ata-validator 1.6.2 → 1.7.1

package/lib/plan-compiler.js

@@ -0,0 +1,545 @@
+'use strict';
+
+// Compiles interpreter Plans into a tree of specialized closures. No source
+// generation, no `new Function`: this is plain closure composition, so it
+// runs wherever the interpreter runs, CSP included. The payoff over eval()
+// is that every keyword branch is decided once at compile time and every
+// child call is a direct monomorphic call, which is the same advantage the
+// code generator has, minus the codegen.
+//
+// Scope, deliberately narrow:
+//   - single schema resource only (no embedded `$id`, no external documents),
+//     so the base URI and the dynamic scope are compile-time constants and
+//     `$ref` / `$dynamicRef` targets resolve once, here;
+//   - no `unevaluatedProperties` / `unevaluatedItems` anywhere (annotation
+//     flow stays eval()'s job).
+// Anything outside that gate keeps the generic evaluator. Error output must
+// be byte-for-byte what eval() produces; tests/test_plan_compiler.js diffs
+// the two over the official suite.
+//
+// Compiled signature: fn(data, errors, instancePath, schemaPath, stack) ->
+// boolean. `errors` may be the NOERRORS sentinel for verdict-only runs, in
+// which case a failed step returns immediately; when collecting, every step
+// runs, exactly like eval().
+
+function install(deps) {
+  const { Plan, NOERRORS, err, evalLeaf, evalLeafV, deepEqual, dataBits, escapePointer,
+          T_STRING, T_ARRAY, T_OBJECT, resolveRef, splitFragment, resolveUri } = deps;
+
+  const TRUE_FN = () => true;
+  const TRUE_PAIR = { v: TRUE_FN, c: TRUE_FN };
+  const FALSE_PAIR = {
+    v: () => false,
+    c: (data, errors, instancePath, schemaPath) => {
+      if (errors !== NOERRORS) errors.push(err('false schema', 'not', instancePath, schemaPath, {}, 'boolean schema is false'));
+      return false;
+    },
+  };
+
+  // Whether the whole tree reachable from `node` fits the compiler's scope.
+  // `base` is the base URI in effect, updated at compile time exactly the way
+  // eval() updates it at run time: the schema path is static, so it can be.
+  function compilable(interp, node, base, seen) {
+    if (node === true || node === false) return true;
+    if (!(node instanceof Plan)) return true;
+    const P = node;
+    if (P.nodeBase !== null && P.nodeBase !== base) base = P.nodeBase;
+    const key = P;
+    const prev = seen.get(key);
+    if (prev !== undefined) { if (prev === base || prev === true) return true; return false; }
+    seen.set(key, base);
+    if (P.hasUnevaluated) return false;
+    if (P.ref !== null) {
+      const t = resolveRef(P.ref, base, interp.state);
+      if (t.node === undefined || !compilable(interp, interp.node(t.node), t.base, seen)) return false;
+    }
+    if (P.dynamicRef !== null) {
+      // $dynamicRef stays compiled only in a single-resource schema, where
+      // the dynamic scope is a constant. Anything larger keeps eval().
+      if (interp.state.resources.size !== 1) return false;
+      const t = dynTarget(interp, P.dynamicRef);
+      if (t === undefined || !compilable(interp, interp.node(t), base, seen)) return false;
+    }
+    const kids = [];
+    if (P.properties !== null) for (const v of P.properties.values()) kids.push(v.node);
+    if (P.patternProperties !== null) for (const e of P.patternProperties) kids.push(e.node);
+    if (P.additionalProperties !== undefined) kids.push(P.additionalProperties);
+    if (P.propertyNames !== undefined) kids.push(P.propertyNames);
+    if (P.dependentSchemas !== null) for (const [, v] of P.dependentSchemas) kids.push(v);
+    if (P.propertyDependencies !== null) for (const [, m] of P.propertyDependencies) for (const v of m.values()) kids.push(v);
+    if (P.prefixItems !== null) for (const v of P.prefixItems) kids.push(v);
+    if (P.items !== undefined) kids.push(P.items);
+    if (P.contains !== undefined) kids.push(P.contains);
+    if (P.allOf !== null) for (const v of P.allOf) kids.push(v);
+    if (P.anyOf !== null) for (const v of P.anyOf) kids.push(v);
+    if (P.oneOf !== null) for (const v of P.oneOf) kids.push(v);
+    if (P.not !== undefined) kids.push(P.not);
+    if (P.if !== undefined) kids.push(P.if);
+    if (P.then !== undefined) kids.push(P.then);
+    if (P.else !== undefined) kids.push(P.else);
+    for (const k of kids) if (!compilable(interp, k, base, seen)) return false;
+    return true;
+  }
+
+  // Static $dynamicRef target: with a single resource the dynamic scope is
+  // always [rootBase], so the outermost-scope search collapses to a lookup.
+  function dynTarget(interp, ref) {
+    const base = interp.state.rootBase;
+    let { node } = resolveRef(ref, base, interp.state);
+    const [, fragment] = splitFragment(resolveUri(base, ref));
+    if (fragment && !fragment.startsWith('/')) {
+      const dyn = interp.state.dynamicAnchors.get(base);
+      const bookended = node !== undefined && dyn && dyn.get(fragment) === node;
+      if (bookended || !interp.bookending) {
+        if (dyn && dyn.has(fragment)) node = dyn.get(fragment);
+      }
+    }
+    return node;
+  }
+
+  function compileNode(interp, node, base, memo) {
+    if (node === true) return TRUE_PAIR;
+    if (node === false) return FALSE_PAIR;
+    if (!(node instanceof Plan)) return TRUE_PAIR;
+    const P = node;
+    if (P.nodeBase !== null && P.nodeBase !== base) base = P.nodeBase;
+    // A plan reached under two bases compiles once per base; nearly every
+    // plan only ever has one.
+    let perBase = memo.get(P);
+    if (perBase === undefined) { perBase = new Map(); memo.set(P, perBase); }
+    const cached = perBase.get(base);
+    if (cached !== undefined) return cached;
+    // Cycles: register trampolines before compiling children.
+    const box = { v: null, c: null };
+    const pair = {
+      v: (d, st) => box.v(d, st),
+      c: (d, e, ip, sp, st) => box.c(d, e, ip, sp, st),
+    };
+    perBase.set(base, pair);
+
+    const steps = [];   // collect variant: (data, errors, ip, sp, stack)
+    const vsteps = [];  // verdict variant: (data, stack), no strings at all
+
+    // $ref / $dynamicRef, resolved at compile time. The cycle guard mirrors
+    // eval(): a (schema, data) pair already on the stack is a fixed point.
