+  }
+  const fill = options && options.useDefaults === false ? null : buildDefaultsApplier(schema);
+  const isValid = fill ? (d) => { fill(d); return mod.isValid(d); } : mod.isValid;
+  return { fill, isValid };
+}
+
+function parse(text) {
+  try { return { value: JSON.parse(text) }; } catch (e) {
+    if (!(e instanceof SyntaxError)) throw e;
+    return { error: e };
+  }
+}
+
+// A frozen stand-in, as the runtime reports, when a document fails and neither
+// the schema nor the extension says why (the data changed in between).
+const EXT_FALLBACK = Object.freeze({ keyword: 'validation', instancePath: '', schemaPath: '#', params: {}, message: 'schema validation failed' });
+
+// A check the schema does not carry, registered the way @ata-project/keywords
+// registers `instanceof` and `typeof` on a Validator: `_extendChecks(resolve)`
+// before the first call, where resolve() returns { check, errors } or null.
+// The wrapper answers as the runtime does under such a check
+// (validator-core.js, _extendValidate and _jsonEntryWrappers): the verdict is
+// the schema's and the check's; validate() lists the schema's errors, then
+// the check's; the JSON entry points run the check only on text the schema
+// accepts. `extend(ext)` returns the wrapper's methods under the check, and is
+// called once, on the first call after registering, with the resolved check.
+function installExtension(api, schema, extend) {
+  let resolvers = null;
+  const define = (name, value) => Object.defineProperty(api, name, { value, configurable: true, writable: true, enumerable: false });
+  define('_schemaObj', schema);
+  define('_initialized', false);
+  define('_extendChecks', function (resolve) {
+    if (typeof resolve !== 'function') throw new TypeError('_extendChecks expects a function');
+    if (resolvers === null) {
+      resolvers = [];
+      const base = {};
+      for (const name of Object.keys(api)) base[name] = api[name];
+      // Resolved on the first call to any method, as the runtime resolves at
+      // its first compile, and the methods are bound once from then on.
+      let bound = null;
+      const bind = () => {
+        if (bound === null) {
+          let ext = null;
+          for (const r of resolvers) {
+            const x = r();
+            if (!x) continue;
+            ext = ext === null ? x : combine(ext, x);
+          }
+          bound = ext === null ? base : extend(base, ext);
+          for (const name of Object.keys(base)) api[name] = bound[name];
+        }
+        return bound;
+      };
+      for (const name of Object.keys(base)) api[name] = function (arg) { return bind()[name](arg); };
+    }
+    resolvers.push(resolve);
+    return api;
+  });
+}
+
+function combine(a, b) {
+  return {
+    check: (d) => a.check(d) && b.check(d),
+    errors: (d) => {
+      const x = a.errors(d), y = b.errors(d);
+      if (!x) return y;
+      if (!y) return x;
+      return x.concat(y);
+    },
+  };
+}
+
+// The JSON entry points under a check, as the runtime has them.
+function extendJSON(base, { check, errors }) {
+  return {
+    validateJSON: base.validateJSON && ((text) => {
+      const res = base.validateJSON(text);
+      if (!res.valid) return res;
+      const p = parse(text);
+      if (p.error) return res;
+      if (check(p.value)) return res;
+      const e = errors(p.value);
+      return e && e.length ? { valid: false, errors: e } : { valid: false, errors: [EXT_FALLBACK] };
+    }),
+    isValidJSON: (text) => {
+      if (!base.isValidJSON(text)) return false;
+      const p = parse(text);
+      return p.error ? true : check(p.value);
+    },
+  };
+}
+
+module.exports = { COMPILED_OPTIONS, prepare, parse, installExtension, extendJSON, EXT_FALLBACK };

package/lib/compiled-verdict.js

@@ -0,0 +1,30 @@
+'use strict';
+
+// The verdict half of lib/compiled.js: isValidObject() and isValidJSON(),
+// answered as a Validator with default options answers them, defaults filled
+// in first. A bundler plugin puts this in place of `new Validator(schema)`
+// when the code only ever asks for a boolean, so the error pipeline (the
+// rejection classes, enrichment, suggestions, JSON positions) stays out of the
+// bundle. Anything that reads errors needs ata-validator/compiled.
+
+const { prepare, parse, installExtension, extendJSON } = require('./compiled-common');
+
+function fromCompiledVerdict(mod, schema, options) {
+  const { isValid } = prepare(mod, schema, options, 'fromCompiledVerdict');
+  const api = {
+    isValidObject(data) {
+      return isValid(data);
+    },
+    isValidJSON(text) {
+      const p = parse(text);
+      return p.error ? false : isValid(p.value);
+    },
+  };
+  installExtension(api, schema, (base, ext) => ({
+    isValidObject: (d) => base.isValidObject(d) && ext.check(d),
+    isValidJSON: extendJSON(base, ext).isValidJSON,
+  }));
+  return api;
+}
+
+module.exports = { fromCompiledVerdict };

package/lib/compiled.js

@@ -16,14 +16,10 @@
 // leaves the input as it is, as the runtime then does.
 
 const { LazyRejection, RichRejection, LazyJsonRejection, _enrichLazy } = require('./rejections');
-const { buildDefaultsApplier } = require('./defaults');
+const { COMPILED_OPTIONS, prepare, parse, installExtension, extendJSON, EXT_FALLBACK } = require('./compiled-common');
 
 const VALID_RESULT = Object.freeze({ valid: true, errors: Object.freeze([]) });
 
