ata-validator 1.61.2 → 1.62.0

package/lib/native-attach.js

@@ -0,0 +1,76 @@
+'use strict';
+
+// Sets up the native engine for one validator: its compiled schema and its
+// slot in the addon's fast registry, which the buffer APIs read. Kept out of
+// lib/validator-core.js so the browser build, which has no addon, maps this
+// file to lib/native-attach.browser.js and leaves it out.
+function attachNative(self, native) {
+  if (!native) return;
+  if (!self._schemaStr) self._schemaStr = JSON.stringify(self._schemaObj);
+  let nativeSchemaStr = self._schemaStr;
+  // A boolean root references nothing, so the registry has nowhere to go and
+  // is left out; merging it used to throw on `true` and `false`.
+  if (self._schemaMap.size > 0 && typeof self._schemaObj === 'object' && self._schemaObj !== null) {
+    const merged = JSON.parse(self._schemaStr);
+    if (!merged.$defs) merged.$defs = {};
+    // The registry goes into $defs under generated names. A name the
+    // schema already uses, or two ids that flatten to one name, would put
+    // one schema where another is referenced; the native engine is then
+    // left out and the JS engines answer.
+    for (const [id, s] of self._schemaMap) {
+      const name = '__ext_' + id.replace(/[^a-zA-Z0-9]/g, '_');
+      if (Object.prototype.hasOwnProperty.call(merged.$defs, name)) { self._fastSlot = -1; return; }
+      merged.$defs[name] = s;
+    }
+    nativeSchemaStr = JSON.stringify(merged);
+  }
+  // The fast registry is a fixed array of slots in the addon, and registering
+  // a distinct schema past the last one throws. It is an accelerator for the
+  // buffer path, not a requirement, so a full registry leaves the slot at -1
+  // and the buffer methods answer from the JS engine instead. Letting this
+  // throw made every validator built after the 4096th unusable on that path.
+  // A schema the native engine declines to compile (a pattern RE2 cannot
+  // take) goes the same way.
+  try {
+    self._compiled = new native.CompiledSchema(nativeSchemaStr);
+    self._fastSlot = native.fastRegister(nativeSchemaStr);
+  } catch {
+    self._compiled = null;
+    self._fastSlot = -1;
+  }
+}
+
+// The buffer APIs on the native engine's fast slot, or through validate()
+// for the shapes lib/buffer-gate.js routes and a validator with no slot.
+function installFast(self, native, bufferNeedsSlowPath, installSlowBufferApis) {
+  if (bufferNeedsSlowPath(self._schemaObj, self._schemaMap, self._keywords, self._userFormats)) return installSlowBufferApis(self);
+  self._ensureNative();
+  const slot = self._fastSlot;
+  if (!(slot >= 0)) return installSlowBufferApis(self);
+  const bytes = (b, who) => {
+    if (typeof b === 'string') return Buffer.from(b);
+    if (b instanceof Uint8Array) return b;
+    throw new TypeError(`${who}() requires a Buffer, Uint8Array, or string. For parsed objects, use isValidObject().`);
+  };
+  self.isValid = (b) => native.rawFastValidate(slot, bytes(b, 'isValid'));
+  self.isValidPrepadded = (paddedBuffer, jsonLength) => native.rawFastValidate(slot, paddedBuffer, jsonLength);
+  self.isValidParallel = (b) => native.rawParallelValidate(slot, bytes(b, 'isValidParallel'));
+  self.isValidNDJSON = (b) => native.rawNDJSONValidate(slot, bytes(b, 'isValidNDJSON'));
+  self.countValid = (b) => {
+    const r = native.rawNDJSONValidate(slot, bytes(b, 'countValid'));
+    let n = 0;
+    for (let i = 0; i < r.length; i++) if (r[i]) n++;
+    return n;
+  };
+  self.batchIsValid = (buffers) => {
+    let n = 0;
+    for (const b of buffers) {
+      if (!(b instanceof Uint8Array)) throw new TypeError('batchIsValid() requires Buffer or Uint8Array elements');
+      if (native.rawFastValidate(slot, b)) n++;
+    }
+    return n;
+  };
+}
+
+attachNative.installFast = installFast;
+module.exports = attachNative;

