@blamejs/core 0.18.36 → 0.18.38

package/CHANGELOG.md

@@ -8,6 +8,62 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.38 (2026-08-19) — **`COPY ... TO STDIN` was reported as a server-side file access whenever it carried more than one space.** `b.guardSql`'s `copy-file` detector finds a `COPY` that reads or writes a file on the database server, and excludes the client-streaming `STDIN` and `STDOUT` forms because those touch no file. The exclusion was a negative lookahead, and it only worked when the whitespace before the keyword was exactly one character: `COPY t TO STDIN` was quiet, `COPY t TO  STDIN` was reported critical.
+
+The exclusion is now decided by reading the following word rather than by a lookahead, so the spacing no longer changes the verdict.
+
+No API changes. Upgrade if you pass SQL fragments through `b.guardSql`. **Changed:** *The content-safety gate now refuses a pattern built at runtime* — `blamejs/no-regex-in-content-safety` reported pattern literals only, so `new RegExp(source)` passed it unnoticed anywhere under `lib/**/safe-*.js` or `lib/**/guard-*.js`. It now reports `new RegExp(...)` and `RegExp(...)`, in both the bare and member spellings — `globalThis.RegExp(src)` puts a MemberExpression in the callee and an identifier-only check permits it silently.
+
+Three call sites carry a suppression with its reason recorded beside it. Two of them never match anything against input: `b.guardRegex` asks the parser whether an operator-supplied pattern compiles at all and discards the result, and `b.safeJson` compiles a schema `pattern` precisely so `assertSafe` can screen the compiled form. The third is `b.guardSql`'s detector table, described below. · *The SQL detectors stay on the platform engine, and the reason is now recorded* — These 32 detectors are built with `new RegExp` and run against a caller's SQL, which reads like something the content-safety rule should forbid. Moving them to `b.regexLinear` — whose cost is the length of the subject whatever the pattern says — was tried and measured, and it is worse:
+
+| subject | linear | platform |
+| --- | --- | --- |
+| 158-byte benign SELECT | 1.4 ms | 0.001 ms |
+| 4 KiB benign SELECT | 15.4 ms | 0.012 ms |
+
+The engine expands each `{0,4000}` span into thousands of states, so every ordinary fragment pays. The platform engine's worst case over these same patterns, on adversarial input built to defeat every lazy span, is 5 ms at 32 KiB — less than the linear engine charges for a benign 4 KiB one. The swap would have made every request cost more than the attack it was meant to prevent.
+
+What bounds these patterns is the patterns: every span is explicitly capped and none pairs two quantifiers over an overlapping alphabet. That is a property of this table rather than a general licence, and it is written where the table is defined so a new detector gets the same check.
+
+SECURITY.md is corrected to match. It named a build gate retired in 0.18.37, said no primitive in the family "contains a regular expression" where the enforced claim is that none SCREENS with one, and now states plainly that a runtime-built pattern is not yet reported by the gate. **Fixed:** *The COPY file-access detector no longer depends on how much whitespace precedes STDIN* — The pattern excluded the safe forms with `\s+(?!STDIN\b|STDOUT\b)`. `\s+` is greedy but backtracks: given two spaces it could give one back, leaving ` STDIN` in front of the lookahead, which then read as "not STDIN" and reported a statement that opens no file.
+
+```
+COPY t TO STDIN     quiet
+COPY t TO  STDIN    reported as "reads or writes a server-side file"
+COPY t TO   STDIN   reported
+COPY t TO \n STDIN  reported
+```
+
+The exclusion is now tested BEFORE the whitespace is consumed — `\b(?:TO|FROM)\b(?!\s+(?:STDIN|STDOUT)\b)\s+` — so it is evaluated once, at a fixed position, and cannot interact with that quantifier at all.
+
+The obvious repair is worse. Teaching the lookahead to skip whitespace where it stood, `\s+(?!\s*(?:STDIN|STDOUT)\b)`, gives the two quantifiers the same alphabet: every backtrack re-scans the remainder of the run, which measures 45 ms on a 16,000-space run and grows quadratically — a denial of service introduced into the primitive whose job is to prevent one. Moving the test in front of `\s+` measures flat, and a cost regression check now covers it.
+
+What the detector catches is unchanged, and the lookahead is kept rather than replaced with a scan for a specific reason: its backtracking is what finds the file in `COPY (SELECT x FROM STDOUT) TO '/tmp/x'`, where the first candidate is excluded and the one that matters appears later in the same statement. A scan that resumed past the excluded match would miss it, because every match has to begin at `COPY`. `COPY t TO '/etc/passwd'` fires, `COPY t TO STDINX` fires because the word does not end at `STDIN`, and `COPY t TO STDOUT; COPY u TO '/tmp/x'` fires on the second statement.
+
+Twenty regression checks cover the whitespace forms, the nested case and the boundary. **References:** [PostgreSQL COPY — TO/FROM STDIN and STDOUT stream to the client](https://www.postgresql.org/docs/current/sql-copy.html)
+
+- v0.18.37 (2026-08-19) — **The no-regex rule for content-safety primitives never covered lib/parsers, where 55 patterns were screening adversarial input.** SECURITY.md states that no `b.guard*` or `b.safe*` primitive contains a regular expression, so a screen costs the length of its input and the byte cap that bounds the input bounds the screen. The build gate enforcing that selected files with `lib/(safe-|guard-)[^/]+\.js` — top level only. Every nested primitive was therefore outside it, and all five of them are the ones that parse untrusted bytes: `b.parsers.yaml`, `b.parsers.toml`, `b.parsers.ini`, `b.parsers.env` and `b.parsers.xml`. Between them they carried 55 pattern literals.
+
+All 55 are gone, and the gate now covers nested paths. Nothing about the parsers' behaviour changes: each screen was differential-tested against the pattern it replaced before the call site was swapped.
+
+Upgrade if you parse YAML, TOML, INI, `.env` or XML from anything you do not control. **Changed:** *The no-regex gate asks a parser instead of walking the source itself* — Deciding whether a `/` opens a regular expression or divides means implementing the ECMAScript lexical grammar, and the previous scanner kept meeting parts of it that were not implemented yet — template substitutions nest, `of` is contextual, a labelled `break` ends at the terminator after its label, `<!--` is a comment, a shebang is not JavaScript.
+
+The check now runs as an ESLint rule, which sees the file after it has already been parsed. All of those questions are answered before the rule is asked. It needs no new dependency: ESLint already runs over the repository as the first static gate, and a flat config takes an inline rule.
+
+Suppression, if a case ever warrants it, is the standard `// eslint-disable-next-line blamejs/no-regex-in-content-safety` with the reason on the line above, replacing a bespoke marker that was never used.
+
+The hand-written scanner is gone with it — about 1,240 lines, including the fixture table that had grown to justify it. Leaving both in place would have meant a justified exception passing one gate and failing the other, since the old one honoured only its own marker.
+
+The rule reports pattern literals. `new RegExp(...)` is not yet included: three call sites use it and they are not one thing — two compile a pattern in order to validate it, which is the opposite of matching against input, while `b.guardSql` builds its detectors that way and does match input. Reporting all three today would mean either an allowlist entry for the one that should be caught, or a rushed conversion of a set of injection detectors. It is tracked instead, and the rule stays exactly as strict as the scanner it replaces. **Fixed:** *A YAML tag beginning with a digit slipped past the tag ban* — `b.parsers.yaml` refuses anchors, aliases, tags and directives. The tag check accepted `!` followed by a letter or `<`, while the comment beside it described the rule as "alphanumeric or `<`" — and the code was the weaker of the two. `a: !123` is a local tag, and it parsed as the plain string `"!123"` rather than being refused.
+
+It is now refused, along with `!!123`. A quoted `"!123"` is still an ordinary string, because a quoted scalar is not a tag. **Security:** *Every pattern literal is gone from the five parsers that consume adversarial bytes* — Fifty-five of them: `safe-yaml` 24, `safe-toml` 16, `safe-env` 8, `safe-ini` 7, `safe-xml` 1.
+
+The replacements walk characters: YAML's core-schema scalar resolution is now exact-set membership and a left-to-right digit walk; TOML's date, time and offset fields are index comparisons against fixed widths; INI's integer, float and hex classification and its `[name "subsection"]` header are single passes; `.env`'s inline-comment split, `export ` prefix and `$VAR` refusal are scans.
+
+Every replacement was compared against the pattern it replaced over exhaustive short strings and adversarial cases before the call site changed — between roughly 60,000 and 1,400,000 inputs each, all with zero divergence. Where a reported line number derives from a match position, the position was compared too, not just the verdict.
+
+One honest note on scale: these patterns were not all hanging. `.env`'s inline-comment matcher looked like catastrophic backtracking and is not — its separator and token classes are disjoint, so the partition of a line is unique, and it measures flat to 40,000 characters. The rule removes it anyway, and that is the point: the cost of a screen in this family holds by construction, rather than by someone re-deriving the ambiguity of each pattern correctly every time one is edited. **References:** [ESTree — RegExpLiteral carries the pattern and flags as parsed data](https://github.com/estree/estree/blob/master/es5.md#regexpliteral) · [OWASP — Regular expression Denial of Service (ReDoS)](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)
+
 - v0.18.36 (2026-08-18) — **Six constant-time comparisons told you which candidate matched, by how long they took.** A comparison that runs in constant time answers one question without leaking anything. A loop of them that stops at the first match answers a second question nobody asked: how far down the list the match was. Six places in the framework compared a presented value against a list of candidates and returned as soon as one matched, so the response time reported the match's position — which deny-list entry a certificate hit, which verifier's nonce a token carried, where in a key rotation the sender currently sits.
 
