ata-validator 1.61.3 → 1.62.0

package/README.md

@@ -201,16 +201,24 @@ documents, Node 24:
 
 | | documents a second, the verdict | same, `new Function` refused |
 |---|---:|---:|
-| ata | 3,295,880 | 607,614 |
-| ata, compiled module | 3,319,594 | 3,344,948 |
-| typebox | 1,638,813 | EvalError |
-| ajv | 1,285,492 | EvalError |
-| typia | 939,572 | 964,507 |
-| zod | 440,473 | 237,176 |
-
-Where ata is behind is in the same tables: on a four-field body that fails, ajv answers the
-verdict faster, and with every error read it does 6.6M a second against ata's 2.9M with rich
-errors (7.6M with `richErrors: false`).
+| ata | 3,274,803 | 1,109,881 |
+| ata, compiled module | 3,270,947 | 3,353,351 |
+| typia | 1,957,392 | 1,931,134 |
+| typebox | 1,615,239 | EvalError |
+| ajv | 1,245,508 | EvalError |
+| zod | 436,632 | 230,808 |
+
+Run of 2026-10-30 with typia 15.2.2, which reuses a pattern's RegExp and shortcuts length
+checks after a report from this benchmark; its order figure doubled.
+
+The same repository runs every SchemaStore schema that ships sample documents, 446 of them,
+against the default validator on those samples: ata ahead on 430, median 1.83x, 2.82x on
+schemas of 50 to 200 KB, and never below 0.74x on the 16 where it is behind
+([RESULTS-schemastore.md](https://github.com/ata-core/validator-benchmarks/blob/main/RESULTS-schemastore.md),
+Node 24, ata 1.61.3). Where ata is behind is
+in the same tables: on a four-field body that fails, ajv answers the verdict faster (15.5M
+against 10.4M), and with every error read it does 7.1M a second against ata's 3.6M with rich
+errors, 5.2M with `richErrors: false`.
 
 ## Why AOT
 
@@ -793,6 +801,55 @@ is rejected by the new one, so a pull request that tightens a schema fails
 the check until someone looks. Generated documents are a sample, not a proof:
 a change this reports is real, one it does not report may still exist.
 
+### Validation as the body arrives
+
+A request that carries many documents, a JSON array or NDJSON, is usually read to the end,
+parsed as a whole and then validated, so a bad third record is reported after the last byte.
+`ata-validator/stream` validates each record the moment its last byte lands and stops reading
+at the first failure, with memory that does not grow with the body.
+
+```js
+import { validateStream } from 'ata-validator/stream'
+
+app.post('/orders/import', async (c) => {
+  const r = await validateStream(orders, c.req.raw.body)   // a Web ReadableStream, or a Node Readable
+  if (!r.valid) return c.json({ record: r.errors[0].record, errors: r.errors[0].errors }, 400)
+  return c.json({ imported: r.records })
+})
+```
+
+`v.stream(opts)` on Node, or `streamValidator(v, opts)` from `ata-validator/stream` anywhere (the lite, edge and browser entries do not carry the method, so their bundles stay what they were), is the same thing fed by hand: `push(chunk)` takes strings or bytes and returns
+the first failure as soon as its record is complete, `end()` returns `{ valid, records, errors }`.
+`onRecord(doc, index)` hands over each record that passed, parsed, so an import does not parse
+twice; `stopOnFirst: false` lists every failing record instead of stopping. The format is read
+from the first character (`[` is an array, anything else NDJSON) or set with `format`. A JSON
+array is split by a scan that tracks strings and nesting, not by parsing it, so the elements are
+parsed one at a time.
+
+Measured on a 100 MB body of 128,419 order documents, read in 64 KB chunks, Node 25, Apple M4
+Pro, one process per row:
+
+| | invalid record 3 | invalid last record |
+|---|---|---|
+| read it all, `JSON.parse`, validate the array | 517 ms, 783 MB | 571 ms, 845 MB |
+| read it all, split lines, parse and validate each | 237 ms, 553 MB | 462 ms, 660 MB |
+| `ata-validator/stream`, JSON array | 13.5 ms, 122 MB, 0.1 MB read | 577 ms, 195 MB |
+| `ata-validator/stream`, NDJSON | 19.6 ms, 122 MB, 0.1 MB read | 461 ms, 197 MB |
+
+Peak RSS; the 100 MB figure is the process without the body. A body that is valid to the end
+costs the same time as before and a third of the memory. `tests/test_stream.js` holds the stream
+to whole-document validation under every way of cutting the bytes into chunks, including inside
+multi-byte characters, strings with brackets and escaped quotes, nested arrays, scalars, CRLF
+and blank lines, and checks that a failing source is destroyed or cancelled rather than read on.
+
+A Node http request handed to `validateStream` is not destroyed at the failure: closing the
+socket under the response turns the answer into a network error at the client (Node's `fetch`
+uploading 100 MB got `write EPIPE`, Chrome "Failed to fetch", neither the 400). Reading stops and
+the rest of the body is read and dropped, so the response goes out and memory stays flat. Node's
+`fetch` then had the 400 after 24 ms and 1 MB sent; Chrome, which reads only after its upload,
+after 58 ms for a 50 MB file over loopback; the Hono example above, whose Node adapter cancels
+the stream without closing the socket, after 28 ms. A plain `Readable` is still destroyed.
+
 ### Bun, compiled ahead of time
 
