ata-validator 1.43.0 → 1.45.0

package/README.md

@@ -244,21 +244,21 @@ is the most common way to get a misleading number out of this library.
 
 | | compiled with `ata build` | runtime `new Validator(schema)` |
 |---|---|---|
-| In a bundle, gzipped | **2.2 KB** | 95.6 KB |
-| Time to a served request | **3.5 ms** | 7.8 ms |
+| In a bundle, gzipped | **2.1 KB** | 112.8 KB |
+| Time to a served request | **3.5 ms** | 8.6 ms |
 | Schema known when | build time | any time |
 
 The bundle row is the ten-field user schema in
 `tests/fixtures/error-dx/user.schema.json`, every export of the compiled module against
-`new Validator(schema)`, built with `bun build --minify --target=browser` on ata 1.36.0.
-The startup row is a Hono route on Bun 1.4, median of nine interleaved runs, from
+`new Validator(schema)`, built with `bun build --minify --target=browser` on ata 1.44.0.
+The startup row is a Hono route on Bun 1.4, the median of three rounds of best-of-seven, from
 `benchmark/bundle`, against 3.5 ms for the same app doing no validation at all, so the
 compiled path costs nothing measurable to start. The runtime figure is what it is because
 a schema that arrives at run time can use any keyword, so the whole engine has to be
 there. The compiled module imports nothing and contains only the checks your schema asks
 for.
 
-**On a server, use whichever fits your schemas.** 96 KB of JavaScript on a Node or Bun
+**On a server, use whichever fits your schemas.** 113 KB of JavaScript on a Node or Bun
 process is not a cost anyone notices, and the runtime API is the simpler thing to reach
 for. Speed is the same either way once warm.
 
@@ -491,7 +491,7 @@ const v = new Validator(schema, {
 
 ### Build-time compile (`ata compile`)
 
-The `ata` CLI turns a JSON Schema file into a self-contained JavaScript module. No runtime dependency on `ata-validator`, so only the generated validator ships to the browser. For the ten-field user schema in `tests/fixtures/error-dx/user.schema.json` the module is 2.2 KB gzipped, full error detail included, against 95.6 KB for the runtime bundled for the browser.
+The `ata` CLI turns a JSON Schema file into a self-contained JavaScript module. No runtime dependency on `ata-validator`, so only the generated validator ships to the browser. For the ten-field user schema in `tests/fixtures/error-dx/user.schema.json` the module is 2.1 KB gzipped, full error detail included, against 112.8 KB for the runtime bundled for the browser (ata 1.44.0).
 
 ```bash
 npx ata compile schemas/user.json -o src/generated/user.validator.mjs
@@ -533,13 +533,13 @@ npx ata build 'schemas/*.json' --out-dir build/validators --check
 Run with `--watch` during development for incremental rebuilds.
 
 Bundle sizes for the 10-field user schema in `tests/fixtures/error-dx/user.schema.json`,
-minified and gzipped, measured with `bun build --minify --target=browser` on ata 1.36.0:
+minified and gzipped, measured with `bun build --minify --target=browser` on ata 1.44.0:
 
 | What the app imports | Size | Notes |
 |---|---|---|
-| `Validator` from `ata-validator` | 95.6 KB | The compiler ships with it, because a runtime schema can use any keyword |
+| `Validator` from `ata-validator` | 112.8 KB | The compiler ships with it, because a runtime schema can use any keyword |
 | `isValid` from the compiled module | **1.3 KB** | Nothing else is reachable, so the error collector is dropped |
-| `validate` from the compiled module | **2.0 KB** | Adds the detailed error collector |
+| `validate` from the compiled module | **1.9 KB** | Adds the detailed error collector |
 
 `--abort-early` makes the generated source about three times smaller, and after
 bundling it makes no difference: importing only `isValid` already leaves the error
@@ -575,7 +575,7 @@ through a `setFormats()` export the module carries. `docs/API.md` has the
 details.
 
 **Fastify startup, 10 route schemas, from a cold process to the first validated request:
-ajv 19.9 ms, ata 2.9 ms, no build step required.** ata registers in 0.5 ms of that and
+ajv 19.4 ms, ata 2.7 ms, no build step required.** ata registers in 0.2 ms of that and
 compiles on the first request, so counting only registration would overstate the gap.