 Every one of them returned the correct answer. The defect is only in how long it took, which is why no test caught it and why the guard that replaces them is structural.

package/lib/guard-regex.js

@@ -2321,6 +2321,12 @@ function _ambiguityFindings(src, flags) {
     // at all" and returned every finding false, so a quadratic pattern using
     // any of that syntax walked straight past this gate.
     var compiles = true;
+    // The result is discarded and the pattern is never run against a subject —
+    // this asks the parser whether `text` is a regular expression at all, which
+    // is the opposite direction from screening input with one. Nothing a caller
+    // supplies is matched here; a source that does not compile simply reports as
+    // not-a-regex.
+    // eslint-disable-next-line blamejs/no-regex-in-content-safety
     try { RegExp(text, typeof flags === "string" ? flags : ""); }
     catch (_e) { compiles = false; }
     if (compiles) {

package/lib/guard-sql.js

@@ -248,11 +248,32 @@ var MASK_SPACE = " ";
 
 function _re(source) {
   // Construct each detector regex from an ASCII source string so the
-  // source file embeds no attack-character literals. Case-insensitive;
-  // detectors are intentionally global-free (first match is enough).
-  return new RegExp(source, "i");                                       // allow:dynamic-regex — detector source is a compile-time ASCII literal table below
+  // source file embeds no attack-character literals. Case-insensitive, and
+  // deliberately NOT global: `.test()` on a `g` regex advances `lastIndex` and
+  // answers differently on the next call with the same input.
+  //
+  // These stay on the platform engine, and that was measured rather than
+  // assumed. Compiling all 32 on b.regexLinear — whose cost is the length of the
+  // subject whatever the pattern says — makes a BENIGN 4 KiB fragment cost 15 ms
+  // against 0.012 ms here, because the NFA expands each `{0,4000}` span into
+  // thousands of states. The platform engine's own worst case over these
+  // patterns is 5 ms at 32 KiB of adversarial SQL, so the swap would have made
+  // every request pay more than the attack it was meant to prevent.
+  //
+  // What bounds these is the patterns themselves: every span is explicitly
+  // capped, and none pairs two quantifiers over an overlapping alphabet. That is
+  // a property of THIS table, not a general licence — a new detector needs the
+  // same check before it is added.
+  //
+  // The suppression below is the ONE audited exception in the family, and it is
+  // recorded rather than assumed: the alternative was measured and is worse, the
+  // sources are a fixed compile-time table rather than anything a caller
+  // supplies, and the cost is covered by a regression check in guard-sql.test.js.
+  // eslint-disable-next-line blamejs/no-regex-in-content-safety
+  return new RegExp(source, "i");                                               // allow:dynamic-regex — compile-time ASCII literal table, every span bounded
 }
 
+
 // \b word-boundary + optional whitespace/paren tolerance baked into
 // each source string. `[\s]` spans the comment-collapsed single spaces.
 var DETECTORS = [
@@ -263,7 +284,31 @@ var DETECTORS = [
     reason: "COPY ... PROGRAM executes a shell command (Postgres RCE)" },
   { code: "sql.file-access", severity: "critical", kind: "copy-file",
     family: "floor", dialect: "postgres",
-    re: _re("\\bCOPY\\b[\\s\\S]{0,4000}?\\b(?:TO|FROM)\\b\\s+(?!STDIN\\b|STDOUT\\b)"),
+    // STDIN / STDOUT stream to the client and touch no server-side file, so
+    // they are excluded — and the exclusion is tested BEFORE the whitespace is
+    // consumed, which is the whole trick here.
+    //
+    // Written the other way round, after `\s+`, it is wrong: `\s+` is greedy but
+    // backtracks, so given two spaces it gives one back, leaves " STDIN" in
+    // front of a lookahead that only knows how to reject "STDIN", and reports a
+    // client-side `COPY t TO  STDIN` as a server-side file access. One space was
+    // quiet and two were critical.
+    //
+    // Teaching that lookahead to skip whitespace (`(?!\s*(?:STDIN|STDOUT)\b)`)
+    // fixes the verdict and introduces a worse problem: `\s+` and the `\s*`
+    // range over the same characters, so every backtrack re-scans the rest of
+    // the run — 45 ms on a 16k-space run, quadratic, in the one primitive whose
+    // job is to not be a denial of service.
+    //
+    // In front of `\s+` the lookahead is evaluated once, at a fixed position,
+    // and cannot interact with that quantifier at all. Measured flat.
+    //
+    // A lookahead rather than a scan-and-compare because its backtracking is
+    // what finds the file in `COPY (SELECT x FROM STDOUT) TO '/tmp/x'`: the
+    // first candidate is excluded and the one that matters comes later in the
+    // SAME statement, which a scan resuming past the excluded match would miss,
+    // since every match has to begin at COPY.
+    re: _re("\\bCOPY\\b[\\s\\S]{0,4000}?\\b(?:TO|FROM)\\b(?!\\s+(?:STDIN|STDOUT)\\b)\\s+"),
     reason: "COPY TO/FROM <file> reads or writes a server-side file" },
   { code: "sql.file-access", severity: "critical", kind: "large-object",
     family: "floor", dialect: "postgres",

package/lib/parsers/safe-env.js

@@ -64,6 +64,7 @@ var lazyRequire = require("../lazy-require");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var safeJson = require("../safe-json");
+var codepointClass = require("../codepoint-class");
 var { FrameworkError } = require("../framework-error");
 var { boot } = require("../log");
 
