@blamejs/core 0.18.51 → 0.18.53

package/CHANGELOG.md

@@ -8,6 +8,73 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.53 (2026-08-24) — **The YAML screens refused ordinary documents: a list of records, and an exclamation mark in a sentence.** `b.guardYaml.parse` refused any sequence whose items carry more than one key, which is the shape of nearly every list of records anyone writes. Separately, both `b.guardYaml` and `b.parsers.yaml` decided whether a `!`, `&` or `*` opened a tag, anchor or alias by looking at the character in front of it, so they reported one inside a quoted string, inside a block scalar's shell script, in the middle of a value, and inside a comment. `x: 1 # note !bang` was refused. Both screens now read the document's structure, through one scanner shared by the two modules. **Fixed:** *`b.guardYaml` no longer reports a duplicate key for a list of records* — Key uniqueness was tracked per indentation level, and a sequence-item line never reset that tracking. The second item's keys were therefore checked against the first item's, so every key except the one written inline with the dash was reported as a duplicate:
+
+```yaml
+steps:
+  - name: build
+    run: make
+  - name: test
+    run: make check
+```
+
+That document was refused with `duplicate key "run"`, and it has no duplicate key in it. Under `duplicateKeyPolicy: "reject"` — the strict profile's default — the parse threw.
+
+Each item of a sequence is now its own mapping, so a key may appear once per item. Two things that were already true stay true, and both are pinned by tests: a key repeated *within* one item is still a duplicate, and so is a key repeated in an ordinary mapping.
+
+The key written inline with the dash was being skipped entirely rather than tracked, so `- name: a` followed by `name: b` inside the same item went unreported. It is now tracked with the rest of its mapping. · *A tag, anchor or alias is recognised where it can actually appear* — `!`, `&` and `*` introduce a tag, an anchor and an alias only at a node start. Both YAML screens decided the question by looking at the preceding character — whitespace meant a sigil, anything else meant not — and that rule cannot tell a node start from the middle of a scalar. Every one of these was refused:
+
+```yaml
+x: "hello !world"      # a bang in a quoted string
+x: hello !world        # a bang in the middle of a value
+x: 1 # note !bang      # a bang in a comment
+x: |
+  echo !boom           # a bang in a shell script
+text: fish &chips      # an ampersand in prose
+```
+
+The two modules had separate implementations of the check and separate gaps. `b.parsers.yaml` masked quoted strings but copied comment text through verbatim and had no block-scalar handling, despite a note in it saying both were covered; `b.guardYaml` had none of the three. So a document refused by one was sometimes accepted by the other.
+
+Both now use one scanner that tracks where each character sits: inside a quoted scalar, a comment, a block-scalar body, a plain scalar, or in the structure. A sigil is reported only where it opens a node. Scalars that run across several lines are followed rather than read afresh, so neither the continuation of a quoted string nor of an unquoted value is mistaken for structure, and a `!` after the closing quote or the ending comma still is one.
+
+**What this changes for a document you already have:** a sigil inside a plain scalar is no longer reported. `text: this &notanchor` and `x: -&a` used to raise an anchor finding and no longer do. Neither declares an anchor — an anchor is a separate token — so nothing can reference it, and the amplification these findings exist to stop has no path through them. A merge key written without spaces, `<<:*d`, is still refused, by the merge-key screen rather than the alias one.
+
+`b.parsers.yaml` continues to refuse every real tag, anchor, alias and directive, and the strict profile of `b.guardYaml` continues to report them. · *The residency gate's raw-SQL timing check no longer depends on how busy the machine is* — The check that a padded raw `UPDATE` costs no extra parse time compared the padded call against an unpadded one and allowed 500ms between them. A difference of two timings carries the noise of both, and on a loaded runner the padded sample alone drifted past that allowance while the statement itself parses in a fraction of a millisecond.
+
+It now bounds the padded call on its own, and takes the fastest of fifteen samples rather than three. The defect it guards cost roughly seven seconds against 0.04ms once fixed, so the ceiling sits between the two behaviours with several orders of magnitude to spare rather than tracking the machine. The unpadded baseline is still measured and still printed, because a reader looking at a failure needs to know whether the box was slow or the parse was.
+
+- v0.18.52 (2026-08-23) — **A refusal that would not say why, and a currency gate that skipped the one pin able to move underneath it.** `b.guardFilename` refuses a filename carrying NTFS alternate-data-stream syntax whatever `adsPolicy` says, which is correct and was documented, but the refusal never mentioned the option — so a caller who set `"allow"` was left comparing their code against a message that said nothing about the setting they had changed. Separately, the pinned-actions currency gate could only see a `uses:` pinned to a commit SHA, so the one workflow reference pinned to a tag was absent from every run rather than reported, and its `--json` output had a human summary line after the document, so nothing could parse it. **Fixed:** *The NTFS-ADS refusal now says where `adsPolicy: "allow"` applies* — A filename carrying alternate-data-stream syntax (`report.txt:stream`) is refused by `b.guardFilename.sanitize`, `validate` and `gate` regardless of `adsPolicy`. That is deliberate: on Windows the write lands on a hidden stream of the base file rather than on a file anyone can see, so it is one of the shapes a filename guard always refuses. `adsPolicy` still takes `"allow"` because `verifyExtractionPath` honours it, for an operator deliberately extracting stream-suffixed entries into a root they chose.
+
+What was missing is that none of this was visible from the call site. The refusal said only that the name contained stream syntax, so setting `"allow"` and watching nothing change read as the option being broken rather than as it being scoped. The message now names the boundary, and the split is pinned by tests at all four entry points.
+
+One thing worth knowing if you go looking: a colon is also a Windows reserved character, so `reservedCharPolicy` refuses such a name before the ADS check is reached. Setting `adsPolicy` alone never changes the outcome for a name like `12:30 notes.txt` — `reservedCharPolicy` is the one governing it, and `"strip"` there yields `12_30 notes.txt`.
+
