z-schema 12.3.1 → 12.4.0

package/dist/utils/hostname.js

@@ -3,6 +3,94 @@ import punycode from "punycode/punycode.js";
 //#region src/utils/hostname.ts
 const IDN_SEPARATOR_REGEX = /[\u3002\uFF0E\uFF61]/g;
 const IDN_SEPARATOR_TEST_REGEX = /[\u3002\uFF0E\uFF61]/;
+const XN_LABEL_REGEX = /^xn--/i;
+const DISALLOWED_CATEGORY_REGEX = /[\p{P}\p{S}\p{Z}\p{C}]/u;
+const DISALLOWED_CATEGORY_WHITELIST = /* @__PURE__ */ new Set([
+	"-",
+	"·",
+	"͵",
+	"׳",
+	"״",
+	"・",
+	"۽",
+	"۾",
+	"་",
+	"‌",
+	"‍"
+]);
+const isDisallowedCodePoint = (char) => DISALLOWED_CATEGORY_REGEX.test(char) && !DISALLOWED_CATEGORY_WHITELIST.has(char);
+const TRANSPARENT_MARK_REGEX = /\p{Mn}/u;
+const ARABIC_SCRIPT_REGEX = /\p{Script=Arabic}/u;
+const ARABIC_INDIC_DIGITS_REGEX = /[\u0660-\u0669\u06F0-\u06F9]/;
+const isArabicJoiningLetter = (char) => char !== void 0 && ARABIC_SCRIPT_REGEX.test(char) && !ARABIC_INDIC_DIGITS_REGEX.test(char);
+const hasZwnjJoiningContext = (label, idx) => {
+	let before = idx - 1;
+	while (before >= 0 && TRANSPARENT_MARK_REGEX.test(label[before])) before--;
+	let after = idx + 1;
+	while (after < label.length && TRANSPARENT_MARK_REGEX.test(label[after])) after++;
+	return isArabicJoiningLetter(label[before]) && isArabicJoiningLetter(label[after]);
+};
+const BIDI_NSM_REGEX = /[\p{Mn}\p{Me}]/u;
+const BIDI_ARABIC_INDIC_DIGIT_REGEX = /[\u0660-\u0669]/;
+const BIDI_EXTENDED_ARABIC_INDIC_DIGIT_REGEX = /[\u06F0-\u06F9]/;
+const BIDI_HEBREW_SCRIPT_REGEX = /\p{Script=Hebrew}/u;
+const BIDI_AL_SCRIPT_REGEX = /[\p{Script=Arabic}\p{Script=Syriac}\p{Script=Thaana}]/u;
+const BIDI_ASCII_DIGIT_REGEX = /[0-9]/;
+const BIDI_LETTER_REGEX = /\p{L}/u;
+const classifyBidi = (char) => {
+	if (BIDI_NSM_REGEX.test(char)) return "NSM";
+	if (BIDI_ARABIC_INDIC_DIGIT_REGEX.test(char)) return "AN";
+	if (BIDI_EXTENDED_ARABIC_INDIC_DIGIT_REGEX.test(char)) return "EN";
+	if (BIDI_HEBREW_SCRIPT_REGEX.test(char)) return "R";
+	if (BIDI_AL_SCRIPT_REGEX.test(char)) return "AL";
+	if (BIDI_ASCII_DIGIT_REGEX.test(char)) return "EN";
+	if (BIDI_LETTER_REGEX.test(char)) return "L";
+	return "ON";
+};
+const isLabelBidiTriggering = (label) => {
+	for (const char of label) {
+		const bidiClass = classifyBidi(char);
+		if (bidiClass === "R" || bidiClass === "AL" || bidiClass === "AN") return true;
+	}
+	return false;
+};
+const isLabelBidiRuleValid = (label) => {
+	const classes = [];
+	for (const char of label) classes.push(classifyBidi(char));
+	if (classes.length === 0) return false;
+	const first = classes[0];
+	if (first !== "L" && first !== "R" && first !== "AL") return false;
+	let lastIdx = classes.length - 1;
+	while (lastIdx > 0 && classes[lastIdx] === "NSM") lastIdx--;
+	const last = classes[lastIdx];
+	if (first === "R" || first === "AL") {
+		let hasEN = false;
+		let hasAN = false;
+		for (let i = 0; i < classes.length; i++) {
+			const c = classes[i];
+			if (c !== "R" && c !== "AL" && c !== "AN" && c !== "EN" && c !== "NSM" && c !== "ON") return false;
+			if (c === "EN") hasEN = true;
+			else if (c === "AN") hasAN = true;
+		}
+		if (hasEN && hasAN) return false;
+		return last === "R" || last === "AL" || last === "EN" || last === "AN";
+	}
+	for (let i = 0; i < classes.length; i++) {
+		const c = classes[i];
+		if (c !== "L" && c !== "EN" && c !== "NSM" && c !== "ON") return false;
+	}
+	return last === "L" || last === "EN";
+};
+const isDomainBidiValid = (unicodeLabels) => {
+	let isBidiDomain = false;
+	for (let i = 0; i < unicodeLabels.length; i++) if (isLabelBidiTriggering(unicodeLabels[i])) {
+		isBidiDomain = true;
+		break;
+	}