package/lib/native-positions.js

@@ -37,6 +37,13 @@ function nativeTargeted (text, wanted) {
     const off = offs[k];
     const at = lineOf(off);
     const entry = { byteOffset: off, length: found[2 * k + 1], line: at.line, col: off - at.start + 1, text: at.text };
+    // A long line is cut around the value, as in lib/data-positions.js.
+    if (entry.text.length > 200) {
+      let s = entry.col > 61 ? entry.col - 61 : 0;
+      if (s + 200 > entry.text.length) s = entry.text.length - 200;
+      entry.text = entry.text.slice(s, s + 200);
+      entry.textCol = entry.col - s;
+    }
     const ks = keyStartBefore(text, off);
     if (ks >= 0 && ptrs[k] !== '') {
       const kat = lineOf(ks);

package/lib/plan-compiler.js

@@ -530,9 +530,15 @@ function install(deps) {
       // lookup, and most schemas declare a handful.
       const propKeys = props !== null ? [...props.keys()] : null;
       // req: the key is also required, so holding undefined it is missing.
+      // Flagged only when the leaf folded `required` into this walk
+      // (reqFolded in compileLeafV). With an undeclared required name the
+      // leaf checks every required key itself, and a flag here would be
+      // counted against a total of zero, so a document with the key was
+      // refused until the closure plan replaced this one.
       const reqIn = P.requiredInProps;
+      const reqWalked = P.required !== null && P.requiredUndef === null && reqIn !== null;
       const propList = props !== null
-        ? [...props].map(([key, entry]) => ({ fn: child(entry.node), seg: entry.seg, schemaSeg: entry.schemaSeg, req: reqIn !== null && reqIn.has(key) }))
+        ? [...props].map(([key, entry]) => ({ fn: child(entry.node), seg: entry.seg, schemaSeg: entry.schemaSeg, req: reqWalked && reqIn.has(key) }))
         : null;
       const propMap = props !== null && props.size > 8 ? new Map(propKeys.map((k, i) => [k, propList[i]])) : null;
       const lookup = propMap !== null