-// The Validator options the wrapper answers the same way as the runtime.
-// Anything else changes what the runtime does in a way the wrapper does not
-// reproduce, so it is refused rather than ignored.
-const COMPILED_OPTIONS = Object.freeze(['useDefaults']);
 const EMPTY_ERRORS = Object.freeze([]);
 const VERDICT_DISAGREES = Object.freeze({
   valid: false,
@@ -50,23 +46,12 @@ class CompiledState {
 }
 
 function fromCompiled(mod, schema, options) {
-  if (options !== undefined && (options === null || typeof options !== 'object')) {
-    throw new TypeError('fromCompiled options must be an object');
-  }
-  for (const key of Object.keys(options || {})) {
-    if (!COMPILED_OPTIONS.includes(key)) {
-      throw new TypeError(`fromCompiled does not support the ${key} option; a Validator with it has to stay on the runtime`);
-    }
-  }
+  const { fill, isValid } = prepare(mod, schema, options, 'fromCompiled');
   const self = new CompiledState(schema);
-  const fill = options && options.useDefaults === false ? null : buildDefaultsApplier(schema);
   if (fill) {
     self._mutatesInput = true;
     self._preprocess = fill;
   }
-  // With defaults, the document is filled in before it is checked, on every
-  // entry point, as the runtime does.
-  const isValid = fill ? (d) => { fill(d); return mod.isValid(d); } : mod.isValid;
   const errFn = mod.validate;
   // The generated function's own result, rejected: if it says valid where the
   // verdict said no, the disagreement is reported rather than turned into an
@@ -78,13 +63,7 @@ function fromCompiled(mod, schema, options) {
   const rich = (data) => new RichRejection(raw(data), data, null, self, schema, _enrichLazy);
   const buildErrors = (data) => rich(data).errors;
   const buildRawErrors = (data) => rich(data)._ataRaw();
-  const parse = (text) => {
-    try { return { value: JSON.parse(text) }; } catch (e) {
-      if (!(e instanceof SyntaxError)) throw e;
-      return { error: e };
-    }
-  };
-  return {
+  const api = {
     validate(data) {
       if (isValid(data)) return { valid: true, data, errors: EMPTY_ERRORS };
       // The runtime returns the rich rejection directly when it rewrites input.
@@ -105,6 +84,56 @@ function fromCompiled(mod, schema, options) {
       return p.error ? false : isValid(p.value);
     },
   };
+  installExtension(api, schema, (base, ext) => {
+    const json = extendJSON(base, ext);
+    return {
+      // The verdict is the schema's and the check's. A failure lists the
+      // schema's errors, then the check's, read when somebody asks.
+      validate(data) {
+        const r = base.validate(data);
+        if (r.valid && ext.check(data)) return r;
+        return new ExtendedRejection(r, data, ext.errors);
+      },
+      isValidObject: (d) => base.isValidObject(d) && ext.check(d),
+      validateJSON: json.validateJSON,
+      isValidJSON: json.isValidJSON,
+    };
+  });
+  return api;
+}
+
+// validate() under a check, as the runtime reports it (ExtendedRejection in
+// validator-core.js): the inner result's errors, then the check's.
+class ExtendedRejection {
+  constructor(inner, data, collect) {
+    this.valid = false;
+    this._inner = inner;
+    this._data = data;
+    this._collect = collect;
+    this._errors = null;
+  }
+  toJSON() {
+    return { valid: false, errors: this.errors };
+  }
+  _ataRaw() {
+    const inner = this._inner;
+    const more = this._collect(this._data) || [];
+    const raw = inner.valid ? more : (typeof inner._ataRaw === 'function' ? inner._ataRaw() : inner.errors).concat(more);
+    return raw.length ? raw : [EXT_FALLBACK];
+  }
 }
+Object.defineProperty(ExtendedRejection.prototype, 'errors', {
+  enumerable: true,
+  configurable: true,
+  get() {
+    if (this._errors === null) {
+      const inner = this._inner;
+      const more = this._collect(this._data) || [];
+      const all = inner.valid ? more : inner.errors.concat(more);
+      this._errors = all.length ? all : [EXT_FALLBACK];
+    }
+    return this._errors;
+  },
+});
 
 module.exports = { fromCompiled, COMPILED_OPTIONS };

package/lib/js-compiler.js

@@ -173,6 +173,7 @@ const DOC_BASE = 'https://ata-validator.com/e/'
 // reader sorts by without deriving it from the path. Empty when the path is
 // not into the root document.
 function ordinalField (ctx, schemaPath) {
+  if (ctx && ctx.noOrdinal) return ''
   const o = ctx && ctx.rootSchema ? ordinalFor(ctx.rootSchema, unescapeSp(schemaPath)) : null
   return o === null ? '' : `,_o:${o}`
 }
@@ -198,6 +199,8 @@ function unescapeSp (sp) {
   return sp.indexOf('\\') === -1 ? sp : sp.replace(/\\(.)/g, '$1')
 }
 
