ata-validator 1.40.0 → 1.41.0

package/README.md

@@ -5,6 +5,8 @@ JSON Schema validation that compiles for speed and still runs where code generat
 [![npm](https://img.shields.io/npm/v/ata-validator)](https://www.npmjs.com/package/ata-validator)
 [![License](https://img.shields.io/npm/l/ata-validator)](LICENSE)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/ata-core/ata-validator/badge)](https://scorecard.dev/viewer/?uri=github.com/ata-core/ata-validator)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/15196/badge)](https://www.bestpractices.dev/projects/15196)
+[![Socket Badge](https://badge.socket.dev/npm/package/ata-validator)](https://socket.dev/npm/package/ata-validator)
 
 1.0 is a stability commitment: see [docs/STABILITY.md](docs/STABILITY.md) for the semver, deprecation, and error-code guarantees.
 
@@ -554,7 +556,8 @@ included. For the plugin's three-schema test entry a minified Vite build goes fr
 checks takes 1.12 ms where the runtime takes 6.63 ms (median of 15 fresh processes). Across
 SchemaStore's 977 schemas, 725 can be compiled away; the rest stay on the runtime. Where the code only calls `isValidObject()` or `isValidJSON()`, the plugin uses
 `fromCompiledVerdict()` from `ata-validator/compiled-verdict` instead, which carries no error pipeline: a
-small app that only asks for a boolean bundles to 2.1 KB gzipped, against 11.5 KB with the full wrapper.
+small app that only asks for a boolean bundles to 2.6 KB gzipped, against 12.1 KB with the full wrapper, on
+ata 1.40.0 with `@ata-project/unplugin` 0.5.0.
 
 Programmatic API if you prefer to script it:
 

package/index.js

@@ -395,8 +395,9 @@ installCodegenPaths.compileVerdict = function compileVerdict () {
     return;
   }
   const uf = this._userFormats;
-  const _cg = compileToJSCodegen(this._schemaObj, sm, uf);
-  const jsFn = _cg || compileToJS(this._schemaObj, null, sm);
+  // Custom keywords: see the note on the same call in lib/validator-core.js.
+  const _cg = compileToJSCodegen(this._schemaObj, sm, uf, this._keywords ? { keywords: this._keywords } : undefined);
+  const jsFn = _cg || (this._usesKeywords ? null : compileToJS(this._schemaObj, null, sm));
   this._jsFn = jsFn;
   if (jsFn) {
     _bindVerdict(this, jsFn);
@@ -408,7 +409,7 @@ installCodegenPaths.compileVerdict = function compileVerdict () {
     // is the bug this cache had once already. `isCodegen` rides along so a
     // validator that later reuses this entry reports the same engine it
     // would have compiled to.
-    if (!uf) {
+    if (!uf && !this._keywords) {
       if (!cached) _compileCache.set(mapKey, { jsFn, combined: undefined, errFn: undefined, isCodegen: !!_cg, full: false });
       else cached.jsFn = jsFn;
     }
@@ -433,6 +434,9 @@ installCodegenPaths.installScanner = function installScanner (schemaObj, options
   // builds it now, which is how the differential test reaches it.
   this._ensureScanner = (now) => {
     if (self._scanner === undefined) {
+      // The scanner reads the schema's own keywords from the text and knows
+      // nothing of custom ones, so it would accept what they reject.
+      if (self._usesKeywords) { self._scanner = null; return null; }
       if (!now && ++calls < SCAN_AFTER) return undefined;
       const built = require('./lib/scan-compiler').compileScanner(schemaObj, { userFormats: self._userFormats });
       self._scanner = built ? built.scan : null;

package/lib/aot-build.js

@@ -30,9 +30,13 @@ async function expandGlobs(globs) {
         out.push(path.resolve(g));
         continue;
       }
-      const m = g.match(/^(.*?)(?:\/\*\.(.+))?$/);
-      const dir = m && m[1] ? m[1] : '.';
-      const ext = m && m[2] ? '.' + m[2] : null;
+      // Split on the first "/*." that has something after it, by index rather
+      // than a regular expression, which backtracked polynomially on a long
+      // run of "/*.a".
+      const star = g.indexOf('/*.');
+      const split = star !== -1 && star + 3 < g.length;
+      const dir = (split ? g.slice(0, star) : g) || '.';
+      const ext = split ? '.' + g.slice(star + 3) : null;
       if (!fs.existsSync(dir)) continue;
       for (const entry of fs.readdirSync(dir)) {
         if (ext && !entry.endsWith(ext)) continue;

package/lib/aot-impl.js

@@ -727,11 +727,28 @@ function loadBundle(Validator, mods, schemas, opts) {
   });
 }
 
