ata-validator 1.47.0 → 1.49.0

package/lib/regex-linear.js

@@ -3,34 +3,56 @@
 const { parse } = require('./safe-regex')
 
 // True when the platform RegExp, a backtracking engine, also runs `src` in
-// linear time, so it can take the pattern: every unbounded quantifier on one
-// character, class or `.`; at most one of them, and then anchored with `^`;
-// a finite repeat may cover a group that holds no unbounded quantifier; few
-// bounded choices in all; only escapes both engines read alike; nothing
-// outside the BMP, so both see the same UTF-16 units.
-// tests/test_regex_native_linear.js holds it.
+// linear time, so it can take the pattern instead of the linear-time engine
+// in safe-regex.js, which costs three to five times as much per character.
+// Two rules, and a pattern passes on either:
+//
+// The simple rule, the original one: every unbounded quantifier is on one
+// character, class or `.`; at most one of them, and then the pattern is
+// anchored with `^` on every branch; a finite repeat may cover a group that
+// holds no unbounded quantifier; few bounded choices in all. One loop whose
+// body cannot be split two ways, exited at most once per position, with
+// bounded work after it.
+//
+// The deterministic rule, for the patterns the simple one declines: dotted
+// identifiers, `[^/]+/[^/]+`, version numbers. On the Glushkov construction
+// the characters, classes and dots are positions. Around every unbounded
+// loop the next character must decide the single way to continue: the
+// positions that can follow a position inside a loop accept pairwise
+// disjoint characters, and so do the positions a match can start at when a
+// loop is among them; a position reaches a follower by one route only, since
+// `(a+)+` reaches `a` from `a` through the inner loop and again through the
+// outer one and that double route is what a backtracking engine explores
+// exponentially; a loop body must not match the empty string, since `(a*)*`
+// iterates emptily without bound. Ambiguity away from any loop, `(pwa|PWA)`,
+// costs a bounded factor and is allowed, as the simple rule allows it. A
+// bounded repeat is a loop only when its body holds an unbounded one, since
+// `(\w+\s?){5}` splits five ways where `(?:[A-F0-9]{2}:){31}` counts. With
+// an unbounded quantifier the pattern must be anchored with `^` on every
+// branch, since an unanchored search retries from each position.
+//
+// Both rules allow only escapes both engines read alike and nothing outside
+// the BMP, so both see the same UTF-16 units. tests/test_regex_native_linear.js
+// holds them: every accepted pattern answers as the linear engine does and
+// stays fast on inputs built to make a backtracking engine retry.
 const NATIVE_ESCAPES = new Set(['d', 'D', 'w', 'W', 's', 'S', 'n', 'r', 't', 'f', 'v', '.', '\\', '/', '^', '$', '|', '?', '*', '+', '(', ')', '[', ']', '{', '}', '-', 'x', 'u'])
-function nativeIsLinear (src) {
-  if (typeof src !== 'string' || src.length > 512) return false
-  for (let i = 0; i < src.length; i++) {
-    const c = src.charCodeAt(i)
-    if (c >= 0xd800 && c <= 0xdfff) return false
-    if (src[i] === '\\') {
-      const e = src[i + 1]
-      if (!NATIVE_ESCAPES.has(e)) return false
-      if (e === 'x' && !/^[0-9a-fA-F]{2}$/.test(src.slice(i + 2, i + 4))) return false
-      if (e === 'u' && !/^[0-9a-fA-F]{4}$/.test(src.slice(i + 2, i + 6))) return false
-      i++
-    }
-  }
-  let ast
-  try { ast = parse(src) } catch { return false }
+const MAX_BOUNDED_CHOICES = 64
+