 Bun's ahead-of-time compiler (`bun build --compile --aot`, an open pull

package/bin/ata.js

@@ -533,7 +533,8 @@ function cmdValidate (args) {
   try {
     schema = JSON.parse(schemaContent);
   } catch (e) {
-    process.stderr.write(`error: ${schemaPath} is not valid JSON: ${e.message}\n`);
+    // The parser quotes the text it stopped at, and the text is the file's.
+    process.stderr.write(`error: ${schemaPath} is not valid JSON: ${require('../lib/diagnose').term(e.message)}\n`);
     process.exit(2);
   }
 
@@ -550,7 +551,7 @@ function cmdValidate (args) {
   try {
     v = new Validator(schema, { source: { path: schemaPath, content: schemaContent } });
   } catch (e) {
-    process.stderr.write(`error: schema compile failed: ${e.message}\n`);
+    process.stderr.write(`error: schema compile failed: ${require('../lib/diagnose').term(e.message)}\n`);
     process.exit(2);
   }
 

package/compat.js

@@ -129,7 +129,9 @@ class Ata {
     const formatNames = Object.keys(this._formats);
     if (formatNames.length > 0) out.formats = { ...this._formats };
     const keywordNames = Object.keys(this._keywords);
-    const kws = {};
+    // Null prototype: a keyword named __proto__ written into a plain object
+    // would set its prototype and never reach the validator.
+    const kws = Object.create(null);
     for (const name of keywordNames) if (this._keywords[name] !== true) kws[name] = this._keywords[name];
     if (Object.keys(kws).length > 0) out.keywords = kws;
     const registry = this._registrySnapshot();
@@ -646,8 +648,16 @@ function referencedDefaults(rootDoc, registry) {
     }
     return node;
   };
+  // `done`, per call: the schemas already applied to each object. A second
+  // application fills nothing new, and following every edge of a chain such
+  // as n_i = allOf [n_(i-1), n_(i-1)] applied the bottom schema 2^n times.
+  let done = null;
   const fill = (schema, data, active) => {
     if (schema === null || typeof schema !== 'object' || data === null || typeof data !== 'object' || active.has(schema)) return;
+    let applied = done.get(data);
+    if (applied === undefined) done.set(data, (applied = new Set()));
+    if (applied.has(schema)) return;
+    applied.add(schema);
     active.add(schema);
     if (typeof schema.$ref === 'string') fill(resolve(schema.$ref), data, active);
     if (Array.isArray(schema.allOf)) for (const sub of schema.allOf) fill(sub, data, active);
@@ -670,7 +680,10 @@ function referencedDefaults(rootDoc, registry) {
     }
     active.delete(schema);
   };
-  return (data) => fill(rootDoc, data, new Set());
+  return (data) => {
+    done = new Map();
+    try { fill(rootDoc, data, new Set()); } finally { done = null; }
+  };
 }
 
 // The registry id a fragment-only key is kept under: a `#...` string is not an

package/index.d.ts

@@ -509,6 +509,13 @@ export interface Validator<T = unknown> {
   /** Validate a JSON string. Uses simdjson fast path for large documents. */
   validateJSON(jsonString: string): ValidationResult<T>;
 
+  /**
+   * Validation as the body arrives: a record stream over this validator for a
+   * JSON array or NDJSON fed in chunks, reporting the first failing record the
+   * moment it is complete. See `ata-validator/stream` for the types.
+   */
+  stream(opts?: import('./stream').StreamOptions): import('./stream').RecordStream;
+
   /** Fast boolean check for a JSON string */
   isValidJSON(jsonString: string): boolean;
 

package/index.js

@@ -6,6 +6,16 @@
 // lib/codegen-engine.js, so that the edge entry (index.edge.js) and
 // ata-validator/lite can load the core without it.
 const core = require('./lib/validator-core.js');
+
+// Validation as the body arrives: `v.stream(opts)` is a record stream over the
+// validator (lib/stream.js), loaded on first use. Defined here, on the Node
+// entry, and not in the core: the lite, edge and browser builds are measured
+// to the byte and a static require from the core would put the stream into
+// every one of them; there `ata-validator/stream` is imported where it is used.
+Object.defineProperty(core.Validator.prototype, 'stream', {
+  configurable: true, writable: true,
+  value: function stream (opts) { return require('./lib/stream.js').streamValidator(this, opts); },
+});
 // The code generator loads on first need, or once the event loop is free,
 // not with the package: it is most of what requiring the package parsed. The
 // timer is unref'd, so a script that has finished does not stay to load it.

