typesea 0.1.0 → 0.3.0

package/docs/api.md

@@ -27,6 +27,7 @@ condition.
 interface Guard<T> {
   is(value: unknown): value is T;
   check(value: unknown): CheckResult<T>;
+  checkFirst(value: unknown): CheckResult<T>;
   assert(value: unknown): asserts value is T;
   graph(): Graph;
 }
@@ -36,6 +37,7 @@ interface Guard<T> {
 | --- | --- | --- |
 | `is` | Hot boolean narrowing | Avoids diagnostic allocation on the success path. |
 | `check` | Validation with issues | Returns frozen `Result<T, Issue[]>` containers. |
+| `checkFirst` | Hot rejection diagnostics | Returns the same frozen `Result` shape, but failure contains at most one issue. Compiled and AOT guards use a dedicated first-fault collector. |
 | `assert` | Throwing integration boundaries | Throws `TypeSeaAssertionError` with copied, frozen issues. |
 | `graph` | Runtime plan introspection | Returns the validated, optimized, frozen Sea-of-Nodes graph held by the validation plan. |
 
@@ -47,14 +49,19 @@ cross the API boundary.
 
 | Family | Builders |
 | --- | --- |
-| Scalars | `t.unknown`, `t.never`, `t.string`, `t.number`, `t.bigint`, `t.symbol`, `t.boolean` |
-| Literals and containers | `t.literal(value)`, `t.array(item)`, `t.tuple([a, b])`, `t.record(value)` |
+| Scalars | `t.unknown`, `t.never`, `t.string`, `t.number`, `t.date`, `t.bigint`, `t.symbol`, `t.boolean`, `t.null`, `t.undefined`, `t.void` |
+| String checks | `.min`, `.max`, `.length`, `.nonempty`, `.regex`, `.startsWith`, `.endsWith`, `.includes`, `.uuid`, `.email`, `.url`, `.isoDate`, `.isoDateTime`, `.ulid`, `.ipv4`, `.ipv6` |
+| Number checks | `.int`, `.finite`, `.safe`, `.gte`, `.lte`, `.min`, `.max`, `.gt`, `.lt`, `.multipleOf`, `.positive`, `.nonnegative`, `.negative`, `.nonpositive` |
+| Date checks | `.min`, `.max` |
+| Literals and containers | `t.literal(value)`, `t.enum(values)`, `t.array(item)`, `t.tuple([a, b])`, `t.tuple([head], rest)`, `t.record(value)`, `t.map(key, value)`, `t.set(item)`, `t.json()` |
+| Array checks | `.min`, `.max`, `.length`, `.nonempty` |
 | Objects | `t.object(shape)`, `t.strictObject(shape)` |
-| Object transforms | `t.extend`, `t.pick`, `t.omit`, `t.partial`, and matching object guard methods |
+| Object transforms | `t.extend`, `t.safeExtend`, `t.merge`, `t.pick`, `t.omit`, `t.partial`, `t.deepPartial`, `t.required`, `t.strict`, `t.passthrough`, `t.strip`, `t.catchall`, and matching object guard methods |
+| Runtime object contracts | `t.instanceOf(Ctor)`, `t.property(base, key, value)`, `guard.property(key, value)` |
 | Composition | `t.union`, `t.discriminatedUnion`, `t.intersect`, `guard.intersect` |
-| Presence | `t.optional`, `t.undefinedable`, `t.nullable` |
+| Presence | `t.optional`, `t.undefinedable`, `t.nullable`, `t.nullish` |
 | Dynamic guards | `t.lazy`, `t.refine` |
-| Decoders | `t.decoder`, `t.transform`, `t.pipe`, `t.coerce` |
+| Decoders | `t.decoder`, `t.transform`, `t.pipe`, `t.default`, `t.defaultValue`, `t.prefault`, `t.catch`, `t.codec`, `t.coerce`, `t.string.trim()`, `t.string.toLowerCase()`, `t.string.toUpperCase()` |
 | Async decoders | `t.asyncDecoder`, `t.asyncRefine`, `t.asyncTransform`, `t.asyncPipe` |
 
 Builder functions validate inputs before a schema can enter the validation plan,
@@ -80,6 +87,8 @@ const Shape = t.object({
 - `name` may be absent. If `name` exists, its value must be a string.
 - `nickname` must be present. Its value may be a string or `undefined`.
