ata-validator 1.42.0 → 1.43.0

package/lib/js-compiler.js

@@ -176,7 +176,24 @@ const { compileSafe, patternIsSafe } = require('./safe-regex')
 let _nativeIsLinear = null
 // The linearity check only parses; it runs first so a pattern bound for the
 // RegExp is never compiled for the engine just to be told it could have been.
+// Unicode property escapes need a real RegExp in unicode mode, as the
+// interpreter compiles them (Interpreter#pattern): the linear engine does not
+// know them, and without the flag `\p{L}` reads as the letters p, {, L, }.
+// The flag only where the pattern is valid with it, again as the interpreter
+// does. These patterns used to send the whole schema to the interpreter.
+const PROP_ESCAPE = /\\[pP]\{/
+function reFlags (src) {
+  if (!PROP_ESCAPE.test(src)) return ''
+  try { new RegExp(src, 'u'); return 'u' } catch { return '' }
+}
+// The flag argument for generated `new RegExp(<json literal>)` source.
+function reFlagArg (jsonLit) {
+  let raw
+  try { raw = JSON.parse(jsonLit) } catch { return '' }
+  return typeof raw === 'string' && reFlags(raw) ? ",'u'" : ''
+}
 const useSafeEngine = (src) => {
+  if (PROP_ESCAPE.test(src)) return false
   if (_nativeIsLinear === null) _nativeIsLinear = require('./regex-linear').nativeIsLinear
   if (_nativeIsLinear(src)) return false
   return patternIsSafe(src)
@@ -187,7 +204,7 @@ const useSafeEngine = (src) => {
 // standalone embeds the engine), else a plain RegExp. Both expose `.test`.
 function safeReClosure (ctx, src) {
   if (useSafeEngine(src)) { ctx.usesSafeRe = true; return compileSafe(src) }
-  return new RegExp(src)
+  return new RegExp(src, reFlags(src))
 }
 
 // Compile a JSON Schema into a pure JS validator function.
@@ -228,7 +245,7 @@ function literalValue (lit) {
 }
 
 function unescapeSp (sp) {
-  return sp.indexOf('\\') === -1 ? sp : sp.replace(/\\(.)/g, '$1')
+  return sp.indexOf('\\') === -1 ? sp : sp.replace(/\\u([0-9a-fA-F]{4})|\\(.)/g, (m, h, c) => (h !== undefined ? String.fromCharCode(parseInt(h, 16)) : c))
 }
 
 const FRAME_INLINE_MAX = 120
@@ -338,6 +355,7 @@ function compileToJS(schema, defs, schemaMap) {
   // A $ref cycle on one value recurses here as it does in generated code; see
   // hasSameInstanceRefCycle.
   if (!defs && hasSameInstanceRefCycle(schema)) return null
+  if (!defs && bothDefsContainers(schema)) return null
 
   // unevaluatedProperties / unevaluatedItems need annotation tracking this
   // path does not do. Decline so the schema reaches an engine that does.
@@ -589,7 +607,7 @@ function compileToJS(schema, defs, schemaMap) {
   }
   if (schema.pattern) {
     try {
-      const re = useSafeEngine(schema.pattern) ? compileSafe(schema.pattern) : new RegExp(schema.pattern)
+      const re = useSafeEngine(schema.pattern) ? compileSafe(schema.pattern) : new RegExp(schema.pattern, reFlags(schema.pattern))
       checks.push((d) => typeof d !== 'string' || re.test(d))
     } catch {
       return null
@@ -1481,7 +1499,6 @@ function codegenSafe(schema, schemaMap) {
   }
 
   // Unicode property escapes in pattern need 'u' flag — codegen uses RegExp without it
-  if (schema.pattern && /\\[pP]\{/.test(schema.pattern)) return false
 
   // $ref — allow local refs (#/$defs/Name) and non-local refs if in schemaMap
   if (schema.$ref) {
@@ -1516,17 +1533,11 @@ function codegenSafe(schema, schemaMap) {
         !resolvedTarget.propertyNames
       if (!targetSimple && schema.unevaluatedProperties === undefined && schema.unevaluatedItems === undefined) return false
     }
-    // In Draft 2020-12, $ref with siblings is allowed. Only bail if no unevaluated* keyword
-    // (unevaluated schemas need $ref + siblings to work properly): without one, the
-    // generators emit the $ref and skip the rest of the node, so a sibling that
-    // validates would be dropped. Schema-organization keywords and annotations
-    // validate nothing and do not count. Annotations are listed rather than
-    // inferred from what is not a validation keyword, so a keyword this list
-    // does not know still declines instead of being skipped. Measured on the
-    // 977 SchemaStore schemas: a $ref with a description or title beside it sent
-    // 223 of them to the interpreted engine.
-    const siblings = Object.keys(schema).filter(k => !REF_NEUTRAL_SIBLINGS.has(k) && !k.startsWith('x-'))
-    if (siblings.length > 0 && schema.unevaluatedProperties === undefined && schema.unevaluatedItems === undefined) return false
+    // In Draft 2020-12, $ref with siblings applies both. The verdict
+    // generator compiles the siblings after the reference (genCodeNode), the
+    // combined one too (genCodeCNode), and the error generator declines such
+    // a node, so a sibling is never dropped. This used to decline the whole
+    // schema unless an unevaluated keyword was beside the reference.
   }
 
   // additionalProperties as schema — supported when no composition (allOf/oneOf/anyOf)
@@ -1608,7 +1619,6 @@ function codegenSafe(schema, schemaMap) {
   // compiled to code that ignored it.
   if (schema.patternProperties) {
     for (const [pat, sub] of Object.entries(schema.patternProperties)) {
-      if (/\\[pP]\{/.test(pat)) return false
       if (typeof sub === 'object' && sub !== null && !codegenSafe(sub, schemaMap)) return false
     }
   }
@@ -1947,8 +1957,20 @@ function hasSameInstanceRefCycle(root) {
   return found
 }
 
+// The generators look a definition up by name in one table, `$defs` or else
+// `definitions`, whichever container the pointer named. With both at the root,
+// `#/definitions/x` read `$defs/x`: a draft 7 schema carrying both, with
+// different schemas under one name, rejected what it allowed and accepted
+// what it rejected. The interpreter resolves the pointer as written, so a
+// schema with both goes there. None of SchemaStore's 980 has both.
+function bothDefsContainers(schema) {
+  return schema.$defs !== null && typeof schema.$defs === 'object' &&
+    schema.definitions !== null && typeof schema.definitions === 'object'
+}
+
 function sharedCodegenGate(schema, schemaMap) {
   if (typeof schema !== 'object' || schema === null) return true
+  if (bothDefsContainers(schema)) return false
   if (hasSameInstanceRefCycle(schema)) return false
   if (!codegenSafe(schema, schemaMap)) return false
   if (needsBaseTracking(schema, schemaMap, new Set())) return false
@@ -2276,6 +2298,15 @@ function prepareForCodegen(schema, schemaMap) {
   return normalizePropertyNames(normalizeRefs(schema, schemaMap))
 }
 
+const VERDICT_SPLIT = 64 * 1024
+function sourceSize (lines, ctx) {
+  let n = 0
+  for (const l of lines) n += l.length
+  for (const l of ctx.preamble) n += l.length
+  if (ctx.deferredChecks) for (const l of ctx.deferredChecks) n += l.length
+  return n
+}
+
 function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
   const inputSchema = schema
   schema = prepareForCodegen(schema, schemaMap)
@@ -2300,7 +2331,6 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
   // patternProperties: bail only on boolean sub-schemas or unicode property escapes
   if (schema.patternProperties) {
     for (const [pat, sub] of Object.entries(schema.patternProperties)) {
-      if (/\\[pP]\{/.test(pat)) return null
       if (typeof sub === 'object' && sub !== null && !codegenSafe(sub, schemaMap)) return null
     }
   }
@@ -2349,20 +2379,28 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
   if (hasUnresolvableRef(schema, rootDefs, anchors, schemaMap, new Set())) return null
   if (needsBaseTracking(schema, schemaMap, new Set())) return null
 
-  const ctx = { varCounter: 0, helpers: [], helperCode: [], preamble: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen], rootDefs, refStack: new Set(), schemaMap: schemaMap || null, anchors, rootSchema: inputSchema, userFormats: userFormats || null, removeNodes,
-    keywords: (opts && opts.keywords) || null, kwEmitted: null }
-  if (ctx.keywords) {
-    // Macro keywords expand into a schema of their own, which this generator
-    // does not apply; such a schema stays on the interpreted engine.
-    if (usesMacroKeyword(schema, schemaMap, ctx.keywords)) return null
-    ctx.kwEmitted = new Set()
-  }
-  const lines = []
-  try {
-    genCode(schema, 'd', lines, ctx)
-  } catch (e) {
-    if (e === DECLINE) return null
-    throw e
+  // Macro keywords expand into a schema of their own, which this generator
+  // does not apply; such a schema stays on the interpreted engine.
+  if (opts && opts.keywords && usesMacroKeyword(schema, schemaMap, opts.keywords)) return null
+  // Every reference is first expanded where it is used, which is the fastest
+  // form for the checks. Past VERDICT_SPLIT of source the function is
+  // generated again with each definition referenced from several places
+  // written once, as a function in the preamble: expanded, SchemaStore's sarif
+  // (79 KB of schema) came to 2.8 MB of verdict source, and compiling it was
+  // half of the first validate() call.
+  let ctx, lines
+  for (const share of [false, true]) {
+    ctx = { varCounter: 0, helpers: [], helperCode: [], preamble: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen], rootDefs, refStack: new Set(), schemaMap: schemaMap || null, anchors, rootSchema: inputSchema, userFormats: userFormats || null, removeNodes,
+      keywords: (opts && opts.keywords) || null, kwEmitted: null, shareDefs: share }
+    if (ctx.keywords) ctx.kwEmitted = new Set()
+    lines = []
+    try {
+      genCode(schema, 'd', lines, ctx)
+    } catch (e) {
+      if (e === DECLINE) return null
+      throw e
+    }
+    if (share || sourceSize(lines, ctx) <= VERDICT_SPLIT) break
   }
   // Every schema node that carries a custom keyword must have had its check
   // written. A path that inlined a node without going through genCodeNode
@@ -2396,10 +2434,10 @@ function compileToJSCodegen(schema, schemaMap, userFormats, opts) {
       closureValues.push(compileSafe(JSON.parse(safeMatch[2])))
       continue
     }
-    const match = code.match(/^const (_re\d+)=new RegExp\((.+)\)$/)
+    const match = code.match(/^const (_re\d+)=new RegExp\((.+?)(?:,'(u)')?\)$/)
     if (match) {
       closureNames.push(match[1])
-      closureValues.push(new RegExp(JSON.parse(match[2])))
+      closureValues.push(new RegExp(JSON.parse(match[2]), match[3] || ''))
     }
   }
 