+    if (P.ref !== null) {
+      const t = resolveRef(P.ref, base, interp.state);
+      const target = compileNode(interp, interp.node(t.node), t.base, memo);
+      const schema = P.schema;
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        for (let i = stack.length - 2; i >= 0; i -= 2) {
+          if (stack[i] === schema && stack[i + 1] === data) return true;
+        }
+        stack.push(schema, data);
+        const ok = target.c(data, errors, instancePath, schemaPath + '/$ref', stack);
+        stack.length -= 2;
+        return ok;
+      });
+      vsteps.push((data, stack) => {
+        for (let i = stack.length - 2; i >= 0; i -= 2) {
+          if (stack[i] === schema && stack[i + 1] === data) return true;
+        }
+        stack.push(schema, data);
+        const ok = target.v(data, stack);
+        stack.length -= 2;
+        return ok;
+      });
+    }
+    if (P.dynamicRef !== null) {
+      const target = compileNode(interp, interp.node(dynTarget(interp, P.dynamicRef)), base, memo);
+      const schema = P.schema;
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        for (let i = stack.length - 2; i >= 0; i -= 2) {
+          if (stack[i] === schema && stack[i + 1] === data) return true;
+        }
+        stack.push(schema, data);
+        const ok = target.c(data, errors, instancePath, schemaPath + '/$dynamicRef', stack);
+        stack.length -= 2;
+        return ok;
+      });
+      vsteps.push((data, stack) => {
+        for (let i = stack.length - 2; i >= 0; i -= 2) {
+          if (stack[i] === schema && stack[i + 1] === data) return true;
+        }
+        stack.push(schema, data);
+        const ok = target.v(data, stack);
+        stack.length -= 2;
+        return ok;
+      });
+    }
+
+    // Every value-level keyword in one step, reusing the leaf evaluator so
+    // the two paths cannot drift.
+    if (P.hasType || P.enum !== null || P.hasConst || P.hasNumber || P.hasString ||
+        P.minItems !== undefined || P.maxItems !== undefined || P.uniqueItems ||
+        P.required !== null || P.minProperties !== undefined || P.maxProperties !== undefined ||
+        P.dependentRequired !== null) {
+      steps.push((data, errors, instancePath, schemaPath) => evalLeaf(P, data, errors, instancePath, schemaPath));
+      vsteps.push((data) => evalLeafV(P, data));
+    }
+
+    // Arrays
+    if (P.prefixItems !== null) {
+      const fns = P.prefixItems.map((v) => compileNode(interp, v, base, memo));
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        if (dataBits(data) !== T_ARRAY) return true;
+        let ok = true;
+        const n = Math.min(fns.length, data.length);
+        for (let i = 0; i < n; i++) {
+          if (!fns[i].c(data[i], errors, instancePath + '/' + i, schemaPath + '/prefixItems/' + i, stack)) {
+            ok = false;
+            if (errors === NOERRORS) return false;
+          }
+        }
+        return ok;
+      });
+      vsteps.push((data, stack) => {
+        if (dataBits(data) !== T_ARRAY) return true;
+        const n = Math.min(fns.length, data.length);
+        for (let i = 0; i < n; i++) if (!fns[i].v(data[i], stack)) return false;
+        return true;
+      });
+    }
+    if (P.items !== undefined) {
+      const fn = compileNode(interp, P.items, base, memo);
+      const start = P.prefixItems !== null ? P.prefixItems.length : 0;
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        if (dataBits(data) !== T_ARRAY) return true;
+        let ok = true;
+        for (let i = start; i < data.length; i++) {
+          if (!fn.c(data[i], errors, instancePath + '/' + i, schemaPath + '/items', stack)) {
+            ok = false;
+            if (errors === NOERRORS) return false;
+          }
+        }
+        return ok;
+      });
+      const fv = fn.v;
+      vsteps.push((data, stack) => {
+        if (dataBits(data) !== T_ARRAY) return true;
+        for (let i = start; i < data.length; i++) if (!fv(data[i], stack)) return false;
+        return true;
+      });
+    }
+    if (P.contains !== undefined) {
+      const fn = compileNode(interp, P.contains, base, memo);
+      const minC = P.minContains !== undefined ? P.minContains : 1;
+      const maxC = P.maxContains;
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        if (dataBits(data) !== T_ARRAY) return true;
+        let matched = 0;
+        for (let i = 0; i < data.length; i++) {
+          if (fn.v(data[i], stack)) matched++;
+        }
+        let ok = true;
+        if (matched < minC) {
+          if (errors !== NOERRORS) errors.push(err('contains', 'contains', instancePath, schemaPath + '/contains', { minContains: minC }, `must contain at least ${minC} valid item(s)`));
+          ok = false;
+        }
+        if (maxC !== undefined && matched > maxC) {
+          if (errors !== NOERRORS) errors.push(err('maxContains', 'maxContains', instancePath, schemaPath + '/maxContains', { limit: maxC }, `must NOT contain more than ${maxC} valid item(s)`));
+          ok = false;
+        }
+        return ok;
+      });
+      vsteps.push((data, stack) => {
+        if (dataBits(data) !== T_ARRAY) return true;
+        let matched = 0;
+        for (let i = 0; i < data.length; i++) {
+          if (fn.v(data[i], stack)) { matched++; if (maxC === undefined && matched >= minC) return true; }
+        }
+        return matched >= minC && (maxC === undefined || matched <= maxC);
+      });
+    }
+
+    // Objects
+    if (P.properties !== null || P.patternProperties !== null || P.additionalProperties !== undefined || P.propertyNames !== undefined) {
+      const props = P.properties;
+      const propFns = props !== null ? new Map() : null;
+      if (props !== null) {
+        for (const [key, entry] of props) propFns.set(key, { fn: compileNode(interp, entry.node, base, memo), seg: entry.seg, schemaSeg: entry.schemaSeg });
+      }
+      const patterns = P.patternProperties !== null
+        ? P.patternProperties.map((e) => ({ re: e.re, src: e.src, fn: compileNode(interp, e.node, base, memo) }))
+        : null;
+      const apFn = P.additionalProperties !== undefined ? compileNode(interp, P.additionalProperties, base, memo) : null;
+      const pnFn = P.propertyNames !== undefined ? compileNode(interp, P.propertyNames, base, memo) : null;
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        if (dataBits(data) !== T_OBJECT) return true;