+This also records a change that shipped in 0.18.48 without being written down: before it, `sanitize` honoured `adsPolicy: "reject"` and so could be opted out of. It no longer can be, and there is no replacement value, because a stream-suffixed name has no safe repair. · *The pinned-actions currency gate could not see a tag-pinned workflow* — `check-actions-currency.js` matched a `uses:` line only when it was pinned to a 40-character commit SHA. A reference pinned to anything else matched nothing, was collected by nothing, and appeared in the run as neither current nor stale — absent, while the summary counted what it had looked at and read as a clean result.
+
+The pin that fell through is the one least able to look after itself. A commit SHA is immutable, so a stale SHA pin becomes visible as soon as upstream cuts a release; a tag can be repointed at new code with no local diff at all. The single reference here pinned to a tag is pinned that way by necessity, because the SLSA provenance generator refuses to run from a commit SHA — so the one exception to the pinning discipline was also the one thing never checked.
+
+Tag pins are now collected, version-checked like any other, and reported as tag pins. `--fix` deliberately leaves them alone and says so: there is no old SHA to compare against and none to write, and the review material `--fix` prints is a diff between two SHAs, which is exactly what a tag cannot give.
+
+An action can also be pinned by SHA in one workflow and by tag in another, and the two need different answers in different places. The pin type is therefore tracked per reference: the ready-to-paste replacement line is printed only where a SHA reference can take it, each tag reference is marked as one, and `--fix` skips such an action entirely rather than bumping the references that were already current and leaving the stale one behind.
+
+The cause of the gap is worth naming because it repeated one level down: the first pattern written to catch these anchored the version at end-of-line, and the line in question carries a trailing comment explaining why it is not SHA-pinned. It matched nothing either.
+
+So the gate no longer relies on recognising every shape. It reads the `uses:` scalar first, quoting and all, then classifies what it found; a reference it cannot classify is listed and **fails the run** rather than dropping out of the report. That covers quoted values (`uses: "owner/repo@v1"`), version tags carrying a prerelease or build suffix (`@v2.1.0-rc.1`), a SHA pin whose `# vX.Y.Z` comment is missing, and a reference pinned to a branch. Local actions (`./…`) and `docker://` images are skipped deliberately, because neither has an upstream release to compare against, and the body of a `run: |` block is skipped because those lines are script rather than YAML.
+
+Two consequences of reading more shapes are worth calling out. Version comparison now follows semver precedence for prerelease identifiers, so `rc.1` is older than `rc.2` and older than `rc.10`, and a release candidate left pinned after the final release ships reports stale rather than current. And `--fix` now verifies that each rewrite actually landed: it reaches through a closing quote to replace a quoted pin, and if a collected reference does not match the replacement it says so and exits non-zero instead of reporting the action fixed over an unchanged file.
+
+The pattern matching is gone. Whether a `uses` token is a key is a question about YAML structure, and a pattern cannot answer it: every attempt to widen one admitted a shape it read wrongly, and every attempt to narrow one dropped a shape it should have read. The collector now scans, tracking the three things that actually decide it — quoting, comments, and flow-collection depth.
+
+Every form is read as a result: block style, flow mappings whether `uses` is the first key or the fifth, mappings spanning lines, quoted keys (`"uses":`), quoted values, and values inside nested flow collections. And in the other direction, `uses` inside a quoted string, inside a comment, or inside a `run: |` body is text rather than a key, so `- { run: "echo a, uses: owner/repo@main" }` names no action at all. Both block-scalar indicator orders are handled, since `|2-` and `|-2` are equally valid and misreading one scans a shell script as YAML.
+
+Position decides what counts, not the value. A reference is a `uses` under `steps`, or a job's own `uses` for a reusable workflow; anything else spelled `uses` is data. That distinction cannot be made from the value, because `owner/repo@main` is a perfectly ordinary string to put in an `env` block or pass through `with`, and matrix `include` entries carry properties an operator names themselves. Naming the two positions the schema defines is finite; listing every container that is not one is not.
+
+What the scan covers is printed on every run, as a `scope` line in the report and a `scope` field in `--json`. The original defect was a form the gate did not read and did not say so; that is now two separate things it cannot do.
+
+If you run this gate against your own workflows, expect it to fail on references it could previously not see. That is the point of the change; each one it names is a pin whose currency was never being checked. · *`check-actions-currency.js --json` emits only the JSON document* — The JSON branch wrote the document and then fell through into the summary blocks, which wrote to the same stream regardless of the flag. Every `--json` run therefore ended with a `[actions-currency] …` line after the closing brace, and `JSON.parse` on the stream failed with "Unexpected non-whitespace character after JSON". `--fix --json` was the same shape with more trailing text.
+
+Every human-readable line now goes through a writer that is silent under `--json`. Exit codes are unchanged: a machine reader still gets a non-zero exit when something is stale.
+
 - v0.18.51 (2026-08-22) — **Five parsers could be made to spend their time on the thing they were parsing.** Three prompt-injection detectors, the BIMI logo parser and the raw-write data-residency gate each ran a pattern whose cost grew with the square or the cube of its input while an ordinary input of the same length cost a millisecond. A 64 KiB prompt took up to 4.5 seconds to classify; a 32 KiB logo took 409 milliseconds to parse; a 4 KB raw UPDATE took 7 seconds to get a verdict from a gate that accepts statements twenty-four times longer. All five now cost what ordinary input of that length costs, and each was checked against a corpus to confirm it still decides what it decided before. Separately, a verified VMC logo was reported as absent when its SVG began with an XML declaration and a DOCTYPE. **Changed:** *`b.guardFilename` no longer repairs a null byte, and five options that accept one value now say so* — 0.18.47 accepted `nullBytePolicy: "strip"` on `b.guardFilename` and removed the null byte from the name. 0.18.48 stopped accepting it. That removal was correct and was not written down, which is the part being fixed here.
 