+// A module written here may end up inline in an HTML page, inside a <script>
+// element, and the HTML parser ends that element at the first `</script` it
+// sees, whatever JavaScript context it is in. A schema string carrying one, an
+// enum value, a pattern, a property name, closed the element early and handed
+// the rest of the module to the HTML parser. `<!--` changes how the parser
+// reads the element too. Both are written with `\x3C` for the `<`, an escape
+// that means the same character in a string, a template and a regular
+// expression, with or without the u flag. An escaped `\<`, which the emitters
+// do not write but a pattern could carry, has its backslash dropped, since
+// `\x3C` already is the escape. A module with neither sequence, which is
+// nearly every one, comes back as the same string.
+function htmlSafe(src) {
+  if (typeof src !== 'string' || src.indexOf('<') === -1) return src;
+  return src.replace(/(\\*)<(\/script|!--)/gi, (m, bs, rest) => (bs.length % 2 ? bs.slice(0, -1) : bs) + '\\x3C' + rest);
+}
+const htmlSafeResult = (fn) => function () { return htmlSafe(fn.apply(this, arguments)); };
+
 module.exports = {
-  toStandalone,
-  toStandaloneModule,
-  bundle,
-  bundleStandalone,
-  bundleCompact,
+  toStandalone: htmlSafeResult(toStandalone),
+  toStandaloneModule: htmlSafeResult(toStandaloneModule),
+  bundle: htmlSafeResult(bundle),
+  bundleStandalone: htmlSafeResult(bundleStandalone),
+  bundleCompact: htmlSafeResult(bundleCompact),
   loadBundle,
 };

package/lib/draft7.js

@@ -166,6 +166,22 @@ function _normalizeNullable(schema) {
     }
   }
   if ('nullable' in schema) delete schema.nullable
+  // A JSON Pointer in a URI fragment is percent-encoded, so a definition named
+  // `Node<Row>` is reached by `#/definitions/Node%3CRow%3E` (RFC 6901, section
+  // 6). The interpreter decodes the fragment; the code generator compared the
+  // encoded text with the definition names and declined the whole document, so
+  // one such reference sent every validator built from it to the interpreter and
+  // made `ata compile` refuse it. Rewritten here to the decoded pointer, every
+  // engine reads the same text. A decoded form still holding a `%` is left
+  // alone: the engines decode once more, and `100%` must not be decoded twice.
+  // This walk is the one every normalization runs, so it costs no second pass;
+  // a reference it does not reach keeps the old behaviour, the interpreter.
+  if (/^#.*%/.test(schema.$ref)) {
+    try {
+      const decoded = decodeURIComponent(schema.$ref)
+      if (!decoded.includes('%')) schema.$ref = decoded
+    } catch {}
+  }
 
   const objSubs = ['properties', 'patternProperties', '$defs', 'definitions', 'dependentSchemas']
   for (const key of objSubs) {

package/lib/interpreter.js

@@ -1258,6 +1258,6 @@ module.exports = { createInterpreter };
 // For lib/plan-source.js, which emits source from the same plans and must call
 // the same helpers so the two cannot answer differently.
 Object.defineProperty(module.exports, '_planInternals', {
-  value: { Plan, deepEqual, cpAtLeast, cpAtMost, multipleOfOk, dataBits, T_STRING, T_NUMBER, T_INTEGER, T_BOOLEAN, T_NULL, T_OBJECT, T_ARRAY, T_ANY },
+  value: { Plan, deepEqual, cpAtLeast, cpAtMost, multipleOfOk, dataBits, typeBit, T_STRING, T_NUMBER, T_INTEGER, T_BOOLEAN, T_NULL, T_OBJECT, T_ARRAY, T_ANY },
   enumerable: false,
 });

package/lib/js-compiler.js

@@ -2093,7 +2093,14 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
   if (hasUnresolvableRef(schema, rootDefs, anchors, schemaMap, new Set())) return null
   if (needsBaseTracking(schema, schemaMap, new Set())) return null
 