+        let ok = true;
+        const keys = Object.keys(data);
+        if (pnFn !== null) {
+          for (const key of keys) {
+            if (!pnFn.c(key, errors, instancePath + '/' + escapePointer(key), schemaPath + '/propertyNames', stack)) {
+              ok = false;
+              if (errors === NOERRORS) return false;
+            }
+          }
+        }
+        for (let k = 0; k < keys.length; k++) {
+          const key = keys[k];
+          let evaluated = false;
+          const prop = propFns !== null ? propFns.get(key) : undefined;
+          if (prop !== undefined) {
+            if (!prop.fn.c(data[key], errors, instancePath + prop.seg, schemaPath + prop.schemaSeg, stack)) {
+              ok = false;
+              if (errors === NOERRORS) return false;
+            }
+            evaluated = true;
+          }
+          if (patterns !== null) {
+            for (let pi = 0; pi < patterns.length; pi++) {
+              const pp = patterns[pi];
+              if (pp.re.test(key)) {
+                if (!pp.fn.c(data[key], errors, instancePath + '/' + escapePointer(key), schemaPath + '/patternProperties/' + escapePointer(pp.src), stack)) {
+                  ok = false;
+                  if (errors === NOERRORS) return false;
+                }
+                evaluated = true;
+              }
+            }
+          }
+          if (!evaluated && apFn !== null) {
+            if (!apFn.c(data[key], errors, instancePath + '/' + escapePointer(key), schemaPath + '/additionalProperties', stack)) {
+              ok = false;
+              if (errors === NOERRORS) return false;
+            }
+          }
+        }
+        return ok;
+      });
+      vsteps.push((data, stack) => {
+        if (dataBits(data) !== T_OBJECT) return true;
+        const keys = Object.keys(data);
+        if (pnFn !== null) {
+          for (const key of keys) if (!pnFn.v(key, stack)) return false;
+        }
+        for (let k = 0; k < keys.length; k++) {
+          const key = keys[k];
+          let evaluated = false;
+          const prop = propFns !== null ? propFns.get(key) : undefined;
+          if (prop !== undefined) {
+            if (!prop.fn.v(data[key], stack)) return false;
+            evaluated = true;
+          }
+          if (patterns !== null) {
+            for (let pi = 0; pi < patterns.length; pi++) {
+              const pp = patterns[pi];
+              if (pp.re.test(key)) {
+                if (!pp.fn.v(data[key], stack)) return false;
+                evaluated = true;
+              }
+            }
+          }
+          if (!evaluated && apFn !== null) {
+            if (!apFn.v(data[key], stack)) return false;
+          }
+        }
+        return true;
+      });
+    }
+    if (P.dependentSchemas !== null) {
+      const entries = P.dependentSchemas.map(([key, v]) => [key, compileNode(interp, v, base, memo), escapePointer(key)]);
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        if (dataBits(data) !== T_OBJECT) return true;
+        let ok = true;
+        for (const [key, fn, ek] of entries) {
+          if (Object.hasOwn(data, key)) {
+            if (!fn.c(data, errors, instancePath, schemaPath + '/dependentSchemas/' + ek, stack)) {
+              ok = false;
+              if (errors === NOERRORS) return false;
+            }
+          }
+        }
+        return ok;
+      });
+      vsteps.push((data, stack) => {
+        if (dataBits(data) !== T_OBJECT) return true;
+        for (const [key, fn] of entries) {
+          if (Object.hasOwn(data, key) && !fn.v(data, stack)) return false;
+        }
+        return true;
+      });
+    }
+    if (P.propertyDependencies !== null) {
+      const entries = P.propertyDependencies.map(([key, choices]) => {
+        const m = new Map();
+        for (const [value, v] of choices) m.set(value, compileNode(interp, v, base, memo));
+        return [key, m];
+      });
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        if (dataBits(data) !== T_OBJECT) return true;
+        let ok = true;
+        for (const [key, choices] of entries) {
+          if (!Object.hasOwn(data, key)) continue;
+          const value = data[key];
+          if (typeof value !== 'string') continue;
+          const fn = choices.get(value);
+          if (fn === undefined) continue;
+          const branchPath = schemaPath + '/propertyDependencies/' + escapePointer(key) + '/' + escapePointer(value);
+          if (!fn.c(data, errors, instancePath, branchPath, stack)) {
+            ok = false;
+            if (errors === NOERRORS) return false;
+          }
+        }
+        return ok;
+      });
+      vsteps.push((data, stack) => {
+        if (dataBits(data) !== T_OBJECT) return true;
+        for (const [key, choices] of entries) {
+          if (!Object.hasOwn(data, key)) continue;
+          const value = data[key];
+          if (typeof value !== 'string') continue;
+          const fn = choices.get(value);
+          if (fn !== undefined && !fn.v(data, stack)) return false;
+        }
+        return true;
+      });
+    }
+
+    // In-place applicators
+    if (P.allOf !== null) {
+      const fns = P.allOf.map((v) => compileNode(interp, v, base, memo));
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        let ok = true;
+        for (let i = 0; i < fns.length; i++) {
+          if (!fns[i].c(data, errors, instancePath, schemaPath + '/allOf/' + i, stack)) {
+            ok = false;
+            if (errors === NOERRORS) return false;
+          }
+        }
+        return ok;
+      });
+      vsteps.push((data, stack) => {
+        for (let i = 0; i < fns.length; i++) if (!fns[i].v(data, stack)) return false;
+        return true;
+      });
+    }
+    if (P.anyOf !== null) {
+      const fns = P.anyOf.map((v) => compileNode(interp, v, base, memo));
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        const scratch = errors === NOERRORS ? NOERRORS : [];
+        let any = false;
+        for (let i = 0; i < fns.length; i++) {
+          if (fns[i].c(data, scratch, instancePath, schemaPath + '/anyOf/' + i, stack)) any = true;
+        }
+        if (!any) {
+          if (errors !== NOERRORS) {
+            for (const e of scratch) errors.push(e);
+            errors.push(err('anyOf', 'anyOf', instancePath, schemaPath + '/anyOf', {}, 'must match a schema in anyOf'));
+          }
+          return false;
+        }