 - `t.nullable(inner)` adds `null` to the value domain.
+- `t.nullish(inner)` combines nullable value semantics with optional object-key
+  presence.
 - Presence-preserving wrappers keep optional-key semantics through `nullable`,
   `undefinedable`, `brand`, and `refine`.
 
@@ -87,6 +96,18 @@ Object combinators preserve object mode. Strict object guards remain strict
 after `extend`, `pick`, `omit`, or `partial`; passthrough object guards keep
 allowing unknown keys.
 
+`catchall(schema)` validates every undeclared own key with `schema`.
+`strip()` is validation-only in TypeSea: guards return the original value, so it
+has the same validation behavior as `passthrough()`.
+`pick` and `omit` accept either key arrays or Zod-style `{ key: true }` masks.
+`deepPartial()` recursively partializes pure object, array, tuple, tuple rest,
+record, map, set, property, union, intersection, nullable, undefinedable,
+optional, and brand schemas. Lazy and refinement schemas are semantic barriers.
+
+`property` validates only own data descriptors. It is useful for class instances
+with stable fields; prototype getters and accessor-backed properties are rejected
+instead of executed.
+
 ## Composition
 
 `t.union(a, b)` accepts a value that satisfies at least one branch.
@@ -125,6 +146,16 @@ lazy chain must eventually resolve to a concrete non-lazy schema.
 ```ts
 const Count = t.pipe(t.coerce.number(), t.number.int().gte(0));
 const result = Count.decode("42");
+
+const Name = t.default(t.string.min(1), "anonymous");
+const NumberText = t.codec(
+  t.string.regex(/^\d+$/u, "digits"),
+  t.number.int().nonnegative(),
+  {
+    decode: (value) => Number(value),
+    encode: (value) => String(value)
+  }
+);
 ```
 
 Decoders are for output-producing operations. They return `Result` from
@@ -134,8 +165,15 @@ not be the same runtime value as the input.
 - `t.transform(source, mapper)` decodes `source`, then maps the decoded value.
 - `t.pipe(source, next)` feeds a successful decoded value into the next guard or
   decoder.
+- `t.default(source, value)` returns a fallback output for `undefined` input.
+- `t.prefault(source, value)` feeds a fallback input through the source.
+- `t.codec(input, output, mapping)` validates both sides of a bidirectional
+  decode/encode pair.
 - `t.coerce.string`, `t.coerce.number`, and `t.coerce.boolean` provide explicit
   primitive coercion.
+- `t.string.trim()`, `t.string.toLowerCase()`, and `t.string.toUpperCase()`
+  are decoder helpers. They validate the string first, then return transformed
+  output from `decode()`.
 - `t.asyncRefine`, `t.asyncTransform`, and `t.asyncPipe` return
   `Promise<Result<T, Issue[]>>` from `decodeAsync()`.
 
@@ -152,14 +190,16 @@ const checked = withMessages(User.check(input), {
 });
 ```
 
-`formatIssue`, `formatIssues`, and `withMessages` render diagnostics after
-validation has finished. This keeps `is()` and ordinary `check()` paths free from
-message allocation.
+`formatIssue`, `formatIssues`, `flattenIssues`, and `withMessages` render
+diagnostics after validation has finished. This keeps `is()` and ordinary
+`check()` paths free from message allocation.
 
 Built-in locales are `en` and `ko`. Custom catalogs can use string templates
 with `{path}`, `{code}`, `{expected}`, and `{actual}`, or formatter callbacks.
 `withMessages(result, options)` preserves successful results and returns a new
 failed `Result` with copied, frozen issues whose `message` fields are populated.
+`flattenIssues(issues, options)` groups rendered messages into `formErrors` and
+top-level `fieldErrors` buckets.
 
 ## Runtime Compile
 
@@ -187,10 +227,67 @@ Generated source never interpolates user-controlled values directly. Literals,
 regexps, property keys, keysets, and dynamic schema fallbacks are captured in
 side tables and referenced by numeric index.
 
+### Unsafe Compile Mode
+
+```ts
+const FastButLooseUser = compile(User, {
+  name: "isUserFast",
+  mode: "unsafe"
+});
+```
+
+`CompileOptions["mode"]` and `AotCompileOptions["mode"]` are
+`"safe" | "unsafe" | "unchecked" | undefined`; omitted options default to
+`"safe"`. Safe mode keeps TypeSea's hostile-input contract: descriptor-based
+property reads, no getter execution, and strict-object rejection for symbol and
+non-enumerable extras.
