ata-validator 1.52.0 → 1.54.0

package/lib/formats-source.js

@@ -6,44 +6,11 @@
 // checks the interpreted engine calls, so a bundle without the code generator
 // (ata-validator/lite) does not carry them.
 
-const { DURATION_RE, URI_TEMPLATE_EXPR, URI_FAST } = require('./formats');
+// The three patterns below are read from lib/formats.js when a source that
+// needs one is written, not when this file loads: a compile with no uri,
+// uri-template or duration format then does not load formats.js at all.
+const _formats = () => require('./formats');
 
-const uriCharsSource = (v, from) =>
-  `for(let _ri=${from};_ri<${v}.length;_ri++){const _rc=${v}.charCodeAt(_ri);` +
-  'if(_rc<33||_rc>126||_rc===34||_rc===60||_rc===62||_rc===92||_rc===94||_rc===96||_rc===123||_rc===124||_rc===125)return false;' +
-  `if(_rc===37){const _h1=${v}.charCodeAt(_ri+1),_h2=${v}.charCodeAt(_ri+2);` +
-  'if(!((_h1>=48&&_h1<=57)||(_h1>=97&&_h1<=102)||(_h1>=65&&_h1<=70))||' +
-  '!((_h2>=48&&_h2<=57)||(_h2>=97&&_h2<=102)||(_h2>=65&&_h2<=70)))return false;_ri+=2}}';
-const uriAuthoritySource = (v, start) =>
-  `if(${v}.charCodeAt(${start})===47&&${v}.charCodeAt(${start}+1)===47){` +
-  `let _ae=${v}.length;` +
-  `for(let _ai=${start}+2;_ai<${v}.length;_ai++){const _ac=${v}.charCodeAt(_ai);` +
-  'if(_ac===47||_ac===63||_ac===35){_ae=_ai;break}}' +
-  `const _au=${v}.slice(${start}+2,_ae);const _aat=_au.lastIndexOf('@');` +
-  'if(_aat!==-1&&/[[\\]]/.test(_au.slice(0,_aat)))return false;' +
-  'const _hp=_aat===-1?_au:_au.slice(_aat+1);' +
-  'if(_hp.charCodeAt(0)===91){const _cl=_hp.indexOf("]");' +
-  'if(_cl===-1)return false;const _rs=_hp.slice(_cl+1);' +
-  'if(_rs!==""){if(_rs.charCodeAt(0)!==58||!/^[0-9]*$/.test(_rs.slice(1)))return false}}' +
-  'else{const _co=_hp.lastIndexOf(":");' +
-  'if(_co!==-1){if(_hp.indexOf(":")!==_co)return false;' +
-  'if(!/^[0-9]*$/.test(_hp.slice(_co+1)))return false}}}';
-const iriCharsSource = (v, from) =>
-  `for(let _ii=${from};_ii<${v}.length;_ii++){const _ic=${v}.charCodeAt(_ii);` +
-  'if(_ic===127||(_ic<127&&(_ic<33||_ic===34||_ic===60||_ic===62||_ic===92||_ic===94||_ic===96||_ic===123||_ic===124||_ic===125)))return false;' +
-  `if(_ic===37){const _j1=${v}.charCodeAt(_ii+1),_j2=${v}.charCodeAt(_ii+2);` +
-  'if(!((_j1>=48&&_j1<=57)||(_j1>=97&&_j1<=102)||(_j1>=65&&_j1<=70))||' +
-  '!((_j2>=48&&_j2<=57)||(_j2>=97&&_j2<=102)||(_j2>=65&&_j2<=70)))return false;_ii+=2}}';
-function iriSource (v, isStr) {
-  return guard(v, isStr, `const _n=${v}.length;if(_n===0)return false;` +
-    `const _f=${v}.charCodeAt(0);if(!((_f>=97&&_f<=122)||(_f>=65&&_f<=90)))return false;` +
-    `let _co=-1;for(let _i=1;_i<_n;_i++){const _c=${v}.charCodeAt(_i);if(_c===58){_co=_i;break}` +
-    `if(!((_c>=48&&_c<=57)||(_c>=97&&_c<=122)||(_c>=65&&_c<=90)||_c===43||_c===45||_c===46))return false}` +
-    `if(_co===-1)return false;` +
-    iriCharsSource(v, '_co+1') +
-    uriAuthoritySource(v, '_co+1'));
-}
-function iriReferenceSource (v, isStr) { return guard(v, isStr, iriCharsSource(v, '0')); }
 function idnEmailSource (v, isStr) {
   const inner =
     `const _at=${v}.lastIndexOf('@');` +
@@ -57,6 +24,7 @@ function idnEmailSource (v, isStr) {
       `else{` +
         `if(_dm.charCodeAt(0)===46||_dm.charCodeAt(_dm.length-1)===46)return false;` +
         `if(_dm.indexOf('..')!==-1)return false;` +
+        `if(_dm.charCodeAt(0)===45||_dm.charCodeAt(_dm.length-1)===45||_dm.indexOf('-.')!==-1||_dm.indexOf('.-')!==-1)return false;` +
         `for(let _di=0;_di<_dm.length;_di++){const _dc=_dm.charCodeAt(_di);` +
         `if(_dc<=32||_dc===127||_dc===64)return false}` +
       `}` +
@@ -180,31 +148,34 @@ function timeSource (v, isStr) {
     'if(_u!==1439)return false}');
 }
 
-// The same walk as `uri` above, as source, for the code generator to hoist
-// once per compiled function and call. Two copies of one algorithm is what
-// this file has always done for every format, so they sit together here and
-// tests/test_uri_helper_parity.js holds them to the same answer over a corpus
-// built from the walk's own boundaries.