 It was correct because a null byte in a filename is a truncation attack, not a typo: the name the check reads and the name the operating system acts on differ at the byte, so repairing it produces a name nobody validated. The guard refuses with `filename.null-byte` and the message has said `null-byte truncation is never sanitizable` throughout. There is no replacement policy value, because there is no safe repair. A caller that was asking for the strip should refuse the input instead, or rename before validating.

package/lib/guard-filename.js

@@ -280,6 +280,19 @@ function _hasUncPrefix(name) {
 
 // An NTFS alternate-data-stream suffix: a colon followed by a run with no
 // further colon and no separator in it, at the very end of the name.
+// One wording for every path that refuses a stream-suffixed name. A caller who
+// set `adsPolicy: "allow"` can arrive at any of them — sanitize in either mode,
+// validate, or gate — and each has to answer the same question, or the option
+// reads as broken from whichever door they happened to use. Saying it in one
+// place and only one is how three of the four ended up silent the first time.
+//
+// `verifyExtractionPath` is deliberately absent: it is the one entry point that
+// HONOURS the option, so it never reaches this text.
+var ADS_SCOPE_NOTE = "always refused here; adsPolicy \"allow\" applies only " +
+  "to verifyExtractionPath";
+var ADS_SNIPPET = "NTFS alternate data stream syntax (name:stream) — " + ADS_SCOPE_NOTE;
+var ADS_MESSAGE = "filename contains " + ADS_SNIPPET;
+
 function _hasAdsSuffix(name) {
   var colon = name.lastIndexOf(":");
   if (colon === -1 || colon === name.length - 1) return false;
@@ -469,7 +482,7 @@ function _detectIssues(input, opts) {
       issues.push({
         kind: "ntfs-ads", severity: "critical",
         ruleId: "filename.ntfs-ads",
-        snippet: "NTFS alternate data stream syntax (name:stream)",
+        snippet: ADS_SNIPPET,
       });
     }
   }
@@ -660,9 +673,18 @@ function _sanitize(input, opts) {
     name = "_" + name;
   }
 
-  // ADS detection.
+  // ADS detection. Not gated on `adsPolicy`, and the message says so: a
+  // stream-suffixed name is one of the shapes a filename guard always refuses,
+  // because on Windows the write lands on a hidden stream of the base file
+  // rather than on a file anyone can see. `adsPolicy` still takes "allow", for
+  // `verifyExtractionPath` alone, where an operator may be deliberately
+  // extracting stream-suffixed entries to a root they chose.
+  //
+  // The scope is in the message because it is invisible from the call site: a
+  // caller who sets "allow" here gets a refusal that, without it, never
+  // mentions the setting they changed and so reads as the option being broken.
   if (_hasAdsSuffix(name)) {
-    throw _err("filename.ntfs-ads", "filename contains NTFS alternate data stream syntax");
+    throw _err("filename.ntfs-ads", ADS_MESSAGE);
   }
 
   // Length cap.
@@ -796,7 +818,7 @@ function _sanitizeStripMode(input, opts) {
     throw _err("filename.unc", "UNC path syntax");
   }
   if (_hasAdsSuffix(name) && name.charAt(0) !== "/") {
-    throw _err("filename.ntfs-ads", "filename contains NTFS alternate data stream syntax");
+    throw _err("filename.ntfs-ads", ADS_MESSAGE);
   }
   if (Buffer.byteLength(name, "utf8") > opts.maxBytes) {
     throw _err("filename.length", "filename exceeds maxBytes " + opts.maxBytes);

package/lib/guard-yaml.js

@@ -68,6 +68,7 @@
  */
 
 var codepointClass = require("./codepoint-class");
+var yamlLex = require("./yaml-lex");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
@@ -95,11 +96,11 @@ var SAFE_CORE_TAGS = Object.freeze([
   "!!binary", "!!timestamp", "!!merge",
 ]);
 
-// Characters that may precede an anchor declaration (`&name`) or an alias
-// reference (`*name`) — the start of the document, whitespace, or one of the
-// structural characters a name can follow.
-var ANCHOR_LEAD_CHARS = ":-";
-var ALIAS_LEAD_CHARS  = ":-[{,";
+// There is no table of characters an anchor or alias is allowed to follow any
+// more. Two of them existed, one per sigil, and each was a guess at YAML's
+// grammar written as a character class: they admitted a sigil in the middle of
+// a plain scalar and excluded the compact flow form `{"a":&anchor v}` that YAML
+// permits. Position is decided once, by the shared lexer's mask.
 