package/lib/aot-build.js

@@ -95,7 +95,13 @@ function runtimePathFor(outputs, opts, format) {
   let dir = path.resolve(path.dirname(outputs[0]));
   for (const o of outputs) {
     const d = path.resolve(path.dirname(o));
-    while (dir !== d && !d.startsWith(dir + path.sep)) dir = path.dirname(dir);
+    // The root already ends in a separator ('/' or a drive root), and dirname of the
+    // root is the root: compared against root + sep the walk never ended.
+    while (dir !== d && !d.startsWith(dir.endsWith(path.sep) ? dir : dir + path.sep)) {
+      const up = path.dirname(dir);
+      if (up === dir) break;
+      dir = up;
+    }
   }
   return path.join(dir, name);
 }
@@ -245,6 +251,15 @@ async function buildWith(opts) {
   // check once warm.
   if (opts.mode !== undefined && opts.mode !== 'code' && opts.mode !== 'schema') throw new Error(`build: mode must be code or schema (got "${opts.mode}")`);
   const schemaMode = opts.mode === 'schema' && !opts.abortEarly;
+  // The options that change what a module holds, recorded with each cache
+  // entry and required to match. Without them a module built for production
+  // (no schema-source frames) was reported up to date by a development build
+  // and kept, since the input and the output had not changed.
+  const optionsKey = JSON.stringify([
+    !!opts.abortEarly, opts.onePass === true, !!opts.plainErrors, !!opts.verdictOnly,
+    opts.order === undefined ? null : opts.order, opts.formatMode === undefined ? null : opts.formatMode,
+    opts.baseUri === undefined ? null : opts.baseUri, opts.target === undefined ? null : opts.target, !!opts.types,
+  ]);
 
   const compiled = [];
   const cached = [];
@@ -367,6 +382,8 @@ async function buildWith(opts) {
         cacheEntry.output === output &&
         !!cacheEntry.sharable === sharable &&
         !!cacheEntry.schemaMode === schemaMode &&
+        cacheEntry.source === source &&
+        cacheEntry.options === optionsKey &&
         // A module built against the other inputs depends on them too, and
         // the registry is put together from such modules: always rebuilt.
         !cacheEntry.usesSiblings &&
@@ -522,6 +539,8 @@ async function buildWith(opts) {
         outputHash: hashContent(Buffer.from(src, 'utf8')),
         sharable,
         schemaMode,
+        source,
+        options: optionsKey,
         mode: e.mode,
         runtime: e.mode !== 'inline' ? runtime.path : undefined,
         fullGz: e.fullGz,
@@ -577,8 +596,13 @@ async function watch(opts, onReport) {
     }
   };
 
+  // The build writes its cache file, JSON and often beside the schemas; a
+  // change to it is the build's own and starts nothing, or every build woke
+  // the watcher for the next one.
+  const cachePath = opts.cacheFile ? path.resolve(opts.cacheFile) : null;
   const watchers = dirs.map((d) => fs.watch(d, (_event, filename) => {
     if (!filename) return;
+    if (cachePath !== null && path.resolve(d, filename) === cachePath) return;
     const ext = path.extname(filename).toLowerCase();
     if (ext !== '.json' && ext !== '.yaml' && ext !== '.yml') return;
     if (debounceTimer) clearTimeout(debounceTimer);
@@ -754,3 +778,5 @@ module.exports = {
   toStandaloneModule,
   schemaHash,
 };
+// For tests only, not part of ata-validator/build.
+Object.defineProperty(module.exports, '_runtimePathFor', { value: runtimePathFor, enumerable: false });