@@ -2913,7 +2951,9 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
   // $ref — guard against circular references
   // In 2020-12 with unevaluated*, $ref can coexist with siblings — don't early return
   // Only when THIS schema has unevaluated keywords directly (not via $ref target)
-  const hasSiblings = schema.$ref && (schema.unevaluatedProperties !== undefined || schema.unevaluatedItems !== undefined)
+  // Any keyword beside $ref that validates is compiled after the reference
+  // (2020-12 applies both; draft 7 drops such siblings when it is read).
+  const hasSiblings = !!schema.$ref && Object.keys(schema).some((k) => !REF_NEUTRAL_SIBLINGS.has(k) && !k.startsWith('x-'))
   if (schema.$ref) {
     if (genRefNode(schema, v, lines, ctx, knownType, hasSiblings)) return
   }
@@ -3121,7 +3161,7 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
           ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`);
           ctx.usesSafeRe = true
         } else {
-          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`);
+          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`);
         }
       }
       const ri = ctx.regExpMap.get(pattern);
@@ -3643,6 +3683,31 @@ function genRefNode(schema, v, lines, ctx, knownType, hasSiblings) {
       }
       lines.push(`if(!${fnName}(${v}))return false`)
       if (!hasSiblings) return true
+    } else if (ctx.shareDefs && !ctx.refStack.has(schema.$ref) && (ctx.sharedDefs || (ctx.sharedDefs = sharedDefNames(ctx.rootSchema, ctx.rootDefs))).has(defName)) {
+      // A shared definition off any cycle, as a plain function in the
+      // preamble (see compileToJSCodegen): no guard, since it cannot re-enter
+      // itself. Generated over its own `d` like the cyclic ones above.
+      if (!ctx.sharedDefFns) ctx.sharedDefFns = new Map()
+      let fnName = ctx.sharedDefFns.get(defName)
+      if (!fnName) {
+        fnName = '_dv' + ctx.sharedDefFns.size + '_' + defName.replace(/[^A-Za-z0-9_]/g, '_')
+        ctx.sharedDefFns.set(defName, fnName)
+        const bodyLines = []
+        const outerDeferred = ctx.deferredChecks
+        ctx.deferredChecks = null
+        ctx.refStack.add(schema.$ref)
+        try {
+          genCode(ctx.rootDefs[defName], 'd', bodyLines, ctx)
+        } finally {
+          ctx.refStack.delete(schema.$ref)
+        }
+        if (ctx.deferredChecks) for (const dc of ctx.deferredChecks) bodyLines.push(dc)
+        ctx.deferredChecks = outerDeferred
+        if (bodyLines.some((l) => /\b_validate\b/.test(l))) throw DECLINE
+        hoist(ctx, `function ${fnName}(d){${bodyLines.join('\n  ')}\n  return true}`)
+      }
+      lines.push(`if(!${fnName}(${v}))return false`)
+      if (!hasSiblings) return true
     } else if (ctx.refStack.has(schema.$ref)) { if (ctx.nestedBoolean) throw DECLINE; if (!hasSiblings) return true }
     else {
       ctx.refStack.add(schema.$ref)
@@ -4417,7 +4482,11 @@ const FORMAT_CODEGEN = {
 function esc(s) { return JSON.stringify(s).slice(1, -1).replace(/'/g, "\\'") }
 // A schema pointer segment for a pattern: JSON Pointer escaping, then made
 // safe for the single-quoted literal the error emitters use.
-function ptrSeg(s) { return s.replace(/~/g, '~0').replace(/\//g, '~1').replace(/\\/g, '\\\\').replace(/'/g, "\\'") }
+// A pointer segment as text for a single-quoted literal. Control characters
+// and the two line separators go in as \u escapes: written raw, a property
+// named "foo\nbar" broke the literal, the combined function failed to compile
+// and every schema with such a name lost it.
+function ptrSeg(s) { return s.replace(/~/g, '~0').replace(/\//g, '~1').replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/[\u0000-\u001f\u2028\u2029]/g, (c) => '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0')) }
 