+        return true;
+      });
+      vsteps.push((data, stack) => {
+        for (let i = 0; i < fns.length; i++) if (fns[i].v(data, stack)) return true;
+        return false;
+      });
+    }
+    if (P.oneOf !== null) {
+      const fns = P.oneOf.map((v) => compileNode(interp, v, base, memo));
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        const scratch = errors === NOERRORS ? NOERRORS : [];
+        let count = 0;
+        for (let i = 0; i < fns.length; i++) {
+          if (fns[i].c(data, scratch, instancePath, schemaPath + '/oneOf/' + i, stack)) count++;
+        }
+        if (count !== 1) {
+          if (errors !== NOERRORS) {
+            if (count === 0) for (const e of scratch) errors.push(e);
+            errors.push(err('oneOf', 'oneOf', instancePath, schemaPath + '/oneOf', { passingSchemas: count }, 'must match exactly one schema in oneOf'));
+          }
+          return false;
+        }
+        return true;
+      });
+      vsteps.push((data, stack) => {
+        let count = 0;
+        for (let i = 0; i < fns.length; i++) {
+          if (fns[i].v(data, stack)) { count++; if (count > 1) return false; }
+        }
+        return count === 1;
+      });
+    }
+    if (P.not !== undefined) {
+      const fn = compileNode(interp, P.not, base, memo);
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        if (fn.v(data, stack)) {
+          if (errors !== NOERRORS) errors.push(err('not', 'not', instancePath, schemaPath + '/not', {}, 'must NOT be valid'));
+          return false;
+        }
+        return true;
+      });
+      vsteps.push((data, stack) => !fn.v(data, stack));
+    }
+    if (P.if !== undefined) {
+      const ifFn = compileNode(interp, P.if, base, memo);
+      const thenFn = P.then !== undefined ? compileNode(interp, P.then, base, memo) : null;
+      const elseFn = P.else !== undefined ? compileNode(interp, P.else, base, memo) : null;
+      steps.push((data, errors, instancePath, schemaPath, stack) => {
+        if (ifFn.v(data, stack)) {
+          if (thenFn !== null) return thenFn.c(data, errors, instancePath, schemaPath + '/then', stack);
+        } else if (elseFn !== null) {
+          return elseFn.c(data, errors, instancePath, schemaPath + '/else', stack);
+        }
+        return true;
+      });
+      vsteps.push((data, stack) => {
+        if (ifFn.v(data, stack)) {
+          if (thenFn !== null) return thenFn.v(data, stack);
+        } else if (elseFn !== null) {
+          return elseFn.v(data, stack);
+        }
+        return true;
+      });
+    }
+
+    let cfn;
+    if (steps.length === 0) cfn = TRUE_FN;
+    else if (steps.length === 1) cfn = steps[0];
+    else {
+      const arr = steps;
+      cfn = (d, e, ip, sp, st) => {
+        let ok = true;
+        for (let i = 0; i < arr.length; i++) {
+          if (!arr[i](d, e, ip, sp, st)) {
+            if (e === NOERRORS) return false;
+            ok = false;
+          }
+        }
+        return ok;
+      };
+    }
+    let vfn;
+    if (vsteps.length === 0) vfn = TRUE_FN;
+    else if (vsteps.length === 1) vfn = vsteps[0];
+    else if (vsteps.length === 2) {
+      const [a, b] = vsteps;
+      vfn = (d, st) => a(d, st) && b(d, st);
+    } else {
+      const arr = vsteps;
+      vfn = (d, st) => {
+        for (let i = 0; i < arr.length; i++) if (!arr[i](d, st)) return false;
+        return true;
+      };
+    }
+    box.c = cfn;
+    box.v = vfn;
+    pair.c = cfn;
+    pair.v = vfn;
+    perBase.set(base, pair);
+    return pair;
+  }
+
+  // Entry point: returns a compiled root function or null when the schema is
+  // outside the compiler's scope.
+  function compileInterpreter(interp) {
+    if (!compilable(interp, interp.rootNode, interp.state.rootBase, new Map())) return null;
+    return compileNode(interp, interp.rootNode, interp.state.rootBase, new Map());
+  }
+
+  return { compileInterpreter };
+}
+
+module.exports = { install };

package/lib/safe-regex-source.js

@@ -5,4 +5,4 @@
 // into standalone output without a runtime `fs` read. Kept in sync by
 // `tests/test_safe_regex_source_sync.js`.
 
-module.exports = "'use strict'\n\n// Linear-time regex engine for JSON Schema `pattern`, used in place of JS RegExp\n// so an adversarial input cannot trigger catastrophic backtracking (ReDoS).\n//\n// It is a Pike VM: the pattern compiles to a small instruction program, and the\n// VM simulates all NFA threads in lockstep over the input, deduping by program\n// counter. Runtime is O(input * program), with no backtracking.\n//\n// Supported (the RE2 subset, which is what ata's native path also accepts):\n// literals, ., character classes, \\d \\w \\s \\D \\W \\S, anchors ^ $, quantifiers\n// * + ? {n} {n,} {n,m} (greedy or lazy, same language for a boolean test),\n// groups ( ) (?: ), alternation |. Backreferences and lookaround are not\n// supported by linear engines; compileSafe throws on them so the caller can\n// decide (ata's codegen rejects such schemas rather than risk a hang).\n\nconst WS = [[9, 13], [32, 32], [160, 160]]\nconst DIGIT = [[48, 57]]\nconst WORD = [[48, 57], [65, 90], [97, 122], [95, 95]]\n\nfunction parse (src) {\n  let i = 0\n  const len = src.length\n  const peek = () => src[i]\n  const eof = () => i >= len\n\n  function parseAlt () {\n    const opts = [parseConcat()]\n    while (!eof() && peek() === '|') { i++; opts.push(parseConcat()) }\n    return opts.length === 1 ? opts[0] : { t: 'alt', opts }\n  }\n\n  function parseConcat () {\n    const parts = []\n    while (!eof() && peek() !== '|' && peek() !== ')') parts.push(parseRepeat())\n    if (parts.length === 0) return { t: 'empty' }\n    return parts.length === 1 ? parts[0] : { t: 'concat', parts }\n  }\n\n  function parseRepeat () {\n    let node = parseAtom()\n    while (!eof()) {\n      const ch = peek()\n      if (ch === '*') { i++; node = { t: 'star', child: node } }\n      else if (ch === '+') { i++; node = { t: 'plus', child: node } }\n      else if (ch === '?') { i++; node = { t: 'quest', child: node } }\n      else if (ch === '{') {\n        const saved = i\n        const q = tryQuantifier()\n        if (!q) { i = saved; break }\n        node = { t: 'repeat', child: node, min: q.min, max: q.max }\n      } else break\n      // a trailing ? makes the quantifier lazy; same language for a boolean test\n      if (!eof() && peek() === '?') i++\n    }\n    return node\n  }\n\n  function tryQuantifier () {\n    // assumes current char is '{'\n    i++\n    let min = ''\n    while (!eof() && /[0-9]/.test(peek())) { min += peek(); i++ }\n    if (min === '') return null\n    let max\n    if (peek() === '}') { i++; return { min: +min, max: +min } }\n    if (peek() === ',') {\n      i++\n      let m = ''\n      while (!eof() && /[0-9]/.test(peek())) { m += peek(); i++ }\n      if (peek() !