+	if (!isBidiDomain) return true;
+	for (let i = 0; i < unicodeLabels.length; i++) if (!isLabelBidiRuleValid(unicodeLabels[i])) return false;
+	return true;
+};
 const splitHostnameLabels = (hostname) => {
 	if (hostname.length === 0 || hostname.length > 255) return null;
 	if (hostname.startsWith(".") || hostname.endsWith(".")) return null;
@@ -18,7 +106,7 @@ const isGreek = (char) => /\p{Script=Greek}/u.test(char);
 const isHebrew = (char) => /\p{Script=Hebrew}/u.test(char);
 const hasCjkKanaOrHan = (input) => /[\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Han}]/u.test(input);
 const toUnicodeLabel = (label) => {
-	if (!/^xn--/i.test(label)) return label;
+	if (!XN_LABEL_REGEX.test(label)) return label;
 	try {
 		return punycode.toUnicode(label.toLowerCase());
 	} catch {
@@ -27,7 +115,7 @@ const toUnicodeLabel = (label) => {
 };
 const isValidIdnUnicodeLabel = (label) => {
 	if (label.startsWith("-") || label.endsWith("-")) return false;
-	if (label.length >= 4 && label[2] === "-" && label[3] === "-" && !/^xn--/i.test(label)) return false;
+	if (label.length >= 4 && label[2] === "-" && label[3] === "-" && !XN_LABEL_REGEX.test(label)) return false;
 	if (/^\p{M}/u.test(label)) return false;
 	if (/[\u302E\u302F\u0640\u07FA]/u.test(label)) return false;
 	for (let idx = 0; idx < label.length; idx++) {
@@ -36,7 +124,9 @@ const isValidIdnUnicodeLabel = (label) => {
 		if (char === "͵" && (idx === label.length - 1 || !isGreek(label[idx + 1]))) return false;
 		if ((char === "׳" || char === "״") && (idx === 0 || !isHebrew(label[idx - 1]))) return false;
 		if (char === "‍" && (idx === 0 || label[idx - 1] !== "्")) return false;
+		if (char === "‌" && (idx === 0 || label[idx - 1] !== "्" && !hasZwnjJoiningContext(label, idx))) return false;
 	}
+	for (const char of label) if (isDisallowedCodePoint(char)) return false;
 	if (label.includes("・") && !hasCjkKanaOrHan(label.replaceAll("・", ""))) return false;
 	const hasArabicIndic = /[\u0660-\u0669]/.test(label);
 	const hasExtendedArabicIndic = /[\u06F0-\u06F9]/.test(label);
@@ -51,7 +141,7 @@ const isValidHostname = (hostname) => {
 	for (let i = 0; i < labels.length; i++) {
 		const label = labels[i];
 		if (!isAsciiHostnameLabel(label)) return false;
-		if (/^xn--/i.test(label)) {
+		if (XN_LABEL_REGEX.test(label)) {
 			const unicodeLabel = toUnicodeLabel(label);
 			if (unicodeLabel === null || !isValidIdnUnicodeLabel(unicodeLabel)) return false;
 		}
@@ -59,14 +149,28 @@ const isValidHostname = (hostname) => {
 	return true;
 };
 const isValidIdnHostname = (hostname) => {
-	const labels = splitHostnameLabels(hostname.replace(IDN_SEPARATOR_REGEX, "."));
+	const normalizedHostname = hostname.replace(IDN_SEPARATOR_REGEX, ".");
+	const labels = splitHostnameLabels(normalizedHostname);
 	if (labels === null) return false;
+	const unicodeLabels = [];
+	let totalLength = labels.length - 1;
 	for (let i = 0; i < labels.length; i++) {
 		const label = labels[i];
 		const unicodeLabel = toUnicodeLabel(label);
 		if (unicodeLabel === null || !isValidIdnUnicodeLabel(unicodeLabel)) return false;
+		let aLabel;
+		try {
+			aLabel = punycode.toASCII(unicodeLabel);
+		} catch {
+			return false;
+		}
+		if (XN_LABEL_REGEX.test(label) && aLabel.toLowerCase() !== label.toLowerCase()) return false;
+		if (aLabel.length > 63) return false;
+		totalLength += aLabel.length;
+		unicodeLabels.push(unicodeLabel);
 	}
-	return true;
+	if (totalLength > 253) return false;
+	return isDomainBidiValid(unicodeLabels);
 };
 //#endregion
 export { isValidHostname, isValidIdnHostname };

