fastify-ata 0.2.3 → 0.2.4

package/README.md

@@ -2,7 +2,7 @@
 
 Fastify plugin for [ata-validator](https://ata-validator.com) — JSON Schema validation powered by simdjson.
 
-Replaces the default ajv validator compiler with ata-validator. Beats ajv on every valid-path benchmark.
+Drop-in replacement for Fastify's default ajv validator. Standard Schema V1 compatible.
 
 ## Install
 
@@ -24,40 +24,82 @@ fastify.post('/user', {
       type: 'object',
       properties: {
         name: { type: 'string', minLength: 1 },
-        age: { type: 'integer', minimum: 0 }
+        age: { type: 'integer', minimum: 0 },
+        role: { type: 'string', default: 'user' }
       },
       required: ['name']
     }
   }
 }, (req, reply) => {
+  // req.body.role === 'user' (default applied)
   reply.send({ ok: true, name: req.body.name })
 })
 
 fastify.listen({ port: 3000 })
 ```
 
-That's it. All your existing JSON Schema route definitions work as-is.
+All your existing JSON Schema route definitions work as-is.
+
+## Options
+
+```js
+fastify.register(fastifyAta, {
+  coerceTypes: true,       // convert "42" → 42 for integer fields
+  removeAdditional: true,  // strip properties not in schema
+})
+```
+
+## Standard Schema V1
+
+ata-validator natively implements [Standard Schema V1](https://github.com/standard-schema/standard-schema) — the emerging standard for TypeScript-first schema libraries.
+
+```js
+const { Validator } = require('ata-validator')
+const v = new Validator(schema)
+
+// Standard Schema V1 interface
+const result = v['~standard'].validate(data)
+// { value: data } on success
+// { issues: [{ message, path }] } on failure
+```
+
+Works with Fastify v5's Standard Schema support, tRPC, TanStack Form, Drizzle ORM.
 
 ## What it does
 
 - Registers a custom `validatorCompiler` using ata-validator
-- Caches compiled schemas for reuse across routes
+- Applies `default` values, `coerceTypes`, `removeAdditional` during validation
+- Caches compiled schemas (WeakMap) for reuse across routes
 - Returns Fastify-compatible validation errors on invalid requests (400)
 - Works with Fastify v4 and v5
 
-## Why
+## Performance
+
+### Real-world HTTP benchmark (autocannon, 10 connections, 5s)
+
+| Payload | ata | ajv | |
+|---|---|---|---|
+| 1 user (0.1KB) | 65.7K req/sec | 65.7K req/sec | equal |
+| 10 users (0.9KB) | 57.2K | 55.3K | +3% |
+| 50 users (4.6KB) | 36.0K | 33.8K | +6% |
+| 100 users (9.1KB) | 24.6K | 22.6K | +9% |
+
+### Where ata really shines
+
+| Scenario | ata | ajv | |
+|---|---|---|---|
+| **Serverless cold start** (50 schemas) | 7.7ms | 96ms | **12.5x faster** |
+| **ReDoS protection** (catastrophic pattern) | 0.3ms | 765ms | **immune** |
+| **Batch NDJSON** (10K items, multi-core) | 13.4M/sec | 5.1M/sec | **2.6x faster** |
+| **validate(obj)** valid (micro) | 15M ops/sec | 8.5M ops/sec | **1.8x faster** |
+| **Schema compilation** | 125K ops/sec | 831 ops/sec | **151x faster** |
 
-| | ata-validator | ajv |
-|---|---|---|
-| validate(obj) valid | **1.1x faster** | baseline |
-| validate(obj) 100 users | **2.7x faster** | baseline |
-| Schema compilation | **151x faster** | baseline |
-| Parallel batch (10K) | **5.9x faster** (12.5M items/sec) | 2.1M items/sec |
-| Engine | simdjson + V8 codegen + multi-core | JS (single-thread) |
-| Spec compliance | 98.5% Draft 2020-12 | ~100% |
-| Standard Schema V1 | Yes | No |
+### Things only ata can do
 
-> ata uses speculative validation: a V8-optimized JS codegen fast path runs first. Valid data (the common case) never crosses the NAPI boundary.