+const atom = (n) => n.t === 'char' || n.t === 'class' || n.t === 'any'
+
+// Anchored at the start on every top-level branch.
+function anchored (ast) {
+  let top = ast
+  while (top.t === 'group') top = top.child
+  const branches = top.t === 'alt' ? top.opts : [top]
+  const first = (n) => { while (n && n.t === 'group') n = n.child; return n && n.t === 'concat' ? first(n.parts[0]) : n }
+  return branches.every((b) => { const f = first(b); return f && f.t === 'bol' })
+}
+
+function simpleRule (ast) {
   // Per subtree: how many unbounded quantifiers it holds (`u`) and how many
   // bounded choices a backtracking engine could try (`b`), or null where the
-  // shape is not provably linear. A finite repeat of a group is linear when
-  // the group holds no unbounded quantifier: `(?:[A-F0-9]{2}:){31}` has
-  // nothing to retry, and its choices multiply through the nesting.
-  const atom = (n) => n.t === 'char' || n.t === 'class' || n.t === 'any'
+  // shape is not provably linear.
   const info = (n) => {
     switch (n.t) {
       case 'star': case 'plus':
@@ -56,19 +78,154 @@ function nativeIsLinear (src) {
     }
   }
   const r = info(ast)
-  const ok = r !== null
-  const unbounded = ok ? r.u : 0
-  const bounded = ok ? r.b : 0
-  if (!ok || unbounded > 1 || bounded > 64) return false
-  if (unbounded === 1) {
-    // Anchored at the start on every top-level branch.
-    let top = ast
-    while (top.t === 'group') top = top.child
-    const branches = top.t === 'alt' ? top.opts : [top]
-    const first = (n) => { while (n && n.t === 'group') n = n.child; return n && n.t === 'concat' ? first(n.parts[0]) : n }
-    if (!branches.every((b) => { const f = first(b); return f && f.t === 'bol' })) return false
+  if (r === null || r.u > 1 || r.b > MAX_BOUNDED_CHOICES) return false
+  return r.u === 0 || anchored(ast)
+}
+
+// The characters a position accepts: 128 ASCII bits and one bit for "some
+// code point at 128 or above", which keeps two classes with non-ASCII
+// members apart only when one of them has none. Conservative in the right
+// direction: an overlap that is not there only sends a pattern to the
+// linear engine.
+function charSet (node) {
+  const bits = new Uint8Array(128)
+  let high = 0
+  if (node.t === 'any') {
+    bits.fill(1); bits[10] = 0; bits[13] = 0; high = 1
+  } else if (node.t === 'char') {
+    if (node.c < 128) bits[node.c] = 1; else high = 1
+  } else {
+    for (const [lo, hi] of node.ranges) {
+      for (let c = Math.max(0, lo), top = Math.min(127, hi); c <= top; c++) bits[c] = 1
+      if (hi >= 128) high = 1
+    }
+    if (node.neg) { for (let c = 0; c < 128; c++) bits[c] ^= 1; high = 1 }
   }
-  return true
+  return { bits, high }
+}
+
+function overlap (a, b) {
+  if (a.high && b.high) return true
+  for (let c = 0; c < 128; c++) if (a.bits[c] & b.bits[c]) return true
+  return false
+}
+
+// Whether a subtree holds an unbounded quantifier.
+function hasUnbounded (n) {
+  switch (n.t) {
+    case 'star': case 'plus': return true
+    case 'repeat': return n.max === Infinity || hasUnbounded(n.child)
+    case 'quest': case 'group': return hasUnbounded(n.child)
+    case 'concat': return n.parts.some(hasUnbounded)
+    case 'alt': return n.opts.some(hasUnbounded)
+    default: return false
+  }
+}
+
+function deterministicRule (ast) {
+  const sets = []
+  const follow = []
+  const inLoop = []
+  let ok = true
+  let unbounded = 0
+  let bounded = 0
+  let depth = 0
+  // Pairwise disjoint, required when a loop position is among them.
+  const disjoint = (ids) => {