@@ -90,10 +91,117 @@ class SafeEnvError extends FrameworkError {
   }
 }
 
+// Split an unquoted value at an inline `# comment`, returning the text BEFORE
+// the comment, or null when there is no comment to strip. Replaces
+// `/^([^\s#]*(?:[ \t]+[^#\s]+)*)\s+#.*$/`.
+//
+// That pattern was NOT catastrophic, and it is worth saying so rather than
+// implying the family rule only ever removes live bugs. `[ \t]+` and `[^#\s]+`
+// are disjoint, so the partition of a line into separators and tokens is unique
+// and there is nothing for the engine to backtrack through — measured flat to
+// 40k characters across every shape that defeats the match. It goes because the
+// rule is uniform: a screen in this family costs the length of its input, and
+// that holds by construction instead of by someone re-deriving the ambiguity of
+// each pattern correctly, every time one is edited. The neighbouring
+// trailing-whitespace strip is already a walk, for a reason that WAS measured —
+// `.replace(/[ \t]+$/)` is quadratic in V8 and the parser caps total bytes, not
+// bytes per line.
+//
+// Reading the pattern back gives a rule with no search in it. Group 1 admits no
+// `#` at all, so the `#` the pattern finds is always the FIRST one; it must be
+// preceded by whitespace; and everything before that whitespace run may only be
+// separated by spaces and tabs (a `\v`, `\f` or U+00A0 is whitespace to `\s` but
+// not to `[ \t]`, so the pattern would not match and neither does this).
+function _splitInlineComment(rest) {
+  var hash = rest.indexOf("#");
+  if (hash <= 0) return null;                       // absent, or nothing before it
+  if (!codepointClass.inRanges(rest.charCodeAt(hash - 1), codepointClass.WHITESPACE_RANGES)) {
+    return null;                                    // `color#red` keeps its `#`
+  }
+  // Walk back over the whitespace run that `\s+` consumed.
+  var end = hash - 1;
+  while (end >= 0 && codepointClass.inRanges(rest.charCodeAt(end), codepointClass.WHITESPACE_RANGES)) {
+    end -= 1;
+  }
+  var head = rest.slice(0, end + 1);
+  // The separators inside group 1 are `[ \t]` only.
+  for (var i = 0; i < head.length; i += 1) {
+    var cc = head.charCodeAt(i);
+    if (!codepointClass.inRanges(cc, codepointClass.WHITESPACE_RANGES)) continue;
+    if (cc !== 0x20 && cc !== 0x09) return null;
+  }
+  // `#.*$` cannot cross a line terminator, and `$` without `m` is end-of-string.
+  // Lines arrive split on LF and CR already, but U+2028 and U+2029 survive that
+  // and are terminators to the grammar, so a comment containing one meant the
+  // pattern did not match and the whole value was kept.
+  for (var t = hash; t < rest.length; t += 1) {
+    var tc = rest.charCodeAt(t);
+    if (tc === 0x0A || tc === 0x0D || tc === 0x2028 || tc === 0x2029) return null;
+  }
+  return head;
+}
+
+// `export FOO=bar` — the POSIX shell convention. Replaces a `/^export\s+/` test
+// paired with an identical `.replace`, which walked the prefix twice.
+// The default key shape, `^[A-Z_][A-Z0-9_]*$`, as a walk. The label is what the
+// refusal message quotes, so an operator still sees the shape they violated
+// rather than the word "function".
+var _ASCII_UPPER      = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+var _KEY_HEAD_CHARS   = _ASCII_UPPER + "_";
+var _KEY_TAIL_CHARS   = _ASCII_UPPER + codepointClass.ASCII_DIGITS + "_";
+var DEFAULT_KEY_SHAPE = "^[A-Z_][A-Z0-9_]*$";
+
+function _matchesDefaultKeyShape(key) {
+  if (typeof key !== "string" || key.length === 0) return false;
+  if (_KEY_HEAD_CHARS.indexOf(key.charAt(0)) === -1) return false;
+  if (key.length === 1) return true;                 // isRunOf("") is false
+  return codepointClass.isRunOf(key.slice(1), _KEY_TAIL_CHARS);
+}
+
+var _EXPORT = "export";
+
+function _stripExportPrefix(line) {
+  if (line.slice(0, _EXPORT.length) !== _EXPORT) return line;
+  var i = _EXPORT.length;
+  var afterWord = i;
+  while (i < line.length &&
+         codepointClass.inRanges(line.charCodeAt(i), codepointClass.WHITESPACE_RANGES)) i += 1;
+  if (i === afterWord) return line;              // `exported=1` is a key, not a prefix
+  return line.slice(i);
+}
+
+// `$VAR` and `${VAR}` references, which this parser refuses rather than expands.
+// Replaces `/\$(\{[A-Za-z_]|[A-Za-z_])/` — a `$` followed either by a brace and
+// an identifier head, or by an identifier head directly. A trailing `$`, `$1` or
+// `$ ` is a literal dollar and stays one.
+function _isIdentifierHead(ch) {
+  // The length guard is load-bearing: `charAt` past the end returns "", and
+  // `indexOf("")` is 0 on every string, so without it a trailing `$` reads as a
+  // reference and a literal dollar at end-of-value is refused.
+  if (ch.length !== 1) return false;
+  return ch === "_" || codepointClass.ASCII_ALPHA.indexOf(ch) !== -1;
+}
+
+function _hasVariableReference(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    if (text.charAt(i) !== "$") continue;
+    var next = text.charAt(i + 1);
+    if (next === "{") {
+      if (_isIdentifierHead(text.charAt(i + 2))) return true;
+      continue;
+    }
+    if (_isIdentifierHead(next)) return true;
+  }
+  return false;
+}
+
 var DEFAULTS = {
   maxBytes:       C.BYTES.kib(64),
   maxKeys:        1_000,
-  keyShape:       /^[A-Z_][A-Z0-9_]*$/,
+  // The DEFAULT shape is a walk, not a pattern. An operator may still pass a
+  // RegExp — there the pattern is the INPUT, which is the one case this family
+  // allows — and that override is honoured unchanged below.
+  keyShape:       null,
   applyToProcess: false,
   allowOverwrite: false,
   rejectUnknown:  false,
@@ -120,7 +228,11 @@ function parse(input, opts) {
     ? Math.min(opts.maxBytes, C.BYTES.mib(1)) : DEFAULTS.maxBytes;
   var maxKeys = opts.maxKeys !== undefined
     ? Math.min(opts.maxKeys, 100_000) : DEFAULTS.maxKeys;
-  var keyShape = opts.keyShape instanceof RegExp ? opts.keyShape : DEFAULTS.keyShape;
+  var operatorKeyShape = opts.keyShape instanceof RegExp ? opts.keyShape : null;
+  var keyShapeLabel = operatorKeyShape ? String(operatorKeyShape) : DEFAULT_KEY_SHAPE;
+  function keyShapeAccepts(key) {
+    return operatorKeyShape ? operatorKeyShape.test(key) : _matchesDefaultKeyShape(key);
+  }
 
   input = safeBuffer.normalizeText(input, {
     maxBytes:   maxBytes,
@@ -129,7 +241,9 @@ function parse(input, opts) {
     sizeCode:   "env/too-large",
   });
 
-  var rawLines = input.split(/\r\n|\r|\n/);
+  // splitLinesAny breaks on LF, CR and CRLF-as-one — the same three the
+  // `/\r\n|\r|\n/` alternation covered, in the same order of preference.
+  var rawLines = codepointClass.splitLinesAny(input);
   var values = Object.create(null);
   var seen = new Set();
 
@@ -137,14 +251,12 @@ function parse(input, opts) {
     var line = rawLines[i];
     var lineNumber = i + 1;
     // Trim leading whitespace (operators sometimes indent for readability)
-    var trimmed = line.replace(/^[ \t]+/, "");
+    var trimmed = codepointClass.trimChars(line, " \t", { trailing: false });
     if (trimmed.length === 0) continue;
     if (trimmed.charAt(0) === "#") continue;
 
     // Optional `export ` prefix (POSIX shell convention)
-    if (/^export\s+/.test(trimmed)) {
-      trimmed = trimmed.replace(/^export\s+/, "");
-    }
+    trimmed = _stripExportPrefix(trimmed);
 
     var eqIdx = trimmed.indexOf("=");
     if (eqIdx < 0) {
@@ -159,9 +271,9 @@ function parse(input, opts) {
     if (pick.isPoisonedKey(key)) {
       throw new SafeEnvError("forbidden key '" + key + "'", "env/poisoned-key", lineNumber);
     }
-    if (!keyShape.test(key)) {
+    if (!keyShapeAccepts(key)) {
       throw new SafeEnvError(
-        "key '" + key + "' does not match keyShape " + keyShape,
+        "key '" + key + "' does not match keyShape " + keyShapeLabel,
         "env/bad-key-shape", lineNumber
       );
     }
@@ -188,18 +300,14 @@ function parse(input, opts) {
       // Unquoted value: strip trailing whitespace + inline `# comment`.
       // The comment marker MUST be preceded by whitespace to count
       // (so a value like `KEY=color#red` keeps the literal `#`).
-      var commentMatch = rest.match(/^([^\s#]*(?:[ \t]+[^#\s]+)*)\s+#.*$/);
+      var beforeComment = _splitInlineComment(rest);
       // stripTrailingHspace is a linear char-scan; .replace(/[ \t]+$/) is O(n^2)
       // in V8 and the env parser only caps TOTAL bytes, not per-line, so a
       // single huge-whitespace value line would otherwise hang the parser.
-      if (commentMatch) {
-        value = safeBuffer.stripTrailingHspace(commentMatch[1]);
-      } else {
-        value = safeBuffer.stripTrailingHspace(rest);
-      }
+      value = safeBuffer.stripTrailingHspace(beforeComment === null ? rest : beforeComment);
       // Reject `$VAR` style references — explicit error so operators
       // see the policy rather than silently getting unexpanded text.
-      if (/\$(\{[A-Za-z_]|[A-Za-z_])/.test(value)) {
+      if (_hasVariableReference(value)) {
         throw new SafeEnvError(
           "$VAR / ${VAR} expansion not supported (escape with \\$ if literal, or quote and expand yourself)",
           "env/expansion-banned", lineNumber
@@ -254,7 +362,8 @@ function _decodeDoubleQuoted(rest, lineNumber) {
       // Optional inline comment after closing quote — ignore.
       return out;
     }
-    if (ch === "$" && /^[{A-Za-z_]/.test(rest.charAt(i + 1) || "")) {
+    var afterDollar = rest.charAt(i + 1);
+    if (ch === "$" && (afterDollar === "{" || _isIdentifierHead(afterDollar))) {
       throw new SafeEnvError(
         "$VAR / ${VAR} expansion not supported in double-quoted value (use \\$ for literal $)",
         "env/expansion-banned", lineNumber