 // Resolve child path at codegen time when parent is a static string literal.
 // This enables frozen pre-allocation for ALL nested error objects.
@@ -4744,7 +4813,6 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
   if (!sharedCodegenGate(schema, schemaMap)) return null
   if (schema.patternProperties) {
     for (const [pat, sub] of Object.entries(schema.patternProperties)) {
-      if (/\\[pP]\{/.test(pat)) return null
       if (typeof sub === 'object' && sub !== null && !codegenSafe(sub, schemaMap)) return null
     }
   }
@@ -4941,6 +5009,50 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
 // Emit codegen for oneOf/anyOf that runs each branch with error collection,
 // aggregates results, and uses __ataCollapse to surface a single best-branch
 // error. Wraps the existing per-branch evaluation; does not replace it.
+const BRANCH_VERDICT_MAX = 4096
+
+// What undoing a trial emission needs: during one, the context's arrays only
+// grow and its maps and sets only gain keys (a reference pushed onto refStack
+// by a declined branch is such a key), so their lengths and sizes are enough,
+// and what was added is cut off the end, in insertion order. Copying them
+// instead made the trial quadratic: 297 oneOf and anyOf on apollo-router,
+// each copying a helper list thousands long.
+function snapshotCtx (ctx) {
+  const out = new Map()
+  for (const k of Object.keys(ctx)) {
+    const x = ctx[k]
+    if (Array.isArray(x)) out.set(k, { kind: 'a', ref: x, n: x.length })
+    else if (x instanceof Map || x instanceof Set) out.set(k, { kind: 'c', ref: x, n: x.size })
+    else out.set(k, { kind: 'v', ref: x })
+  }
+  return out
+}
+function restoreCtx (ctx, saved) {
+  for (const k of Object.keys(ctx)) if (!saved.has(k)) delete ctx[k]
+  for (const [k, e] of saved) {
+    if (e.kind === 'a') { e.ref.length = Math.min(e.ref.length, e.n); ctx[k] = e.ref }
+    else if (e.kind === 'c') {
+      const extra = e.ref.size - e.n
+      if (extra > 0) {
+        const added = []
+        let i = 0
+        for (const key of e.ref.keys()) if (i++ >= e.n) added.push(key)
+        for (const key of added) e.ref.delete(key)
+      }
+      ctx[k] = e.ref
+    } else ctx[k] = e.ref
+  }
+}
+
+// Whether a node holds a reference anywhere below it.
+function holdsRef (node, seen = new Set()) {
+  if (node === null || typeof node !== 'object' || seen.has(node)) return false
+  seen.add(node)
+  if (typeof node.$ref === 'string' || typeof node.$dynamicRef === 'string') return true
+  for (const k of Object.keys(node)) if (holdsRef(node[k], seen)) return true
+  return false
+}
+
 function emitBranchCollapse (branches, keyword, v, pathExpr, lines, ctx, schemaPrefix) {
   ctx.usesBranchCollapse = true
   const fi = ctx.varCounter++
@@ -5004,6 +5116,88 @@ function emitBranchCollapse (branches, keyword, v, pathExpr, lines, ctx, schemaP
   const report = ctx.inCombined && !ctx.inBranchFn
     ? `const ${collapsed}=__ataCollapse('${branchKw}',${resArr},_pp${fi},'${branchSp}',${ord},_bt${fi});if(${collapsed})(_e||(_e=[])).push(${collapsed})`
     : `const ${collapsed}=__ataCollapse('${branchKw}',${resArr},_pp${fi},'${branchSp}',${ord},_bt${fi});if(${collapsed}){_e.push(${collapsed});if(!_all)return{valid:false,errors:_e}}`
+  // The node's runtime unevaluatedProperties already counted how many of
+  // these branches pass, through the annotation functions, which answer the
+  // same validity. A oneOf with exactly one, an anyOf with any, holds and
+  // reports nothing, so its branches are not run a second time to say so.
+  // Only in the combined function proper, where that count is in scope.
+  const counted = ctx.inCombined && !ctx.inBranchFn && ctx.branchCounts ? ctx.branchCounts.get(branches) : undefined
+  const same = counted !== undefined ? `${v}!==null&&typeof ${v}==='object'&&${counted.of}===${v}` : ''
+  let guard = counted !== undefined
+    ? (keyword === 'anyOf' ? `if(!(${same}&&${counted.count}>=1))` : `if(!(${same}&&${counted.count}===1))`)
+    : ''
+  // More than one oneOf branch passed: the error names them and carries no
+  // branch errors, so it is built from the bits the count left.
+  if (guard !== '' && keyword === 'oneOf' && counted.mask && ctx.inCombined && !ctx.inBranchFn) {
+    const ord0 = ctx.noOrdinal ? 'null' : (() => { const o = ordinalFor(ctx.rootSchema, unescapeSp(branchSp)); return o === null ? 'null' : o })()
+    guard = `if(${same}&&${counted.count}>1){const _pi${fi}=[];for(let _k=0;_k<${branches.length};_k++)if((${counted.mask}>>_k)&1)_pi${fi}.push(_k);(_e||(_e=[])).push(__ataMulti(_pi${fi},${branches.length},${pp},'${branchSp}',${ord0}))}else if(!(${same}&&${counted.count}===1))`
+  }
+  // Without such a count, each branch also gets a verdict function, and the
+  // passing branches are counted with those: a oneOf with exactly one and an
+  // anyOf with any hold, and a oneOf with more than one is reported from the
+  // bits, so the error-collecting branches run only when no branch passes
+  // and the collapse needs their errors to pick the closest. Running them to
+  // learn the count built a result object and an error list per branch,
+  // which made a oneOf matched twice cost 69 ns where counting costs about
+  // 12. A branch the verdict generator declines keeps the old path.
+  let vfArr = null
+  // Branches that hold a reference are left to the error branches: their
+  // verdicts would expand every definition again, as a second copy, where the
+  // error branches call the shared one.
+  if (guard === '' && !branches.some((b) => holdsRef(b))) {
+    // A trial: the generators are not exception-safe on the context (a
+    // reference left on refStack by a declined branch made the next error
+    // function write that branch as nothing, which read as valid), so the
+    // context is put back as it was when the verdicts decline.
+    const saved = snapshotCtx(ctx)
+    try {
+      const vfs = branches.map((sub) => {
+        if (sub === true) return 'function(){return true}'
+        if (sub === false) return 'function(){return false}'
+        const bl = []
+        nestedGenCode(sub, '_bv', bl, ctx)
+        return bl.length === 0 ? 'function(){return true}' : `function(_bv){${bl.join(';')};return true}`
+      })
+      // Only while the verdicts are small: they are a second copy of the
+      // branches, with every reference expanded, and on large branches that
+      // copy cost more to compile than counting saves (apollo-router's error
+      // function grew from 1.5 to 2.5 MB of source).
+      if (!vfs.some((b) => b.includes(SP_PLACEHOLDER)) && vfs.reduce((n, b) => n + b.length, 0) <= BRANCH_VERDICT_MAX) {
+        // One constant per branch, called directly: through an array the one
+        // call site sees every branch and none of them is inlined.
+        vfArr = `_bvf${fi}`
+        ctx.helperCode.push(vfs.map((b, i) => `const ${vfArr}_${i}=${b}`).join(';'))
+      } else {
+        restoreCtx(ctx, saved)
+      }
+    } catch (e) {
+      if (e !== DECLINE) throw e
+      restoreCtx(ctx, saved)
+    }
+  }
+  if (vfArr !== null) {
+    const L = branches.length
+    const top = ctx.inCombined && !ctx.inBranchFn
+    // An accepted document is still answered by the verdict first (see the
+    // result shape in compileToJSCombined): that is the fastest path to it,
+    // and dropping it measured 20 ns slower per accepted oneOf.
+    if (top) ctx.unguardedCollapse = true
+    const tests = branches.map((_, i) => `${vfArr}_${i}(${v})`)
+    if (keyword === 'anyOf') {
+      lines.push(`{const _pp${fi}=${pp};if(!(${tests.join('||')})){if(_all===0){_e.push(null);return{valid:false,errors:_e}}const ${resArr}=[];for(let _bi=0;_bi<${L};_bi++){const _br=${call};${resArr}.push(_br.valid?{valid:false,errors:_br.errors}:_br)}${report}}}`)
+    } else {
+      const mk = L <= 30
+      const collect = mk
+        ? `const _pi${fi}=[];for(let _k=0;_k<${L};_k++)if((_m${fi}>>_k)&1)_pi${fi}.push(_k);`
+        : ''
+      const multi = `__ataMulti(_pi${fi},${L},_pp${fi},'${branchSp}',${ord})`
+      const pushMulti = top ? `(_e||(_e=[])).push(${multi})` : `_e.push(${multi});if(!_all)return{valid:false,errors:_e}`
+      const count = tests.map((t, i) => `if(${t}){_n${fi}++;${mk ? `_m${fi}|=${1 << i}` : `_pi${fi}.push(${i})`}}`).join('')
+      lines.push(`{const _pp${fi}=${pp};let _n${fi}=0${mk ? `,_m${fi}=0` : `,_pi${fi}=[]`};${count}if(_n${fi}!==1){if(_all===0){_e.push(null);return{valid:false,errors:_e}}if(_n${fi}>1){${collect}${pushMulti}}else{const ${resArr}=[];for(let _bi=0;_bi<${L};_bi++)${resArr}.push(${call});${report}}}}`)
+    }
+    return
+  }
+  if (guard === '' && ctx.inCombined && !ctx.inBranchFn) ctx.unguardedCollapse = true
   if (keyword === 'anyOf') {
     // anyOf reports nothing once a branch passes, so the branches are first
     // only asked whether they pass. They are called with `_all` set to 0, a
@@ -5017,12 +5211,12 @@ function emitBranchCollapse (branches, keyword, v, pathExpr, lines, ctx, schemaP
     // no one read. Only when no branch passes do they run again with the
     // caller's `_all`, and the collapse sees them all, as before.
     const probe = `${fnArr}[_bi](${v},_pp${fi},0${usesSp ? ',_sp' : ''})`
-    lines.push(`{const _pp${fi}=${pp};let _bp${fi}=false;for(let _bi=0;_bi<${fnArr}.length;_bi++){if(${probe}.valid){_bp${fi}=true;break}}if(!_bp${fi}){if(_all===0){_e.push(null);return{valid:false,errors:_e}}const ${resArr}=[];for(let _bi=0;_bi<${fnArr}.length;_bi++){const _br=${call};${resArr}.push(_br.valid?{valid:false,errors:_br.errors}:_br)}${report}}}`)
+    lines.push(`${guard}{const _pp${fi}=${pp};let _bp${fi}=false;for(let _bi=0;_bi<${fnArr}.length;_bi++){if(${probe}.valid){_bp${fi}=true;break}}if(!_bp${fi}){if(_all===0){_e.push(null);return{valid:false,errors:_e}}const ${resArr}=[];for(let _bi=0;_bi<${fnArr}.length;_bi++){const _br=${call};${resArr}.push(_br.valid?{valid:false,errors:_br.errors}:_br)}${report}}}`)
   } else {
     // Asked only whether it passes (`_all` 0, see anyOf above), oneOf counts
     // the passing branches and answers; the branch errors of a probe are not
     // errors anyone reads and are not collapsed.
-    lines.push(`{const _pp${fi}=${pp};const ${resArr}=[];for(let _bi=0;_bi<${fnArr}.length;_bi++)${resArr}.push(${call});if(_all===0){let _n=0;for(const _r of ${resArr})if(_r.valid)_n++;if(_n!==1){_e.push(null);return{valid:false,errors:_e}}}else{${report}}}`)
+    lines.push(`${guard}{const _pp${fi}=${pp};const ${resArr}=[];for(let _bi=0;_bi<${fnArr}.length;_bi++)${resArr}.push(${call});if(_all===0){let _n=0;for(const _r of ${resArr})if(_r.valid)_n++;if(_n!==1){_e.push(null);return{valid:false,errors:_e}}}else{${report}}}`)
   }
 }
 
@@ -5259,7 +5453,7 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
           ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`)
           ctx.usesSafeRe = true
         } else {
-          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`)
+          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`)
         }
       }
       const ri = ctx.regExpMap.get(pattern);
@@ -5334,7 +5528,7 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
           ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`)
           ctx.usesSafeRe = true
         } else {
-          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`)
+          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`)
         }
       }
       patChecks.push(`_re${ctx.regExpMap.get(pattern)}.test(_k${ci}[_i])`)
@@ -5365,6 +5559,7 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   // whose evaluated set depends on its own branches would report the wrong
   // errors, and the collapse would pick the wrong closest branch; declined.
   if (ctx.inCombined && schema.unevaluatedProperties !== undefined && schema.unevaluatedProperties !== true && !unevalLocalOk(schema, 'unevaluatedProperties')) throw DECLINE
+  if (ctx.inCombined && schema.unevaluatedItems !== undefined && schema.unevaluatedItems !== true && !unevalLocalOk(schema, 'unevaluatedItems')) throw DECLINE
   if (schema.unevaluatedProperties === false && schema.additionalProperties === undefined) genUnevaluatedFalseE(schema, v, pathExpr, lines, ctx, schemaPrefix, isObj)
 