+const FRAME_INLINE_MAX = 120
+
 function buildErrorLiteral (opts) {
   const { keyword, format, schemaPath, sourceMap } = opts
   let code = (keyword === 'format' && format) ? codeFor('format', format) : codeFor(keyword)
@@ -214,10 +217,24 @@ function buildErrorLiteral (opts) {
       const line = Array.isArray(hit) ? hit[0] : hit.line
       const col = Array.isArray(hit) ? hit[1] : hit.col
       const text = Array.isArray(hit) ? hit[2] : hit.text
-      frame = ',schemaSource:Object.freeze({file:' + JSON.stringify(sourceMap.file) +
-        ',line:' + line +
-        ',col:' + col +
-        ',text:' + JSON.stringify(text) + '})'
+      if (sourceMap.frames && text.length > FRAME_INLINE_MAX) {
+        // A long source line is written once at module scope (see
+        // sourceFrameDecls in aot-impl.js) and the literal names it. Inlined,
+        // every error site carried the whole line, and a schema kept on one
+        // line is one line of all of it: 181 KB minified for a 2 KB schema.
+        // Short lines stay inline: gzip folds the repeats, and measured on
+        // the 50-field fixture the table cost 1206 gzipped bytes where the
+        // inline frames cost 696.
+        const key = line + ':' + col
+        let f = sourceMap.frames.get(key)
+        if (!f) { f = { line, col, text, index: sourceMap.frames.size }; sourceMap.frames.set(key, f) }
+        frame = ',schemaSource:__ataSS[' + f.index + ']'
+      } else {
+        frame = ',schemaSource:Object.freeze({file:' + JSON.stringify(sourceMap.file) +
+          ',line:' + line +
+          ',col:' + col +
+          ',text:' + JSON.stringify(text) + '})'
+      }
     }
   }
   return { codeStr: code, docUrl, frame }
@@ -4315,7 +4332,7 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
                 // closure parameters below the way the other entry points do.
                 closureVars: [], closureVals: [],
                 sourceMap: (sourceOpts && sourceOpts.sourceMap && sourceOpts.schemaFile)
-                  ? { file: sourceOpts.schemaFile, map: sourceOpts.sourceMap }
+                  ? { file: sourceOpts.schemaFile, map: sourceOpts.sourceMap, frames: sourceOpts.frames || null }
                   : null }
   ctx.helperCode.push('const _cpLen=s=>{let n=0;for(const _ of s)n++;return n}')
   const lines = []
@@ -4393,6 +4410,18 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
       factoryBody = helpersE + 'return function(d,_all){const _e=[];\n  ' + checkStr +
         '\n  return{valid:_e.length===0,errors:_e}}'
     }
+    // For the runtime, the literals take the legacy shape directly. `code` and
+    // `docUrl` are there for standalone modules, which return errors as they
+    // are; the runtime derives both from the keyword when it enriches, and
+    // orders errors by schemaPath, so the literals carried three fields that
+    // every read then copied the error to remove. The patterns are this
+    // generator's own spelling; the collapse helper writes its fields with a
+    // space and keeps them.
+    if (sourceOpts && sourceOpts.runtimeShape) {
+      const shape = (src) => src.replace(/code:'ATA\d{4}',/g, '').replace(/,docUrl:'https:\/\/ata-validator\.com\/e\/ATA\d{4}'/g, '').replace(/,_o:\d+/g, '')
+      body = shape(body)
+      factoryBody = shape(factoryBody)
+    }
     const hoistable = !ctx.usesRecursion && defSetsE.length === 0 && helpersE !== ''
     if (hoistable || needsGuardE) {
       const params = [...cvars, '__ataSafeRe']
@@ -5177,7 +5206,7 @@ function genIfE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
 // Returns VALID_RESULT for valid data, {valid:false, errors} for invalid.
 // Avoids double-pass (jsFn → false → errFn runs same checks again).
 // Uses type-aware optimizations: after type check passes, skip guards.
-function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats) {
+function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts) {
   const inputSchema = schema
   schema = normalizePropertyNames(schema)
   // Same provably-local rule as the error generator above.
@@ -5257,7 +5286,8 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats) {
   if (hasUnresolvableRef(schema, cRootDefs, cAnchors, schemaMap, new Set())) return null
   if (needsBaseTracking(schema, schemaMap, new Set())) return null
 
-  const ctx = { varCounter: 0, helperCode: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen],
+  // runtimeShape: errors without the ordinal, see compileToJSCodegenWithErrors.
+  const ctx = { noOrdinal: !!(opts && opts.runtimeShape), varCounter: 0, helperCode: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen],
                 rootDefs: cRootDefs, refStack: new Set(), schemaMap: schemaMap || null, anchors: cAnchors, rootSchema: inputSchema, userFormats: userFormats || null }
   const lines = []
   try {
@@ -5392,7 +5422,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
         if (pathVal !== undefined) {
         const spVal = unescapeSp(sp)
         ctx.closureVars.push(errVar)
-        const o = ordinalFor(ctx.rootSchema, spVal)
+        const o = ctx.noOrdinal ? null : ordinalFor(ctx.rootSchema, spVal)
         const lit = {keyword, instancePath: pathVal, schemaPath: spVal, params: Object.freeze(paramsVal), message: msgVal}
         if (o !== null) lit._o = o
         ctx.closureVals.push(Object.freeze(lit))