package/lib/parsers/safe-ini.js

@@ -41,6 +41,7 @@ var C = require("../constants");
 var pick = require("../pick");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
+var codepointClass = require("../codepoint-class");
 var { defineClass } = require("../framework-error");
 
 var IniSafeError = defineClass("IniSafeError", { alwaysPermanent: true });
@@ -69,7 +70,7 @@ function _stripComment(line) {
     if (c === "\"" && !inSingle) { inDouble = !inDouble; continue; }
     if (c === "'"  && !inDouble) { inSingle = !inSingle; continue; }
     if (!inSingle && !inDouble && (c === ";" || c === "#")) {
-      if (i === 0 || /\s/.test(line.charAt(i - 1))) {
+      if (i === 0 || codepointClass.inRanges(line.charCodeAt(i - 1), codepointClass.WHITESPACE_RANGES)) {
         return line.slice(0, i);
       }
     }
@@ -110,6 +111,113 @@ function _unquote(raw) {
   return s;
 }
 
+// Lexical shape tests for the value forms INI coerces. Each replaces an
+// anchored pattern and walks the string once, so the cost is its length —
+// values arrive from a file an operator may not control, and a screen whose
+// cost depends on the arrangement of the characters is what this family avoids.
+//
+// `\d` in the patterns these replace is ASCII-only, so isAsciiDigit matches it
+// exactly; a walk using a Unicode digit test would accept more than the pattern
+// did and silently widen what parses as a number.
+
+// `/^0x[0-9a-f]+$/i` — the prefix, then at least one hex digit, nothing else.
+function _isHexInteger(s) {
+  if (s.length < 3) return false;
+  if (s.charAt(0) !== "0") return false;
+  var x = s.charAt(1);
+  if (x !== "x" && x !== "X") return false;
+  return codepointClass.isRunOf(s.slice(2), codepointClass.ASCII_HEX);
+}
+
+// Digits from `from` to the end, at least one. The shared tail of every shape
+// below, and the reason none of them needs a quantifier.
+function _digitsToEnd(s, from) {
+  if (from >= s.length) return false;
+  return codepointClass.isRunOf(s.slice(from), codepointClass.ASCII_DIGITS);
+}
+
+function _digitRunEnd(s, from) {
+  var i = from;
+  while (i < s.length && codepointClass.isAsciiDigit(s.charCodeAt(i))) i += 1;
+  return i;                                        // === from when no digits
+}
+
+// `/^-?\d+$/`
+function _isDecimalInteger(s) {
+  return _digitsToEnd(s, s.charAt(0) === "-" ? 1 : 0);
+}
+
+// `/^-?\d+\.\d+([eE][+-]?\d+)?$/` or `/^-?\d+[eE][+-]?\d+$/` — a float needs
+// either a fractional part, an exponent, or both, which is what keeps a bare
+// integer out of this branch and in the one above it.
+function _isDecimalFloat(s) {
+  var i = s.charAt(0) === "-" ? 1 : 0;
+  var afterInt = _digitRunEnd(s, i);
+  if (afterInt === i) return false;                // no integer part
+  i = afterInt;
+  var sawFraction = false;
+  if (s.charAt(i) === ".") {
+    var afterFrac = _digitRunEnd(s, i + 1);
+    if (afterFrac === i + 1) return false;         // `1.` is not a float here
+    i = afterFrac;
+    sawFraction = true;
+  }
+  var e = s.charAt(i);
+  if (e === "e" || e === "E") {
+    var j = i + 1;
+    var sign = s.charAt(j);
+    if (sign === "+" || sign === "-") j += 1;
+    if (!_digitsToEnd(s, j)) return false;
+    return true;                                   // exponent consumed the rest
+  }
+  return sawFraction && i === s.length;
+}
+
+// `[name "subsection"]` — the git-config form. Replaces
+// `/^([A-Za-z0-9._-]+)\s+"([^"\\]*(?:\\.[^"\\]*)*)"$/`, whose inner group is the
+// unrolled-loop idiom for a quoted string; walking it is both clearer and free
+// of the backtracking that idiom exists to avoid.
+//
+// Two details of the pattern are load-bearing and preserved here. The value is
+// captured VERBATIM, escapes included — `_unquote` does the unescaping later, so
+// consuming the backslash here would double-unescape. And `\\.` cannot match a
+// line terminator, so a backslash before one is not an escape and the whole
+// header fails to match rather than swallowing the break.
+var _SECTION_NAME_CHARS = codepointClass.ASCII_ALNUM + "._-";
+
+function _isDotAtom(ch) {
+  // The characters `.` does NOT match without the `s` flag.
+  return ch !== "\n" && ch !== "\r" && ch !== "\u2028" && ch !== "\u2029";
+}
+
+function _parseQuotedSectionHeader(inner) {
+  var i = 0;
+  while (i < inner.length && _SECTION_NAME_CHARS.indexOf(inner.charAt(i)) !== -1) i += 1;
+  if (i === 0) return null;                             // name needs one char
+  var name = inner.slice(0, i);
+  var afterName = i;
+  while (i < inner.length &&
+         codepointClass.inRanges(inner.charCodeAt(i), codepointClass.WHITESPACE_RANGES)) i += 1;
+  if (i === afterName) return null;                     // `\s+` needs one
+  if (inner.charAt(i) !== "\"") return null;
+  i += 1;
+  var value = "";
+  while (i < inner.length) {
+    var ch = inner.charAt(i);
+    if (ch === "\\") {
+      var next = inner.charAt(i + 1);
+      if (i + 1 >= inner.length || !_isDotAtom(next)) return null;
+      value += ch + next;
+      i += 2;
+      continue;
+    }
+    if (ch === "\"") return i === inner.length - 1 ? [name, value] : null;
+    value += ch;
+    i += 1;
+  }
+  return null;                                          // unterminated quote
+}
+
 function _coerceValue(raw) {
   if (raw.length === 0) return raw;
   var first = raw.charAt(0);
@@ -117,21 +225,21 @@ function _coerceValue(raw) {
   var lower = raw.toLowerCase();
   if (TRUE_VALUES.has(lower))  return true;
   if (FALSE_VALUES.has(lower)) return false;
-  if (/^0x[0-9a-f]+$/i.test(raw)) {
+  if (_isHexInteger(raw)) {
     var hex = parseInt(raw, RADIX_HEX);
     if (!Number.isSafeInteger(hex)) {
       throw _err("ini/value-out-of-range", "hex integer exceeds safe-integer range: " + raw);
     }
     return hex;
   }
-  if (/^-?\d+$/.test(raw)) {
+  if (_isDecimalInteger(raw)) {
     var n = Number(raw);
     if (!Number.isSafeInteger(n)) {
       throw _err("ini/value-out-of-range", "integer exceeds safe-integer range: " + raw);
     }
     return n;
   }
-  if (/^-?\d+\.\d+([eE][+-]?\d+)?$/.test(raw) || /^-?\d+[eE][+-]?\d+$/.test(raw)) {
+  if (_isDecimalFloat(raw)) {
     var f = Number(raw);
     // Float overflow (e.g. 1e999) coerces to ±Infinity — the same
     // never-silently-coerce refusal the integer/hex branches enforce with
@@ -178,10 +286,8 @@ function _parseSectionHeader(line) {
   if (inner.length === 0) {
     throw _err("ini/empty-section", "section header [] has no name");
   }
-  var quotedMatch = /^([A-Za-z0-9._-]+)\s+"([^"\\]*(?:\\.[^"\\]*)*)"$/.exec(inner);
-  if (quotedMatch) {
-    return [quotedMatch[1], quotedMatch[2]];
-  }
+  var quoted = _parseQuotedSectionHeader(inner);
+  if (quoted) return quoted;
   var parts = inner.split(".");
   for (var i = 0; i < parts.length; i++) {
     if (parts[i].length === 0) {
@@ -240,7 +346,7 @@ function parse(input, opts) {
   var sectionCount = 0;
   var keysInCurrentSection = 0;
 
