z-schema 12.2.0 → 12.4.0

package/src/format-validators.ts

@@ -14,13 +14,13 @@ const dateValidator: FormatValidatorFn = (date: unknown) => {
     return true;
   }
   // full-date from http://tools.ietf.org/html/rfc3339#section-5.6
-  const matches = /^([0-9]{4})-([0-9]{2})-([0-9]{2})$/.exec(date);
+  const matches = /^(?<year>[0-9]{4})-(?<month>[0-9]{2})-(?<day>[0-9]{2})$/.exec(date);
   if (matches === null) {
     return false;
   }
-  const year = parseInt(matches[1], 10);
-  const month = parseInt(matches[2], 10);
-  const day = parseInt(matches[3], 10);
+  const year = Number.parseInt(matches[1], 10);
+  const month = Number.parseInt(matches[2], 10);
+  const day = Number.parseInt(matches[3], 10);
   return isValidRfc3339Date(year, month, day);
 };
 
@@ -29,20 +29,23 @@ const dateTimeValidator: FormatValidatorFn = (dateTime: unknown) => {
     return true;
   }
   // date-time from http://tools.ietf.org/html/rfc3339#section-5.6
-  const s = dateTime.toLowerCase().split('t');
-  if (s.length !== 2) {
+  let tIdx = dateTime.indexOf('T');
+  if (tIdx === -1) {
+    tIdx = dateTime.indexOf('t');
+  }
+  if (tIdx === -1) {
     return false;
   }
-  const datePart = s[0];
-  const timePart = s[1];
+  const datePart = dateTime.slice(0, tIdx);
+  const timePart = dateTime.slice(tIdx + 1);
   // Check date
-  const dateMatches = /^([0-9]{4})-([0-9]{2})-([0-9]{2})$/.exec(datePart);
+  const dateMatches = /^(?<year>[0-9]{4})-(?<month>[0-9]{2})-(?<day>[0-9]{2})$/.exec(datePart);
   if (dateMatches === null) {
     return false;
   }
-  const year = parseInt(dateMatches[1], 10);
-  const month = parseInt(dateMatches[2], 10);
-  const day = parseInt(dateMatches[3], 10);
+  const year = Number.parseInt(dateMatches[1], 10);
+  const month = Number.parseInt(dateMatches[2], 10);
+  const day = Number.parseInt(dateMatches[3], 10);
   if (!isValidRfc3339Date(year, month, day)) {
     return false;
   }
@@ -58,7 +61,7 @@ const emailValidator: FormatValidatorFn = (email: unknown) => {
     return true;
   }
 
-  const ipv6Literal = /^(.+)@\[IPv6:([^\]]+)\]$/i.exec(email);
+  const ipv6Literal = /^(?<localPart>.+)@\[IPv6:(?<address>[^\]]+)\]$/i.exec(email);
   if (!ipv6Literal) {
     return false;
   }
@@ -96,12 +99,13 @@ const ipv6Validator: FormatValidatorFn = (ipv6: unknown) => {
   return isIPModule.default(ipv6, 6);
 };
 
+const INVALID_REGEX_ESCAPES = new Set(['a']);
+
 const regexValidator: FormatValidatorFn = (input: unknown) => {
   if (typeof input !== 'string') {
     return true;
   }
 
-  const invalidEscapes = new Set(['a']);
   for (let idx = 0; idx < input.length; idx++) {
     if (input[idx] !== '\\') {
       continue;
@@ -113,15 +117,19 @@ const regexValidator: FormatValidatorFn = (input: unknown) => {
     }
 
     const escaped = input[idx];
-    if (invalidEscapes.has(escaped)) {
+    if (INVALID_REGEX_ESCAPES.has(escaped)) {
       return false;
     }
   }
 
   try {
-    RegExp(input);
+    // Constructed purely to detect an invalid pattern (throws SyntaxError). The
+    // result is intentionally unused; `new` is required by new-for-builtins and
+    // `void`/call-form trip no-void/new-for-builtins, so no-new is disabled here.
+    // oxlint-disable-next-line no-new
+    new RegExp(input);
     return true;
-  } catch (_e) {
+  } catch {
     return false;
   }
 };
@@ -132,7 +140,7 @@ const durationValidator: FormatValidatorFn = (input: unknown) => {
   }
 