package/dist/utils/json.js

@@ -16,7 +16,8 @@ const areEqual = (json1, json2, options, _depth = 0) => {
 	}
 	if (isObject(json1) && isObject(json2)) {
 		const keys1 = sortedKeys(json1);
-		if (!areEqual(keys1, sortedKeys(json2), options, _depth + 1)) return false;
+		const keys2 = sortedKeys(json2);
+		if (!areEqual(keys1, keys2, options, _depth + 1)) return false;
 		len = keys1.length;
 		for (i = 0; i < len; i++) if (!areEqual(json1[keys1[i]], json2[keys1[i]], options, _depth + 1)) return false;
 		return true;

package/dist/utils/time.js

@@ -8,7 +8,7 @@ const toUtcTime = (hour, minute, offsetSign, offsetHour, offsetMinute) => {
 		minute: normalizedUtcTotalMinutes % 60
 	};
 };
-const RFC3339_TIME_REGEX = /^([0-9]{2}):([0-9]{2}):([0-9]{2})(\.[0-9]+)?(z|([+-][0-9]{2}:[0-9]{2}))$/i;
+const RFC3339_TIME_REGEX = /^(?<hour>[0-9]{2}):(?<minute>[0-9]{2}):(?<second>[0-9]{2})(?<fraction>\.[0-9]+)?(?<offset>z|(?<offsetValue>[+-][0-9]{2}:[0-9]{2}))$/i;
 const parseRfc3339Time = (time) => {
 	const matches = RFC3339_TIME_REGEX.exec(time);
 	if (matches === null) return null;
@@ -19,7 +19,7 @@ const parseRfc3339Time = (time) => {
 	let utcHour = hour;
 	let utcMinute = minute;
 	if (matches[5].toLowerCase() !== "z") {
-		const offsetMatches = /^([+-])([0-9]{2}):([0-9]{2})$/.exec(matches[5]);
+		const offsetMatches = /^(?<sign>[+-])(?<hour>[0-9]{2}):(?<minute>[0-9]{2})$/.exec(matches[5]);
 		if (offsetMatches === null) return null;
 		const offsetSign = offsetMatches[1];
 		const offsetHour = Number.parseInt(offsetMatches[2], 10);
@@ -39,4 +39,4 @@ const parseRfc3339Time = (time) => {
 	};
 };
 //#endregion
-export { parseRfc3339Time };
+export { parseRfc3339Time, toUtcTime };

package/dist/validation/ref.js

@@ -46,4 +46,4 @@ const resolveDynamicRef = (schema, dynamicScopeStack) => {
 	return target;
 };
 //#endregion
-export { resolveDynamicRef, resolveRecursiveRef };
+export { findDynamicAnchorInScope, getDynamicRefAnchorName, resolveDynamicRef, resolveRecursiveRef };

