ata-validator 1.48.0 → 1.49.0

package/README.md

@@ -109,6 +109,29 @@ file.
   passes with nothing failed, errored or skipped under Bowtie's own runner. The v1 dialect is
   declared in a pending harness change that waits for a Bowtie release.
 
+### Side by side
+
+[validator-benchmarks](https://github.com/ata-core/validator-benchmarks) is ata's own
+comparison, so it comes after the ones above: eleven validators on three realistic bodies
+and four scenes, each library in its own process, 27 samples per cell, every schema and
+document in the repository. On an order body with formats and a pattern, 900 valid
+documents, Node 24:
+
+[![Documents a second on one order body, eleven validators](https://raw.githubusercontent.com/ata-core/validator-benchmarks/main/media/race-order-verdict-valid.gif)](https://github.com/ata-core/validator-benchmarks/blob/main/media/race-order-verdict-valid.mp4)
+
+| | documents a second, the verdict | same, `new Function` refused |
+|---|---:|---:|
+| ata | 3,295,880 | 607,614 |
+| ata, compiled module | 3,319,594 | 3,344,948 |
+| typebox | 1,638,813 | EvalError |
+| ajv | 1,285,492 | EvalError |
+| typia | 939,572 | 964,507 |
+| zod | 440,473 | 237,176 |
+
+Where ata is behind is in the same tables: on a four-field body that fails, ajv answers the
+verdict faster, and with every error read it does 6.6M a second against ata's 2.9M with rich
+errors (7.6M with `richErrors: false`).
+
 ## Why AOT
 
 | Dimension | Schema | ata-AOT | runtime validator | Difference |
@@ -254,13 +277,13 @@ is the most common way to get a misleading number out of this library.
 
 | | compiled with `ata build` | runtime `new Validator(schema)` |
 |---|---|---|
-| In a bundle, gzipped | **2.1 KB** | 125.0 KB |
+| In a bundle, gzipped | **2.1 KB** | 126.1 KB |
 | Time to a served request | **3.5 ms** | 7.6 ms |
 | Schema known when | build time | any time |
 
 The bundle row is the ten-field user schema in
 `tests/fixtures/error-dx/user.schema.json`, every export of the compiled module against
-`new Validator(schema)`, built with `bun build --minify --target=browser` on ata 1.47.0.
+`new Validator(schema)`, built with `bun build --minify --target=browser` on ata 1.48.0.
 The startup row is a Hono route on Bun 1.4, the median of three rounds of best-of-seven, from
 `benchmark/bundle`, against 3.5 ms for the same app doing no validation at all, so the
 compiled path costs nothing measurable to start. The runtime figure is what it is because
@@ -703,7 +726,7 @@ Copy-paste recipes for the common frameworks. Most need 10-20 lines of glue. See
 
 ### Dialects
 
-`$schema` selects the dialect. Draft 2020-12 is the default, draft-07 is normalized on the way in, and `https://json-schema.org/v1` (or the dated `https://json-schema.org/v1/2026`) selects JSON Schema v1.
+`$schema` selects the dialect. Draft 2020-12 is the default; draft-07, draft-06 and Draft 2019-09 are rewritten to the 2020-12 spelling on the way in (draft-06 as draft-07 without `if`/`then`/`else`, 2019-09's tuple `items` and `$recursiveRef` as `prefixItems` and `$dynamicRef`); and `https://json-schema.org/v1` (or the dated `https://json-schema.org/v1/2026`) selects JSON Schema v1. The official suite passes in full on all five: 1301 of 1301 on 2020-12, 1261 of 1261 on 2019-09, 929 of 929 on draft-07, 841 of 841 on draft-06 and 1135 of 1135 on v1, with code generation allowed and blocked. Draft-04 and earlier are not supported; draft-04's boolean `exclusiveMinimum`/`exclusiveMaximum` is read wherever it appears.
 
 Two things differ under v1. `propertyDependencies` selects a subschema by the value of a property rather than by its presence, which is what `dependentSchemas` does. And `$dynamicRef` no longer requires bookending: the reference resolves through the dynamic scope whether or not the schema it first lands on carries a matching `$dynamicAnchor`, so the outermost matching anchor still in scope wins. Everything else ata implements is identical under both dialects, so a schema that declares no `$schema` behaves exactly as before.
 

package/index.js

@@ -814,22 +814,40 @@ function hasDefaultsInside(node, seen) {
 function emitDefaults(node, ov, lines, st) {
   if (st.seen.has(node)) { st.cycle = true; return; }
   st.seen.add(node);
+  // A default is written only where the key is not an own property, and the
+  // own-property test used to be Object.hasOwn for every default on every
+  // call: on a configuration schema of 82 defaults that was 820 ns a call
+  // for a document that already carried every key, against 12 ns with the
+  // pass off. For a plain object (prototype Object.prototype) a key the
+  // prototype does not have is own exactly when reading it gives a value, so
+  // the read, an inline-cached load, settles the common case and hasOwn is
+  // consulted only when the read gives undefined. Keys Object.prototype does
+  // have (constructor, toString, __proto__) keep the hasOwn test, since the
+  // read would find the inherited one; so does any object with another
+  // prototype, where a read may find an inherited value of the same name.
+  const pk = '_pk' + st.n++;
+  lines.push(`const ${pk}=Object.getPrototypeOf(${ov})===Object.prototype`);
   for (const [key, prop] of Object.entries(node.properties || {})) {
     if (!prop || typeof prop !== 'object') continue;
     const k = JSON.stringify(key);
+    const inherited = key in Object.prototype;
+    const absent = inherited ? `!Object.hasOwn(${ov},${k})` : `(${ov}[${k}]===undefined||!${pk})&&!Object.hasOwn(${ov},${k})`;
     if (prop.default !== undefined) {
       const def = JSON.stringify(prop.default);
       // Assignment to a key named __proto__ hits the prototype setter
       // instead of creating a property; defineProperty writes an own key.
       lines.push(key === '__proto__'
-        ? `if(!Object.hasOwn(${ov},${k}))Object.defineProperty(${ov},${k},{value:${def},writable:true,enumerable:true,configurable:true})`
-        : `if(!Object.hasOwn(${ov},${k}))${ov}[${k}]=${def}`);
+        ? `if(${absent})Object.defineProperty(${ov},${k},{value:${def},writable:true,enumerable:true,configurable:true})`
+        : `if(${absent})${ov}[${k}]=${def}`);
     }
     // Into an own property that holds an object, arrays included, as the
-    // closure pass walks it.
+    // closure pass walks it. Object.prototype's own properties are functions
+    // apart from the __proto__ accessor, so on a plain object a read that
+    // gives an object is an own property for every other key.
     if (prop.properties && hasDefaultsInside(prop, new Set())) {
       const n = '_d' + st.n++;
-      lines.push(`if(Object.hasOwn(${ov},${k})){const ${n}=${ov}[${k}];if(typeof ${n}==='object'&&${n}!==null){`);
+      const own = inherited ? `Object.hasOwn(${ov},${k})` : `(${pk}||Object.hasOwn(${ov},${k}))`;
+      lines.push(`{const ${n}=${ov}[${k}];if(typeof ${n}==='object'&&${n}!==null&&${own}){`);
       emitDefaults(prop, n, lines, st);
       lines.push('}}');
     }

package/lib/aot-impl.js

@@ -113,6 +113,9 @@ function toStandalone(validator) {
   // Also capture error function source for zero-compile standalone load
   const jsErrFn = compileToJSCodegenWithErrors(
     typeof validator._schemaObj === 'object' ? validator._schemaObj : {},
+    null,
+    null,
+    { noOrdinal: true },
   );
   const errSrc = jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : '';
 
@@ -388,11 +391,14 @@ function toStandaloneModule(validator, opts) {
       `const _ER = function(e) { _ataStamp(e); this.valid = false; this.errors = e; };\n` +
       `${codeTableSource(onePass.keywords, onePass.formats)}const _vC = (function() {\n${onePass.core}\n})();\n`;
   } else if (!abortEarly) {
+    // A module returns the collector's errors as they are and never sorts
+    // them, so the ordinal the runtime sorts by (`_o`) has no reader there;
+    // it leaked into every error object a module reported.
     jsErrFn = compileToJSCodegenWithErrors(
       typeof validator._schemaObj === 'object' ? validator._schemaObj : {},
       null,
       validator._userFormats,
-      (source && sourceMap && schemaFile) ? { sourceMap, schemaFile, frames: sourceFrames } : null,
+      (source && sourceMap && schemaFile) ? { sourceMap, schemaFile, frames: sourceFrames, noOrdinal: true } : { noOrdinal: true },
     );
     const errSrc = jsErrFn && jsErrFn._errSource ? jsErrFn._errSource : '';
     if (errSrc && jsErrFn._errFactory) {
@@ -665,6 +671,7 @@ function bundleStandalone(Validator, schemas, opts) {
       v._schemaObj,
       v._schemaMap,
       v._userFormats,
+      { noOrdinal: true },
     );
     if (jsFn._usesSafeRe || (jsErrFn && jsErrFn._usesSafeRe)) bundleUsesSafeRe = true;
     return { v, jsFn, jsErrFn };
@@ -757,6 +764,7 @@ function bundleCompact(Validator, schemas, opts) {
       v._schemaObj,
       v._schemaMap,
       v._userFormats,
+      { noOrdinal: true },
     );
     if (jsFn._usesSafeRe || (jsErrFn && jsErrFn._usesSafeRe)) bundleUsesSafeRe = true;
     // Hoisted anyOf/oneOf branch helpers (e.g. `_af1_b0`) must travel with the

package/lib/draft7.js

@@ -1,19 +1,36 @@
 'use strict'
 
