ata-validator 1.6.1 → 1.7.0

package/lib/js-compiler.js

@@ -108,6 +108,14 @@ function compileToJS(schema, defs, schemaMap) {
   }
 
   if (!defs && needsBaseTracking(schema, schemaMap, new Set())) return null
+  if (!defs && externalDocsNeedInterpreter(schema, schemaMap)) return null
+
+  // unevaluatedProperties / unevaluatedItems need annotation tracking this
+  // path does not do. Decline so the schema reaches an engine that does.
+  if (!defs) {
+    const str = JSON.stringify(schema)
+    if (str.includes('"unevaluatedProperties"') || str.includes('"unevaluatedItems"')) return null
+  }
 
   // Collect $defs early so sub-schemas can resolve $ref
   const rootDefs = defs || collectDefs(schema)
@@ -158,13 +166,13 @@ function compileToJS(schema, defs, schemaMap) {
     const primitives = vals.filter(v => v === null || typeof v !== 'object')
     const objects = vals.filter(v => v !== null && typeof v === 'object')
     const primSet = new Set(primitives.map(v => v === null ? 'null' : typeof v === 'string' ? 's:' + v : 'n:' + v))
-    const objStrs = objects.map(v => JSON.stringify(v))
+    const objStrs = objects.map(v => _canonical(v))
     checks.push((d) => {
       // Fast primitive check
       const key = d === null ? 'null' : typeof d === 'string' ? 's:' + d : typeof d === 'number' || typeof d === 'boolean' ? 'n:' + d : null
       if (key !== null && primSet.has(key)) return true
-      // Slow object check
-      const ds = JSON.stringify(d)
+      // Slow object check, key order independent
+      const ds = _canonical(d)
       for (let i = 0; i < objStrs.length; i++) {
         if (ds === objStrs[i]) return true
       }
@@ -182,15 +190,15 @@ function compileToJS(schema, defs, schemaMap) {
     if (cv === null || typeof cv !== 'object') {
       checks.push((d) => d === cv)
     } else {
-      const cs = JSON.stringify(cv)
-      checks.push((d) => JSON.stringify(d) === cs)
+      const cs = _canonical(cv)
+      checks.push((d) => _canonical(d) === cs)
     }
   }
 
-  // required
+  // required applies to objects only; other types are ignored.
   if (schema.required && Array.isArray(schema.required)) {
     for (const key of schema.required) {
-      checks.push((d) => typeof d === 'object' && d !== null && key in d)
+      checks.push((d) => typeof d !== 'object' || d === null || Array.isArray(d) || d[key] !== undefined)
     }
   }
 
@@ -206,10 +214,10 @@ function compileToJS(schema, defs, schemaMap) {
     }
   }
 
-  // additionalProperties
-  if (schema.additionalProperties !== undefined && schema.properties) {
+  // additionalProperties (with or without a properties map)
+  if (schema.additionalProperties !== undefined) {
     if (schema.additionalProperties === false) {
-      const allowed = new Set(Object.keys(schema.properties))
+      const allowed = new Set(Object.keys(schema.properties || {}))
       checks.push((d) => {
         if (typeof d !== 'object' || d === null || Array.isArray(d)) return true
         const keys = Object.keys(d)
@@ -246,13 +254,14 @@ function compileToJS(schema, defs, schemaMap) {
     }
   }
 
-  // items
+  // items, applied after the prefixItems positions
   if (schema.items) {
     const itemCheck = compileToJS(schema.items, rootDefs)
     if (!itemCheck) return null
+    const start = Array.isArray(schema.prefixItems) ? schema.prefixItems.length : 0
     checks.push((d) => {
       if (!Array.isArray(d)) return true
-      for (let i = 0; i < d.length; i++) {
+      for (let i = start; i < d.length; i++) {
         if (!itemCheck(d[i])) return false
       }
       return true
@@ -330,7 +339,11 @@ function compileToJS(schema, defs, schemaMap) {
   }
   if (schema.multipleOf !== undefined) {
     const div = schema.multipleOf
-    checks.push((d) => typeof d !== 'number' || d % div === 0)
+    checks.push((d) => {
+      if (typeof d !== 'number') return true
+      const r = d % div
+      return Math.abs(r) <= 1e-8 || Math.abs(r - div) <= 1e-8
+    })
   }
 
   // string
@@ -352,10 +365,12 @@ function compileToJS(schema, defs, schemaMap) {
     }
   }
 
-  // format — hand-written fast checks
+  // format — hand-written fast checks. A format the code generator asserts
+  // but this path cannot is a decline, not a pass.
   if (schema.format) {
     const fc = FORMAT_CHECKS[schema.format]
     if (fc) checks.push((d) => typeof d !== 'string' || fc(d))
+    else if (FORMAT_CODEGEN[schema.format]) return null
   }
 
   // array size
@@ -371,11 +386,11 @@ function compileToJS(schema, defs, schemaMap) {
   // object size
   if (schema.minProperties !== undefined) {
     const min = schema.minProperties
-    checks.push((d) => typeof d !== 'object' || d === null || Object.keys(d).length >= min)
+    checks.push((d) => typeof d !== 'object' || d === null || Array.isArray(d) || Object.keys(d).length >= min)
   }
   if (schema.maxProperties !== undefined) {
     const max = schema.maxProperties
-    checks.push((d) => typeof d !== 'object' || d === null || Object.keys(d).length <= max)
+    checks.push((d) => typeof d !== 'object' || d === null || Array.isArray(d) || Object.keys(d).length <= max)
   }
 