package/lib/regex-linear.js

@@ -290,8 +290,96 @@ function delimitedLoopRule (ast) {
   return run(suffix)
 }
 
+// A Unicode property escape, `\p{L}` or `\P{Nd}`, read as one class so the
+// rules above can judge a pattern that uses one: exact on ASCII, where the
+// platform answers for each of the 128 characters, and taken to match
+// everything above it, which is the conservative side (an overlap that is
+// not there only declines the pattern). The class is written back into the
+// pattern as ranges, in brackets outside a class and bare inside one, and
+// the result parsed as any other pattern. A pattern the platform refuses
+// in unicode mode is declined: without the flag `\p{L}` is the letters p,
+// {, L, }, and the generators write such a pattern with the flag only when
+// it is valid with it.
+const PROP_ESCAPE = /\\[pP]\{/
+const _propRanges = new Map()
+function propRanges (esc) {
+  let out = _propRanges.get(esc)
+  if (out !== undefined) return out
+  const re = new RegExp(esc, 'u')
+  const hex = (c) => '\\u' + c.toString(16).padStart(4, '0')
+  out = ''
+  for (let c = 0; c < 128; c++) {
+    if (!re.test(String.fromCharCode(c))) continue
+    let d = c
+    while (d + 1 < 128 && re.test(String.fromCharCode(d + 1))) d++
+    out += d === c ? hex(c) : hex(c) + '-' + hex(d)
+    c = d
+  }
+  _propRanges.set(esc, out)
+  return out
+}
+function expandPropertyEscapes (src) {
+  try { new RegExp(src, 'u') } catch { return null }
+  let out = ''
+  let inClass = false
+  let negated = false
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i]
+    if (c === '\\') {
+      const e = src[i + 1]
+      if ((e === 'p' || e === 'P') && src[i + 2] === '{') {
+        const close = src.indexOf('}', i + 3)
+        if (close < 0) return null
+        const ascii = propRanges(src.slice(i, close + 1))
+        // Everything above ASCII is taken to match, except inside a negated
+        // class, where adding it would take it away: there the ASCII part
+        // alone is written, and the class keeps every character above.
+        if (!inClass) out += '[' + ascii + '\\u0080-\\uffff]'
+        else out += negated ? ascii : ascii + '\\u0080-\\uffff'
+        i = close
+        continue
+      }
+      out += c + (e === undefined ? '' : e)
+      i++
+      continue
+    }
+    if (c === '[' && !inClass) { inClass = true; negated = src[i + 1] === '^' }
+    else if (c === ']' && inClass) inClass = false
+    out += c
+  }
+  // A negated class left with nothing in it, `[^]`, would read as any
+  // character; the parser may not take that form, so such a pattern declines.
+  if (/\[\^\]/.test(out)) return null
+  return out
+}
+
+// A pattern with no `$` that ends in a greedy loop over one character class
+// (`\p{L}+`, the usual patternProperties key) is tested for a match anywhere:
+// the loop takes what it can and the match succeeds, so it never backtracks
+// into the loop, and for test() `X+` at the end costs what `X` costs and `X*`
+// costs nothing. The rules above refuse an unanchored loop, so such a key
+// went to the interpreted engine for want of a linear-time reading. Applied
+// to patterns with a property escape only, which have no other engine to go
+// to; the rest keep their current routing.
+const TRAILING_LOOP = /(\[(?:\\.|[^\]\\])*\]|\\[dDwWsS]|\.)([+*])$/
+function dropTrailingLoop (src) {
+  if (src.endsWith('$')) return src
+  const m = TRAILING_LOOP.exec(src)
+  if (!m) return src
+  // The atom must start at a real class or escape, not inside an escape.
+  let bs = 0
+  for (let i = m.index - 1; i >= 0 && src[i] === '\\'; i--) bs++
+  if (bs % 2) return src
+  return src.slice(0, m.index) + (m[2] === '+' ? m[1] : '')
+}
+
 function nativeIsLinear (src) {
   if (typeof src !== 'string' || src.length > 512) return false
+  if (PROP_ESCAPE.test(src)) {
+    src = expandPropertyEscapes(src)
+    if (src === null) return false
+    src = dropTrailingLoop(src)
+  }
   for (let i = 0; i < src.length; i++) {
     const c = src.charCodeAt(i)
     if (c >= 0xd800 && c <= 0xdfff) return false

package/lib/rejections.js

@@ -226,9 +226,19 @@ function sortErrorsBySchemaOrder(rootSchema, errors) {
     prevPath = e.schemaPath;
   }
   if (sorted) return errors;
-  // Error lists are short. A stable insertion sort over the integer keys
-  // moves the errors in tandem with no index array; equal keys fall back to
-  // the rank only when the paths differ.
+  // Error lists are usually short. A stable insertion sort over the integer
+  // keys moves the errors in tandem with no index array; equal keys fall back
+  // to the rank only when the paths differ. It is quadratic, though: 20000
+  // errors out of order took seconds. Past a short list the platform's sort,
+  // which is stable, orders an index array by the same comparison.
+  if (n > 32) {
+    const idx = new Array(n);
+    for (let i = 0; i < n; i++) idx[i] = i;
+    idx.sort((a, b) => (keys[a] - keys[b]) || (keys[a] === keys[b] && errors[a].schemaPath !== errors[b].schemaPath ? tieOrder(rootSchema, errors[a].schemaPath, errors[b].schemaPath) : 0) || a - b);
+    const res = new Array(n);
+    for (let i = 0; i < n; i++) res[i] = errors[idx[i]];
+    return res;
+  }
   const out = errors.slice();
   for (let i = 1; i < n; i++) {
     const k = keys[i];

package/lib/render-compact.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { color, ANSI, resolveColor, trimCwd } = require('./render-shared');
-const { toDiagnostics } = require('./diagnose');
+const { toDiagnostics, term } = require('./diagnose');
 
 const { getDiagnosticSource } = require('./diagnostic-source');
 