+// draft-06 is read through the same rules: it differs from draft-07 only in
+// lacking `if`/`then`/`else` (and the content and readOnly annotations), so a
+// draft-06 schema is a draft-07 schema with those three keywords inert. Before
+// this, a draft-06 schema was read under 2020-12 and its tuple `items`,
+// `additionalItems` and `dependencies` were not applied: 30 cases of the
+// official draft-06 suite accepted documents they must reject.
 const DRAFT7_SCHEMAS = new Set([
   'http://json-schema.org/draft-07/schema#',
   'http://json-schema.org/draft-07/schema',
+  'http://json-schema.org/draft-06/schema#',
+  'http://json-schema.org/draft-06/schema',
+])
+const DRAFT6_SCHEMAS = new Set([
+  'http://json-schema.org/draft-06/schema#',
+  'http://json-schema.org/draft-06/schema',
 ])
 
 function isDraft7(schema) {
-  return !!(schema && schema.$schema && DRAFT7_SCHEMAS.has(schema.$schema))
+  return !!(schema && typeof schema.$schema === 'string' && DRAFT7_SCHEMAS.has(schema.$schema))
+}
+
+function isDraft6(schema) {
+  return !!(schema && typeof schema.$schema === 'string' && DRAFT6_SCHEMAS.has(schema.$schema))
 }
 
 // `force` applies the draft-07 rules to a document that declares no dialect
 // of its own, which is how a retrieved schema inherits the root's draft.
-function normalizeDraft7(schema, force) {
+// `draft6` says the document, or the root it inherits from, is draft-06.
+function normalizeDraft7(schema, force, draft6) {
   if (!force && !isDraft7(schema)) return schema
-  _normalize(schema)
+  _normalize(schema, draft6 === true || isDraft6(schema))
   return schema
 }
 
@@ -21,9 +38,13 @@ function normalizeDraft7(schema, force) {
 // definitions are addressable by pointer, annotations are inert.
 const REF_SIBLINGS_KEPT = new Set(['$ref', '$defs', 'definitions', '$schema', '$comment', 'title', 'description', 'examples', 'default', 'readOnly', 'writeOnly'])
 
-function _normalize(schema) {
+function _normalize(schema, d6) {
   if (typeof schema !== 'object' || schema === null) return
 
+  // draft-06 has no conditional: `if`, `then` and `else` are unknown keywords
+  // there, so they are dropped rather than applied.
+  if (d6) { delete schema.if; delete schema.then; delete schema.else }
+
   // In draft-07 an object with `$ref` is that reference and nothing else:
   // sibling keywords, `$id` included, are ignored. Dropping them here gives
   // every engine the same reading without each having to know the draft.
@@ -74,7 +95,7 @@ function _normalize(schema) {
   for (const key of objSubs) {
     if (schema[key] && typeof schema[key] === 'object') {
       for (const v of Object.values(schema[key])) {
-        if (typeof v === 'object' && v !== null) _normalize(v)
+        if (typeof v === 'object' && v !== null) _normalize(v, d6)
       }
     }
   }
@@ -84,7 +105,7 @@ function _normalize(schema) {
   for (const key of arrSubs) {
     if (Array.isArray(schema[key])) {
       for (const s of schema[key]) {
-        if (typeof s === 'object' && s !== null) _normalize(s)
+        if (typeof s === 'object' && s !== null) _normalize(s, d6)
       }
     }
   }
@@ -94,7 +115,7 @@ function _normalize(schema) {
                        'additionalProperties', 'propertyNames']
   for (const key of singleSubs) {
     if (typeof schema[key] === 'object' && schema[key] !== null) {
-      _normalize(schema[key])
+      _normalize(schema[key], d6)
     }
   }
 }
@@ -248,4 +269,81 @@ function _stripFormat(schema, seen) {
   }
 }
 
-module.exports = { isDraft7, normalizeDraft7, normalizeNullable, normalizeExclusiveBounds, stripFormatAssertions }
+// Draft 2019-09 differs from 2020-12, which every engine here reads, in two
+// places: the array form of `items` with `additionalItems` (2020-12 spells
+// them `prefixItems` and `items`), and `$recursiveRef`/`$recursiveAnchor`,
+// which 2020-12 generalised into `$dynamicRef`/`$dynamicAnchor`. Both are
+// rewritten to the 2020-12 spelling. Before, a 2019-09 schema was read as
+// 2020-12 as written, and 38 cases of the official 2019-09 suite accepted
+// documents they must reject.
+//
+// The recursive pair maps one to one: a resource whose root says
+// `$recursiveAnchor: true` gets a `$dynamicAnchor` of a reserved name, and
+// `$recursiveRef: "#"` becomes a `$dynamicRef` to that name when its resource
+// carries the anchor, and a plain `$ref: "#"` when it does not, which is what
+// 2019-09 says it means then. The outward search for the outermost anchored
+// resource is the same rule in both drafts.
+const DRAFT2019_SCHEMAS = new Set([
+  'https://json-schema.org/draft/2019-09/schema',
+  'https://json-schema.org/draft/2019-09/schema#',
+])
+const RECURSIVE_ANCHOR = '__ata_recursive_anchor'
+
+function isDraft2019(schema) {
+  return !!(schema && typeof schema.$schema === 'string' && DRAFT2019_SCHEMAS.has(schema.$schema))
+}
+
+const SUB_OBJECT = ['properties', 'patternProperties', '$defs', 'definitions', 'dependentSchemas']
+const SUB_ARRAY = ['allOf', 'anyOf', 'oneOf', 'prefixItems', 'items']
+const SUB_SINGLE = ['items', 'additionalItems', 'contains', 'not', 'if', 'then', 'else', 'additionalProperties',
+  'propertyNames', 'unevaluatedItems', 'unevaluatedProperties', 'contentSchema']
+
+function normalizeDraft2019(schema, force) {
+  if (!force && !isDraft2019(schema)) return schema
+  _normalize2019(schema, schema, false)
+  return schema
+}
+
+function _normalize2019(node, resourceRoot, isRoot) {
+  if (typeof node !== 'object' || node === null || Array.isArray(node)) return
+  // A subschema with its own `$id` starts a new resource.
+  const root = !isRoot && typeof node.$id === 'string' && !node.$id.startsWith('#') ? node : resourceRoot
+  if (node.$recursiveAnchor === true && node === root) node.$dynamicAnchor = RECURSIVE_ANCHOR
+  delete node.$recursiveAnchor
+  if (typeof node.$recursiveRef === 'string') {
+    if (node.$recursiveRef === '#' && root.$dynamicAnchor === RECURSIVE_ANCHOR) node.$dynamicRef = '#' + RECURSIVE_ANCHOR
+    else if (node.$ref === undefined) node.$ref = node.$recursiveRef
+    delete node.$recursiveRef
+  }
+  // Recurse before the items rewrite, so tuple members are walked as members.
+  for (const key of SUB_OBJECT) {
+    const sub = node[key]
+    if (sub && typeof sub === 'object') for (const v of Object.values(sub)) _normalize2019(v, root, false)
+  }
+  for (const key of SUB_ARRAY) {
+    if (Array.isArray(node[key])) for (const v of node[key]) _normalize2019(v, root, false)
+  }
+  for (const key of SUB_SINGLE) {
+    const sub = node[key]
+    if (sub && typeof sub === 'object' && !Array.isArray(sub)) _normalize2019(sub, root, false)
+  }
+  if (Array.isArray(node.items)) {
+    node.prefixItems = node.items
+    if (node.additionalItems !== undefined) { node.items = node.additionalItems; delete node.additionalItems } else delete node.items
+  } else {
+    delete node.additionalItems
+  }
+}
+
+// The draft a `$schema` value names, for the normalizers: 2 draft-06,
+// 1 draft-07, 3 2019-09, 0 anything else. Takes the string so the caller
+// reads the property once.
+function draftCode(uri) {
+  if (typeof uri !== 'string') return 0
+  if (DRAFT6_SCHEMAS.has(uri)) return 2
+  if (DRAFT7_SCHEMAS.has(uri)) return 1
+  if (DRAFT2019_SCHEMAS.has(uri)) return 3
+  return 0
+}
+
+module.exports = { draftCode, isDraft7, isDraft6, isDraft2019, normalizeDraft2019, normalizeDraft7, normalizeNullable, normalizeExclusiveBounds, stripFormatAssertions }

