z-schema 12.3.1 → 12.4.0

package/umd/ZSchema.js

@@ -71,7 +71,7 @@
 	function isInteger(value) {
 		return typeof value === "number" && Number.isFinite(value) && value % 1 === 0;
 	}
-	const NON_SCHEMA_KEYWORDS_SET = new Set([
+	const NON_SCHEMA_KEYWORDS_SET = /* @__PURE__ */ new Set([
 		"enum",
 		"const",
 		"default",
@@ -246,7 +246,8 @@
 		}
 		if (isObject(json1) && isObject(json2)) {
 			const keys1 = sortedKeys(json1);
-			if (!areEqual(keys1, sortedKeys(json2), options, _depth + 1)) return false;
+			const keys2 = sortedKeys(json2);
+			if (!areEqual(keys1, keys2, options, _depth + 1)) return false;
 			len = keys1.length;
 			for (i = 0; i < len; i++) if (!areEqual(json1[keys1[i]], json2[keys1[i]], options, _depth + 1)) return false;
 			return true;
@@ -2444,6 +2445,94 @@
 	})))(), 1);
 	const IDN_SEPARATOR_REGEX = /[\u3002\uFF0E\uFF61]/g;
 	const IDN_SEPARATOR_TEST_REGEX = /[\u3002\uFF0E\uFF61]/;
+	const XN_LABEL_REGEX = /^xn--/i;
+	const DISALLOWED_CATEGORY_REGEX = /[\p{P}\p{S}\p{Z}\p{C}]/u;
+	const DISALLOWED_CATEGORY_WHITELIST = /* @__PURE__ */ new Set([
+		"-",
+		"·",
+		"͵",
+		"׳",
+		"״",
+		"・",
+		"۽",
+		"۾",
+		"་",
+		"‌",
+		"‍"
+	]);
+	const isDisallowedCodePoint = (char) => DISALLOWED_CATEGORY_REGEX.test(char) && !DISALLOWED_CATEGORY_WHITELIST.has(char);
+	const TRANSPARENT_MARK_REGEX = /\p{Mn}/u;
+	const ARABIC_SCRIPT_REGEX = /\p{Script=Arabic}/u;
+	const ARABIC_INDIC_DIGITS_REGEX = /[\u0660-\u0669\u06F0-\u06F9]/;
+	const isArabicJoiningLetter = (char) => char !== void 0 && ARABIC_SCRIPT_REGEX.test(char) && !ARABIC_INDIC_DIGITS_REGEX.test(char);
+	const hasZwnjJoiningContext = (label, idx) => {
+		let before = idx - 1;
+		while (before >= 0 && TRANSPARENT_MARK_REGEX.test(label[before])) before--;
+		let after = idx + 1;
+		while (after < label.length && TRANSPARENT_MARK_REGEX.test(label[after])) after++;
+		return isArabicJoiningLetter(label[before]) && isArabicJoiningLetter(label[after]);
+	};
+	const BIDI_NSM_REGEX = /[\p{Mn}\p{Me}]/u;
+	const BIDI_ARABIC_INDIC_DIGIT_REGEX = /[\u0660-\u0669]/;
+	const BIDI_EXTENDED_ARABIC_INDIC_DIGIT_REGEX = /[\u06F0-\u06F9]/;
+	const BIDI_HEBREW_SCRIPT_REGEX = /\p{Script=Hebrew}/u;
+	const BIDI_AL_SCRIPT_REGEX = /[\p{Script=Arabic}\p{Script=Syriac}\p{Script=Thaana}]/u;
+	const BIDI_ASCII_DIGIT_REGEX = /[0-9]/;
+	const BIDI_LETTER_REGEX = /\p{L}/u;
+	const classifyBidi = (char) => {
+		if (BIDI_NSM_REGEX.test(char)) return "NSM";
+		if (BIDI_ARABIC_INDIC_DIGIT_REGEX.test(char)) return "AN";
+		if (BIDI_EXTENDED_ARABIC_INDIC_DIGIT_REGEX.test(char)) return "EN";
+		if (BIDI_HEBREW_SCRIPT_REGEX.test(char)) return "R";
+		if (BIDI_AL_SCRIPT_REGEX.test(char)) return "AL";
+		if (BIDI_ASCII_DIGIT_REGEX.test(char)) return "EN";
+		if (BIDI_LETTER_REGEX.test(char)) return "L";
+		return "ON";
+	};
+	const isLabelBidiTriggering = (label) => {
+		for (const char of label) {
+			const bidiClass = classifyBidi(char);
+			if (bidiClass === "R" || bidiClass === "AL" || bidiClass === "AN") return true;
+		}
+		return false;
+	};
+	const isLabelBidiRuleValid = (label) => {
+		const classes = [];
+		for (const char of label) classes.push(classifyBidi(char));
+		if (classes.length === 0) return false;
+		const first = classes[0];
+		if (first !== "L" && first !== "R" && first !== "AL") return false;
+		let lastIdx = classes.length - 1;
+		while (lastIdx > 0 && classes[lastIdx] === "NSM") lastIdx--;