+    const arr = Array.from(ids)
+    if (!arr.some((p) => inLoop[p])) return
+    for (let i = 0; i < arr.length && ok; i++) {
+      for (let j = i + 1; j < arr.length; j++) if (overlap(sets[arr[i]], sets[arr[j]])) { ok = false; return }
+    }
+  }
+  const link = (from, to) => {
+    for (const p of to) {
+      if (follow[from].has(p)) { ok = false; return }
+      follow[from].add(p)
+    }
+  }
+  const empty = () => ({ nullable: true, first: new Set(), last: new Set() })
+  const walk = (n) => {
+    if (!ok) return empty()
+    switch (n.t) {
+      case 'char': case 'class': case 'any': {
+        const id = sets.length
+        sets.push(charSet(n))
+        follow.push(new Set())
+        inLoop.push(depth > 0)
+        return { nullable: false, first: new Set([id]), last: new Set([id]) }
+      }
+      case 'bol': case 'eol': return empty()
+      case 'group': return walk(n.child)
+      case 'star': case 'plus': case 'quest': case 'repeat': {
+        const infinite = n.t === 'star' || n.t === 'plus' || (n.t === 'repeat' && n.max === Infinity)
+        const loops = infinite || (n.t === 'repeat' && n.max > 1 && hasUnbounded(n.child))
+        const optional = n.t === 'star' || n.t === 'quest' || (n.t === 'repeat' && n.min === 0)
+        if (loops) depth++
+        const c = walk(n.child)
+        if (loops) depth--
+        if (infinite) {
+          unbounded++
+          if (c.nullable) ok = false
+        } else if (n.t === 'quest') {
+          bounded += 1
+        } else {
+          bounded += (n.max - n.min)
+          if (!atom(n.child)) bounded += n.max
+        }
+        if (loops) for (const l of c.last) link(l, c.first)
+        return { nullable: c.nullable || optional, first: c.first, last: c.last }
+      }
+      case 'concat': {
+        let acc = empty()
+        for (const part of n.parts) {
+          const r = walk(part)
+          for (const l of acc.last) link(l, r.first)
+          const first = new Set(acc.first)
+          if (acc.nullable) for (const f of r.first) first.add(f)
+          const last = new Set(r.last)
+          if (r.nullable) for (const l of acc.last) last.add(l)
+          acc = { nullable: acc.nullable && r.nullable, first, last }
+        }
+        return acc
+      }
+      case 'alt': {
+        const rs = n.opts.map(walk)
+        const first = new Set()
+        const last = new Set()
+        for (const r of rs) { for (const f of r.first) first.add(f); for (const l of r.last) last.add(l) }
+        return { nullable: rs.some((r) => r.nullable), first, last }
+      }
+      default:
+        ok = false
+        return empty()
+    }
+  }
+  const root = walk(ast)
+  if (!ok) return false
+  disjoint(root.first)
+  for (let p = 0; p < sets.length && ok; p++) disjoint(follow[p])
+  if (!ok) return false
+  if (bounded > MAX_BOUNDED_CHOICES) return false
+  return unbounded === 0 || anchored(ast)
+}
+
+function nativeIsLinear (src) {
+  if (typeof src !== 'string' || src.length > 512) return false
+  for (let i = 0; i < src.length; i++) {
+    const c = src.charCodeAt(i)
+    if (c >= 0xd800 && c <= 0xdfff) return false
+    if (src[i] === '\\') {
+      const e = src[i + 1]
+      if (!NATIVE_ESCAPES.has(e)) return false
+      if (e === 'x' && !/^[0-9a-fA-F]{2}$/.test(src.slice(i + 2, i + 4))) return false
+      if (e === 'u' && !/^[0-9a-fA-F]{4}$/.test(src.slice(i + 2, i + 6))) return false
+      i++
+    }
+  }
+  let ast
+  try { ast = parse(src) } catch { return false }
+  return simpleRule(ast) || deterministicRule(ast)
 }
 