 // The YAML 1.1 boolean-shaped tokens that make an unquoted scalar change type.
 // `true` and `false` are valid YAML 1.2 booleans and are not flagged; these
@@ -119,14 +120,17 @@ function _isSpace(cc) {
 
 // Every `&name` / `*name` in the document, given the sigil and the characters
 // that may precede it. Returns the names, in order.
-function _collectSigilNames(text, sigil, leadChars) {
+// `text` is the MASK, in which a sigil survives only where it opens a node, so
+// there is no test on the preceding character here at all. That judgement used
+// to be a hand-written list of characters a sigil was allowed to follow, kept
+// separately for anchors and for aliases, and it was wrong in both directions:
+// it admitted a `&` in the middle of a plain scalar, and it had no way to allow
+// `{"a":&anchor v}`, where YAML's JSON compatibility lets a quoted key take its
+// colon with no space after it. One scanner decides position now.
+function _collectSigilNames(text, sigil) {
   var out = [];
   for (var i = 0; i < text.length; i += 1) {
     if (text.charAt(i) !== sigil) continue;
-    if (i > 0) {
-      var lead = text.charCodeAt(i - 1);
-      if (!_isSpace(lead) && leadChars.indexOf(text.charAt(i - 1)) === -1) continue;
-    }
     if (!_isNameStart(text.charCodeAt(i + 1))) continue;
     var end = i + 2;
     while (end < text.length && _isNameChar(text.charCodeAt(end))) end += 1;
@@ -325,9 +329,11 @@ function _scanTags(text) {
   var tags = [];
   for (var i = 0; i < text.length; i += 1) {
     if (text.charAt(i) !== "!") continue;
-    var atStart = i === 0 ||
-                  codepointClass.inRanges(text.charCodeAt(i - 1), codepointClass.WHITESPACE_RANGES);
-    if (!atStart) continue;
+    // No "preceded by whitespace" test. That WAS the original defect, and once
+    // the mask decides position it is not merely redundant but harmful: in
+    // `{"a":!!python/object x}` the character before the tag is the colon of a
+    // JSON-style key, so the test skipped it and a deserialization tag reached
+    // both screens unreported. Position is the mask's question now.
     var nameAt = text.charAt(i + 1) === "!" ? i + 2 : i + 1;
     if (!codepointClass.isAsciiLetter(text.charCodeAt(nameAt))) continue;
     var end = nameAt + 1;
@@ -354,8 +360,22 @@ function _detectIssues(input, opts) {
   if (pre.done) return pre.issues;
   var issues = pre.issues;
 
+  // Sigil scans run against the MASK, not the source. A `!`, `&` or `*` means
+  // what it looks like only at a node start, and the previous rule — "after
+  // whitespace" — cannot tell a node start from the middle of a scalar. It
+  // reported a tag for the bang in a comment, in a quoted string, in a block
+  // scalar's shell script, and in ordinary prose: `x: 1 # note !bang` was
+  // refused. The mask is index-aligned with the source and the same length, so
+  // every location and line number reported below is still the source's.
+  //
+  // Only the three sigil scans use it. The value-shaped detectors further down
+  // (the Norway problem, leading zeros, merge keys) are asking about scalar
+  // CONTENT, which is exactly what the mask removes, so they keep reading the
+  // source.
+  var masked = yamlLex.maskNonStructural(input);
+
   // 1. Tag-injection scan.
-  var tagHits = _scanTags(input);
+  var tagHits = _scanTags(masked);
   for (var ti = 0; ti < tagHits.length; ti += 1) {
     var t = tagHits[ti];
     if (t.kind === "dangerous") {
@@ -392,8 +412,8 @@ function _detectIssues(input, opts) {
   }
 
   // 2. Anchor / alias recursion scan.
-  var anchors = _collectSigilNames(input, "&", ANCHOR_LEAD_CHARS);
-  var aliases = _collectSigilNames(input, "*", ALIAS_LEAD_CHARS);
+  var anchors = _collectSigilNames(masked, "&");
+  var aliases = _collectSigilNames(masked, "*");
   if (anchors.length > opts.maxAnchors) {
     issues.push({
       kind: "anchor-cap", severity: "high",
@@ -531,6 +551,24 @@ function _mappingEntryAt(line) {
   return null;
 }
 