-  const ctx = { varCounter: 0, helpers: [], helperCode: [], preamble: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen], rootDefs, refStack: new Set(), schemaMap: schemaMap || null, anchors, rootSchema: inputSchema, userFormats: userFormats || null, removeNodes }
+  const ctx = { varCounter: 0, helpers: [], helperCode: [], preamble: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen], rootDefs, refStack: new Set(), schemaMap: schemaMap || null, anchors, rootSchema: inputSchema, userFormats: userFormats || null, removeNodes,
+    keywords: (opts && opts.keywords) || null, kwEmitted: null }
+  if (ctx.keywords) {
+    // Macro keywords expand into a schema of their own, which this generator
+    // does not apply; such a schema stays on the interpreted engine.
+    if (usesMacroKeyword(schema, schemaMap, ctx.keywords)) return null
+    ctx.kwEmitted = new Set()
+  }
   const lines = []
   try {
     genCode(schema, 'd', lines, ctx)
@@ -2101,6 +2108,16 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
     if (e === DECLINE) return null
     throw e
   }
+  // Every schema node that carries a custom keyword must have had its check
+  // written. A path that inlined a node without going through genCodeNode
+  // would drop the keyword and accept what it should reject, so a node that
+  // was not reached declines the whole schema to the interpreted engine
+  // instead. Unreferenced definitions decline too: slower, never wrong.
+  if (ctx.keywords) {
+    for (const node of keywordNodes(schema, schemaMap, ctx.keywords)) {
+      if (!ctx.kwEmitted.has(node)) return null
+    }
+  }
 