 Reproduce with `node benchmark/bench_fastify_boot.mjs`.
 

package/index.js

@@ -434,6 +434,9 @@ function installCodegenPaths (ctx) {
     }
     return nativeText ? getNative().rawFastValidate(this._fastSlot, Buffer.from(jsonStr)) : undefined;
   };
+  // The parsed document is left on `_lastParsed` for the rich layer around
+  // validateJSON, which hands it to the rejection so reading the errors does
+  // not parse the text again (see LazyJsonRejection).
   const validateText = (jsonStr) => {
     let obj;
     try {
@@ -442,6 +445,7 @@ function installCodegenPaths (ctx) {
       if (!(e instanceof SyntaxError)) throw e;
       return _jsonSyntaxRejection(e);
     }
+    this._lastParsed = obj;
     return jsonValidateFn(obj);
   };
   this.validateJSON = useSimdjsonForLarge && !preprocess
@@ -878,8 +882,58 @@ function buildParse (self, decline, extended) {
 // preprocess pass, the JSON-text scanner, the parse() copy and the
 // ahead-of-time bundle methods. parse() and the bundle methods load on first
 // use.
+// Cold start. A validator's first COLD_CALLS calls are answered by an
+// interpreted twin, built from the same schema and options with
+// `engine: 'interpreter'`, which the test suite holds to the same answers and
+// errors as the generated code. Generating code and having V8 compile it is
+// the largest part of a first call on a large schema: from process start to
+// one rejection with its error read, SchemaStore's SARIF schema took 87 ms
+// with code generated at the first call and 31 ms with the twin answering.
+// A validator still in use after that compiles as before, so a server reaches
+// the generated code's speed within its first requests, and a command line
+// tool or a short-lived function never pays to compile. Only where compiling
+// costs enough to matter: a schema whose size with its references followed
+// passes COLD_MIN characters (expandedChars in lib/js-compiler.js). A small
+// schema compiles in about a millisecond and is generated at its first call
+// as before, which also keeps every test that compares the generated code
+// with the interpreter comparing the generated code. Not for a validator with
+// an extension (_extendValidate, _extendChecks), which the twin would not
+// carry. Returns the twin to answer this call, or null to compile.
+const COLD_CALLS = 64;
+const COLD_MIN = 16 * 1024;
+// Whether the schema may expand past `limit`, answered from its text where
+// that settles it. Without a `$ref` nothing expands, and expandedChars counts
+// at most 8 for each character of the text, so a short schema is decided
+// without walking it. The text is the one _ensureCompiled needs anyway. Walking
+// every small route schema here cost a Fastify boot of ten routes 0.15 ms.
+function mayExpandPast (self, limit) {
+  const str = self._schemaStr || (self._schemaStr = JSON.stringify(self._schemaObj));
+  if (str === undefined) return false;
+  if (str.length * 8 <= limit && !str.includes('"$ref"')) return false;
+  return jsCompiler.expandedChars(self._schemaObj, limit) > limit;
+}
+
+function coldTwin (self, Validator) {
+  const n = self._coldCalls === undefined ? 0 : self._coldCalls;
+  if (n >= COLD_CALLS || self._validateTail !== null || self._verdictTail !== null) return null;
+  let t = self._twin;
+  if (t === undefined) {
+    t = null;
+    if (!self._interpretOnly && !self._initialized && mayExpandPast(self, COLD_MIN)) {
+      try { t = new Validator(self._rawSchema, Object.assign({}, self._options, { engine: 'interpreter' })); } catch { t = null; }
+    }
+    self._twin = t;
+  }
+  if (t === null) return null;
+  self._coldCalls = n + 1;
+  return t;
+}
+
 core._registerCodegen({
   jsCompiler,
+  coldTwin,
+  // The native locator for error frames, loaded with the first frame.
+  nativePositions: () => require('./lib/native-positions').nativeTargeted,
   installPaths: installCodegenPaths,
   compileVerdict: installCodegenPaths.compileVerdict,
   installScanner: installCodegenPaths.installScanner,

package/lib/clone-emit.js

@@ -78,8 +78,11 @@ function inlineRefsForClone(root) {
     for (const k of Object.keys(cur)) {
       if (strip && k === 'default') continue;
       const v = cur[k];
-      if (_INLINE_DATA_KEYS.has(k) || k === '$defs' || k === 'definitions') { out[k] = v; continue; }
-      out[k] = walk(v, active, strip);
+      // A property named "__proto__" is an own key of the copy: assigned, it
+      // set the copy's prototype and the property was gone from parse().