-const URI_HELPER_TABLES = 'const _uct=new Uint8Array(128);for(let _i=33;_i<127;_i++)_uct[_i]=1;' +
-  '_uct[34]=_uct[60]=_uct[62]=_uct[92]=_uct[94]=_uct[96]=_uct[123]=_uct[124]=_uct[125]=0;' +
-  'const _uch=new Uint8Array(128);for(let _i=48;_i<58;_i++)_uch[_i]=1;' +
-  'for(let _i=97;_i<103;_i++)_uch[_i]=1;for(let _i=65;_i<71;_i++)_uch[_i]=1;' +
-  'const _ucs=new Uint8Array(128);for(let _i=48;_i<58;_i++)_ucs[_i]=1;' +
-  'for(let _i=97;_i<123;_i++)_ucs[_i]=1;for(let _i=65;_i<91;_i++)_ucs[_i]=1;' +
-  '_ucs[43]=1;_ucs[45]=1;_ucs[46]=1;const _ufa=/' + URI_FAST.source + '/';
-const URI_HELPER_BODY = 'if(_ufa.test(_s))return true;const _n=_s.length;if(_n===0)return false;let _c=_s.charCodeAt(0);if(_c>127||_ucs[_c]===0||(_c>=48&&_c<=57)||_c===43||_c===45||_c===46)return false;let _co=-1;for(let _i=1;_i<_n;_i++){_c=_s.charCodeAt(_i);if(_c===58){_co=_i;break}if(_c>127||_ucs[_c]===0)return false}if(_co===-1)return false;let _i=_co+1;let _ae=_n;if(_s.charCodeAt(_i)===47&&_s.charCodeAt(_i+1)===47){const _as=_i+2;let _at=-1,_fc=-1,_lc=-1,_br=0,_ba=0,_hs=_as;_ae=-1;for(_i=_as;_i<_n;_i++){_c=_s.charCodeAt(_i);if(_c>127||_uct[_c]===0)return false;if(_c===47||_c===63||_c===35){_ae=_i;break}if(_c===37){const _h1=_s.charCodeAt(_i+1),_h2=_s.charCodeAt(_i+2);if(!(_h1<=127)||!(_h2<=127)||_uch[_h1]===0||_uch[_h2]===0)return false;_i+=2;continue}if(_c===64){_ba=_br;_at=_i;_fc=-1;_lc=-1;_hs=_i+1}else if(_c===58){if(_fc===-1)_fc=_i;_lc=_i}else if(_c===91||_c===93){_br=1}}if(_ae===-1)_ae=_n;if(_at!==-1&&_ba)return false;if(_s.charCodeAt(_hs)===91){let _cl=-1;for(let _j=_hs+1;_j<_ae;_j++){if(_s.charCodeAt(_j)===93){_cl=_j;break}}if(_cl===-1)return false;if(_cl+1!==_ae){if(_s.charCodeAt(_cl+1)!==58)return false;for(let _j=_cl+2;_j<_ae;_j++){const _d=_s.charCodeAt(_j);if(_d<48||_d>57)return false}}}else if(_lc!==-1){if(_fc!==_lc)return false;for(let _j=_lc+1;_j<_ae;_j++){const _d=_s.charCodeAt(_j);if(_d<48||_d>57)return false}}_i=_ae}for(;_i<_n;_i++){_c=_s.charCodeAt(_i);if(_c>127||_uct[_c]===0)return false;if(_c===37){const _h1=_s.charCodeAt(_i+1),_h2=_s.charCodeAt(_i+2);if(!(_h1<=127)||!(_h2<=127)||_uch[_h1]===0||_uch[_h2]===0)return false;_i+=2}}return true;';
+// The URI family: the walk in lib/uri-core.js, emitted as its factory's source
+// and built once per compiled function (uriHelperSource, hoisted under `name`),
+// so a standalone module carries the same walk the interpreted engine runs.
+// tests/test_uri_helper_parity.js holds the two to one answer over a corpus
+// built from the walk's own boundaries. `uri` keeps the regex for the common
+// shape in front of the walk; the others go straight to it with their mode.
+// The walk takes the IPv6 check for a bracketed host as its argument, and
+// here that is ipv6Source as a function, so the module carries one copy.
+// The factory's text with the spaces around punctuation taken out, about
+// 40% shorter, since it lands in every generated function and standalone
+// module that checks a URI. No string literal inside holds a space, and every
+// statement ends in a semicolon or a brace, so the joins are safe;
+// tests/test_uri_helper_parity.js runs this text against the function.
+let _uriSrc = null
+const uriWalkText = () => _uriSrc !== null ? _uriSrc : (_uriSrc = require('./uri-core').__ataUri.toString().replace(/\s*([=,(){};<>+\-&|?:!])\s*/g, '$1'))
+const uriWalkSource = () => `(${uriWalkText()})(function(_s){${ipv6Source('_s', true)}return true})`
+// `_uri(s)` is the uri check, `_urif(s, mode)` the other three (the
+// expression in front for an iri), `_uriw(s, mode)` the walk alone.