@@ -19,12 +19,12 @@ function renderCompact (errors, opts) {
     let prefix = '';
     const raw = d.mergedFrom[0];
     if (raw && raw.schemaSource) {
-      const f = trimCwd(raw.schemaSource.file, cwd);
+      const f = term(trimCwd(raw.schemaSource.file, cwd));
       prefix = color(useColor, ANSI.cyan, `${f}:${raw.schemaSource.line}:${raw.schemaSource.col}`) + ' - ';
     }
-    const codeStr = color(useColor, ANSI.red + ANSI.bold, d.code ? `error ${d.code}` : 'error');
+    const codeStr = color(useColor, ANSI.red + ANSI.bold, d.code ? `error ${term(d.code)}` : 'error');
     const pathStr = color(useColor, ANSI.cyan, d.dotted);
-    const got = raw && raw.received != null ? `got ${raw.received}` : '';
+    const got = raw && raw.received != null ? `got ${term(String(raw.received))}` : '';
     const sugg = d.help ? color(useColor, ANSI.yellow, `, ${d.help}`) : '';
     const tail = got || sugg ? ` (${got}${sugg})` : '';
     lines.push(`${prefix}${codeStr}: ${pathStr} ${d.headline}${tail}`);
@@ -33,7 +33,7 @@ function renderCompact (errors, opts) {
   const n = errors.length;
   const shown = diags.length;
   lines.push('');
-  let summary = `Found ${n} error${n === 1 ? '' : 's'} in ${opts.context || 'input'}`;
+  let summary = `Found ${n} error${n === 1 ? '' : 's'} in ${term(opts.context || 'input')}`;
   if (shown !== n) summary += `, shown as ${shown} diagnostic${shown === 1 ? '' : 's'}`;
   lines.push(summary + '.');
   if (!(typeof process !== 'undefined' && process.stdout && process.stdout.isTTY)) {

package/lib/render-pretty.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { color, ANSI, resolveColor, trimCwd, truncateLine, terminalWidth } = require('./render-shared');
-const { toDiagnostics } = require('./diagnose');
+const { toDiagnostics, term, termLine } = require('./diagnose');
 
 const { getDiagnosticSource } = require('./diagnostic-source');
 
@@ -14,6 +14,18 @@ function sourceFor (errors, opts) {
 // Never wider than the terminal. The old form repeated the caret for the
 // full span of the value, which for a root-level error was the whole
 // document drawn under a one-character line.
+// The part of a long line around the caret that fits the terminal, and the
+// caret's column in it. Cut from the start alone, a value past the terminal
+// width had its caret drawn beyond the end of the text.
+function windowAround (text, col, max) {
+  if (!text || text.length <= max) return { text, col };
+  const s = Math.max(0, Math.min(col - 1 - Math.floor(max / 3), text.length - max));
+  let t = text.slice(s, s + max);
+  if (s > 0) t = '\u2026' + t.slice(1);
+  if (s + max < text.length) t = t.slice(0, -1) + '\u2026';
+  return { text: t, col: col - s };
+}
+
 function caretLine (col, length, gutter) {
   const pad = ' '.repeat(gutter);
   const lead = ' '.repeat(Math.max(0, col - 1));
@@ -29,7 +41,7 @@ const NO_SUFFIX = new Set(['additionalProperties', 'unevaluatedProperties', 'une
 function caretSuffix (d, raw, useColor) {
   if (!raw) return '';
   if (raw.keyword === 'required') {
-    return raw.expected ? '  ' + color(useColor, ANSI.dim, `expected ${raw.expected}`) : '';
+    return raw.expected ? '  ' + color(useColor, ANSI.dim, `expected ${term(raw.expected)}`) : '';
   }
   // A composition error anchored inside the closest branch has a value there.
   if (d.found != null && (raw.keyword === 'oneOf' || raw.keyword === 'anyOf')) {
@@ -50,7 +62,7 @@ function renderOne (d, useColor, opts) {
 