   // eslint-disable-next-line no-control-regex
-  if (!/^P[\x00-\x7F]*$/.test(input)) {
+  if (!/^P[\u0000-\u007F]*$/.test(input)) {
     return false;
   }
 
@@ -163,7 +171,7 @@ const durationValidator: FormatValidatorFn = (input: unknown) => {
     return false;
   }
 
-  const hasDateComponent = /\d+[YMD]/.test(datePart);
+  const hasDateComponent = datePart.length > 0;
   let hasTimeComponent = false;
 
   if (timePart !== undefined) {
@@ -193,43 +201,55 @@ const uuidValidator: FormatValidatorFn = (input: unknown) => {
 
 const strictUriValidator: FormatValidatorFn = (uri: unknown) => typeof uri !== 'string' || isURLModule.default(uri);
 
+const isHexChar = (c: number) => (c >= 48 && c <= 57) || (c >= 65 && c <= 70) || (c >= 97 && c <= 102);
+
 const hasValidPercentEncoding = (str: string): boolean => {
   for (let i = 0; i < str.length; i++) {
-    if (str[i] === '%') {
-      if (i + 2 >= str.length || !/[0-9a-fA-F]/.test(str[i + 1]) || !/[0-9a-fA-F]/.test(str[i + 2])) {
-        return false;
-      }
+    if (
+      str[i] === '%' &&
+      (i + 2 >= str.length || !isHexChar(str.charCodeAt(i + 1)) || !isHexChar(str.charCodeAt(i + 2)))
+    ) {
+      return false;
     }
   }
   return true;
 };
 
-const uriValidator: FormatValidatorFn = function (uri: unknown) {
-  if (typeof uri !== 'string') return true;
+const uriValidator: FormatValidatorFn = (uri: unknown) => {
+  if (typeof uri !== 'string') {
+    return true;
+  }
   // eslint-disable-next-line no-control-regex
-  if (/[^\x00-\x7F]/.test(uri)) return false;
-  if (!hasValidPercentEncoding(uri)) return false;
-  const match = uri.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/?#]*)/);
+  if (/[^\u0000-\u007F]/.test(uri)) {
+    return false;
+  }
+  if (!hasValidPercentEncoding(uri)) {
+    return false;
+  }
+  const match = /^(?<scheme>[a-zA-Z][a-zA-Z0-9+.-]*):\/\/(?<authority>[^/?#]*)/.exec(uri);
   if (match) {
     const authority = match[2];
     const atIndex = authority.indexOf('@');
     if (atIndex > 0) {
-      const userinfo = authority.substring(0, atIndex);
+      // userinfo is a string; prefer-set-has misfires here — two String#includes
+      // calls are faster than building a Set or a regex for this membership check.
+      // oxlint-disable-next-line unicorn/prefer-set-has
+      const userinfo = authority.slice(0, atIndex);
       if (userinfo.includes('[') || userinfo.includes(']')) {
         return false;
       }
     }
     // Validate port: must be numeric
-    let hostPort = atIndex >= 0 ? authority.substring(atIndex + 1) : authority;
+    let hostPort = atIndex === -1 ? authority : authority.slice(atIndex + 1);
     if (hostPort.startsWith('[')) {
       const bracketEnd = hostPort.indexOf(']');
-      if (bracketEnd >= 0) {
-        hostPort = hostPort.substring(bracketEnd + 1);
+      if (bracketEnd !== -1) {
+        hostPort = hostPort.slice(bracketEnd + 1);
       }
     }
     const colonIndex = hostPort.lastIndexOf(':');
-    if (colonIndex >= 0) {
-      const port = hostPort.substring(colonIndex + 1);
+    if (colonIndex !== -1) {
+      const port = hostPort.slice(colonIndex + 1);
       if (port.length > 0 && !/^\d+$/.test(port)) {
         return false;
       }
@@ -239,17 +259,23 @@ const uriValidator: FormatValidatorFn = function (uri: unknown) {
 };
 