   // allOf
@@ -558,7 +573,7 @@ function walkJsonPointer(root, fragment) {
   for (const p of parts) {
     if (target == null || typeof target !== 'object') return null
     if (!(p in target)) {
-      const alt = p === 'definitions' ? '$defs' : p === '$defs' ? 'definitions' : null
+      const alt = p === 'definitions' ? '$defs' : p === '$defs' ? 'definitions' : p === 'items' && Array.isArray(target.prefixItems) ? 'prefixItems' : null
       if (alt !== null && alt in target) { target = target[alt]; continue }
       return null
     }
@@ -597,8 +612,9 @@ function resolveCrossSchemaRef(ref, schemaMap) {
 }
 
 function resolveRef(ref, defs, schemaMap) {
-  // Self-reference: "#" — treat as permissive to avoid infinite recursion
-  if (ref === '#') return () => true
+  // Self-reference: "#" cannot be expressed as a closure without a recursion
+  // guard. Decline rather than substitute a vacuous check.
+  if (ref === '#') return null
 
   // 1. Local ref
   if (defs) {
@@ -660,6 +676,13 @@ const TYPE_CHECKS = {
   object: (d) => typeof d === 'object' && d !== null && !Array.isArray(d),
 }
 
+// Key-order independent JSON rendering for const/enum comparison.
+function _canonical(x) {
+  if (x === null || typeof x !== 'object') return JSON.stringify(x)
+  if (Array.isArray(x)) return '[' + x.map(_canonical).join(',') + ']'
+  return '{' + Object.keys(x).sort().map((k) => JSON.stringify(k) + ':' + _canonical(x[k])).join(',') + '}'
+}
+
 const FORMAT_CHECKS = {
   email: (s) => { const at = s.indexOf('@'); return at > 0 && at < s.length - 1 && s.indexOf('.', at) > at + 1 },
   date: (s) => { if (s.length !== 10 || !/^\d{4}-\d{2}-\d{2}$/.test(s)) return false; const m = +s.slice(5, 7), d = +s.slice(8, 10); return m >= 1 && m <= 12 && d >= 1 && d <= 31 },
@@ -845,6 +868,16 @@ function codegenSafe(schema, schemaMap) {
     if (typeof schema.unevaluatedProperties === 'object' && schema.unevaluatedProperties !== null) {
       if (!codegenSafe(schema.unevaluatedProperties, schemaMap)) return false
     }
+    // When evaluation is both dynamic (branch-dependent) and some branch
+    // unconditionally evaluates all properties, static tracking cannot
+    // correctly determine which properties are unevaluated at runtime.
+    // For example, a oneOf whose branches include both patternProperties
+    // and unevaluatedProperties:true requires annotation-aware evaluation
+    // that only the interpreted engine provides.
+    if (schema.unevaluatedProperties === false || (typeof schema.unevaluatedProperties === 'object' && schema.unevaluatedProperties !== null)) {
+      const evalResult = collectEvaluated(schema, schemaMap)
+      if (evalResult.dynamic && evalResult.allProps) return false
+    }
   }
   // unevaluatedItems: allow boolean and schema values
   if (schema.unevaluatedItems !== undefined) {
@@ -861,15 +894,52 @@ function codegenSafe(schema, schemaMap) {
   const defs = schema.$defs || schema.definitions
   if (defs) {
     const defNames = new Set(Object.keys(defs))
-    // Detect cyclic local refs: if any def's own body references back to a sibling
-    // def, the schema contains a cycle. The JS codegen returns (() => true) on cycle
-    // (permissive), so cyclic schemas must route to the interpreted engine instead.
-    // We check only the def bodies, not the top-level schema, so that a plain
-    // { $ref: '#/$defs/Name', $defs: { Name: { type: 'string' } } } (no cycle)
-    // still compiles.
-    const hasCycle = Object.values(defs).some(
-      (def) => typeof def === 'object' && def !== null && subtreeRefersToLocalDef(def, defNames)
-    )
+    // Detect cyclic local refs: build a directed graph of def->def references and
+    // check for cycles using DFS. A plain cross-reference (A -> B where B doesn't
+    // refer back to A) is fine; only true cycles (A -> B -> A) must be rejected.
+    // The JS codegen returns (() => true) on cycle (permissive), so cyclic schemas
+    // must route to the interpreted engine instead.
+    const defRefs = {}
+    for (const [name, def] of Object.entries(defs)) {
+      defRefs[name] = []
+      if (typeof def === 'object' && def !== null) {
+        const refs = []
+        const seen = new WeakSet()
+        const collectRefs = (node) => {
+          if (typeof node !== 'object' || node === null) return
+          if (seen.has(node)) return
+          seen.add(node)
+          if (node.$ref) {
+            const m = /^#\/(?:\$defs|definitions)\/([^/]+)$/.exec(node.$ref)
+            if (m && defNames.has(m[1])) refs.push(m[1])
+          }
+          for (const val of Object.values(node)) {
+            if (typeof val === 'object' && val !== null) {
+              if (Array.isArray(val)) { for (const item of val) collectRefs(item) }
+              else collectRefs(val)
+            }
+          }
+        }
+        collectRefs(def)
+        defRefs[name] = refs
+      }
+    }
+    const hasCycle = (() => {
+      const visited = new Set()
+      const inStack = new Set()
+      const dfs = (node) => {
+        if (inStack.has(node)) return true
+        if (visited.has(node)) return false
+        visited.add(node)
+        inStack.add(node)
+        for (const neighbor of (defRefs[node] || [])) {
+          if (dfs(neighbor)) return true
+        }
+        inStack.delete(node)
+        return false
+      }
+      return Object.keys(defRefs).some(dfs)
+    })()
     if (hasCycle) return false
     for (const [name, def] of Object.entries(defs)) {
       if (/[~/"']/.test(name)) return false // special chars in def name
@@ -1100,14 +1170,85 @@ function hasUnresolvableRef(node, rootDefs, anchors, schemaMap, seen) {
   return false
 }
 