 const uriHelperSource = (name) =>
-  URI_HELPER_TABLES + ';function ' + name + '(_s){' + URI_HELPER_BODY + '}';
-
-function uriSource (v, isStr) {
-  return guard(v, isStr, `const _n=${v}.length;if(_n===0)return false;` +
-    `const _f=${v}.charCodeAt(0);if(!((_f>=97&&_f<=122)||(_f>=65&&_f<=90)))return false;` +
-    `let _co=-1;for(let _i=1;_i<_n;_i++){const _c=${v}.charCodeAt(_i);if(_c===58){_co=_i;break}` +
-    `if(!((_c>=48&&_c<=57)||(_c>=97&&_c<=122)||(_c>=65&&_c<=90)||_c===43||_c===45||_c===46))return false}` +
-    `if(_co===-1)return false;` +
-    uriCharsSource(v, '_co+1') +
-    uriAuthoritySource(v, '_co+1'));
-}
+  'const _ufa=/' + _formats().URI_FAST.source + '/;const ' + name + 'w=' + uriWalkSource() + ';' +
+  'function ' + name + '(_s){if(_ufa.test(_s))return true;return ' + name + 'w(_s,1)}' +
+  'function ' + name + 'f(_s,_m){if((_m&1)===1&&_ufa.test(_s))return true;return ' + name + 'w(_s,_m)}'
+// The inline forms, for a caller with no function to hoist into: the walk is
+// built in place, which costs a factory per call, so the generators hoist.
+function uriSource (v, isStr) { return guard(v, isStr, `if(!/${_formats().URI_FAST.source}/.test(${v})&&!${uriWalkSource()}(${v},1))return false`) }
+function uriReferenceSource (v, isStr) { return guard(v, isStr, `if(!${uriWalkSource()}(${v},0))return false`) }
+function iriSource (v, isStr) { return guard(v, isStr, `if(!/${_formats().URI_FAST.source}/.test(${v})&&!${uriWalkSource()}(${v},3))return false`) }
+function iriReferenceSource (v, isStr) { return guard(v, isStr, `if(!${uriWalkSource()}(${v},2))return false`) }
 
 function ipv6Source (v, isStr) {
   return guard(v, isStr, `const _n=${v}.length;if(_n<2||_n>45)return false;let _end=_n,_g=0;` +
@@ -245,6 +216,9 @@ function uriTemplateSource (v, isStr) {
       `const _c=${v}.charCodeAt(_i);` +
       `if(_c===125)return false;` +
       `if(_c!==123&&(_c<=32||_c===127))return false;` +
+      `if(_c===37){const _h1=${v}.charCodeAt(_i+1),_h2=${v}.charCodeAt(_i+2);` +
+      'if(!((_h1>=48&&_h1<=57)||(_h1>=97&&_h1<=102)||(_h1>=65&&_h1<=70))||' +
+      '!((_h2>=48&&_h2<=57)||(_h2>=97&&_h2<=102)||(_h2>=65&&_h2<=70)))return false;_i+=3;continue}' +
       `if(_c!==123){_i++;continue}` +
       // `_ute`, not `_e`: this source is spliced into a generated function whose
       // error accumulator is `_e`, and a `const _e` here shadowed it, so
@@ -254,7 +228,7 @@ function uriTemplateSource (v, isStr) {
       `if(_ute===-1)return false;` +
       `const _x=${v}.slice(_i+1,_ute);` +
       `if(_x===''||_x.indexOf('{')!==-1)return false;` +
-      `if(!${URI_TEMPLATE_EXPR.toString()}.test(_x))return false;` +
+      `if(!${_formats().URI_TEMPLATE_EXPR.toString()}.test(_x))return false;` +
       `_i=_ute+1` +
     `}`;
   return isStr ? `{${inner}}` : `if(typeof ${v}==='string'){${inner}}`;
@@ -296,7 +270,10 @@ function emailSource (v, isStr) {
     `const _n0=${v}.length;let _at;` +
     `if(${v}.charCodeAt(0)===34){` +
       `_at=${v}.lastIndexOf('@');` +
-      `if(_at<2||_at===_n0-1||_at>64||${v}.charCodeAt(_at-1)!==34)return false` +
+      `if(_at<2||_at===_n0-1||_at>64||${v}.charCodeAt(_at-1)!==34)return false;` +
+      `for(let _qi=1;_qi<_at-1;_qi++){const _qc=${v}.charCodeAt(_qi);` +
+      `if(_qc===92){const _qp=${v}.charCodeAt(_qi+1);if(_qp<32||_qp>126||_qi+1>=_at-1)return false;_qi++;continue}` +
+      `if(_qc<32||_qc>126||_qc===34)return false}` +
     `}else{` +
       `if(${v}.charCodeAt(0)===46)return false;` +
       `_at=-1;let _pd=false;` +
@@ -310,14 +287,14 @@ function emailSource (v, isStr) {
       `const _dm=${v}.slice(_at+1);` +
       `if(_dm.charCodeAt(_dm.length-1)!==93||_dm.length<=2)return false;` +
       `const _in=_dm.slice(1,-1);` +
-      `if(_in.startsWith('IPv6:')){const _i6=_in.slice(5);${ipv6Source('_i6', true)}}` +
+      `if((_in.charCodeAt(0)|32)===105&&(_in.charCodeAt(1)|32)===112&&(_in.charCodeAt(2)|32)===118&&_in.charCodeAt(3)===54&&_in.charCodeAt(4)===58){const _i6=_in.slice(5);${ipv6Source('_i6', true)}}` +
       `else{${ipv4Source('_in', true)}}` +
     `}` +
     `else{${hostnameRangeSource(v, '_at+1', `${v}.length`)}}`;
   return isStr ? `{${inner}}` : `if(typeof ${v}==='string'){${inner}}`;
 }
 function durationSource (v, isStr) {
-  const inner = `if(!${DURATION_RE.toString()}.test(${v}))return false`;
+  const inner = `if(!${_formats().DURATION_RE.toString()}.test(${v}))return false`;
   return isStr ? inner : `if(typeof ${v}==='string'&&${inner.slice(3)}`;
 }
-module.exports = { uriHelperSource, uriCharsSource, uriAuthoritySource, iriSource, iriReferenceSource, idnEmailSource, dateSource, ipv4Source, dateTimeSource, ipv6Source, hostnameSource, uriSource, uuidSource, timeSource, noReservedSource, jsonPointerSource, relativeJsonPointerSource, uriTemplateSource, emailSource, durationSource };
+module.exports = { uriHelperSource, uriSource, uriReferenceSource, iriSource, iriReferenceSource, idnEmailSource, dateSource, ipv4Source, dateTimeSource, ipv6Source, hostnameSource, uriSource, uuidSource, timeSource, noReservedSource, jsonPointerSource, relativeJsonPointerSource, uriTemplateSource, emailSource, durationSource };

package/lib/formats.js

@@ -245,34 +245,6 @@ function hostname (s, from, to) {
   return labelLength !== 0 && previous !== 45;
 }
 
-// Character classes as tables rather than comparison chains. Nine `===` tests
-// per character more than doubled the cost of the scan they guarded, measured
-// against the same loop doing a single range check; an indexed byte read costs
-// the same whatever the class holds.