package/lib/rejections.js

@@ -80,49 +80,53 @@ class RichRejection {
     return raw;
   }
 }
+// Orders a raw error list and gives it the shape the caller asked for: the
+// legacy key set, or enriched. Shared by both rejection classes below.
+function presentErrors(raw, data, rawInput, self, root, enrich) {
+  if (needsOrdering(raw)) raw = sortErrorsBySchemaOrder(root, raw);
+  // The position map, resolved now that an error is actually being read.
+  let positions = null;
+  if (enrich && raw.length && rawInput != null) {
+    positions = self._pos().targeted(rawInput, wantedPointersFor(raw));
+    if (positions) self._posCache.reset();
+  }
+  // One options object for the whole list, not one per error.
+  const opts = enrich && raw.length
+    ? {
+        data,
+        positions,
+        schemaPositions: self._schemaPositions,
+        schemaFile: self._source ? self._source.path : undefined,
+      }
+    : null;
+  const cached = opts
+    ? raw.map((e) => enrich(e, opts))
+    // The v0.14 shape is a fixed key set; the ordering key the
+    // generated code carries is dropped from it here.
+    : raw.map(stripOrdinal);
+  // Correlation is published, never applied. Both halves of a typo pair
+  // stay in the array; `related` only says they are one mistake, so a
+  // wrong pairing costs a sentence rather than a hidden violation.
+  if (enrich && cached.length > 1) attachRelated(cached);
+  // No diagnostic payload here. validate(data) is the library hot path,
+  // and attaching one cost about 100 ns per rejection for a consumer
+  // that never renders. The text path attaches it, and a renderer given
+  // `{ data }` builds frames for object input on request.
+  return cached;
+}
+
 Object.defineProperty(RichRejection.prototype, 'errors', {
   enumerable: true,
   configurable: true,
   get() {
     if (this._cached === null) {
-      const self = this._self;
-      const enrich = this._enrich;
-      let raw = this._result.errors || [];
-      if (needsOrdering(raw)) raw = sortErrorsBySchemaOrder(this._root, raw);
-      // The position map, resolved now that an error is actually being read.
-      let positions = null;
-      if (enrich && raw.length && this._rawInput != null) {
-        positions = self._pos().targeted(this._rawInput, wantedPointersFor(raw));
-        if (positions) self._posCache.reset();
-      }
-      // One options object for the whole list, not one per error.
-      const opts = enrich && raw.length
-        ? {
-            data: this._data,
-            positions,
-            schemaPositions: self._schemaPositions,
-            schemaFile: self._source ? self._source.path : undefined,
-          }
-        : null;
-      const cached = opts
-        ? raw.map((e) => enrich(e, opts))
-        // The v0.14 shape is a fixed key set; the ordering key the
-        // generated code carries is dropped from it here.
-        : raw.map(stripOrdinal);
-      // Correlation is published, never applied. Both halves of a typo pair
-      // stay in the array; `related` only says they are one mistake, so a
-      // wrong pairing costs a sentence rather than a hidden violation.
-      if (enrich && cached.length > 1) attachRelated(cached);
-      // No diagnostic payload here. validate(data) is the library hot path,
-      // and attaching one cost about 100 ns per rejection for a consumer
-      // that never renders. The text path attaches it, and a renderer given
-      // `{ data }` builds frames for object input on request.
-      this._cached = cached;
+      this._cached = presentErrors(this._result.errors || [], this._data, this._rawInput, this._self, this._root, this._enrich);
     }
     return this._cached;
   },
 });
 
+
 // The rejection validateJSON returns. Everything the text path adds over
 // validate(data), the value tree enrichment needs, the position map, the
 // diagnostic payload, happens on first access to `.errors`. Reading `.valid`
@@ -256,7 +260,10 @@ function wantedPointersFor (errors) {
 const COLLAPSE_CODES = new Set(['ATA4001', 'ATA4002', 'ATA4003']);
 function stripOrdinal(e) {
   if (e === null || typeof e !== 'object') return e;
-  if (e._o === undefined && e.docUrl === undefined && (e.code === undefined || COLLAPSE_CODES.has(e.code)) && !e.branchErrors) return e;
+  // Generated code keeps errors at a fixed path as frozen literals shared by
+  // every call. The caller gets its own copy, as it always has, so an error it
+  // edits (a translated message) is its own and editing it does not throw.
+  if (e._o === undefined && e.docUrl === undefined && (e.code === undefined || COLLAPSE_CODES.has(e.code)) && !e.branchErrors) return Object.isFrozen(e) ? { ...e } : e;
   const out = {};
   for (const k in e) {
     if (k === '_o' || k === 'docUrl') continue;
@@ -364,4 +371,4 @@ function attachRelated (errors) {
   return errors;
 }
 
-module.exports = { LazyRejection, RichRejection, LazyJsonRejection, _enrichLazy, attachRelated, sortErrorsBySchemaOrder, stripOrdinal, wantedPointersFor };
+module.exports = { LazyRejection, RichRejection, presentErrors, needsOrdering, LazyJsonRejection, _enrichLazy, attachRelated, sortErrorsBySchemaOrder, stripOrdinal, wantedPointersFor };

package/lib/render-pretty.js

@@ -42,7 +42,11 @@ function caretSuffix (d, raw, useColor) {
 function renderOne (d, useColor, opts) {
   const lines = [];
   const width = terminalWidth();
-  const gutter = 3;
+  // The bar sits one column past the widest line number, so the source line,
+  // the blank rows and the caret row share it and a caret lands on the first
+  // character of the value, not one column to its left.
+  const bar = (line) => ' '.repeat(Math.max(3, String(line).length + 1)) + '|';
+  const src = (line, text) => String(line).padStart(Math.max(2, String(line).length)) + ' | ' + text;
 