+
+// --- The one gate every code generation entry point runs first ---
+//
+// Four entry points build four contexts, and three times a bail present in
+// one was missing from another; each time the generator emitted nothing for
+// a construct it could not represent and returned the empty program as
+// always-valid. The checks that do not depend on an entry point's own anchor
+// map live here, so adding a bail is one edit. Entry-point-specific checks
+// (hasUnresolvableRef against each path's anchors) still run after this.
+// tests/test_codegen_entrypoint_agreement.js holds the four to one verdict.
+
+function collectExternalRefKeys(node, out, seen) {
+  if (typeof node !== 'object' || node === null) return
+  if (seen.has(node)) return
+  seen.add(node)
+  if (Array.isArray(node)) { for (const n of node) collectExternalRefKeys(n, out, seen); return }
+  for (const key of Object.keys(node)) {
+    const v = node[key]
+    if ((key === '$ref' || key === '$dynamicRef') && typeof v === 'string' && !v.startsWith('#')) out.add(v.split('#')[0])
+    else if (typeof v === 'object' && v !== null && key !== 'enum' && key !== 'const' && key !== 'default' && key !== 'examples') collectExternalRefKeys(v, out, seen)
+  }
+}
+
+function lookupExternal(key, schemaMap) {
+  if (schemaMap.has(key)) return schemaMap.get(key)
+  if (!key.includes('://')) {
+    for (const [id, doc] of schemaMap) if (id.endsWith('/' + key)) return doc
+  }
+  return null
+}
+
+// Documents reachable from `schema` through cross-document references.
+function reachableExternalDocs(schema, schemaMap) {
+  const docs = new Set()
+  if (!schemaMap || schemaMap.size === 0) return docs
+  const queue = [schema]
+  const seenDocs = new Set([schema])
+  while (queue.length) {
+    const doc = queue.shift()
+    const keys = new Set()
+    collectExternalRefKeys(doc, keys, new Set())
+    for (const key of keys) {
+      const target = lookupExternal(key, schemaMap)
+      if (target && !seenDocs.has(target)) { seenDocs.add(target); docs.add(target); queue.push(target) }
+    }
+  }
+  return docs
+}
+
+// Dynamic scope and annotation tracking across documents is interpreter
+// work. A referenced document that uses either must decline the whole
+// schema, or the generator emits a vacuous check for the reference.
+function externalDocsNeedInterpreter(schema, schemaMap) {
+  for (const doc of reachableExternalDocs(schema, schemaMap)) {
+    const str = JSON.stringify(doc)
+    if (str.includes('"$dynamicRef"') || str.includes('"$dynamicAnchor"') ||
+        str.includes('"unevaluatedProperties"') || str.includes('"unevaluatedItems"')) return true
+    // An embedded $id inside a referenced document opens a resource the
+    // generator never registers, so references to it would be vacuous.
+    if (typeof doc === 'object' && doc !== null && hasNestedIdScope(doc)) return true
+  }
+  return false
+}
+
+function sharedCodegenGate(schema, schemaMap) {
+  if (typeof schema !== 'object' || schema === null) return true
+  if (!codegenSafe(schema, schemaMap)) return false
+  if (needsBaseTracking(schema, schemaMap, new Set())) return false
+  if (externalDocsNeedInterpreter(schema, schemaMap)) return false
+  return true
+}
+
 // --- Codegen mode: generates a single Function (NOT CSP-safe) ---
 // This matches ajv's approach: one monolithic function, V8 JIT fully inlines it
 function compileToJSCodegen(schema, schemaMap, userFormats) {
   if (typeof schema === 'boolean') return schema ? () => true : () => false
   if (typeof schema !== 'object' || schema === null) return null
 
-  // Bail if schema contains features that codegen can't handle correctly
-  if (!codegenSafe(schema, schemaMap)) return null
+  if (!sharedCodegenGate(schema, schemaMap)) return null
 