-const URI_CHAR = new Uint8Array(128);
-for (let i = 33; i < 127; i++) URI_CHAR[i] = 1;
-// " < > \ ^ ` { | } are printable and still not allowed in a URI.
-for (const c of [34, 60, 62, 92, 94, 96, 123, 124, 125]) URI_CHAR[c] = 0;
-const HEX_CHAR = new Uint8Array(128);
-for (let i = 48; i < 58; i++) HEX_CHAR[i] = 1;
-for (let i = 97; i < 103; i++) HEX_CHAR[i] = 1;
-for (let i = 65; i < 71; i++) HEX_CHAR[i] = 1;
-// Scheme characters: letters, digits, "+", "-", ".".
-const SCHEME_CHAR = new Uint8Array(128);
-for (let i = 48; i < 58; i++) SCHEME_CHAR[i] = 1;
-for (let i = 97; i < 123; i++) SCHEME_CHAR[i] = 1;
-for (let i = 65; i < 91; i++) SCHEME_CHAR[i] = 1;
-SCHEME_CHAR[43] = 1; SCHEME_CHAR[45] = 1; SCHEME_CHAR[46] = 1;
-
-// A scheme followed by a colon, an optional authority, and no character a URI
-// cannot hold anywhere after the colon.
-//
-// One walk answers all of it. The authority's landmarks, the last "@", the
-// colons after it and whether a bracket appeared before it, are recorded while
-// the characters are being checked, so the authority is never cut out of the
-// string or scanned again. Reading it out with `slice` and asking the copy for
-// `lastIndexOf` and two regular expressions allocated a string per URI, and a
-// document carrying a handful of URLs paid that per field.
 // The shape almost every URI in a document has, as one regular expression: a
 // scheme, then either "//" and a host with no userinfo, port, brackets or
 // percent escapes, or no authority at all, then a tail of characters RFC 3986
@@ -285,78 +257,18 @@ SCHEME_CHAR[43] = 1; SCHEME_CHAR[45] = 1; SCHEME_CHAR[46] = 1;
 // group merely optional, "http://[::1" could skip it and match "//[::1" as a
 // path, accepting a string the walk rejects for its unclosed bracket.
 // tests/test_uri_fast_path.js holds the subset relation.
-const URI_FAST = /^[A-Za-z][A-Za-z0-9+.\-]*:(?:\/\/[!$&-.0-9;=A-Z_a-z~]*(?:[\/?#][!#$&-;=?-\[\]_a-z~]*)?|(?!\/\/)[!#$&-;=?-\[\]_a-z~]*)$/;
-
-function uri (s) {
-  if (URI_FAST.test(s)) return true;
-  const n = s.length;
-  if (n === 0) return false;
-  let c = s.charCodeAt(0);
-  // A scheme opens with a letter, never a digit or a sign.
-  if (c > 127 || SCHEME_CHAR[c] === 0 || (c >= 48 && c <= 57) || c === 43 || c === 45 || c === 46) return false;
-  let colon = -1;
-  for (let i = 1; i < n; i++) {
-    c = s.charCodeAt(i);
-    if (c === 58) { colon = i; break; }
-    if (c > 127 || SCHEME_CHAR[c] === 0) return false;
-  }
-  if (colon === -1) return false;
-
-  let i = colon + 1;
-  let authEnd = n;
-  if (s.charCodeAt(i) === 47 && s.charCodeAt(i + 1) === 47) {
-    const authStart = i + 2;
-    let at = -1, firstColon = -1, lastColon = -1, sawBracket = 0, bracketBeforeAt = 0;
-    let hostStart = authStart;
-    authEnd = -1;
-    for (i = authStart; i < n; i++) {
-      c = s.charCodeAt(i);
-      if (c > 127 || URI_CHAR[c] === 0) return false;
-      if (c === 47 || c === 63 || c === 35) { authEnd = i; break; }
-      if (c === 37) {
-        const h1 = s.charCodeAt(i + 1), h2 = s.charCodeAt(i + 2);
-        // A "%" at the end of the string reads as NaN, which no comparison
-        // admits; `<= 127` is written that way so NaN takes the reject.
-        if (!(h1 <= 127) || !(h2 <= 127) || HEX_CHAR[h1] === 0 || HEX_CHAR[h2] === 0) return false;
-        i += 2;
-        continue;
-      }
-      // The last "@" ends userinfo, so everything recorded before it belongs
-      // to a part that has its own rules and is dropped here.