   // Headline carries the code when there is one. A code-less error, which the
   // LazyRejection fallback can produce, must not render as "error[undefined]".
@@ -57,12 +61,12 @@ function renderOne (d, useColor, opts) {
   if (raw && raw.schemaSource) {
     const f = trimCwd(raw.schemaSource.file, opts.cwd);
     lines.push(`  --> ${color(useColor, ANSI.cyan, `${f}:${raw.schemaSource.line}:${raw.schemaSource.col}`)}`);
-    lines.push('   |');
-    const sln = String(raw.schemaSource.line).padStart(2, ' ');
-    lines.push(` ${sln} | ${truncateLine(raw.schemaSource.text, width - 8)}`);
+    const sl = raw.schemaSource.line;
+    lines.push(bar(sl));
+    lines.push(src(sl, truncateLine(raw.schemaSource.text, width - 8)));
     const inlineHint = raw.expected ? '  ' + color(useColor, ANSI.dim, `expected ${raw.expected}`) : '';
-    lines.push(caretLine(raw.schemaSource.col, 1, gutter) + inlineHint);
-    lines.push('   |');
+    lines.push(caretLine(raw.schemaSource.col, 1, bar(sl).length - 1) + inlineHint);
+    lines.push(bar(sl));
   }
 
   // Data location, always, even without a frame. This is the single most
@@ -70,11 +74,11 @@ function renderOne (d, useColor, opts) {
   if (d.frame) {
     const where = `input:${d.frame.line}:${d.frame.col}`;
     lines.push(`  --> ${color(useColor, ANSI.cyan, where)}  ${color(useColor, ANSI.dim, '(' + d.dotted + ')')}`);
-    lines.push('   |');
-    const ln = String(d.frame.line).padStart(2, ' ');
-    lines.push(` ${ln} | ${truncateLine(d.frame.text, width - 8)}`);
-    lines.push(caretLine(d.frame.col, d.frame.length, gutter) + caretSuffix(d, raw, useColor));
-    lines.push('   |');
+    const fl = d.frame.line;
+    lines.push(bar(fl));
+    lines.push(src(fl, truncateLine(d.frame.text, width - 8)));
+    lines.push(caretLine(d.frame.col, d.frame.length, bar(fl).length - 1) + caretSuffix(d, raw, useColor));
+    lines.push(bar(fl));
   } else {
     lines.push(`  --> ${color(useColor, ANSI.cyan, 'at ' + d.dotted)}`);
   }

package/lib/schema-order.js

@@ -156,6 +156,14 @@ function ordinalFor(rootSchema, schemaPath) {
   const map = ordinals(rootSchema);
   const hit = map.get(schemaPath);
   if (hit !== undefined) return hit;
+  // A path that is not a node is answered from the cache below, filled by the
+  // walk after it: every error behind a `$ref`, which is every error of a
+  // schema the interpreter answers through references, used to walk its path
+  // back segment by segment on every read.
+  let misses = _missCache.get(rootSchema);
+  if (misses === undefined) { misses = new Map(); _missCache.set(rootSchema, misses); }
+  const known = misses.get(schemaPath);
+  if (known !== undefined) return known;
   // Walk back to the longest prefix that exists. Paths through a keyword's
   // value that is a primitive, or through a key the schema does not have,
   // land on the nearest enclosing node.
@@ -163,16 +171,24 @@ function ordinalFor(rootSchema, schemaPath) {
   // behind a reference sort where the `$ref` is declared among its siblings;
   // rankFor orders them among themselves.
   let p = schemaPath;
+  let found = 0;
   while (true) {
     const cut = p.lastIndexOf('/');
-    if (cut < 0) return 0;
+    if (cut < 0) break;
     p = p.slice(0, cut);
     const o = map.get(p);
     if (o !== undefined) {
       const r = map.get(p + '/$ref');
-      return r !== undefined ? r : o;
+      found = r !== undefined ? r : o;
+      break;
     }
   }
+  // Bounded: behind a recursive reference the paths grow with the document's
+  // depth, and the cache must not grow with them.
+  if (misses.size < MISS_CACHE_LIMIT) misses.set(schemaPath, found);
+  return found;
 }
+const _missCache = new WeakMap();
+const MISS_CACHE_LIMIT = 4096;
 
 module.exports = { rankFor, ordinalFor, unescapePointerSegment };

package/lib/validator-core.js

@@ -292,7 +292,7 @@ function resolveSchemaByPath(rootSchema, schemaPath) {
 //
 // A failing route sees the same handful of schemaPaths over and over, which is
 // what makes the first one worth having.
-const { LazyRejection, RichRejection, LazyJsonRejection, _enrichLazy } = require('./rejections');
+const { LazyRejection, RichRejection, LazyJsonRejection, _enrichLazy, presentErrors, needsOrdering, sortErrorsBySchemaOrder } = require('./rejections');
 
 // Text that does not parse, reported the same way on every path and platform:
 // ATA9001 with the parser's own message. The native addon used to say only
@@ -991,20 +991,28 @@ class Validator {
     };
     const _buildCombined = () => {
       if (jsCombinedFn !== undefined) return;
-      jsCombinedFn = compileToJSCombined(schemaObj, VALID_RESULT, sm, this._userFormats) || null;
+      jsCombinedFn = compileToJSCombined(schemaObj, VALID_RESULT, sm, this._userFormats, { runtimeShape: true }) || null;
       _upgradeCacheEntry();
     };
     const _buildErr = () => {
       if (jsErrFn !== undefined) return;
-      jsErrFn = compileToJSCodegenWithErrors(schemaObj, sm, this._userFormats) || null;
+      jsErrFn = compileToJSCodegenWithErrors(schemaObj, sm, this._userFormats, { runtimeShape: true }) || null;
       _upgradeCacheEntry();
     };
 