package/lib/enrich-error.js

@@ -77,7 +77,19 @@ function reprValue (v) {
   if (t === 'number' || t === 'boolean') return String(v);
   if (Array.isArray(v)) return `[array, ${v.length} items]`;
   if (t === 'object') {
-    if (jsonSizeWithin(v, 60) >= 0) {
+    // The keys first: every key costs at least five characters serialised
+    // (`"k":` and a one-character value), so past twelve keys the 60-character
+    // body is out of reach and the size walk is skipped. The count is what the
+    // fallback prints, so it is taken once either way; the walk and the
+    // serialisation used to run on every container an error named, and a
+    // `required` or `unevaluatedProperties` error names its container.
+    let n;
+    try {
+      n = Object.keys(v).length;
+    } catch {
+      return '[object, unserializable]';
+    }
+    if (n <= 12 && jsonSizeWithin(v, 60) >= 0) {
       try {
         const s = JSON.stringify(v);
         if (s !== undefined && s.length <= 60) return s;
@@ -85,12 +97,6 @@ function reprValue (v) {
         return '[object, unserializable]';
       }
     }
-    let n;
-    try {
-      n = Object.keys(v).length;
-    } catch {
-      return '[object, unserializable]';
-    }
     return `[object, ${n} ${n === 1 ? 'key' : 'keys'}]`;
   }
   return `[${t}]`;
@@ -131,11 +137,12 @@ function resolveAt (err, data) {
  */
 // Observation-first wording. `message` stays as it is for parity, so this is a
 // separate field a consumer opts into.
-function detailFor (err, out) {
+function detailFor (err, out, at) {
   const p = err.params || {};
   switch (err.keyword) {
     case 'type':
-      return `expected ${p.type}, found ${typeNameOf(out.received)}`;
+      // From the value when the caller resolved it; from the repr otherwise.
+      return `expected ${p.type}, found ${(at === undefined || at === MISSING ? null : typeNameOfValue(at)) || typeNameOf(out.received)}`;
     case 'required':
       return `missing required property "${p.missingProperty}"`;
     case 'additionalProperties':
@@ -157,6 +164,24 @@ function detailFor (err, out) {
   }
 }
 
+// The same names from the value itself, for the callers that hold it: the
+// repr is a string built to be read, and parsing it back cost a regex per
+// type error. Agrees with typeNameOf on every value reprValue can produce:
+// a number that is not finite prints as NaN or Infinity, which the repr
+// parser calls a value, and so does this.
+// An object with its own toJSON prints as whatever that returns, so it is
+// left to the repr route (null here).
+function typeNameOfValue (v) {
+  if (v === null) return 'null';
+  switch (typeof v) {
+    case 'boolean': return 'boolean';
+    case 'string': return 'string';
+    case 'number': return Number.isFinite(v) ? 'number' : 'value';
+    case 'object': return Array.isArray(v) ? 'array' : typeof v.toJSON === 'function' ? null : 'object';
+    default: return 'value';
+  }
+}
+
 // Derived from the repr in `received`, which is already a JSON-ish string.
 function typeNameOf (received) {
   if (received === undefined) return 'nothing';
@@ -252,7 +277,13 @@ function enrich (rawErr, opts) {
   // renderer can surface the closest variant's diagnostics. They are enriched
   // like any other error: passed through raw, they carried whatever the engine
   // that answered wrote, the generator's internal ordering key included.
-  if (rawErr.branchErrors) out.branchErrors = rawErr.branchErrors.map((b) => enrich(b, data !== undefined ? { data } : null));
+  // A branch error the rich combined function already built is kept:
+  // enriching it again recomputed every field to the same values, and a
+  // collapsed oneOf paid that for each branch error on top of its own
+  // enrichment. Such an error carries `rank`, which only this enrichment and
+  // makeRich write; a standalone module's error carries a docUrl but no
+  // rank and is enriched as before (fromCompiled wraps those).
+  if (rawErr.branchErrors) out.branchErrors = rawErr.branchErrors.map((b) => (b !== null && typeof b === 'object' && b.rank !== undefined && b.docUrl !== undefined && b._o === undefined) ? b : enrich(b, data !== undefined ? { data } : null));
 
   // The frames come from the position map, which is a walk of the document.
   // Given lazily (validateJSON's rejections), the walk waits for the first
@@ -286,7 +317,7 @@ function enrich (rawErr, opts) {
   const sugg = suggestFor(out, data, at === MISSING ? undefined : at);
   if (sugg) out.suggestion = sugg;
 
-  const detail = detailFor(rawErr, out);
+  const detail = detailFor(rawErr, out, at);
   if (detail !== undefined) out.detail = detail;
   out.rank = st.rank;
 

package/lib/enrich-site.js

@@ -49,7 +49,7 @@ function makeRich (site, path, params, message, value, root, spPrefix) {
   };
   const sugg = suggestFor(out, root, at === MISSING ? undefined : at);
   if (sugg) out.suggestion = sugg;
-  const detail = detailFor({ keyword: site.keyword, params }, out);
+  const detail = detailFor({ keyword: site.keyword, params }, out, at);
   if (detail !== undefined) out.detail = detail;
   out.rank = site.rank;
   return out;

package/lib/js-compiler-errors.js

@@ -9,7 +9,7 @@ const { compileFunction } = require('./compile-fn')
 // the first call that compiles errors. Everything here was written as part
 // of js-compiler.js and reads its helpers from that module's _internal.
 const core = require('./js-compiler')
-const { hasConstraints, assertEmitted, prepareForCodegen, sharedCodegenGate, codegenSafe, isSimplePN, hasUnresolvableRef, needsBaseTracking, _cpLen, sharedRt, DECLINE, bindRt, compileSafe, emitGuardState, withPlain, REF_NEUTRAL_SIBLINGS, resolveCrossSchemaRef, enumCondition, emitDeq, emitConstant, ownGuard, ownKeyExpr, multipleOfBad, compilePatternInline, useSafeEngine, reFlags, FORMAT_CODEGEN, PROTO_NAMES, setOwn, nestedGenCode, compileToJSCodegen, SKIP_VALUE_KEYS, skipString, CYCLE_DEPTH, cyclicDefNames, sharedDefNames, reFlagArg, hoistOnce, PTR_ESC_HELPER, unevalContributions, emitUq, uqSources, safeReClosure, fastPrefixCheck, replaceTopLevel, refTargetFor, genCode, addLocalAnnotations, addTopApplicatorAnnotations, protoIs, ANNOT_APPLICATORS, SIZE_SKIPS, emitRootGuard, emitGuardedRun } = core._internal
+const { hasConstraints, assertEmitted, prepareForCodegen, sharedCodegenGate, codegenSafe, isSimplePN, hasUnresolvableRef, needsBaseTracking, _cpLen, sharedRt, DECLINE, bindRt, compileSafe, emitGuardState, withPlain, REF_NEUTRAL_SIBLINGS, resolveCrossSchemaRef, enumCondition, enumOperand, emitDeq, emitConstant, ownGuard, ownKeyExpr, multipleOfBad, compilePatternInline, useSafeEngine, reFlags, FORMAT_CODEGEN, PROTO_NAMES, setOwn, nestedGenCode, compileToJSCodegen, SKIP_VALUE_KEYS, skipString, CYCLE_DEPTH, cyclicDefNames, sharedDefNames, reFlagArg, hoistOnce, PTR_ESC_HELPER, unevalContributions, emitUq, uqSources, safeReClosure, fastPrefixCheck, replaceTopLevel, refTargetFor, genCode, addLocalAnnotations, addTopApplicatorAnnotations, protoIs, ANNOT_APPLICATORS, SIZE_SKIPS, emitRootGuard, emitGuardedRun } = core._internal
 
 
 function emitPtrEsc(ctx) {
@@ -289,7 +289,7 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
   if (hasUnresolvableRef(schema, eRootDefs, eAnchors, schemaMap, new Set())) return null
   if (needsBaseTracking(schema, schemaMap, new Set())) return null
 
-  const ctx = { varCounter: 0, helperCode: [], rootDefs: eRootDefs, shared: [], refStack: new Set(), schemaMap: schemaMap || null, anchors: eAnchors, rootE: schema, rootSchema: inputSchema, userFormats: userFormats || null,
+  const ctx = { noOrdinal: !!(sourceOpts && sourceOpts.noOrdinal), varCounter: 0, helperCode: [], rootDefs: eRootDefs, shared: [], refStack: new Set(), schemaMap: schemaMap || null, anchors: eAnchors, rootE: schema, rootSchema: inputSchema, userFormats: userFormats || null,
                 // Custom format checkers referenced by the body, bound as
                 // closure parameters below the way the other entry points do.
                 closureVars: [], closureVals: [],
@@ -1143,7 +1143,8 @@ function genCodeENode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
 
   // enum
   if (schema.enum) {
-    lines.push(`if(!(${enumCondition(ctx, schema.enum, v)})){${fail('enum', 'enum', `{allowedValues:${JSON.stringify(schema.enum)}}`, "'must be equal to one of the allowed values'")}}`)
+    const ev = enumOperand(ctx, schema.enum, v, lines)
+    lines.push(`if(!(${enumCondition(ctx, schema.enum, ev)})){${fail('enum', 'enum', `{allowedValues:${JSON.stringify(schema.enum)}}`, "'must be equal to one of the allowed values'")}}`)
   }
 