+
+Unsafe mode is an explicit performance escape hatch for trusted, normalized
+plain data:
+
+- Required object fields read with `value[key]` when the field schema rejects
+  `undefined`.
+- Discriminant dispatch reads the tag with direct bracket access.
+- Arrays and tuples read items with direct indexed loads.
+- Strict-object extra-key rejection uses an allocation-free own-enumerable
+  `for...in` loop.
+
+This may execute getters, may accept prototype-backed values, and does not
+reject symbol or non-enumerable extras on strict objects. Because compiled
+`check()` first trusts the generated predicate verdict, an unsafe predicate
+that returns `true` also returns a successful `check()` result. Use unsafe mode
+only after the input has crossed a trusted normalization boundary.
+
+Unsafe mode may embed escaped static property keys directly into generated
+predicate source so V8 can attach ordinary property-load inline caches. Safe
+mode keeps property keys in side tables.
+
+Unchecked mode uses the unsafe direct-read shape and also skips strict-object
+extra-key loops. It is only for input whose object shape has already been
+trusted or normalized; strict objects no longer reject extra keys in this mode.
+Unsafe and unchecked compiled `check()` calls also return raw successful Result
+objects without `Object.freeze()`. Failure diagnostics remain frozen. Safe mode
+keeps frozen success and failure Result objects.
+FastMode diagnostic collectors use direct field reads and FastMode strict-key
+rules for object diagnostics where possible, so missing/accessor issue codes
+are not guaranteed to match safe mode. Array and tuple diagnostics also use
+direct indexed reads in fast modes, so sparse slots are diagnosed from the
+loaded `undefined` value. Record diagnostics use direct `record[key]` reads;
+unchecked mode also visits inherited enumerable keys. Discriminant diagnostics
+read the tag directly and compare string cases with `===`.
+
 ## AOT Emit
 
 ```ts
 const emitted = emitAotModule(User, { name: "aotUser" });
+const unsafeEmitted = emitAotModule(User, {
+  name: "aotUserFast",
+  mode: "unsafe"
+});
+const uncheckedEmitted = emitAotModule(User, {
+  name: "aotUserTrustedShape",
+  mode: "unchecked"
+});
 ```
 
 `emitAotModule` returns `Result<AotModule, AotIssue[]>`. A successful result
@@ -213,6 +310,28 @@ const resolver = toReactHookFormResolver(User);
 Adapters are structural and zero-dependency. TypeSea does not import tRPC,
 Fastify, or React Hook Form.
 
+Compiled guards can be passed to the same adapters. This is the preferred shape
+for hot request paths: compile once during startup, then let the adapter reuse
+the generated predicate.
+
+```ts
+const FastUser = compile(User);
+const fastParser = toTrpcParser(FastUser);
+const fastValidatorCompiler = toFastifyValidatorCompiler(FastUser);
+```
+
+Use the default compiled mode at public input boundaries. For trusted,
+already-normalized internal data, the faster modes can be wired through adapters
+the same way.