package/dist/validation/shared.js

@@ -9,7 +9,7 @@ const VOCAB_VALIDATION_2019_09 = "https://json-schema.org/draft/2019-09/vocab/va
 const VOCAB_VALIDATION_2020_12 = "https://json-schema.org/draft/2020-12/vocab/validation";
 const VOCAB_FORMAT_2019_09 = "https://json-schema.org/draft/2019-09/vocab/format";
 const VOCAB_FORMAT_ASSERTION_2020_12 = "https://json-schema.org/draft/2020-12/vocab/format-assertion";
-const VALIDATION_VOCAB_KEYWORDS = new Set([
+const VALIDATION_VOCAB_KEYWORDS = /* @__PURE__ */ new Set([
 	"type",
 	"multipleOf",
 	"maximum",
@@ -40,7 +40,9 @@ const isValidationVocabularyEnabled = (schema, report, version) => {
 	const metaSchema = currentSchemaMeta || rootSchemaMeta;
 	if (!metaSchema || typeof metaSchema !== "object" || !isObject(metaSchema.$vocabulary)) return true;
 	const vocabulary = metaSchema.$vocabulary;
-	if (Object.hasOwn(vocabulary, VOCAB_VALIDATION_2019_09) || Object.hasOwn(vocabulary, VOCAB_VALIDATION_2020_12)) return vocabulary[VOCAB_VALIDATION_2019_09] || vocabulary[VOCAB_VALIDATION_2020_12];
+	const has2019 = Object.hasOwn(vocabulary, VOCAB_VALIDATION_2019_09);
+	const has2020 = Object.hasOwn(vocabulary, VOCAB_VALIDATION_2020_12);
+	if (has2019 || has2020) return vocabulary[VOCAB_VALIDATION_2019_09] || vocabulary[VOCAB_VALIDATION_2020_12];
 	return false;
 };
 /**

package/dist/validation/string.js

@@ -45,11 +45,11 @@ function formatValidator(ctx, report, schema, json) {
 			if (result instanceof Promise) {
 				const promiseResult = result;
 				report.addAsyncTaskWithPath(async (callback) => {
+					let resolved = false;
 					try {
-						callback(await promiseResult);
-					} catch {
-						callback(false);
-					}
+						resolved = await promiseResult;
+					} catch {}
+					callback(resolved);
 				}, [], (resolvedResult) => {
 					if (resolvedResult !== true) report.addError("INVALID_FORMAT", [schema.format, JSON.stringify(json)], void 0, schema, "format");
 				});

package/dist/z-schema-options.js

@@ -52,4 +52,4 @@ const normalizeOptions = (options) => {
 	return normalized;
 };
 //#endregion
-export { defaultOptions, normalizeOptions };
+export { MAX_ASYNC_TIMEOUT, defaultOptions, normalizeOptions };

package/dist/z-schema.js

@@ -287,4 +287,4 @@ var ZSchemaAsyncSafe = class extends ZSchemaBase {
 	}
 };
 //#endregion
-export { ZSchema };
+export { ZSchema, ZSchemaAsync, ZSchemaAsyncSafe, ZSchemaSafe };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "z-schema",
-  "version": "12.3.1",
+  "version": "12.4.0",
   "description": "Fast, lightweight JSON Schema validator for Node.js and browsers — full support for draft-04, draft-06, draft-07, draft-2019-09, and draft-2020-12 (latest)",
   "keywords": [
     "draft-04",
@@ -82,7 +82,7 @@
   },
   "devDependencies": {
     "@types/lodash.isequal": "^4.5.8",
-    "@types/node": "^25.2.0",
+    "@types/node": "^26.0.1",
     "@types/punycode": "^2.1.4",
     "@types/validator": "^13.15.10",
     "@vitest/browser-playwright": "^4.1.0",
@@ -90,9 +90,9 @@
     "@vitest/coverage-v8": "^4.1.0",
     "lefthook": "^2.1.9",
     "lodash.isequal": "^4.5.0",
-    "oxfmt": "^0.51.0",
+    "oxfmt": "^0.57.0",
     "oxlint": "^1.56.0",
-    "oxlint-tsgolint": "^0.23.0",
+    "oxlint-tsgolint": "^0.24.0",
     "rimraf": "^6.1.2",
     "tsdown": "^0.22.0",
     "typescript": "^6.0.3",
@@ -100,7 +100,7 @@
     "vitest": "^4.1.0"
   },
   "optionalDependencies": {
-    "commander": "^14.0.3"
+    "commander": "^15.0.0"
   },
   "overrides": {
     "vite": ">=7.3.2"