   // const — use canonical (sorted-key) comparison for objects
@@ -2330,7 +2331,8 @@ function genCodeCNode(schema, v, pathExpr, lines, ctx, schemaPrefix) {
   const emitEnumConst = () => {
     // enum
     if (schema.enum) {
-      lines.push(`if(!(${enumCondition(ctx, schema.enum, v)})){${fail('enum', 'enum', `{allowedValues:${JSON.stringify(schema.enum)}}`, "'must be equal to one of the allowed values'")}}`)
+      const ev = enumOperand(ctx, schema.enum, v, lines)
+      lines.push(`if(!(${enumCondition(ctx, schema.enum, ev)})){${fail('enum', 'enum', `{allowedValues:${JSON.stringify(schema.enum)}}`, "'must be equal to one of the allowed values'")}}`)
     }
 
     // const

package/lib/js-compiler.js

@@ -135,6 +135,21 @@ function emitConstant(ctx, value) {
   return name
 }
 
+// The operand an `enum` test compares: `v` itself when it is a plain
+// identifier, otherwise a local bound once. The test is a chain of `===`,
+// one per member, and each used to repeat the access expression, so a
+// 32-member enum on a required property read `_e3["tool"]` 32 times; on an
+// array of items in several shapes those reads are polymorphic and cost
+// 59 ns against 20 with the value in a local. The binding goes to `lines`
+// ahead of the test.
+const IDENT_RE = /^[A-Za-z_$][\w$]*$/
+function enumOperand(ctx, vals, v, lines) {
+  if (IDENT_RE.test(v) || vals.length < 2) return v
+  const name = `_ev${ctx.varCounter++}`
+  lines.push(`const ${name}=${v}`)
+  return name
+}
+
 // One `enum` test: primitives compare with `===`, which needs no call, and
 // object members go through structural equality.
 function enumCondition(ctx, vals, v) {
@@ -1316,6 +1331,14 @@ function sharedDefNames (root, defs) {
   }
   return out
 }
+// Raising this to inline small definitions at every site was measured and
+// rejected: SchemaStore's detekt applies one 200-character rule definition
+// at 293 sites, and inlining it took the verdict from 5287 ns to 452 but the
+// standalone module from 168 KB to 1692 KB and its compile to 33 ms. The
+// slowness of the shared function is megamorphic property reads (474 objects
+// of 72 shapes through one function); a for-in body for the shared function
+// was tried too and gave 1.5x, not enough to carry its complexity. Left as a
+// known trade: on that shape the shared function costs 27 ns a call.
 const SHARED_DEF_MIN_CHARS = 120
 
 function cyclicDefNames (defs) {
@@ -1986,8 +2009,32 @@ function sharedCodegenGate(schema, schemaMap) {
   _gateSchema = schema; _gateMap = schemaMap; _gateOk = ok
   return ok
 }
+// `unevaluatedProperties` or `unevaluatedItems` beside a `$ref` back to the
+// document root: the generated evaluated-set tracking does not credit what
+// the root evaluates through that reference, so a tree whose branches say
+// `{ unevaluatedProperties: false, $ref: '#' }` rejected valid branches (a
+// wrong reject, found through the 2019-09 `$recursiveRef` tests, and the same
+// in 2020-12). The interpreted engine answers it. A text check first: almost
+// no schema has both.
+function unevaluatedBesideRootRef(schema) {
+  const text = JSON.stringify(schema)
+  if (!text.includes('"$ref":"#"') || !/"unevaluated(?:Properties|Items)"/.test(text)) return false
+  let found = false
+  const seen = new Set()
+  const walk = (n) => {
+    if (found || n === null || typeof n !== 'object' || seen.has(n)) return
+    seen.add(n)
+    if (Array.isArray(n)) { for (const x of n) walk(x); return }
+    if (n.$ref === '#' && (n.unevaluatedProperties !== undefined || n.unevaluatedItems !== undefined)) { found = true; return }
+    for (const [k, v] of Object.entries(n)) if (k !== 'enum' && k !== 'const' && k !== 'default' && k !== 'examples') walk(v)
+  }
+  walk(schema)
+  return found
+}
+
 function sharedCodegenGateUncached(schema, schemaMap) {
   if (bothDefsContainers(schema)) return false
+  if (unevaluatedBesideRootRef(schema)) return false
   if (hasSameInstanceRefCycle(schema)) return false
   if (!codegenSafe(schema, schemaMap)) return false
   if (needsBaseTracking(schema, schemaMap, new Set())) return false
@@ -3297,7 +3344,8 @@ function genCodeNode(schema, v, lines, ctx, knownType) {
 
   // enum
   if (schema.enum) {
-    lines.push(`if(!(${enumCondition(ctx, schema.enum, v)}))return false`)
+    const ev = enumOperand(ctx, schema.enum, v, lines)
+    lines.push(`if(!(${enumCondition(ctx, schema.enum, ev)}))return false`)
   }
 
   // const
@@ -5371,4 +5419,4 @@ Object.defineProperty(module.exports, '_expandDynamicScopes', { value: expandDyn
 // For tests/test_custom_keyword_codegen.js, which holds these copies to the interpreter's.
 Object.defineProperty(module.exports, '_kwTypeBits', { value: { kwTypeBit, kwDataBits, KW_T_ANY }, enumerable: false })
 
-module.exports._internal = { hasConstraints, assertEmitted, prepareForCodegen, sharedCodegenGate, codegenSafe, isSimplePN, hasUnresolvableRef, needsBaseTracking, _cpLen, sharedRt, DECLINE, bindRt, compileSafe, emitGuardState, withPlain, REF_NEUTRAL_SIBLINGS, resolveCrossSchemaRef, enumCondition, emitDeq, emitConstant, ownGuard, ownKeyExpr, multipleOfBad, compilePatternInline, useSafeEngine, reFlags, FORMAT_CODEGEN, PROTO_NAMES, setOwn, nestedGenCode, compileToJSCodegen, SKIP_VALUE_KEYS, skipString, CYCLE_DEPTH, cyclicDefNames, sharedDefNames, reFlagArg, hoistOnce, PTR_ESC_HELPER, unevalContributions, emitUq, uqSources, safeReClosure, fastPrefixCheck, replaceTopLevel, refTargetFor, genCode, addLocalAnnotations, addTopApplicatorAnnotations, protoIs, ANNOT_APPLICATORS, SIZE_SKIPS, emitRootGuard, emitGuardedRun }
+module.exports._internal = { hasConstraints, assertEmitted, prepareForCodegen, sharedCodegenGate, codegenSafe, isSimplePN, hasUnresolvableRef, needsBaseTracking, _cpLen, sharedRt, DECLINE, bindRt, compileSafe, emitGuardState, withPlain, REF_NEUTRAL_SIBLINGS, resolveCrossSchemaRef, enumCondition, enumOperand, emitDeq, emitConstant, ownGuard, ownKeyExpr, multipleOfBad, compilePatternInline, useSafeEngine, reFlags, FORMAT_CODEGEN, PROTO_NAMES, setOwn, nestedGenCode, compileToJSCodegen, SKIP_VALUE_KEYS, skipString, CYCLE_DEPTH, cyclicDefNames, sharedDefNames, reFlagArg, hoistOnce, PTR_ESC_HELPER, unevalContributions, emitUq, uqSources, safeReClosure, fastPrefixCheck, replaceTopLevel, refTargetFor, genCode, addLocalAnnotations, addTopApplicatorAnnotations, protoIs, ANNOT_APPLICATORS, SIZE_SKIPS, emitRootGuard, emitGuardedRun }

package/lib/metaschemas.js

@@ -2,8 +2,14 @@
 
 // The official meta-schemas, vendored so a `$ref` to one of them resolves
 // without a network. Draft 2020-12 is eight documents joined by $dynamicRef;
-// draft-07 is one. Sources: https://json-schema.org/draft/2020-12/schema and
-// http://json-schema.org/draft-07/schema, fetched 2026-08-23, unmodified.
+// draft-07 and draft-06 are one each; 2019-09 is seven. Sources:
+// https://json-schema.org/draft/2020-12/schema and
+// http://json-schema.org/draft-07/schema, fetched 2026-08-23, and
+// http://json-schema.org/draft-06/schema and
+// https://json-schema.org/draft/2019-09/schema, fetched 2026-10-10, unmodified.
+// The 2019-09 documents are read through the same 2019-09 rewrite as a
+// caller's schema (lib/draft7.js) once, at load, since they use
+// `$recursiveRef`, which the engines read as `$dynamicRef`.
 // Keyed by $id; index.js also registers the http/https and trailing-# spellings.
 