   // unevaluatedItems: false under the same rule. The interpreted engine
@@ -5497,7 +5692,7 @@ function genUnevaluatedFalseE(schema, v, pathExpr, lines, ctx, schemaPrefix, isO
         ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`)
         ctx.usesSafeRe = true
       } else {
-        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`)
+        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`)
       }
     }
     patChecksU.push(`_re${ctx.regExpMap.get(pattern)}.test(_k${ui}[_i])`)
@@ -5529,7 +5724,7 @@ function genPatternPropertiesE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
         ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`);
         ctx.usesSafeRe = true
       } else {
-        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`);
+        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`);
       }
     }
     const ri = ctx.regExpMap.get(pattern);
@@ -5559,7 +5754,7 @@ function genAdditionalSchemaE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
         ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`)
         ctx.usesSafeRe = true
       } else {
-        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`)
+        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`)
       }
     }
     patTests.push(`_re${ctx.regExpMap.get(pattern)}.test(_k${ki})`)
@@ -5611,7 +5806,7 @@ function genPropertyNamesE(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
         ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`);
         ctx.usesSafeRe = true
       } else {
-        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`);
+        ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern}${reFlagArg(pattern)})`);
       }
     }
     const ri = ctx.regExpMap.get(pattern);
@@ -5733,8 +5928,11 @@ function errPushC(ctx, keyword, sp, pathExpr, paramsCode, msgCode, valueExpr, le
   const { errorSite } = require('./enrich-site')
   const siteVar = `_S${ctx.varCounter++}`
   ctx.closureVars.push(siteVar)
-  ctx.closureVals.push(errorSite(keyword, unescapeSp(sp), paramsVal, fmt))
-  return `(_e||(_e=[])).push(_mk(${siteVar},${pathExpr || '""'},${paramsShared || paramsCode},${msgCode},${valueExpr},d))`
+  // Inside a shared definition (emitSharedDefC) the site holds the path past
+  // the definition and the reference's own comes in as `_sp`.
+  const rel = sp.startsWith(SP_PLACEHOLDER)
+  ctx.closureVals.push(errorSite(keyword, unescapeSp(rel ? sp.slice(SP_PLACEHOLDER.length) : sp), paramsVal, fmt))
+  return `(_e||(_e=[])).push(_mk(${siteVar},${pathExpr || '""'},${paramsShared || paramsCode},${msgCode},${valueExpr},d${rel ? ',_sp' : ''}))`
 }
 
 function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts) {
@@ -5743,15 +5941,12 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts)
   // Same provably-local rule as the error generator above.
   if (typeof schema === 'object' && schema !== null) {
     const s = JSON.stringify(schema)
-    // unevaluatedProperties that is not provably local is built at run time
-    // (genUnevaluatedDynamicC); unevaluatedItems still has to be local.
-    if (s.includes('unevaluatedItems') && !unevalAllProvablyLocal(schema, 'items')) return null
-    // Bail on self-referencing schemas — combined codegen doesn't support recursion
-    if (s.includes('"$ref":"#"')) return null
-    // Defs on a $ref cycle compile as named functions in the boolean and
-    // errors generators; this generator has no preamble for them, so it
-    // declines and the router uses the errors generator.
-    if (cyclicDefNames(schema.$defs || schema.definitions).size) return null
+    // unevaluatedProperties and unevaluatedItems that are not provably local
+    // are worked out at run time (genUnevaluatedDynamicC,
+    // genUnevaluatedItemsDynamicC).
+    // A schema that references itself, through `$ref: "#"` or a definition on
+    // a cycle, has those references written as calls under the cycle guard
+    // (emitDefFnC).
     // Bail on oneOf/anyOf — branch-collapse aggregation lives in genCodeE only.
     // Letting genCodeC emit the legacy "must match exactly one" placeholder
     // would short-circuit the ATA4001/ATA4002/ATA4003 contract. The boolean
@@ -5775,7 +5970,6 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts)
   if (!sharedCodegenGate(schema, schemaMap)) return null
   if (schema.patternProperties) {
     for (const [pat, sub] of Object.entries(schema.patternProperties)) {
-      if (/\\[pP]\{/.test(pat)) return null
       if (typeof sub === 'object' && sub !== null && !codegenSafe(sub, schemaMap)) return null
     }
   }
@@ -5825,7 +6019,7 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts)
   if (needsBaseTracking(schema, schemaMap, new Set())) return null
 
   // runtimeShape: errors without the ordinal, see compileToJSCodegenWithErrors.
-  const ctx = { noOrdinal: !!(opts && opts.runtimeShape), rich: !!(opts && opts.rich), inCombined: true, varCounter: 0, helperCode: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen],
+  const ctx = { noOrdinal: !!(opts && opts.runtimeShape), rich: !!(opts && opts.rich), inCombined: true, hoisted: [], rootC: schema, varCounter: 0, helperCode: [], shared: [], closureVars: ['_cpLen'], closureVals: [_cpLen],
                 rootDefs: cRootDefs, refStack: new Set(), schemaMap: schemaMap || null, anchors: cAnchors, rootSchema: inputSchema, userFormats: userFormats || null }
   const lines = []
   try {
@@ -5851,10 +6045,15 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts)
   const closureParams = closureNames.join(',')
   // A definition the error generator wrote as a named function inside a
   // branch (one on a cycle, or referenced from several places) reads the
-  // cycle-guard state its own function declares, which this one does not:
-  // the first document to reach it threw a ReferenceError. Declined; the
-  // error function, which has that state, answers instead.
-  if (ctx.usesBranchCollapse && ctx.defFns && ctx.defFns.size) return null
+  // cycle-guard state the error function declares. Here that state is
+  // declared too, and the checks run as the error function runs them: in a
+  // body of their own, again in the guarded mode when data turns out to
+  // point back at itself. This used to decline, which left every schema
+  // whose oneOf or anyOf branches reach a shared definition without one
+  // pass.
+  const guardList = [...(ctx.defFns ? ctx.defFns.values() : []), ...(ctx.cycFnsC || [])]
+  const guardDefs = guardList.length ? guardList : null
+  if (guardDefs) ctx.helperCode.unshift(emitGuardState())
   // Collapsed oneOf/anyOf: the helper the error generator embeds, `_all` for
   // the branch functions (this function collects everything), and the
   // runtime shape the error generator gives its literals, without code and
@@ -5865,12 +6064,23 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts)
     for (let i = 0; i < ctx.helperCode.length; i++) ctx.helperCode[i] = shape(ctx.helperCode[i])
     for (let i = 0; i < lines.length; i++) lines[i] = shape(lines[i])
   }
-  const helpers = ctx.helperCode.length ? ctx.helperCode.join('\n  ') + '\n  ' : ''
   // Lazy error array: no allocation for valid data (the common case)
   // resultShape: validate() itself for a validator whose errors are being read
   // (see validator-core): the result objects built here, so one pass decides,
   // collects and answers, with nothing between the caller and the checks.
   const rs = opts && opts.resultShape
+  // Counts shared between a node's unevaluatedProperties and its anyOf and
+  // oneOf (genUnevaluatedDynamicC), visible to every line of the function.
+  let hoistDecl = ctx.hoisted.length ? `let ${ctx.hoisted.map((n) => n + '=null').join(',')};` : ''
+  let checks = lines.join('\n  ')
+  let allDecl = ctx.usesBranchCollapse ? 'const _all=true;' : ''
+  if (guardDefs) {
+    const clears = ['_stk.clear()'].concat(guardDefs.map((n) => `${n}_s.clear()`)).join(';')
+    ctx.helperCode.push(`function _bodyC(d){${hoistDecl}${allDecl}let _e;\n  ${checks}\n  return _e}`)
+    hoistDecl = ''
+    allDecl = ''
+    checks = `_sd=0;try{_e=_bodyC(d)}catch(_err){if(_err!==_CYC)throw _err;_sg=true;${clears};try{_e=_bodyC(d)}finally{_sg=false}}`
+  }
   // In the result shape this function is validate() itself, so a document
   // that makes it throw is answered by the caller's previous path instead
   // (`_FB`). A thrown error reaching the caller is the one thing this form
@@ -5879,12 +6089,16 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats, opts)
     // With collapsed branches, collecting runs every branch of every oneOf
     // and anyOf in full, which an accepted document does not need: the
     // verdict answers it first.
-    ? `try{${ctx.usesBranchCollapse ? 'if(_VF!==null&&_VF(d))return{valid:true,data:d,errors:_EE};const _all=true;' : ''}let _e;\n  ` + lines.join('\n  ') +
+    // Not when every collapse is guarded by a count (emitBranchCollapse): an
+    // accepted document then runs no branch twice, and a rejected one would
+    // pay for the verdict for nothing.
+    ? `try{${hoistDecl}${ctx.usesBranchCollapse && ctx.unguardedCollapse ? 'if(_VF!==null&&_VF(d))return{valid:true,data:d,errors:_EE};' : ''}${allDecl}let _e;\n  ` + checks +
       // A collapsed branch error is presented even alone (its ordinal and
       // raw branch errors stay inside); otherwise only a list of two or more
       // needs ordering.
       `\n  return _e?new _ER(${ctx.usesBranchCollapse ? '_SRT(_e)' : '_e.length>1?_SRT(_e):_e'}):{valid:true,data:d,errors:_EE}}catch(_x){return _FB(d)}`
-    : (ctx.usesBranchCollapse ? 'const _all=true;' : '') + `let _e;\n  ` + lines.join('\n  ') + `\n  return _e?{valid:false,errors:_e}:R`
+    : hoistDecl + allDecl + `let _e;\n  ` + checks + `\n  return _e?{valid:false,errors:_e}:R`
+  const helpers = ctx.helperCode.length ? ctx.helperCode.join('\n  ') + '\n  ' : ''
 