== '}') return null\n      i++\n      max = m === '' ? Infinity : +m\n      return { min: +min, max }\n    }\n    return null\n  }\n\n  function parseAtom () {\n    const ch = peek()\n    if (ch === '(') {\n      i++\n      if (src[i] === '?') {\n        if (src[i + 1] === ':') { i += 2 }\n        else throw new Error('unsupported group (lookaround/named) in pattern')\n      }\n      const child = parseAlt()\n      if (peek() !== ')') throw new Error('unbalanced ( in pattern')\n      i++\n      return { t: 'group', child }\n    }\n    if (ch === '[') return parseClass()\n    if (ch === '.') { i++; return { t: 'any' } }\n    if (ch === '^') { i++; return { t: 'bol' } }\n    if (ch === '$') { i++; return { t: 'eol' } }\n    if (ch === '\\\\') return parseEscape(false)\n    if (ch === ')' || ch === '|') return { t: 'empty' }\n    i++\n    return { t: 'char', c: ch.charCodeAt(0) }\n  }\n\n  function parseClass () {\n    i++ // [\n    let neg = false\n    if (peek() === '^') { neg = true; i++ }\n    const ranges = []\n    while (!eof() && peek() !== ']') {\n      let lo\n      if (peek() === '\\\\') {\n        const esc = parseEscape(true)\n        if (esc.t === 'classpart') { for (const r of esc.ranges) ranges.push(r); continue }\n        lo = esc.c\n      } else { lo = peek().charCodeAt(0); i++ }\n      if (peek() === '-' && src[i + 1] !== ']' && i + 1 < len) {\n        i++ // -\n        let hi\n        if (peek() === '\\\\') { const e = parseEscape(true); hi = e.c } else { hi = peek().charCodeAt(0); i++ }\n        ranges.push([lo, hi])\n      } else {\n        ranges.push([lo, lo])\n      }\n    }\n    if (peek() !== ']') throw new Error('unbalanced [ in pattern')\n    i++\n    return { t: 'class', neg, ranges }\n  }\n\n  function parseEscape (inClass) {\n    i++ // backslash\n    if (eof()) throw new Error('trailing backslash in pattern')\n    const ch = peek(); i++\n    switch (ch) {\n      case 'd': return inClass ? { t: 'classpart', ranges: DIGIT } : { t: 'class', neg: false, ranges: DIGIT }\n      case 'w': return inClass ? { t: 'classpart', ranges: WORD } : { t: 'class', neg: false, ranges: WORD }\n      case 's': return inClass ? { t: 'classpart', ranges: WS } : { t: 'class', neg: false, ranges: WS }\n      case 'D': if (inClass) throw new Error('\\\\D inside a class is not supported'); return { t: 'class', neg: true, ranges: DIGIT }\n      case 'W': if (inClass) throw new Error('\\\\W inside a class is not supported'); return { t: 'class', neg: true, ranges: WORD }\n      case 'S': if (inClass) throw new Error('\\\\S inside a class is not supported'); return { t: 'class', neg: true, ranges: WS }\n      case 'n': return { t: 'char', c: 10 }\n      case 'r': return { t: 'char', c: 13 }\n      case 't': return { t: 'char', c: 9 }\n      case 'f': return { t: 'char', c: 12 }\n      case 'v': return { t: 'char', c: 11 }\n      case '0': return { t: 'char', c: 0 }\n      case 'x': { const h = src.slice(i, i + 2); i += 2; return { t: 'char', c: parseInt(h, 16) } }\n      case 'u': { const h = src.slice(i, i + 4); i += 4; return { t: 'char', c: parseInt(h, 16) } }\n      case 'b': if (inClass) return { t: 'char', c: 8 }; throw new Error('\\\\b word boundary is not supported')\n      default:\n        if (/[1-9]/.test(ch)) throw new Error('backreferences are not supported in pattern')\n        return { t: 'char', c: ch.charCodeAt(0) }\n    }\n  }\n\n  const ast = parseAlt()\n  if (!eof()) throw new Error('unexpected \"' + peek() + '\" in pattern')\n  return ast\n}\n\nfunction compileProg (ast) {\n  const prog = []\n  const emit = (op, extra) => { const idx = prog.length; prog.push(Object.assign({ op }, extra)); return idx }\n\n  function rec (n) {\n    switch (n.t) {\n      case 'empty': break\n      case 'char': emit('char', { c: n.c }); break\n      case 'any': emit('any'); break\n      case 'class': emit('class', { neg: n.neg, ranges: n.ranges }); break\n      case 'bol': emit('bol'); break\n      case 'eol': emit('eol'); break\n      case 'group': rec(n.child); break\n      case 'concat': for (const p of n.parts) rec(p); break\n      case 'alt': {\n        const jmps = []\n        for (let k = 0; k < n.opts.length; k++) {\n          if (k < n.opts.length - 1) {\n            const sp = emit('split', { x: 0, y: 0 })\n            prog[sp].x = prog.length\n            rec(n.opts[k])\n            jmps.push(emit('jmp', { x: 0 }))\n            prog[sp].y = prog.length\n          } else {\n            rec(n.opts[k])\n          }\n        }\n        for (const j of jmps) prog[j].x = prog.length\n        break\n      }\n      case 'star': {\n        const sp = emit('split', { x: 0, y: 0 })\n        prog[sp].x = prog.length\n        rec(n.child)\n        emit('jmp', { x: sp })\n        prog[sp].y = prog.length\n        break\n      }\n      case 'plus': {\n        const start = prog.length\n        rec(n.child)\n        const sp = emit('split', { x: start, y: 0 })\n        prog[sp].y = prog.length\n        break\n      }\n      case 'quest': {\n        const sp = emit('split', { x: 0, y: 0 })\n        prog[sp].x = prog.length\n        rec(n.child)\n        prog[sp].y = prog.length\n        break\n      }\n      case 'repeat': {\n        for (let k = 0; k < n.min; k++) rec(n.child)\n        if (n.max === Infinity) {\n          if (n.min === 0) rec({ t: 'star', child: n.child })\n          else rec({ t: 'star', child: n.child })\n        } else {\n          for (let k = 0; k < n.max - n.min; k++) rec({ t: 'quest', child: n.child })\n        }\n        break\n      }\n    }\n  }\n\n  rec(ast)\n  emit('match')\n  return prog\n}\n\nfunction matchClass (instr, c) {\n  let inside = false\n  const r = instr.ranges\n  for (let k = 0; k < r.length; k++) { if (c >= r[k][0] && c <= r[k][1]) { inside = true; break } }\n  return instr.neg ? !inside : inside\n}\n\nfunction makeRunner (prog) {\n  const n = prog.length\n  const lastGen = new Int32Array(n).fill(-1)\n  let gen = 0\n  const stack = []\n\n  function addThread (list, pc, pos, len) {\n    