z-schema 10.0.0 → 12.0.0

package/dist/errors.js

@@ -12,6 +12,7 @@ export const Errors = {
     ARRAY_LENGTH_LONG: 'Array is too long ({0}), maximum {1}',
     ARRAY_UNIQUE: 'Array items are not unique (indexes {0} and {1})',
     ARRAY_ADDITIONAL_ITEMS: 'Additional items not allowed',
+    ARRAY_UNEVALUATED_ITEMS: 'Unevaluated items are not allowed',
     // Numeric errors
     MULTIPLE_OF: 'Value {0} is not a multiple of {1}',
     MINIMUM: 'Value {0} is less than minimum {1}',
@@ -23,6 +24,7 @@ export const Errors = {
     OBJECT_PROPERTIES_MAXIMUM: 'Too many properties defined ({0}), maximum {1}',
     OBJECT_MISSING_REQUIRED_PROPERTY: 'Missing required property: {0}',
     OBJECT_ADDITIONAL_PROPERTIES: 'Additional properties not allowed: {0}',
+    OBJECT_UNEVALUATED_PROPERTIES: 'Unevaluated properties are not allowed: {0}',
     OBJECT_DEPENDENCY_KEY: 'Dependency failed - key must exist: {0} (due to key: {1})',
     // String errors
     MIN_LENGTH: 'String is too short ({0} chars), minimum {1}',
@@ -52,6 +54,9 @@ export const Errors = {
     CONST: 'Value does not match const: {0}',
     CONTAINS: 'Array does not contain an item matching the schema',
     PROPERTY_NAMES: 'Property name {0} does not match the propertyNames schema',
+    // Draft-2019-09+ errors
+    COLLECT_EVALUATED_DEPTH_EXCEEDED: 'Schema nesting depth exceeded maximum ({0}) during unevaluated items/properties collection',
+    MAX_RECURSION_DEPTH_EXCEEDED: 'Maximum recursion depth ({0}) exceeded. If your schema or data is deeply nested and valid, increase the maxRecursionDepth option.',
 };
 export class ValidateError extends Error {
     name;