 const uriReferenceValidator: FormatValidatorFn = (uri: unknown) => {
-  if (typeof uri !== 'string') return true;
+  if (typeof uri !== 'string') {
+    return true;
+  }
   // eslint-disable-next-line no-control-regex
-  if (/[^\x00-\x7F]/.test(uri)) return false;
+  if (/[^\u0000-\u007F]/.test(uri)) {
+    return false;
+  }
   // URI-reference allows relative URIs
-  return /^([a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/.test(uri);
+  return /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/.test(uri);
 };
 
 const uriTemplateValidator: FormatValidatorFn = (uri: unknown) => {
-  if (typeof uri !== 'string') return true;
+  if (typeof uri !== 'string') {
+    return true;
+  }
   // URI template allows braces for expressions.
-  if (!/^([a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^`| ]*$/.test(uri)) {
+  if (!/^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^`| ]*$/.test(uri)) {
     return false;
   }
 
@@ -286,67 +312,127 @@ const hasValidTildeEscapes = (segment: string): boolean => {
 };
 
 const jsonPointerValidator: FormatValidatorFn = (pointer: unknown) => {
-  if (typeof pointer !== 'string') return true;
+  if (typeof pointer !== 'string') {
+    return true;
+  }
   // JSON Pointer: empty, or a sequence of '/'-prefixed reference tokens.
   // In each token, '~' must be escaped as '~0' or '~1'.
-  if (pointer === '') return true;
-  if (!/^(?:\/[^/]*)+$/.test(pointer)) return false;
-  const tokens = pointer.split('/').slice(1); // first element is empty before leading '/'
-  for (const token of tokens) {
-    if (!hasValidTildeEscapes(token)) return false;
+  if (pointer === '') {
+    return true;
+  }
+  if (!/^(?:\/[^/]*)+$/.test(pointer)) {
+    return false;
+  }
+  const tokens = pointer.split('/');
+  for (let i = 1; i < tokens.length; i++) {
+    if (!hasValidTildeEscapes(tokens[i])) {
+      return false;
+    }
   }
   return true;
 };
 
 const relativeJsonPointerValidator: FormatValidatorFn = (pointer: unknown) => {
-  if (typeof pointer !== 'string') return true;
+  if (typeof pointer !== 'string') {
+    return true;
+  }
   // Relative JSON Pointer: non-negative integer prefix (no leading zeros unless zero),
   // followed by either '#', a JSON Pointer, or nothing.
-  const match = pointer.match(/^(0|[1-9]\d*)(.*)$/);
-  if (!match) return false;
+  const match = /^(?<int>0|[1-9]\d*)(?<suffix>.*)$/.exec(pointer);
+  if (!match) {
+    return false;
+  }
   const suffix = match[2];
-  if (suffix === '' || suffix === '#') return true;
-  if (!suffix.startsWith('/')) return false;
-  if (!/^(?:\/[^/]*)+$/.test(suffix)) return false;
-  const tokens = suffix.split('/').slice(1);
-  for (const token of tokens) {
-    if (!hasValidTildeEscapes(token)) return false;
+  if (suffix === '' || suffix === '#') {
+    return true;
+  }
+  if (!suffix.startsWith('/')) {
+    return false;
+  }
+  if (!/^(?:\/[^/]*)+$/.test(suffix)) {
+    return false;
+  }
+  const tokens = suffix.split('/');
+  for (let i = 1; i < tokens.length; i++) {
+    if (!hasValidTildeEscapes(tokens[i])) {
+      return false;
+    }
   }
   return true;
 };
 
 const timeValidator: FormatValidatorFn = (time: unknown) => {
-  if (typeof time !== 'string') return true;
+  if (typeof time !== 'string') {
+    return true;
+  }
   return parseRfc3339Time(time) !== null;
 };
 