-      if (c === 64) { bracketBeforeAt = sawBracket; at = i; firstColon = -1; lastColon = -1; hostStart = i + 1; }
-      else if (c === 58) { if (firstColon === -1) firstColon = i; lastColon = i; }
-      else if (c === 91 || c === 93) { sawBracket = 1; }
-    }
-    if (authEnd === -1) authEnd = n;
-    // Brackets belong to the host, so one before the "@" is not userinfo.
-    if (at !== -1 && bracketBeforeAt) return false;
-    if (s.charCodeAt(hostStart) === 91) { // '['
-      let close = -1;
-      for (let j = hostStart + 1; j < authEnd; j++) { if (s.charCodeAt(j) === 93) { close = j; break; } }
-      if (close === -1) return false;
-      if (close + 1 !== authEnd) {
-        if (s.charCodeAt(close + 1) !== 58) return false;
-        if (!allDigits(s, close + 2, authEnd)) return false;
-      }
-    } else if (lastColon !== -1) {
-      // A host holding more than one colon is an IPv6 address, and those must
-      // be bracketed. Without that rule the last group reads as a port number.
-      if (firstColon !== lastColon) return false;
-      if (!allDigits(s, lastColon + 1, authEnd)) return false;
-    }
-    i = authEnd;
-  }
-  for (; i < n; i++) {
-    c = s.charCodeAt(i);
-    if (c > 127 || URI_CHAR[c] === 0) return false;
-    if (c === 37) {
-      const h1 = s.charCodeAt(i + 1), h2 = s.charCodeAt(i + 2);
-      if (!(h1 <= 127) || !(h2 <= 127) || HEX_CHAR[h1] === 0 || HEX_CHAR[h2] === 0) return false;
-      i += 2;
-    }
-  }
-  return true;
-}
+const URI_FAST = /^[A-Za-z][A-Za-z0-9+.\-]*:(?:\/\/[!$&-.0-9;=A-Z_a-z~]*(?::[0-9]*)?(?:[\/?][!$&-;=?-Z_a-z~]*)?|(?!\/\/)[!$&-;=?-Z_a-z~]*)(?:#[!$&-;=?-Z_a-z~]*)?$/;
+
+// The walk behind the expression, shared with the code generator
+// (lib/uri-core.js). An IRI is a URI that also admits non-ASCII, so the
+// expression answers its common shapes too and anything else goes to the
+// walk. A reference goes straight to the walk, which opens with a scan for
+// the plain shapes.
+const _uriWalk = require('./uri-core').__ataUri(ipv6);
+function uri (s) { return URI_FAST.test(s) || _uriWalk(s, 1); }
+function uriReference (s) { return _uriWalk(s, 0); }
+function iri (s) { return URI_FAST.test(s) || _uriWalk(s, 3); }
+function iriReference (s) { return _uriWalk(s, 2); }
 
 // The characters a URI cannot hold: C0 controls, space, DEL, and the rest of
 // Unicode whitespace. Asking for that set directly costs more than it looks:
@@ -374,128 +286,6 @@ const NON_PRINTABLE = /[^\u0021-\u007e]/;
 // " < > \ ^ ` { | }, plus everything below 0x21 and above 0x7e. The old check
 // only looked for whitespace and non-printables, so a backslash or a lone
 // percent sign passed as a URI.
-function uriChar (c) {
-  if (c < 33 || c > 126) return false;
-  return !(c === 34 || c === 60 || c === 62 || c === 92 ||
-           c === 94 || c === 96 || c === 123 || c === 124 || c === 125);
-}
-function isHex (c) {
-  return (c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70);
-}
-// The same set through the URI_CHAR and HEX_CHAR tables: one load per
-// character, where uriChar() was a call and up to eleven comparisons, and on
-// SchemaStore's SARIF samples, full of URIs, that loop was a sixth of what the
-// interpreted engine spent. A "%" at the end reads past the string, NaN,
-// which fails the bound as it failed isHex().
-function uriChars (s, from) {
-  for (let i = from; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c > 127 || URI_CHAR[c] === 0) return false;
-    if (c === 37) { // '%'
-      const h1 = s.charCodeAt(i + 1), h2 = s.charCodeAt(i + 2);
-      if (!(h1 <= 127) || !(h2 <= 127) || HEX_CHAR[h1] === 0 || HEX_CHAR[h2] === 0) return false;
-      i += 2;
-    }
-  }
-  return true;
-}
-
-function allDigits (s, from, to) {
-  for (let i = from; i < to; i++) {
-    const c = s.charCodeAt(i);
-    if (c < 48 || c > 57) return false;
-  }
-  return true;
-}
-
-// The authority sits between "//" and the next "/", "?" or "#". A bracketed
-// host must close, and a port is digits.
-//
-// Everything here reads the original string through index bounds. Cutting the
-// authority out with `slice` and asking it for `lastIndexOf` and two regular
-// expressions allocated a string for every URI validated, and a document
-// carrying a handful of URLs paid that per field; the authority of an ordinary
-// URL is a dozen characters, so walking it twice costs less than copying it
-// once.
-function uriAuthority (s, start) {
-  if (s.charCodeAt(start) !== 47 || s.charCodeAt(start + 1) !== 47) return true;
-  const n = s.length;
-  const authStart = start + 2;
-  let authEnd = n;
-  for (let i = authStart; i < n; i++) {
-    const c = s.charCodeAt(i);
-    if (c === 47 || c === 63 || c === 35) { authEnd = i; break; }
-  }
-  // The last "@" splits userinfo from the host. Brackets belong to the host,
-  // so one before the "@" is not userinfo.