+- **RE2 regex engine** — linear-time guaranteed, immune to ReDoS attacks
+- **Multi-core parallel validation** — NDJSON batch at 12.5M items/sec
+- **Standard Schema V1** — native support, ajv doesn't have it
+- **151x faster compilation** — serverless cold starts, dynamic schemas
 
 ## License
 

package/bench-scenarios.js

@@ -0,0 +1,304 @@
+'use strict'
+
+const { execSync } = require('child_process')
+const { writeFileSync, unlinkSync } = require('fs')
+const path = require('path')
+
+// ============================================================
+// Scenario 1: Serverless Cold Start
+// Compile 50 schemas + validate 1 request each
+// ============================================================
+async function benchColdStart() {
+  console.log('--- Scenario 1: Serverless Cold Start ---')
+  console.log('    Compile 50 schemas + validate 1 request each\n')
+
+  const script = (useAta) => `
+'use strict'
+${useAta ? `
+const { Validator } = require('ata-validator')
+` : `
+const Ajv = require('ajv')
+const addFormats = require('ajv-formats')
+`}
+
+const schemas = []
+for (let i = 0; i < 50; i++) {
+  schemas.push({
+    type: 'object',
+    properties: {
+      ['field' + i]: { type: 'string', minLength: 1 },
+      id: { type: 'integer', minimum: 1 },
+      name: { type: 'string' },
+      email: { type: 'string', format: 'email' },
+      age: { type: 'integer', minimum: 0, maximum: 150 },
+      active: { type: 'boolean' },
+    },
+    required: ['id', 'name', 'email'],
+  })
+}
+
+// Measure: compile all 50 schemas + validate 1 request each (simulates cold start)
+// Single iteration — that's what cold start means
+const start = performance.now()
+${useAta ? `
+const validators = schemas.map(s => new Validator(s))
+validators.forEach(v => v.validate({ id: 1, name: 'x', email: 'a@b.com', active: true }))
+` : `
+schemas.forEach(s => {
+  const ajv = new Ajv({ allErrors: true })
+  addFormats(ajv)
+  const validate = ajv.compile(s)
+  validate({ id: 1, name: 'x', email: 'a@b.com', active: true })
+})
+`}
+const elapsed = performance.now() - start
+console.log(JSON.stringify({ elapsed: elapsed.toFixed(1) }))
+`
+
+  const ataPath = path.join(__dirname, '_cold_ata.js')
+  const ajvPath = path.join(__dirname, '_cold_ajv.js')
+  writeFileSync(ataPath, script(true))
+  writeFileSync(ajvPath, script(false))
+
+  const ataResult = JSON.parse(execSync(`node ${ataPath}`, { cwd: __dirname }).toString())
+  const ajvResult = JSON.parse(execSync(`node ${ajvPath}`, { cwd: __dirname }).toString())
+
+  unlinkSync(ataPath)
+  unlinkSync(ajvPath)
+
+  console.log(`  ata: ${ataResult.elapsed}ms to compile 50 schemas + validate`)
+  console.log(`  ajv: ${ajvResult.elapsed}ms to compile 50 schemas + validate`)
+  console.log(`  >>> ata is ${(parseFloat(ajvResult.elapsed) / parseFloat(ataResult.elapsed)).toFixed(1)}x faster\n`)
+}
+
+// ============================================================
+// Scenario 2: ReDoS Protection
+// Pattern with catastrophic backtracking potential
+// ============================================================
+async function benchReDoS() {
+  console.log('--- Scenario 2: ReDoS Protection ---')
+  console.log('    Pattern: ^(a+)+$ with pathological input\n')
+
+  const script = (useAta) => `
+'use strict'
+${useAta ? `
+// Force NAPI path to use RE2 (not JS RegExp)
+process.env.ATA_FORCE_NAPI = '1'
+const { Validator } = require('ata-validator')
+const v = new Validator({ type: 'string', pattern: '^(a+)+$' })
+` : `
+const Ajv = require('ajv')
+const ajv = new Ajv()
+const validate = ajv.compile({ type: 'string', pattern: '^(a+)+$' })
+`}
+
+// Pathological input — causes catastrophic backtracking in JS regex
+const input = 'a'.repeat(25) + 'b'
+
+const start = performance.now()
+${useAta ? `
+const json = JSON.stringify(input)
+v.validateJSON(json)
+` : `validate(input)`}
+const elapsed = performance.now() - start