+// Matches a lone (unpaired) UTF-16 surrogate — either a high surrogate not
+// followed by a low surrogate, or a low surrogate not preceded by a high one.
+const LONE_SURROGATE_REGEX = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+// A quoted local part: any char except a bare quote/backslash; backslash escapes
+// allowed. Leniently permits raw control chars (e.g. bare CR/LF), which stricter
+// RFC 5321 parsing forbids — an accepted limitation, not exercised by the suite.
+const QUOTED_LOCAL_PART_REGEX = /^"(?:[^"\\]|\\.)*"$/u;
+const UNQUOTED_LOCAL_PART_REGEX = /^[^\s@]+$/u;
+
+const isValidIdnEmailLocalPart = (localPart: string): boolean => {
+  if (localPart.length === 0 || LONE_SURROGATE_REGEX.test(localPart)) {
+    return false;
+  }
+  if (localPart.length >= 2 && localPart.startsWith('"') && localPart.endsWith('"')) {
+    return QUOTED_LOCAL_PART_REGEX.test(localPart);
+  }
+  return UNQUOTED_LOCAL_PART_REGEX.test(localPart);
+};
+
 const idnEmailValidator: FormatValidatorFn = (email: unknown) => {
-  if (typeof email !== 'string') return true;
-  // Simple email check, allowing international chars
-  return /^[^\s@]+@[^\s@]+$/.test(email);
+  if (typeof email !== 'string') {
+    return true;
+  }
+  // Split on the last '@': everything after it is the (idn-)hostname domain,
+  // everything before it is the local part (which may itself be quoted).
+  // Note: unlike the ASCII `email` validator, IP-literal domains
+  // (`user@[192.168.1.1]` / `@[IPv6:...]`) are not supported here.
+  const atIdx = email.lastIndexOf('@');
+  if (atIdx <= 0 || atIdx === email.length - 1) {
+    return false;
+  }
+  return isValidIdnEmailLocalPart(email.slice(0, atIdx)) && isValidIdnHostname(email.slice(atIdx + 1));
 };
 
 const idnHostnameValidator: FormatValidatorFn = (hostname: unknown) => {
-  if (typeof hostname !== 'string') return true;
+  if (typeof hostname !== 'string') {
+    return true;
+  }
   return isValidIdnHostname(hostname);
 };
 
 const iriValidator: FormatValidatorFn = (iri: unknown) => {
-  if (typeof iri !== 'string') return true;
+  if (typeof iri !== 'string') {
+    return true;
+  }
   if (!/^[a-zA-Z][a-zA-Z0-9+.-]*:[^"\\<>^{}^`| ]*$/u.test(iri)) {
     return false;
   }
   try {
+    // Constructed purely to detect an unparseable IRI (throws). Avoids URL.canParse,
+    // which is unavailable in older browsers the UMD build still targets; no-new is
+    // disabled here as the construction is intentional and the result is unused.
+    // oxlint-disable-next-line no-new
     new URL(iri);
     return true;
-  } catch (_e) {
+  } catch {
     return false;
   }
 };
 
 const iriReferenceValidator: FormatValidatorFn = (iriReference: unknown) => {
-  if (typeof iriReference !== 'string') return true;
-  return /^([a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/u.test(iriReference);
+  if (typeof iriReference !== 'string') {
+    return true;
+  }
+  return /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/u.test(iriReference);
 };
 
 export interface FormatValidatorsOptions {
@@ -385,10 +471,24 @@ export function getFormatValidators(options?: FormatValidatorsOptions): Record<s
     ...inbuiltValidators,
     ...(options?.strictUris ? { uri: strictUriValidator } : {}),
     ...customValidators,
-    ...(options?.customFormats || {}),
+    ...options?.customFormats,
   };
 }
 