+    // What validate() returns for a document already known to fail, without
+    // deciding again, when the codegen paths can say (see index.js). Kept in
+    // locals and on this object rather than on the instance: every call reads
+    // `validate` off the instance, and three more own properties made that
+    // read slower across the suite's validators.
+    let _rejectBase = null, _rejectPresented = null, _rejectPlain = false;
     if (jsFn) {
-      _codegen.installPaths.call(this, {
+      const _cg = {
         jsFn, _isCodegen, preprocess, fusedRemove, options, schemaObj, useSimdjsonForLarge, _buildCombined, _buildErr,
-        combined: () => jsCombinedFn, err: () => jsErrFn,
-      });
+        combined: () => jsCombinedFn, err: () => jsErrFn, rejectBase: null,
+      };
+      _codegen.installPaths.call(this, _cg);
+      _rejectBase = _cg.rejectBase;
     } else {
       // No JS codegen: the interpreted engine, with or without the addon. The
       // buffer APIs come from _installBufferApis on first use, as they do on
@@ -1030,7 +1038,9 @@ class Validator {
         : (preprocess
             ? (data) => { preprocess(data); return interp.validate(data); }
             : (data) => interp.validate(data));
-      this.validate = run;
+      this.validate = this._verbose ? _verboseWrap(run, schemaObj) : run;
+      // Reading errors runs the interpreter once, directly; see _rejectBase.
+      if (!preprocess && !options.abortEarly && !this._verbose) _rejectBase = (data) => interp.validate(data);
       _bindVerdict(this, this._fastVerdict
         ? this._fastVerdict
         : (data) => run(data).valid);
@@ -1059,8 +1069,7 @@ class Validator {
       const enrich = this._richErrors ? _enrichLazy : null;
       const root = this._schemaObj;
       const self = this;
-      this.validate = (data) => {
-        const result = inner(data);
+      const present = (result, data) => {
         // abortEarly returns the shared ATA9000 stub; preserve it as-is so the
         // perf fast path stays allocation-free and the documented code stays stable.
         if (result && result.valid === false && result !== ABORT_EARLY_RESULT) {
@@ -1076,6 +1085,13 @@ class Validator {
         }
         return result;
       };
+      this.validate = (data) => present(inner(data), data);
+      // The same presentation for a document already known to fail.
+      const rejectBase = _rejectBase;
+      _rejectPresented = rejectBase ? (data) => present(rejectBase(data), data) : null;
+      // True while nothing but this layer stands between a rejection and the
+      // caller; the lazy layer below can then build the rejection itself.
+      _rejectPlain = !!rejectBase;
 