+      const w = (_INLINE_DATA_KEYS.has(k) || k === '$defs' || k === 'definitions') ? v : walk(v, active, strip);
+      if (k === '__proto__') Object.defineProperty(out, k, { value: w, writable: true, enumerable: true, configurable: true });
+      else out[k] = w;
     }
     if (siblingDefault !== undefined) out.default = siblingDefault;
     return out;

package/lib/data-position-cache.js

@@ -2,13 +2,17 @@
 
 const { buildDataPositionMap, buildTargetedPositionMap } = require('./data-positions');
 
+
 /**
  * Memoize the position map for the duration of a single validate() call.
  * Caller passes the original buffer/string. Identity-keyed: same reference
  * == same map. No global state, caller holds the cache instance.
  */
 
-function createCache () {
+// `nativeTargeted`, when given, is a faster source of the same entries: the
+// full entry point passes lib/native-positions.js, lite passes nothing.
+function createCache (nativeTargeted) {
+  const _nativeTargeted = typeof nativeTargeted === 'function' ? nativeTargeted : null;
   const wm = new WeakMap();
   const sm = new Map(); // strings can't go in WeakMap; clear after each validate
   let lastInput = null;
@@ -32,11 +36,13 @@ function createCache () {
         ? sm.get(input)
         : (Buffer.isBuffer(input) ? wm.get(input) : undefined);
       if (already) return already;
-      let filtered;
-      try {
-        filtered = buildTargetedPositionMap(input, wanted);
-      } catch {
-        return null;
+      let filtered = _nativeTargeted === null ? null : _nativeTargeted(input, wanted);
+      if (filtered === null) {
+        try {
+          filtered = buildTargetedPositionMap(input, wanted);
+        } catch {
+          return null;
+        }
       }
       let full;
       const fallback = (key) => {

package/lib/draft7.js

@@ -49,13 +49,11 @@ function _normalize(schema) {
   // dependencies → dependentSchemas + dependentRequired
   if (schema.dependencies) {
     for (const [key, value] of Object.entries(schema.dependencies)) {
-      if (Array.isArray(value)) {
-        if (!schema.dependentRequired) schema.dependentRequired = {}
-        schema.dependentRequired[key] = value
-      } else {
-        if (!schema.dependentSchemas) schema.dependentSchemas = {}
-        schema.dependentSchemas[key] = value
-      }
+      // defineProperty: a dependency on a property named "__proto__" is an
+      // own key here, where assignment would set the map's prototype.
+      const target = Array.isArray(value) ? 'dependentRequired' : 'dependentSchemas'
+      if (!schema[target]) schema[target] = {}
+      Object.defineProperty(schema[target], key, { value, writable: true, enumerable: true, configurable: true })
     }
     delete schema.dependencies
   }

package/lib/formats.js

@@ -382,12 +382,18 @@ function uriChar (c) {
 function isHex (c) {
   return (c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70);
 }
+// The same set through the URI_CHAR and HEX_CHAR tables: one load per
+// character, where uriChar() was a call and up to eleven comparisons, and on
+// SchemaStore's SARIF samples, full of URIs, that loop was a sixth of what the
+// interpreted engine spent. A "%" at the end reads past the string, NaN,
+// which fails the bound as it failed isHex().
 function uriChars (s, from) {
   for (let i = from; i < s.length; i++) {
     const c = s.charCodeAt(i);
-    if (!uriChar(c)) return false;
+    if (c > 127 || URI_CHAR[c] === 0) return false;
     if (c === 37) { // '%'
-      if (!isHex(s.charCodeAt(i + 1)) || !isHex(s.charCodeAt(i + 2))) return false;
+      const h1 = s.charCodeAt(i + 1), h2 = s.charCodeAt(i + 2);
+      if (!(h1 <= 127) || !(h2 <= 127) || HEX_CHAR[h1] === 0 || HEX_CHAR[h2] === 0) return false;
       i += 2;
     }
   }

package/lib/interpreter.js

@@ -183,26 +183,22 @@ function resolveRef(ref, fromBase, state) {
 
 // ---------- value helpers ----------
 
-function deepEqual(a, b) {
-  if (a === b) return true;
-  if (typeof a === 'number' && typeof b === 'number') return a === b;
-  if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object') return false;
-  const aArr = Array.isArray(a);
-  if (aArr !== Array.isArray(b)) return false;
-  if (aArr) {
-    if (a.length !== b.length) return false;
-    for (let i = 0; i < a.length; i++) if (!deepEqual(a[i], b[i])) return false;
-    return true;
-  }
-  const ak = Object.keys(a);
-  const bk = Object.keys(b);
-  if (ak.length !== bk.length) return false;
-  for (const k of ak) {
-    if (!(k in b) || !deepEqual(a[k], b[k])) return false;
-  }
-  return true;
+// uniqueItems: the functions the code generator emits as _uq and _uqp
+// (lib/unique-items.js), so both engines run the same code.