+		const last = classes[lastIdx];
+		if (first === "R" || first === "AL") {
+			let hasEN = false;
+			let hasAN = false;
+			for (let i = 0; i < classes.length; i++) {
+				const c = classes[i];
+				if (c !== "R" && c !== "AL" && c !== "AN" && c !== "EN" && c !== "NSM" && c !== "ON") return false;
+				if (c === "EN") hasEN = true;
+				else if (c === "AN") hasAN = true;
+			}
+			if (hasEN && hasAN) return false;
+			return last === "R" || last === "AL" || last === "EN" || last === "AN";
+		}
+		for (let i = 0; i < classes.length; i++) {
+			const c = classes[i];
+			if (c !== "L" && c !== "EN" && c !== "NSM" && c !== "ON") return false;
+		}
+		return last === "L" || last === "EN";
+	};
+	const isDomainBidiValid = (unicodeLabels) => {
+		let isBidiDomain = false;
+		for (let i = 0; i < unicodeLabels.length; i++) if (isLabelBidiTriggering(unicodeLabels[i])) {
+			isBidiDomain = true;
+			break;
+		}
+		if (!isBidiDomain) return true;
+		for (let i = 0; i < unicodeLabels.length; i++) if (!isLabelBidiRuleValid(unicodeLabels[i])) return false;
+		return true;
+	};
 	const splitHostnameLabels = (hostname) => {
 		if (hostname.length === 0 || hostname.length > 255) return null;
 		if (hostname.startsWith(".") || hostname.endsWith(".")) return null;
@@ -2459,7 +2548,7 @@
 	const isHebrew = (char) => /\p{Script=Hebrew}/u.test(char);
 	const hasCjkKanaOrHan = (input) => /[\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Han}]/u.test(input);
 	const toUnicodeLabel = (label) => {
-		if (!/^xn--/i.test(label)) return label;
+		if (!XN_LABEL_REGEX.test(label)) return label;
 		try {
 			return import_punycode.default.toUnicode(label.toLowerCase());
 		} catch {
@@ -2468,7 +2557,7 @@
 	};
 	const isValidIdnUnicodeLabel = (label) => {
 		if (label.startsWith("-") || label.endsWith("-")) return false;
-		if (label.length >= 4 && label[2] === "-" && label[3] === "-" && !/^xn--/i.test(label)) return false;
+		if (label.length >= 4 && label[2] === "-" && label[3] === "-" && !XN_LABEL_REGEX.test(label)) return false;
 		if (/^\p{M}/u.test(label)) return false;
 		if (/[\u302E\u302F\u0640\u07FA]/u.test(label)) return false;
 		for (let idx = 0; idx < label.length; idx++) {
@@ -2477,7 +2566,9 @@
 			if (char === "͵" && (idx === label.length - 1 || !isGreek(label[idx + 1]))) return false;
 			if ((char === "׳" || char === "״") && (idx === 0 || !isHebrew(label[idx - 1]))) return false;
 			if (char === "‍" && (idx === 0 || label[idx - 1] !== "्")) return false;
+			if (char === "‌" && (idx === 0 || label[idx - 1] !== "्" && !hasZwnjJoiningContext(label, idx))) return false;
 		}
+		for (const char of label) if (isDisallowedCodePoint(char)) return false;
 		if (label.includes("・") && !hasCjkKanaOrHan(label.replaceAll("・", ""))) return false;
 		const hasArabicIndic = /[\u0660-\u0669]/.test(label);
 		const hasExtendedArabicIndic = /[\u06F0-\u06F9]/.test(label);
@@ -2492,7 +2583,7 @@
 		for (let i = 0; i < labels.length; i++) {
 			const label = labels[i];
 			if (!isAsciiHostnameLabel(label)) return false;
-			if (/^xn--/i.test(label)) {
+			if (XN_LABEL_REGEX.test(label)) {
 				const unicodeLabel = toUnicodeLabel(label);
 				if (unicodeLabel === null || !isValidIdnUnicodeLabel(unicodeLabel)) return false;
 			}
@@ -2500,14 +2591,28 @@
 		return true;
 	};
 	const isValidIdnHostname = (hostname) => {
-		const labels = splitHostnameLabels(hostname.replace(IDN_SEPARATOR_REGEX, "."));