       // validateJSON also enriches: set _lastRawInput so the position cache
       // can lazily build a map for dataFrame attachment. Only validateJSON
@@ -1149,6 +1165,8 @@ class Validator {
           return result;
         };
         if (this.validate) this.validate = wrap(this.validate);
+        if (_rejectPresented) _rejectPresented = wrap(_rejectPresented);
+        _rejectPlain = false;
         if (this.validateJSON) this.validateJSON = wrap(this.validateJSON);
         // validateAndParse routes through self.validate on the codegen path, but
         // the native-only path returns directly from the addon — wrap it so both
@@ -1185,7 +1203,13 @@ class Validator {
     const _vx = this._validateTail !== null ? this._validateTail() : null;
     let _vxApplied = false;
     if (this._fastVerdict && !preprocess && !options.abortEarly && this.validate) {
-      const _full = this.validate;
+      // The errors of a document the verdict rejected come from the rejection
+      // path directly, not from validate() deciding a second time. Not with a
+      // check from _extendValidate: that check can reject what the schema
+      // accepts, and then the schema's own errors must come from a verdict.
+      // Not with removeAdditional's fused pass either, which edits the
+      // document before the errors are read.
+      const _full = (_vx === null && !fusedRemove && _rejectPresented) ? _rejectPresented : this.validate;
       const _fast = _vx ? _fuseTail(this._fastVerdict, _vx.check) : this._fastVerdict;
       const _extra = _vx ? _vx.errors : null;
       _vxApplied = true;
@@ -1198,11 +1222,19 @@ class Validator {
         // verdict and say so rather than inventing a specific error.
         return own || _verdictFallback;
       };
-      const _buildErrors = (data) => {
+      // The common case: the verdict decides, and reading `errors` runs the
+      // error function and presents its list directly. Through the layers it
+      // took a second verdict and a second rejection object, about 75 ns of a
+      // 96 ns read on a two-error document. validate() below is the same code
+      // either way, so reading only `.valid` costs what it did.
+      const _plain = (_vx === null && !fusedRemove && _rejectPlain)
+        ? _plainBuilders(_rejectBase, this._richErrors ? _enrichLazy : null, this._schemaObj, this, _verdictFallback)
+        : null;
+      const _buildErrors = _plain !== null ? _plain.errors : (data) => {
         const r = _full(data);
         return _withExtra((r && r.valid === false && r.errors && r.errors.length) ? r.errors : null, data);
       };
-      const _buildRawErrors = (data) => {
+      const _buildRawErrors = _plain !== null ? _plain.raw : (data) => {
         const r = _full(data);
         let raw = null;
         if (r && r.valid === false) {
@@ -1700,6 +1732,60 @@ const _VERDICT_DISAGREES = Object.freeze({
   valid: false,
   errors: Object.freeze([Object.freeze({ keyword: 'validation', instancePath: '', schemaPath: '#', params: Object.freeze({}), message: 'schema validation failed' })]),
 });
+// The error builders of the common rejection path (see _ensureCompiled): run
+// the error function behind `reject` for a document the verdict rejected, and
+// order and present its list. Out here so the closures capture only this.
+function _plainBuilders(reject, enrich, root, self, fallback) {
+  const rawOf = (data) => {
+    const r = reject(data);
+    const errors = r && r.errors;
+    return errors && errors.length ? errors : fallback;
+  };
+  return {
+    errors: (data) => presentErrors(rawOf(data), data, null, self, root, enrich),
+    raw: (data) => {
+      const raw = rawOf(data);
+      return needsOrdering(raw) ? sortErrorsBySchemaOrder(root, raw) : raw;
+    },
+  };
+}
+
+// Verbose mode: populate parentSchema, schema and data on each error, the
+// three fields the default error shape carries under the same option. `data`
+// is the value the error points at; without it a caller has to walk the
+// document by the instance path itself, which is what one migration ended up
+// writing by hand. Errors may be frozen, so they are cloned with the extra
+// fields. Both engines go through this; the interpreted one used to skip it,
+// so the same validator reported different fields depending on which engine
+// answered.
+function _verboseWrap(inner, root) {
+  const { resolvePointer } = require('./pointer.js');
+  return (data) => {
+    const result = inner(data);
+    if (result && !result.valid && result.errors) {
+      const enriched = result.errors.map((err) => {
+        if (!err || err.parentSchema !== undefined) return err;
+        const parentSchema = resolveSchemaByPath(root, err.schemaPath);
+        // The last segment of the schema path is the keyword that
+        // failed, so its value on the parent is that keyword's schema.
+        const sp = typeof err.schemaPath === 'string' ? err.schemaPath : '';
+        const last = sp.slice(sp.lastIndexOf('/') + 1).replace(/~1/g, '/').replace(/~0/g, '~');
+        const keywordSchema = (parentSchema !== null && typeof parentSchema === 'object' && last)
+          ? parentSchema[last]
+          : undefined;
+        return {
+          ...err,
+          parentSchema,
+          schema: keywordSchema,
+          data: resolvePointer(data, err.instancePath, undefined),
+        };
+      });
+      return { valid: false, errors: enriched };
+    }
+    return result;
+  };
+}
+
 function _mustReject(r) {
   return r && r.valid === false ? r : _VERDICT_DISAGREES;
 }
@@ -2063,4 +2149,4 @@ module.exports = {
 // surface of `require('ata-validator')` is what it was.
 Object.defineProperty(module.exports, '_registerCodegen', { value: _registerCodegen, enumerable: false });
 // What the compiled paths in index.js need from this module.
-Object.defineProperty(module.exports, '_internals', { value: { _jsonSyntaxRejection, ABORT_EARLY_RESULT, HYBRID_TIER_CALLS, SIMDJSON_THRESHOLD, VALID_RESULT, _bindEntry, _bindVerdict, _compileCache, _mustReject, _rememberInstance, compileCacheKey, getNative, isV1Dialect, resolveSchemaByPath }, enumerable: false });
+Object.defineProperty(module.exports, '_internals', { value: { _jsonSyntaxRejection, ABORT_EARLY_RESULT, HYBRID_TIER_CALLS, SIMDJSON_THRESHOLD, VALID_RESULT, _bindEntry, _bindVerdict, _compileCache, _mustReject, _rememberInstance, _verboseWrap, compileCacheKey, getNative, isV1Dialect, resolveSchemaByPath }, enumerable: false });