   // Append deferred checks (additionalProperties, unevaluatedProperties) at the end
   if (ctx.deferredChecks) {
@@ -2449,6 +2466,115 @@ function _deferOrInline(ctx, lines, v, check) {
 // 'object' = we know v is a non-null non-array object
 // 'array'  = we know v is an array
 // 'string' / 'number' / 'integer' = we know the primitive type
+// Custom keywords (the `keywords` option, normalized by lib/keywords.js) as
+// calls into the caller's functions, threaded in as closure variables the way
+// user formats are. Each check is built here with the interpreter's own
+// semantics, so the two engines cannot disagree on one: the keyword is skipped
+// for data outside its declared types (the interpreter's type bits), the
+// compile form is built once per schema node, and any errors the function
+// leaves on itself are cleared after the call, as runCustomV does. Written
+// first in the node, before anything that could return early.
+// The interpreter's type bits (lib/interpreter.js typeBit and dataBits),
+// copied rather than required: loading the interpreter added about a
+// millisecond to the first call of a schema that never needs it.
+// tests/test_custom_keyword_codegen.js holds the copies equal to the originals.
+const KW_T_ANY = 127
+function kwTypeBit (name) {
+  switch (name) {
+    case 'string': return 1
+    case 'number': return 2
+    case 'integer': return 4
+    case 'boolean': return 8
+    case 'null': return 16
+    case 'object': return 32
+    case 'array': return 64
+    default: return KW_T_ANY
+  }
+}
+function kwDataBits (d) {
+  switch (typeof d) {
+    case 'string': return 1
+    case 'number':
+      if (!isFinite(d)) return 0
+      return Number.isInteger(d) ? 2 | 4 : 2
+    case 'boolean': return 8
+    case 'object':
+      if (d === null) return 16
+      return Array.isArray(d) ? 64 : 32
+    default: return 0
+  }
+}
+function genCustomKeywords (schema, v, lines, ctx) {
+  for (const key of Object.keys(schema)) {
+    const def = ctx.keywords[key]
+    if (def === undefined || def.macro !== null) continue
+    const value = schema[key]
+    const dataBits = kwDataBits
+    const T_ANY = KW_T_ANY
+    let mask = T_ANY
+    if (def.types !== null) {
+      mask = 0
+      for (const t of def.types) mask |= kwTypeBit(t)
+    }
+    let fn
+    if (def.compile !== null) {
+      fn = def.compile(value, schema)
+      if (typeof fn !== 'function') throw new Error(`keyword "${key}": compile must return a function`)
+    } else {
+      const validate = def.validate
+      fn = (data) => validate(value, data, schema)
+      fn.source = validate
+    }
+    const holder = () => fn.source || fn
+    const check = mask === T_ANY
+      ? (data) => { const ok = fn(data); const h = holder(); if (h.errors) h.errors = null; return !!ok }
+      : (data) => {
+          if ((dataBits(data) & mask) === 0) return true
+          const ok = fn(data); const h = holder(); if (h.errors) h.errors = null; return !!ok
+        }
+    const name = '_kwc' + ctx.closureVars.length
+    ctx.closureVars.push(name)
+    ctx.closureVals.push(check)
+    lines.push(`if(!${name}(${v}))return false`)
+  }
+  ctx.kwEmitted.add(schema)
+}
+
+// Map keys under these are names, not keywords (lib/keywords.js NAME_MAPS).
+const KW_NAME_MAPS = new Set([
+  'properties', 'patternProperties', '$defs', 'definitions',
+  'dependentSchemas', 'dependentRequired', 'dependencies', 'propertyDependencies',
+])
+function forEachKeywordNode (schema, schemaMap, keywords, visit) {
+  const seen = new Set()
+  const walk = (node, keysAreNames) => {
+    if (node === null || typeof node !== 'object' || seen.has(node)) return
+    seen.add(node)
+    if (Array.isArray(node)) { for (const item of node) walk(item, false); return }
+    let has = false
+    for (const key of Object.keys(node)) {
+      if (!keysAreNames && keywords[key] !== undefined) has = true
+      const val = node[key]
+      if (val !== null && typeof val === 'object') walk(val, !keysAreNames && KW_NAME_MAPS.has(key))
+    }
+    if (has) visit(node)
+  }
+  walk(schema, false)
+  if (schemaMap) for (const s of schemaMap.values()) walk(s, false)
+}
+function keywordNodes (schema, schemaMap, keywords) {
+  const out = []
+  forEachKeywordNode(schema, schemaMap, keywords, (n) => out.push(n))
+  return out
+}
+function usesMacroKeyword (schema, schemaMap, keywords) {
+  let macro = false
+  forEachKeywordNode(schema, schemaMap, keywords, (n) => {
+    for (const key of Object.keys(n)) if (keywords[key] !== undefined && keywords[key].macro !== null) macro = true
+  })
+  return macro
+}
+
 function genCode(schema, v, lines, ctx, knownType) {
   return withPlain(schema, v, lines, ctx, () => genCodeNode(schema, v, lines, ctx, knownType))
 }
@@ -2459,6 +2585,7 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
   if (schema === false) { lines.push('return false'); return }
   if (schema === true) return
   if (typeof schema !== 'object' || schema === null) return
+  if (ctx.keywords) genCustomKeywords(schema, v, lines, ctx)
   if (!ctx.regExpMap) {
     ctx.regExpMap = new Map();
   }
@@ -3951,7 +4078,12 @@ const FORMAT_CODEGEN = {
 }
 
 // Safe key escaping: use JSON.stringify to handle all special chars (newlines, null bytes, etc.)
-function esc(s) { return JSON.stringify(s).slice(1, -1) }
+// A schema string as the body of a JavaScript string literal, single- or
+// double-quoted. JSON.stringify escapes the double quote and the backslash;
+// the single quote needs its own escape, because the error emitters put these
+// in '...' literals. Without it a property name holding a quote closed the
+// literal, and the rest of the name ran as code in the generated validator.
+function esc(s) { return JSON.stringify(s).slice(1, -1).replace(/'/g, "\\'") }
 // A schema pointer segment for a pattern: JSON Pointer escaping, then made
 // safe for the single-quoted literal the error emitters use.
 function ptrSeg(s) { return s.replace(/~/g, '~0').replace(/\//g, '~1').replace(/\\/g, '\\\\').replace(/'/g, "\\'") }
@@ -6157,3 +6289,5 @@ function _collectEval(schema, result, defs, schemaMap, refStack, isRoot) {
 }
 