-  var lines = input.split(/\r?\n/);
+  var lines = codepointClass.splitLines(input);
   for (var li = 0; li < lines.length; li++) {
     var raw = lines[li];
     var stripped = _stripComment(raw).trim();

package/lib/parsers/safe-toml.js

@@ -71,6 +71,61 @@ var RADIX_BIN     = 0x2;
 var RADIX_OCTAL   = 0x8;
 var RADIX_HEX     = 0x10;
 
+// Character sets and fixed-width shapes, as walks. TOML's grammar is all
+// fixed-width date and time fields and single-character classes, so every one of
+// these replaces a pattern with an index comparison — nothing here needs a
+// search, and the parser's cost stays the length of the document.
+var _OCTAL_DIGITS  = "01234567";
+var _BINARY_DIGITS = "01";
+var _BARE_KEY_TAIL = codepointClass.ASCII_ALNUM + "_";
+var _NUMBER_LEADS  = codepointClass.ASCII_DIGITS + "+-i n";     // `inf`, `nan`, sign, space
+
+function _isDigit(ch)      { return ch.length === 1 && codepointClass.ASCII_DIGITS.indexOf(ch) !== -1; }
+function _isHexDigit(ch)   { return ch.length === 1 && codepointClass.ASCII_HEX.indexOf(ch) !== -1; }
+function _isOctalDigit(ch) { return ch.length === 1 && _OCTAL_DIGITS.indexOf(ch) !== -1; }
+function _isBinaryDigit(ch){ return ch.length === 1 && _BINARY_DIGITS.indexOf(ch) !== -1; }
+
+// `charAt` past the end returns "", and `"".indexOf` is 0 on every string, so
+// each of these guards its length before asking. Without it an out-of-range read
+// answers "yes" and the shape checks accept a truncated document.
+function _isBareKeyChar(ch) { return ch.length === 1 && _BARE_KEY_TAIL.indexOf(ch) !== -1; }
+function _isNumberLead(ch)  { return ch.length === 1 && _NUMBER_LEADS.indexOf(ch) !== -1; }
+
+function _digitsAt(text, from, count) {
+  if (from + count > text.length) return false;
+  for (var i = 0; i < count; i += 1) {
+    if (!_isDigit(text.charAt(from + i))) return false;
+  }
+  return true;
+}
+
+// `\d{4}-\d{2}-\d{2}` anchored at the start of `text`.
+function _looksLikeDate(text) {
+  return _digitsAt(text, 0, 4) && text.charAt(4) === "-" &&
+         _digitsAt(text, 5, 2) && text.charAt(7) === "-" &&
+         _digitsAt(text, 8, 2);
+}
+
+// `\d{2}:\d{2}:\d{2}` anchored at the start of `text`.
+function _looksLikeTime(text) {
+  return _digitsAt(text, 0, 2) && text.charAt(2) === ":" &&
+         _digitsAt(text, 3, 2) && text.charAt(5) === ":" &&
+         _digitsAt(text, 6, 2);
+}
+
+// `^[+-]\d{2}:\d{2}$` — a whole numeric UTC offset, nothing after it.
+function _isNumericOffset(text) {
+  if (text.length !== 6) return false;
+  var sign = text.charAt(0);
+  if (sign !== "+" && sign !== "-") return false;
+  return _digitsAt(text, 1, 2) && text.charAt(3) === ":" && _digitsAt(text, 4, 2);
+}
+
+// Strip the `_` digit separators TOML allows inside numbers.
+function _stripUnderscores(text) {
+  return text.indexOf("_") === -1 ? text : codepointClass.stripRanges(text, [0x5F]);
+}
+
 // Date-time literal character widths (per TOML / RFC 3339).
 var TIME_CHARS    = 0x8;    // "HH:MM:SS"
 var OFFSET_CHARS  = 0x6;    // "+HH:MM"
@@ -285,7 +340,7 @@ function parse(input, opts) {
       case "U": {
         var hexLen = 0x8;
         var hex8 = input.substring(pos, pos + hexLen);
-        if (hex8.length < hexLen || !/^[0-9a-fA-F]{8}$/.test(hex8)) {
+        if (hex8.length < hexLen || hex8.length !== 8 || !codepointClass.isRunOf(hex8, codepointClass.ASCII_HEX)) {
           throw _err("bad \\U escape", "toml/bad-escape");
         }
         _advance(hexLen);
@@ -404,19 +459,19 @@ function parse(input, opts) {
   // current position doesn't start a date-time literal.
   function _tryParseDateTime() {
     // Date-time form: YYYY-MM-DD followed by 'T'/' ' followed by time
-    if (pos + 10 <= len && /^\d{4}-\d{2}-\d{2}/.test(input.substr(pos, 10))) {
+    if (pos + 10 <= len && _looksLikeDate(input.substr(pos, 10))) {
       var sep = _peek(10);
       if (sep === "T" || sep === "t" || sep === " ") {
         // Look ahead for time portion (HH:MM:SS = 8 chars)
         var timeStart = pos + 11;
         var timeChars = TIME_CHARS;
-        if (/^\d{2}:\d{2}:\d{2}/.test(input.substr(timeStart, timeChars))) {
+        if (_looksLikeTime(input.substr(timeStart, timeChars))) {
           var datePart = input.substr(pos, 10);
           var timeEnd = timeStart + timeChars;
           // Optional fractional
           if (_peek(timeEnd - pos) === ".") {
             timeEnd += 1;
-            while (timeEnd < len && /\d/.test(input.charAt(timeEnd))) timeEnd += 1;
+            while (timeEnd < len && _isDigit(input.charAt(timeEnd))) timeEnd += 1;
           }
           var timePart = input.substring(timeStart, timeEnd);
           // Optional offset
@@ -427,7 +482,7 @@ function parse(input, opts) {
             // Expect ±HH:MM (6 chars)
             var offsetChars = OFFSET_CHARS;
             var off = input.substr(timeEnd, offsetChars);
-            if (/^[+-]\d{2}:\d{2}$/.test(off)) {
+            if (_isNumericOffset(off)) {
               offsetStr = off;
               timeEnd += offsetChars;
             }
@@ -445,7 +500,7 @@ function parse(input, opts) {
       }
       // Date-only — but only if followed by something OTHER than digit/colon
       var after = _peek(10);
-      if (!after || !/[0-9:.]/.test(after)) {
+      if (!after || !(_isDigit(after) || after === ":" || after === ".")) {
         var ds = input.substr(pos, 10);
         _advance(10);
         return { kind: "local-date", value: ds };
@@ -453,11 +508,11 @@ function parse(input, opts) {
     }
     // Time-only: HH:MM:SS (8 chars)
     var timeOnlyChars = TIME_CHARS;
-    if (pos + timeOnlyChars <= len && /^\d{2}:\d{2}:\d{2}/.test(input.substr(pos, timeOnlyChars))) {
+    if (pos + timeOnlyChars <= len && _looksLikeTime(input.substr(pos, timeOnlyChars))) {
       var teEnd = pos + timeOnlyChars;
       if (input.charAt(teEnd) === ".") {
         teEnd += 1;
-        while (teEnd < len && /\d/.test(input.charAt(teEnd))) teEnd += 1;
+        while (teEnd < len && _isDigit(input.charAt(teEnd))) teEnd += 1;
       }
       var ts = input.substring(pos, teEnd);
       _advance(teEnd - pos);
@@ -496,12 +551,12 @@ function parse(input, opts) {
         while (!_eof()) {
           var ch = _peek();
           if (ch === "_") { _advance(); continue; }
-          if (radix === RADIX_HEX   && /[0-9a-fA-F]/.test(ch)) { _advance(); continue; }
-          if (radix === RADIX_OCTAL && /[0-7]/.test(ch))       { _advance(); continue; }
-          if (radix === RADIX_BIN   && /[01]/.test(ch))        { _advance(); continue; }
+          if (radix === RADIX_HEX   && _isHexDigit(ch))    { _advance(); continue; }
+          if (radix === RADIX_OCTAL && _isOctalDigit(ch))  { _advance(); continue; }
+          if (radix === RADIX_BIN   && _isBinaryDigit(ch)) { _advance(); continue; }
           break;
         }
-        var digits = input.substring(digitsStart, pos).replace(/_/g, "");
+        var digits = _stripUnderscores(input.substring(digitsStart, pos));
         if (digits.length === 0) throw _err("expected digits after radix prefix", "toml/bad-number");
         var n = parseInt(digits, radix);
         if (!Number.isSafeInteger(n)) {
@@ -527,7 +582,7 @@ function parse(input, opts) {
       }
       break;
     }
-    var raw = input.substring(startPos, pos).replace(/_/g, "");
+    var raw = _stripUnderscores(input.substring(startPos, pos));
     if (raw === "" || raw === "-" || raw === "+") {
       throw new SafeTomlError("invalid number", "toml/bad-number", startLine, startCol);
     }
@@ -560,17 +615,17 @@ function parse(input, opts) {
     if (c === "[") return _parseArray(depth + 1);
     if (c === "{") return _parseInlineTable(depth + 1);
 