+console.log(JSON.stringify({ elapsed: elapsed.toFixed(3) }))
+`
+
+  const ataPath = path.join(__dirname, '_redos_ata.js')
+  const ajvPath = path.join(__dirname, '_redos_ajv.js')
+  writeFileSync(ataPath, script(true))
+  writeFileSync(ajvPath, script(false))
+
+  const ataResult = JSON.parse(execSync(`node ${ataPath}`, { cwd: __dirname, timeout: 5000 }).toString())
+
+  let ajvResult
+  try {
+    ajvResult = JSON.parse(execSync(`node ${ajvPath}`, { cwd: __dirname, timeout: 5000 }).toString())
+  } catch {
+    ajvResult = { elapsed: 'TIMEOUT (>5s)' }
+  }
+
+  unlinkSync(ataPath)
+  unlinkSync(ajvPath)
+
+  console.log(`  ata (RE2):    ${ataResult.elapsed}ms`)
+  console.log(`  ajv (JS regex): ${ajvResult.elapsed}${typeof ajvResult.elapsed === 'string' && ajvResult.elapsed.includes('TIMEOUT') ? '' : 'ms'}`)
+  if (typeof ajvResult.elapsed === 'number' || !ajvResult.elapsed.includes('TIMEOUT')) {
+    const ratio = parseFloat(ajvResult.elapsed) / parseFloat(ataResult.elapsed)
+    console.log(`  >>> ata is ${ratio.toFixed(0)}x faster (immune to ReDoS)\n`)
+  } else {
+    console.log(`  >>> ajv HANGS — catastrophic backtracking. ata is immune.\n`)
+  }
+}
+
+// ============================================================
+// Scenario 3: Large Payload Validation (HTTP)
+// ============================================================
+async function benchLargePayload() {
+  console.log('--- Scenario 3: Large Payload HTTP Validation ---')
+  console.log('    500 users per request, real HTTP\n')
+
+  const schema = {
+    body: {
+      type: 'object',
+      properties: {
+        users: {
+          type: 'array',
+          items: {
+            type: 'object',
+            properties: {
+              id: { type: 'integer', minimum: 1 },
+              name: { type: 'string', minLength: 1 },
+              email: { type: 'string', format: 'email' },
+              active: { type: 'boolean' },
+              role: { enum: ['admin', 'user', 'moderator'] },
+            },
+            required: ['id', 'name', 'email', 'active', 'role'],
+          },
+        },
+      },
+      required: ['users'],
+    },
+  }
+
+  const users = []
+  for (let i = 0; i < 500; i++) {
+    users.push({ id: i + 1, name: `User ${i}`, email: `u${i}@example.com`, active: true, role: 'user' })
+  }
+  const payload = JSON.stringify({ users })
+
+  function serverScript(useAta) {
+    return `
+'use strict'
+const fastify = require('fastify')()
+${useAta ? "fastify.register(require('./index'))" : ''}
+const schema = ${JSON.stringify(schema)}
+fastify.post('/users', { schema }, (req, reply) => {
+  reply.send({ ok: true })
+})
+fastify.listen({ port: 0 }).then(() => {
+  process.send({ port: fastify.server.address().port })
+})
+`
+  }
+
+  async function run(label, useAta) {
+    const scriptPath = path.join(__dirname, '_bench_server.js')
+    writeFileSync(scriptPath, serverScript(useAta))
+    const { fork } = require('child_process')
+    const child = fork(scriptPath, { stdio: ['pipe', 'pipe', 'pipe', 'ipc'] })
+    const port = await new Promise((resolve) => { child.on('message', (msg) => resolve(msg.port)) })
+    const escaped = payload.replace(/'/g, "'\\''")
+    const result = execSync(
+      `npx autocannon -c 10 -d 5 -j http://localhost:${port}/users -m POST -H "content-type: application/json" -b '${escaped}'`,
+      { cwd: __dirname, timeout: 30000 }
+    ).toString()
+    child.kill()
+    try { unlinkSync(scriptPath) } catch {}
+    return JSON.parse(result).requests.average
+  }
+
+  const ata = await run('ata', true)
+  const ajv = await run('ajv', false)
+
+  console.log(`  ata: ${ata.toLocaleString()} req/sec`)
+  console.log(`  ajv: ${ajv.toLocaleString()} req/sec`)
+  console.log(`  >>> ata ${(ata / ajv).toFixed(2)}x faster (${((ata / ajv - 1) * 100).toFixed(0)}%)\n`)
+}
+
+// ============================================================