-  let at = -1;
-  for (let i = authEnd - 1; i >= authStart; i--) {
-    if (s.charCodeAt(i) === 64) { at = i; break; }
-  }
-  if (at !== -1) {
-    for (let i = authStart; i < at; i++) {
-      const c = s.charCodeAt(i);
-      if (c === 91 || c === 93) return false;
-    }
-  }
-  const hpStart = at === -1 ? authStart : at + 1;
-  if (s.charCodeAt(hpStart) === 91) { // '['
-    let close = -1;
-    for (let i = hpStart + 1; i < authEnd; i++) {
-      if (s.charCodeAt(i) === 93) { close = i; break; }
-    }
-    if (close === -1) return false;
-    if (close + 1 === authEnd) return true;
-    if (s.charCodeAt(close + 1) !== 58) return false;
-    return allDigits(s, close + 2, authEnd);
-  }
-  let firstColon = -1;
-  let lastColon = -1;
-  for (let i = hpStart; i < authEnd; i++) {
-    if (s.charCodeAt(i) === 58) {
-      if (firstColon === -1) firstColon = i;
-      lastColon = i;
-    }
-  }
-  if (lastColon === -1) return true;
-  // A host holding more than one colon is an IPv6 address, and those must be
-  // bracketed. Without that rule the last group reads as a port number.
-  if (firstColon !== lastColon) return false;
-  return allDigits(s, lastColon + 1, authEnd);
-}
-
-// An IRI is a URI that also admits non-ASCII. The ASCII rules are identical,
-// so the same character test runs with everything above 0x7e allowed through.
-function iriChar (c) { return c > 126 ? c !== 127 : uriChar(c); }
-function iriChars (s, from) {
-  for (let i = from; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (!iriChar(c)) return false;
-    if (c === 37) {
-      if (!isHex(s.charCodeAt(i + 1)) || !isHex(s.charCodeAt(i + 2))) return false;
-      i += 2;
-    }
-  }
-  return true;
-}
-
-function iri (s) {
-  const n = s.length;
-  if (n === 0) return false;
-  const first = s.charCodeAt(0);
-  if (!((first >= 97 && first <= 122) || (first >= 65 && first <= 90))) return false;
-  let colon = -1;
-  for (let i = 1; i < n; i++) {
-    const c = s.charCodeAt(i);
-    if (c === 58) { colon = i; break; }
-    if (!(isDigit(c) || (c >= 97 && c <= 122) || (c >= 65 && c <= 90) ||
-      c === 43 || c === 45 || c === 46)) return false;
-  }
-  if (colon === -1) return false;
-  return iriChars(s, colon + 1) && uriAuthority(s, colon + 1);
-}
-function iriReference (s) { return iriChars(s, 0); }
-
 // An internationalised mailbox differs from a mailbox only in admitting
 // non-ASCII on both sides. The separator stays the ASCII "@": a fullwidth one
 // is a character in the local part, not a separator.
@@ -514,6 +304,10 @@ function idnEmail (s) {
   }
   if (domain.charCodeAt(0) === 46 || domain.charCodeAt(domain.length - 1) === 46) return false;
   if (domain.indexOf('..') !== -1) return false;
+  // No label starts or ends with a hyphen (RFC 5321 sub-domain, as for
+  // `hostname`): with the dots checked above, that is a hyphen at either end
+  // or next to a dot.
+  if (domain.charCodeAt(0) === 45 || domain.charCodeAt(domain.length - 1) === 45 || domain.indexOf('-.') !== -1 || domain.indexOf('.-') !== -1) return false;
   for (let i = 0; i < domain.length; i++) {
     const c = domain.charCodeAt(i);
     if (c <= 32 || c === 127 || c === 64) return false;
@@ -612,10 +406,6 @@ function time (s) {
 }
 
 // Anything without a control character or whitespace.
-function uriReference (s) {
-  return uriChars(s, 0);
-}
-
 // --- RFC 6901 JSON pointers -------------------------------------------------
 // A pointer is empty or a run of "/"-prefixed tokens, and the only escape is
 // "~" followed by 0 or 1. Everything else, including "#", is not a pointer:
@@ -652,14 +442,21 @@ function relativeJsonPointer(s) {
 // expression: an optional operator, then a comma-separated list of varspecs,
 // each a possibly dotted name of varchars with an optional ":n" prefix length
 // or "*" explode.
-const URI_TEMPLATE_EXPR = /^(?:[+#./;?&=,!@|]?)(?:[A-Za-z0-9_%]|%[0-9A-Fa-f]{2})+(?:\.(?:[A-Za-z0-9_%]|%[0-9A-Fa-f]{2})+)*(?::[1-9][0-9]{0,3}|\*)?(?:,(?:[A-Za-z0-9_%]|%[0-9A-Fa-f]{2})+(?:\.(?:[A-Za-z0-9_%]|%[0-9A-Fa-f]{2})+)*(?::[1-9][0-9]{0,3}|\*)?)*$/;
+const URI_TEMPLATE_EXPR = /^(?:[+#./;?&=,!@|]?)(?:[A-Za-z0-9_]|%[0-9A-Fa-f]{2})+(?:\.(?:[A-Za-z0-9_]|%[0-9A-Fa-f]{2})+)*(?::[1-9][0-9]{0,3}|\*)?(?:,(?:[A-Za-z0-9_]|%[0-9A-Fa-f]{2})+(?:\.(?:[A-Za-z0-9_]|%[0-9A-Fa-f]{2})+)*(?::[1-9][0-9]{0,3}|\*)?)*$/;
+function isHexCode (c) { return (c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70); }
 function uriTemplate(s) {
   let i = 0;
   while (i < s.length) {
     const c = s.charCodeAt(i);
     if (c === 125) return false; // '}' with no opening brace
-    // A literal excludes the controls, the space and DEL.