package/lib/aot-impl.js

@@ -160,13 +160,19 @@ module.exports = { boolFn, hybridFactory, errFn };
 // 'inject' writes no function source. The module exports `setFormats(map)`
 // and each format is looked up from that registry when a value is checked,
 // so the caller supplies the functions at load time.
+// The format name a helper name was made from (js-compiler.js ufName):
+// `_uf_` and the name with every character outside [A-Za-z0-9_] written as
+// `$` and four hex digits.
+function formatFromName(name) {
+  return name.slice(4).replace(/\$([0-9a-f]{4})/g, (m, h) => String.fromCharCode(parseInt(h, 16)));
+}
 function emitFormatDecls(closures, mode, declKW) {
   if (!closures || closures.length === 0) return { decls: '', exportsSetFormats: false };
   if (mode === 'inject') {
     let out = `${declKW} __formats = Object.create(null);\n`;
     out += `function setFormats(map) { for (const k in map) __formats[k] = map[k]; }\n`;
     for (const { name, format } of closures) {
-      const key = JSON.stringify(format === null ? name.slice(4) : format);
+      const key = JSON.stringify(format === null ? formatFromName(name) : format);
       out += `${declKW} ${name} = function (v) { const f = __formats[${key}]; if (typeof f !== 'function') throw new Error('ata: format ' + ${key} + ' is not registered; call setFormats({ [' + ${key} + ']: fn }) before validating'); return f(v); };\n`;
     }
     return { decls: out, exportsSetFormats: true };
@@ -199,10 +205,15 @@ function sourceFrameDecls(frames, schemaFile) {
   const texts = [];
   const textIndex = new Map();
   const rows = [];
+  // The rows come from the caller's `sourceMap` option. A line or column that
+  // is not an integer is written as 0: written as given, a string in one ran
+  // as code when the module loaded.
+  const int = (n) => (Number.isInteger(n) ? n : 0);
   for (const f of frames.values()) {
-    let i = textIndex.get(f.text);
-    if (i === undefined) { i = texts.length; texts.push(f.text); textIndex.set(f.text, i); }
-    rows[f.index] = `[${f.line},${f.col},${i}]`;
+    const text = typeof f.text === 'string' ? f.text : '';
+    let i = textIndex.get(text);
+    if (i === undefined) { i = texts.length; texts.push(text); textIndex.set(text, i); }
+    rows[f.index] = `[${int(f.line)},${int(f.col)},${i}]`;
   }
   return `const __ataSF = ${JSON.stringify(schemaFile)};\n` +
     `const __ataSL = ${JSON.stringify(texts)};\n` +
@@ -367,7 +378,27 @@ function defaultsDecl(validator) {
   if (defaults.buildDefaultsApplier(schema) === null) return '';
   const embedded = require('./schema-strip').stripAnnotationsKeepingDefaults(schema);
   const text = JSON.stringify(JSON.stringify(embedded)).replace(/</g, '\\u003c');
-  return `const _ataDefaults = (function () {\nconst MAX_DEPTH = ${defaults.MAX_DEPTH};\n${loadAotOrder().take('defaults.js', defaults.EMBED)}\nreturn buildDefaultsApplier;\n})();\n` +
+  // patternProperties keys are tested as validation tests them: on the
+  // linear engine where validation uses it, the platform RegExp otherwise.
+  // Called without a matcher, the embedded pass took the RegExp for every
+  // pattern, and a key that backtracks cost seconds there. A module whose
+  // declaration names __ataSafeRe carries the engine (callers check).
+  const { useSafeEngine } = require('./js-compiler')._internal;
+  const safe = new Set();
+  const seen = new Set();
+  const walk = (n) => {
+    if (n === null || typeof n !== 'object' || seen.has(n)) return;
+    seen.add(n);
+    if (!Array.isArray(n) && n.patternProperties && typeof n.patternProperties === 'object' && !Array.isArray(n.patternProperties)) {
+      for (const k of Object.keys(n.patternProperties)) if (useSafeEngine(k)) safe.add(k);
+    }
+    for (const k of Object.keys(n)) walk(n[k]);
+  };
+  walk(embedded);
+  const build = safe.size === 0
+    ? 'buildDefaultsApplier'
+    : `(function () { const SAFE = new Set(${JSON.stringify([...safe])}); return (s) => buildDefaultsApplier(s, (p) => SAFE.has(p) ? __ataSafeRe(p) : keyPattern(p)); })()`;
+  return `const _ataDefaults = (function () {\nconst MAX_DEPTH = ${defaults.MAX_DEPTH};\n${loadAotOrder().take('defaults.js', defaults.EMBED)}\nreturn ${build};\n})();\n` +
     `let _ataFill;\nfunction applyDefaults(d) { (_ataFill || (_ataFill = _ataDefaults(JSON.parse(${text}))))(d); }\n`;
 }
 