+// The column the line's content starts in.
+function _indentOfLine(line) {
+  var i = 0;
+  while (i < line.length && _isSpace(line.charCodeAt(i))) i += 1;
+  return i;
+}
+
+// The indent of a sequence dash opening this line, or -1 when the line does not
+// open a sequence item. A dash counts only when it stands alone as a token: `-`
+// at end of line, or followed by a space. `-quux` and `-1` are scalars.
+function _sequenceDashIndent(line) {
+  var i = 0;
+  while (i < line.length && _isSpace(line.charCodeAt(i))) i += 1;
+  if (i >= line.length || line.charAt(i) !== "-") return -1;
+  if (i + 1 < line.length && !_isSpace(line.charCodeAt(i + 1))) return -1;
+  return i;
+}
+
 // Is the line blank, or a comment?
 function _isCommentLine(line) {
   var i = 0;
@@ -544,19 +582,117 @@ function _detectDuplicateKeysYaml(text) {
   var dups = Object.create(null);
   var lines = _splitLines(text);
   var indentScopes = Object.create(null);
+  // The sequence items currently open, outermost first, each with the column
+  // its first key sat in. Every key of an item at its top level is filed under
+  // one scope whatever column it is written in, because it is one mapping.
+  //
+  // A STACK, because sequences nest. Holding the innermost item in a pair of
+  // variables let a nested sequence overwrite its parent's scope and never give
+  // it back, so a key repeated in the OUTER item after the nested one closed
+  // was filed somewhere else and went unreported:
+  //
+  //     - a: 1
+  //       inner:
+  //         - x: 1
+  //       a: 2      <- a duplicate of the first `a`, and it was missed
+  //
+  // The same shape as the defect this detector reports, one level up: a single
+  // slot standing in for something there can be several of.
+  var itemStack = [];
   for (var i = 0; i < lines.length; i += 1) {
     var line = lines[i];
     if (line.length === 0 || _isCommentLine(line)) continue;
+    // A sequence item OPENS A NEW MAPPING, so it ends the previous item's and
+    // everything nested inside it. That is decided from the DASH, before
+    // anything else, because a line may be a sequence item and carry no mapping
+    // entry of its own:
+    //
+    //     steps:
+    //       -
+    //         p: 1
+    //       -
+    //         p: 2
+    //
+    // A dash alone has no `key: value` on it, so a reset that waited for one
+    // never ran and the second item's `p` was still read as a duplicate of the
+    // first's. The boundary is the dash; whether the item writes its first key
+    // beside it or underneath it is a matter of layout.
+    var dashAt = _sequenceDashIndent(line);
+    // An item is over once the document comes back out to its dash's column or
+    // further left. That is true of the next item's own dash as much as of a
+    // key belonging to the enclosing mapping, so it is measured here, before
+    // this line is classified at all.
+    var lineIndent = dashAt >= 0 ? dashAt : _indentOfLine(line);
+    while (itemStack.length &&
+           itemStack[itemStack.length - 1].dash >= lineIndent) itemStack.pop();
+    if (dashAt >= 0) {
+      Object.keys(indentScopes).forEach(function (k) {
+        if (Number(k) > dashAt) delete indentScopes[k];
+      });
+      // keyIndent is set by this item's first key, wherever it is written.
+      itemStack.push({ dash: dashAt, keyIndent: -1 });
+    }
     var entry = _mappingEntryAt(line);
     if (!entry) continue;
     var indent = entry.indent;
     var key = entry.key.trim();
-    if (key.charAt(0) === "-" || key.charAt(0) === "[" || key.charAt(0) === "{") continue;
-    if (!indentScopes[indent]) indentScopes[indent] = Object.create(null);
-    if (indentScopes[indent][key]) dups[key] = true;
-    else indentScopes[indent][key] = true;
+    if (key.charAt(0) === "[" || key.charAt(0) === "{") continue;
+    // The key written INLINE with the dash belongs to the item's mapping, and
+    // sits at the indent AFTER the dash and its space — so that is the scope it
+    // is registered in, alongside the keys written underneath it. It used to be
+    // skipped entirely, which meant repeating it went unreported.
+    var dash = key.charAt(0) === "-" &&
+               (key.length === 1 || _isSpace(key.charCodeAt(1)));
+    var scopeAt = indent;
+    if (dash) {
+      var after = 1;
+      while (after < key.length && _isSpace(key.charCodeAt(after))) after += 1;
+      key = key.slice(after).trim();
+      // `- ` alone, or `- - x`: no inline key of this item's own to register.
+      if (!key || key.charAt(0) === "-" || key.charAt(0) === "[" ||
+          key.charAt(0) === "{") continue;
+      scopeAt = indent + after;
+    }
+    // The item's mapping is ONE mapping however its keys are laid out, so the
+    // scope it is tracked under must not depend on spacing. `-   a: 1` puts its
+    // inline key at column 4 while the key written under it sits at column 2,
+    // and keying on the raw column filed them separately — so a repeat across
+    // those two lines went unreported, which is exactly the smuggling shape
+    // this detector exists for (one parser reads two keys, another reads one).
+    //
+    // The item's top level is every key deeper than the dash and no deeper than
+    // the first key it saw. Anything past that is genuinely nested and keeps
+    // its own column, so `- a: 1` / `  b:` / `    a: 2` is still not a
+    // duplicate.
+    // Half a column past the dash: a number, so the pruning comparisons below
+    // and at the dash keep working unchanged, and one that sorts between the
+    // dash and anything nested inside the item.
+    var item = itemStack.length ? itemStack[itemStack.length - 1] : null;
+    if (item && scopeAt > item.dash) {
+      // The item's top level is every key no deeper than the SHALLOWEST key it
+      // has shown, and the bound moves down as shallower ones appear. Two
+      // failures pinned this from opposite sides:
+      //
+      //   -   a: 1        the inline key sits at column 4 because of the extra
+      //     b:            spacing, but the item's mapping is written at 2. If
+      //       a: 2        4 is taken as the bound, the NESTED `a` at 4 counts
+      //                   as top level and reads as a duplicate.
+      //
+      //   - a:            here the inline key IS the bound, at 2. If it sets
+      //       x: 1        nothing, the first nested key at 4 becomes the bound
+      //       a: 2        and the nested `a` reads as a duplicate instead.
+      //
+      // So the inline key establishes the bound and a later, shallower key
+      // lowers it. Extra spacing after the indicator is presentation; the
+      // shallowest key is the structure.
+      if (item.keyIndent === -1 || scopeAt < item.keyIndent) item.keyIndent = scopeAt;
+      if (scopeAt <= item.keyIndent) scopeAt = item.dash + 0.5;
+    }
+    if (!indentScopes[scopeAt]) indentScopes[scopeAt] = Object.create(null);
+    if (indentScopes[scopeAt][key]) dups[key] = true;
+    else indentScopes[scopeAt][key] = true;
     Object.keys(indentScopes).forEach(function (k) {
-      if (Number(k) > indent) delete indentScopes[k];
+      if (Number(k) > scopeAt) delete indentScopes[k];
     });
   }
   return Object.keys(dups);

package/lib/parsers/safe-yaml.js

@@ -60,6 +60,7 @@ var boundedMap = require("../bounded-map");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var codepointClass = require("../codepoint-class");
+var yamlLex = require("../yaml-lex");
 var { FrameworkError } = require("../framework-error");
 