+
+```ts
+const UnsafeUser = compile(User, { mode: "unsafe" });
+const internalParser = toTrpcParser(UnsafeUser);
+
+const TrustedShapeUser = compile(User, { mode: "unchecked" });
+const internalValidatorCompiler = toFastifyValidatorCompiler(TrustedShapeUser);
+```
+
 | Adapter | Export | Behavior |
 | --- | --- | --- |
 | tRPC | `toTrpcParser`, `toAsyncTrpcParser` | Return parser objects that emit decoded values or throw `TypeSeaAssertionError`. |
@@ -257,6 +376,7 @@ Runtime-only concepts return explicit export issues:
 - `undefined`
 - `bigint`
 - `symbol`
+- JavaScript `Date`, `Map`, `Set`, `instanceOf`, and `property` contracts
 - `lazy`
 - `refine`
 - decoder transforms

package/docs/assets/benchmark-headline.svg

@@ -0,0 +1,163 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1120" height="760" viewBox="0 0 1120 760" role="img" aria-labelledby="title desc">
+    <title id="title">TypeSea benchmark comparison</title>
+    <desc id="desc">Local strict object benchmark comparing TypeSea safe, unsafe, unchecked, Zod, Valibot, and Ajv throughput.</desc>
+    <defs>
+        <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+            <stop offset="0" stop-color="#071014"/>
+            <stop offset="0.58" stop-color="#0f172a"/>
+            <stop offset="1" stop-color="#13251f"/>
+        </linearGradient>
+        <linearGradient id="panel" x1="0" y1="0" x2="1" y2="1">
+            <stop offset="0" stop-color="#111827"/>
+            <stop offset="1" stop-color="#0b1220"/>
+        </linearGradient>
+        <linearGradient id="safe" x1="0" y1="0" x2="1" y2="0">
+            <stop offset="0" stop-color="#14b8a6"/>
+            <stop offset="1" stop-color="#2dd4bf"/>
+        </linearGradient>
+        <linearGradient id="unsafe" x1="0" y1="0" x2="1" y2="0">
+            <stop offset="0" stop-color="#f97316"/>
+            <stop offset="1" stop-color="#fbbf24"/>
+        </linearGradient>
+        <linearGradient id="unchecked" x1="0" y1="0" x2="1" y2="0">
+            <stop offset="0" stop-color="#22c55e"/>
+            <stop offset="1" stop-color="#a3e635"/>
+        </linearGradient>
+        <linearGradient id="ajv" x1="0" y1="0" x2="1" y2="0">
+            <stop offset="0" stop-color="#3b82f6"/>
+            <stop offset="1" stop-color="#93c5fd"/>
+        </linearGradient>
+        <linearGradient id="zod" x1="0" y1="0" x2="1" y2="0">
+            <stop offset="0" stop-color="#8b5cf6"/>
+            <stop offset="1" stop-color="#c4b5fd"/>
+        </linearGradient>
+        <linearGradient id="valibot" x1="0" y1="0" x2="1" y2="0">
+            <stop offset="0" stop-color="#ec4899"/>
+            <stop offset="1" stop-color="#f9a8d4"/>
+        </linearGradient>
+        <filter id="shadow" x="-20%" y="-20%" width="140%" height="140%">
+            <feDropShadow dx="0" dy="14" stdDeviation="18" flood-color="#000000" flood-opacity="0.35"/>
+        </filter>
+        <style>
+            text { font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; }
+            .title { fill: #f8fafc; font-size: 42px; font-weight: 800; letter-spacing: 0; }
+            .subtitle { fill: #94a3b8; font-size: 16px; font-weight: 500; }
+            .card-title { fill: #e5e7eb; font-size: 18px; font-weight: 800; }
+            .card-note { fill: #94a3b8; font-size: 12px; font-weight: 600; }
+            .metric-label { fill: #94a3b8; font-size: 12px; font-weight: 700; text-transform: uppercase; }
+            .metric-value { fill: #f8fafc; font-size: 30px; font-weight: 900; }
+            .metric-sub { fill: #cbd5e1; font-size: 13px; font-weight: 600; }
+            .bar-label { fill: #cbd5e1; font-size: 13px; font-weight: 700; }
+            .bar-value { fill: #f8fafc; font-size: 13px; font-weight: 800; }
+            .axis { stroke: #334155; stroke-width: 1; }
+        </style>
+    </defs>
+
+    <rect width="1120" height="760" rx="28" fill="url(#bg)"/>
+    <circle cx="1028" cy="82" r="180" fill="#22c55e" opacity="0.08"/>
+    <circle cx="84" cy="690" r="220" fill="#38bdf8" opacity="0.07"/>
+
+    <text id="headline" x="44" y="58" class="title">TypeSea benchmark comparison</text>
+    <text x="46" y="88" class="subtitle">Local run on 2026-07-04 KST, strict-object contract, ops/sec. Higher is better.</text>