 module.exports = { nativeIsLinear }

package/lib/rejections.js

@@ -84,17 +84,16 @@ class RichRejection {
 // legacy key set, or enriched. Shared by both rejection classes below.
 function presentErrors(raw, data, rawInput, self, root, enrich) {
   if (needsOrdering(raw)) raw = sortErrorsBySchemaOrder(root, raw);
-  // The position map, resolved now that an error is actually being read.
-  let positions = null;
-  if (enrich && raw.length && rawInput != null) {
-    positions = self._pos().targeted(rawInput, wantedPointersFor(raw));
-    if (positions) self._posCache.reset();
-  }
+  // The position map, resolved on the first read of an error's frame (see
+  // defineLazyFrames in lib/enrich-error.js): a walk of the document that a
+  // caller reading messages and paths never needs.
+  const lazyPositions = enrich && raw.length && rawInput != null ? lazyPositionsFor(self, rawInput, raw) : null;
   // One options object for the whole list, not one per error.
   const opts = enrich && raw.length
     ? {
         data,
-        positions,
+        positions: null,
+        lazyPositions,
         schemaPositions: self._schemaPositions,
         schemaFile: self._source ? self._source.path : undefined,
       }
@@ -180,13 +179,16 @@ Object.defineProperty(LazyJsonRejection.prototype, 'errors', {
     // on raw errors; taking it as the signal left those errors without
     // `received` or a suggestion on the text path while validate() had both.
     if (!raw[0] || !('received' in raw[0])) {
-      const positions = self._pos().targeted(jsonStr, wantedPointersFor(raw));
       // Declaration order, as validate() applies it; the text path used to
       // enrich in emission order.
       const ordered = needsOrdering(raw) ? sortErrorsBySchemaOrder(self._schemaObj, raw) : raw;
+      // The position map waits for the first read of a frame (lib/enrich-error
+      // defineLazyFrames); until then reading the list costs the enrichment alone.
+      const lazyPositions = lazyPositionsFor(self, jsonStr, ordered);
       const enrichOpts = {
         data: parsedData,
-        positions,
+        positions: null,
+        lazyPositions,
         schemaPositions: self._schemaPositions,
         schemaFile: self._source ? self._source.path : undefined,
       };
@@ -195,11 +197,11 @@ Object.defineProperty(LazyJsonRejection.prototype, 'errors', {
       attachDiagnosticSource(enriched, {
         data: parsedData,
         text: jsonStr,
-        positions,
+        // Read by the diagnostic renderer only, which resolves the same map.
+        get positions () { return lazyPositions(); },
         schema: self._schemaObj,
         mutatesInput: self._mutatesInput === true,
       });
-      if (positions) self._posCache.reset();
       this._cached = enriched;
       return enriched;
     }
@@ -232,6 +234,20 @@ Object.defineProperty(LazyJsonRejection.prototype, 'errors', {
   },
 });
 
+// The targeted position map for a list, built on the first call and shared
+// by every error's frame accessor (lib/enrich-error defineLazyFrames).
+function lazyPositionsFor (self, text, errors) {
+  let done = false;
+  let positions = null;
+  return () => {
+    if (done) return positions;
+    done = true;
+    positions = self._pos().targeted(text, wantedPointersFor(errors));
+    if (positions) self._posCache.reset();
+    return positions;
+  };
+}
+
 // The pointers a set of errors will ask the position map about. lib/enrich-error
 // looks up the error's own path, and for an additional or unevaluated property
 // the child pointer named in `params`, unescaped, which is the form it asks for.

package/lib/safe-regex.js

@@ -410,7 +410,8 @@ function __ataSafeRegex () {
       id = states.length
       let isMatch = false
       for (let k = 0; k < pcs.length; k++) if (ops[pcs[k]] === OP_MATCH) { isMatch = true; break }
-      states.push({ pcs: Int32Array.from(pcs), isMatch, next: new Int32Array(128).fill(-2), nextEnd: new Int32Array(128).fill(-2) })
+      // `dead`: an anchored match with no thread left cannot recover.
+      states.push({ pcs: Int32Array.from(pcs), isMatch, dead: anchored && pcs.length === 0, next: new Int32Array(128).fill(-2), nextEnd: new Int32Array(128).fill(-2) })
       stateIds.set(key, id)
       return id
     }
@@ -452,23 +453,36 @@ function __ataSafeRegex () {
       }
       if (id < 0) return testNFA(s)
       let state = states[id]
-      for (let pos = 0; pos < len; pos++) {
+      if (len === 0) return state.isMatch
+      // The last character is stepped with the end-of-input flag set and is
+      // handled after the loop, so the loop body selects no table and tests
+      // no position.
+      const last = len - 1
+      for (let pos = 0; pos < last; pos++) {
         if (state.isMatch) return true
         const c = s.charCodeAt(pos)
-        const atEnd = pos + 1 === len
         let nid
         if (c < 128) {
-          const table = atEnd ? state.nextEnd : state.next
-          nid = table[c]
-          if (nid === -2) { nid = step(state, c, atEnd); table[c] = nid }
+          nid = state.next[c]
+          if (nid === -2) { nid = step(state, c, false); state.next[c] = nid }
         } else {
-          nid = step(state, c, atEnd)
+          nid = step(state, c, false)
         }
         if (nid < 0) return testNFA(s)
         state = states[nid]
-        if (anchored && state.pcs.length === 0) return false
+        if (state.dead) return false
       }
-      return state.isMatch
+      if (state.isMatch) return true
+      const c = s.charCodeAt(last)
+      let nid
+      if (c < 128) {
+        nid = state.nextEnd[c]
+        if (nid === -2) { nid = step(state, c, true); state.nextEnd[c] = nid }
+      } else {
+        nid = step(state, c, true)
+      }
+      if (nid < 0) return testNFA(s)
+      return states[nid].isMatch
     }
 