package/src/format-validators.ts

@@ -14,7 +14,7 @@ const dateValidator: FormatValidatorFn = (date: unknown) => {
     return true;
   }
   // full-date from http://tools.ietf.org/html/rfc3339#section-5.6
-  const matches = /^([0-9]{4})-([0-9]{2})-([0-9]{2})$/.exec(date);
+  const matches = /^(?<year>[0-9]{4})-(?<month>[0-9]{2})-(?<day>[0-9]{2})$/.exec(date);
   if (matches === null) {
     return false;
   }
@@ -39,7 +39,7 @@ const dateTimeValidator: FormatValidatorFn = (dateTime: unknown) => {
   const datePart = dateTime.slice(0, tIdx);
   const timePart = dateTime.slice(tIdx + 1);
   // Check date
-  const dateMatches = /^([0-9]{4})-([0-9]{2})-([0-9]{2})$/.exec(datePart);
+  const dateMatches = /^(?<year>[0-9]{4})-(?<month>[0-9]{2})-(?<day>[0-9]{2})$/.exec(datePart);
   if (dateMatches === null) {
     return false;
   }
@@ -61,7 +61,7 @@ const emailValidator: FormatValidatorFn = (email: unknown) => {
     return true;
   }
 
-  const ipv6Literal = /^(.+)@\[IPv6:([^\]]+)\]$/i.exec(email);
+  const ipv6Literal = /^(?<localPart>.+)@\[IPv6:(?<address>[^\]]+)\]$/i.exec(email);
   if (!ipv6Literal) {
     return false;
   }
@@ -226,7 +226,7 @@ const uriValidator: FormatValidatorFn = (uri: unknown) => {
   if (!hasValidPercentEncoding(uri)) {
     return false;
   }
-  const match = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/?#]*)/.exec(uri);
+  const match = /^(?<scheme>[a-zA-Z][a-zA-Z0-9+.-]*):\/\/(?<authority>[^/?#]*)/.exec(uri);
   if (match) {
     const authority = match[2];
     const atIndex = authority.indexOf('@');
@@ -267,7 +267,7 @@ const uriReferenceValidator: FormatValidatorFn = (uri: unknown) => {
     return false;
   }
   // URI-reference allows relative URIs
-  return /^([a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/.test(uri);
+  return /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/.test(uri);
 };
 
 const uriTemplateValidator: FormatValidatorFn = (uri: unknown) => {
@@ -275,7 +275,7 @@ const uriTemplateValidator: FormatValidatorFn = (uri: unknown) => {
     return true;
   }
   // URI template allows braces for expressions.
-  if (!/^([a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^`| ]*$/.test(uri)) {
+  if (!/^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^`| ]*$/.test(uri)) {
     return false;
   }
 
@@ -338,7 +338,7 @@ const relativeJsonPointerValidator: FormatValidatorFn = (pointer: unknown) => {
   }
   // Relative JSON Pointer: non-negative integer prefix (no leading zeros unless zero),
   // followed by either '#', a JSON Pointer, or nothing.
-  const match = /^(0|[1-9]\d*)(.*)$/.exec(pointer);
+  const match = /^(?<int>0|[1-9]\d*)(?<suffix>.*)$/.exec(pointer);
   if (!match) {
     return false;
   }
@@ -368,12 +368,38 @@ const timeValidator: FormatValidatorFn = (time: unknown) => {
   return parseRfc3339Time(time) !== null;
 };
 
+// Matches a lone (unpaired) UTF-16 surrogate — either a high surrogate not
+// followed by a low surrogate, or a low surrogate not preceded by a high one.
+const LONE_SURROGATE_REGEX = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+// A quoted local part: any char except a bare quote/backslash; backslash escapes
+// allowed. Leniently permits raw control chars (e.g. bare CR/LF), which stricter
+// RFC 5321 parsing forbids — an accepted limitation, not exercised by the suite.
+const QUOTED_LOCAL_PART_REGEX = /^"(?:[^"\\]|\\.)*"$/u;
+const UNQUOTED_LOCAL_PART_REGEX = /^[^\s@]+$/u;
+
+const isValidIdnEmailLocalPart = (localPart: string): boolean => {
+  if (localPart.length === 0 || LONE_SURROGATE_REGEX.test(localPart)) {
+    return false;
+  }
+  if (localPart.length >= 2 && localPart.startsWith('"') && localPart.endsWith('"')) {
+    return QUOTED_LOCAL_PART_REGEX.test(localPart);
+  }
+  return UNQUOTED_LOCAL_PART_REGEX.test(localPart);
+};
+
 const idnEmailValidator: FormatValidatorFn = (email: unknown) => {
   if (typeof email !== 'string') {
     return true;
   }
-  // Simple email check, allowing international chars
-  return /^[^\s@]+@[^\s@]+$/.test(email);
+  // Split on the last '@': everything after it is the (idn-)hostname domain,
+  // everything before it is the local part (which may itself be quoted).
+  // Note: unlike the ASCII `email` validator, IP-literal domains
+  // (`user@[192.168.1.1]` / `@[IPv6:...]`) are not supported here.
+  const atIdx = email.lastIndexOf('@');
+  if (atIdx <= 0 || atIdx === email.length - 1) {
+    return false;
+  }
+  return isValidIdnEmailLocalPart(email.slice(0, atIdx)) && isValidIdnHostname(email.slice(atIdx + 1));
 };
 