+export function resolveFormatValidator(name: string, options?: FormatValidatorsOptions): FormatValidatorFn | undefined {
+  const custom = options?.customFormats;
+  if (custom && Object.hasOwn(custom, name)) {
+    return custom[name] as FormatValidatorFn | undefined;
+  }
+  if (Object.hasOwn(customValidators, name)) {
+    return customValidators[name];
+  }
+  if (options?.strictUris && name === 'uri') {
+    return strictUriValidator;
+  }
+  return inbuiltValidators[name];
+}
+
 export function registerFormat(name: string, validatorFunction: FormatValidatorFn) {
   customValidators[name] = validatorFunction;
 }
@@ -411,10 +511,16 @@ export function isFormatSupported(name: string, customFormats?: Record<string, F
   if (customFormats) {
     const custom = customFormats[name];
     // Explicitly null means unregistered at instance level
-    if (custom === null) return false;
-    if (custom != null) return true;
+    if (custom === null) {
+      return false;
+    }
+    if (custom != null) {
+      return true;
+    }
+  }
+  if (name in customValidators) {
+    return customValidators[name] != null;
   }
-  if (name in customValidators) return customValidators[name] != null;
   return name in inbuiltValidators;
 }
 

package/src/json-schema-versions.ts

@@ -75,11 +75,65 @@ export interface JsonSchemaAll extends JsonSchemaCommon {
 // Internal types (schema + z-schema runtime properties)
 // ---------------------------------------------------------------------------
 
+/**
+ * Sub-schema-valued keywords. On the internal type these point at
+ * `JsonSchemaInternal` (rather than the public `JsonSchema`) so the validator
+ * can traverse nested schemas without asserting `as JsonSchemaInternal` at
+ * every step.
+ */
+type InternalSchemaKeys =
+  | 'items'
+  | 'additionalItems'
+  | 'properties'
+  | 'patternProperties'
+  | 'additionalProperties'
+  | 'dependencies'
+  | 'allOf'
+  | 'anyOf'
+  | 'oneOf'
+  | 'not'
+  | 'definitions'
+  | 'contains'
+  | 'propertyNames'
+  | 'if'
+  | 'then'
+  | 'else'
+  | '$defs'
+  | 'dependentSchemas'
+  | 'unevaluatedItems'
+  | 'unevaluatedProperties'
+  | 'prefixItems';
+
 /**
  * Internal schema type used throughout the validator. Based on `JsonSchemaAll`
- * so that validators can access any draft-specific property without narrowing.
+ * so that validators can access any draft-specific property without narrowing,
+ * but with every sub-schema keyword re-typed to `JsonSchemaInternal` so nested
+ * traversal needs no type assertions.
  */
-export type JsonSchemaInternal = JsonSchemaAll & ZSchemaInternalProperties;
+export type JsonSchemaInternal = Omit<JsonSchemaAll, InternalSchemaKeys> &
+  ZSchemaInternalProperties & {
+    items?: JsonSchemaInternal | boolean | Array<JsonSchemaInternal | boolean>;
+    additionalItems?: boolean | JsonSchemaInternal;
+    properties?: Record<string, JsonSchemaInternal | boolean>;
+    patternProperties?: Record<string, JsonSchemaInternal>;
+    additionalProperties?: boolean | JsonSchemaInternal;
+    dependencies?: Record<string, string[] | JsonSchemaInternal>;
+    allOf?: JsonSchemaInternal[];
+    anyOf?: JsonSchemaInternal[];
+    oneOf?: JsonSchemaInternal[];
+    not?: JsonSchemaInternal;
+    definitions?: Record<string, JsonSchemaInternal>;
+    contains?: JsonSchemaInternal;
+    propertyNames?: JsonSchemaInternal;
+    if?: JsonSchemaInternal | boolean;
+    then?: JsonSchemaInternal | boolean;
+    else?: JsonSchemaInternal | boolean;
+    $defs?: Record<string, JsonSchemaInternal>;
+    dependentSchemas?: Record<string, JsonSchemaInternal>;
+    unevaluatedItems?: JsonSchemaInternal | boolean;
+    unevaluatedProperties?: JsonSchemaInternal | boolean;
+    prefixItems?: Array<JsonSchemaInternal | boolean>;
+  };
 