stack.length = 0\n    stack.push(pc)\n    while (stack.length) {\n      const p = stack.pop()\n      if (lastGen[p] === gen) continue\n      lastGen[p] = gen\n      const I = prog[p]\n      switch (I.op) {\n        case 'jmp': stack.push(I.x); break\n        case 'split': stack.push(I.y); stack.push(I.x); break\n        case 'bol': if (pos === 0) stack.push(p + 1); break\n        case 'eol': if (pos === len) stack.push(p + 1); break\n        default: list.push(p)\n      }\n    }\n  }\n\n  return function test (s) {\n    const len = s.length\n    let clist = []\n    let nlist = []\n    gen++\n    addThread(clist, 0, 0, len)\n    for (let pos = 0; pos <= len; pos++) {\n      const c = pos < len ? s.charCodeAt(pos) : -1\n      gen++\n      nlist.length = 0\n      for (let k = 0; k < clist.length; k++) {\n        const pc = clist[k]\n        const I = prog[pc]\n        if (I.op === 'match') return true\n        else if (I.op === 'char') { if (c === I.c) addThread(nlist, pc + 1, pos + 1, len) }\n        else if (I.op === 'any') { if (c !== -1 && c !== 10) addThread(nlist, pc + 1, pos + 1, len) }\n        else if (I.op === 'class') { if (c !== -1 && matchClass(I, c)) addThread(nlist, pc + 1, pos + 1, len) }\n      }\n      if (pos < len) addThread(nlist, 0, pos + 1, len)\n      const tmp = clist; clist = nlist; nlist = tmp\n    }\n    return false\n  }\n}\n\nfunction compileSafe (pattern) {\n  const prog = compileProg(parse(pattern))\n  const runner = makeRunner(prog)\n  // `__ataSafe` brands the result so the standalone serializer can tell a safe\n  // matcher apart from a RegExp and emit `__ataSafeRe(source)` instead.\n  return { test: runner, source: pattern, __ataSafe: true }\n}\n\n// True when the linear engine can represent `src`. Used by the codegen to decide\n// between the safe matcher and a JS RegExp fallback for patterns outside the\n// supported (RE2) subset (backreferences, lookaround, etc.).\nfunction patternIsSafe (src) {\n  try { compileSafe(src); return true } catch { return false }\n}\n\nmodule.exports = { compileSafe, patternIsSafe }\n";
+module.exports = "'use strict'\n\n// Linear-time regex engine for JSON Schema `pattern`, used in place of JS RegExp\n// so an adversarial input cannot trigger catastrophic backtracking (ReDoS).\n//\n// It is a Pike VM: the pattern compiles to a small instruction program, and the\n// VM simulates all NFA threads in lockstep over the input, deduping by program\n// counter. Runtime is O(input * program), with no backtracking.\n//\n// Supported (the RE2 subset, which is what ata's native path also accepts):\n// literals, ., character classes, \\d \\w \\s \\D \\W \\S, anchors ^ $, quantifiers\n// * + ? {n} {n,} {n,m} (greedy or lazy, same language for a boolean test),\n// groups ( ) (?: ), alternation |. Backreferences and lookaround are not\n// supported by linear engines; compileSafe throws on them so the caller can\n// decide (ata's codegen rejects such schemas rather than risk a hang).\n\nconst WS = [[9, 13], [32, 32], [160, 160]]\nconst DIGIT = [[48, 57]]\nconst WORD = [[48, 57], [65, 90], [97, 122], [95, 95]]\n\nfunction parse (src) {\n  let i = 0\n  const len = src.length\n  const peek = () => src[i]\n  const eof = () => i >= len\n\n  function parseAlt () {\n    const opts = [parseConcat()]\n    while (!eof() && peek() === '|') { i++; opts.push(parseConcat()) }\n    return opts.length === 1 ? opts[0] : { t: 'alt', opts }\n  }\n\n  function parseConcat () {\n    const parts = []\n    while (!eof() && peek() !== '|' && peek() !== ')') parts.push(parseRepeat())\n    if (parts.length === 0) return { t: 'empty' }\n    return parts.length === 1 ? parts[0] : { t: 'concat', parts }\n  }\n\n  function parseRepeat () {\n    let node = parseAtom()\n    while (!eof()) {\n      const ch = peek()\n      if (ch === '*') { i++; node = { t: 'star', child: node } }\n      else if (ch === '+') { i++; node = { t: 'plus', child: node } }\n      else if (ch === '?') { i++; node = { t: 'quest', child: node } }\n      else if (ch === '{') {\n        const saved = i\n        const q = tryQuantifier()\n        if (!q) { i = saved; break }\n        node = { t: 'repeat', child: node, min: q.min, max: q.max }\n      } else break\n      // a trailing ? makes the quantifier lazy; same language for a boolean test\n      if (!eof() && peek() === '?') i++\n    }\n    return node\n  }\n\n  function tryQuantifier () {\n    // assumes current char is '{'\n    i++\n    let min = ''\n    while (!eof() && /[0-9]/.test(peek())) { min += peek(); i++ }\n    if (min === '') return null\n    let max\n    if (peek() === '}') { i++; return { min: +min, max: +min } }\n    if (peek() === ',') {\n      i++\n      let m = ''\n      while (!eof() && /[0-9]/.test(peek())) { m += peek(); i++ }\n      if (peek() !== '}') return null\n      i++\n      max = m === '' ? Infinity : +m\n      return { min: +min, max }\n    }\n    return null\n  }\n\n  function parseAtom () {\n    const ch = peek()\n    if (ch === '(') {\n      i++\n      if (src[i] === '?') {\n        if (src[i + 1] === ':') { i += 2 }\n        else throw new Error('unsupported group (lookaround/named) in pattern')\n      }\n      const child = parseAlt()\n      if (peek() !== ')') throw new Error('unbalanced ( in pattern')\n      i++\n      return { t: 'group', child }\n    }\n    if (ch === '[') return parseClass()\n    if (ch === '.') { i++; return { t: 'any' } }\n    if (ch === '^') { i++; return { t: 'bol' } }\n    if (ch === '$') { i++; return { t: 'eol' } }\n    if (ch === '\\\\') return parseEscape(false)\n    if (ch === ')' || ch === '|') return { t: 'empty' }\n    i++\n    return { t: 'char', c: ch.charCodeAt(0) }\n  }\n\n  function parseClass () {\n    i++ // [\n    let neg = false\n    if (peek() === '^') { neg = true; i++ }\n    const ranges = []\n    while (!eof() && peek() !== ']') {\n      let lo\n      if (peek() === '\\\\') {\n        const esc = parseEscape(true)\n        if (esc.t === 'classpart') { for (const r of esc.ranges) ranges.push(r); continue }\n        lo = esc.c\n      } else { lo = peek().charCodeAt(0); i++ }\n      if (peek() === '-' && src[i + 1] !== ']' && i + 1 < len) {\n        i++ // -\n        let hi\n        if (peek() === '\\\\') { const e = parseEscape(true); hi = e.c } else { hi = peek().charCodeAt(0); i++ }\n        ranges.push([lo, hi])\n      } else {\n        ranges.push([lo, lo])\n      }\n    }\n    if (peek() !