+const { allDistinct, duplicatePair, _deq } = require('./unique-items');
+
+// Whether `data` deep-equals one of the node's enum values (see enumPrims).
+function enumMember(P, data) {
+  if (data === null || typeof data !== 'object') return P.enumPrims.has(data);
+  const objs = P.enumObjs;
+  for (let i = 0; i < objs.length; i++) if (deepEqual(objs[i], data)) return true;
+  return false;
 }
 
+// JSON equality: the same function the code generator emits as `_deq`, so the
+// engines agree on what equal means (an object's own keys, in any order).
+const deepEqual = _deq;
+
 function codePointLength(s) {
   let n = 0;
   for (let i = 0; i < s.length; i++) {
@@ -375,6 +371,21 @@ class Plan {
     }
     this.hasType = schema.type !== undefined;
     this.enum = schema.enum !== undefined ? schema.enum : null;
+    // Membership for enumMember(): the primitive values in a Set, so a long
+    // enum answers in one lookup, and the object and array values, which only
+    // deepEqual can compare, in a list. Scanning every value with deepEqual
+    // was a fifth to a third of what validating SchemaStore's samples cost.
+    // NaN stays out of the Set: deepEqual never matches it, and a Set would.
+    this.enumPrims = null;
+    this.enumObjs = null;
+    if (Array.isArray(this.enum)) {
+      this.enumPrims = new Set();
+      this.enumObjs = [];
+      for (const v of this.enum) {
+        if (v !== null && typeof v === 'object') this.enumObjs.push(v);
+        else if (!(typeof v === 'number' && v !== v)) this.enumPrims.add(v);
+      }
+    }
     this.hasConst = schema.const !== undefined;
     this.const = schema.const;
 
@@ -524,9 +535,7 @@ function evalLeafV(P, data) {
   const bits = dataBits(data);
   if (P.hasType && (bits & P.typeMask) === 0) return false;
   if (P.enum !== null) {
-    let found = false;
-    for (let i = 0; i < P.enum.length; i++) { if (deepEqual(P.enum[i], data)) { found = true; break; } }
-    if (!found) return false;
+    if (!enumMember(P, data)) return false;
   }
   if (P.hasConst && !deepEqual(P.const, data)) return false;
   if (P.hasNumber && Number.isFinite(data)) {
@@ -545,13 +554,7 @@ function evalLeafV(P, data) {
   if (P.hasArray && bits === T_ARRAY) {
     if (P.minItems !== undefined && data.length < P.minItems) return false;
     if (P.maxItems !== undefined && data.length > P.maxItems) return false;
-    if (P.uniqueItems) {
-      for (let i = 0; i < data.length; i++) {
-        for (let j = i + 1; j < data.length; j++) {
-          if (deepEqual(data[i], data[j])) return false;
-        }
-      }
-    }
+    if (P.uniqueItems && !allDistinct(data)) return false;
   }
   if (P.hasObject && bits === T_OBJECT) {
     if (P.required !== null) {
@@ -635,9 +638,7 @@ function evalLeaf(P, data, errors, instancePath, schemaPath) {
     valid = false;
   }
   if (P.enum !== null) {
-    let found = false;
-    for (let i = 0; i < P.enum.length; i++) { if (deepEqual(P.enum[i], data)) { found = true; break; } }
-    if (!found) {
+    if (!enumMember(P, data)) {
       if (errors !== NOERRORS) errors.push(err('enum', 'enum', instancePath, schemaPath + '/enum', { allowedValues: P.enum }, 'must be equal to one of the allowed values'));
       valid = false;
     }
@@ -663,14 +664,11 @@ function evalLeaf(P, data, errors, instancePath, schemaPath) {
     if (P.minItems !== undefined && data.length < P.minItems) { errors === NOERRORS || errors.push(err('minItems', 'minItems', instancePath, schemaPath + '/minItems', { limit: P.minItems }, `must NOT have fewer than ${P.minItems} items`)); valid = false; }