-    if (input.substr(pos, 4) === "true" && !/[A-Za-z0-9_]/.test(input.charAt(pos + 4) || "")) {
+    if (input.substr(pos, 4) === "true" && !_isBareKeyChar(input.charAt(pos + 4))) {
       _advance(4); return true;
     }
-    if (input.substr(pos, 5) === "false" && !/[A-Za-z0-9_]/.test(input.charAt(pos + 5) || "")) {
+    if (input.substr(pos, 5) === "false" && !_isBareKeyChar(input.charAt(pos + 5))) {
       _advance(5); return false;
     }
 
     var dt = _tryParseDateTime();
     if (dt !== null) return dt.value;
 
-    if (/[0-9+\-i n]/.test(c)) return _parseNumber(c);
+    if (_isNumberLead(c)) return _parseNumber(c);
 
     throw _err("unexpected character '" + c + "'", "toml/expected-value");
   }

package/lib/parsers/safe-xml.js

@@ -53,6 +53,7 @@ var C = require("../constants");
 var pick = require("../pick");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
+var codepointClass = require("../codepoint-class");
 var { FrameworkError } = require("../framework-error");
 
 class SafeXmlError extends FrameworkError {
@@ -405,7 +406,12 @@ function parse(input, opts) {
       }
     }
     Object.assign(obj, grouped);
-    var combinedText = textParts.join("").replace(/\s+/g, " ").trim();
+    // Collapse whitespace runs to a single space and trim, by walking rather
+    // than matching: the text came off the wire and a screen whose cost depends
+    // on the shape of the input is the thing this family does not do.
+    // splitOnWhitespace drops empty segments, so joining restores exactly the
+    // collapsed-and-trimmed form.
+    var combinedText = codepointClass.splitOnWhitespace(textParts.join("")).join(" ");
     if (combinedText.length > 0) obj["#text"] = combinedText;
     return _make(name, obj);
   }

package/lib/parsers/safe-yaml.js

@@ -59,6 +59,7 @@ var pick = require("../pick");
 var boundedMap = require("../bounded-map");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
+var codepointClass = require("../codepoint-class");
 var { FrameworkError } = require("../framework-error");
 