   // Headline carries the code when there is one. A code-less error, which the
   // LazyRejection fallback can produce, must not render as "error[undefined]".
-  const label = d.code ? `error[${d.code}]: ` : 'error: ';
+  const label = d.code ? `error[${term(d.code)}]: ` : 'error: ';
   lines.push(color(useColor, ANSI.red + ANSI.bold, label) + d.headline);
 
   // Schema source frame, when the Validator was built with a `source` option.
@@ -59,12 +71,12 @@ function renderOne (d, useColor, opts) {
   // points at the value.
   const raw = d.mergedFrom[0];
   if (raw && raw.schemaSource) {
-    const f = trimCwd(raw.schemaSource.file, opts.cwd);
+    const f = term(trimCwd(raw.schemaSource.file, opts.cwd));
     lines.push(`  --> ${color(useColor, ANSI.cyan, `${f}:${raw.schemaSource.line}:${raw.schemaSource.col}`)}`);
     const sl = raw.schemaSource.line;
     lines.push(bar(sl));
-    lines.push(src(sl, truncateLine(raw.schemaSource.text, width - 8)));
-    const inlineHint = raw.expected ? '  ' + color(useColor, ANSI.dim, `expected ${raw.expected}`) : '';
+    lines.push(src(sl, truncateLine(termLine(raw.schemaSource.text), width - 8)));
+    const inlineHint = raw.expected ? '  ' + color(useColor, ANSI.dim, `expected ${term(raw.expected)}`) : '';
     lines.push(caretLine(raw.schemaSource.col, 1, bar(sl).length - 1) + inlineHint);
     lines.push(bar(sl));
   }
@@ -76,8 +88,9 @@ function renderOne (d, useColor, opts) {
     lines.push(`  --> ${color(useColor, ANSI.cyan, where)}  ${color(useColor, ANSI.dim, '(' + d.dotted + ')')}`);
     const fl = d.frame.line;
     lines.push(bar(fl));
-    lines.push(src(fl, truncateLine(d.frame.text, width - 8)));
-    lines.push(caretLine(d.frame.col, d.frame.length, bar(fl).length - 1) + caretSuffix(d, raw, useColor));
+    const shown = windowAround(d.frame.text, d.frame.textCol !== undefined ? d.frame.textCol : d.frame.col, width - 8);
+    lines.push(src(fl, shown.text));
+    lines.push(caretLine(shown.col, d.frame.length, bar(fl).length - 1) + caretSuffix(d, raw, useColor));
     lines.push(bar(fl));
   } else {
     lines.push(`  --> ${color(useColor, ANSI.cyan, 'at ' + d.dotted)}`);
@@ -85,7 +98,7 @@ function renderOne (d, useColor, opts) {
 
   if (d.help) lines.push('   = ' + color(useColor, ANSI.yellow, 'help: ') + d.help);
   if (d.branchErrors && d.branchErrors.length) {
-    const variant = (raw && raw.params && raw.params.closestName) || 'closest variant';
+    const variant = term((raw && raw.params && raw.params.closestName) || 'closest variant');
     const n = d.branchErrors.length;
     lines.push('   = ' + color(useColor, ANSI.dim, 'note: ') + `closest match was ${variant} with ${n} error${n === 1 ? '' : 's'}:`);
     renderBranchErrors(d.branchErrors, 1, lines, useColor);
@@ -125,7 +138,7 @@ function renderPretty (errors, opts) {
   opts = opts || {};
   const useColor = resolveColor(opts.color || 'auto');
   const maxErrors = opts.maxErrors != null ? opts.maxErrors : 20;
-  const context = opts.context || 'input';
+  const context = term(opts.context || 'input');
 