   try {
     if (typeof process !== 'undefined' && process.env && process.env.ATA_DUMP_CODEGEN) console.log('=== COMBINED CODEGEN ===\n' + helpers + inner + '\n=== CLOSURE VARS: ' + ctx.closureVars.length + ' ===')
@@ -5924,6 +6138,9 @@ function typeMismatchRest(schema, types) {
     rest[k] = schema[k]
   }
   if (rest === null) return null
+  // A node whose reference was already written (genCodeCNode) keeps that
+  // mark, or the reference is written again here and its errors twice.
+  if (schema[REF_DONE]) Object.defineProperty(rest, REF_DONE, { value: true })
   for (const k of Object.keys(rest)) if (!NOT_VALIDATING.has(k) && !k.startsWith('x-')) return rest
   return null
 }
@@ -5931,6 +6148,68 @@ function typeMismatchRest(schema, types) {
 function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   return withPlain(schema, v, lines, ctx, () => genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix))
 }
+// A definition referenced from several places, written once as a function
+// and called at each reference, instead of its whole code at every one: the
+// combined function of SchemaStore's cloud-run (48 KB of schema) came to
+// 1.1 MB of source and sarif's (79 KB) to 2.8 MB, and compiling those was most
+// of the 50 to 300 ms a first rejection with its errors read took. The body is
+// generated against a placeholder schema path that becomes the `_sp` argument,
+// as the error generator does (genCodeENode), so an error names the path it
+// was reached by. It collects into its own list, returned to the caller, and
+// declares its own branch counts (genUnevaluatedDynamicC). The document root
+// comes in as `d` for the rich errors that read it. Not for a definition on a
+// reference cycle, which keeps its existing path. False when not shared.
+function emitSharedDefC(defName, v, pathExpr, lines, ctx, schemaPrefix) {
+  if (!ctx.cyclicDefs) ctx.cyclicDefs = cyclicDefNames(ctx.rootDefs)
+  if (!ctx.sharedDefs) ctx.sharedDefs = sharedDefNames(ctx.rootSchema, ctx.rootDefs)
+  const cyclic = ctx.cyclicDefs.has(defName)
+  if (!cyclic && !ctx.sharedDefs.has(defName)) return false
+  emitDefFnC(defName, ctx.rootDefs[defName], cyclic, v, pathExpr, lines, ctx, schemaPrefix)
+  return true
+}
+
+// One schema as a function of its own in the combined function (see
+// emitSharedDefC). The name is registered before the body is written, so a
+// reference back to it inside becomes a call. One that can re-enter itself,
+// a definition on a cycle or the root through `$ref: "#"`, goes through the
+// cycle guard the error generator's definitions use: depth counted, and in
+// the guarded pass a value already being checked is not checked again.
+function emitDefFnC(key, target, cyclic, v, pathExpr, lines, ctx, schemaPrefix) {
+  if (!ctx.defFnsC) ctx.defFnsC = new Map()
+  let fnName = ctx.defFnsC.get(key)
+  if (!fnName) {
+    fnName = '_defC' + ctx.defFnsC.size + '_' + (key === '#' ? 'root' : key.replace(/[^A-Za-z0-9_]/g, '_'))
+    ctx.defFnsC.set(key, fnName)
+    const outerHoisted = ctx.hoisted
+    ctx.hoisted = []
+    const bodyLines = []
+    let hoisted
+    try {
+      genCodeC(target, '_dv', '_p', bodyLines, ctx, SP_PLACEHOLDER)
+    } finally {
+      hoisted = ctx.hoisted
+      ctx.hoisted = outerHoisted
+    }
+    let body = bodyLines.join('\n  ')
+    body = body.split(`'${SP_PLACEHOLDER}`).join(`_sp+'`).split(`"${SP_PLACEHOLDER}`).join(`_sp+"`)
+    if (body.includes(SP_PLACEHOLDER)) throw DECLINE
+    const decl = hoisted.length ? `let ${hoisted.map((n) => n + '=null').join(',')};` : ''
+    const fn = `function ${cyclic ? fnName + '_b' : fnName}(_dv,_p,_sp,d){const _all=true;${decl}let _e;\n  ${body}\n  return _e}`
+    if (cyclic) {
+      if (!ctx.cycFnsC) ctx.cycFnsC = []
+      ctx.cycFnsC.push(fnName)
+      ctx.helperCode.push(
+        `const ${fnName}_s=new Set()\n  function ${fnName}(_dv,_p,_sp,d){\n  ` +
+          `if(_sg){if(typeof _dv!=='object'||_dv===null)return ${fnName}_b(_dv,_p,_sp,d);if(${fnName}_s.has(_dv))return;${fnName}_s.add(_dv);try{return ${fnName}_b(_dv,_p,_sp,d)}finally{${fnName}_s.delete(_dv)}}\n  ` +
+          `if(++_sd>${CYCLE_DEPTH})throw _CYC\n  const _r=${fnName}_b(_dv,_p,_sp,d)\n  _sd--\n  return _r\n  }\n  ` + fn)
+    } else {
+      ctx.helperCode.push(fn)
+    }
+  }
+  lines.push(`{const _r=${fnName}(${v},${pathExpr || '""'},'${schemaPrefix}',d);if(_r!==undefined){if(_e===undefined)_e=_r;else for(let _i=0;_i<_r.length;_i++)_e.push(_r[_i])}}`)
+}
+
+const REF_DONE = Symbol('ata.refDone')
 function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   if (!schemaPrefix) schemaPrefix = '#'
   // Per-node, for the reason spelled out in genCode.
@@ -5945,18 +6224,34 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   if (typeof schema !== 'object' || schema === null) return
 
   // $ref — resolve local, anchor, and cross-schema refs
-  if (schema.$ref) {
-    // The reference is followed and the rest of the node is not compiled, so
-    // a node with a keyword beside its $ref that validates (2020-12 applies
-    // both) declines: compiled, the sibling was dropped and a document it
-    // rejects was accepted. Only reachable since unevaluatedProperties next
-    // to a $ref stopped declining the whole function.
-    for (const k of Object.keys(schema)) if (!REF_NEUTRAL_SIBLINGS.has(k) && !k.startsWith('x-')) throw DECLINE
-    // Self-reference "#" — no-op (permissive) to avoid infinite recursion
-    if (schema.$ref === '#') return
+  if (schema.$ref && !schema[REF_DONE]) {
+    // A keyword beside $ref that validates applies too (2020-12; draft 7
+    // drops such siblings when the schema is read). The reference is written
+    // on its own, then the node again with the reference marked done, on a
+    // fresh copy so the mark cannot reach the same schema object met through
+    // another path; the copy keeps `$ref` for unevaluatedProperties and
+    // unevaluatedItems, which read its annotations. Dropping the siblings
+    // once accepted what they reject, which is why this declined. Not in a
+    // branch function, which the error generator writes.
+    if (Object.keys(schema).some((k) => !REF_NEUTRAL_SIBLINGS.has(k) && !k.startsWith('x-'))) {
+      if (!ctx.inCombined || ctx.inBranchFn) throw DECLINE
+      genCodeCNode({ $ref: schema.$ref }, v, pathExpr, lines, ctx, schemaPrefix)
+      const rest = Object.assign({}, schema)
+      Object.defineProperty(rest, REF_DONE, { value: true })
+      genCodeCNode(rest, v, pathExpr, lines, ctx, schemaPrefix)
+      return
+    }
+    // A reference back into what is being expanded is a call to that
+    // schema's function (emitDefFnC), never nothing: an expansion that stops
+    // and emits no lines reads as valid.
+    if (schema.$ref === '#') {
+      if (ctx.inCombined && !ctx.inBranchFn && ctx.rootC) { emitDefFnC('#', ctx.rootC, true, v, pathExpr, lines, ctx, schemaPrefix); return }
+      throw DECLINE
+    }
     const m = schema.$ref.match(/^#\/(?:\$defs|definitions)\/(.+)$/)
     if (m && ctx.rootDefs && ctx.rootDefs[m[1]]) {
-      if (ctx.refStack.has(schema.$ref)) return
+      if (ctx.inCombined && !ctx.inBranchFn && emitSharedDefC(m[1], v, pathExpr, lines, ctx, schemaPrefix)) return
+      if (ctx.refStack.has(schema.$ref)) throw DECLINE
       ctx.refStack.add(schema.$ref)
       genCodeC(ctx.rootDefs[m[1]], v, pathExpr, lines, ctx, schemaPrefix)
       ctx.refStack.delete(schema.$ref)
@@ -5967,7 +6262,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       const entry = ctx.rootDefs && ctx.rootDefs[schema.$ref]
       const anchorTarget = entry && entry.raw ? entry.raw : (ctx.anchors && ctx.anchors[schema.$ref])
       if (anchorTarget) {
-        if (ctx.refStack.has(schema.$ref)) return
+        if (ctx.refStack.has(schema.$ref)) throw DECLINE
         ctx.refStack.add(schema.$ref)
         genCodeC(anchorTarget, v, pathExpr, lines, ctx, schemaPrefix)
         ctx.refStack.delete(schema.$ref)
@@ -5975,7 +6270,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       }
     }
     if (ctx.schemaMap && ctx.schemaMap.has(schema.$ref)) {
-      if (ctx.refStack.has(schema.$ref)) return
+      if (ctx.refStack.has(schema.$ref)) throw DECLINE
       ctx.refStack.add(schema.$ref)
       genCodeC(ctx.schemaMap.get(schema.$ref), v, pathExpr, lines, ctx, schemaPrefix)
       ctx.refStack.delete(schema.$ref)
@@ -5985,7 +6280,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     if (ctx.schemaMap && schema.$ref.includes('#') && !schema.$ref.startsWith('#')) {
       const r = resolveCrossSchemaRef(schema.$ref, ctx.schemaMap)
       if (r) {
-        if (ctx.refStack.has(schema.$ref)) return
+        if (ctx.refStack.has(schema.$ref)) throw DECLINE
         ctx.refStack.add(schema.$ref)
         genCodeC(r.schema, v, pathExpr, lines, ctx, schemaPrefix)
         ctx.refStack.delete(schema.$ref)
@@ -6201,7 +6496,7 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       const ri = ctx.varCounter++
       const reVar = `_re${ri}`
       ctx.closureVars.push(reVar)
-      ctx.closureVals.push(useSafeEngine(schema.pattern) ? compileSafe(schema.pattern) : new RegExp(schema.pattern))
+      ctx.closureVals.push(useSafeEngine(schema.pattern) ? compileSafe(schema.pattern) : new RegExp(schema.pattern, reFlags(schema.pattern)))
       const c = isStr ? `!${reVar}.test(${v})` : `typeof ${v}==='string'&&!${reVar}.test(${v})`
       lines.push(`if(${c}){${fail('pattern', 'pattern', `{pattern:${JSON.stringify(schema.pattern)}}`, JSON.stringify(`must match pattern "${schema.pattern}"`))}}`)
     }
@@ -6297,7 +6592,10 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   // unevaluatedItems: false under the same rule: one error for the array,
   // the first uncovered position as the limit. Adjacent schema-form `items`
   // evaluates everything; the draft-07 array form acts as the prefix.
-  if (schema.unevaluatedItems === false) genUnevaluatedItemsFalseC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
+  if (schema.unevaluatedItems !== undefined && schema.unevaluatedItems !== true) {
+    if (unevalLocalOk(schema, 'unevaluatedItems')) genUnevaluatedItemsFalseC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
+    else genUnevaluatedItemsDynamicC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail)
+  }
 