+    // A literal excludes the controls, the space and DEL, and a "%" in it
+    // introduces two hex digits.
     if (c !== 123 && (c <= 32 || c === 127)) return false;
+    if (c === 37) {
+      const h1 = s.charCodeAt(i + 1), h2 = s.charCodeAt(i + 2);
+      if (!(h1 <= 127) || !(h2 <= 127) || !isHexCode(h1) || !isHexCode(h2)) return false;
+      i += 3; continue;
+    }
     if (c !== 123) { i++; continue; } // not '{'
     const end = s.indexOf('}', i + 1);
     if (end === -1) return false;
@@ -698,6 +495,14 @@ function email(s) {
     at = s.lastIndexOf('@');
     if (at < 2 || at === n - 1 || at > 64) return false;
     if (s.charCodeAt(at - 1) !== 34) return false;
+    // Inside the quotes: printable ASCII other than the quote and the
+    // backslash, or a backslash followed by one printable ASCII character
+    // (RFC 5321 quoted-pairSMTP); "\©" is not a quoted pair.
+    for (let i = 1; i < at - 1; i++) {
+      const c = s.charCodeAt(i);
+      if (c === 92) { const q = s.charCodeAt(i + 1); if (q < 32 || q > 126 || i + 1 >= at - 1) return false; i++; continue; }
+      if (c < 32 || c > 126 || c === 34) return false;
+    }
   } else {
     if (s.charCodeAt(0) === 46) return false; // a leading dot is not a mailbox
     at = -1;
@@ -718,8 +523,9 @@ function email(s) {
   }
   if (s.charCodeAt(at + 1) === 91) { // '['
     if (s.charCodeAt(n - 1) !== 93 || n - at - 1 <= 2) return false;
-    // IPv6 literals are tagged; anything else in brackets is an IPv4 address.
-    if (s.startsWith('IPv6:', at + 2)) return ipv6(s.slice(at + 7, n - 1));
+    // IPv6 literals are tagged, in any case; anything else in brackets is an
+    // IPv4 address. `| 32` lowers an ASCII letter and leaves "6" and ":".
+    if ((s.charCodeAt(at + 2) | 32) === 105 && (s.charCodeAt(at + 3) | 32) === 112 && (s.charCodeAt(at + 4) | 32) === 118 && s.charCodeAt(at + 5) === 54 && s.charCodeAt(at + 6) === 58) return ipv6(s.slice(at + 7, n - 1));
     return ipv4(s.slice(at + 2, n - 1));
   }
   return hostname(s, at + 1, n);
@@ -732,4 +538,4 @@ function email(s) {
 const DURATION_RE = /^P(?:\d+W|(?:\d+Y(?:\d+M(?:\d+D)?)?|\d+M(?:\d+D)?|\d+D)(?:T(?:\d+H(?:\d+M(?:\d+S)?)?|\d+M(?:\d+S)?|\d+S))?|T(?:\d+H(?:\d+M(?:\d+S)?)?|\d+M(?:\d+S)?|\d+S))$/;
 function duration (s) { return DURATION_RE.test(s); }
 
-module.exports = { IPV4, IPV6_FULL, ipv4Range, URI_FAST, date, ipv4, dateTime, ipv6, hostname, uri, uriReference, uuid, time, noReserved, jsonPointer, relativeJsonPointer, uriTemplate, email, duration, uriChars, uriAuthority, iri, iriReference, idnEmail, DURATION_RE, URI_TEMPLATE_EXPR };
+module.exports = { IPV4, IPV6_FULL, ipv4Range, URI_FAST, date, ipv4, dateTime, ipv6, hostname, uri, uriReference, uuid, time, noReserved, jsonPointer, relativeJsonPointer, uriTemplate, email, duration, iri, iriReference, idnEmail, DURATION_RE, URI_TEMPLATE_EXPR };

package/lib/interpreter-compat.js

@@ -0,0 +1,144 @@
+'use strict';
+
+// What compat reads the reference's way while the interpreted engine walks a
+// document: coercion where each `type` is checked, and the discriminator in
+// place of `oneOf`. compat installs this (lib/interpreter-core.js, setCompat),
+// so an application that never imports compat does not bundle it.
+
+function isDiscriminated(schema) {
+  const d = schema.discriminator;
+  return d !== null && typeof d === 'object' && typeof d.propertyName === 'string';
+}
+
+// The reference's coercion: the first type in the list the value converts to,
+// after unwrapping a one-element array in 'array' mode, which then converts
+// the element.
+const NO_COERCION = Symbol('no coercion');
+function fitsType(d, t) {
+  switch (t) {
+    case 'string': return typeof d === 'string';
+    case 'number': return typeof d === 'number' && isFinite(d);
+    case 'integer': return typeof d === 'number' && Number.isInteger(d);
+    case 'boolean': return typeof d === 'boolean';
+    case 'null': return d === null;
+    case 'array': return Array.isArray(d);
+    case 'object': return d !== null && typeof d === 'object' && !Array.isArray(d);
+    default: return false;
+  }
+}
+// Whether an unwrapped element is kept as it is. The reference tests a list
+// of types here with every type at once, so a list of two or more keeps
+// nothing (`number` stands in for `integer` beside it), and the element goes
+// on to be converted, as one of a single type does when it does not fit.