+		const normalizedHostname = hostname.replace(IDN_SEPARATOR_REGEX, ".");
+		const labels = splitHostnameLabels(normalizedHostname);
 		if (labels === null) return false;
+		const unicodeLabels = [];
+		let totalLength = labels.length - 1;
 		for (let i = 0; i < labels.length; i++) {
 			const label = labels[i];
 			const unicodeLabel = toUnicodeLabel(label);
 			if (unicodeLabel === null || !isValidIdnUnicodeLabel(unicodeLabel)) return false;
+			let aLabel;
+			try {
+				aLabel = import_punycode.default.toASCII(unicodeLabel);
+			} catch {
+				return false;
+			}
+			if (XN_LABEL_REGEX.test(label) && aLabel.toLowerCase() !== label.toLowerCase()) return false;
+			if (aLabel.length > 63) return false;
+			totalLength += aLabel.length;
+			unicodeLabels.push(unicodeLabel);
 		}
-		return true;
+		if (totalLength > 253) return false;
+		return isDomainBidiValid(unicodeLabels);
 	};
 	//#endregion
 	//#region src/utils/time.ts
@@ -2520,7 +2625,7 @@
 			minute: normalizedUtcTotalMinutes % 60
 		};
 	};
-	const RFC3339_TIME_REGEX = /^([0-9]{2}):([0-9]{2}):([0-9]{2})(\.[0-9]+)?(z|([+-][0-9]{2}:[0-9]{2}))$/i;
+	const RFC3339_TIME_REGEX = /^(?<hour>[0-9]{2}):(?<minute>[0-9]{2}):(?<second>[0-9]{2})(?<fraction>\.[0-9]+)?(?<offset>z|(?<offsetValue>[+-][0-9]{2}:[0-9]{2}))$/i;
 	const parseRfc3339Time = (time) => {
 		const matches = RFC3339_TIME_REGEX.exec(time);
 		if (matches === null) return null;
@@ -2531,7 +2636,7 @@
 		let utcHour = hour;
 		let utcMinute = minute;
 		if (matches[5].toLowerCase() !== "z") {
-			const offsetMatches = /^([+-])([0-9]{2}):([0-9]{2})$/.exec(matches[5]);
+			const offsetMatches = /^(?<sign>[+-])(?<hour>[0-9]{2}):(?<minute>[0-9]{2})$/.exec(matches[5]);
 			if (offsetMatches === null) return null;
 			const offsetSign = offsetMatches[1];
 			const offsetHour = Number.parseInt(offsetMatches[2], 10);
@@ -2554,7 +2659,7 @@
 	//#region src/format-validators.ts
 	const dateValidator = (date) => {
 		if (typeof date !== "string") return true;
-		const matches = /^([0-9]{4})-([0-9]{2})-([0-9]{2})$/.exec(date);
+		const matches = /^(?<year>[0-9]{4})-(?<month>[0-9]{2})-(?<day>[0-9]{2})$/.exec(date);
 		if (matches === null) return false;
 		return isValidRfc3339Date(Number.parseInt(matches[1], 10), Number.parseInt(matches[2], 10), Number.parseInt(matches[3], 10));
 	};
@@ -2565,7 +2670,7 @@
 		if (tIdx === -1) return false;
 		const datePart = dateTime.slice(0, tIdx);
 		const timePart = dateTime.slice(tIdx + 1);
-		const dateMatches = /^([0-9]{4})-([0-9]{2})-([0-9]{2})$/.exec(datePart);
+		const dateMatches = /^(?<year>[0-9]{4})-(?<month>[0-9]{2})-(?<day>[0-9]{2})$/.exec(datePart);
 		if (dateMatches === null) return false;
 		if (!isValidRfc3339Date(Number.parseInt(dateMatches[1], 10), Number.parseInt(dateMatches[2], 10), Number.parseInt(dateMatches[3], 10))) return false;
 		return parseRfc3339Time(timePart) !== null;
@@ -2576,7 +2681,7 @@
 			require_tld: true,
 			allow_ip_domain: true
 		})) return true;
-		const ipv6Literal = /^(.+)@\[IPv6:([^\]]+)\]$/i.exec(email);
+		const ipv6Literal = /^(?<localPart>.+)@\[IPv6:(?<address>[^\]]+)\]$/i.exec(email);
 		if (!ipv6Literal) return false;
 		const localPart = ipv6Literal[1];
 		const addressPart = ipv6Literal[2];
@@ -2596,7 +2701,7 @@
 		if (ipv6.includes("%")) return false;
 		return import_isIP.default.default(ipv6, 6);
 	};