     return function test (s) {

package/lib/scan-compiler.js

@@ -892,7 +892,7 @@ function emitArray(schema, ctx, out, depth) {
 // Every `return 0` inside the member becomes that record, which is also how
 // the rule reaches nested objects: an inner object's own verdict is a value
 // failure at the level above it.
-function emitMember(sub, ctx, out, depth, objId) {
+function emitMember(sub, ctx, out, depth, objId, kn) {
   let lines = [];
   emitValue(sub, ctx, lines, depth + 1);
   // A large member value becomes a function of its own, so no one function
@@ -921,9 +921,17 @@ function emitMember(sub, ctx, out, depth, objId) {
   out.push(label + ':{');
   out.push(body.split('return 0;').join('{_f' + objId + '=2;break ' + label + ';}'));
   out.push('}');
-  // Resync from where the value started: a scan that stopped partway through
-  // one cannot say where it ends, and the skipper can.
-  out.push('if(_f' + objId + '===2){_f' + objId + '=1;i=_r.skipValue(s,_vs' + label + ');if(i<0)return 0;c=s.charCodeAt(i);}');
+  // A failed member is the verdict unless this object repeats the key later,
+  // since the parser keeps the last value. Whether it can is answered by two
+  // native searches over the rest of the text, for the key as written and
+  // for any backslash, which is the only way to spell that key differently:
+  // when neither is there the scan ends here, and a 69 KB body with a bad
+  // first item is refused in the time of an indexOf rather than a full pass.
+  // Otherwise resync from where the value started, since a scan that stopped
+  // partway through one cannot say where it ends and the skipper can, and
+  // go on, so a repeat still bails to the parser.
+  out.push('if(_f' + objId + '===2){if(s.indexOf(s.slice(_p' + kn + '-1,_e' + kn + '+1),i)<0&&s.indexOf("\\\\",i)<0)return 0;');
+  out.push('_f' + objId + '=1;i=_r.skipValue(s,_vs' + label + ');if(i<0)return 0;c=s.charCodeAt(i);}');
 }
 
 function emitObject(schema, ctx, out, depth) {
@@ -1111,7 +1119,7 @@ function emitObject(schema, ctx, out, depth) {
       const cond = gi === bounds.length - 1 ? '' : 'if(_kid' + kn + '<' + g.end + ')';
       out.push((gi === 0 ? '' : 'else ') + cond + '{');
       if (g.sub === undefined) out.push(addH);
-      else emitMember(g.sub, ctx, out, depth, n);
+      else emitMember(g.sub, ctx, out, depth, n, kn);
       out.push('}');
       prev = g.end;
     });
@@ -1160,7 +1168,7 @@ function emitObject(schema, ctx, out, depth) {
       out.push('_s' + n + '_' + slot.w + '|=' + slot.b + ';');
       const sub = props && Object.prototype.hasOwnProperty.call(props, name) ? props[name] : undefined;
       if (sub === undefined) out.push(additional.join('\n'));
-      else emitMember(sub, ctx, out, depth, n);
+      else emitMember(sub, ctx, out, depth, n, kn);
       out.push('}');
     }
     out.push('else{' + additional.join('\n') + '}');