 class SafeYamlError extends FrameworkError {
@@ -93,14 +94,187 @@ var DEFAULTS = {
 // YAML 1.2 core-schema scalar resolution. Order matters: null first
 // (covers ~ and empty), then bool, then int (with base prefixes), then
 // float, then string fallback.
-var NULL_RE  = /^(null|Null|NULL|~|)$/;
-var BOOL_RE  = /^(true|True|TRUE|false|False|FALSE)$/;
-var INT_RE   = /^[-+]?(0|[1-9][0-9]*)$/;
-var INT_OCT  = /^0o[0-7]+$/;
-var INT_HEX  = /^0x[0-9a-fA-F]+$/;
-var FLOAT_RE = /^[-+]?(\.[0-9]+|[0-9]+(\.[0-9]*)?)([eE][-+]?[0-9]+)?$/;
-var FLOAT_INF = /^[-+]?\.(inf|Inf|INF)$/;
-var FLOAT_NAN = /^\.(nan|NaN|NAN)$/;
+// The resolvers are exact-set membership or a left-to-right walk. YAML's core
+// schema spells each type out, so none of these needs to search: the anchored
+// alternations were only ever a compact way of writing a fixed vocabulary and a
+// digit shape.
+var NULL_TOKENS = { "": 1, "null": 1, "Null": 1, "NULL": 1, "~": 1 };
+var BOOL_TRUE   = { "true": 1, "True": 1, "TRUE": 1 };
+var BOOL_FALSE  = { "false": 1, "False": 1, "FALSE": 1 };
+var INF_TOKENS  = { ".inf": 1, ".Inf": 1, ".INF": 1 };
+var NAN_TOKENS  = { ".nan": 1, ".NaN": 1, ".NAN": 1 };
+var OCTAL_DIGITS = "01234567";
+
+function _isNull(s) { return Object.prototype.hasOwnProperty.call(NULL_TOKENS, s); }
+function _isBool(s) {
+  return Object.prototype.hasOwnProperty.call(BOOL_TRUE, s) ||
+         Object.prototype.hasOwnProperty.call(BOOL_FALSE, s);
+}
+
+function _signOffset(s) { var c = s.charAt(0); return (c === "-" || c === "+") ? 1 : 0; }
+
+// `^[-+]?(0|[1-9][0-9]*)$` — no leading zeros, because `010` is a string in the
+// core schema rather than an octal.
+function _isDecimalInt(s) {
+  var i = _signOffset(s);
+  var rest = s.slice(i);
+  if (rest.length === 0) return false;
+  if (rest === "0") return true;
+  if (rest.charAt(0) === "0") return false;
+  return codepointClass.isRunOf(rest, codepointClass.ASCII_DIGITS);
+}
+
+function _isPrefixedInt(s, marker, alphabet) {
+  if (s.length < 3) return false;
+  if (s.charAt(0) !== "0" || s.charAt(1) !== marker) return false;
+  return codepointClass.isRunOf(s.slice(2), alphabet);
+}
+function _isOctalInt(s) { return _isPrefixedInt(s, "o", OCTAL_DIGITS); }
+function _isHexInt(s)   { return _isPrefixedInt(s, "x", codepointClass.ASCII_HEX); }
+
+// `^[-+]?(\.[0-9]+|[0-9]+(\.[0-9]*)?)([eE][-+]?[0-9]+)?$` — either a leading dot
+// with digits after it, or digits with an optional dot and optional digits, then
+// an optional exponent that must carry at least one digit.
+function _isFloat(s) {
+  var i = _signOffset(s);
+  var n = s.length;
+  // Both branches below return early when they find no digit, so reaching the
+  // exponent means at least one was consumed — no separate flag needed.
+  if (s.charAt(i) === ".") {
+    i += 1;
+    var fracStart = i;
+    while (i < n && codepointClass.ASCII_DIGITS.indexOf(s.charAt(i)) !== -1) i += 1;
+    if (i === fracStart) return false;              // `.` alone is not a float
+  } else {
+    var intStart = i;
+    while (i < n && codepointClass.ASCII_DIGITS.indexOf(s.charAt(i)) !== -1) i += 1;
+    if (i === intStart) return false;
+    if (s.charAt(i) === ".") {
+      i += 1;
+      while (i < n && codepointClass.ASCII_DIGITS.indexOf(s.charAt(i)) !== -1) i += 1;
+    }
+  }
+  if (i === n) return true;
+  var e = s.charAt(i);
+  if (e !== "e" && e !== "E") return false;
+  i += 1;
+  var expSign = s.charAt(i);
+  if (expSign === "+" || expSign === "-") i += 1;
+  if (i >= n) return false;
+  return codepointClass.isRunOf(s.slice(i), codepointClass.ASCII_DIGITS);
+}
+
+function _isInfinity(s) {
+  return Object.prototype.hasOwnProperty.call(INF_TOKENS, s.slice(_signOffset(s)));
+}
+function _isNotANumber(s) {
+  return Object.prototype.hasOwnProperty.call(NAN_TOKENS, s);
+}
+
+function _isWhitespaceChar(ch) {
+  return ch.length === 1 && codepointClass.inRanges(ch.charCodeAt(0), codepointClass.WHITESPACE_RANGES);
+}
+
+// The four characters `.` does not match without the `s` flag.
+function _isLineTerminator(ch) {
+  return ch === "\n" || ch === "\r" || ch === "\u2028" || ch === "\u2029";
+}
+
+// `^---(\s|$)` / `^\.\.\.(\s|$)` — a document marker is the three characters and
+// then either the end of the line or a space, so `---foo` is not one.
+function _isDocumentMarker(line, marker) {
+  if (line.slice(0, marker.length) !== marker) return false;
+  if (line.length === marker.length) return true;
+  return _isWhitespaceChar(line.charAt(marker.length));
+}
+
+// `^[|>][-+]?[0-9]?\s*$` and its variant allowing a trailing `# comment`.
+// A block-scalar header: the indicator, an optional chomping sign, an optional
+// single explicit-indent digit, then nothing that matters.
+function _isBlockScalarHeader(content, allowComment) {
+  var i = 0;
+  var lead = content.charAt(0);
+  if (lead !== "|" && lead !== ">") return false;
+  i += 1;
+  var sign = content.charAt(i);
+  if (sign === "-" || sign === "+") i += 1;
+  var digit = content.charAt(i);
+  if (digit.length === 1 && codepointClass.ASCII_DIGITS.indexOf(digit) !== -1) i += 1;
+  while (i < content.length && _isWhitespaceChar(content.charAt(i))) i += 1;
+  if (i === content.length) return true;
+  if (!allowComment) return false;
+  if (content.charAt(i) !== "#") return false;
+  // `.*` stops at a line terminator, and `$` without `m` is end-of-string, so a
+  // comment may not contain one. ECMAScript counts four, not just LF: U+2028 and
+  // U+2029 are line terminators to the grammar even though nothing else here
+  // treats them as breaks, and accepting them would admit a header the pattern
+  // refused.
+  var tail = content.slice(i);
+  for (var t = 0; t < tail.length; t += 1) {
+    if (_isLineTerminator(tail.charAt(t))) return false;
+  }
+  return true;
+}
+
+// `(^|\s)([&*])([A-Za-z0-9_][A-Za-z0-9_-]*)` — an anchor or alias sigil that
+// opens a token. Returns the index of the match INCLUDING the leading separator,
+// matching what the pattern captured, so the reported line is unchanged.
+var _NAME_HEAD = codepointClass.ASCII_ALNUM + "_";
+var _NAME_TAIL = codepointClass.ASCII_ALNUM + "_-";
+
+function _findAnchorOrAlias(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    var ch = text.charAt(i);
+    if (ch !== "&" && ch !== "*") continue;
+    var atStart = i === 0;
+    if (!atStart && !_isWhitespaceChar(text.charAt(i - 1))) continue;
+    if (_NAME_HEAD.indexOf(text.charAt(i + 1)) === -1 || text.charAt(i + 1) === "") continue;
+    return { index: atStart ? i : i - 1, sigil: ch };
+  }
+  return null;
+}
+
+// `(^|[\s-])(!{1,2}[A-Za-z<])` — one or two `!` opening a tag.
+function _findTag(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    if (text.charAt(i) !== "!") continue;
+    var atStart = i === 0;
+    var before = text.charAt(i - 1);
+    if (!atStart && !(before === "-" || _isWhitespaceChar(before))) continue;
+    // The pattern is greedy, so it takes two `!` when both are present.
+    var after = text.charAt(i + 1) === "!" ? text.charAt(i + 2) : text.charAt(i + 1);
+    if (after.length !== 1) continue;
+    // Digits count. The pattern this replaces used `[A-Za-z<]` while the comment
+    // above it said "alphanumeric or `<`", and the code was the weaker of the
+    // two: `a: !123` is a local tag and parsed as the plain string "!123"
+    // instead of being refused, so the documented ban had a hole in it. This is
+    // not a regression from the rewrite — `main` behaves the same way — but the
+    // promise is that tags are refused, so the stricter reading wins.
+    if (after !== "<" && codepointClass.ASCII_ALNUM.indexOf(after) === -1) continue;
+    return { index: atStart ? i : i - 1 };
+  }
+  return null;
+}
+
+// `(^|\n)%(YAML|TAG)\b` — a directive at column zero.
+var _DIRECTIVE_NAMES = ["YAML", "TAG"];
+
+function _findDirective(text) {
+  for (var i = 0; i < text.length; i += 1) {
+    if (text.charAt(i) !== "%") continue;
+    var atStart = i === 0;
+    if (!atStart && text.charAt(i - 1) !== "\n") continue;
+    for (var d = 0; d < _DIRECTIVE_NAMES.length; d += 1) {
+      var name = _DIRECTIVE_NAMES[d];
+      if (text.slice(i + 1, i + 1 + name.length) !== name) continue;
+      // `\b` — the character after the name must not continue a word.
+      var next = text.charAt(i + 1 + name.length);
+      if (next.length === 1 && (_NAME_HEAD.indexOf(next) !== -1)) continue;
+      return { index: atStart ? i : i - 1, precededByNewline: !atStart };
+    }
+  }
+  return null;
+}
 
 function _resolveScalar(s) {
   // Fall back to string for any token whose length exceeds the scalar cap
@@ -109,31 +283,31 @@ function _resolveScalar(s) {
   // type-inference regexes never see a pathologically long string.
   if (typeof s !== "string" || s.length > MAX_SCALAR_BYTES) return s;
   // Below: every regex test sees an `s` whose s.length <= MAX_SCALAR_BYTES.
-  if (NULL_RE.test(s)) return null;
-  if (BOOL_RE.test(s)) return s.toLowerCase() === "true";
+  if (_isNull(s)) return null;
+  if (_isBool(s)) return s.toLowerCase() === "true";
   // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
-  if (INT_RE.test(s)) {
+  if (_isDecimalInt(s)) {
     var n = parseInt(s, 10);
     if (Number.isSafeInteger(n)) return n;
     return s;  // fallback to string for huge ints (don't lose precision silently)
   }
   // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
-  if (INT_OCT.test(s)) {
+  if (_isOctalInt(s)) {
     var oct = parseInt(s.substring(2), RADIX_OCTAL);
     if (Number.isSafeInteger(oct)) return oct;
     return s;
   }
   // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
-  if (INT_HEX.test(s)) {
+  if (_isHexInt(s)) {
     var hex = parseInt(s.substring(2), RADIX_HEX);
     if (Number.isSafeInteger(hex)) return hex;
     return s;
   }
   // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
-  if (FLOAT_INF.test(s)) return s.charAt(0) === "-" ? -Infinity : Infinity;
-  if (FLOAT_NAN.test(s)) return NaN;
+  if (_isInfinity(s)) return s.charAt(0) === "-" ? -Infinity : Infinity;
+  if (_isNotANumber(s)) return NaN;
   // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
-  if (FLOAT_RE.test(s)) {
+  if (_isFloat(s)) {
     var f = parseFloat(s);
     if (!isNaN(f)) return f;
   }
@@ -179,7 +353,9 @@ function parse(input, opts) {
   _preValidate(input);
 
   // Normalize line endings: CRLF / CR → LF for consistent line-based work.
-  input = input.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+  // Normalise CRLF and lone CR to LF. splitLinesAny treats all three as one
+  // break, so rejoining with "\n" is the same substitution in one pass.
+  input = codepointClass.splitLinesAny(input).join("\n");
 
