ata-validator 1.4.0 → 1.5.1

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.5.1 - 2026-08-07
+
+### Fixed
+
+- `isValid()` on a buffer disagreed with `validate()` on the parsed value for 294 of 2208 cases in the official suite, in both directions. Two causes: the path returned the code generator's `false` directly, which is ambiguous between "invalid" and "the plan stopped at a composition opcode and the walker should finish", so every schema using `allOf`, `anyOf`, `oneOf` or `$ref` was rejected outright; and it ended in a second, simpler walker that had drifted from the one `validate()` uses. It now calls the same walker with all errors off, so there is one set of semantics rather than two kept in step by hand. The disagreement drops to 243 cases, the rest being the on-demand plan answering before the walker runs, which is engine work rather than a setting.
+- `tests/test_buffer_path_parity.js` records that number so it cannot widen, and the README and the edge runtimes guide now state the gap, since `isValid`, `countValid` and `batchIsValid` are shipped APIs and a caller has no way to know otherwise.
+
+### Changed
+
+- `ATA_NO_MIMALLOC` skips the bundled `mimalloc-new-delete.h` include. A toolchain that ships the mimalloc headers along with its own `operator new`/`delete` over the same allocator hits a duplicate symbol at link time; Emscripten with `-sMALLOC=mimalloc` is that case, so the source could not be compiled to WebAssembly at all. The native build does not define it and is unchanged.
+
+## 1.5.0 - 2026-08-05
+
+### Added
+
+- `propertyDependencies`, a JSON Schema v1 [proposal](https://github.com/json-schema-org/json-schema-spec/blob/main/specs/proposals/propertyDependencies.md), selects a subschema by the value of a property rather than by its presence. It replaces the `oneOf` and `if`/`then` patterns normally used to branch on a discriminator field, and reads as `{ "propertyDependencies": { "type": { "customer": { ... }, "employee": { ... } } } }`. The proposal defines the keyword as equivalent to an `if`/`then` on `const`, and `tests/test_property_dependencies.js` checks that equivalence case by case rather than asserting a separate expectation, alongside the proposal's own test files from the official suite: 36 of 38, the two remaining being a `$dynamicRef` scope gap the `if`/`then` form of the same schema hits identically.
+- The keyword is implemented in the interpreted engine. Both JS compiler paths decline a schema that uses it rather than emitting nothing for a keyword they do not know, which would make the constraint vacuous.
+
 ## 1.4.0 - 2026-08-04
 
 ### Fixed

package/README.md

@@ -22,6 +22,10 @@ npm install ata-validator --omit=optional
 
 or set `ATA_NO_NATIVE=1` at runtime. Typical schemas compile to specialized JS; shapes the compiler cannot represent (some `$dynamicRef`, cyclic `$ref`, unusual keyword interactions) fall back to an interpreted engine, so every schema validates in every environment. The pure-JS setup scores the same on the official suite as the native one, 1285 of 1290 Draft 2020-12 cases; the two miss a different `$dynamicRef` scope corner each. Only the buffer and parallel APIs (`isValid` on raw buffers, `countValid`, `batchIsValid`, `validateAndParse`) need the native engine and say so with a clear error.
 