package/lib/validator-core.js

@@ -25,7 +25,7 @@ function _registerCodegen(engine) {
   _codegen = engine;
   ({ compileToJS, compileToJSCodegen, compileToJSCodegenWithErrors, compileToJSCombined } = engine.jsCompiler);
 }
-const { normalizeDraft7, normalizeNullable, normalizeExclusiveBounds, stripFormatAssertions } = require("./draft7");
+const { draftCode, normalizeDraft2019, normalizeDraft7, normalizeNullable, normalizeExclusiveBounds, stripFormatAssertions } = require("./draft7");
 const { enabledKeywords, stripDisabledKeywords } = require("./vocabularies");
 const { needsNormalization } = require("./schema-scan");
 const { isV1Dialect } = require("./dialect");
@@ -426,21 +426,26 @@ function _deepCloneWithSymbols(v) {
 // Normalize a caller-provided schema without mutating the original.
 // Clones only when normalization would change the object (draft-07 keys
 // present or nullable fields present). Internal-only — not exported.
+// `inheritDraft7` is the root's draft for a document that declares none of
+// its own: 0 or absent for none, 1 for draft-07, 2 for draft-06, 3 for 2019-09.
 function _normalizeCallerSchema(s, inheritDraft7) {
-  const declares = s && typeof s === 'object' && s.$schema !== undefined
-  const needsDraft7 = declares
-    ? (s.$schema === 'http://json-schema.org/draft-07/schema#' || s.$schema === 'http://json-schema.org/draft-07/schema')
-    : !!inheritDraft7
+  const declared = s && typeof s === 'object' ? s.$schema : undefined
+  const code = declared !== undefined ? draftCode(declared) : (inheritDraft7 || 0)
+  const needsDraft7 = code === 1 || code === 2
+  const draft6 = code === 2
+  const draft2019 = code === 3
   // One walk answers whether there is anything to do. Almost always there is
   // not, and then the serialize, clone, normalize, serialize, compare below is
   // work spent to find that out. The walk over-reports rather than under, so a
   // schema it clears is one no normalizer would have touched;
   // `tests/test_schema_scan.js` holds that direction against the whole suite.
-  if (!needsNormalization(s, needsDraft7)) return s
+  // The scan does not look for `if`/`then`/`else`, which draft-06 drops.
+  if (!draft6 && !draft2019 && !needsNormalization(s, needsDraft7)) return s
 
   const str = JSON.stringify(s)
   const copy = _deepCloneWithSymbols(s)
-  if (needsDraft7) normalizeDraft7(copy, true)
+  if (needsDraft7) normalizeDraft7(copy, true, draft6)
+  if (draft2019) normalizeDraft2019(copy, true)
   normalizeNullable(copy)
   normalizeExclusiveBounds(copy)
   // Return original when normalization produced no change, copy otherwise.
@@ -467,7 +472,7 @@ function declaredId(original, normalized) {
   return undefined
 }
 
-// `inheritDraft7` is true when the root schema is draft-07: a retrieved
+// `inheritDraft7` is non-zero when the root schema is draft-07 or draft-06: a retrieved
 // document that declares no dialect is read under the root's draft.
 // The map is derived entirely from what the caller passed, so the same
 // `schemas` gives the same map. A server building one validator per route over
@@ -485,12 +490,12 @@ function buildSchemaMap(schemas, inheritDraft7) {
   if (!schemas) return null
   const byDraft = _schemaMapCache.get(schemas)
   if (byDraft) {
-    const hit = byDraft[inheritDraft7 ? 1 : 0]
+    const hit = byDraft[inheritDraft7 || 0]
     if (hit) return hit
   }
   const map = _buildSchemaMap(schemas, inheritDraft7)
-  const slot = byDraft || [null, null]
-  slot[inheritDraft7 ? 1 : 0] = map
+  const slot = byDraft || [null, null, null, null]
+  slot[inheritDraft7 || 0] = map
   if (!byDraft) _schemaMapCache.set(schemas, slot)
   return map
 }
@@ -676,8 +681,7 @@ class Validator {
     // uses, and a benchmark timing construction measures construction.
     // When schema is a string, JSON.parse already produces a fresh object.
     const raw = typeof schema === "string" ? JSON.parse(schema) : schema;
-    const rootIsDraft7 = !!(raw && typeof raw === 'object' && typeof raw.$schema === 'string' &&
-      (raw.$schema === 'http://json-schema.org/draft-07/schema#' || raw.$schema === 'http://json-schema.org/draft-07/schema'));
+    const rootIsDraft7 = raw && typeof raw === 'object' ? draftCode(raw.$schema) : 0;
 