 const METASCHEMAS = new Map([
@@ -16,6 +22,19 @@ const METASCHEMAS = new Map([
   ["https://json-schema.org/draft/2020-12/meta/content", {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/content","$dynamicAnchor":"meta","title":"Content vocabulary meta-schema","type":["object","boolean"],"properties":{"contentEncoding":{"type":"string"},"contentMediaType":{"type":"string"},"contentSchema":{"$dynamicRef":"#meta"}}}],
   ["https://json-schema.org/draft/2020-12/meta/unevaluated", {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/unevaluated","$dynamicAnchor":"meta","title":"Unevaluated applicator vocabulary meta-schema","type":["object","boolean"],"properties":{"unevaluatedItems":{"$dynamicRef":"#meta"},"unevaluatedProperties":{"$dynamicRef":"#meta"}}}],
   ["http://json-schema.org/draft-07/schema#", {"$schema":"http://json-schema.org/draft-07/schema#","$id":"http://json-schema.org/draft-07/schema#","title":"Core schema meta-schema","definitions":{"schemaArray":{"type":"array","minItems":1,"items":{"$ref":"#"}},"nonNegativeInteger":{"type":"integer","minimum":0},"nonNegativeIntegerDefault0":{"allOf":[{"$ref":"#/definitions/nonNegativeInteger"},{"default":0}]},"simpleTypes":{"enum":["array","boolean","integer","null","number","object","string"]},"stringArray":{"type":"array","items":{"type":"string"},"uniqueItems":true,"default":[]}},"type":["object","boolean"],"properties":{"$id":{"type":"string","format":"uri-reference"},"$schema":{"type":"string","format":"uri"},"$ref":{"type":"string","format":"uri-reference"},"$comment":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"default":true,"readOnly":{"type":"boolean","default":false},"writeOnly":{"type":"boolean","default":false},"examples":{"type":"array","items":true},"multipleOf":{"type":"number","exclusiveMinimum":0},"maximum":{"type":"number"},"exclusiveMaximum":{"type":"number"},"minimum":{"type":"number"},"exclusiveMinimum":{"type":"number"},"maxLength":{"$ref":"#/definitions/nonNegativeInteger"},"minLength":{"$ref":"#/definitions/nonNegativeIntegerDefault0"},"pattern":{"type":"string","format":"regex"},"additionalItems":{"$ref":"#"},"items":{"anyOf":[{"$ref":"#"},{"$ref":"#/definitions/schemaArray"}],"default":true},"maxItems":{"$ref":"#/definitions/nonNegativeInteger"},"minItems":{"$ref":"#/definitions/nonNegativeIntegerDefault0"},"uniqueItems":{"type":"boolean","default":false},"contains":{"$ref":"#"},"maxProperties":{"$ref":"#/definitions/nonNegativeInteger"},"minProperties":{"$ref":"#/definitions/nonNegativeIntegerDefault0"},"required":{"$ref":"#/definitions/stringArray"},"additionalProperties":{"$ref":"#"},"definitions":{"type":"object","additionalProperties":{"$ref":"#"},"default":{}},"properties":{"type":"object","additionalProperties":{"$ref":"#"},"default":{}},"patternProperties":{"type":"object","additionalProperties":{"$ref":"#"},"propertyNames":{"format":"regex"},"default":{}},"dependencies":{"type":"object","additionalProperties":{"anyOf":[{"$ref":"#"},{"$ref":"#/definitions/stringArray"}]}},"propertyNames":{"$ref":"#"},"const":true,"enum":{"type":"array","items":true,"minItems":1,"uniqueItems":true},"type":{"anyOf":[{"$ref":"#/definitions/simpleTypes"},{"type":"array","items":{"$ref":"#/definitions/simpleTypes"},"minItems":1,"uniqueItems":true}]},"format":{"type":"string"},"contentMediaType":{"type":"string"},"contentEncoding":{"type":"string"},"if":{"$ref":"#"},"then":{"$ref":"#"},"else":{"$ref":"#"},"allOf":{"$ref":"#/definitions/schemaArray"},"anyOf":{"$ref":"#/definitions/schemaArray"},"oneOf":{"$ref":"#/definitions/schemaArray"},"not":{"$ref":"#"}},"default":true}],
+  ["http://json-schema.org/draft-06/schema#", {"$schema":"http://json-schema.org/draft-06/schema#","$id":"http://json-schema.org/draft-06/schema#","title":"Core schema meta-schema","definitions":{"schemaArray":{"type":"array","minItems":1,"items":{"$ref":"#"}},"nonNegativeInteger":{"type":"integer","minimum":0},"nonNegativeIntegerDefault0":{"allOf":[{"$ref":"#/definitions/nonNegativeInteger"},{"default":0}]},"simpleTypes":{"enum":["array","boolean","integer","null","number","object","string"]},"stringArray":{"type":"array","items":{"type":"string"},"uniqueItems":true,"default":[]}},"type":["object","boolean"],"properties":{"$id":{"type":"string","format":"uri-reference"},"$schema":{"type":"string","format":"uri"},"$ref":{"type":"string","format":"uri-reference"},"title":{"type":"string"},"description":{"type":"string"},"default":{},"examples":{"type":"array","items":{}},"multipleOf":{"type":"number","exclusiveMinimum":0},"maximum":{"type":"number"},"exclusiveMaximum":{"type":"number"},"minimum":{"type":"number"},"exclusiveMinimum":{"type":"number"},"maxLength":{"$ref":"#/definitions/nonNegativeInteger"},"minLength":{"$ref":"#/definitions/nonNegativeIntegerDefault0"},"pattern":{"type":"string","format":"regex"},"additionalItems":{"$ref":"#"},"items":{"anyOf":[{"$ref":"#"},{"$ref":"#/definitions/schemaArray"}],"default":{}},"maxItems":{"$ref":"#/definitions/nonNegativeInteger"},"minItems":{"$ref":"#/definitions/nonNegativeIntegerDefault0"},"uniqueItems":{"type":"boolean","default":false},"contains":{"$ref":"#"},"maxProperties":{"$ref":"#/definitions/nonNegativeInteger"},"minProperties":{"$ref":"#/definitions/nonNegativeIntegerDefault0"},"required":{"$ref":"#/definitions/stringArray"},"additionalProperties":{"$ref":"#"},"definitions":{"type":"object","additionalProperties":{"$ref":"#"},"default":{}},"properties":{"type":"object","additionalProperties":{"$ref":"#"},"default":{}},"patternProperties":{"type":"object","additionalProperties":{"$ref":"#"},"propertyNames":{"format":"regex"},"default":{}},"dependencies":{"type":"object","additionalProperties":{"anyOf":[{"$ref":"#"},{"$ref":"#/definitions/stringArray"}]}},"propertyNames":{"$ref":"#"},"const":{},"enum":{"type":"array","minItems":1,"uniqueItems":true},"type":{"anyOf":[{"$ref":"#/definitions/simpleTypes"},{"type":"array","items":{"$ref":"#/definitions/simpleTypes"},"minItems":1,"uniqueItems":true}]},"format":{"type":"string"},"allOf":{"$ref":"#/definitions/schemaArray"},"anyOf":{"$ref":"#/definitions/schemaArray"},"oneOf":{"$ref":"#/definitions/schemaArray"},"not":{"$ref":"#"}},"default":{}}],