   // Split into raw lines preserving line numbers.
   var rawLines = input.split("\n");
@@ -212,11 +388,11 @@ function parse(input, opts) {
   // Reject any later `---` or `...` (multi-document streams not supported).
   var idx = 0;
   while (idx < lines.length && (lines[idx].isBlank || lines[idx].isComment)) idx += 1;
-  if (idx < lines.length && /^---(\s|$)/.test(lines[idx].content)) idx += 1;
+  if (idx < lines.length && _isDocumentMarker(lines[idx].content, "---")) idx += 1;
   // Subsequent doc markers anywhere = reject.
   for (var j = idx; j < lines.length; j++) {
     var c = lines[j].content;
-    if (/^---(\s|$)/.test(c) || /^\.\.\.(\s|$)/.test(c)) {
+    if (_isDocumentMarker(c, "---") || _isDocumentMarker(c, "...")) {
       throw new SafeYamlError(
         "multi-document YAML streams are not supported",
         "yaml/multi-document", lines[j].lineNumber, 1
@@ -277,7 +453,7 @@ function parse(input, opts) {
     }
 
     // Block scalar header: `|` or `>` (with optional chomp/indent indicator)
-    if (/^[|>][-+]?[0-9]?\s*(#.*)?$/.test(content)) {
+    if (_isBlockScalarHeader(content, true)) {
       return _parseBlockScalar(k, indent, content);
     }
 
@@ -398,7 +574,8 @@ function parse(input, opts) {
       // 1. if there's content after the colon, that's a flow value or
       //    a plain scalar continuation on the same line.
       // 2. otherwise the value lives on subsequent more-indented lines.
-      var afterColon = ln.content.substring(keyRange.valueStart).replace(/^[ \t]+/, "");
+      var afterColon = codepointClass.trimChars(
+        ln.content.substring(keyRange.valueStart), " \t", { trailing: false });
       // Strip end-of-line comment
       afterColon = _stripEolComment(afterColon);
       var value;
@@ -406,7 +583,7 @@ function parse(input, opts) {
         // Inline value on this line.
         if (afterColon.charAt(0) === "|" || afterColon.charAt(0) === ">") {
           // Block scalar header inline with key
-          if (!/^[|>][-+]?[0-9]?\s*$/.test(afterColon)) {
+          if (!_isBlockScalarHeader(afterColon, false)) {
             throw new SafeYamlError("malformed block scalar header",
               "yaml/bad-block-scalar", ln.lineNumber, ln.indent + 1);
           }
@@ -506,7 +683,8 @@ function parse(input, opts) {
       // branch below) using _parseFlowValue's end position, then return the value
       // via the direct parser so the shape is identical to the pre-existing path.
       var fend = _parseFlowValue(t, 0, lineNumber, col, 0).nextPos;
-      var afterFlow = t.slice(fend).replace(/^\s+/, "");
+      var afterFlow = codepointClass.trimRanges(
+        t.slice(fend), codepointClass.WHITESPACE_RANGES, { trailing: false });
       if (afterFlow.length > 0 && afterFlow.charAt(0) !== "#") {
         throw new SafeYamlError("unexpected content after flow collection",
           "yaml/trailing-content", lineNumber, col);
@@ -517,7 +695,8 @@ function parse(input, opts) {
     if (t.charAt(0) === '"') {
       var dq = _decodeDoubleQuoted(t, lineNumber, col);
       var afterDq = _trailingAfterQuoted(t, '"');
-      if (afterDq.length > 0 && afterDq.replace(/^\s+/, "") !== "") {
+      if (afterDq.length > 0 &&
+          codepointClass.trimRanges(afterDq, codepointClass.WHITESPACE_RANGES, { trailing: false }) !== "") {
         throw new SafeYamlError("unexpected content after quoted string",
           "yaml/trailing-content", lineNumber, col);
       }
@@ -759,7 +938,7 @@ function parse(input, opts) {
           }
           case "U": {
             var hex8 = raw.substring(i + 2, i + 10);
-            if (!/^[0-9a-fA-F]{8}$/.test(hex8)) {
+            if (hex8.length !== 8 || !codepointClass.isRunOf(hex8, codepointClass.ASCII_HEX)) {
               throw new SafeYamlError("bad \\U escape", "yaml/bad-escape", lineNumber, col + i);
             }
             var code = parseInt(hex8, RADIX_HEX);
@@ -904,7 +1083,7 @@ function parse(input, opts) {
 
     if (chomp === "-") {
       // strip — remove trailing newline(s)
-      body = body.replace(/\n+$/, "");
+      body = codepointClass.trimRanges(body, [0x0A], { leading: false });
     } else if (chomp === "+") {
       // keep — restore trailing blanks we popped
       body += "\n".repeat(trailingBlanks);
@@ -1026,14 +1205,12 @@ function _preValidate(input) {
   //   (or start of value position). A simple heuristic: any unescaped `&`
   //   that's followed by an identifier char and is preceded by space or
   //   line start is an anchor. Same for `*`.
-  var anchorOrAliasRe = /(^|\s)([&*])([A-Za-z0-9_][A-Za-z0-9_-]*)/;
-  var m = safe.match(anchorOrAliasRe);
+  var m = _findAnchorOrAlias(safe);
   if (m) {
-    var posIdx = safe.indexOf(m[0]);
-    var lineCount = safe.substring(0, posIdx).split("\n").length;
+    var lineCount = safe.substring(0, m.index).split("\n").length;
     throw new SafeYamlError(
-      m[2] === "&" ? "anchors are not supported" : "aliases are not supported",
-      m[2] === "&" ? "yaml/anchors-banned" : "yaml/aliases-banned",
+      m.sigil === "&" ? "anchors are not supported" : "aliases are not supported",
+      m.sigil === "&" ? "yaml/anchors-banned" : "yaml/aliases-banned",
       lineCount, 1
     );
   }
@@ -1041,21 +1218,17 @@ function _preValidate(input) {
   // Tags: `!` at start of value or after `: ` / `- `. False-positive risk:
   //   "key: !something" vs "key: ![bracket". We match `!` followed by
   //   alphanumeric or `<`.
-  var tagRe = /(^|[\s-])(!{1,2}[A-Za-z<])/;
-  var mt = safe.match(tagRe);
+  var mt = _findTag(safe);
   if (mt) {
-    var tagIdx = safe.indexOf(mt[0]);
-    var tagLine = safe.substring(0, tagIdx).split("\n").length;
+    var tagLine = safe.substring(0, mt.index).split("\n").length;
     throw new SafeYamlError("tags are not supported",
       "yaml/tags-banned", tagLine, 1);
   }
 
   // Directives: `%YAML` or `%TAG` at column 0
-  var dirRe = /(^|\n)%(YAML|TAG)\b/;
-  var md = safe.match(dirRe);
+  var md = _findDirective(safe);
   if (md) {
-    var dirIdx = safe.indexOf(md[0]);
-    var dirLine = safe.substring(0, dirIdx).split("\n").length + (md[1] === "\n" ? 1 : 0);
+    var dirLine = safe.substring(0, md.index).split("\n").length + (md.precededByNewline ? 1 : 0);
     throw new SafeYamlError("directives are not supported",
       "yaml/directives-banned", dirLine, 1);
   }

package/lib/safe-json.js

@@ -837,6 +837,12 @@ function _patternMatcher(pattern) {
       // branch twice. That is the overlap the alternation rule exists to
       // catch, so `/^(?=(a|A)+$)a+$/i` would pass a source-only screen and
       // then run, under those flags, against a value from the wire.
+      // Compiled precisely so assertSafe can screen the COMPILED form, per the
+      // comment above: a source-only screen misreads `(a|A)+` under `i`. The
+      // pattern here is the operator's schema `pattern` keyword — the input
+      // being validated rather than the implementation of a screen — and it is
+      // refused before it ever runs against a value.
+      // eslint-disable-next-line blamejs/no-regex-in-content-safety
       var native = new RegExp(source, flags);
       // assertSafe builds `new ErrorClass(code, message)`; SafeJsonError takes
       // them the other way round, so the screen reports through its own error.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.36",
+  "version": "0.18.38",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f384e0aa-ad27-4c4f-a0b0-eceb0cac068e",
+  "serialNumber": "urn:uuid:3e525c66-4a72-4004-90a2-8985bbb5daa4",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-18T23:20:05.652Z",
+    "timestamp": "2026-08-19T06:46:25.351Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.36",
+      "bom-ref": "@blamejs/core@0.18.38",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.36",
+      "version": "0.18.38",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.36",
+      "purl": "pkg:npm/%40blamejs/core@0.18.38",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.36",
+      "ref": "@blamejs/core@0.18.38",
       "dependsOn": []
     }
   ]