   // Collect defs for $ref resolution
   const rootDefs = schema.$defs || schema.definitions || null
@@ -1243,7 +1384,13 @@ function compileToJSCodegen(schema, schemaMap, userFormats) {
       const fmtEntries = []
       for (let i = 0; i < closureNames.length; i++) {
         if (closureNames[i].startsWith('_uf_')) {
-          fmtEntries.push({ name: closureNames[i], fn: closureValues[i] })
+          // The format's own name, so an emitter can look it up at runtime
+          // instead of embedding the function.
+          let format = null
+          for (const key of Object.keys(ctx.userFormats)) {
+            if (ctx.userFormats[key] === closureValues[i]) { format = key; break }
+          }
+          fmtEntries.push({ name: closureNames[i], fn: closureValues[i], format })
         }
       }
       if (fmtEntries.length) boolFn._formatClosures = fmtEntries
@@ -1387,7 +1534,7 @@ function tryGenCombined(schema, access, ctx) {
     if (schema.maximum !== undefined) conds.push(`_v>${schema.maximum}`)
     if (schema.exclusiveMinimum !== undefined) conds.push(`_v<=${schema.exclusiveMinimum}`)
     if (schema.exclusiveMaximum !== undefined) conds.push(`_v>=${schema.exclusiveMaximum}`)
-    if (schema.multipleOf !== undefined) conds.push(`_v%${schema.multipleOf}!==0`)
+    if (schema.multipleOf !== undefined) conds.push(`(Math.abs(_v%${schema.multipleOf})>1e-8&&Math.abs(_v%${schema.multipleOf}-${schema.multipleOf})>1e-8)`)
     if (conds.length < 2) return null
     return bind(conds)
   }
@@ -1398,7 +1545,7 @@ function tryGenCombined(schema, access, ctx) {
     if (schema.maximum !== undefined) conds.push(`_v>${schema.maximum}`)
     if (schema.exclusiveMinimum !== undefined) conds.push(`_v<=${schema.exclusiveMinimum}`)
     if (schema.exclusiveMaximum !== undefined) conds.push(`_v>=${schema.exclusiveMaximum}`)
-    if (schema.multipleOf !== undefined) conds.push(`_v%${schema.multipleOf}!==0`)
+    if (schema.multipleOf !== undefined) conds.push(`(Math.abs(_v%${schema.multipleOf})>1e-8&&Math.abs(_v%${schema.multipleOf}-${schema.multipleOf})>1e-8)`)
     if (conds.length < 2) return null
     return bind(conds)
   }
@@ -1411,7 +1558,9 @@ function tryGenCombined(schema, access, ctx) {
 // function is only safe when we're at the root (`v === 'd'`). For nested
 // nodes, emit inline so block-scoped variables like `_o0` stay in scope.
 function _deferOrInline(ctx, lines, v, check) {
-  if (v === 'd') {
+  // Deferring is only sound at the top level of the root function. Inside a
+  // conditional applicator (dependentSchemas) the check must stay in its block.
+  if (v === 'd' && !ctx.condDepth) {
     if (!ctx.deferredChecks) ctx.deferredChecks = []
     ctx.deferredChecks.push(check)
   } else {
@@ -1552,7 +1701,7 @@ function genCode(schema, v, lines, ctx, knownType) {
   const isArr = effectiveType === 'array'
   const isStr = effectiveType === 'string'
   const isNum = effectiveType === 'number' || effectiveType === 'integer'
-  const objGuard = isObj ? '' : `typeof ${v}==='object'&&${v}!==null&&`
+  const objGuard = isObj ? '' : `typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&`
   const objCheck = isObj ? '' : `if(typeof ${v}!=='object'||${v}===null)return false;`
 
   // enum
@@ -1572,7 +1721,12 @@ function genCode(schema, v, lines, ctx, knownType) {
     if (cv === null || typeof cv !== 'object') {
       lines.push(`if(${v}!==${JSON.stringify(cv)})return false`)
     } else {
-      lines.push(`if(JSON.stringify(${v})!==${JSON.stringify(JSON.stringify(cv))})return false`)
+      // Key-order independent comparison, defined inline so every emitter
+      // (runtime, hybrid, standalone) carries it.
+      const ci = ctx.varCounter++
+      const canonFn = `_cnB${ci}`
+      const expected = _canonical(cv)
+      lines.push(`{const ${canonFn}=function(x){if(x===null||typeof x!=='object')return JSON.stringify(x);if(Array.isArray(x))return'['+x.map(${canonFn}).join(',')+']';return'{'+Object.keys(x).sort().map(function(k){return JSON.stringify(k)+':'+${canonFn}(x[k])}).join(',')+'}'};if(${canonFn}(${v})!==${JSON.stringify(expected)})return false}`)
     }
   }
 
@@ -1600,9 +1754,9 @@ function genCode(schema, v, lines, ctx, knownType) {
       const checks = schema.required.map(key => `${v}[${JSON.stringify(key)}]===undefined`)
       lines.push(`if(${checks.join('||')})return false`)
     } else {
-      for (const key of schema.required) {
-        lines.push(`if(typeof ${v}!=='object'||${v}===null||!(${JSON.stringify(key)} in ${v}))return false`)
-      }
+      // required applies to objects only; other types are ignored.
+      const checks = schema.required.map(key => `${v}[${JSON.stringify(key)}]===undefined`)
+      lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&(${checks.join('||')}))return false`)
     }
   }
 
@@ -1632,7 +1786,11 @@ function genCode(schema, v, lines, ctx, knownType) {
   if (schema.maximum !== undefined) lines.push(isNum ? `if(${v}>${schema.maximum})return false` : `if(typeof ${v}==='number'&&${v}>${schema.maximum})return false`)
   if (schema.exclusiveMinimum !== undefined) lines.push(isNum ? `if(${v}<=${schema.exclusiveMinimum})return false` : `if(typeof ${v}==='number'&&${v}<=${schema.exclusiveMinimum})return false`)
   if (schema.exclusiveMaximum !== undefined) lines.push(isNum ? `if(${v}>=${schema.exclusiveMaximum})return false` : `if(typeof ${v}==='number'&&${v}>=${schema.exclusiveMaximum})return false`)
-  if (schema.multipleOf !== undefined) lines.push(isNum ? `if(${v}%${schema.multipleOf}!==0)return false` : `if(typeof ${v}==='number'&&${v}%${schema.multipleOf}!==0)return false`)
+  if (schema.multipleOf !== undefined) {
+    const m = schema.multipleOf
+    const bad = `(Math.abs(${v}%${m})>1e-8&&Math.abs(${v}%${m}-${m})>1e-8)`
+    lines.push(isNum ? `if${bad}return false` : `if(typeof ${v}==='number'&&${bad})return false`)
+  }
 