== ']') throw new Error('unbalanced [ in pattern')\n    i++\n    return { t: 'class', neg, ranges }\n  }\n\n  function parseEscape (inClass) {\n    i++ // backslash\n    if (eof()) throw new Error('trailing backslash in pattern')\n    const ch = peek(); i++\n    switch (ch) {\n      case 'd': return inClass ? { t: 'classpart', ranges: DIGIT } : { t: 'class', neg: false, ranges: DIGIT }\n      case 'w': return inClass ? { t: 'classpart', ranges: WORD } : { t: 'class', neg: false, ranges: WORD }\n      case 's': return inClass ? { t: 'classpart', ranges: WS } : { t: 'class', neg: false, ranges: WS }\n      case 'D': if (inClass) throw new Error('\\\\D inside a class is not supported'); return { t: 'class', neg: true, ranges: DIGIT }\n      case 'W': if (inClass) throw new Error('\\\\W inside a class is not supported'); return { t: 'class', neg: true, ranges: WORD }\n      case 'S': if (inClass) throw new Error('\\\\S inside a class is not supported'); return { t: 'class', neg: true, ranges: WS }\n      case 'n': return { t: 'char', c: 10 }\n      case 'r': return { t: 'char', c: 13 }\n      case 't': return { t: 'char', c: 9 }\n      case 'f': return { t: 'char', c: 12 }\n      case 'v': return { t: 'char', c: 11 }\n      case '0': return { t: 'char', c: 0 }\n      case 'x': { const h = src.slice(i, i + 2); i += 2; return { t: 'char', c: parseInt(h, 16) } }\n      case 'u': { const h = src.slice(i, i + 4); i += 4; return { t: 'char', c: parseInt(h, 16) } }\n      case 'b': if (inClass) return { t: 'char', c: 8 }; throw new Error('\\\\b word boundary is not supported')\n      default:\n        if (/[1-9]/.test(ch)) throw new Error('backreferences are not supported in pattern')\n        return { t: 'char', c: ch.charCodeAt(0) }\n    }\n  }\n\n  const ast = parseAlt()\n  if (!eof()) throw new Error('unexpected \"' + peek() + '\" in pattern')\n  return ast\n}\n\nfunction compileProg (ast) {\n  const prog = []\n  const emit = (op, extra) => { const idx = prog.length; prog.push(Object.assign({ op }, extra)); return idx }\n\n  function rec (n) {\n    switch (n.t) {\n      case 'empty': break\n      case 'char': emit('char', { c: n.c }); break\n      case 'any': emit('any'); break\n      case 'class': emit('class', { neg: n.neg, ranges: n.ranges }); break\n      case 'bol': emit('bol'); break\n      case 'eol': emit('eol'); break\n      case 'group': rec(n.child); break\n      case 'concat': for (const p of n.parts) rec(p); break\n      case 'alt': {\n        const jmps = []\n        for (let k = 0; k < n.opts.length; k++) {\n          if (k < n.opts.length - 1) {\n            const sp = emit('split', { x: 0, y: 0 })\n            prog[sp].x = prog.length\n            rec(n.opts[k])\n            jmps.push(emit('jmp', { x: 0 }))\n            prog[sp].y = prog.length\n          } else {\n            rec(n.opts[k])\n          }\n        }\n        for (const j of jmps) prog[j].x = prog.length\n        break\n      }\n      case 'star': {\n        const sp = emit('split', { x: 0, y: 0 })\n        prog[sp].x = prog.length\n        rec(n.child)\n        emit('jmp', { x: sp })\n        prog[sp].y = prog.length\n        break\n      }\n      case 'plus': {\n        const start = prog.length\n        rec(n.child)\n        const sp = emit('split', { x: start, y: 0 })\n        prog[sp].y = prog.length\n        break\n      }\n      case 'quest': {\n        const sp = emit('split', { x: 0, y: 0 })\n        prog[sp].x = prog.length\n        rec(n.child)\n        prog[sp].y = prog.length\n        break\n      }\n      case 'repeat': {\n        for (let k = 0; k < n.min; k++) rec(n.child)\n        if (n.max === Infinity) {\n          if (n.min === 0) rec({ t: 'star', child: n.child })\n          else rec({ t: 'star', child: n.child })\n        } else {\n          for (let k = 0; k < n.max - n.min; k++) rec({ t: 'quest', child: n.child })\n        }\n        break\n      }\n    }\n  }\n\n  rec(ast)\n  emit('match')\n  return prog\n}\n\n// Numeric opcodes for the runner. The program is compiled once into flat\n// typed arrays so the inner loop does no property lookups or string compares.\nconst OP_CHAR = 0\nconst OP_ANY = 1\nconst OP_CLASS = 2\nconst OP_SPLIT = 3\nconst OP_JMP = 4\nconst OP_BOL = 5\nconst OP_EOL = 6\nconst OP_MATCH = 7\n\nfunction classMatcher (instr) {\n  // ASCII is answered from a bitmap; anything above 0x7f walks the ranges.\n  const bits = new Uint8Array(128)\n  const r = instr.ranges\n  for (let k = 0; k < r.length; k++) {\n    const hi = Math.min(r[k][1], 127)\n    for (let c = r[k][0]; c <= hi; c++) bits[c] = 1\n  }\n  return { bits, ranges: r, neg: instr.neg }\n}\n\nfunction matchClass (cls, c) {\n  let inside\n  if (c < 128) {\n    inside = cls.bits[c] === 1\n  } else {\n    inside = false\n    const r = cls.ranges\n    for (let k = 0; k < r.length; k++) { if (c >= r[k][0] && c <= r[k][1]) { inside = true; break } }\n  }\n  return cls.neg ? !inside : inside\n}\n\nfunction makeRunner (prog) {\n  const n = prog.length\n  const ops = new Uint8Array(n)\n  const xs = new Int32Array(n)\n  const ys = new Int32Array(n)\n  const cs = new Int32Array(n)\n  const classes = new Array(n)\n  for (let i = 0; i < n; i++) {\n    const I = prog[i]\n    switch (I.op) {\n      case 'char': ops[i] = OP_CHAR; cs[i] = I.c; break\n      case 'any': ops[i] = OP_ANY; break\n      case 'class': ops[i] = OP_CLASS; classes[i] = classMatcher(I); break\n      case 'split': ops[i] = OP_SPLIT; xs[i] = I.x; ys[i] = I.y; break\n      case 'jmp': ops[i] = OP_JMP; xs[i] = I.x; break\n      case 'bol': ops[i] = OP_BOL; break\n      case 'eol': ops[i] = OP_EOL; break\n      case 'match': ops[i] = OP_MATCH; break\n    }\n  }\n\n  const lastGen = new Int32Array(n).fill(-1)\n  let gen = 0\n  // Each unvisited instruction is popped once and pushes at most two, so the\n  // stack never holds more than 2n + 1 entries.\n  const stack = new Int32Array(2 * n + 2)\n  // Thread lists hold at most one entry per instruction per step.\n  let clist = new Int32Array(n)\n  let nlist = new Int32Array(n)\n  let clen = 0\n  let nlen = 0\n\n  // Follows epsilon edges from `pc` and records every consuming instruction\n  // (or match) reached in `list`. `lastGen` dedupes per step.\n  function addThread (list, len0, pc, pos, len) {\n    // Most transitions land directly on a consuming instruction; skip the\n    // stack walk for those.