+Those four also do not yet agree with `validate()`. Over the official suite they differ on 243 of 2208 cases, in both directions, concentrated in `unevaluatedProperties`, `contains`, `const` and the `$ref` family. `npm test` measures the gap on every run so it cannot widen, and `docs/edge-runtimes.md` has the detail. Until it is closed, use them where throughput matters more than exactness, and use `validate()` or `isValidObject()` as the check on untrusted input.
+
+Where `new Function` is refused altogether, on Cloudflare Workers, Deno Deploy or under a strict Content-Security-Policy, ata drops to the interpreted engine and scores 1286 of 1290 with code generation blocked. No flags, and on Workers no `nodejs_compat` either. See [docs/edge-runtimes.md](docs/edge-runtimes.md).
+
 In your code:
 
 ```ts

package/index.js

@@ -1061,8 +1061,11 @@ class Validator {
       this._ensureNative();
       const _hasDynRef = this._schemaStr.includes('"$dynamicRef"') || this._schemaStr.includes('"$dynamicAnchor"')
       const _hasUneval = this._schemaStr.includes('"unevaluatedProperties"') || this._schemaStr.includes('"unevaluatedItems"')
+      // propertyDependencies exists only in the interpreted engine, so a schema
+      // using it goes there even when it also uses $dynamicRef.
+      const _hasPropDeps = this._schemaStr.includes('"propertyDependencies"')
       let _validate;
-      if (_hasDynRef && !_hasUneval) {
+      if (_hasDynRef && !_hasUneval && !_hasPropDeps) {
         // validateJSON is the C++ path with full anchor-map support; the NAPI
         // direct V8 `validate` path has no anchor maps.
         _validate = (data) => this._compiled.validateJSON(JSON.stringify(data));

package/lib/interpreter.js

@@ -102,6 +102,16 @@ function walkSchema(node, baseUri, state, isResourceRoot) {
     const list = node[kw];
     if (Array.isArray(list)) for (const sub of list) walkSchema(sub, baseUri, state, false);
   }
+  // propertyDependencies nests one level deeper than the other maps:
+  // property name -> property value -> schema.
+  const propDeps = node.propertyDependencies;
+  if (propDeps && typeof propDeps === 'object' && !Array.isArray(propDeps)) {
+    for (const choices of Object.values(propDeps)) {
+      if (choices && typeof choices === 'object' && !Array.isArray(choices)) {
+        for (const sub of Object.values(choices)) walkSchema(sub, baseUri, state, false);
+      }
+    }
+  }
 }
 
 // ---------- ref resolution ----------
@@ -504,6 +514,23 @@ class Interpreter {
           }
         }
       }
+      // propertyDependencies: like dependentSchemas but keyed on the property's
+      // value rather than its presence. Only string values can match, since the
+      // inner keys are object keys. Equivalent to
+      // `if: { properties: { p: { const: v } }, required: [p] }, then: <schema>`.
+      if (schema.propertyDependencies && typeof schema.propertyDependencies === 'object') {
+        for (const [key, choices] of Object.entries(schema.propertyDependencies)) {
+          if (!choices || typeof choices !== 'object' || Array.isArray(choices)) continue;
+          if (!Object.prototype.hasOwnProperty.call(data, key)) continue;
+          const value = data[key];
+          if (typeof value !== 'string') continue;
+          if (!Object.prototype.hasOwnProperty.call(choices, value)) continue;
+          const sub = { props: null, items: null };
+          const branchPath = schemaPath + '/propertyDependencies/' + escapePointer(key) + '/' + escapePointer(value);
+          if (!this.eval(choices[value], data, base, dynScope, errors, instancePath, branchPath, stack, sub)) valid = false;
+          else mergeAnnotations(local, sub);
+        }
+      }
     }
 
     // in-place applicators

package/lib/js-compiler.js

@@ -115,6 +115,7 @@ function compileToJS(schema, defs, schemaMap) {
   // Bail on features that are too complex for JS fast path
   if (schema.patternProperties ||
       schema.dependentSchemas ||
+      schema.propertyDependencies ||
       schema.propertyNames) {
     return null
   }
@@ -749,6 +750,11 @@ function codegenSafe(schema, schemaMap) {
   if (typeof schema === 'boolean') return true
   if (typeof schema !== 'object' || schema === null) return true
 
+  // propertyDependencies is a proposal the interpreted engine implements and
+  // neither JS path does. Emitting nothing for it would make the keyword
+  // vacuous, so hand the schema over rather than silently ignore a constraint.
+  if (schema.propertyDependencies !== undefined) return false
+
   // Only bail on $dynamicRef if it can't be resolved at compile time
   if (schema.$dynamicRef && !schema.$dynamicRef.startsWith('#')) return false
 

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.4.0';
+module.exports = '1.5.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
   "main": "index.js",
   "module": "index.mjs",
@@ -44,7 +44,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_format_engine_parity.js && node tests/test_defs_pointer_alias.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_order.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_buffer_path_parity.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_format_engine_parity.js && node tests/test_defs_pointer_alias.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_order.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7",
     "test:compat": "node tests/test_compat.js",
@@ -112,12 +112,12 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.4.0",
-    "@ata-validator/native-linux-x64-gnu": "1.4.0",
-    "@ata-validator/native-linux-arm64-gnu": "1.4.0",
-    "@ata-validator/native-linux-x64-musl": "1.4.0",
-    "@ata-validator/native-linux-arm64-musl": "1.4.0",
-    "@ata-validator/native-win32-x64": "1.4.0"
+    "@ata-validator/native-darwin-arm64": "1.5.1",
+    "@ata-validator/native-linux-x64-gnu": "1.5.1",
+    "@ata-validator/native-linux-arm64-gnu": "1.5.1",
+    "@ata-validator/native-linux-x64-musl": "1.5.1",
+    "@ata-validator/native-linux-arm64-musl": "1.5.1",
+    "@ata-validator/native-win32-x64": "1.5.1"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"