@@ -577,7 +608,7 @@ function toStandaloneModule(validator, opts) {
   // which carries it anyway, instead of embedding a copy (2.9 KB gzipped,
   // minified) in every module that has a pattern the platform RegExp does not
   // run.
-  const usesSafeRe = errorRuntime !== null && ((jsFn && jsFn._usesSafeRe) || (jsErrFn && jsErrFn._usesSafeRe));
+  let usesSafeRe = errorRuntime !== null && ((jsFn && jsFn._usesSafeRe) || (jsErrFn && jsErrFn._usesSafeRe));
   let compactCore = '';
   if (errorRuntime !== null) {
     const { stripAnnotations } = require('./schema-strip');
@@ -649,9 +680,33 @@ function toStandaloneModule(validator, opts) {
   // safe-regex prelude, which has a module-scope parse() of its own for
   // reading patterns. A second declaration of that name shadowed it and the
   // prelude called this one instead, reaching _fn before its initialiser ran.
-  const parseCore = cloneExpr
-    ? `function _ataParse(data) {\n  ${pre.call}if (!_fn(data)) { const e = new Error('validation failed'); e.name = 'AtaValidationError'; throw e; }\n  return ${cloneExpr};\n}\n`
-    : '';
+  // With a pass before the check (the validator's coerceTypes or
+  // removeAdditional, and its defaults unless useDefaults is off), the
+  // runtime's parse() takes its verdict on a filled copy of the input and
+  // checks the copy it hands back too (buildParse in lib/codegen-engine.js).
+  // Checked on the raw input, a default that makes a conditional apply was
+  // missed and parse() returned what validate() refuses after the fill.
+  const fillDecl = defaultsDecl(validator);
+  const fills = !!fillDecl && vopts.useDefaults !== false;
+  // The defaults pass tests patternProperties keys on the linear engine
+  // where validation does; the module then carries the engine.
+  const fillSafeRe = fillDecl.includes('__ataSafeRe(');
+  if (fillSafeRe && errorRuntime !== null) usesSafeRe = true;
+  const parseCore = !cloneExpr
+    ? ''
+    : !fills && pre.decl === ''
+      ? `function _ataParse(data) {\n  if (!_fn(data)) { const e = new Error('validation failed'); e.name = 'AtaValidationError'; throw e; }\n  return ${cloneExpr};\n}\n`
+      : `function _ataParse(data) {
+  let doc;
+  try { doc = structuredClone(data); } catch (_) { doc = undefined; }
+  if (doc === undefined && data !== undefined) throw new TypeError('parse() is not available for this value: it cannot be copied to fill its defaults before the check. Use validate() instead.');
+  if (doc !== null && typeof doc === 'object') { ${pre.decl !== '' ? '_ataPre(doc); ' : ''}${fills ? 'applyDefaults(doc); ' : ''}}
+  if (!_fn(doc)) { const e = new Error('validation failed'); e.name = 'AtaValidationError'; throw e; }
+  const out = ${cloneExpr};
+  if (!_fn(out)) throw new TypeError('parse() is not available for this value: the copy that keeps the declared properties is not one the schema accepts. Use validate() instead.');
+  return out;
+}
+`;
 
   // validateJSON(): parse the text, validate, and on failure attach a
   // dataFrame (byte offset, line, col, source line) to every error by
@@ -666,7 +721,7 @@ function toStandaloneModule(validator, opts) {
   // the worst case of a pointer at the very end. It is also 125 characters
   // smaller than the full-map builder it replaces.
   const positionsCore = !(opts && opts.positions) ? '' : `const _ataPosMap = ${buildTargetedPositionMap.toString()};
-function _ataFrame(p) { return { byteOffset: p.byteOffset, length: p.length, line: p.line, col: p.col, text: p.text }; }
+function _ataFrame(p) { const f = { byteOffset: p.byteOffset, length: p.length, line: p.line, col: p.col, text: p.text }; if (p.textCol !== undefined) f.textCol = p.textCol; return f; }
 function validateJSON(text) {
   const s = String(text);
   let data;
@@ -705,7 +760,6 @@ function validateJSON(text) {
   const hashDecl = `const schemaHash = ${JSON.stringify(hashSrc)};\nconst ataVersion = ${JSON.stringify(ATA_VERSION)};\n`;
 