+  ["https://json-schema.org/draft/2019-09/schema", {"$schema":"https://json-schema.org/draft/2019-09/schema","$id":"https://json-schema.org/draft/2019-09/schema","$vocabulary":{"https://json-schema.org/draft/2019-09/vocab/core":true,"https://json-schema.org/draft/2019-09/vocab/applicator":true,"https://json-schema.org/draft/2019-09/vocab/validation":true,"https://json-schema.org/draft/2019-09/vocab/meta-data":true,"https://json-schema.org/draft/2019-09/vocab/format":false,"https://json-schema.org/draft/2019-09/vocab/content":true},"$recursiveAnchor":true,"title":"Core and Validation specifications meta-schema","allOf":[{"$ref":"meta/core"},{"$ref":"meta/applicator"},{"$ref":"meta/validation"},{"$ref":"meta/meta-data"},{"$ref":"meta/format"},{"$ref":"meta/content"}],"type":["object","boolean"],"properties":{"definitions":{"$comment":"While no longer an official keyword as it is replaced by $defs, this keyword is retained in the meta-schema to prevent incompatible extensions as it remains in common use.","type":"object","additionalProperties":{"$recursiveRef":"#"},"default":{}},"dependencies":{"$comment":"\"dependencies\" is no longer a keyword, but schema authors should avoid redefining it to facilitate a smooth transition to \"dependentSchemas\" and \"dependentRequired\"","type":"object","additionalProperties":{"anyOf":[{"$recursiveRef":"#"},{"$ref":"meta/validation#/$defs/stringArray"}]}}}}],
+  ["https://json-schema.org/draft/2019-09/meta/core", {"$schema":"https://json-schema.org/draft/2019-09/schema","$id":"https://json-schema.org/draft/2019-09/meta/core","$recursiveAnchor":true,"title":"Core vocabulary meta-schema","type":["object","boolean"],"properties":{"$id":{"type":"string","format":"uri-reference","$comment":"Non-empty fragments not allowed.","pattern":"^[^#]*#?$"},"$schema":{"type":"string","format":"uri"},"$anchor":{"type":"string","pattern":"^[A-Za-z][-A-Za-z0-9.:_]*$"},"$ref":{"type":"string","format":"uri-reference"},"$recursiveRef":{"type":"string","format":"uri-reference"},"$recursiveAnchor":{"type":"boolean","default":false},"$vocabulary":{"type":"object","propertyNames":{"type":"string","format":"uri"},"additionalProperties":{"type":"boolean"}},"$comment":{"type":"string"},"$defs":{"type":"object","additionalProperties":{"$recursiveRef":"#"},"default":{}}}}],
+  ["https://json-schema.org/draft/2019-09/meta/applicator", {"$schema":"https://json-schema.org/draft/2019-09/schema","$id":"https://json-schema.org/draft/2019-09/meta/applicator","$recursiveAnchor":true,"title":"Applicator vocabulary meta-schema","type":["object","boolean"],"properties":{"additionalItems":{"$recursiveRef":"#"},"unevaluatedItems":{"$recursiveRef":"#"},"items":{"anyOf":[{"$recursiveRef":"#"},{"$ref":"#/$defs/schemaArray"}]},"contains":{"$recursiveRef":"#"},"additionalProperties":{"$recursiveRef":"#"},"unevaluatedProperties":{"$recursiveRef":"#"},"properties":{"type":"object","additionalProperties":{"$recursiveRef":"#"},"default":{}},"patternProperties":{"type":"object","additionalProperties":{"$recursiveRef":"#"},"propertyNames":{"format":"regex"},"default":{}},"dependentSchemas":{"type":"object","additionalProperties":{"$recursiveRef":"#"}},"propertyNames":{"$recursiveRef":"#"},"if":{"$recursiveRef":"#"},"then":{"$recursiveRef":"#"},"else":{"$recursiveRef":"#"},"allOf":{"$ref":"#/$defs/schemaArray"},"anyOf":{"$ref":"#/$defs/schemaArray"},"oneOf":{"$ref":"#/$defs/schemaArray"},"not":{"$recursiveRef":"#"}},"$defs":{"schemaArray":{"type":"array","minItems":1,"items":{"$recursiveRef":"#"}}}}],
+  ["https://json-schema.org/draft/2019-09/meta/validation", {"$schema":"https://json-schema.org/draft/2019-09/schema","$id":"https://json-schema.org/draft/2019-09/meta/validation","$recursiveAnchor":true,"title":"Validation vocabulary meta-schema","type":["object","boolean"],"properties":{"multipleOf":{"type":"number","exclusiveMinimum":0},"maximum":{"type":"number"},"exclusiveMaximum":{"type":"number"},"minimum":{"type":"number"},"exclusiveMinimum":{"type":"number"},"maxLength":{"$ref":"#/$defs/nonNegativeInteger"},"minLength":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"pattern":{"type":"string","format":"regex"},"maxItems":{"$ref":"#/$defs/nonNegativeInteger"},"minItems":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"uniqueItems":{"type":"boolean","default":false},"maxContains":{"$ref":"#/$defs/nonNegativeInteger"},"minContains":{"$ref":"#/$defs/nonNegativeInteger","default":1},"maxProperties":{"$ref":"#/$defs/nonNegativeInteger"},"minProperties":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"required":{"$ref":"#/$defs/stringArray"},"dependentRequired":{"type":"object","additionalProperties":{"$ref":"#/$defs/stringArray"}},"const":true,"enum":{"type":"array","items":true},"type":{"anyOf":[{"$ref":"#/$defs/simpleTypes"},{"type":"array","items":{"$ref":"#/$defs/simpleTypes"},"minItems":1,"uniqueItems":true}]}},"$defs":{"nonNegativeInteger":{"type":"integer","minimum":0},"nonNegativeIntegerDefault0":{"$ref":"#/$defs/nonNegativeInteger","default":0},"simpleTypes":{"enum":["array","boolean","integer","null","number","object","string"]},"stringArray":{"type":"array","items":{"type":"string"},"uniqueItems":true,"default":[]}}}],
+  ["https://json-schema.org/draft/2019-09/meta/meta-data", {"$schema":"https://json-schema.org/draft/2019-09/schema","$id":"https://json-schema.org/draft/2019-09/meta/meta-data","$recursiveAnchor":true,"title":"Meta-data vocabulary meta-schema","type":["object","boolean"],"properties":{"title":{"type":"string"},"description":{"type":"string"},"default":true,"deprecated":{"type":"boolean","default":false},"readOnly":{"type":"boolean","default":false},"writeOnly":{"type":"boolean","default":false},"examples":{"type":"array","items":true}}}],
+  ["https://json-schema.org/draft/2019-09/meta/format", {"$schema":"https://json-schema.org/draft/2019-09/schema","$id":"https://json-schema.org/draft/2019-09/meta/format","$recursiveAnchor":true,"title":"Format vocabulary meta-schema","type":["object","boolean"],"properties":{"format":{"type":"string"}}}],
+  ["https://json-schema.org/draft/2019-09/meta/content", {"$schema":"https://json-schema.org/draft/2019-09/schema","$id":"https://json-schema.org/draft/2019-09/meta/content","$recursiveAnchor":true,"title":"Content vocabulary meta-schema","type":["object","boolean"],"properties":{"contentMediaType":{"type":"string"},"contentEncoding":{"type":"string"},"contentSchema":{"$recursiveRef":"#"}}}],
 ]);
 