 module.exports = { compileToJS, compileToJSCodegen, compileToJSCodegenWithErrors, compileToJSCombined, collectEvaluated, unevalContributions, AJV_MESSAGES, _setCodeBudget }
+// For tests/test_custom_keyword_codegen.js, which holds these copies to the interpreter's.
+Object.defineProperty(module.exports, '_kwTypeBits', { value: { kwTypeBit, kwDataBits, KW_T_ANY }, enumerable: false })

package/lib/render-compact.js

@@ -36,7 +36,7 @@ function renderCompact (errors, opts) {
   let summary = `Found ${n} error${n === 1 ? '' : 's'} in ${opts.context || 'input'}`;
   if (shown !== n) summary += `, shown as ${shown} diagnostic${shown === 1 ? '' : 's'}`;
   lines.push(summary + '.');
-  if (!(process.stdout && process.stdout.isTTY)) {
+  if (!(typeof process !== 'undefined' && process.stdout && process.stdout.isTTY)) {
     lines.push('(run with --pretty for source frames)');
   }
   return lines.join('\n');

package/lib/render-shared.js

@@ -9,13 +9,21 @@ const ANSI = {
   cyan: '\x1b[36m',
 };
 
+// A browser, a Worker or Deno without the Node globals has no `process`, and
+// the renderers ship in the browser entry: reading it bare threw a
+// ReferenceError there. Without it there is no terminal, so no colour, a
+// default width and no working directory to trim.
+const proc = typeof process !== 'undefined' ? process : null;
+
 function resolveColor (opt) {
   if (opt === 'never') return false;
   if (opt === 'always') return true;
-  if (process.env.NO_COLOR != null && process.env.NO_COLOR !== '') return false;
-  const fc = process.env.FORCE_COLOR;
+  if (proc === null) return false;
+  const env = proc.env || {};
+  if (env.NO_COLOR != null && env.NO_COLOR !== '') return false;
+  const fc = env.FORCE_COLOR;
   if (fc === '1' || fc === '2' || fc === '3' || fc === 'true') return true;
-  return !!(process.stdout && process.stdout.isTTY);
+  return !!(proc.stdout && proc.stdout.isTTY);
 }
 
 function color (enabled, code, s) {
@@ -40,7 +48,8 @@ function pathToDotted (jsonPointer) {
 
 function trimCwd (file, cwd) {
   if (!file) return file;
-  const c = cwd || process.cwd();
+  const c = cwd || (proc !== null && typeof proc.cwd === 'function' ? proc.cwd() : '');
+  if (!c) return file;
   if (file.startsWith(c + '/')) return file.slice(c.length + 1);
   return file;
 }
@@ -51,7 +60,7 @@ function truncateLine (text, maxWidth) {
 }
 
 function terminalWidth () {
-  const w = process.stdout && process.stdout.columns;
+  const w = proc !== null && proc.stdout && proc.stdout.columns;
   return (typeof w === 'number' && w > 0) ? w : 100;
 }
 

package/lib/schema-scan.js

@@ -28,6 +28,7 @@ const DEFINITIONS = 1 << 3;      // `definitions`, renamed to `$defs`
 const DEPENDENCIES = 1 << 4;     // `dependencies`, split into two keywords
 const TUPLE_ITEMS = 1 << 5;      // array-valued `items`, split into `prefixItems`
 const EXCLUSIVE_BOOL = 1 << 6;   // draft-04's boolean `exclusiveMinimum`/`exclusiveMaximum`
+const ENCODED_REF = 1 << 7;      // a fragment `$ref` holding a percent escape, decoded by normalizeNullable's walk
 
 // Everything only draft-07 normalization acts on. A schema of another dialect
 // can carry these without them meaning anything, so they are read together
@@ -84,6 +85,7 @@ function scan(schema) {
     // to contribute here, and walking it is the slower path in V8.
     const keys = Object.keys(node);
     if (typeof node.$ref === 'string') {
+      if (node.$ref[0] === '#' && node.$ref.includes('%')) bits |= ENCODED_REF;
       for (let i = 0; i < keys.length; i++) {
         if (!REF_SIBLINGS_KEPT.has(keys[i])) { bits |= REF_SIBLINGS; break; }
       }
@@ -102,11 +104,11 @@ function scan(schema) {
 // rules apply at all, which the caller already knows.
 function needsNormalization(schema, isDraft7) {
   const bits = scan(schema);
-  if (bits & NULLABLE) return true;
   // The boolean form of the exclusive bounds is draft-04's, and it is
   // unambiguous wherever it appears: no later dialect gives a boolean any
-  // meaning there. Normalizing it is not gated on the declared dialect.
-  if (bits & EXCLUSIVE_BOOL) return true;
+  // meaning there. Percent-encoded fragments mean the same in every dialect
+  // too. Neither is gated on the declared dialect.
+  if (bits & (NULLABLE | EXCLUSIVE_BOOL | ENCODED_REF)) return true;
   return isDraft7 ? (bits & DRAFT7_WORK) !== 0 : false;
 }
 