 class SafeYamlError extends FrameworkError {
@@ -227,7 +228,10 @@ function _findAnchorOrAlias(text) {
     var ch = text.charAt(i);
     if (ch !== "&" && ch !== "*") continue;
     var atStart = i === 0;
-    if (!atStart && !_isWhitespaceChar(text.charAt(i - 1))) continue;
+    // No test on the preceding character: `text` is the shared mask, in which a
+    // sigil survives only where it opens a node. The whitespace test was the
+    // original defect and it also had no way to admit `{"a":&anchor v}`, where
+    // a quoted key takes its colon with no space after it.
     if (_NAME_HEAD.indexOf(text.charAt(i + 1)) === -1 || text.charAt(i + 1) === "") continue;
     return { index: atStart ? i : i - 1, sigil: ch };
   }
@@ -239,8 +243,10 @@ function _findTag(text) {
   for (var i = 0; i < text.length; i += 1) {
     if (text.charAt(i) !== "!") continue;
     var atStart = i === 0;
-    var before = text.charAt(i - 1);
-    if (!atStart && !(before === "-" || _isWhitespaceChar(before))) continue;
+    // Same as above: position is the mask's judgement. Requiring whitespace or
+    // a dash before the tag let `{"a":!!python/object x}` through, because the
+    // character in front of it is the colon of a JSON-style key — and a
+    // deserialization tag is the one thing this ban exists for.
     // The pattern is greedy, so it takes two `!` when both are present.
     var after = text.charAt(i + 1) === "!" ? text.charAt(i + 2) : text.charAt(i + 1);
     if (after.length !== 1) continue;
@@ -1194,6 +1200,21 @@ function _preValidate(input) {
     advance();
   }
 
+  // The masking above is kept for ONE thing: it is the scan that notices an
+  // unterminated quote, and that diagnosis is this parser's to give. What it
+  // produced was not a usable screen. Its own header promised that block-scalar
+  // bodies were masked and there was no block-scalar handling in it at all, and
+  // comment text was copied through verbatim under a comment saying so — which
+  // is why `x: 1 # note !bang` and `x: |` / `  echo !boom` were both refused as
+  // tags. A plain scalar was not understood either, so `x: hello !world` was
+  // refused for a bang sitting in the middle of a value.
+  //
+  // The banned-construct scan therefore runs against the shared lexer's mask.
+  // `guard-yaml` had the same three gaps in a separate implementation, and one
+  // scan answering "which region is this character in" is what stops the two
+  // drifting apart again.
+  safe = yamlLex.maskNonStructural(input);
+
   // Now scan `safe` for banned constructs.
   // Banned tokens (must be at line-start or after whitespace, not in keys):
   //   &name      anchor