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.39.1';
+module.exports = '1.40.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.39.1",
+  "version": "1.40.0",
   "description": "JSON Schema validator that compiles to plain JavaScript, still runs where code generation is blocked, and can be compiled away at build time. Passes the full official test suite.",
   "main": "index.js",
   "module": "index.mjs",
@@ -43,6 +43,11 @@
       "import": "./compiled.mjs",
       "require": "./compiled.js"
     },
+    "./compiled-verdict": {
+      "types": "./compiled-verdict.d.ts",
+      "import": "./compiled-verdict.mjs",
+      "require": "./compiled-verdict.js"
+    },
     "./package.json": "./package.json"
   },
   "sideEffects": false,
@@ -59,7 +64,7 @@
     "release:check": "node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_embed.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_text_path_errors.js && node tests/test_compiled_parity.js && node tests/test_buffer_gate.js && node tests/test_scanner_differential.js && node tests/test_validate_json_scanner_cost.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_error_list_differential.js && node tests/test_output_format.js && node tests/test_standard_json_schema.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_esm_exports.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_native_lazy.js && node tests/test_buffer_apis_without_native.js && node tests/test_cold_start_modules.js && node tests/test_safe_regex_embed.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_regex_ecma_whitespace.js && node tests/test_regex_native_linear.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_option.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_error_accumulator_collision.js && node tests/test_uri_helper_parity.js && node tests/test_uri_fast_path.js && node tests/test_extend_verdict.js && node tests/test_ipv4_regex.js && node tests/test_ipv6_fast_path.js && node tests/test_nested_recursion_decline.js && node tests/test_generator_error_content.js && node tests/test_inherited_key_presence.js && node tests/test_proto_accessor.js && node tests/test_hybrid_tier.js && node tests/test_first_rejection_builds_one.js && node tests/test_container_local.js && node tests/test_one_shot_validate.js && node tests/test_fixed_pattern_inline.js && node tests/test_plan_source.js && node tests/test_fused_remove_additional.js && node tests/test_runtime_parse.js && node tests/test_formats_single_pass.js && node tests/test_email_format_cost.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_ref_annotation_siblings.js && node tests/test_gate_wrapped_schemas.js && node tests/test_pattern_message_escape.js && node tests/test_nested_defaults_engines.js && node tests/test_nested_coercion_parity.js && node tests/test_preprocess_cache.js && node tests/test_large_schema_codegen.js && node tests/test_base_uri.js && node tests/test_hoisted_def_recursion.js && node tests/test_alias_definitions.js && node tests/test_property_names_ref.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_deferred_def_scope.js && node tests/test_node_scoped_ctx_flags.js && node tests/test_fast_slot_exhaustion.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_unevaluated_differential.js && node tests/fuzz_differential.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_additional_props_combined_cost.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_ref_error_order.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_single_pass_errors.js && node tests/test_lazy_json_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_lite_parity.js && node tests/test_lite_bundle_size.js && node tests/test_defaults_own_keys.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_targeted_positions.js && node tests/test_position_map_cost.js && node tests/test_targeted_positions_cost.js && node tests/test_aot_staleness.js && node tests/test_file_positions.js && node tests/test_aot_positions_cost.js && node tests/test_schema_hash.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node tests/test_collect_evaluated.js && node tests/test_differential_tiers.js && node tests/test_draft7.js && node tests/test_dual_path.js && node tests/test_keywords_codegen.js && node tests/test_ref_cross.js && node tests/test_shape_classifier.js && node tests/test_tier0.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_text_path_errors.js && node tests/test_compiled_parity.js && node tests/test_compiled_extension_parity.js && node tests/test_buffer_gate.js && node tests/test_scanner_differential.js && node tests/test_validate_json_scanner_cost.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_error_list_differential.js && node tests/test_output_format.js && node tests/test_standard_json_schema.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_esm_exports.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_native_lazy.js && node tests/test_buffer_apis_without_native.js && node tests/test_cold_start_modules.js && node tests/test_safe_regex_embed.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_regex_ecma_whitespace.js && node tests/test_regex_native_linear.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_option.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_error_accumulator_collision.js && node tests/test_uri_helper_parity.js && node tests/test_uri_fast_path.js && node tests/test_extend_verdict.js && node tests/test_ipv4_regex.js && node tests/test_ipv6_fast_path.js && node tests/test_nested_recursion_decline.js && node tests/test_generator_error_content.js && node tests/test_inherited_key_presence.js && node tests/test_proto_accessor.js && node tests/test_hybrid_tier.js && node tests/test_first_rejection_builds_one.js && node tests/test_container_local.js && node tests/test_one_shot_validate.js && node tests/test_fixed_pattern_inline.js && node tests/test_plan_source.js && node tests/test_fused_remove_additional.js && node tests/test_runtime_parse.js && node tests/test_formats_single_pass.js && node tests/test_email_format_cost.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_ref_annotation_siblings.js && node tests/test_gate_wrapped_schemas.js && node tests/test_pattern_message_escape.js && node tests/test_nested_defaults_engines.js && node tests/test_nested_coercion_parity.js && node tests/test_preprocess_cache.js && node tests/test_large_schema_codegen.js && node tests/test_base_uri.js && node tests/test_hoisted_def_recursion.js && node tests/test_alias_definitions.js && node tests/test_property_names_ref.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_deferred_def_scope.js && node tests/test_node_scoped_ctx_flags.js && node tests/test_fast_slot_exhaustion.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_unevaluated_differential.js && node tests/fuzz_differential.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_additional_props_combined_cost.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_ref_error_order.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_single_pass_errors.js && node tests/test_lazy_json_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_lite_parity.js && node tests/test_lite_bundle_size.js && node tests/test_defaults_own_keys.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_targeted_positions.js && node tests/test_position_map_cost.js && node tests/test_targeted_positions_cost.js && node tests/test_aot_staleness.js && node tests/test_file_positions.js && node tests/test_aot_positions_cost.js && node tests/test_schema_hash.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_aot_source_frames.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node tests/test_collect_evaluated.js && node tests/test_differential_tiers.js && node tests/test_draft7.js && node tests/test_dual_path.js && node tests/test_keywords_codegen.js && node tests/test_ref_cross.js && node tests/test_shape_classifier.js && node tests/test_tier0.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -130,18 +135,21 @@
     "compiled.js",
     "compiled.mjs",
     "compiled.d.ts",
+    "compiled-verdict.js",
+    "compiled-verdict.mjs",
+    "compiled-verdict.d.ts",
     "bin/",
     "README.md",
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.39.1",
-    "@ata-validator/native-darwin-x64": "1.39.1",
-    "@ata-validator/native-linux-arm64-gnu": "1.39.1",
-    "@ata-validator/native-linux-arm64-musl": "1.39.1",
-    "@ata-validator/native-linux-x64-gnu": "1.39.1",
-    "@ata-validator/native-linux-x64-musl": "1.39.1",
-    "@ata-validator/native-win32-x64": "1.39.1"
+    "@ata-validator/native-darwin-arm64": "1.40.0",
+    "@ata-validator/native-darwin-x64": "1.40.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.40.0",
+    "@ata-validator/native-linux-arm64-musl": "1.40.0",
+    "@ata-validator/native-linux-x64-gnu": "1.40.0",
+    "@ata-validator/native-linux-x64-musl": "1.40.0",
+    "@ata-validator/native-win32-x64": "1.40.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"