+// Scenario 4: Batch NDJSON Processing
+// ============================================================
+async function benchBatch() {
+  console.log('--- Scenario 4: Batch NDJSON Processing ---')
+  console.log('    10K items, multi-core vs single-thread\n')
+
+  const script = (useAta) => `
+'use strict'
+${useAta ? `
+const { Validator } = require('ata-validator')
+const v = new Validator({
+  type: 'object',
+  properties: {
+    id: { type: 'integer' },
+    name: { type: 'string' },
+    value: { type: 'number' }
+  },
+  required: ['id', 'name']
+})
+const lines = []
+for (let i = 0; i < 10000; i++) {
+  lines.push(JSON.stringify({ id: i, name: 'item' + i, value: Math.random() }))
+}
+const buf = Buffer.from(lines.join('\\n'))
+// Warmup
+for (let i = 0; i < 10; i++) v.isValidParallel(buf)
+
+const N = 100
+const start = performance.now()
+for (let i = 0; i < N; i++) v.isValidParallel(buf)
+const elapsed = performance.now() - start
+const itemsPerSec = (N * 10000) / (elapsed / 1000)
+console.log(JSON.stringify({ items: Math.round(itemsPerSec) }))
+` : `
+const Ajv = require('ajv')
+const ajv = new Ajv()
+const validate = ajv.compile({
+  type: 'object',
+  properties: {
+    id: { type: 'integer' },
+    name: { type: 'string' },
+    value: { type: 'number' }
+  },
+  required: ['id', 'name']
+})
+// Same NDJSON input — parse each line + validate (fair comparison)
+const lines = []
+for (let i = 0; i < 10000; i++) {
+  lines.push(JSON.stringify({ id: i, name: 'item' + i, value: Math.random() }))
+}
+const ndjson = lines.join('\\n')
+// Warmup
+for (let i = 0; i < 5; i++) { for (const line of ndjson.split('\\n')) validate(JSON.parse(line)) }
+
+const N = 50
+const start = performance.now()
+for (let i = 0; i < N; i++) { for (const line of ndjson.split('\\n')) validate(JSON.parse(line)) }
+const elapsed = performance.now() - start
+const itemsPerSec = (N * 10000) / (elapsed / 1000)
+console.log(JSON.stringify({ items: Math.round(itemsPerSec) }))
+`}
+`
+
+  const ataPath = path.join(__dirname, '_batch_ata.js')
+  const ajvPath = path.join(__dirname, '_batch_ajv.js')
+  writeFileSync(ataPath, script(true))
+  writeFileSync(ajvPath, script(false))
+
+  const ataResult = JSON.parse(execSync(`node ${ataPath}`, { cwd: __dirname, timeout: 60000 }).toString())
+  const ajvResult = JSON.parse(execSync(`node ${ajvPath}`, { cwd: __dirname, timeout: 60000 }).toString())
+
+  unlinkSync(ataPath)
+  unlinkSync(ajvPath)
+
+  console.log(`  ata (multi-core): ${ataResult.items.toLocaleString()} items/sec`)
+  console.log(`  ajv (single-thread): ${ajvResult.items.toLocaleString()} items/sec`)
+  console.log(`  >>> ata is ${(ataResult.items / ajvResult.items).toFixed(1)}x faster\n`)
+}
+
+async function main() {
+  console.log('\n==============================================')
+  console.log('  ata-validator vs ajv — Real-World Scenarios')
+  console.log('==============================================\n')
+
+  await benchColdStart()
+  await benchReDoS()
+  await benchLargePayload()
+  await benchBatch()
+
+  console.log('==============================================')
+  console.log('  Summary: ata wins where it matters most')
+  console.log('==============================================\n')
+}
+
+main().catch(console.error)

package/bench.js

@@ -0,0 +1,118 @@
+'use strict'
+
+const { execSync } = require('child_process')
+const { writeFileSync, unlinkSync } = require('fs')
+const path = require('path')
+
+const schema = {
+  body: {
+    type: 'object',
+    properties: {
+      users: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: {
+            id: { type: 'integer', minimum: 1 },
+            name: { type: 'string', minLength: 1 },
+            email: { type: 'string', format: 'email' },
+            age: { type: 'integer', minimum: 0, maximum: 150 },
+            active: { type: 'boolean' },
+            role: { enum: ['admin', 'user', 'moderator'] },