     if (P.maxItems !== undefined && data.length > P.maxItems) { errors === NOERRORS || errors.push(err('maxItems', 'maxItems', instancePath, schemaPath + '/maxItems', { limit: P.maxItems }, `must NOT have more than ${P.maxItems} items`)); valid = false; }
     if (P.uniqueItems) {
-      outer: for (let i = 0; i < data.length; i++) {
-        for (let j = i + 1; j < data.length; j++) {
-          if (deepEqual(data[i], data[j])) {
-            if (errors !== NOERRORS) errors.push(err('uniqueItems', 'uniqueItems', instancePath, schemaPath + '/uniqueItems', { i, j }, `must NOT have duplicate items (items ## ${j} and ${i} are identical)`));
-            valid = false;
-            break outer;
-          }
-        }
+      const pair = duplicatePair(data);
+      if (pair !== null) {
+        const i = pair[0], j = pair[1];
+        if (errors !== NOERRORS) errors.push(err('uniqueItems', 'uniqueItems', instancePath, schemaPath + '/uniqueItems', { i, j }, `must NOT have duplicate items (items ## ${j} and ${i} are identical)`));
+        valid = false;
       }
     }
   }
@@ -924,9 +922,7 @@ class Interpreter {
       valid = false;
     }
     if (P.enum !== null) {
-      let found = false;
-      for (let i = 0; i < P.enum.length; i++) { if (deepEqual(P.enum[i], data)) { found = true; break; } }
-      if (!found) {
+      if (!enumMember(P, data)) {
         if (errors !== NOERRORS) errors.push(err('enum', 'enum', instancePath, schemaPath + '/enum', { allowedValues: P.enum }, 'must be equal to one of the allowed values'));
         valid = false;
       }
@@ -958,14 +954,11 @@ class Interpreter {
       if (P.minItems !== undefined && data.length < P.minItems) { errors === NOERRORS || errors.push(err('minItems', 'minItems', instancePath, schemaPath + '/minItems', { limit: P.minItems }, `must NOT have fewer than ${P.minItems} items`)); valid = false; }
       if (P.maxItems !== undefined && data.length > P.maxItems) { errors === NOERRORS || errors.push(err('maxItems', 'maxItems', instancePath, schemaPath + '/maxItems', { limit: P.maxItems }, `must NOT have more than ${P.maxItems} items`)); valid = false; }
       if (P.uniqueItems) {
-        outer: for (let i = 0; i < data.length; i++) {
-          for (let j = i + 1; j < data.length; j++) {
-            if (deepEqual(data[i], data[j])) {
-              if (errors !== NOERRORS) errors.push(err('uniqueItems', 'uniqueItems', instancePath, schemaPath + '/uniqueItems', { i, j }, `must NOT have duplicate items (items ## ${j} and ${i} are identical)`));
-              valid = false;
-              break outer;
-            }
-          }
+        const pair = duplicatePair(data);
+        if (pair !== null) {
+          const i = pair[0], j = pair[1];
+          if (errors !== NOERRORS) errors.push(err('uniqueItems', 'uniqueItems', instancePath, schemaPath + '/uniqueItems', { i, j }, `must NOT have duplicate items (items ## ${j} and ${i} are identical)`));
+          valid = false;
         }
       }
       const prefix = P.prefixItems;
@@ -1246,7 +1239,7 @@ function err(code, keyword, instancePath, schemaPath, params, message) {
 
 const { compileInterpreter } = require('./plan-compiler').install({
   Plan, NOERRORS, err, evalLeaf, evalLeafV, runCustomV, dataBits, escapePointer,
-  deepEqual, multipleOfOk, cpAtLeast, cpAtMost,
+  deepEqual, enumMember, allDistinct, multipleOfOk, cpAtLeast, cpAtMost,
   T_STRING, T_ARRAY, T_OBJECT, resolveRef, splitFragment, resolveUri,
 });