ata-validator 1.46.0 → 1.47.0

package/lib/native-load.js

@@ -1,4 +1,5 @@
 'use strict';
+const { env } = require('./env');
 
 // Locate the optional native engine. Resolution order:
 //   1. ATA_NO_NATIVE set        -> null (explicit pure-JS mode)
@@ -36,6 +37,12 @@ function detectMusl() {
   }
 }
 
+// The require of the platform package is of a computed name on purpose. A
+// literal require of each of the seven packages was tried: at most one of
+// them is installed on any machine, and a bundler that bundles the Node
+// entry (esbuild, bun, webpack) fails to resolve the other six and stops.
+// A supply-chain scanner reports a computed require as dynamic loading;
+// this is what it loads, and nothing else is ever required by name here.
 let warned = false;
 function checkVersion(binding, source) {
   if (!binding) return null;
@@ -58,7 +65,7 @@ function checkVersion(binding, source) {
 }
 
 module.exports = function loadNative() {
-  if (process.env.ATA_NO_NATIVE) return null;
+  if (env('ATA_NO_NATIVE')) return null;
 
   const isMusl = process.platform === 'linux' ? detectMusl() : false;
   const candidates = [];
@@ -80,6 +87,8 @@ module.exports = function loadNative() {
 
   // Contributors running from a source checkout.
   try {
+    // Not a literal path for the same reason: the file is absent from the
+    // published package and a bundler must not try to resolve it.
     const path = require('path');
     const binding = checkVersion(
       require(path.join(__dirname, '..', 'build', 'Release', 'ata.node')),

package/lib/scan-compiler.js

@@ -1,4 +1,5 @@
 'use strict';
+const { compileFunction } = require('./compile-fn');
 
 // A schema-directed scanner: it answers the verdict from the JSON text without
 // building the document. `JSON.parse` is three quarters of the cost of a real
@@ -436,7 +437,7 @@ function finish(built, opts) {
   let fn;
   try {
     // eslint-disable-next-line no-new-func
-    fn = new Function('_h', '_r', ctx.subSource.join('\n') + '\nreturn function scan(s){\n' + body + '\n}')(ctx.helpers, require('./scan-runtime'));
+    fn = compileFunction('_h', '_r', ctx.subSource.join('\n') + '\nreturn function scan(s){\n' + body + '\n}')(ctx.helpers, require('./scan-runtime'));
   } catch {
     return null; // a runtime without code generation has no scanner, by design
   }

package/lib/validator-core.js

@@ -10,6 +10,8 @@ function getNative() {
   if (_nativeMod === undefined) _nativeMod = require("./native-load")();
   return _nativeMod;
 }
+const { env } = require('./env');
+const { compileFunction } = require('./compile-fn');
 const { normalizeKeywords, schemaUsesKeywords } = require('./keywords');
 // The code generator (lib/js-compiler and what builds on it: the scanner, the
 // parse() copy, the ahead-of-time emitters) is registered by the entry that
@@ -207,7 +209,7 @@ function codegenAvailable() {
   if (_codegen === null) return false;
   if (_codegenAvailable === null) {
     try {
-      _codegenAvailable = new Function('return 1')() === 1;
+      _codegenAvailable = compileFunction('return 1')() === 1;
     } catch {
       _codegenAvailable = false;
     }
@@ -880,7 +882,7 @@ class Validator {
     // Check cache first -- reuse compiled functions for same schema
     const sm = this._schemaMap.size > 0 ? this._schemaMap : null;
     const mapKey = compileCacheKey(this._schemaStr, this._schemaMap);
-    var _forceNapi = this._interpretOnly || (typeof process !== 'undefined' && process.env && process.env.ATA_FORCE_NAPI);
+    var _forceNapi = this._interpretOnly || env('ATA_FORCE_NAPI');
     // Custom formats are JS functions: bypass the compile cache since they can
     // differ between validators that share the same schema string. An
     // interpreter-only validator never touches it either way: a function a
@@ -1584,7 +1586,7 @@ class Validator {
       return;
     }
     this._ensureVocabularies();
-    if (this._interpretOnly || _codegen === null || (typeof process !== 'undefined' && process.env && process.env.ATA_FORCE_NAPI)) return;
+    if (this._interpretOnly || _codegen === null || env('ATA_FORCE_NAPI')) return;
     _codegen.compileVerdict.call(this);
   }
 

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.46.0';
+module.exports = '1.47.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.46.0",
+  "version": "1.47.0",
   "description": "JSON Schema validator that compiles to plain JavaScript, still runs where code generation is blocked, and can be compiled away at build time. Passes the full official test suite.",
   "main": "index.js",
   "module": "index.mjs",
@@ -143,13 +143,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.46.0",
-    "@ata-validator/native-darwin-x64": "1.46.0",
-    "@ata-validator/native-linux-arm64-gnu": "1.46.0",
-    "@ata-validator/native-linux-arm64-musl": "1.46.0",
-    "@ata-validator/native-linux-x64-gnu": "1.46.0",
-    "@ata-validator/native-linux-x64-musl": "1.46.0",
-    "@ata-validator/native-win32-x64": "1.46.0"
+    "@ata-validator/native-darwin-arm64": "1.47.0",
+    "@ata-validator/native-darwin-x64": "1.47.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.47.0",
+    "@ata-validator/native-linux-arm64-musl": "1.47.0",
+    "@ata-validator/native-linux-x64-gnu": "1.47.0",
+    "@ata-validator/native-linux-x64-musl": "1.47.0",
+    "@ata-validator/native-win32-x64": "1.47.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"