   // string length — skip type guard if known string.
   // s.length (UTF-16 code units) is an upper bound on cpLen, and at least cpLen
@@ -1891,7 +2049,9 @@ function genCode(schema, v, lines, ctx, knownType) {
     for (const [key, depSchema] of Object.entries(schema.dependentSchemas)) {
       const guard = isObj ? '' : `typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&`
       lines.push(`if(${guard}${JSON.stringify(key)} in ${v}){`)
+      ctx.condDepth = (ctx.condDepth || 0) + 1
       genCode(depSchema, v, lines, ctx, effectiveType)
+      ctx.condDepth--
       lines.push(`}`)
     }
   }
@@ -1968,9 +2128,11 @@ function genCode(schema, v, lines, ctx, knownType) {
     const idx = `_j${ctx.varCounter}`
     const elem = `_e${ctx.varCounter}`
     ctx.varCounter++
+    // items applies after the prefixItems positions (Draft 2020-12).
+    const start = Array.isArray(schema.prefixItems) ? schema.prefixItems.length : 0
     lines.push(isArr
-      ? `for(let ${idx}=0;${idx}<${v}.length;${idx}++){const ${elem}=${v}[${idx}]`
-      : `if(Array.isArray(${v})){for(let ${idx}=0;${idx}<${v}.length;${idx}++){const ${elem}=${v}[${idx}]`)
+      ? `for(let ${idx}=${start};${idx}<${v}.length;${idx}++){const ${elem}=${v}[${idx}]`
+      : `if(Array.isArray(${v})){for(let ${idx}=${start};${idx}<${v}.length;${idx}++){const ${elem}=${v}[${idx}]`)
     genCode(schema.items, elem, lines, ctx)
     lines.push(isArr ? `}` : `}}`)
   }
@@ -2635,6 +2797,9 @@ const FORMAT_CODEGEN = {
 
 // Safe key escaping: use JSON.stringify to handle all special chars (newlines, null bytes, etc.)
 function esc(s) { return JSON.stringify(s).slice(1, -1) }
+// A schema pointer segment for a pattern: JSON Pointer escaping, then made
+// safe for the single-quoted literal the error emitters use.
+function ptrSeg(s) { return s.replace(/~/g, '~0').replace(/\//g, '~1').replace(/\\/g, '\\\\').replace(/'/g, "\\'") }
 
 // Resolve child path at codegen time when parent is a static string literal.
 // This enables frozen pre-allocation for ALL nested error objects.
@@ -2781,7 +2946,7 @@ function compileToJSCodegenWithErrors(schema, schemaMap, userFormats, sourceOpts
       : () => ({ valid: false, errors: [{ keyword: 'false schema', instancePath: '', schemaPath: '#', params: {}, message: 'boolean schema is false' }] })
   }
   if (typeof schema !== 'object' || schema === null) return null
-  if (!codegenSafe(schema, schemaMap)) return null
+  if (!sharedCodegenGate(schema, schemaMap)) return null
   if (schema.patternProperties) {
     for (const [pat, sub] of Object.entries(schema.patternProperties)) {
       if (typeof sub === 'boolean') return null
@@ -3179,13 +3344,30 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
     lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})&&Object.keys(${v}).length>${schema.maxProperties}){${fail('maxProperties', 'maxProperties', `{limit:${schema.maxProperties}}`, `'must NOT have more than ${schema.maxProperties} properties'`)}}`)
   }
 
-  // additionalProperties: false
-  if (schema.additionalProperties === false && schema.properties) {
-    const allowed = Object.keys(schema.properties).map(k => `${JSON.stringify(k)}`).join(',')
+  // additionalProperties: false. A key matched by any patternProperties
+  // entry is not additional, so those patterns are consulted here as well.
+  if (schema.additionalProperties === false && (schema.properties || schema.patternProperties)) {
+    const allowed = Object.keys(schema.properties || {}).map(k => `${JSON.stringify(k)}`).join(',')
     const ci = ctx.varCounter++
     const apSp = `${schemaPrefix}/additionalProperties`
     const apLit = buildErrorLiteral({ keyword: 'additionalProperties', schemaPath: apSp, sourceMap: ctx.sourceMap })
-    const inner = `const _k${ci}=Object.keys(${v});const _a${ci}=new Set([${allowed}]);for(let _i=0;_i<_k${ci}.length;_i++){if(!_a${ci}.has(_k${ci}[_i])){_e.push({code:'${apLit.codeStr}',keyword:'additionalProperties',instancePath:${pathExpr||'""'},schemaPath:'${apSp}',params:{additionalProperty:_k${ci}[_i]},message:'must NOT have additional properties',docUrl:'${apLit.docUrl}'${apLit.frame}});if(!_all)return{valid:false,errors:_e}}}`
+    const patChecks = []
+    for (const pat of Object.keys(schema.patternProperties || {})) {
+      const pattern = JSON.stringify(pat)
+      if (!ctx.regExpMap.has(pattern)) {
+        const ri = ctx.varCounter++
+        ctx.regExpMap.set(pattern, ri)
+        if (patternIsSafe(pat)) {
+          ctx.helperCode.push(`const _re${ri}=__ataSafeRe(${pattern})`)
+          ctx.usesSafeRe = true
+        } else {
+          ctx.helperCode.push(`const _re${ri}=new RegExp(${pattern})`)
+        }
+      }
+      patChecks.push(`_re${ctx.regExpMap.get(pattern)}.test(_k${ci}[_i])`)
+    }
+    const isAdditional = patChecks.length ? `!_a${ci}.has(_k${ci}[_i])&&!(${patChecks.join('||')})` : `!_a${ci}.has(_k${ci}[_i])`
+    const inner = `const _k${ci}=Object.keys(${v});const _a${ci}=new Set([${allowed}]);for(let _i=0;_i<_k${ci}.length;_i++){if(${isAdditional}){_e.push({code:'${apLit.codeStr}',keyword:'additionalProperties',instancePath:${pathExpr||'""'},schemaPath:'${apSp}',params:{additionalProperty:_k${ci}[_i]},message:'must NOT have additional properties',docUrl:'${apLit.docUrl}'${apLit.frame}});if(!_all)return{valid:false,errors:_e}}}`
     lines.push(isObj ? `{${inner}}` : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
   }
 