@@ -120,5 +122,6 @@ module.exports = {
   DEPENDENCIES,
   TUPLE_ITEMS,
   EXCLUSIVE_BOOL,
+  ENCODED_REF,
   DRAFT7_WORK,
 };

package/lib/validator-core.js

@@ -609,7 +609,17 @@ function _materializeSchema(self) {
   if (options.assertFormat === false) {
     schemaObj = stripFormatAssertions(isCallers ? _deepCloneWithSymbols(schemaObj) : schemaObj);
   }
-  const usesKeywords = self._keywords !== null && schemaUsesKeywords(schemaObj, self._keywords);
+  // A keyword used only in a schema reached through $ref counts too: the
+  // interpreted engine applies it there, and every path that does not know the
+  // keyword has to stand aside for it. Looking at the root alone, a keyword in
+  // a referenced schema was skipped by every compiled path and accepted
+  // whatever it should have rejected.
+  let usesKeywords = self._keywords !== null && schemaUsesKeywords(schemaObj, self._keywords);
+  if (!usesKeywords && self._keywords !== null && self._schemaMap && self._schemaMap.size > 0) {
+    for (const ext of self._schemaMap.values()) {
+      if (schemaUsesKeywords(ext, self._keywords)) { usesKeywords = true; break; }
+    }
+  }
   Object.defineProperty(self, '_schemaObj', { value: schemaObj, writable: true, configurable: true, enumerable: true });
   Object.defineProperty(self, '_usesKeywords', { value: usesKeywords, writable: true, configurable: true, enumerable: true });
   Object.defineProperty(self, '_schemaIsCallers', { value: isCallers && schemaObj === raw, writable: true, configurable: true, enumerable: true });
@@ -849,7 +859,7 @@ class Validator {
     // interpreted engine is both eval-free and more correct, so go straight
     // there. The forced case is decided before the probe: the probe is a
     // `new Function` too, and a validator that promised none must not run it.
-    if (_forceNapi || this._v1Dynamic || this._usesKeywords || !codegenAvailable()) {
+    if (_forceNapi || this._v1Dynamic || !codegenAvailable()) {
       jsFn = null; jsCombinedFn = null; jsErrFn = null;
     // `full` separates an entry that holds every compiled function from one
     // the verdict-only fast path seeded, where `combined` and `errFn` are null
@@ -871,8 +881,17 @@ class Validator {
       this._engine = _isCodegen ? 'codegen' : jsFn ? 'closure' : null;
     } else {
       const uf = this._userFormats;
-      const _cgFn = compileToJSCodegen(schemaObj, sm, uf);
-      jsFn = _cgFn || compileToJS(schemaObj, null, sm);
+      // Custom keywords compile into the verdict function as calls to the
+      // caller's functions. Only the verdict: the error and combined
+      // generators, the closure compiler and the text scanner know nothing of
+      // them and would skip the keyword, accepting what it rejects, so for a
+      // schema that uses one they are not built, and errors come from the
+      // interpreted engine, which applies the keywords. Where the generator
+      // declines the schema, so does everything else, and the interpreted
+      // engine answers alone, as it always did.
+      const kw = this._keywords ? { keywords: this._keywords } : undefined;
+      const _cgFn = compileToJSCodegen(schemaObj, sm, uf, kw);
+      jsFn = _cgFn || (this._usesKeywords ? null : compileToJS(schemaObj, null, sm));
       // Only the verdict is compiled here. The error and combined generators
       // are the other two thirds of a cold first call (8.2, 10.4 and 7.8 ms on
       // a 120-property config schema, most of it V8 compiling each generator
@@ -882,7 +901,9 @@ class Validator {
       jsErrFn = undefined;
       _isCodegen = !!_cgFn;
       this._engine = _cgFn ? 'codegen' : jsFn ? 'closure' : null;
-      if (!uf) {
+      // A function bound to this validator's keyword functions or formats is
+      // not the schema's alone, so it is not shared through the cache.
+      if (!uf && !this._keywords) {
         _compileCache.set(mapKey, { jsFn, combined: undefined, errFn: undefined, isCodegen: _isCodegen, full: false });
       }
     }
@@ -991,12 +1012,12 @@ class Validator {
     };
     const _buildCombined = () => {
       if (jsCombinedFn !== undefined) return;
-      jsCombinedFn = compileToJSCombined(schemaObj, VALID_RESULT, sm, this._userFormats, { runtimeShape: true }) || null;
+      jsCombinedFn = this._usesKeywords ? null : (compileToJSCombined(schemaObj, VALID_RESULT, sm, this._userFormats, { runtimeShape: true }) || null);
       _upgradeCacheEntry();
     };
     const _buildErr = () => {
       if (jsErrFn !== undefined) return;
-      jsErrFn = compileToJSCodegenWithErrors(schemaObj, sm, this._userFormats, { runtimeShape: true }) || null;
+      jsErrFn = this._usesKeywords ? null : (compileToJSCodegenWithErrors(schemaObj, sm, this._userFormats, { runtimeShape: true }) || null);
       _upgradeCacheEntry();
     };
 