   let names = fmt.exportsSetFormats ? baseNames + ', setFormats' : baseNames;
-  const fillDecl = defaultsDecl(validator);
   if (fillDecl) names += ', applyDefaults';
   names += ', schemaHash, ataVersion';
   if (positionsCore) names += ', validateJSON';
@@ -726,7 +780,7 @@ ${errorRuntime === null ? '// Schema is embedded; runtime has zero dependency on
 // Re-run the build after upgrading ata: the version above is what wrote this.
 ${degradedNote}'use strict';
 ${errorRuntime === null ? '' : format === 'esm' ? `import { createErrors as _ataCreateErrors${usesSafeRe ? ', compileSafe as _ataCompileSafe' : ''}${usesUriWalk ? ', uriWalk as _ataUriWalk' : ''} } from ${JSON.stringify(errorRuntime)};\n` : `const { createErrors: _ataCreateErrors${usesSafeRe ? ', compileSafe: _ataCompileSafe' : ''}${usesUriWalk ? ', uriWalk: _ataUriWalk' : ''} } = require(${JSON.stringify(errorRuntime)});\n`}${_CP_LEN_SOURCE}
-${errorRuntime !== null ? (usesSafeRe ? 'const __ataSafeRe = _ataCompileSafe;\n' : '') : safeRePrelude(jsFn, jsErrFn, onePass !== null && onePass.usesSafeRe ? { _usesSafeRe: true } : null)}${schemaSourceConst}const VALID = Object.freeze({ valid: true, errors: Object.freeze([]) });
+${errorRuntime !== null ? (usesSafeRe ? 'const __ataSafeRe = _ataCompileSafe;\n' : '') : safeRePrelude(jsFn, jsErrFn, (onePass !== null && onePass.usesSafeRe) || fillSafeRe ? { _usesSafeRe: true } : null)}${schemaSourceConst}const VALID = Object.freeze({ valid: true, errors: Object.freeze([]) });
 const ABORT = Object.freeze({
   valid: false,
   errors: Object.freeze([Object.freeze({
@@ -885,7 +939,10 @@ function toSchemaModule(validator, opts) {
     ? `import { createValidator as _ataCreateValidator } from ${spec};\n`
     : `const { createValidator: _ataCreateValidator } = require(${spec});\n`)
     + (regSpec === null ? '' : format === 'esm' ? `import _ataRegistry from ${regSpec};\n` : `const _ataRegistry = require(${regSpec});\n`);
-  const fillDecl = defaultsDecl(validator);
+  let fillDecl = defaultsDecl(validator);
+  // No verdict code here to carry the linear engine; the defaults pass
+  // brings its own when it tests keys on it.
+  if (fillDecl.includes('__ataSafeRe(')) fillDecl = getSafeRegexEmbed() + '\n' + fillDecl;
   const expNames = 'validate, isValid' + (fillDecl ? ', applyDefaults' : '') + ', schemaHash, ataVersion';
   const exp = format === 'esm'
     ? `export { ${expNames} };\nexport default { ${expNames} };\n`
@@ -1035,6 +1092,7 @@ function bundleStandalone(Validator, schemas, opts) {
     // The runtime's passes over the data, for the options asked for, and its
     // defaults pass as the validator's applyDefaults.
     const fillDecl = defaultsDecl(v);
+    if (fillDecl.includes('__ataSafeRe(')) bundleUsesSafeRe = true;
     const pre = bundlePreprocess(v, opts, fillDecl, 'bundleStandalone');
     preamble = preamble ? `${preamble}\n${fillDecl}${pre.decl}` : fillDecl + pre.decl;
     const ret = (body) => fillDecl
@@ -1188,13 +1246,21 @@ function bundleCompact(Validator, schemas, opts) {
   // User format functions are referenced as _uf_<name> by the hybrid and error
   // bodies. Collect them across all schemas (deduped by name) and embed via
   // Function#toString so the bundle stays self-contained.
-  const fmtSeen = new Set();
+  // One declaration per helper name. The name is one to one with the
+  // format name, so two entries under one name are the same format; were
+  // they bound to different functions the bundle could not serve both, so
+  // that is refused rather than letting one schema run another's checker.
+  const fmtSeen = new Map();
   const fmtAll = [];
   for (const e of entries) {
     if (!e || !e.fmt) continue;
     for (const entry of e.fmt) {
-      if (fmtSeen.has(entry.name)) continue;
-      fmtSeen.add(entry.name);
+      const prev = fmtSeen.get(entry.name);
+      if (prev !== undefined) {
+        if (prev !== entry.fn) throw new Error(`ata: custom format "${entry.format === null ? formatFromName(entry.name) : entry.format}" is bound to two different functions in this bundle`);
+        continue;
+      }
+      fmtSeen.set(entry.name, entry.fn);
       fmtAll.push(entry);
     }
   }
@@ -1255,9 +1321,24 @@ function loadBundle(Validator, mods, schemas, opts) {
 // do not write but a pattern could carry, has its backslash dropped, since
 // `\x3C` already is the escape. A module with neither sequence, which is
 // nearly every one, comes back as the same string.
+// The match is the `<` and what follows; the backslashes before it are
+// counted from the match offset. Matching them as part of the pattern made
+// the scan re-read a run of backslashes at every `<` after it, so an enum
+// value of 40000 backslashes and `<a` took 6.5 s. One pass, whatever the run.
 function htmlSafe(src) {
   if (typeof src !== 'string' || src.indexOf('<') === -1) return src;
-  return src.replace(/(\\*)<(\/script|!--)/gi, (m, bs, rest) => (bs.length % 2 ? bs.slice(0, -1) : bs) + '\\x3C' + rest);
+  let out = '';
+  let last = 0;
+  const re = /<(\/script|!--)/gi;
+  let m;
+  while ((m = re.exec(src)) !== null) {
+    const at = m.index;
+    let bs = 0;
+    while (at - bs - 1 >= last && src.charCodeAt(at - bs - 1) === 92) bs++;
+    out += src.slice(last, at - (bs % 2)) + '\\x3C' + m[1];
+    last = at + m[0].length;
+  }
+  return last === 0 ? src : out + src.slice(last);
 }
 const htmlSafeResult = (fn) => function () { return htmlSafe(fn.apply(this, arguments)); };
 