@@ -3228,7 +3410,8 @@ function genCodeE(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       const ki = ctx.varCounter++
       lines.push(`if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){for(const _k${ki} in ${v}){if(_re${ri}.test(_k${ki})){`)
       const p = pathExpr ? `${pathExpr}+'/'+_k${ki}` : `'/'+_k${ki}`
-      genCodeE(sub, `${v}[_k${ki}]`, p, lines, ctx, schemaPrefix+'/patternProperties')
+      // The real pointer, so source maps can locate the failing keyword.
+      genCodeE(sub, `${v}[_k${ki}]`, p, lines, ctx, schemaPrefix + '/patternProperties/' + pat.replace(/~/g, '~0').replace(/\//g, '~1'))
       lines.push(`}}}`)
     }
   }
@@ -3407,7 +3590,7 @@ function compileToJSCombined(schema, VALID_RESULT, schemaMap, userFormats) {
       : () => ({ valid: false, errors: [{ keyword: 'false schema', instancePath: '', schemaPath: '#', params: {}, message: 'boolean schema is false' }] })
   }
   if (typeof schema !== 'object' || schema === null) return null
-  if (!codegenSafe(schema, schemaMap)) return null
+  if (!sharedCodegenGate(schema, schemaMap)) return null
   if (schema.patternProperties) {
     for (const [pat, sub] of Object.entries(schema.patternProperties)) {
       if (typeof sub === 'boolean') return null
@@ -3841,17 +4024,6 @@ function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       }
     }
 
-    // Build sub-schema validators as closure vars
-    for (let i = 0; i < ppEntries.length; i++) {
-      const [, sub] = ppEntries[i]
-      const subLines = []
-      genCode(sub, `_ppv`, subLines, ctx)
-      const fnBody = subLines.length === 0 ? `return true` : `${subLines.join(';')};return true`
-      const fnVar = `_ppf${pi}_${i}`
-      ctx.closureVars.push(fnVar)
-      ctx.closureVals.push(new Function('_ppv', fnBody))
-    }
-
     const guard = isObj ? '' : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v}))`
     const kVar = `_k${pi}`
 
@@ -3895,7 +4067,11 @@ function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
       const matchExpr = keyCheck || `_as${pi}.has(${kVar})`
       lines.push(`let _m${pi}=${matchExpr}`)
       for (let i = 0; i < ppEntries.length; i++) {
-        lines.push(`if(${matchers[i].check}){_m${pi}=true;if(!_ppf${pi}_${i}(${v}[${kVar}])){${fail('pattern', 'patternProperties', `{pattern:'${ppEntries[i][0]}'}`, `'patternProperties: value invalid for key '+${kVar}`)}}}`)
+        // The subschema is generated in place so its own keywords report
+        // the real instance path and schema pointer.
+        lines.push(`if(${matchers[i].check}){_m${pi}=true;{const _ppv${pi}_${i}=${v}[${kVar}]`)
+        genCodeC(ppEntries[i][1], `_ppv${pi}_${i}`, childPathDynExpr(pathExpr, kVar), lines, ctx, schemaPrefix + '/patternProperties/' + ptrSeg(ppEntries[i][0]))
+        lines.push(`}}`)
       }
       lines.push(`if(!_m${pi}){${fail('additionalProperties', 'additionalProperties', `{additionalProperty:${kVar}}`, "'must NOT have additional properties'")}}`)
       lines.push(`}}`)
@@ -3925,7 +4101,9 @@ function genCodeC(schema, v, pathExpr, lines, ctx, schemaPrefix) {
         }
       }
       for (let i = 0; i < ppEntries.length; i++) {
-        lines.push(`if(${matchers[i].check}&&!_ppf${pi}_${i}(${v}[${kVar}])){${fail('pattern', 'patternProperties', `{pattern:'${ppEntries[i][0]}'}`, `'patternProperties: value invalid for key '+${kVar}`)}}`)
+        lines.push(`if(${matchers[i].check}){const _ppv${pi}_${i}=${v}[${kVar}]`)
+        genCodeC(ppEntries[i][1], `_ppv${pi}_${i}`, childPathDynExpr(pathExpr, kVar), lines, ctx, schemaPrefix + '/patternProperties/' + ptrSeg(ppEntries[i][0]))
+        lines.push(`}`)
       }
       lines.push(`}}`)
     }