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.40.0';
+module.exports = '1.41.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "description": "JSON Schema validator that compiles to plain JavaScript, still runs where code generation is blocked, and can be compiled away at build time. Passes the full official test suite.",
   "main": "index.js",
   "module": "index.mjs",
@@ -64,7 +64,7 @@
     "release:check": "node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_embed.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_text_path_errors.js && node tests/test_compiled_parity.js && node tests/test_compiled_extension_parity.js && node tests/test_buffer_gate.js && node tests/test_scanner_differential.js && node tests/test_validate_json_scanner_cost.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_error_list_differential.js && node tests/test_output_format.js && node tests/test_standard_json_schema.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_esm_exports.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_native_lazy.js && node tests/test_buffer_apis_without_native.js && node tests/test_cold_start_modules.js && node tests/test_safe_regex_embed.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_regex_ecma_whitespace.js && node tests/test_regex_native_linear.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_option.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_error_accumulator_collision.js && node tests/test_uri_helper_parity.js && node tests/test_uri_fast_path.js && node tests/test_extend_verdict.js && node tests/test_ipv4_regex.js && node tests/test_ipv6_fast_path.js && node tests/test_nested_recursion_decline.js && node tests/test_generator_error_content.js && node tests/test_inherited_key_presence.js && node tests/test_proto_accessor.js && node tests/test_hybrid_tier.js && node tests/test_first_rejection_builds_one.js && node tests/test_container_local.js && node tests/test_one_shot_validate.js && node tests/test_fixed_pattern_inline.js && node tests/test_plan_source.js && node tests/test_fused_remove_additional.js && node tests/test_runtime_parse.js && node tests/test_formats_single_pass.js && node tests/test_email_format_cost.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_ref_annotation_siblings.js && node tests/test_gate_wrapped_schemas.js && node tests/test_pattern_message_escape.js && node tests/test_nested_defaults_engines.js && node tests/test_nested_coercion_parity.js && node tests/test_preprocess_cache.js && node tests/test_large_schema_codegen.js && node tests/test_base_uri.js && node tests/test_hoisted_def_recursion.js && node tests/test_alias_definitions.js && node tests/test_property_names_ref.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_deferred_def_scope.js && node tests/test_node_scoped_ctx_flags.js && node tests/test_fast_slot_exhaustion.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_unevaluated_differential.js && node tests/fuzz_differential.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_additional_props_combined_cost.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_ref_error_order.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_single_pass_errors.js && node tests/test_lazy_json_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_lite_parity.js && node tests/test_lite_bundle_size.js && node tests/test_defaults_own_keys.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_targeted_positions.js && node tests/test_position_map_cost.js && node tests/test_targeted_positions_cost.js && node tests/test_aot_staleness.js && node tests/test_file_positions.js && node tests/test_aot_positions_cost.js && node tests/test_schema_hash.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_aot_source_frames.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node tests/test_collect_evaluated.js && node tests/test_differential_tiers.js && node tests/test_draft7.js && node tests/test_dual_path.js && node tests/test_keywords_codegen.js && node tests/test_ref_cross.js && node tests/test_shape_classifier.js && node tests/test_tier0.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_number_text_parity.js && node tests/test_text_path_errors.js && node tests/test_compiled_parity.js && node tests/test_compiled_extension_parity.js && node tests/test_buffer_gate.js && node tests/test_scanner_differential.js && node tests/test_validate_json_scanner_cost.