package/dist/format-validators.js

@@ -1,7 +1,10 @@
 import isEmailModule from 'validator/lib/isEmail.js';
 import isIPModule from 'validator/lib/isIP.js';
 import isURLModule from 'validator/lib/isURL.js';
+import { isValidRfc3339Date } from './utils/date.js';
+import { isValidHostname, isValidIdnHostname } from './utils/hostname.js';
 import { sortedKeys } from './utils/json.js';
+import { parseRfc3339Time } from './utils/time.js';
 const dateValidator = (date) => {
     if (typeof date !== 'string') {
         return true;
@@ -11,13 +14,10 @@ const dateValidator = (date) => {
     if (matches === null) {
         return false;
     }
-    // var year = matches[1];
-    // var month = matches[2];
-    // var day = matches[3];
-    if (matches[2] < '01' || matches[2] > '12' || matches[3] < '01' || matches[3] > '31') {
-        return false;
-    }
-    return true;
+    const year = parseInt(matches[1], 10);
+    const month = parseInt(matches[2], 10);
+    const day = parseInt(matches[3], 10);
+    return isValidRfc3339Date(year, month, day);
 };
 const dateTimeValidator = (dateTime) => {
     if (typeof dateTime !== 'string') {
@@ -38,111 +38,34 @@ const dateTimeValidator = (dateTime) => {
     const year = parseInt(dateMatches[1], 10);
     const month = parseInt(dateMatches[2], 10);
     const day = parseInt(dateMatches[3], 10);
-    if (month < 1 || month > 12 || day < 1 || day > 31) {
-        return false;
-    }
-    // Check if date is valid
-    const date = new Date(year, month - 1, day);
-    if (date.getFullYear() !== year || date.getMonth() !== month - 1 || date.getDate() !== day) {
-        return false;
-    }
-    // Check time
-    const timeMatches = /^([0-9]{2}):([0-9]{2}):([0-9]{2})(.[0-9]+)?(z|([+-][0-9]{2}:[0-9]{2}))$/.exec(timePart);
-    if (timeMatches === null) {
+    if (!isValidRfc3339Date(year, month, day)) {
         return false;
     }
-    const hour = parseInt(timeMatches[1], 10);
-    const minute = parseInt(timeMatches[2], 10);
-    const second = parseInt(timeMatches[3], 10);
-    if (hour > 23 || minute > 59 || second > 60) {
-        return false;
-    }
-    // Check offset
-    let utcHour = hour;
-    if (timeMatches[5] !== 'z') {
-        const offset = timeMatches[5];
-        const offsetMatches = /^([+-])([0-9]{2}):([0-9]{2})$/.exec(offset);
-        if (offsetMatches === null) {
-            return false;
-        }
-        const offsetSign = offsetMatches[1];
-        const offsetHour = parseInt(offsetMatches[2], 10);
-        const offsetMinute = parseInt(offsetMatches[3], 10);
-        if (offsetHour > 23 || offsetMinute > 59) {
-            return false;
-        }
-        if (offsetSign === '+') {
-            utcHour = hour - offsetHour;
-        }
-        else {
-            utcHour = hour + offsetHour;
-        }
-        utcHour = ((utcHour % 24) + 24) % 24;
-    }
-    // Leap second only at 23:59:60 UTC
-    if (second === 60) {
-        if (utcHour !== 23 || minute !== 59) {
-            return false;
-        }
-    }
-    return true;
+    return parseRfc3339Time(timePart) !== null;
 };
 const emailValidator = (email) => {
     if (typeof email !== 'string') {
         return true;
     }
-    return isEmailModule.default(email, { require_tld: true });
+    if (isEmailModule.default(email, { require_tld: true, allow_ip_domain: true })) {
+        return true;
+    }
+    const ipv6Literal = /^(.+)@\[IPv6:([^\]]+)\]$/i.exec(email);
+    if (!ipv6Literal) {
+        return false;
+    }
+    const localPart = ipv6Literal[1];
+    const addressPart = ipv6Literal[2];
+    if (!isIPModule.default(addressPart, 6)) {
+        return false;
+    }
+    return isEmailModule.default(`${localPart}@example.com`, { require_tld: true });
 };
 const hostnameValidator = (hostname) => {
     if (typeof hostname !== 'string') {
         return true;
     }
-    /*
-            http://json-schema.org/latest/json-schema-validation.html#anchor114
-            A string instance is valid against this attribute if it is a valid
-            representation for an Internet host name, as defined by RFC 1034, section 3.1 [RFC1034].
-  
-            http://tools.ietf.org/html/rfc1034#section-3.5
-  
-            <digit> ::= any one of the ten digits 0 through 9
-            var digit = /[0-9]/;
-  
-            <letter> ::= any one of the 52 alphabetic characters A through Z in upper case and a through z in lower case
-            var letter = /[a-zA-Z]/;
-  
-            <let-dig> ::= <letter> | <digit>
-            var letDig = /[0-9a-zA-Z]/;
-  
-            <let-dig-hyp> ::= <let-dig> | "-"
-            var letDigHyp = /[-0-9a-zA-Z]/;
-  
-            <ldh-str> ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
-            var ldhStr = /[-0-9a-zA-Z]+/;
-  
-            <label> ::= <letter> [ [ <ldh-str> ] <let-dig> ]
-            var label = /[a-zA-Z](([-0-9a-zA-Z]+)?[0-9a-zA-Z])?/;
-  
-            <subdomain> ::= <label> | <subdomain> "." <label>
-            var subdomain = /^[a-zA-Z](([-0-9a-zA-Z]+)?[0-9a-zA-Z])?(\.[a-zA-Z](([-0-9a-zA-Z]+)?[0-9a-zA-Z])?)*$/;
-  
-            <domain> ::= <subdomain> | " "
-            var domain = null;
-        */
-    const valid = /^[a-zA-Z](([-0-9a-zA-Z]+)?[0-9a-zA-Z])?(\.[a-zA-Z](([-0-9a-zA-Z]+)?[0-9a-zA-Z])?)*$/.test(hostname);
-    if (valid) {
-        // the sum of all label octets and label lengths is limited to 255.
-        if (hostname.length > 255) {
-            return false;
-        }
-        // Each node has a label, which is zero to 63 octets in length