+
+    <g filter="url(#shadow)">
+        <rect x="44" y="118" width="322" height="108" rx="18" fill="url(#panel)" stroke="#1f2937"/>
+        <text x="66" y="148" class="metric-label">Unchecked valid hot path</text>
+        <text x="66" y="188" class="metric-value">42.58M</text>
+        <text x="66" y="210" class="metric-sub">31.7x Zod, 10.0x Ajv</text>
+
+        <rect x="399" y="118" width="322" height="108" rx="18" fill="url(#panel)" stroke="#1f2937"/>
+        <text x="421" y="148" class="metric-label">Safe invalid fast-fail</text>
+        <text x="421" y="188" class="metric-value">42.08M</text>
+        <text x="421" y="210" class="metric-sub">1.51x Ajv, 499x Zod</text>
+
+        <rect x="754" y="118" width="322" height="108" rx="18" fill="url(#panel)" stroke="#1f2937"/>
+        <text x="776" y="148" class="metric-label">Safe valid path</text>
+        <text x="776" y="188" class="metric-value">4.30M</text>
+        <text x="776" y="210" class="metric-sub">Ajv-class while staying safe</text>
+    </g>
+
+    <g filter="url(#shadow)">
+        <rect x="44" y="260" width="1032" height="136" rx="18" fill="url(#panel)" stroke="#1f2937"/>
+        <text x="66" y="291" class="card-title">Valid object path</text>
+        <text x="230" y="291" class="card-note">linear scale to 42.58M</text>
+        <line x1="270" y1="318" x2="1010" y2="318" class="axis"/>
+
+        <text x="66" y="326" class="bar-label">TypeSea unchecked</text>
+        <rect x="270" y="312" width="740" height="15" rx="7.5" fill="url(#unchecked)"/>
+        <text x="1024" y="326" class="bar-value">42.58M</text>
+
+        <text x="66" y="350" class="bar-label">TypeSea unsafe</text>
+        <rect x="270" y="336" width="631" height="15" rx="7.5" fill="url(#unsafe)"/>
+        <text x="915" y="350" class="bar-value">36.30M</text>
+
+        <text x="66" y="374" class="bar-label">TypeSea safe / Ajv / Zod</text>
+        <rect x="270" y="360" width="75" height="15" rx="7.5" fill="url(#safe)"/>
+        <rect x="354" y="360" width="74" height="15" rx="7.5" fill="url(#ajv)"/>
+        <rect x="437" y="360" width="24" height="15" rx="7.5" fill="url(#valibot)"/>
+        <rect x="470" y="360" width="23" height="15" rx="7.5" fill="url(#zod)"/>
+        <text x="506" y="374" class="bar-value">safe 4.30M, Ajv 4.28M, Valibot 1.41M, Zod 1.34M</text>
+    </g>
+
+    <g filter="url(#shadow)">
+        <rect x="44" y="418" width="1032" height="150" rx="18" fill="url(#panel)" stroke="#1f2937"/>
+        <text x="66" y="449" class="card-title">Invalid object fast-fail</text>
+        <text x="268" y="449" class="card-note">linear scale to 50.48M</text>
+        <line x1="270" y1="476" x2="1010" y2="476" class="axis"/>
+
+        <text x="66" y="482" class="bar-label">TypeSea unchecked</text>
+        <rect x="270" y="468" width="740" height="15" rx="7.5" fill="url(#unchecked)"/>
+        <text x="1024" y="482" class="bar-value">50.48M</text>
+
+        <text x="66" y="506" class="bar-label">TypeSea unsafe</text>
+        <rect x="270" y="492" width="728" height="15" rx="7.5" fill="url(#unsafe)"/>
+        <text x="1024" y="506" class="bar-value">49.65M</text>
+
+        <text x="66" y="530" class="bar-label">TypeSea safe</text>
+        <rect x="270" y="516" width="617" height="15" rx="7.5" fill="url(#safe)"/>
+        <text x="902" y="530" class="bar-value">42.08M</text>
+
+        <text x="66" y="554" class="bar-label">Ajv / Valibot / Zod</text>
+        <rect x="270" y="540" width="408" height="15" rx="7.5" fill="url(#ajv)"/>
+        <rect x="690" y="540" width="13" height="15" rx="7.5" fill="url(#valibot)"/>
+        <rect x="714" y="540" width="3" height="15" rx="1.5" fill="url(#zod)"/>
+        <text x="734" y="554" class="bar-value">Ajv 27.82M, Valibot 0.88M, Zod 0.08M</text>
+    </g>
+
+    <g filter="url(#shadow)">
+        <rect x="44" y="576" width="1032" height="136" rx="18" fill="url(#panel)" stroke="#1f2937"/>
+        <text x="66" y="607" class="card-title">Invalid diagnostic path</text>
+        <text x="270" y="607" class="card-note">linear scale to 28.71M; Ajv is a boolean baseline</text>
+        <line x1="270" y1="634" x2="1010" y2="634" class="axis"/>
+
+        <text x="66" y="642" class="bar-label">Ajv compiled</text>