@@ -1278,6 +1359,16 @@ module.exports = {
     if (!Array.isArray(schemas)) return er.errorRuntimeSource(format, ATA_VERSION, undefined, !!schemaMode);
     const { stripAnnotations } = require('./schema-strip');
     const embedded = schemas.map((x) => stripAnnotations(x && typeof x === 'object' && x._schemaObj !== undefined ? x._schemaObj : x));
+    // A module reaches the registered schemas (`schemas` option) through
+    // $ref, so what they use the runtime must carry too. Read from the
+    // validator's map, since the validator may not have compiled yet: a
+    // pattern that lived only in a registered schema was missed, the runtime
+    // went out without the pattern engine, and the module matched on the
+    // platform RegExp.
+    for (const x of schemas) {
+      if (!x || typeof x !== 'object' || !(x._schemaMap instanceof Map)) continue;
+      for (const ext of x._schemaMap.values()) if (ext && typeof ext === 'object') embedded.push(stripAnnotations(ext));
+    }
     const features = er.runtimeFeatures(embedded);
     for (const x of schemas) if (x && x._jsFn && x._jsFn._usesSafeRe) features['safe-regex'] = true;
     return er.errorRuntimeSource(format, ATA_VERSION, features, !!schemaMode);

package/lib/buffer-gate.js

@@ -24,11 +24,16 @@ const UNSUPPORTED_KEYWORDS = new Set([
   'contains', 'minContains', 'maxContains',
   'unevaluatedProperties', 'unevaluatedItems',
   'dependencies', 'dependentSchemas', 'dependentRequired',
-  'propertyNames', 'patternProperties',
+  'propertyNames', 'patternProperties', 'propertyDependencies',
 ]);
 
-// Formats the native checkers answer differently from the JS ones.
-const DIVERGENT_FORMATS = new Set(['hostname', 'date-time', 'time', 'uri-reference', 'duration']);
+// Formats the native engine checks by the same rules as lib/formats.js,
+// held to the same answers by tests/test_native_formats.js. Every other
+// format name goes through validate(): the native engine has no check for
+// it and would let any string pass. This was a list of the divergent ones,
+// which missed every format the engine does not know (json-pointer, iri,
+// uri-template, regex and the rest) and a caller's own formats.
+const NATIVE_FORMATS = new Set(['email', 'date', 'uri', 'uuid', 'ipv4', 'ipv6', 'hostname']);
 
 const SUBSCHEMA_MAPS = ['properties', 'patternProperties', '$defs', 'definitions', 'dependentSchemas', 'dependencies'];
 const SUBSCHEMA_NODES = [
@@ -92,7 +97,7 @@ function refersBack(root) {
   return visit(root);
 }
 
-function walk(schema, depth) {
+function walk(schema, depth, userFormats) {
   if (depth > NATIVE_DEPTH) return true;
   if (schema === true || schema === false) {
     // A boolean root is answered wrong by the walker; nested booleans are
@@ -101,7 +106,7 @@ function walk(schema, depth) {
   }
   if (schema === null || typeof schema !== 'object') return false;
   if (Array.isArray(schema)) {
-    for (const s of schema) if (walk(s, depth + 1)) return true;
+    for (const s of schema) if (walk(s, depth + 1, userFormats)) return true;
     return false;
   }
   for (const key of Object.keys(schema)) {
@@ -114,7 +119,7 @@ function walk(schema, depth) {
     if (key === '$id' && depth > 0) return true;
     // An empty enum rejects everything; the walker accepts everything.
     if (key === 'enum' && Array.isArray(v) && v.length === 0) return true;
-    if (key === 'format' && DIVERGENT_FORMATS.has(v)) return true;
+    if (key === 'format' && (!NATIVE_FORMATS.has(v) || (userFormats && Object.prototype.hasOwnProperty.call(userFormats, v)))) return true;
     // Unicode property escapes: RE2 cannot parse them and the walker then
     // skips the pattern instead of failing.
     if (key === 'pattern' && typeof v === 'string' && /\\[pP]\{/.test(v)) return true;
@@ -126,10 +131,10 @@ function walk(schema, depth) {
 
     if (SUBSCHEMA_MAPS.includes(key)) {
       if (v && typeof v === 'object' && !Array.isArray(v)) {
-        for (const k of Object.keys(v)) if (walk(v[k], depth + 1)) return true;
+        for (const k of Object.keys(v)) if (walk(v[k], depth + 1, userFormats)) return true;
       }
     } else if (SUBSCHEMA_NODES.includes(key)) {
-      if (walk(v, depth + 1)) return true;
+      if (walk(v, depth + 1, userFormats)) return true;
     }
   }
   return false;
@@ -138,13 +143,15 @@ function walk(schema, depth) {
 // True when the buffer APIs must answer through validate() for this schema.
 // `keywords` is the validator's normalized custom keyword map, if any: the
 // native walker knows nothing about those, so a schema using one is routed
-// through validate() like the other shapes here.
-function bufferNeedsSlowPath(schema, schemaMap, keywords) {
+// through validate() like the other shapes here. `userFormats` is the
+// validator's `formats` option: a format it defines, even under a built-in
+// name, is a check only the JS engines run.
+function bufferNeedsSlowPath(schema, schemaMap, keywords, userFormats) {
   if (keywords && schemaUsesKeywords(schema, keywords)) return true;
-  if (walk(schema, 0)) return true;
+  if (walk(schema, 0, userFormats)) return true;
   if (refersBack(schema)) return true;
   if (schemaMap && schemaMap.size > 0) {
-    for (const s of schemaMap.values()) if (walk(s, 1)) return true;
+    for (const s of schemaMap.values()) if (walk(s, 1, userFormats)) return true;
   }
   return false;
 }
@@ -163,8 +170,12 @@ function toText(input, name) {
 function installSlowBufferApis(validator) {
   const isValidText = (text) => validator.isValidJSON(text);
   validator.isValid = (input) => isValidText(toText(input, 'isValid'));
-  validator.isValidPrepadded = (paddedBuffer, jsonLength) =>
-    isValidText(Buffer.from(paddedBuffer.buffer, paddedBuffer.byteOffset, jsonLength).toString('utf8'));
+  // The length is the caller's, so it is held to the buffer: a view past its
+  // end read the bytes of whatever shared the pool, and answered on them.
+  validator.isValidPrepadded = (paddedBuffer, jsonLength) => {
+    if (!(paddedBuffer instanceof Uint8Array) || !Number.isInteger(jsonLength) || jsonLength < 0 || jsonLength > paddedBuffer.byteLength) return false;
+    return isValidText(Buffer.from(paddedBuffer.buffer, paddedBuffer.byteOffset, jsonLength).toString('utf8'));
+  };
   const ndjson = (input, name) => {
     const lines = toText(input, name).split('\n');
     const out = [];