\n    if (ops[pc] <= OP_CLASS || ops[pc] === OP_MATCH) {\n      if (lastGen[pc] === gen) return len0\n      lastGen[pc] = gen\n      list[len0] = pc\n      return len0 + 1\n    }\n    let sp = 0\n    stack[sp++] = pc\n    let count = len0\n    while (sp > 0) {\n      const p = stack[--sp]\n      if (lastGen[p] === gen) continue\n      lastGen[p] = gen\n      switch (ops[p]) {\n        case OP_JMP: stack[sp++] = xs[p]; break\n        case OP_SPLIT: stack[sp++] = ys[p]; stack[sp++] = xs[p]; break\n        case OP_BOL: if (pos === 0) stack[sp++] = p + 1; break\n        case OP_EOL: if (pos === len) stack[sp++] = p + 1; break\n        default: list[count++] = p\n      }\n    }\n    return count\n  }\n\n  // A pattern is anchored when starting it anywhere but position 0 yields no\n  // thread, which is the case for `^...` and its alternations. The probe sits\n  // at position 1 of a length-1 string so that only `^` can fail. For anchored\n  // patterns the per-position restart below is skipped, and an empty thread\n  // list means the match has already failed.\n  gen++\n  const anchored = addThread(nlist, 0, 0, 1, 1) === 0\n\n  function testNFA (s) {\n    const len = s.length\n    gen++\n    clen = addThread(clist, 0, 0, 0, len)\n    for (let pos = 0; pos <= len; pos++) {\n      const c = pos < len ? s.charCodeAt(pos) : -1\n      gen++\n      nlen = 0\n      for (let k = 0; k < clen; k++) {\n        const pc = clist[k]\n        switch (ops[pc]) {\n          case OP_MATCH: return true\n          case OP_CHAR: if (c === cs[pc]) nlen = addThread(nlist, nlen, pc + 1, pos + 1, len); break\n          case OP_ANY: if (c !== -1 && c !== 10) nlen = addThread(nlist, nlen, pc + 1, pos + 1, len); break\n          case OP_CLASS: if (c !== -1 && matchClass(classes[pc], c)) nlen = addThread(nlist, nlen, pc + 1, pos + 1, len); break\n        }\n      }\n      if (pos < len) {\n        if (!anchored) nlen = addThread(nlist, nlen, 0, pos + 1, len)\n        else if (nlen === 0) return false\n      }\n      const tmp = clist; clist = nlist; nlist = tmp\n      clen = nlen\n    }\n    return false\n  }\n\n  // Lazy DFA on top of the NFA. A DFA state is the set of consuming\n  // instructions live at a position; transitions are computed on first use\n  // and cached per ASCII character. `^` and `$` depend on position, so the\n  // closure is taken with flags for \"at start\" and \"at end\", which gives two\n  // start states and two transition tables per state. The state count is\n  // capped; past the cap the matcher falls back to the NFA walk above, so the\n  // time bound stays linear either way.\n  const MAX_STATES = 256\n  const states = []\n  const stateIds = new Map()\n  let overflow = false\n\n  function closure (list, count, pc, atStart, atEnd) {\n    // Same walk as addThread, with the position replaced by the two flags.\n    let sp = 0\n    stack[sp++] = pc\n    while (sp > 0) {\n      const p = stack[--sp]\n      if (lastGen[p] === gen) continue\n      lastGen[p] = gen\n      switch (ops[p]) {\n        case OP_JMP: stack[sp++] = xs[p]; break\n        case OP_SPLIT: stack[sp++] = ys[p]; stack[sp++] = xs[p]; break\n        case OP_BOL: if (atStart) stack[sp++] = p + 1; break\n        case OP_EOL: if (atEnd) stack[sp++] = p + 1; break\n        default: list[count++] = p\n      }\n    }\n    return count\n  }\n\n  function internState (list, count) {\n    const pcs = Array.from(list.subarray(0, count)).sort((a, b) => a - b)\n    const key = pcs.join(',')\n    let id = stateIds.get(key)\n    if (id !== undefined) return id\n    if (states.length >= MAX_STATES) { overflow = true; return -1 }\n    id = states.length\n    let isMatch = false\n    for (let k = 0; k < pcs.length; k++) if (ops[pcs[k]] === OP_MATCH) { isMatch = true; break }\n    states.push({ pcs: Int32Array.from(pcs), isMatch, next: new Int32Array(128).fill(-2), nextEnd: new Int32Array(128).fill(-2) })\n    stateIds.set(key, id)\n    return id\n  }\n\n  function step (state, c, atEnd) {\n    gen++\n    let count = 0\n    const pcs = state.pcs\n    for (let k = 0; k < pcs.length; k++) {\n      const pc = pcs[k]\n      switch (ops[pc]) {\n        case OP_CHAR: if (c === cs[pc]) count = closure(nlist, count, pc + 1, false, atEnd); break\n        case OP_ANY: if (c !== 10) count = closure(nlist, count, pc + 1, false, atEnd); break\n        case OP_CLASS: if (matchClass(classes[pc], c)) count = closure(nlist, count, pc + 1, false, atEnd); break\n      }\n    }\n    if (!anchored) count = closure(nlist, count, 0, false, atEnd)\n    return internState(nlist, count)\n  }\n\n  let startEmpty = -2\n  let startNonEmpty = -2\n\n  function startState (atEnd) {\n    gen++\n    const count = closure(nlist, 0, 0, true, atEnd)\n    return internState(nlist, count)\n  }\n\n  function testDFA (s) {\n    const len = s.length\n    let id\n    if (len === 0) {\n      if (startEmpty === -2) startEmpty = startState(true)\n      id = startEmpty\n    } else {\n      if (startNonEmpty === -2) startNonEmpty = startState(false)\n      id = startNonEmpty\n    }\n    if (id < 0) return testNFA(s)\n    let state = states[id]\n    for (let pos = 0; pos < len; pos++) {\n      if (state.isMatch) return true\n      const c = s.charCodeAt(pos)\n      const atEnd = pos + 1 === len\n      let nid\n      if (c < 128) {\n        const table = atEnd ? state.nextEnd : state.next\n        nid = table[c]\n        if (nid === -2) { nid = step(state, c, atEnd); table[c] = nid }\n      } else {\n        nid = step(state, c, atEnd)\n      }\n      if (nid < 0) return testNFA(s)\n      state = states[nid]\n      if (anchored && state.pcs.length === 0) return false\n    }\n    return state.isMatch\n  }\n\n  return function test (s) {\n    return overflow ? testNFA(s) : testDFA(s)\n  }\n}\n\nfunction compileSafe (pattern) {\n  const prog = compileProg(parse(pattern))\n  const runner = makeRunner(prog)\n  // `__ataSafe` brands the result so the standalone serializer can tell a safe\n  // matcher apart from a RegExp and emit `__ataSafeRe(source)` instead.\n  return { test: runner, source: pattern, __ataSafe: true }\n}\n\n// True when the linear engine can represent `src`. Used by the codegen to decide\n// between the safe matcher and a JS RegExp fallback for patterns outside the\n// supported (RE2) subset (backreferences, lookaround, etc.).\nfunction patternIsSafe (src) {\n  try { compileSafe(src); return true } catch { return false }\n}\n\nmodule.exports = { compileSafe, patternIsSafe }\n";