-	const INVALID_REGEX_ESCAPES = new Set(["a"]);
+	const INVALID_REGEX_ESCAPES = /* @__PURE__ */ new Set(["a"]);
 	const regexValidator = (input) => {
 		if (typeof input !== "string") return true;
 		for (let idx = 0; idx < input.length; idx++) {
@@ -2649,7 +2754,7 @@
 		if (typeof uri !== "string") return true;
 		if (/[^\u0000-\u007F]/.test(uri)) return false;
 		if (!hasValidPercentEncoding(uri)) return false;
-		const match = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^/?#]*)/.exec(uri);
+		const match = /^(?<scheme>[a-zA-Z][a-zA-Z0-9+.-]*):\/\/(?<authority>[^/?#]*)/.exec(uri);
 		if (match) {
 			const authority = match[2];
 			const atIndex = authority.indexOf("@");
@@ -2673,11 +2778,11 @@
 	const uriReferenceValidator = (uri) => {
 		if (typeof uri !== "string") return true;
 		if (/[^\u0000-\u007F]/.test(uri)) return false;
-		return /^([a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/.test(uri);
+		return /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/.test(uri);
 	};
 	const uriTemplateValidator = (uri) => {
 		if (typeof uri !== "string") return true;
-		if (!/^([a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^`| ]*$/.test(uri)) return false;
+		if (!/^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^`| ]*$/.test(uri)) return false;
 		let inExpression = false;
 		for (let idx = 0; idx < uri.length; idx++) {
 			const ch = uri[idx];
@@ -2709,7 +2814,7 @@
 	};
 	const relativeJsonPointerValidator = (pointer) => {
 		if (typeof pointer !== "string") return true;
-		const match = /^(0|[1-9]\d*)(.*)$/.exec(pointer);
+		const match = /^(?<int>0|[1-9]\d*)(?<suffix>.*)$/.exec(pointer);
 		if (!match) return false;
 		const suffix = match[2];
 		if (suffix === "" || suffix === "#") return true;
@@ -2723,9 +2828,19 @@
 		if (typeof time !== "string") return true;
 		return parseRfc3339Time(time) !== null;
 	};
+	const LONE_SURROGATE_REGEX = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+	const QUOTED_LOCAL_PART_REGEX = /^"(?:[^"\\]|\\.)*"$/u;
+	const UNQUOTED_LOCAL_PART_REGEX = /^[^\s@]+$/u;
+	const isValidIdnEmailLocalPart = (localPart) => {
+		if (localPart.length === 0 || LONE_SURROGATE_REGEX.test(localPart)) return false;
+		if (localPart.length >= 2 && localPart.startsWith("\"") && localPart.endsWith("\"")) return QUOTED_LOCAL_PART_REGEX.test(localPart);
+		return UNQUOTED_LOCAL_PART_REGEX.test(localPart);
+	};
 	const idnEmailValidator = (email) => {
 		if (typeof email !== "string") return true;
-		return /^[^\s@]+@[^\s@]+$/.test(email);
+		const atIdx = email.lastIndexOf("@");
+		if (atIdx <= 0 || atIdx === email.length - 1) return false;
+		return isValidIdnEmailLocalPart(email.slice(0, atIdx)) && isValidIdnHostname(email.slice(atIdx + 1));
 	};
 	const idnHostnameValidator = (hostname) => {
 		if (typeof hostname !== "string") return true;
@@ -2743,7 +2858,7 @@
 	};
 	const iriReferenceValidator = (iriReference) => {
 		if (typeof iriReference !== "string") return true;
-		return /^([a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/u.test(iriReference);
+		return /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?[^"\\<>^{}^`| ]*$/u.test(iriReference);
 	};
 	const inbuiltValidators = {
 		date: dateValidator,
@@ -3778,7 +3893,7 @@
 	const VOCAB_VALIDATION_2020_12 = "https://json-schema.org/draft/2020-12/vocab/validation";
 	const VOCAB_FORMAT_2019_09 = "https://json-schema.org/draft/2019-09/vocab/format";