 /** @deprecated Use `JsonSchemaInternal` — they are now equivalent. */
 export type JsonSchemaInternalAll = JsonSchemaAll & ZSchemaInternalProperties;

package/src/json-schema.ts

@@ -2,18 +2,19 @@ import type { JsonSchema, JsonSchemaInternal } from './json-schema-versions.js';
 import type { Reference } from './schema-compiler.js';
 import type { ZSchemaOptions } from './z-schema-options.js';
 
+import { DEFAULT_MAX_RECURSION_DEPTH } from './utils/constants.js';
 import { getRemotePath, isAbsoluteUri } from './utils/uri.js';
+import { isObject } from './utils/what-is.js';
 
 /**
  * Keywords whose values are not JSON Schema sub-schemas and must not be
  * traversed during schema walking (id collection, reference collection, etc.).
  */
 export const NON_SCHEMA_KEYWORDS = ['enum', 'const', 'default', 'examples'] as const;
+export const NON_SCHEMA_KEYWORDS_SET = new Set<string>(NON_SCHEMA_KEYWORDS);
 
 /** Returns true if the key is an internal z-schema property (prefixed with `__$`). */
 export const isInternalKey = (key: string): boolean => key.startsWith('__$');
-import { DEFAULT_MAX_RECURSION_DEPTH } from './utils/constants.js';
-import { isObject } from './utils/what-is.js';
 
 /**
  * Properties present in ALL JSON Schema drafts (04 through 2020-12) with
@@ -30,7 +31,7 @@ export interface JsonSchemaCommon {
 
   // ── Type / enum ─────────────────────────────────────────────────────────
   type?: string | string[];
-  enum?: Array<unknown>;
+  enum?: unknown[];
   format?: string;
 
   // ── Numeric ─────────────────────────────────────────────────────────────
@@ -78,9 +79,9 @@ export type JsonSchemaType = 'array' | 'boolean' | 'integer' | 'null' | 'number'
 export interface ZSchemaInternalProperties {
   __$compiled?: unknown;
   __$missingReferences?: Reference[];
-  __$refResolved?: JsonSchema;
-  __$dynamicRefResolved?: JsonSchema;
-  __$recursiveRefResolved?: JsonSchema;
+  __$refResolved?: JsonSchemaInternal;
+  __$dynamicRefResolved?: JsonSchemaInternal;
+  __$recursiveRefResolved?: JsonSchemaInternal;
   __$resourceRoot?: JsonSchemaInternal;
   __$schemaResolved?: unknown;
   __$validated?: boolean;
@@ -142,7 +143,7 @@ export const findId = (
   const inTargetBase = !targetBaseUri || nextBaseUri === targetBaseUri;
 
   if (inTargetBase) {
-    if (schemaId && (schemaId === id || (schemaId[0] === '#' && schemaId.substring(1) === id))) {
+    if (schemaId && (schemaId === id || (schemaId.startsWith('#') && schemaId.slice(1) === id))) {
       return schema;
     }
     if (schema.$anchor === id || schema.$dynamicAnchor === id) {
@@ -153,7 +154,7 @@ export const findId = (
   let result;
   if (Array.isArray(schema)) {
     for (let i = 0; i < schema.length; i++) {
-      result = findId(schema[i], id, targetBaseUri, nextBaseUri, maxDepth, _depth + 1);
+      result = findId(schema[i] as JsonSchemaInternal, id, targetBaseUri, nextBaseUri, maxDepth, _depth + 1);
       if (result) {
         return result;
       }
@@ -167,7 +168,7 @@ export const findId = (
     // intermediate resources - pointer reference across resource boundary".
     for (let i = keys.length - 1; i >= 0; i--) {
       const k = keys[i];
-      if (isInternalKey(k) || NON_SCHEMA_KEYWORDS.includes(k as any)) {
+      if (isInternalKey(k) || NON_SCHEMA_KEYWORDS_SET.has(k)) {
         continue;
       }
       result = findId(schema[k] as JsonSchemaInternal, id, targetBaseUri, nextBaseUri, maxDepth, _depth + 1);