package/lib/bun-target.js

@@ -79,15 +79,20 @@ function empty () { return { string: [], number: [], boolean: [], null: [], obje
 function universal () { const t = empty(); for (const k of KINDS) t[k].push(UNIVERSAL[k]); return t }
 function single (kind, alt) { const t = empty(); t[kind].push(alt); return t }
 function union (a, b) { const t = empty(); for (const k of [...KINDS, 'alias']) t[k] = dedupe([...a[k], ...b[k]]); return t }
-function dedupe (xs) { return xs.filter((x, i) => xs.indexOf(x) === i) }
+function dedupe (xs) { return xs.length < 2 ? xs : [...new Set(xs)] }
 function isUniversal (t) { return t.alias.length === 0 && KINDS.every((k) => t[k].length === 1 && t[k][0] === UNIVERSAL[k]) }
 
 // Intersection, or null where the two cannot be written as one type; the
-// caller then keeps one side in the residual.
+// caller then keeps one side in the residual. The product of two unions
+// distributes, so allOf over n branches of two shapes each is 2^n
+// alternatives: 14 branches took 2.3 s and 16 did not finish. Past this many
+// alternatives for one kind the branch stays in the residual.
+const MAX_ALTERNATIVES = 256
 function intersect (a, b) {
   if (a.alias.length || b.alias.length) return null
   const t = empty()
   for (const k of KINDS) {
+    if (a[k].length * b[k].length > MAX_ALTERNATIVES) return null
     for (const x of a[k]) {
       for (const y of b[k]) {
         const z = meet(k, x, y)
@@ -548,17 +553,28 @@ function schemaToBunType (root, opts = {}) {
 // the type, and the module's functions with the type on them. `parse`
 // declares the type where it parses, which is what the compiler reads to make
 // the objects with that layout; the module then checks the content.
+// A string as a JavaScript literal with every line terminator escaped.
+// JSON.stringify leaves U+2028 and U+2029 as they are, and inside a `//`
+// comment those end the comment the way a line feed does.
+function jsString (s) {
+  return JSON.stringify(String(s)).replace(/[\u2028\u2029]/g, (c) => '\\u' + c.charCodeAt(0).toString(16))
+}
+// The same without the quotes, for text that goes into a // comment: a file
+// name holding a line break ended the comment and the rest of the name was
+// source.
+function commentText (s) { return jsString(s).slice(1, -1) }
+
 function toBunModule ({ schemaFile, moduleImport, typeName: tn, typeSource, aliases }) {
   const lines = []
-  lines.push(`// Generated by ata build --target bun from ${schemaFile}. Do not edit.`)
+  lines.push(`// Generated by ata build --target bun from ${commentText(schemaFile)}. Do not edit.`)
   lines.push('//')
   lines.push('// For executables built with `bun build --compile --aot`: the schema as a type')
-  lines.push(`// for the program, with the plain module (${moduleImport}) answering every`)
+  lines.push(`// for the program, with the plain module (${commentText(moduleImport)}) answering every`)
   lines.push('// check, so the answers and the errors are the module\'s. `parse(text)` declares')
   lines.push('// the type where it parses and the module checks the content; it is not faster')
   lines.push('// than a plain parse and the module. Everywhere else, including plain `bun run`,')
   lines.push('// the plain module does the same without this file.')
-  lines.push(`import * as _m from ${JSON.stringify(moduleImport)}`)
+  lines.push(`import * as _m from ${jsString(moduleImport)}`)
   lines.push('')
   for (const [n, src] of aliases) lines.push(`type ${n} = ${src}`)
   lines.push(`export type ${tn} = ${typeSource}`)