+{
+  const { isDraft2019, normalizeDraft2019 } = require('./draft7')
+  for (const [id, doc] of METASCHEMAS) if (isDraft2019(doc)) METASCHEMAS.set(id, normalizeDraft2019(JSON.parse(JSON.stringify(doc)), true))
+}
+
 module.exports = { METASCHEMAS };

package/lib/regex-linear.js

@@ -3,34 +3,56 @@
 const { parse } = require('./safe-regex')
 
 // True when the platform RegExp, a backtracking engine, also runs `src` in
-// linear time, so it can take the pattern: every unbounded quantifier on one
-// character, class or `.`; at most one of them, and then anchored with `^`;
-// a finite repeat may cover a group that holds no unbounded quantifier; few
-// bounded choices in all; only escapes both engines read alike; nothing
-// outside the BMP, so both see the same UTF-16 units.
-// tests/test_regex_native_linear.js holds it.
+// linear time, so it can take the pattern instead of the linear-time engine
+// in safe-regex.js, which costs three to five times as much per character.
+// Two rules, and a pattern passes on either:
+//
+// The simple rule, the original one: every unbounded quantifier is on one
+// character, class or `.`; at most one of them, and then the pattern is
+// anchored with `^` on every branch; a finite repeat may cover a group that
+// holds no unbounded quantifier; few bounded choices in all. One loop whose
+// body cannot be split two ways, exited at most once per position, with
+// bounded work after it.
+//
+// The deterministic rule, for the patterns the simple one declines: dotted
+// identifiers, `[^/]+/[^/]+`, version numbers. On the Glushkov construction
+// the characters, classes and dots are positions. Around every unbounded
+// loop the next character must decide the single way to continue: the
+// positions that can follow a position inside a loop accept pairwise
+// disjoint characters, and so do the positions a match can start at when a
+// loop is among them; a position reaches a follower by one route only, since
+// `(a+)+` reaches `a` from `a` through the inner loop and again through the
+// outer one and that double route is what a backtracking engine explores
+// exponentially; a loop body must not match the empty string, since `(a*)*`
+// iterates emptily without bound. Ambiguity away from any loop, `(pwa|PWA)`,
+// costs a bounded factor and is allowed, as the simple rule allows it. A
+// bounded repeat is a loop only when its body holds an unbounded one, since
+// `(\w+\s?){5}` splits five ways where `(?:[A-F0-9]{2}:){31}` counts. With
+// an unbounded quantifier the pattern must be anchored with `^` on every
+// branch, since an unanchored search retries from each position.
+//
+// Both rules allow only escapes both engines read alike and nothing outside
+// the BMP, so both see the same UTF-16 units. tests/test_regex_native_linear.js
+// holds them: every accepted pattern answers as the linear engine does and
+// stays fast on inputs built to make a backtracking engine retry.
 const NATIVE_ESCAPES = new Set(['d', 'D', 'w', 'W', 's', 'S', 'n', 'r', 't', 'f', 'v', '.', '\\', '/', '^', '$', '|', '?', '*', '+', '(', ')', '[', ']', '{', '}', '-', 'x', 'u'])
-function nativeIsLinear (src) {
-  if (typeof src !== 'string' || src.length > 512) return false
-  for (let i = 0; i < src.length; i++) {
-    const c = src.charCodeAt(i)
-    if (c >= 0xd800 && c <= 0xdfff) return false
-    if (src[i] === '\\') {
-      const e = src[i + 1]
-      if (!NATIVE_ESCAPES.has(e)) return false
-      if (e === 'x' && !/^[0-9a-fA-F]{2}$/.test(src.slice(i + 2, i + 4))) return false
-      if (e === 'u' && !/^[0-9a-fA-F]{4}$/.test(src.slice(i + 2, i + 6))) return false
-      i++
-    }
-  }
-  let ast
-  try { ast = parse(src) } catch { return false }
+const MAX_BOUNDED_CHOICES = 64
+
+const atom = (n) => n.t === 'char' || n.t === 'class' || n.t === 'any'
+
+// Anchored at the start on every top-level branch.
+function anchored (ast) {
+  let top = ast
+  while (top.t === 'group') top = top.child
+  const branches = top.t === 'alt' ? top.opts : [top]
+  const first = (n) => { while (n && n.t === 'group') n = n.child; return n && n.t === 'concat' ? first(n.parts[0]) : n }
+  return branches.every((b) => { const f = first(b); return f && f.t === 'bol' })
+}
+
+function simpleRule (ast) {
   // Per subtree: how many unbounded quantifiers it holds (`u`) and how many
   // bounded choices a backtracking engine could try (`b`), or null where the
-  // shape is not provably linear. A finite repeat of a group is linear when
-  // the group holds no unbounded quantifier: `(?:[A-F0-9]{2}:){31}` has
-  // nothing to retry, and its choices multiply through the nesting.
-  const atom = (n) => n.t === 'char' || n.t === 'class' || n.t === 'any'
+  // shape is not provably linear.
   const info = (n) => {
     switch (n.t) {
       case 'star': case 'plus':
@@ -56,19 +78,154 @@ function nativeIsLinear (src) {
     }
   }
   const r = info(ast)
-  const ok = r !== null
-  const unbounded = ok ? r.u : 0
-  const bounded = ok ? r.b : 0
-  if (!ok || unbounded > 1 || bounded > 64) return false
-  if (unbounded === 1) {
-    // Anchored at the start on every top-level branch.
-    let top = ast
-    while (top.t === 'group') top = top.child
-    const branches = top.t === 'alt' ? top.opts : [top]
-    const first = (n) => { while (n && n.t === 'group') n = n.child; return n && n.t === 'concat' ? first(n.parts[0]) : n }
-    if (!branches.every((b) => { const f = first(b); return f && f.t === 'bol' })) return false
+  if (r === null || r.u > 1 || r.b > MAX_BOUNDED_CHOICES) return false
+  return r.u === 0 || anchored(ast)
+}
+
+// The characters a position accepts: 128 ASCII bits and one bit for "some
+// code point at 128 or above", which keeps two classes with non-ASCII
+// members apart only when one of them has none. Conservative in the right
+// direction: an overlap that is not there only sends a pattern to the
+// linear engine.
+function charSet (node) {
+  const bits = new Uint8Array(128)
+  let high = 0
+  if (node.t === 'any') {
+    bits.fill(1); bits[10] = 0; bits[13] = 0; high = 1
+  } else if (node.t === 'char') {
+    if (node.c < 128) bits[node.c] = 1; else high = 1
+  } else {
+    for (const [lo, hi] of node.ranges) {
+      for (let c = Math.max(0, lo), top = Math.min(127, hi); c <= top; c++) bits[c] = 1
+      if (hi >= 128) high = 1
+    }
+    if (node.neg) { for (let c = 0; c < 128; c++) bits[c] ^= 1; high = 1 }
   }
-  return true
+  return { bits, high }
+}
+
+function overlap (a, b) {
+  if (a.high && b.high) return true
+  for (let c = 0; c < 128; c++) if (a.bits[c] & b.bits[c]) return true
+  return false
+}
+
+// Whether a subtree holds an unbounded quantifier.
+function hasUnbounded (n) {
+  switch (n.t) {
+    case 'star': case 'plus': return true
+    case 'repeat': return n.max === Infinity || hasUnbounded(n.child)
+    case 'quest': case 'group': return hasUnbounded(n.child)
+    case 'concat': return n.parts.some(hasUnbounded)
+    case 'alt': return n.opts.some(hasUnbounded)
+    default: return false
+  }
+}
+
+function deterministicRule (ast) {
+  const sets = []
+  const follow = []
+  const inLoop = []
+  let ok = true
+  let unbounded = 0
+  let bounded = 0
+  let depth = 0
+  // Pairwise disjoint, required when a loop position is among them.
+  const disjoint = (ids) => {
+    const arr = Array.from(ids)
+    if (!arr.some((p) => inLoop[p])) return
+    for (let i = 0; i < arr.length && ok; i++) {
+      for (let j = i + 1; j < arr.length; j++) if (overlap(sets[arr[i]], sets[arr[j]])) { ok = false; return }
+    }
+  }
+  const link = (from, to) => {
+    for (const p of to) {
+      if (follow[from].has(p)) { ok = false; return }
+      follow[from].add(p)
+    }
+  }
+  const empty = () => ({ nullable: true, first: new Set(), last: new Set() })
+  const walk = (n) => {
+    if (!ok) return empty()
+    switch (n.t) {
+      case 'char': case 'class': case 'any': {
+        const id = sets.length
+        sets.push(charSet(n))
+        follow.push(new Set())
+        inLoop.push(depth > 0)
+        return { nullable: false, first: new Set([id]), last: new Set([id]) }
+      }
+      case 'bol': case 'eol': return empty()
+      case 'group': return walk(n.child)
+      case 'star': case 'plus': case 'quest': case 'repeat': {
+        const infinite = n.t === 'star' || n.t === 'plus' || (n.t === 'repeat' && n.max === Infinity)
+        const loops = infinite || (n.t === 'repeat' && n.max > 1 && hasUnbounded(n.child))
+        const optional = n.t === 'star' || n.t === 'quest' || (n.t === 'repeat' && n.min === 0)
+        if (loops) depth++
+        const c = walk(n.child)
+        if (loops) depth--
+        if (infinite) {
+          unbounded++
+          if (c.nullable) ok = false
+        } else if (n.t === 'quest') {
+          bounded += 1
+        } else {
+          bounded += (n.max - n.min)
+          if (!atom(n.child)) bounded += n.max
+        }
+        if (loops) for (const l of c.last) link(l, c.first)
+        return { nullable: c.nullable || optional, first: c.first, last: c.last }
+      }
+      case 'concat': {
+        let acc = empty()
+        for (const part of n.parts) {
+          const r = walk(part)
+          for (const l of acc.last) link(l, r.first)
+          const first = new Set(acc.first)
+          if (acc.nullable) for (const f of r.first) first.add(f)
+          const last = new Set(r.last)
+          if (r.nullable) for (const l of acc.last) last.add(l)
+          acc = { nullable: acc.nullable && r.nullable, first, last }
+        }
+        return acc
+      }
+      case 'alt': {
+        const rs = n.opts.map(walk)
+        const first = new Set()
+        const last = new Set()
+        for (const r of rs) { for (const f of r.first) first.add(f); for (const l of r.last) last.add(l) }
+        return { nullable: rs.some((r) => r.nullable), first, last }
+      }
+      default:
+        ok = false
+        return empty()
+    }
+  }
+  const root = walk(ast)
+  if (!ok) return false
+  disjoint(root.first)
+  for (let p = 0; p < sets.length && ok; p++) disjoint(follow[p])
+  if (!ok) return false
+  if (bounded > MAX_BOUNDED_CHOICES) return false
+  return unbounded === 0 || anchored(ast)
+}
+
+function nativeIsLinear (src) {
+  if (typeof src !== 'string' || src.length > 512) return false
+  for (let i = 0; i < src.length; i++) {
+    const c = src.charCodeAt(i)
+    if (c >= 0xd800 && c <= 0xdfff) return false
+    if (src[i] === '\\') {
+      const e = src[i + 1]
+      if (!NATIVE_ESCAPES.has(e)) return false
+      if (e === 'x' && !/^[0-9a-fA-F]{2}$/.test(src.slice(i + 2, i + 4))) return false
+      if (e === 'u' && !/^[0-9a-fA-F]{4}$/.test(src.slice(i + 2, i + 6))) return false
+      i++
+    }
+  }
+  let ast
+  try { ast = parse(src) } catch { return false }
+  return simpleRule(ast) || deterministicRule(ast)
 }
 
 module.exports = { nativeIsLinear }

package/lib/safe-regex.js

@@ -410,7 +410,8 @@ function __ataSafeRegex () {
       id = states.length
       let isMatch = false
       for (let k = 0; k < pcs.length; k++) if (ops[pcs[k]] === OP_MATCH) { isMatch = true; break }
-      states.push({ pcs: Int32Array.from(pcs), isMatch, next: new Int32Array(128).fill(-2), nextEnd: new Int32Array(128).fill(-2) })
+      // `dead`: an anchored match with no thread left cannot recover.
+      states.push({ pcs: Int32Array.from(pcs), isMatch, dead: anchored && pcs.length === 0, next: new Int32Array(128).fill(-2), nextEnd: new Int32Array(128).fill(-2) })
       stateIds.set(key, id)
       return id
     }
@@ -452,23 +453,36 @@ function __ataSafeRegex () {
       }
       if (id < 0) return testNFA(s)
       let state = states[id]
-      for (let pos = 0; pos < len; pos++) {
+      if (len === 0) return state.isMatch
+      // The last character is stepped with the end-of-input flag set and is
+      // handled after the loop, so the loop body selects no table and tests
+      // no position.
+      const last = len - 1
+      for (let pos = 0; pos < last; pos++) {
         if (state.isMatch) return true
         const c = s.charCodeAt(pos)
-        const atEnd = pos + 1 === len
         let nid
         if (c < 128) {
-          const table = atEnd ? state.nextEnd : state.next
-          nid = table[c]
-          if (nid === -2) { nid = step(state, c, atEnd); table[c] = nid }
+          nid = state.next[c]
+          if (nid === -2) { nid = step(state, c, false); state.next[c] = nid }
         } else {
-          nid = step(state, c, atEnd)
+          nid = step(state, c, false)
         }
         if (nid < 0) return testNFA(s)
         state = states[nid]
-        if (anchored && state.pcs.length === 0) return false
+        if (state.dead) return false
       }
-      return state.isMatch
+      if (state.isMatch) return true
+      const c = s.charCodeAt(last)
+      let nid
+      if (c < 128) {
+        nid = state.nextEnd[c]
+        if (nid === -2) { nid = step(state, c, true); state.nextEnd[c] = nid }
+      } else {
+        nid = step(state, c, true)
+      }
+      if (nid < 0) return testNFA(s)
+      return states[nid].isMatch
     }
 