package/lib/metaschemas.js

@@ -0,0 +1,21 @@
+'use strict';
+
+// The official meta-schemas, vendored so a `$ref` to one of them resolves
+// without a network. Draft 2020-12 is eight documents joined by $dynamicRef;
+// draft-07 is one. Sources: https://json-schema.org/draft/2020-12/schema and
+// http://json-schema.org/draft-07/schema, fetched 2026-08-23, unmodified.
+// Keyed by $id; index.js also registers the http/https and trailing-# spellings.
+
+const METASCHEMAS = new Map([
+  ["https://json-schema.org/draft/2020-12/schema", {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/schema","$vocabulary":{"https://json-schema.org/draft/2020-12/vocab/core":true,"https://json-schema.org/draft/2020-12/vocab/applicator":true,"https://json-schema.org/draft/2020-12/vocab/unevaluated":true,"https://json-schema.org/draft/2020-12/vocab/validation":true,"https://json-schema.org/draft/2020-12/vocab/meta-data":true,"https://json-schema.org/draft/2020-12/vocab/format-annotation":true,"https://json-schema.org/draft/2020-12/vocab/content":true},"$dynamicAnchor":"meta","title":"Core and Validation specifications meta-schema","allOf":[{"$ref":"meta/core"},{"$ref":"meta/applicator"},{"$ref":"meta/unevaluated"},{"$ref":"meta/validation"},{"$ref":"meta/meta-data"},{"$ref":"meta/format-annotation"},{"$ref":"meta/content"}],"type":["object","boolean"],"$comment":"This meta-schema also defines keywords that have appeared in previous drafts in order to prevent incompatible extensions as they remain in common use.","properties":{"definitions":{"$comment":"\"definitions\" has been replaced by \"$defs\".","type":"object","additionalProperties":{"$dynamicRef":"#meta"},"deprecated":true,"default":{}},"dependencies":{"$comment":"\"dependencies\" has been split and replaced by \"dependentSchemas\" and \"dependentRequired\" in order to serve their differing semantics.","type":"object","additionalProperties":{"anyOf":[{"$dynamicRef":"#meta"},{"$ref":"meta/validation#/$defs/stringArray"}]},"deprecated":true,"default":{}},"$recursiveAnchor":{"$comment":"\"$recursiveAnchor\" has been replaced by \"$dynamicAnchor\".","$ref":"meta/core#/$defs/anchorString","deprecated":true},"$recursiveRef":{"$comment":"\"$recursiveRef\" has been replaced by \"$dynamicRef\".","$ref":"meta/core#/$defs/uriReferenceString","deprecated":true}}}],
+  ["https://json-schema.org/draft/2020-12/meta/core", {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/core","$dynamicAnchor":"meta","title":"Core vocabulary meta-schema","type":["object","boolean"],"properties":{"$id":{"$ref":"#/$defs/uriReferenceString","$comment":"Non-empty fragments not allowed.","pattern":"^[^#]*#?$"},"$schema":{"$ref":"#/$defs/uriString"},"$ref":{"$ref":"#/$defs/uriReferenceString"},"$anchor":{"$ref":"#/$defs/anchorString"},"$dynamicRef":{"$ref":"#/$defs/uriReferenceString"},"$dynamicAnchor":{"$ref":"#/$defs/anchorString"},"$vocabulary":{"type":"object","propertyNames":{"$ref":"#/$defs/uriString"},"additionalProperties":{"type":"boolean"}},"$comment":{"type":"string"},"$defs":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"}}},"$defs":{"anchorString":{"type":"string","pattern":"^[A-Za-z_][-A-Za-z0-9._]*$"},"uriString":{"type":"string","format":"uri"},"uriReferenceString":{"type":"string","format":"uri-reference"}}}],
+  ["https://json-schema.org/draft/2020-12/meta/applicator", {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/applicator","$dynamicAnchor":"meta","title":"Applicator vocabulary meta-schema","type":["object","boolean"],"properties":{"prefixItems":{"$ref":"#/$defs/schemaArray"},"items":{"$dynamicRef":"#meta"},"contains":{"$dynamicRef":"#meta"},"additionalProperties":{"$dynamicRef":"#meta"},"properties":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"},"default":{}},"patternProperties":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"},"propertyNames":{"format":"regex"},"default":{}},"dependentSchemas":{"type":"object","additionalProperties":{"$dynamicRef":"#meta"},"default":{}},"propertyNames":{"$dynamicRef":"#meta"},"if":{"$dynamicRef":"#meta"},"then":{"$dynamicRef":"#meta"},"else":{"$dynamicRef":"#meta"},"allOf":{"$ref":"#/$defs/schemaArray"},"anyOf":{"$ref":"#/$defs/schemaArray"},"oneOf":{"$ref":"#/$defs/schemaArray"},"not":{"$dynamicRef":"#meta"}},"$defs":{"schemaArray":{"type":"array","minItems":1,"items":{"$dynamicRef":"#meta"}}}}],
+  ["https://json-schema.org/draft/2020-12/meta/validation", {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/validation","$dynamicAnchor":"meta","title":"Validation vocabulary meta-schema","type":["object","boolean"],"properties":{"type":{"anyOf":[{"$ref":"#/$defs/simpleTypes"},{"type":"array","items":{"$ref":"#/$defs/simpleTypes"},"minItems":1,"uniqueItems":true}]},"const":true,"enum":{"type":"array","items":true},"multipleOf":{"type":"number","exclusiveMinimum":0},"maximum":{"type":"number"},"exclusiveMaximum":{"type":"number"},"minimum":{"type":"number"},"exclusiveMinimum":{"type":"number"},"maxLength":{"$ref":"#/$defs/nonNegativeInteger"},"minLength":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"pattern":{"type":"string","format":"regex"},"maxItems":{"$ref":"#/$defs/nonNegativeInteger"},"minItems":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"uniqueItems":{"type":"boolean","default":false},"maxContains":{"$ref":"#/$defs/nonNegativeInteger"},"minContains":{"$ref":"#/$defs/nonNegativeInteger","default":1},"maxProperties":{"$ref":"#/$defs/nonNegativeInteger"},"minProperties":{"$ref":"#/$defs/nonNegativeIntegerDefault0"},"required":{"$ref":"#/$defs/stringArray"},"dependentRequired":{"type":"object","additionalProperties":{"$ref":"#/$defs/stringArray"}}},"$defs":{"nonNegativeInteger":{"type":"integer","minimum":0},"nonNegativeIntegerDefault0":{"$ref":"#/$defs/nonNegativeInteger","default":0},"simpleTypes":{"enum":["array","boolean","integer","null","number","object","string"]},"stringArray":{"type":"array","items":{"type":"string"},"uniqueItems":true,"default":[]}}}],