 	const VOCAB_FORMAT_ASSERTION_2020_12 = "https://json-schema.org/draft/2020-12/vocab/format-assertion";
-	const VALIDATION_VOCAB_KEYWORDS = new Set([
+	const VALIDATION_VOCAB_KEYWORDS = /* @__PURE__ */ new Set([
 		"type",
 		"multipleOf",
 		"maximum",
@@ -3809,7 +3924,9 @@
 		const metaSchema = currentSchemaMeta || rootSchemaMeta;
 		if (!metaSchema || typeof metaSchema !== "object" || !isObject(metaSchema.$vocabulary)) return true;
 		const vocabulary = metaSchema.$vocabulary;
-		if (Object.hasOwn(vocabulary, VOCAB_VALIDATION_2019_09) || Object.hasOwn(vocabulary, VOCAB_VALIDATION_2020_12)) return vocabulary[VOCAB_VALIDATION_2019_09] || vocabulary[VOCAB_VALIDATION_2020_12];
+		const has2019 = Object.hasOwn(vocabulary, VOCAB_VALIDATION_2019_09);
+		const has2020 = Object.hasOwn(vocabulary, VOCAB_VALIDATION_2020_12);
+		if (has2019 || has2020) return vocabulary[VOCAB_VALIDATION_2019_09] || vocabulary[VOCAB_VALIDATION_2020_12];
 		return false;
 	};
 	/**
@@ -4245,11 +4362,11 @@
 				if (result instanceof Promise) {
 					const promiseResult = result;
 					report.addAsyncTaskWithPath(async (callback) => {
+						let resolved = false;
 						try {
-							callback(await promiseResult);
-						} catch {
-							callback(false);
-						}
+							resolved = await promiseResult;
+						} catch {}
+						callback(resolved);
 					}, [], (resolvedResult) => {
 						if (resolvedResult !== true) report.addError("INVALID_FORMAT", [schema.format, JSON.stringify(json)], void 0, schema, "format");
 					});
@@ -4742,7 +4859,8 @@
 			}
 		}
 		if (deferredUnevaluatedKeys.length > 0 && !(report.errors.length > 0 && ctx.options.breakOnFirstError)) for (let i = 0; i < deferredUnevaluatedKeys.length; i++) {
-			const validator = JsonValidators[deferredUnevaluatedKeys[i]];
+			const key = deferredUnevaluatedKeys[i];
+			const validator = JsonValidators[key];
 			if (validator) {
 				validator(ctx, report, schema, json);
 				if (report.errors.length && ctx.options.breakOnFirstError) break;
@@ -4769,7 +4887,7 @@
 	}
 	//#endregion
 	//#region src/schema-compiler.ts
-	const UNSAFE_TARGETS = new Set([
+	const UNSAFE_TARGETS = /* @__PURE__ */ new Set([
 		Object.prototype,
 		Function.prototype,
 		Array.prototype
@@ -4851,7 +4969,10 @@
 						}
 					}
 					id.absoluteParent = absoluteParent;
-					if (id.absoluteParent) id.absoluteUri = resolveSchemaScopeId(id.absoluteParent.absoluteUri || id.absoluteParent.id, schemaNode, id.id);
+					if (id.absoluteParent) {
+						const parentUri = id.absoluteParent.absoluteUri || id.absoluteParent.id;
+						id.absoluteUri = resolveSchemaScopeId(parentUri, schemaNode, id.id);
+					}
 				}
 				ids.push(id);
 				scope.push(id);
@@ -4935,7 +5056,8 @@
 			for (const item of ids) if (item.absoluteUri) {
 				this.validator.scache.cacheSchemaByUri(item.absoluteUri, item.obj);
 				if (item.type === "relative" && item.absoluteParent && isSimpleIdentifier(item.id)) {
-					const altAbsoluteUri = resolveReference(item.absoluteParent.absoluteUri || item.absoluteParent.id, item.id);
+					const parentUri = item.absoluteParent.absoluteUri || item.absoluteParent.id;
+					const altAbsoluteUri = resolveReference(parentUri, item.id);
 					this.validator.scache.cacheSchemaByUri(altAbsoluteUri, item.obj);
 				}
 			} else if (item.type === "root") this.validator.scache.cacheSchemaByUri(item.id, item.obj);