   // dependentRequired
   if (schema.dependentRequired) {
@@ -6447,17 +6745,17 @@ function genUnevalDynamicVerdict(schema, v, lines, ctx, isObj) {
   if (schema.additionalProperties !== undefined) return
   const ui = ctx.varCounter++
   const S = `_ev${ui}`
-  const body = [`const ${S}=new Set()`]
+  const body = [`const ${S}=[]`]
   addLocalAnnotations(schema, v, S, body, ctx)
-  addApplicatorAnnotations(schema, v, S, body, ctx, true)
+  addTopApplicatorAnnotations(schema, v, S, body, ctx)
   const kVar = `_uk${ui}`
   const up = schema.unevaluatedProperties
   if (up === false) {
-    body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.has(${kVar}))return false`)
+    body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.includes(${kVar}))return false`)
   } else if (typeof up === 'object' && up !== null) {
     const sub = []
     genCode(up, `${v}[${kVar}]`, sub, ctx)
-    if (sub.length) body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.has(${kVar})){${sub.join('\n  ')}\n  }`)
+    if (sub.length) body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.includes(${kVar})){${sub.join('\n  ')}\n  }`)
   } else {
     throw DECLINE
   }
@@ -6470,36 +6768,56 @@ function genUnevalDynamicVerdict(schema, v, lines, ctx, isObj) {
 // count whether or not their values pass; an allOf, anyOf or dependentSchemas
 // branch, an if, then or else, or a $ref target counts only when it passes,
 // a oneOf only when exactly one branch passes, and `not` never. Each branch is
-// asked through an annotation function (emitAnnot), which validates first and
-// only then adds what it evaluated, so nothing has to be rolled back.
+// asked through an annotation function (emitAnnot).
 function genUnevaluatedDynamicC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isObj) {
   // additionalProperties evaluates every key the others do not, pass or fail.
   if (schema.additionalProperties !== undefined) return
   const ui = ctx.varCounter++
   const S = `_ev${ui}`
-  const body = [`const ${S}=new Set()`]
+  const body = [`const ${S}=[]`]
   addLocalAnnotations(schema, v, S, body, ctx)
-  addApplicatorAnnotations(schema, v, S, body, ctx, true)
+  // The anyOf and oneOf counts are handed to the keywords' own error code
+  // (emitBranchCollapse), with the object they were counted for: they are
+  // declared once at the top of the combined function, where every later
+  // line sees them, and read only when that object is the value at hand, so
+  // a count left from another value, another loop iteration or another place
+  // is never taken for this one. Only in the combined function proper.
+  const share = ctx.inCombined && !ctx.inBranchFn && ctx.hoisted !== undefined &&
+    (Array.isArray(schema.anyOf) || Array.isArray(schema.oneOf))
+  const counts = share ? { anyOf: `_ac${ui}`, oneOf: `_oc${ui}`, oneOfMask: `_om${ui}`, of: `_ao${ui}` } : null
+  if (share) {
+    ctx.hoisted.push(counts.anyOf, counts.oneOf, counts.oneOfMask, counts.of)
+    body.push(`${counts.of}=${v};${counts.oneOfMask}=0`)
+    if (!ctx.branchCounts) ctx.branchCounts = new Map()
+    if (Array.isArray(schema.anyOf)) ctx.branchCounts.set(schema.anyOf, { of: counts.of, count: counts.anyOf, mask: null })
+    if (Array.isArray(schema.oneOf)) ctx.branchCounts.set(schema.oneOf, { of: counts.of, count: counts.oneOf, mask: schema.oneOf.length <= 30 ? counts.oneOfMask : null })
+  }
+  addTopApplicatorAnnotations(schema, v, S, body, ctx, counts)
   const kVar = `_uk${ui}`
   const up = schema.unevaluatedProperties
   if (up === false) {
-    body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.has(${kVar})){${fail('unevaluatedProperties', 'unevaluatedProperties', `{unevaluatedProperty:${kVar}}`, "'must NOT have unevaluated properties'")}}`)
+    body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.includes(${kVar})){${fail('unevaluatedProperties', 'unevaluatedProperties', `{unevaluatedProperty:${kVar}}`, "'must NOT have unevaluated properties'")}}`)
   } else if (typeof up === 'object' && up !== null) {
     const pe = emitPtrEsc(ctx)
     const p = pathExpr ? `${pathExpr}+'/'+${pe}(${kVar})` : `'/'+${pe}(${kVar})`
     const sub = []
     genCodeC(up, `${v}[${kVar}]`, p, sub, ctx, schemaPrefix + '/unevaluatedProperties')
-    if (sub.length) body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.has(${kVar})){${sub.join('\n  ')}\n  }`)
+    if (sub.length) body.push(`for(const ${kVar} of Object.keys(${v}))if(!${S}.includes(${kVar})){${sub.join('\n  ')}\n  }`)
   } else {
     throw DECLINE
   }
   lines.push(isObj ? `{${body.join(';')}}` : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${body.join(';')}}`)
 }
 
-// The names a node's own keywords evaluate, added to `S`: present declared
-// properties, keys matching a pattern.
+// The names a node's own keywords evaluate, pushed onto the array `S`:
+// present declared properties, keys matching a pattern, and every key when
+// additionalProperties is there.
 function addLocalAnnotations(node, v, S, out, ctx) {
-  for (const k of Object.keys(node.properties || {})) out.push(`if(Object.prototype.hasOwnProperty.call(${v},${JSON.stringify(k)}))${S}.add(${JSON.stringify(k)})`)
+  if (node.additionalProperties !== undefined) {
+    out.push(`for(const _ka in ${v})${S}.push(_ka)`)
+    return
+  }
+  for (const k of Object.keys(node.properties || {})) out.push(`if(Object.prototype.hasOwnProperty.call(${v},${JSON.stringify(k)}))${S}.push(${JSON.stringify(k)})`)
   const pats = Object.keys(node.patternProperties || {})
   if (pats.length) {
     const tests = []
@@ -6512,24 +6830,31 @@ function addLocalAnnotations(node, v, S, out, ctx) {
       ctx.closureVals.push(safeReClosure(ctx, pat))
       tests.push(`_re${ri}.test(${kv})`)
     }
-    out.push(`for(const ${kv} in ${v})if(${tests.join('||')})${S}.add(${kv})`)
+    out.push(`for(const ${kv} in ${v})if(${tests.join('||')})${S}.push(${kv})`)
   }
 }
 
-// What a node's applicators add to `S`. At the node that owns the
-// unevaluatedProperties (`top`), a oneOf counts only with exactly one passing
-// branch; inside a branch that passed, its oneOf has exactly one.
-function addApplicatorAnnotations(node, v, S, out, ctx, top) {
+// What the applicators of the node that owns the unevaluatedProperties add.
+// Their validity is checked by the code around this; here a branch only
+// contributes, through its annotation function, when it passes, and a oneOf
+// only with exactly one passing branch. An annotation function that fails
+// leaves `S` as it found it.
+function addTopApplicatorAnnotations(node, v, S, out, ctx, counts) {
+  if (node.$dynamicRef !== undefined || node.$recursiveRef !== undefined || node.dependencies !== undefined) throw DECLINE
   for (const b of node.allOf || []) out.push(`${emitAnnot(b, ctx)}(${v},${S})`)
-  for (const b of node.anyOf || []) out.push(`${emitAnnot(b, ctx)}(${v},${S})`)
+  // With `counts`, the passing branches of anyOf and oneOf are counted into
+  // variables the caller declared, so the keyword's own error code further
+  // down can skip its branches when the count already says it holds (see
+  // emitBranchCollapse).
+  if (Array.isArray(node.anyOf)) {
+    if (counts) out.push(`${counts.anyOf}=0;${node.anyOf.map((b) => `if(${emitAnnot(b, ctx)}(${v},${S}))${counts.anyOf}++;`).join('')}`)
+    else for (const b of node.anyOf) out.push(`${emitAnnot(b, ctx)}(${v},${S})`)
+  }
   if (Array.isArray(node.oneOf)) {
-    if (top) {
-      const t = `_one${ctx.varCounter++}`
-      const calls = node.oneOf.map((b, i) => `{const _s=new Set();if(${emitAnnot(b, ctx)}(${v},_s)){${t}c++;${t}s=_s}}`).join('')
-      out.push(`{let ${t}c=0,${t}s=null;${calls}if(${t}c===1)for(const _x of ${t}s)${S}.add(_x)}`)
-    } else {
-      for (const b of node.oneOf) out.push(`${emitAnnot(b, ctx)}(${v},${S})`)
-    }
+    const t = counts ? counts.oneOf : `_oc${ctx.varCounter++}`
+    // Which branches passed, as bits, for a collapse that has to name them.
+    const mask = counts && node.oneOf.length <= 30 ? counts.oneOfMask : null
+    out.push(`{const ${t}m=${S}.length;${counts ? '' : 'let '}${t}=0;${node.oneOf.map((b, i) => `if(${emitAnnot(b, ctx)}(${v},${S})){${t}++;${mask ? `${mask}|=${1 << i};` : ''}}`).join('')}if(${t}!==1)_rb(${S},${t}m)}`)
   }
   if (node.if !== undefined) {
     const thenCall = node.then !== undefined ? `${emitAnnot(node.then, ctx)}(${v},${S})` : ''
@@ -6540,7 +6865,6 @@ function addApplicatorAnnotations(node, v, S, out, ctx, top) {
     for (const [k, ds] of Object.entries(node.dependentSchemas)) out.push(`if(Object.prototype.hasOwnProperty.call(${v},${JSON.stringify(k)}))${emitAnnot(ds, ctx)}(${v},${S})`)
   }
   if (typeof node.$ref === 'string') out.push(`${emitAnnot(refTargetFor(node.$ref, ctx), ctx)}(${v},${S})`)
-  if (node.$dynamicRef !== undefined || node.$recursiveRef !== undefined || node.dependencies !== undefined) throw DECLINE
 }
 