   const diags = toDiagnostics(errors, sourceFor(errors, opts));
 

package/lib/safe-regex.js

@@ -155,10 +155,18 @@ function __ataSafeRegex () {
         case 't': return { t: 'char', c: 9 }
         case 'f': return { t: 'char', c: 12 }
         case 'v': return { t: 'char', c: 11 }
-        case '0': return { t: 'char', c: 0 }
-        case 'x': { const h = src.slice(i, i + 2); i += 2; return { t: 'char', c: parseInt(h, 16) } }
-        case 'u': { const h = src.slice(i, i + 4); i += 4; return { t: 'char', c: parseInt(h, 16) } }
+        case '0': if (/[0-9]/.test(src[i] || '')) throw new Error('octal escapes are not supported in pattern'); return { t: 'char', c: 0 }
+        // A malformed \x or \u is a syntax error under the u flag and the letter
+        // under the legacy one; here it read as NaN and matched U+0000. Refused.
+        case 'x': { const h = src.slice(i, i + 2); if (!/^[0-9a-fA-F]{2}$/.test(h)) throw new Error('malformed \\x escape in pattern'); i += 2; return { t: 'char', c: parseInt(h, 16) } }
+        case 'u': { const h = src.slice(i, i + 4); if (!/^[0-9a-fA-F]{4}$/.test(h)) throw new Error('malformed \\u escape in pattern'); i += 4; return { t: 'char', c: parseInt(h, 16) } }
         case 'b': if (inClass) return { t: 'char', c: 8 }; throw new Error('\\b word boundary is not supported')
+        // Escapes with a meaning the engine does not implement: \B (non word
+        // boundary), \c (control letter), \k (named backreference), \p and
+        // \P (Unicode property), and above a legacy octal \0n. Read as the
+        // letter, ^\B(a|a)$ accepted "Ba" and ^\p{L}+$ accepted "p{L}"; the
+        // callers that ask patternIsSafe directly reached the second.
+        case 'B': case 'c': case 'k': case 'p': case 'P': throw new Error('\\' + ch + ' is not supported in pattern')
         default:
           if (/[1-9]/.test(ch)) throw new Error('backreferences are not supported in pattern')
           return { t: 'char', c: ch.charCodeAt(0) }
@@ -170,9 +178,26 @@ function __ataSafeRegex () {
     return ast
   }
 
+  // A counted repeat is compiled by copying its child, so the program grows
+  // with the product of the counts through nesting: (((a|a)*){1000}){1000}
+  // was a million copies and one level more ran the process out of memory.
+  // Past this many instructions the pattern is refused (compileSafe throws,
+  // patternIsSafe answers false) and the caller takes the platform RegExp.
+  const MAX_PROG = 1 << 16
+
+  // The size the program would have, counted before anything is emitted, so a
+  // repeat of an empty group ((){1e5}){1e5} is refused without looping either.
+  // An iteration costs one even when its child emits nothing. Capped past the
+  // budget so nested products stay finite.
+  const BUDGET = 'pattern expands past the instruction budget'
   function compileProg (ast) {
     const prog = []
-    const emit = (op, extra) => { const idx = prog.length; prog.push(Object.assign({ op }, extra)); return idx }
+    const emit = (op, extra) => {
+      const idx = prog.length
+      if (idx >= MAX_PROG) throw new Error(BUDGET)
+      prog.push(Object.assign({ op }, extra))
+      return idx
+    }
 
     function rec (n) {
       switch (n.t) {

package/lib/scan-compiler.js

@@ -211,6 +211,9 @@ function resolveLocalRef(root, ref) {
 // takes, from every branch, either that branch's subschema for it or that
 // branch's `additionalProperties`.
 