+        <rect x="270" y="628" width="740" height="15" rx="7.5" fill="url(#ajv)"/>
+        <text x="1024" y="642" class="bar-value">28.71M</text>
+
+        <text x="66" y="666" class="bar-label">TypeSea modes</text>
+        <rect x="270" y="652" width="95" height="15" rx="7.5" fill="url(#unchecked)"/>
+        <rect x="374" y="652" width="79" height="15" rx="7.5" fill="url(#unsafe)"/>
+        <rect x="462" y="652" width="54" height="15" rx="7.5" fill="url(#safe)"/>
+        <text x="532" y="666" class="bar-value">unchecked 3.67M, unsafe 3.08M, safe 2.09M</text>
+
+        <text x="66" y="690" class="bar-label">Valibot / Zod</text>
+        <rect x="270" y="676" width="23" height="15" rx="7.5" fill="url(#valibot)"/>
+        <rect x="302" y="676" width="3" height="15" rx="1.5" fill="url(#zod)"/>
+        <text x="322" y="690" class="bar-value">Valibot 0.89M, Zod 0.08M</text>
+    </g>
+
+    <g transform="translate(44 730)">
+        <rect x="0" y="-11" width="13" height="13" rx="3" fill="url(#safe)"/>
+        <text x="20" y="0" class="card-note">TypeSea safe</text>
+        <rect x="128" y="-11" width="13" height="13" rx="3" fill="url(#unsafe)"/>
+        <text x="148" y="0" class="card-note">unsafe</text>
+        <rect x="228" y="-11" width="13" height="13" rx="3" fill="url(#unchecked)"/>
+        <text x="248" y="0" class="card-note">unchecked</text>
+        <rect x="356" y="-11" width="13" height="13" rx="3" fill="url(#ajv)"/>
+        <text x="376" y="0" class="card-note">Ajv</text>
+        <rect x="426" y="-11" width="13" height="13" rx="3" fill="url(#valibot)"/>
+        <text x="446" y="0" class="card-note">Valibot</text>
+        <rect x="536" y="-11" width="13" height="13" rx="3" fill="url(#zod)"/>
+        <text x="556" y="0" class="card-note">Zod</text>
+    </g>
+</svg>

package/docs/engine-notes.md

@@ -18,6 +18,9 @@ allocation sites, branch behavior, and validation contracts visible in code.
 - For all-required strict objects, reject extras by counting own string names
   and own symbols after field validation. Optional strict objects keep the full
   key membership scan.
+- Keep `compile()` and `emitAotModule()` safe by default. Unsafe mode is an
+  explicit opt-in that may use direct property/index loads and own-enumerable
+  strict-key loops after the caller accepts getter/prototype/symbol-extra risk.
 - Mark constructed guards out-of-band so normal receivers avoid repeated schema
   validation while forged receivers still fall back to structural checks.
 - Use `Readonly<Record<string, unknown>>` after object guards.
@@ -91,14 +94,51 @@ descriptor-based element access, and dynamic edges use the same IR-backed
 runtime fallback as ordinary guard execution, preserving behavior for `lazy` and
 `refine`.
 
-Strict object IR emits two shapes. When every declared key is required and has
-already passed the data-property descriptor check, generated validators compare
-`Object.getOwnPropertyNames(value).length` with the declared key count and
-require `Object.getOwnPropertySymbols(value).length === 0`. This keeps
-non-enumerable and symbol extras rejected without paying a `Reflect.ownKeys`
-membership loop on the common all-required path. Optional strict objects still
-emit the full own-key membership scan because a missing optional key cannot be
-distinguished by the final key count alone.
+Strict object IR emits two shapes. When every declared key is required,
+generated validators run the strict-key count before field descriptor reads:
+they compare `Object.getOwnPropertyNames(value).length` with the declared key
+count and require `Object.getOwnPropertySymbols(value).length === 0`. V8
+optimizes this count-only path better than a generic `Reflect.ownKeys` count,
+and it rejects obvious extra-key objects before touching field descriptors.
+Optional strict objects still emit the full own-key membership scan because a
+missing optional key cannot be distinguished by the final key count alone.
+
+`compile(..., { mode: "unsafe" })` and
+`emitAotModule(..., { mode: "unsafe" })` switch generated predicates to a
+trusted-data code shape. Required object fields whose schemas reject
+`undefined` use direct `value[key]` loads without descriptor or own-key checks.