+          },
+          required: ['id', 'name', 'email', 'active', 'role'],
+        },
+      },
+      metadata: {
+        type: 'object',
+        properties: {
+          total: { type: 'integer' },
+          page: { type: 'integer', minimum: 1 },
+        },
+        required: ['total', 'page'],
+      },
+    },
+    required: ['users', 'metadata'],
+  },
+}
+
+function makePayload(n) {
+  const users = []
+  for (let i = 0; i < n; i++) {
+    users.push({
+      id: i + 1,
+      name: `User ${i}`,
+      email: `user${i}@example.com`,
+      age: 25,
+      active: true,
+      role: 'user',
+    })
+  }
+  return JSON.stringify({ users, metadata: { total: n, page: 1 } })
+}
+
+function serverScript(useAta) {
+  return `
+'use strict'
+const fastify = require('fastify')()
+${useAta ? "fastify.register(require('./index'))" : ''}
+const schema = ${JSON.stringify(schema)}
+fastify.post('/users', { schema }, (req, reply) => {
+  reply.send({ ok: true, count: req.body.users.length })
+})
+fastify.listen({ port: 0 }).then(() => {
+  process.send({ port: fastify.server.address().port })
+})
+`
+}
+
+async function bench(label, useAta, payload) {
+  const scriptPath = path.join(__dirname, '_bench_server.js')
+  writeFileSync(scriptPath, serverScript(useAta))
+
+  const { fork } = require('child_process')
+  const child = fork(scriptPath, { stdio: ['pipe', 'pipe', 'pipe', 'ipc'] })
+  const port = await new Promise((resolve) => {
+    child.on('message', (msg) => resolve(msg.port))
+  })
+
+  const escaped = payload.replace(/'/g, "'\\''")
+  const result = execSync(
+    `npx autocannon -c 10 -d 5 -j http://localhost:${port}/users -m POST -H "content-type: application/json" -b '${escaped}'`,
+    { cwd: __dirname, timeout: 30000 }
+  ).toString()
+
+  child.kill()
+  try { unlinkSync(scriptPath) } catch {}
+
+  const parsed = JSON.parse(result)
+  return parsed.requests.average
+}
+
+async function main() {
+  console.log('\n==============================================')
+  console.log('  Fastify POST Validation Benchmark')
+  console.log('  10 connections, 5 seconds, real HTTP')
+  console.log('==============================================\n')
+
+  for (const count of [1, 10, 50, 100]) {
+    const payload = makePayload(count)
+    console.log(`--- ${count} users (${(payload.length / 1024).toFixed(1)} KB) ---`)
+
+    const ata = await bench('ata', true, payload)
+    const ajv = await bench('ajv', false, payload)
+
+    console.log(`  ata: ${ata.toLocaleString().padStart(10)} req/sec`)
+    console.log(`  ajv: ${ajv.toLocaleString().padStart(10)} req/sec`)
+
+    const ratio = ata / ajv
+    if (ratio >= 1) console.log(`  >>> ata ${ratio.toFixed(2)}x faster`)
+    else console.log(`  >>> ajv ${(1 / ratio).toFixed(2)}x faster`)
+    console.log()
+  }
+}
+
+main().catch((err) => {
+  console.error(err)
+  process.exit(1)
+})

package/index.js

@@ -5,11 +5,15 @@ const { Validator } = require('ata-validator')
 
 function fastifyAta(fastify, opts, done) {
   const cache = new WeakMap()
+  const validatorOpts = {
+    coerceTypes: opts.coerceTypes || false,
+    removeAdditional: opts.removeAdditional || false,
+  }
 
   fastify.setValidatorCompiler(({ schema }) => {
     let validator = cache.get(schema)
     if (!validator) {
-      validator = new Validator(schema)
+      validator = new Validator(schema, validatorOpts)
       cache.set(schema, validator)
     }
     return (data) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify-ata",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Fastify plugin for ata-validator — beats ajv on every valid-path benchmark. 2.7x faster validate(obj), 151x faster compilation, simdjson + multi-core.",
   "main": "index.js",
   "types": "index.d.ts",
@@ -33,6 +33,7 @@
     "fastify": ">=4.0.0"
   },
   "devDependencies": {
+    "autocannon": "^8.0.0",
     "fastify": "^5.8.4"
   }
 }