     // Built here rather than below because `$vocabulary` is resolved against
     // it, and that resolution waits until compilation so a meta-schema
@@ -1561,8 +1565,7 @@ class Validator {
     // Normalize a copy so the caller's object is never mutated. A document
     // without a dialect of its own is read under the root's draft.
     const root = this._schemaObj
-    const rootIsDraft7 = !!(root && typeof root === 'object' && typeof root.$schema === 'string' &&
-      (root.$schema === 'http://json-schema.org/draft-07/schema#' || root.$schema === 'http://json-schema.org/draft-07/schema'))
+    const rootIsDraft7 = root && typeof root === 'object' ? draftCode(root.$schema) : 0
     const normalized = _normalizeCallerSchema(schema, rootIsDraft7)
     this._ownSchemaMap()
     this._schemaMap.set(normalized.$id, normalized)
@@ -1802,8 +1805,12 @@ Validator.loadBundle = function (mods, schemas, opts) {
 // simdjson when the addon is there, JSON.parse otherwise; the addon loads on
 // the first call rather than when the package is required.
 function parseJSON(input) {
+  // The addon has not carried parseJSON since the per-platform packages
+  // (1.1.0); the call threw a TypeError whenever the engine was loaded and
+  // returned JSON.parse's answer otherwise. A Buffer is decoded first.
   const native = getNative();
-  return native ? native.parseJSON(input) : JSON.parse(input);
+  if (native && typeof native.parseJSON === 'function') return native.parseJSON(input);
+  return JSON.parse(typeof input === 'string' ? input : String(input));
 }
 
 // Ultra-fast compile: returns validate function directly, no Validator wrapper

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.47.0';
+module.exports = '1.49.0';

package/lib/vocabularies.js

@@ -50,6 +50,18 @@ function keywordsByVocabulary() {
       new Set(Object.keys(meta.properties)),
     )
   }
+  // Draft 2019-09's vocabularies, from its own vendored meta-schemas. A
+  // 2019-09 dialect names these URIs in `$vocabulary`.
+  for (const name of ['core', 'applicator', 'validation', 'meta-data', 'format', 'content']) {
+    const meta = require('./metaschemas').METASCHEMAS.get(
+      `https://json-schema.org/draft/2019-09/meta/${name}`,
+    )
+    if (!meta || !meta.properties) continue
+    byVocabulary.set(
+      `https://json-schema.org/draft/2019-09/vocab/${name}`,
+      new Set(Object.keys(meta.properties)),
+    )
+  }
   // The one vocabulary with no document to read. `format-assertion` is an
   // alternative to `format-annotation` rather than part of the standard
   // dialect, so its meta-schema is not among the vendored ones. It defines

package/lite.d.ts

@@ -0,0 +1,12 @@
+// ata-validator/lite: the same Validator and one-shot functions as
+// ata-validator, on the interpreted engine and without the code generator.
+// Validator#parse and the static bundle methods throw a TypeError here.
+export {
+  Validator,
+  validate,
+  validateAsync,
+  parseAsync,
+  defineSchema,
+  version,
+} from './index.js';
+export type * from './index.js';

package/lite.js

@@ -0,0 +1,20 @@
+'use strict';
+
+// ata-validator/lite: the Validator without the code generator. Every schema
+// runs on the interpreted engine, which passes the same official test suite as
+// the compiled path and never calls `new Function`, so it also runs under a
+// strict Content-Security-Policy. The results are the ones `ata-validator`
+// gives: the same verdicts, the same errors. What it leaves out is what needs
+// the code generator (parse(), the ahead-of-time bundle methods) and the tools
+// no Validator calls (TypeScript generation, the renderers). Made for pages
+// where the size of what ships matters more than nanoseconds per call.
+const core = require('./lib/validator-core.js');
+
+module.exports = {
+  Validator: core.Validator,
+  validate: core.validate,
+  validateAsync: core.validateAsync,
+  parseAsync: core.parseAsync,
+  defineSchema: core.defineSchema,
+  version: core.version,
+};

package/lite.mjs

@@ -0,0 +1,3 @@
+import mod from './lite.js';
+export const { Validator, validate, validateAsync, parseAsync, defineSchema, version } = mod;
+export default mod;