 function refTargetFor(ref, ctx) {
@@ -6550,44 +6874,236 @@ function refTargetFor(ref, ctx) {
   return t
 }
 
-// A function `(value, S) => valid` for one subschema: the subschema's verdict,
-// and when it passes, what it evaluated added to S. One per subschema object.
+// The keywords an annotation function evaluates itself, through its children;
+// the rest of a subschema is checked by a plain verdict.
+const ANNOT_APPLICATORS = new Set(['allOf', 'anyOf', 'oneOf', 'if', 'then', 'else', 'dependentSchemas', '$ref', 'not', 'unevaluatedProperties'])
+
+// A function `(value, S) => valid` for one subschema: whether it passes, and
+// when it does, what it evaluated pushed onto S; when it does not, S is left
+// as it was. Validity is worked out bottom up: the subschema's own keywords
+// by a verdict of the subschema without its applicators, each applicator from
+// its branches' annotation functions. Asking each branch for a full verdict
+// and then again for its annotations repeated every nested branch once per
+// level, which made nested references the slowest shape there was.
 function emitAnnot(sub, ctx) {
   if (sub === true) return '_anT'
   if (sub === false) return '_anF'
   if (sub === null || typeof sub !== 'object') throw DECLINE
   if (!ctx.annFns) {
     ctx.annFns = new Map()
-    ;(ctx.preamble || ctx.helperCode).push('function _anT(){return true}function _anF(){return false}')
+    ;(ctx.preamble || ctx.helperCode).push('function _anT(){return true}function _anF(){return false}function _rb(S,m){if(S.length!==m)S.length=m}')
   }
   const hit = ctx.annFns.get(sub)
   if (hit !== undefined) {
     if (hit === null) throw DECLINE // a reference cycle: not modelled here
     return hit
   }
+  if (sub.$dynamicRef !== undefined || sub.$recursiveRef !== undefined || sub.dependencies !== undefined) throw DECLINE
+  // unevaluatedItems reads what the applicators evaluate too; the local
+  // verdict would see it without them.
+  if (sub.unevaluatedItems !== undefined) throw DECLINE
   ctx.annFns.set(sub, null)
   const name = `_an${ctx.varCounter++}`
+  const local = {}
+  for (const k of Object.keys(sub)) if (!ANNOT_APPLICATORS.has(k)) local[k] = sub[k]
   const vl = []
-  nestedGenCode(sub, '_av', vl, ctx)
-  const body = []
-  // additionalProperties, or an unevaluatedProperties that passed, evaluate
-  // every remaining key.
-  if (sub.additionalProperties !== undefined || (sub.unevaluatedProperties !== undefined && sub.unevaluatedProperties !== false)) {
-    body.push(`for(const _ka in d)S.add(_ka)`)
-  } else if (sub.unevaluatedProperties === false) {
-    body.push(`for(const _ka in d)S.add(_ka)`)
-  } else {
-    addLocalAnnotations(sub, 'd', 'S', body, ctx)
-    addApplicatorAnnotations(sub, 'd', 'S', body, ctx, false)
+  nestedGenCode(local, '_av', vl, ctx)
+  const decls = [`function ${name}_v(_av){${vl.join('\n  ')}\n  return true}`]
+  const body = [`if(!${name}_v(d))return false`]
+  if (sub.not !== undefined) {
+    const nl = []
+    nestedGenCode(sub.not, '_nv', nl, ctx)
+    decls.push(`function ${name}_n(_nv){${nl.join('\n  ')}\n  return true}`)
+    body.push(`if(${name}_n(d))return false`)
+  }
+  body.push(`const _m=S.length;const _o=typeof d==='object'&&d!==null&&!Array.isArray(d)`)
+  const locals = []
+  addLocalAnnotations(sub, 'd', 'S', locals, ctx)
+  if (locals.length) body.push(`if(_o){${locals.join(';')}}`)
+  const failOut = '{_rb(S,_m);return false}'
+  for (const b of sub.allOf || []) body.push(`if(!${emitAnnot(b, ctx)}(d,S))${failOut}`)
+  if (Array.isArray(sub.anyOf)) body.push(`{let _a=false;${sub.anyOf.map((b) => `if(${emitAnnot(b, ctx)}(d,S))_a=true;`).join('')}if(!_a)${failOut}}`)
+  if (Array.isArray(sub.oneOf)) body.push(`{let _c=0;${sub.oneOf.map((b) => `if(${emitAnnot(b, ctx)}(d,S))_c++;`).join('')}if(_c!==1)${failOut}}`)
+  if (sub.if !== undefined) {
+    const thenCheck = sub.then !== undefined ? `if(!${emitAnnot(sub.then, ctx)}(d,S))${failOut}` : ''
+    const elseCheck = sub.else !== undefined ? `if(!${emitAnnot(sub.else, ctx)}(d,S))${failOut}` : ''
+    body.push(`if(${emitAnnot(sub.if, ctx)}(d,S)){${thenCheck}}else{${elseCheck}}`)
+  }
+  if (sub.dependentSchemas && typeof sub.dependentSchemas === 'object') {
+    for (const [k, ds] of Object.entries(sub.dependentSchemas)) body.push(`if(_o&&Object.prototype.hasOwnProperty.call(d,${JSON.stringify(k)})&&!${emitAnnot(ds, ctx)}(d,S))${failOut}`)
+  }
+  if (typeof sub.$ref === 'string') body.push(`if(!${emitAnnot(refTargetFor(sub.$ref, ctx), ctx)}(d,S))${failOut}`)
+  // An unevaluatedProperties of its own: the keys this subschema evaluated
+  // are the ones pushed since _m; what is left must pass it, and then every
+  // key is evaluated.
+  const up = sub.unevaluatedProperties
+  if (up !== undefined && up !== true && sub.additionalProperties === undefined) {
+    if (up === false) {
+      body.push(`if(_o){for(const _k of Object.keys(d))if(S.indexOf(_k,_m)<0)${failOut}}`)
+    } else if (typeof up === 'object' && up !== null) {
+      const ul = []
+      nestedGenCode(up, '_uv', ul, ctx)
+      decls.push(`function ${name}_u(_uv){${ul.join('\n  ')}\n  return true}`)
+      body.push(`if(_o){for(const _k of Object.keys(d))if(S.indexOf(_k,_m)<0&&!${name}_u(d[_k]))${failOut}}`)
+    } else {
+      throw DECLINE
+    }
   }
-  // The verdict generator keeps its declarations in the preamble (its
-  // helperCode is only scanned for patterns); the error generators in
-  // helperCode.
-  ;(ctx.preamble || ctx.helperCode).push(`function ${name}_v(_av){${vl.join('\n  ')}\n  return true}function ${name}(d,S){if(!${name}_v(d))return false;if(typeof d!=='object'||d===null||Array.isArray(d))return true;${body.join(';')};return true}`)
+  if (up !== undefined && sub.additionalProperties === undefined) body.push(`if(_o)for(const _ka in d)S.push(_ka)`)
+  decls.push(`function ${name}(d,S){${body.join(';')};return true}`)
+  ;(ctx.preamble || ctx.helperCode).push(decls.join(''))
   ctx.annFns.set(sub, name)
   return name
 }
 