package/lib/yaml-lex.js

@@ -0,0 +1,533 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// Where in a YAML document a character actually SITS.
+//
+// Two modules were answering that question separately and getting different
+// wrong answers. `guard-yaml` decided a `!` opened a tag if it followed
+// whitespace, so it reported one inside a quoted scalar, inside a block-scalar
+// body, and inside a comment. `parsers/safe-yaml` masked quoted scalars but
+// passed comment text through verbatim and had no block-scalar handling at all,
+// despite its own note promising both. Between them every ordinary document
+// carrying an exclamation mark in prose was refused, by one module or the other.
+//
+// The question is not "what precedes this character" — it is "what region is
+// this character in", and no amount of looking at the previous byte answers it.
+// Region is a property of everything before, so it takes a scan. This module is
+// that scan, written once, so the two callers cannot drift apart again.
+//
+// `maskNonStructural` returns a string the SAME LENGTH as its input, with every
+// non-structural region replaced by spaces and newlines preserved. Callers keep
+// their existing sigil searches and run them against the mask instead of the
+// source: an index into one is an index into the other, so reported locations
+// and line numbers stay true.
+//
+// What survives the mask, because it is what the callers are looking for:
+// structural punctuation, node properties (`!tag`, `&anchor`, `*alias`),
+// directive lines, and document markers. What is masked is scalar content in
+// every form it takes: quoted, plain, and block.
+//
+// The mask is deliberately readier to KEEP than to hide. Masking something
+// structural is the dangerous direction: it does not refuse a good document, it
+// hides a real tag inside a bad one and hands the callers something they then
+// call clean. Every case below that looked like a tidy simplification and was
+// not — blanking the rest of a line, measuring a block body from the wrong
+// column — failed in exactly that direction.
+
+// No line-splitting helper is used here on purpose: `codepointClass.splitLines`
+// strips the carriage return of a CRLF pair, and this function's whole contract
+// is that its output is the same length as its input. See the split below.
+
+// Deliberately not a regex, in either sense. The guard and safe families forbid
+// them, and a scanner is what this file exists to be.
+function _isSpace(code) { return code === 0x20 || code === 0x09; }
+
+function _isPlainSpace(ch) { return ch === " " || ch === "\t"; }
+
+// A node property is a tag, an anchor, or an alias. They chain, so `!tag &a`
+// and `&a !tag` are both a single node's properties and the scalar begins after
+// the last of them.
+function _isPropertySigil(ch) { return ch === "!" || ch === "&" || ch === "*"; }
+
+// A block-scalar header is `|` or `>`, optionally followed by the chomping and
+// indentation indicators in EITHER order (`|2-` and `|-2` are equally valid),
+// and then nothing but whitespace or a comment. Misreading one scans a shell
+// script as if it were YAML.
+// Returns `{ end, declared }` or null. `declared` is the indentation indicator's
+// digit when the header carries one, or 0. That digit is not decoration: it
+// DECLARES the body's indentation relative to the parent node, so a body whose
+// first line happens to be indented further does not move it. Detecting from
+// the first line in that case ends the block early and hands the rest of a
+// scalar to the structural scan.
+function _blockHeaderEnd(line, at) {
+  var ch = line.charAt(at);
+  if (ch !== "|" && ch !== ">") return null;
+  var i = at + 1;
+  var declared = 0, sawChomp = false;
+  while (i < line.length) {
+    var c = line.charAt(i);
+    if (c >= "1" && c <= "9" && !declared) { declared = Number(c); i += 1; continue; }
+    if ((c === "-" || c === "+") && !sawChomp) { sawChomp = true; i += 1; continue; }
+    break;
+  }
+  // Only a header if the rest of the line is blank or a comment; `x: |foo` is
+  // an ordinary plain scalar that happens to start with a bar.
+  var j = i;
+  while (j < line.length && _isPlainSpace(line.charAt(j))) j += 1;
+  if (j < line.length && line.charAt(j) !== "#") return null;
+  return { end: i, declared: declared };
+}
+
+// The document markers and directive lines a caller still needs to see. A
+// directive is only a directive at column zero, and `---` / `...` only at the
+// start of a line.
+function _isVerbatimLine(line, indent) {
+  if (line.charAt(0) === "%") return true;
+  // Column ZERO only. YAML puts document markers there and nowhere else, so an
+  // indented `---` is scalar content — `- hello` / `  ---` / `  !world` is one
+  // plain scalar. Matching it wherever it appeared ended the document, threw
+  // away the scalar state, and left the continuation to be read as structure.
+  if (indent !== 0) return false;
+  if (line.indexOf("---") === 0 &&
+      (line.length === 3 || _isPlainSpace(line.charAt(3)))) return true;
+  if (line.indexOf("...") === 0 &&
+      (line.length === 3 || _isPlainSpace(line.charAt(3)))) return true;
+  return false;
+}
+
+function maskNonStructural(text) {
+  var src = String(text == null ? "" : text);
+  // Split on the newline ALONE, keeping any `\r` with the line it terminates.
+  // `codepointClass.splitLines` strips it, and rejoining those with "\n" drops
+  // one character per CRLF line — which would shift every index after the first
+  // such line and silently break the alignment this whole function exists to
+  // provide. A mask that is not the same length as its source is worse than no
+  // mask, because the locations it reports are confidently wrong.
+  var lines = src.split("\n");
+  var out = [];
+  // A block scalar's body indentation is DETECTED from its first content line,
+  // which is what YAML specifies and the only thing that works. Two fixed
+  // columns were tried and each failed the other's case: measuring from the
+  // key's column masks nothing when extra spacing after a dash puts the body in
+  // that same column, and measuring from a canonical column swallows a sibling
+  // key written between the two. With extra spacing the body can sit anywhere
+  // past the dash, so only the body itself says where it starts.
+  //
+  // `blockOwner` is the column the body must beat for the block to have one at
+  // all; `blockBody` is the detected indentation, -1 until the first content
+  // line sets it. Both -1 when no block is open.
+  var blockOwner = -1;
+  var blockBody  = -1;
+  // A quoted scalar may span lines, so the quote that opened one carries across
+  // until it closes. Scanning each line independently would read the
+  // CONTINUATION as structure, which puts back the exact false positive this
+  // module exists to remove: `x: "hello` / `  !world"` would name a tag on the
+  // second line.
+  var openQuote = null;
+  // A flow collection may also span lines, so its depth carries across too. It
+  // decides where a plain scalar ends, and resetting it per line would end one
+  // at the wrong place inside a multi-line `[ ... ]`.
+  var flowDepth = 0;
+  // A PLAIN scalar spans lines as well — that is how a long description gets
+  // written without quotes — and its continuation lines are indented further
+  // than the node that opened it. Reading one as a fresh line puts the false
+  // positive back a fourth way: in
+  //
+  //     x: hello
+  //       !world
+  //
+  // the value is `hello !world` and the bang introduces nothing.
+  //
+  // -1 when no plain scalar is open. Otherwise the indent of the node that
+  // opened it, which a continuation must beat. This is set ONLY when a line
+  // actually read plain-scalar content, so `x:` with its value underneath does
+  // not arm it and a nested mapping is still read as structure.