-        const labels = hostname.split('.');
-        for (let i = 0; i < labels.length; i++) {
-            if (labels[i].length > 63) {
-                return false;
-            }
-        }
-    }
-    return valid;
+    return isValidHostname(hostname);
 };
 const ipv4Validator = (ipv4) => {
     if (typeof ipv4 !== 'string') {
@@ -161,7 +84,21 @@ const ipv6Validator = (ipv6) => {
 };
 const regexValidator = (input) => {
     if (typeof input !== 'string') {
-        return false;
+        return true;
+    }
+    const invalidEscapes = new Set(['a']);
+    for (let idx = 0; idx < input.length; idx++) {
+        if (input[idx] !== '\\') {
+            continue;
+        }
+        idx++;
+        if (idx >= input.length) {
+            return false;
+        }
+        const escaped = input[idx];
+        if (invalidEscapes.has(escaped)) {
+            return false;
+        }
     }
     try {
         RegExp(input);
@@ -171,6 +108,55 @@ const regexValidator = (input) => {
         return false;
     }
 };
+const durationValidator = (input) => {
+    if (typeof input !== 'string') {
+        return true;
+    }
+    // eslint-disable-next-line no-control-regex
+    if (!/^P[\x00-\x7F]*$/.test(input)) {
+        return false;
+    }
+    if (!input.startsWith('P')) {
+        return false;
+    }
+    const body = input.slice(1);
+    if (body.length === 0) {
+        return false;
+    }
+    if (body.includes('W')) {
+        return /^\d+W$/.test(body);
+    }
+    const parts = body.split('T');
+    if (parts.length > 2) {
+        return false;
+    }
+    const datePart = parts[0];
+    const timePart = parts.length === 2 ? parts[1] : undefined;
+    if (!/^(?:\d+Y)?(?:\d+M)?(?:\d+D)?$/.test(datePart)) {
+        return false;
+    }
+    const hasDateComponent = /\d+[YMD]/.test(datePart);
+    let hasTimeComponent = false;
+    if (timePart !== undefined) {
+        if (timePart.length === 0) {
+            return false;
+        }
+        if (!/^(?:\d+H)?(?:\d+M)?(?:\d+S)?$/.test(timePart)) {
+            return false;
+        }
+        hasTimeComponent = /\d+[HMS]/.test(timePart);
+        if (!hasTimeComponent) {
+            return false;
+        }
+    }
+    return hasDateComponent || hasTimeComponent;
+};
+const uuidValidator = (input) => {
+    if (typeof input !== 'string') {
+        return true;
+    }
+    return /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(input);
+};
 const strictUriValidator = (uri) => typeof uri !== 'string' || isURLModule.default(uri);
 const uriValidator = function (uri) {
     if (typeof uri !== 'string')
@@ -235,14 +221,14 @@ const jsonPointerValidator = (pointer) => {
 const relativeJsonPointerValidator = (pointer) => {
     if (typeof pointer !== 'string')
         return true;
-    // Relative JSON Pointer: number#path or empty
-    return /^\d+(#.*)?$/.test(pointer) || pointer === '';
+    // Relative JSON Pointer: non-negative integer prefix (no leading zeros unless zero),
+    // followed by either '#', a JSON Pointer, or nothing.
+    return /^(?:0|[1-9]\d*)(?:#|(?:\/(?:[^~]|~0|~1)*)+)?$/.test(pointer);
 };
 const timeValidator = (time) => {
     if (typeof time !== 'string')
         return true;
-    // time: hh:mm:ss[.fraction]
-    return /^([01]\d|2[0-3]):([0-5]\d):([0-5]\d)(\.\d+)?$/.test(time);
+    return parseRfc3339Time(time) !== null;
 };
 const idnEmailValidator = (email) => {
     if (typeof email !== 'string')
@@ -250,6 +236,30 @@ const idnEmailValidator = (email) => {
     // Simple email check, allowing international chars
     return /^[^\s@]+@[^\s@]+$/.test(email);
 };
+const idnHostnameValidator = (hostname) => {
+    if (typeof hostname !== 'string')
+        return true;
+    return isValidIdnHostname(hostname);
+};
+const iriValidator = (iri) => {
+    if (typeof iri !== 'string')
+        return true;
+    if (!/^[a-zA-Z][a-zA-Z0-9+.-]*:[^"\\<>^{}^`| ]*$/u.test(iri)) {
+        return false;
+    }
+    try {
+        new URL(iri);
+        return true;
+    }
+    catch (_e) {
+        return false;
+    }
+};
+const iriReferenceValidator = (iriReference) => {
+    if (typeof iriReference !== 'string')
+        return true;
+    return /^([a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/u.test(iriReference);
+};
 const inbuiltValidators = {
     date: dateValidator,
     'date-time': dateTimeValidator,
@@ -267,6 +277,11 @@ const inbuiltValidators = {
     'relative-json-pointer': relativeJsonPointerValidator,
     time: timeValidator,
     'idn-email': idnEmailValidator,
+    'idn-hostname': idnHostnameValidator,
+    iri: iriValidator,
+    'iri-reference': iriReferenceValidator,
+    duration: durationValidator,
+    uuid: uuidValidator,
 };
 const customValidators = {};
 export function getFormatValidators(options) {
@@ -293,8 +308,17 @@ export function getSupportedFormats(customFormats) {
     return keys.filter((key) => merged[key] != null);
 }
 export function isFormatSupported(name, customFormats) {
-    const supported = getSupportedFormats(customFormats);
-    return supported.includes(name);
+    if (customFormats) {
+        const custom = customFormats[name];
+        // Explicitly null means unregistered at instance level
+        if (custom === null)
+            return false;
+        if (custom != null)
+            return true;
+    }
+    if (name in customValidators)
+        return customValidators[name] != null;
+    return name in inbuiltValidators;
 }
 export function getRegisteredFormats() {
     return sortedKeys(customValidators);