+  ["https://json-schema.org/draft/2020-12/meta/meta-data", {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/meta-data","$dynamicAnchor":"meta","title":"Meta-data vocabulary meta-schema","type":["object","boolean"],"properties":{"title":{"type":"string"},"description":{"type":"string"},"default":true,"deprecated":{"type":"boolean","default":false},"readOnly":{"type":"boolean","default":false},"writeOnly":{"type":"boolean","default":false},"examples":{"type":"array","items":true}}}],
+  ["https://json-schema.org/draft/2020-12/meta/format-annotation", {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/format-annotation","$dynamicAnchor":"meta","title":"Format vocabulary meta-schema for annotation results","type":["object","boolean"],"properties":{"format":{"type":"string"}}}],
+  ["https://json-schema.org/draft/2020-12/meta/content", {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/content","$dynamicAnchor":"meta","title":"Content vocabulary meta-schema","type":["object","boolean"],"properties":{"contentEncoding":{"type":"string"},"contentMediaType":{"type":"string"},"contentSchema":{"$dynamicRef":"#meta"}}}],
+  ["https://json-schema.org/draft/2020-12/meta/unevaluated", {"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://json-schema.org/draft/2020-12/meta/unevaluated","$dynamicAnchor":"meta","title":"Unevaluated applicator vocabulary meta-schema","type":["object","boolean"],"properties":{"unevaluatedItems":{"$dynamicRef":"#meta"},"unevaluatedProperties":{"$dynamicRef":"#meta"}}}],
+  ["http://json-schema.org/draft-07/schema#", {"$schema":"http://json-schema.org/draft-07/schema#","$id":"http://json-schema.org/draft-07/schema#","title":"Core schema meta-schema","definitions":{"schemaArray":{"type":"array","minItems":1,"items":{"$ref":"#"}},"nonNegativeInteger":{"type":"integer","minimum":0},"nonNegativeIntegerDefault0":{"allOf":[{"$ref":"#/definitions/nonNegativeInteger"},{"default":0}]},"simpleTypes":{"enum":["array","boolean","integer","null","number","object","string"]},"stringArray":{"type":"array","items":{"type":"string"},"uniqueItems":true,"default":[]}},"type":["object","boolean"],"properties":{"$id":{"type":"string","format":"uri-reference"},"$schema":{"type":"string","format":"uri"},"$ref":{"type":"string","format":"uri-reference"},"$comment":{"type":"string"},"title":{"type":"string"},"description":{"type":"string"},"default":true,"readOnly":{"type":"boolean","default":false},"writeOnly":{"type":"boolean","default":false},"examples":{"type":"array","items":true},"multipleOf":{"type":"number","exclusiveMinimum":0},"maximum":{"type":"number"},"exclusiveMaximum":{"type":"number"},"minimum":{"type":"number"},"exclusiveMinimum":{"type":"number"},"maxLength":{"$ref":"#/definitions/nonNegativeInteger"},"minLength":{"$ref":"#/definitions/nonNegativeIntegerDefault0"},"pattern":{"type":"string","format":"regex"},"additionalItems":{"$ref":"#"},"items":{"anyOf":[{"$ref":"#"},{"$ref":"#/definitions/schemaArray"}],"default":true},"maxItems":{"$ref":"#/definitions/nonNegativeInteger"},"minItems":{"$ref":"#/definitions/nonNegativeIntegerDefault0"},"uniqueItems":{"type":"boolean","default":false},"contains":{"$ref":"#"},"maxProperties":{"$ref":"#/definitions/nonNegativeInteger"},"minProperties":{"$ref":"#/definitions/nonNegativeIntegerDefault0"},"required":{"$ref":"#/definitions/stringArray"},"additionalProperties":{"$ref":"#"},"definitions":{"type":"object","additionalProperties":{"$ref":"#"},"default":{}},"properties":{"type":"object","additionalProperties":{"$ref":"#"},"default":{}},"patternProperties":{"type":"object","additionalProperties":{"$ref":"#"},"propertyNames":{"format":"regex"},"default":{}},"dependencies":{"type":"object","additionalProperties":{"anyOf":[{"$ref":"#"},{"$ref":"#/definitions/stringArray"}]}},"propertyNames":{"$ref":"#"},"const":true,"enum":{"type":"array","items":true,"minItems":1,"uniqueItems":true},"type":{"anyOf":[{"$ref":"#/definitions/simpleTypes"},{"type":"array","items":{"$ref":"#/definitions/simpleTypes"},"minItems":1,"uniqueItems":true}]},"format":{"type":"string"},"contentMediaType":{"type":"string"},"contentEncoding":{"type":"string"},"if":{"$ref":"#"},"then":{"$ref":"#"},"else":{"$ref":"#"},"allOf":{"$ref":"#/definitions/schemaArray"},"anyOf":{"$ref":"#/definitions/schemaArray"},"oneOf":{"$ref":"#/definitions/schemaArray"},"not":{"$ref":"#"}},"default":true}],
+]);
+
+module.exports = { METASCHEMAS };