+// Past this many layers in one merge the scanner declines the schema.
+const MAX_LAYERS = 256;
+
 // Flattens a node and its branches into layers, resolving references as it goes.
 function collectLayers(node, ctx, out, depth) {
   if (depth > MAX_SCHEMA_DEPTH) decline('allOf:too-deep');
@@ -232,12 +235,18 @@ function collectLayers(node, ctx, out, depth) {
     ctx.refStack.pop();
     return;
   }
-  const own = {};
+  const own = Object.create(null);
   for (const k of Object.keys(node)) {
     if (k === 'allOf' || IGNORED.has(k)) continue;
     own[k] = node[k];
   }
-  if (Object.keys(own).length > 0) out.push(own);
+  if (Object.keys(own).length > 0) {
+    // Depth is bounded above, width is not: allOf of two $refs to the same
+    // definition, chained, doubles the layers at every step, and 2^n of
+    // them ran the process out of memory before any size check.
+    if (out.length >= MAX_LAYERS) decline('allOf:too-wide');
+    out.push(own);
+  }
   if (node.allOf !== undefined) {
     if (!Array.isArray(node.allOf)) decline('allOf:not-array');
     for (const branch of node.allOf) collectLayers(branch, ctx, out, depth + 1);
@@ -273,7 +282,8 @@ function mergeAllOf(schema, ctx) {
     if (L.unevaluatedProperties !== undefined || L.unevaluatedItems !== undefined) decline('allOf:unevaluated');
   }
 
-  const out = {};
+  // Null prototype for the same reason as the merged property map below.
+  const out = Object.create(null);
 
   // type: the intersection of the named sets, with `integer` inside `number`,
   // so number and integer together are integer rather than nothing. Empty means
@@ -334,7 +344,9 @@ function mergeAllOf(schema, ctx) {
     for (const k of Object.keys(L.properties)) if (!names.includes(k)) names.push(k);
   }
   if (names.length > 0) {
-    out.properties = {};
+    // Null prototype: a property named __proto__ written into a plain object
+    // sets its prototype and the property's schema is silently lost.
+    out.properties = Object.create(null);
     for (const name of names) {
       const parts = [];
       for (const L of layers) {