package/dist/json-schema-versions.js

@@ -1,5 +1,8 @@
-export const CURRENT_DEFAULT_SCHEMA_VERSION = 'draft-06';
+export const CURRENT_DEFAULT_SCHEMA_VERSION = 'draft2020-12';
 export const VERSION_SCHEMA_URL_MAPPING = {
     'draft-04': 'http://json-schema.org/draft-04/schema#',
     'draft-06': 'http://json-schema.org/draft-06/schema#',
+    'draft-07': 'http://json-schema.org/draft-07/schema#',
+    'draft2019-09': 'https://json-schema.org/draft/2019-09/schema',
+    'draft2020-12': 'https://json-schema.org/draft/2020-12/schema',
 };

package/dist/json-schema.js

@@ -1,14 +1,23 @@
+import { getRemotePath, isAbsoluteUri } from './utils/uri.js';
+/**
+ * Keywords whose values are not JSON Schema sub-schemas and must not be
+ * traversed during schema walking (id collection, reference collection, etc.).
+ */
+export const NON_SCHEMA_KEYWORDS = ['enum', 'const', 'default', 'examples'];
+/** Returns true if the key is an internal z-schema property (prefixed with `__$`). */
+export const isInternalKey = (key) => key.startsWith('__$');
 import { isObject } from './utils/what-is.js';
+import { DEFAULT_MAX_RECURSION_DEPTH } from './z-schema-options.js';
 export const getId = (schema) => {
-    if (schema.$id) {
-        return schema.$id;
-    }
-    if (schema.id) {
+    // Draft-04 uses `id` exclusively — never return `$id` for a draft-04 schema
+    if (typeof schema.$schema === 'string' && schema.$schema.includes('draft-04')) {
         return schema.id;
     }
-    return undefined;
+    // Draft-06+ uses `$id`; fall back to `id` for backward compatibility
+    // with schemas that haven't migrated to `$id` yet.
+    return schema.$id ?? schema.id;
 };
-export const findId = (schema, id) => {
+export const findId = (schema, id, targetBaseUri, currentBaseUri, maxDepth = DEFAULT_MAX_RECURSION_DEPTH, _depth = 0) => {
     // process only arrays and objects
     if (typeof schema !== 'object' || schema === null) {
         return;
@@ -17,17 +26,39 @@ export const findId = (schema, id) => {
     if (!id) {
         return schema;
     }
+    if (_depth >= maxDepth) {
+        throw new Error(`Maximum recursion depth (${maxDepth}) exceeded in findId. ` +
+            'If your schema is deeply nested and valid, increase the maxRecursionDepth option.');
+    }
+    const baseUri = currentBaseUri ?? targetBaseUri;
     const schemaId = getId(schema);
+    let nextBaseUri = baseUri;
     if (schemaId) {
-        if (schemaId === id || (schemaId[0] === '#' && schemaId.substring(1) === id)) {
+        if (isAbsoluteUri(schemaId)) {
+            nextBaseUri = getRemotePath(schemaId);
+        }
+        else if (baseUri && isAbsoluteUri(baseUri)) {
+            try {
+                nextBaseUri = getRemotePath(new URL(schemaId, baseUri).toString());
+            }
+            catch {
+                // keep existing scope when URL resolution fails
+            }
+        }
+    }
+    const inTargetBase = !targetBaseUri || nextBaseUri === targetBaseUri;
+    if (inTargetBase) {
+        if (schemaId && (schemaId === id || (schemaId[0] === '#' && schemaId.substring(1) === id))) {
+            return schema;
+        }
+        if (schema.$anchor === id || schema.$dynamicAnchor === id) {
             return schema;
         }
     }
-    let idx, result;
+    let result;
     if (Array.isArray(schema)) {
-        idx = schema.length;
-        while (idx--) {
-            result = findId(schema[idx], id);
+        for (let i = 0; i < schema.length; i++) {
+            result = findId(schema[i], id, targetBaseUri, nextBaseUri, maxDepth, _depth + 1);
             if (result) {
                 return result;
             }
@@ -35,13 +66,16 @@ export const findId = (schema, id) => {
     }
     if (isObject(schema)) {
         const keys = Object.keys(schema);
-        idx = keys.length;
-        while (idx--) {
-            const k = keys[idx];
-            if (k.indexOf('__$') === 0) {
+        // Reverse iteration: when sibling sub-schemas share the same $dynamicAnchor
+        // name, the LAST sibling (by key order) must win.  This is required for
+        // $dynamicRef correctness — e.g. the optional test "$dynamicRef skips over
+        // intermediate resources - pointer reference across resource boundary".
+        for (let i = keys.length - 1; i >= 0; i--) {
+            const k = keys[i];
+            if (isInternalKey(k) || NON_SCHEMA_KEYWORDS.includes(k)) {
                 continue;
             }
-            result = findId(schema[k], id);
+            result = findId(schema[k], id, targetBaseUri, nextBaseUri, maxDepth, _depth + 1);
             if (result) {
                 return result;
             }