+// unevaluatedItems worked out at run time, for the combined function. The
+// evaluated positions of an array are kept as the interpreter keeps them
+// (lib/plan-compiler.js): `n`, every index below it evaluated, and `x`, the
+// indexes past it that `contains` matched. This node's own prefixItems,
+// items and contains mark them whatever their own verdict, and each in-place
+// subschema marks them only when it passes (emitAnnotI); what is left must
+// pass unevaluatedItems. `false` reports once, at the first position left,
+// as the interpreter does.
+function genUnevaluatedItemsDynamicC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail) {
+  if (schema.$dynamicRef !== undefined || schema.$recursiveRef !== undefined) throw DECLINE
+  if (Array.isArray(schema.items) || schema.additionalItems !== undefined) throw DECLINE
+  annItemHelpers(ctx)
+  const ui = ctx.varCounter++
+  const S = `_es${ui}`
+  const body = [`const ${S}={n:0,x:null}`]
+  addLocalItemAnnotations(schema, v, S, body, ctx)
+  for (const b of schema.allOf || []) body.push(`${emitAnnotI(b, ctx)}(${v},${S})`)
+  if (Array.isArray(schema.anyOf)) for (const b of schema.anyOf) body.push(`${emitAnnotI(b, ctx)}(${v},${S})`)
+  if (Array.isArray(schema.oneOf)) {
+    body.push(`{const _n0=${S}.n,_x0=${S}.x===null?0:${S}.x.length;let _c=0;${schema.oneOf.map((b) => `if(${emitAnnotI(b, ctx)}(${v},${S}))_c++;`).join('')}if(_c!==1)_rbI(${S},_n0,_x0)}`)
+  }
+  if (schema.if !== undefined) {
+    const thenCall = schema.then !== undefined ? `${emitAnnotI(schema.then, ctx)}(${v},${S})` : ''
+    const elseCall = schema.else !== undefined ? `${emitAnnotI(schema.else, ctx)}(${v},${S})` : ''
+    body.push(`if(${emitAnnotI(schema.if, ctx)}(${v},${S})){${thenCall}}else{${elseCall}}`)
+  }
+  if (typeof schema.$ref === 'string') body.push(`${emitAnnotI(refTargetFor(schema.$ref, ctx), ctx)}(${v},${S})`)
+  const iv = `_ix${ui}`
+  const ui2 = schema.unevaluatedItems
+  if (ui2 === false) {
+    const failI = fail('unevaluatedItems', 'unevaluatedItems', `{limit:${iv}}`, `'must NOT have more than '+${iv}+' items'`)
+    body.push(`for(let ${iv}=0;${iv}<${v}.length;${iv}++){if(_hI(${S},${iv}))continue;${failI};break}`)
+  } else if (typeof ui2 === 'object' && ui2 !== null) {
+    const pe = pathExpr ? `${pathExpr}+'/'+${iv}` : `'/'+${iv}`
+    const sub = []
+    genCodeC(ui2, `${v}[${iv}]`, pe, sub, ctx, schemaPrefix + '/unevaluatedItems')
+    if (sub.length) body.push(`for(let ${iv}=0;${iv}<${v}.length;${iv}++){if(_hI(${S},${iv}))continue;${sub.join('\n  ')}\n  }`)
+  } else {
+    throw DECLINE
+  }
+  lines.push(`if(Array.isArray(${v})){${body.join(';')}}`)
+}
+
+function annItemHelpers(ctx) {
+  if (ctx.annItemHelpers) return
+  ctx.annItemHelpers = true
+  ;(ctx.preamble || ctx.helperCode).push(
+    'function _aI(S,i){if(i<S.n)return;if(i===S.n){S.n=i+1;return}(S.x||(S.x=[])).push(i)}' +
+    'function _mrI(S,f,t){if(f>=t)return;if(f<=S.n){if(t>S.n)S.n=t;return}const x=S.x||(S.x=[]);for(let i=f;i<t;i++)x.push(i)}' +
+    'function _hI(S,i){if(i<S.n)return true;const x=S.x;if(x===null)return false;for(let j=0;j<x.length;j++)if(x[j]===i)return true;return false}' +
+    'function _rbI(S,n,l){S.n=n;if(S.x!==null)S.x.length=l}' +
+    'function _anIT(){return true}function _anIF(){return false}')
+}
+
+// The positions a node's own keywords evaluate, marked on `S`, for an array.
+function addLocalItemAnnotations(node, v, S, out, ctx) {
+  if (Array.isArray(node.items) || node.additionalItems !== undefined) throw DECLINE
+  const prefix = Array.isArray(node.prefixItems) ? node.prefixItems.length : 0
+  if (prefix) out.push(`_mrI(${S},0,Math.min(${v}.length,${prefix}))`)
+  if (node.items !== undefined) out.push(`_mrI(${S},${prefix},${v}.length)`)
+  if (node.contains !== undefined) {
+    const cl = []
+    nestedGenCode(node.contains, '_cv', cl, ctx)
+    const ci = ctx.varCounter++
+    ;(ctx.preamble || ctx.helperCode).push(`function _cI${ci}(_cv){${cl.join('\n  ')}\n  return true}`)
+    out.push(`for(let _i=0;_i<${v}.length;_i++)if(_cI${ci}(${v}[_i]))_aI(${S},_i)`)
+  }
+}
+
+// The keywords an item annotation function evaluates through its children;
+// the rest of a subschema is checked by a plain verdict.
+const ANNOT_ITEM_APPLICATORS = new Set(['allOf', 'anyOf', 'oneOf', 'if', 'then', 'else', '$ref', 'not', 'unevaluatedItems'])
+
+// A function `(value, S) => valid` for one subschema, marking on S the array
+// positions it evaluated when it passes, and leaving S as it was when it does
+// not. A subschema with an unevaluatedItems of its own evaluates every
+// position once that passes, so it works on a record of its own and then
+// marks them all.
+function emitAnnotI(sub, ctx) {
+  if (sub === true) return '_anIT'
+  if (sub === false) return '_anIF'
+  if (sub === null || typeof sub !== 'object') throw DECLINE
+  if (!ctx.annFnsI) ctx.annFnsI = new Map()
+  const hit = ctx.annFnsI.get(sub)
+  if (hit !== undefined) {
+    if (hit === null) throw DECLINE
+    return hit
+  }
+  if (sub.$dynamicRef !== undefined || sub.$recursiveRef !== undefined) throw DECLINE
+  if (Array.isArray(sub.items) || sub.additionalItems !== undefined) throw DECLINE
+  // unevaluatedProperties reads the applicators too, which the local verdict
+  // below leaves out.
+  if (sub.unevaluatedProperties !== undefined && sub.unevaluatedProperties !== true) throw DECLINE
+  ctx.annFnsI.set(sub, null)
+  annItemHelpers(ctx)
+  const name = `_ai${ctx.varCounter++}`
+  const local = {}
+  for (const k of Object.keys(sub)) if (!ANNOT_ITEM_APPLICATORS.has(k)) local[k] = sub[k]
+  const vl = []
+  nestedGenCode(local, '_av', vl, ctx)
+  const decls = [`function ${name}_v(_av){${vl.join('\n  ')}\n  return true}`]
+  const body = [`if(!${name}_v(d))return false`]
+  if (sub.not !== undefined) {
+    const nl = []
+    nestedGenCode(sub.not, '_nv', nl, ctx)
+    decls.push(`function ${name}_n(_nv){${nl.join('\n  ')}\n  return true}`)
+    body.push(`if(${name}_n(d))return false`)
+  }
+  const own = sub.unevaluatedItems !== undefined && sub.unevaluatedItems !== true
+  const R = own ? '_R' : 'S'
+  body.push(own ? `const _R={n:0,x:null}` : `const _n0=S.n,_x0=S.x===null?0:S.x.length`)
+  const failOut = own ? 'return false' : '{_rbI(S,_n0,_x0);return false}'
+  const locals = []
+  addLocalItemAnnotations(sub, 'd', R, locals, ctx)
+  if (locals.length) body.push(`if(Array.isArray(d)){${locals.join(';')}}`)
+  for (const b of sub.allOf || []) body.push(`if(!${emitAnnotI(b, ctx)}(d,${R}))${failOut}`)
+  if (Array.isArray(sub.anyOf)) body.push(`{let _a=false;${sub.anyOf.map((b) => `if(${emitAnnotI(b, ctx)}(d,${R}))_a=true;`).join('')}if(!_a)${failOut}}`)
+  if (Array.isArray(sub.oneOf)) body.push(`{let _c=0;${sub.oneOf.map((b) => `if(${emitAnnotI(b, ctx)}(d,${R}))_c++;`).join('')}if(_c!==1)${failOut}}`)
+  if (sub.if !== undefined) {
+    const thenCheck = sub.then !== undefined ? `if(!${emitAnnotI(sub.then, ctx)}(d,${R}))${failOut}` : ''
+    const elseCheck = sub.else !== undefined ? `if(!${emitAnnotI(sub.else, ctx)}(d,${R}))${failOut}` : ''
+    body.push(`if(${emitAnnotI(sub.if, ctx)}(d,${R})){${thenCheck}}else{${elseCheck}}`)
+  }
+  if (typeof sub.$ref === 'string') body.push(`if(!${emitAnnotI(refTargetFor(sub.$ref, ctx), ctx)}(d,${R}))${failOut}`)
+  if (own) {
+    const u = sub.unevaluatedItems
+    if (u === false) {
+      body.push(`if(Array.isArray(d)){for(let _i=0;_i<d.length;_i++)if(!_hI(_R,_i))return false}`)
+    } else if (typeof u === 'object' && u !== null) {
+      const ul = []
+      nestedGenCode(u, '_uv', ul, ctx)
+      decls.push(`function ${name}_u(_uv){${ul.join('\n  ')}\n  return true}`)
+      body.push(`if(Array.isArray(d)){for(let _i=0;_i<d.length;_i++)if(!_hI(_R,_i)&&!${name}_u(d[_i]))return false}`)
+    } else {
+      throw DECLINE
+    }
+    body.push(`if(Array.isArray(d))_mrI(S,0,d.length)`)
+  }
+  // `unevaluatedItems: true` evaluates every position once the subschema
+  // has passed, with nothing to check; marked last, so a failure above has
+  // nothing of it to undo.
+  if (sub.unevaluatedItems === true) body.push(`if(Array.isArray(d))_mrI(S,0,d.length)`)
+  decls.push(`function ${name}(d,S){${body.join(';')};return true}`)
+  ;(ctx.preamble || ctx.helperCode).push(decls.join(''))
+  ctx.annFnsI.set(sub, name)
+  return name
+}
+
 function genUnevaluatedFalseC(schema, v, pathExpr, lines, ctx, schemaPrefix, fail, isObj) {
   const propKeysU = Object.keys(schema.properties || {})
   const ui = ctx.varCounter++