 const idnHostnameValidator: FormatValidatorFn = (hostname: unknown) => {
@@ -406,7 +432,7 @@ const iriReferenceValidator: FormatValidatorFn = (iriReference: unknown) => {
   if (typeof iriReference !== 'string') {
     return true;
   }
-  return /^([a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/u.test(iriReference);
+  return /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/u.test(iriReference);
 };
 
 export interface FormatValidatorsOptions {

package/src/json-validation.ts

@@ -169,7 +169,7 @@ function collectEvaluated(ctx: ZSchemaBase, args: CollectEvaluatedArgs): Set<num
         let passed = getCachedValidationResult(report, currentSchema.contains, jsonArr[i]);
         if (passed === undefined) {
           const subReport = new Report(report);
-          validate(ctx, subReport, currentSchema.contains as JsonSchemaInternal | boolean, jsonArr[i]);
+          validate(ctx, subReport, currentSchema.contains, jsonArr[i]);
           passed = subReport.errors.length === 0;
         }
         if (passed) {
@@ -264,7 +264,7 @@ function collectEvaluated(ctx: ZSchemaBase, args: CollectEvaluatedArgs): Set<num
   // allOf
   if (Array.isArray(currentSchema.allOf)) {
     for (let i = 0; i < currentSchema.allOf.length; i++) {
-      if (merge(recurse(currentSchema.allOf[i] as JsonSchemaInternal | boolean))) {
+      if (merge(recurse(currentSchema.allOf[i]))) {
         return 'all';
       }
     }
@@ -277,10 +277,10 @@ function collectEvaluated(ctx: ZSchemaBase, args: CollectEvaluatedArgs): Set<num
       let passed = getCachedValidationResult(report, subSchema, json);
       if (passed === undefined) {
         const subReport = new Report(report);
-        validate(ctx, subReport, subSchema as JsonSchemaInternal | boolean, json);
+        validate(ctx, subReport, subSchema, json);
         passed = subReport.errors.length === 0;
       }
-      if (passed && merge(recurse(subSchema as JsonSchemaInternal | boolean))) {
+      if (passed && merge(recurse(subSchema))) {
         return 'all';
       }
     }
@@ -293,10 +293,10 @@ function collectEvaluated(ctx: ZSchemaBase, args: CollectEvaluatedArgs): Set<num
       let passed = getCachedValidationResult(report, subSchema, json);
       if (passed === undefined) {
         const subReport = new Report(report);
-        validate(ctx, subReport, subSchema as JsonSchemaInternal | boolean, json);
+        validate(ctx, subReport, subSchema, json);
         passed = subReport.errors.length === 0;
       }
-      if (passed && merge(recurse(subSchema as JsonSchemaInternal | boolean))) {
+      if (passed && merge(recurse(subSchema))) {
         return 'all';
       }
     }
@@ -339,7 +339,7 @@ function collectEvaluated(ctx: ZSchemaBase, args: CollectEvaluatedArgs): Set<num
 
   // $dynamicRef
   const dynamicTarget = resolveDynamicRef(currentSchema, report.__$dynamicScopeStack);
-  if (dynamicTarget && dynamicTarget !== currentSchema && merge(recurse(dynamicTarget as JsonSchemaInternal))) {
+  if (dynamicTarget && dynamicTarget !== currentSchema && merge(recurse(dynamicTarget))) {
     return 'all';
   }
 

package/src/utils/base64.ts

@@ -28,7 +28,7 @@ export const decodeBase64 = (value: string): string | undefined => {
   // where `atob` above is used instead.)
   const bufferCtor = (
     globalThis as {
-      Buffer?: { from(data: string, encoding: string): { toString(encoding: string): string } };
+      Buffer?: { from: (data: string, encoding: string) => { toString: (encoding: string) => string } };
     }
   ).Buffer;
   if (bufferCtor !== undefined) {