+function unwrappedFits(d, types) {
+  let list = types;
+  if (list.length > 1 && list.includes('number')) list = list.filter((t) => t !== 'integer');
+  if (list.length > 1 && list.includes('array') && list.includes('object')) return false;
+  for (const t of list) if (!fitsType(d, t)) return false;
+  return true;
+}
+function coerceValue(data, types, arrayMode) {
+  if (arrayMode && Array.isArray(data) && data.length === 1) {
+    data = data[0];
+    if (unwrappedFits(data, types)) return data;
+  }
+  const kind = data === null ? 'null' : typeof data;
+  for (const t of types) {
+    switch (t) {
+      case 'number':
+      case 'integer':
+        if (kind === 'boolean' || kind === 'null') return +data;
+        // eslint-disable-next-line eqeqeq
+        if (kind === 'string' && data !== '' && data == +data && (t === 'number' || !(data % 1))) return +data;
+        break;
+      case 'string':
+        if (kind === 'number' || kind === 'boolean') return '' + data;
+        if (kind === 'null') return '';
+        break;
+      case 'boolean':
+        if (data === 'false' || data === 0 || data === null) return false;
+        if (data === 'true' || data === 1) return true;
+        break;
+      case 'null':
+        if (data === '' || data === 0 || data === false) return null;
+        break;
+      case 'array':
+        if (arrayMode && (kind === 'string' || kind === 'number' || kind === 'boolean' || kind === 'null')) return [data];
+        break;
+    }
+  }
+  return NO_COERCION;
+}
+
+module.exports = function install({ NOERRORS, DISCARD, err, mergeAnnotations, dataCtx }) {
+  // The discriminator in place of oneOf: the branch the tag names is applied,
+  // and a tag that is not a string, or names no branch, is the error.
+  function discriminate(interp, P, data, base, dynScope, errors, instancePath, schemaPath, stack, local) {
+    const d = discrMap(interp, P, base);
+    const tag = data[d.tagName];
+    if (typeof tag !== 'string') {
+      if (errors !== NOERRORS) errors.push(err('discriminator', 'discriminator', instancePath, schemaPath + '/discriminator', { error: 'tag', tag: d.tagName, tagValue: tag }, `tag "${d.tagName}" must be string`));
+      return false;
+    }
+    const i = d.map.get(tag);
+    if (i === undefined) {
+      if (errors !== NOERRORS) errors.push(err('discriminator', 'discriminator', instancePath, schemaPath + '/discriminator', { error: 'mapping', tag: d.tagName, tagValue: tag }, `value of tag "${d.tagName}" must be in oneOf`));
+      return false;
+    }
+    const sub = local !== DISCARD ? { props: null, items: null } : DISCARD;
+    const ok = interp.eval(P.oneOf[i], data, base, dynScope, errors, instancePath, schemaPath + '/oneOf/' + i, stack, sub);
+    if (ok && local !== DISCARD) mergeAnnotations(local, sub);
+    return ok;
+  }
+
+  // Tag value to branch index, read from each branch's `properties`, through
+  // a `$ref`, with the reference's rules: a `const` or `enum` of unique
+  // strings, and the tag required by the node or by every branch.
+  function discrMap(interp, P, base) {
+    if (interp._discr === null) interp._discr = new Map();
+    let d = interp._discr.get(P);
+    if (d !== undefined) return d;
+    const tagName = P.schema.discriminator.propertyName;
+    if (P.schema.discriminator.mapping !== undefined) throw new Error('discriminator: mapping is not supported');
+    const hasRequired = (s) => s !== null && typeof s === 'object' && Array.isArray(s.required) && s.required.includes(tagName);
+    let topRequired = hasRequired(P.schema);
+    const map = new Map();
+    for (let i = 0; i < P.oneOf.length; i++) {
+      let node = P.oneOf[i];
+      if (node !== null && typeof node === 'object' && node.ref !== null && node.ref !== undefined && (node.schema.properties === undefined)) {
+        const r = interp.resolveRefCached(node, base);
+        if (r.child === undefined) throw new Error(`discriminator: cannot resolve $ref ${node.ref}`);
+        node = r.child;
+      }
+      const sch = node !== null && typeof node === 'object' ? node.schema : undefined;
+      const propSch = sch && sch.properties ? sch.properties[tagName] : undefined;
+      if (propSch === null || typeof propSch !== 'object') throw new Error(`discriminator: oneOf subschemas (or referenced schemas) must have "properties/${tagName}"`);
+      topRequired = topRequired || hasRequired(sch);
+      const values = propSch.const !== undefined ? [propSch.const] : Array.isArray(propSch.enum) ? propSch.enum : null;
+      if (values === null) throw new Error(`discriminator: "properties/${tagName}" must have "const" or "enum"`);
+      for (const v of values) {
+        if (typeof v !== 'string' || map.has(v)) throw new Error(`discriminator: "${tagName}" values must be unique strings`);
+        map.set(v, i);
+      }
+    }
+    if (!topRequired) throw new Error(`discriminator: "${tagName}" must be required`);
+    d = { tagName, map };
+    interp._discr.set(P, d);
+    return d;
+  }
+
+  // Coerces the value at `instancePath` to the node's type and writes it where
+  // it sits; at the root, where it sits nowhere, the walk carries it on.
+  function coerceAt(interp, P, data, instancePath) {
+    const to = coerceValue(data, P.typeNames, interp.coerce === 'array');
+    if (to === NO_COERCION) return data;
+    if (instancePath === '') interp._ctxRoot = to;
+    else {
+      const ctx = dataCtx(instancePath, '', '');
+      if (ctx.parentData !== null && typeof ctx.parentData === 'object') ctx.parentData[ctx.parentDataProperty] = to;
+    }
+    return to;
+  }
+
+  return { isDiscriminated, discriminate, coerceAt };
+};