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_error_list_differential.js && node tests/test_output_format.js && node tests/test_standard_json_schema.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_esm_exports.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_native_lazy.js && node tests/test_buffer_apis_without_native.js && node tests/test_cold_start_modules.js && node tests/test_safe_regex_embed.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_regex_ecma_whitespace.js && node tests/test_regex_native_linear.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_engine_option.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_error_accumulator_collision.js && node tests/test_uri_helper_parity.js && node tests/test_uri_fast_path.js && node tests/test_extend_verdict.js && node tests/test_ipv4_regex.js && node tests/test_ipv6_fast_path.js && node tests/test_nested_recursion_decline.js && node tests/test_generator_error_content.js && node tests/test_inherited_key_presence.js && node tests/test_proto_accessor.js && node tests/test_hybrid_tier.js && node tests/test_first_rejection_builds_one.js && node tests/test_container_local.js && node tests/test_one_shot_validate.js && node tests/test_fixed_pattern_inline.js && node tests/test_plan_source.js && node tests/test_fused_remove_additional.js && node tests/test_runtime_parse.js && node tests/test_formats_single_pass.js && node tests/test_email_format_cost.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_encoded_refs.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_schema_code_injection.js && node tests/test_aot_html_safe.js && node tests/test_ref_annotation_siblings.js && node tests/test_gate_wrapped_schemas.js && node tests/test_pattern_message_escape.js && node tests/test_nested_defaults_engines.js && node tests/test_nested_coercion_parity.js && node tests/test_preprocess_cache.js && node tests/test_large_schema_codegen.js && node tests/test_base_uri.js && node tests/test_hoisted_def_recursion.js && node tests/test_alias_definitions.js && node tests/test_property_names_ref.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_deferred_def_scope.js && node tests/test_node_scoped_ctx_flags.js && node tests/test_fast_slot_exhaustion.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_custom_keyword_codegen.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_unevaluated_differential.js && node tests/fuzz_differential.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_additional_props_combined_cost.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_ref_error_order.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_single_pass_errors.js && node tests/test_lazy_json_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_lite_parity.js && node tests/test_lite_bundle_size.js && node tests/test_defaults_own_keys.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_targeted_positions.js && node tests/test_position_map_cost.js && node tests/test_targeted_positions_cost.js && node tests/test_aot_staleness.js && node tests/test_file_positions.js && node tests/test_aot_positions_cost.js && node tests/test_schema_hash.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_render_without_process.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_aot_source_frames.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node tests/test_collect_evaluated.js && node tests/test_differential_tiers.js && node tests/test_draft7.js && node tests/test_dual_path.js && node tests/test_keywords_codegen.js && node tests/test_ref_cross.js && node tests/test_shape_classifier.js && node tests/test_tier0.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -143,13 +143,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.40.0",
-    "@ata-validator/native-darwin-x64": "1.40.0",
-    "@ata-validator/native-linux-arm64-gnu": "1.40.0",
-    "@ata-validator/native-linux-arm64-musl": "1.40.0",
-    "@ata-validator/native-linux-x64-gnu": "1.40.0",
-    "@ata-validator/native-linux-x64-musl": "1.40.0",
-    "@ata-validator/native-win32-x64": "1.40.0"
+    "@ata-validator/native-darwin-arm64": "1.41.0",
+    "@ata-validator/native-darwin-x64": "1.41.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.41.0",
+    "@ata-validator/native-linux-arm64-musl": "1.41.0",
+    "@ata-validator/native-linux-x64-gnu": "1.41.0",
+    "@ata-validator/native-linux-x64-musl": "1.41.0",
+    "@ata-validator/native-win32-x64": "1.41.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"