package/lib/schema-diff.js

@@ -0,0 +1,103 @@
+'use strict';
+
+// What a change to a schema does to documents: which ones the old schema
+// accepted and the new one rejects (a client sending what used to pass gets a
+// 400), and which ones the new one accepts and the old one did not (a rule
+// was loosened). Reading two schemas side by side tells you which keywords
+// changed; it does not tell you which documents change verdict, and that is
+// the question before a deploy. The documents come from `generate` in
+// lib/verify.js, made from both schemas, half of them with one rule broken,
+// plus the values on either side of every bound, plus the project's own
+// samples. Generated documents are a sample, not a proof: a change this
+// finds is real, one it does not find may still exist.
+
+const { Validator } = require('../index.js');
+const { generate, readSamples } = require('./verify');
+
+const clone = (v) => (v === undefined ? v : JSON.parse(JSON.stringify(v)));
+const errorKey = (e) => `${e.keyword || ''}@${e.instancePath || ''}`;
+const first = (errors) => (errors && errors.length ? errors[0] : { keyword: 'validation', instancePath: '', message: 'validation failed' });
+
+// `samples`: paths of JSON or JSON Lines files, or directories of them.
+function diffSchemas (oldSchema, newSchema, { generate: count = 200, seed = 1, samples = [] } = {}) {
+  const before = new Validator(oldSchema);
+  const after = new Validator(newSchema);
+  const docs = [];
+  const seen = new Set();
+  const add = (doc, source) => {
+    if (doc === undefined) return;
+    const key = JSON.stringify(doc);
+    if (seen.has(key)) return;
+    seen.add(key);
+    docs.push({ doc, source });
+  };
+  for (const d of generate(oldSchema, count, seed, (x) => before.isValidObject(clone(x)))) add(d, 'generated from the old schema');
+  for (const d of generate(newSchema, count, seed + 1, (x) => after.isValidObject(clone(x)))) add(d, 'generated from the new schema');
+  for (const s of readSamples(samples)) if (!s.bad) add(s.doc, s.source);
+
+  const nowRejected = [];
+  const nowAccepted = [];
+  let bothAccept = 0;
+  let bothReject = 0;
+  for (const { doc, source } of docs) {
+    const a = before.validate(clone(doc));
+    const b = after.validate(clone(doc));
+    if (a.valid && b.valid) bothAccept++;
+    else if (!a.valid && !b.valid) bothReject++;
+    else if (a.valid) nowRejected.push({ doc, source, error: first(b.errors) });
+    else nowAccepted.push({ doc, source, error: first(a.errors) });
+  }
+  return {
+    documents: docs.length,
+    bothAccept,
+    bothReject,
+    nowRejected: grouped(nowRejected),
+    nowAccepted: grouped(nowAccepted),
+  };
+}
+
+// The documents of one kind, grouped by the rule that decides them (the
+// first error's keyword and place), each group with one example: one of the
+// project's own documents when the group holds one, since that is a document
+// somebody actually sends, else the first generated one.
+const generated = (source) => source.startsWith('generated');
+function grouped (list) {
+  const groups = new Map();
+  for (const item of list) {
+    const key = errorKey(item.error);
+    let g = groups.get(key);
+    if (g === undefined) groups.set(key, (g = { rule: key, message: item.error.message, count: 0, samples: 0, example: item.doc, source: item.source }));
+    g.count++;
+    if (!generated(item.source)) { g.samples++; if (generated(g.source)) { g.example = item.doc; g.source = item.source; } }
+  }
+  return { count: list.length, rules: [...groups.values()].sort((x, y) => y.count - x.count) };
+}
+
+function breaking (report) { return report.nowRejected.count > 0; }
+
+function renderDiff (report, { json = false, oldName = 'old', newName = 'new' } = {}) {
+  if (json) return JSON.stringify(report, null, 2);
+  const lines = [];
+  const show = (doc) => { const s = JSON.stringify(doc); return s.length > 120 ? s.slice(0, 117) + '...' : s; };
+  lines.push(`${report.documents} documents: ${report.bothAccept} accepted by both, ${report.bothReject} rejected by both, ${report.nowRejected.count} rejected only by ${newName}, ${report.nowAccepted.count} accepted only by ${newName}`);
+  if (report.nowRejected.count) {
+    lines.push('');
+    lines.push(`Rejected by ${newName}, accepted by ${oldName} (a client sending these gets a rejection after the change):`);
+    for (const g of report.nowRejected.rules) {
+      lines.push(`  ${g.rule}: ${g.count} ${g.count === 1 ? 'document' : 'documents'}${g.samples ? `, ${g.samples} of them the project's own` : ''}, ${g.message}`);
+      lines.push(`    ${show(g.example)}${generated(g.source) ? '' : `  (${g.source})`}`);
+    }
+  }
+  if (report.nowAccepted.count) {
+    lines.push('');
+    lines.push(`Accepted by ${newName}, rejected by ${oldName} (what ${oldName} refused with):`);
+    for (const g of report.nowAccepted.rules) {
+      lines.push(`  ${g.rule}: ${g.count} ${g.count === 1 ? 'document' : 'documents'}${g.samples ? `, ${g.samples} of them the project's own` : ''}, ${g.message}`);
+      lines.push(`    ${show(g.example)}${generated(g.source) ? '' : `  (${g.source})`}`);
+    }
+  }
+  if (!report.nowRejected.count && !report.nowAccepted.count) lines.push('No document changed verdict.');
+  return lines.join('\n');
+}
+
+module.exports = { diffSchemas, renderDiff, breaking };