     return function test (s) {

package/lib/validator-core.js

@@ -25,7 +25,7 @@ function _registerCodegen(engine) {
   _codegen = engine;
   ({ compileToJS, compileToJSCodegen, compileToJSCodegenWithErrors, compileToJSCombined } = engine.jsCompiler);
 }
-const { normalizeDraft7, normalizeNullable, normalizeExclusiveBounds, stripFormatAssertions } = require("./draft7");
+const { draftCode, normalizeDraft2019, normalizeDraft7, normalizeNullable, normalizeExclusiveBounds, stripFormatAssertions } = require("./draft7");
 const { enabledKeywords, stripDisabledKeywords } = require("./vocabularies");
 const { needsNormalization } = require("./schema-scan");
 const { isV1Dialect } = require("./dialect");
@@ -426,21 +426,26 @@ function _deepCloneWithSymbols(v) {
 // Normalize a caller-provided schema without mutating the original.
 // Clones only when normalization would change the object (draft-07 keys
 // present or nullable fields present). Internal-only — not exported.
+// `inheritDraft7` is the root's draft for a document that declares none of
+// its own: 0 or absent for none, 1 for draft-07, 2 for draft-06, 3 for 2019-09.
 function _normalizeCallerSchema(s, inheritDraft7) {
-  const declares = s && typeof s === 'object' && s.$schema !== undefined
-  const needsDraft7 = declares
-    ? (s.$schema === 'http://json-schema.org/draft-07/schema#' || s.$schema === 'http://json-schema.org/draft-07/schema')
-    : !!inheritDraft7
+  const declared = s && typeof s === 'object' ? s.$schema : undefined
+  const code = declared !== undefined ? draftCode(declared) : (inheritDraft7 || 0)
+  const needsDraft7 = code === 1 || code === 2
+  const draft6 = code === 2
+  const draft2019 = code === 3
   // One walk answers whether there is anything to do. Almost always there is
   // not, and then the serialize, clone, normalize, serialize, compare below is
   // work spent to find that out. The walk over-reports rather than under, so a
   // schema it clears is one no normalizer would have touched;
   // `tests/test_schema_scan.js` holds that direction against the whole suite.
-  if (!needsNormalization(s, needsDraft7)) return s
+  // The scan does not look for `if`/`then`/`else`, which draft-06 drops.
+  if (!draft6 && !draft2019 && !needsNormalization(s, needsDraft7)) return s
 
   const str = JSON.stringify(s)
   const copy = _deepCloneWithSymbols(s)
-  if (needsDraft7) normalizeDraft7(copy, true)
+  if (needsDraft7) normalizeDraft7(copy, true, draft6)
+  if (draft2019) normalizeDraft2019(copy, true)
   normalizeNullable(copy)
   normalizeExclusiveBounds(copy)
   // Return original when normalization produced no change, copy otherwise.
@@ -467,7 +472,7 @@ function declaredId(original, normalized) {
   return undefined
 }
 
-// `inheritDraft7` is true when the root schema is draft-07: a retrieved
+// `inheritDraft7` is non-zero when the root schema is draft-07 or draft-06: a retrieved
 // document that declares no dialect is read under the root's draft.
 // The map is derived entirely from what the caller passed, so the same
 // `schemas` gives the same map. A server building one validator per route over
@@ -485,12 +490,12 @@ function buildSchemaMap(schemas, inheritDraft7) {
   if (!schemas) return null
   const byDraft = _schemaMapCache.get(schemas)
   if (byDraft) {
-    const hit = byDraft[inheritDraft7 ? 1 : 0]
+    const hit = byDraft[inheritDraft7 || 0]
     if (hit) return hit
   }
   const map = _buildSchemaMap(schemas, inheritDraft7)
-  const slot = byDraft || [null, null]
-  slot[inheritDraft7 ? 1 : 0] = map
+  const slot = byDraft || [null, null, null, null]
+  slot[inheritDraft7 || 0] = map
   if (!byDraft) _schemaMapCache.set(schemas, slot)
   return map
 }
@@ -676,8 +681,7 @@ class Validator {
     // uses, and a benchmark timing construction measures construction.
     // When schema is a string, JSON.parse already produces a fresh object.
     const raw = typeof schema === "string" ? JSON.parse(schema) : schema;
-    const rootIsDraft7 = !!(raw && typeof raw === 'object' && typeof raw.$schema === 'string' &&
-      (raw.$schema === 'http://json-schema.org/draft-07/schema#' || raw.$schema === 'http://json-schema.org/draft-07/schema'));
+    const rootIsDraft7 = raw && typeof raw === 'object' ? draftCode(raw.$schema) : 0;
 
     // Built here rather than below because `$vocabulary` is resolved against
     // it, and that resolution waits until compilation so a meta-schema
@@ -1561,8 +1565,7 @@ class Validator {
     // Normalize a copy so the caller's object is never mutated. A document
     // without a dialect of its own is read under the root's draft.
     const root = this._schemaObj
-    const rootIsDraft7 = !!(root && typeof root === 'object' && typeof root.$schema === 'string' &&
-      (root.$schema === 'http://json-schema.org/draft-07/schema#' || root.$schema === 'http://json-schema.org/draft-07/schema'))
+    const rootIsDraft7 = root && typeof root === 'object' ? draftCode(root.$schema) : 0
     const normalized = _normalizeCallerSchema(schema, rootIsDraft7)
     this._ownSchemaMap()
     this._schemaMap.set(normalized.$id, normalized)

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.48.0';
+module.exports = '1.49.0';

package/lib/vocabularies.js

@@ -50,6 +50,18 @@ function keywordsByVocabulary() {
       new Set(Object.keys(meta.properties)),
     )
   }
+  // Draft 2019-09's vocabularies, from its own vendored meta-schemas. A
+  // 2019-09 dialect names these URIs in `$vocabulary`.
+  for (const name of ['core', 'applicator', 'validation', 'meta-data', 'format', 'content']) {
+    const meta = require('./metaschemas').METASCHEMAS.get(
+      `https://json-schema.org/draft/2019-09/meta/${name}`,
+    )
+    if (!meta || !meta.properties) continue
+    byVocabulary.set(
+      `https://json-schema.org/draft/2019-09/vocab/${name}`,
+      new Set(Object.keys(meta.properties)),
+    )
+  }
   // The one vocabulary with no document to read. `format-assertion` is an
   // alternative to `format-annotation` rather than part of the standard
   // dialect, so its meta-schema is not among the vendored ones. It defines

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ata-validator",
-  "version": "1.48.0",
+  "version": "1.49.0",
   "description": "JSON Schema validator that compiles to plain JavaScript, still runs where code generation is blocked, and can be compiled away at build time. Passes the full official test suite.",
   "type": "commonjs",
   "main": "index.js",
@@ -72,7 +72,7 @@
     "rebuild": "cmake-js rebuild --target ata",
     "test": "node tests/run.js",
     "bench:size": "node benchmark/bench_aot_size.mjs",
-    "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
+    "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1 && node tests/run_suite.js draft6 && node tests/run_suite.js draft2019-09",
     "test:compat": "node tests/test_compat.js",
     "test:standard-schema": "node tests/test_standard_schema.js",
     "test:browser": "node tests/test_browser.js",
@@ -152,13 +152,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.48.0",
-    "@ata-validator/native-darwin-x64": "1.48.0",
-    "@ata-validator/native-linux-arm64-gnu": "1.48.0",
-    "@ata-validator/native-linux-arm64-musl": "1.48.0",
-    "@ata-validator/native-linux-x64-gnu": "1.48.0",
-    "@ata-validator/native-linux-x64-musl": "1.48.0",
-    "@ata-validator/native-win32-x64": "1.48.0"
+    "@ata-validator/native-darwin-arm64": "1.49.0",
+    "@ata-validator/native-darwin-x64": "1.49.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.49.0",
+    "@ata-validator/native-linux-arm64-musl": "1.49.0",
+    "@ata-validator/native-linux-x64-gnu": "1.49.0",
+    "@ata-validator/native-linux-x64-musl": "1.49.0",
+    "@ata-validator/native-win32-x64": "1.49.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"