+Required fields that can accept `undefined` retain an own-key presence guard so
+missing required keys do not collapse into valid `undefined` values. Optional
+fields take the direct-load fast path for present non-`undefined` values and
+fall back to an own-key check only for the ambiguous `undefined` case.
+
+Unsafe array, tuple, record, and discriminant paths also prefer direct loads.
+Strict objects use a `for...in` own-enumerable key loop instead of allocating
+own-key arrays.
+Object keys that are ASCII identifier names emit as dot-property loads such as
+`value.id`; other keys emit as escaped string-literal bracket loads. That is
+intentionally not hostile-input equivalent: getters can execute,
+prototype-backed values can be accepted, symbol or non-enumerable strict extras
+are not rejected, and static property names may appear in unsafe generated
+predicate source.
+
+`mode: "unchecked"` keeps the unsafe direct-read shape and removes strict
+extra-key loops. It is a trusted-shape path for objects already normalized by
+the caller; strict objects no longer reject any extra keys there.
+
+Fast modes also remove `Object.freeze()` from successful compiled `check()`
+results. The returned object keeps the same `{ ok: true, value }` shape, but it
+is intentionally not frozen. Failed diagnostics stay frozen because those
+objects are off the success hot path and are often retained for reporting.
+Object diagnostics in fast modes are generated from the same direct-read
+contract as predicates. Required fields load through `value.key`, optional
+fields use direct load plus an own-key fallback for `undefined`, unsafe strict
+objects scan own enumerable string keys, and unchecked strict objects skip the
+strict-key diagnostic scan. Array and tuple diagnostics in fast modes read
+items through direct indexes instead of descriptor probes. Record diagnostics
+read through `record[key]`; unchecked mode intentionally keeps inherited
+enumerable keys visible. Discriminant diagnostics read the tag directly and
+compare literal string cases with strict equality.
 
 ## Recursion
 
@@ -114,6 +154,10 @@ still checking the original object fields on the outer frame.
 Compiled `lazy` and `refine` fallbacks use the same IR-backed runtime path, so
 recursive behavior stays consistent across execution engines.
 
+`checkFirst()` has a separate generated collector. It returns one frozen issue
+as soon as the first diagnostic is known, instead of running the full `check()`
+collector and truncating its issue array.
+
 ## JSON Schema Export
 
 JSON Schema export succeeds only when the TypeSea schema can be represented over
@@ -141,13 +185,16 @@ Zod, Valibot, and Ajv are dev dependencies for measurement only. They are not
 imported by `src`, and package policy rejects runtime, peer, optional, or
 bundled dependency fields before release.
 
-Last local release smoke on 2026-07-04 KST reported this ecosystem boolean
-path over the JSON-compatible strict-object benchmark:
+Last local benchmark on 2026-07-04 KST reported these ecosystem paths over the
+JSON-compatible strict-object benchmark:
 
-| Case | TypeSea runtime plan | TypeSea compiled | Ajv compiled |
-| --- | ---: | ---: | ---: |
-| Valid object | 496,270 hz | 4,237,892 hz | 4,312,174 hz |
-| Invalid object | 3,422,416 hz | 27,125,445 hz | 28,953,501 hz |
+| Case | TypeSea runtime plan | TypeSea compiled safe | TypeSea compiled unsafe | TypeSea compiled unchecked | Ajv compiled |
+| --- | ---: | ---: | ---: | ---: | ---: |
+| Valid `is()` | 513,701 hz | 4,297,306 hz | 36,297,653 hz | 42,581,174 hz | 4,275,389 hz |
+| Valid `check()` | 503,232 hz | 3,903,929 hz | 35,568,425 hz | 40,084,605 hz | 4,278,587 hz |
+| Invalid `is()` | 3,636,369 hz | 42,080,241 hz | 49,654,076 hz | 50,482,732 hz | 27,820,643 hz |
+| Invalid `check()` | 420,446 hz | 2,086,129 hz | 3,077,367 hz | 3,673,508 hz | 28,713,035 hz |
 
 Benchmark numbers are machine-local telemetry. They are useful for catching
-regressions, not for promising a fixed throughput floor.
+regressions, not for promising a fixed throughput floor. Unsafe and unchecked
+numbers are not hostile-input equivalent to safe mode.