+  var plainOpen = -1;
+  // ...and whether that scalar is a sequence item's own, which decides whether
+  // a continuation at the SAME column counts.
+  var plainFromDash = false;
+
+  for (var li = 0; li < lines.length; li += 1) {
+    var raw = lines[li];
+    // The carriage return of a CRLF pair is a line TERMINATOR, not content, so
+    // it is held aside and put back verbatim. Letting it into the scan would
+    // have it read as the first character of a plain scalar and masked to a
+    // space, which changes the bytes of a document the mask is meant to mirror.
+    var cr = raw.length && raw.charAt(raw.length - 1) === "\r";
+    var line = cr ? raw.slice(0, raw.length - 1) : raw;
+    var indent = 0;
+    while (indent < line.length && _isSpace(line.charCodeAt(indent))) indent += 1;
+    var blank = indent === line.length;
+
+    // A quoted scalar carried over from an earlier line owns this one until it
+    // closes, and nothing before that point is structure — not a `---` that
+    // looks like a document marker, and not a `%` in column zero that looks
+    // like a directive. So this is answered before either of those.
+    //
+    // What follows the closing quote on that line IS structure again, and the
+    // scan resumes there rather than blanking it. Blanking hid a real tag: in
+    // `x: ["first` / ` second", !tag value]` the comma and the tag after the
+    // scalar belong to the collection, and masking them takes a tagged document
+    // and hands both screens something they call clean.
+    var resumeAt = -1;
+    var resumePrefix = "";
+    if (openQuote !== null) {
+      var cont = _maskQuotedBody(line, 0, openQuote);
+      if (!cont.closed) {
+        out.push(cont.masked + (cr ? "\r" : ""));
+        continue;                                   // the whole line is body
+      }
+      openQuote = null;
+      resumeAt = cont.end;
+      resumePrefix = cont.masked;
+    }
+
+    if (resumeAt === -1) {
+      if (blockOwner >= 0) {
+        if (blank) { out.push(_blanked(line) + (cr ? "\r" : "")); continue; }
+        if (blockBody === -1) {
+          // The first content line sets the body's indentation — provided it is
+          // past the owner at all. If it is not, the block has an empty body and
+          // this line is structure.
+          if (indent > blockOwner) {
+            blockBody = indent;
+            out.push(_blanked(line) + (cr ? "\r" : ""));
+            continue;
+          }
+          blockOwner = -1;
+        } else if (indent >= blockBody) {
+          out.push(_blanked(line) + (cr ? "\r" : ""));
+          continue;
+        } else {
+          blockOwner = -1;
+          blockBody  = -1;                          // the body ended here
+        }
+      }
+      if (blank) { out.push(raw); continue; }
+      // A directive or a document marker is structure the callers still need to
+      // see, but only the marker itself is. A comment may follow one on the same
+      // line, and its text is no more YAML there than anywhere else — passing
+      // the whole line through left `--- # note !bang` naming a tag, which is
+      // the very class this module removes, surviving in the one branch that
+      // skipped the scan.
+      if (_isVerbatimLine(line, indent)) {
+        out.push(_maskTrailingComment(line) + (cr ? "\r" : ""));
+        // A document marker ends the document, so EVERY piece of carried state
+        // ends with it. Resetting only the flow depth left a scalar open across
+        // the boundary, and with the sequence-item rule that meant
+        // `- hello` / `---` / `  !tag v` read the new document's first line as
+        // a continuation of the old document's last item — masking a real tag.
+        // A marker is the one place where "carry this across lines" is always
+        // wrong, so the reset is total rather than itemised.
+        flowDepth = 0;
+        plainOpen = -1;
+        plainFromDash = false;
+        blockOwner = -1;
+        blockBody = -1;
+        continue;
+      }
+    }
+
+    // Resuming after a closed continuation starts where the quote ended, with
+    // that scalar already behind us; otherwise the line's own content begins.
+    var masked = resumeAt === -1 ? line.slice(0, indent) : resumePrefix;
+    var i = resumeAt === -1 ? indent : resumeAt;
+    // A node may begin here: at the start of the line's content, and again
+    // after every structural token that introduces one.
+    //
+    // Two things mean it does NOT begin here. A resumed line has just finished
+    // reading a quoted scalar. And a line continuing a PLAIN scalar opened
+    // earlier is more of that scalar, so its first character is content:
+    //
+    //     x: hello
+    //       !world
+    //
+    // The continuation is scanned rather than blanked, because inside a flow
+    // collection it may still end at a `,` or a `]` that belongs to the
+    // collection — `x: [hello` / `  !world]` closes a sequence on its second
+    // line. Closing the node position is enough to make the leading sigil fall
+    // into the plain-scalar branch, and it costs no special case.
+    // A scalar that IS a sequence item has its continuation aligned with the
+    // item's content column rather than deeper than it — `- hello` then
+    // `  !world` is the scalar `hello !world`, and both sit at column 2. So
+    // equality continues that one, while a mapping entry's value still needs a
+    // strictly deeper line, where equality would be a sibling key.
+    var continuesPlain = resumeAt === -1 && plainOpen >= 0 && !blank &&
+                         (plainFromDash ? indent >= plainOpen : indent > plainOpen);
+    var atNodeStart = resumeAt === -1 && !continuesPlain;
+    // Where the NODE on this line begins, which is the line's indent until a
+    // sequence dash moves it along. A block scalar's body is measured from
+    // here, not from the leading whitespace.
+    var nodeIndent = indent;
+    // The column of the innermost sequence dash read on this line, or -1. A
+    // block scalar standing where that dash's own node goes belongs to the
+    // ITEM, so this is what bounds its body.
+    var dashIndent = -1;
+    // Was the token just read a JSON-LIKE key? YAML's JSON compatibility lets
+    // one take its value colon with no space after it, and there are two kinds:
+    // a quoted scalar, and a flow collection. Both end this flag set.
+    var prevWasJsonKey = false;
+    // Did the line finish inside a plain scalar? Set by the plain-scalar branch
+    // when it runs to the end of the line, and false the moment anything else
+    // is read after it.
+    var sawPlainToEol = false;
+    // The column the last plain scalar on this line started in.
+    var plainStartCol = -1;
+
+    while (i < line.length) {
+      var ch = line.charAt(i);
+      // Cleared here and re-set only by the quoted-scalar branch, so no branch
+      // can leave it true by forgetting to. The colon rule reads the captured
+      // copy rather than the live flag.
+      var jsonKeyBefore = prevWasJsonKey;
+      prevWasJsonKey = false;
+
+      // A comment opens on `#` at the start of the content or after whitespace,
+      // and runs to the end of the line. Its text is not YAML, whatever it
+      // says: `x: 1 # note !bang` names no tag.
+      if (ch === "#" && (i === indent || _isPlainSpace(line.charAt(i - 1)))) {
+        masked += _blanked(line.slice(i));
+        break;
+      }
+
+      // Whitespace carries the quoted-key flag rather than clearing it. YAML
+      // allows separation between a JSON-style key and its adjacent value, so
+      // `{"a" :!!python/object x}` is as valid as `{"a":!!python/object x}` —
+      // and clearing here left the second form closed and the first one open,
+      // which is a deserialization tag hidden behind one space.
+      if (_isPlainSpace(ch)) {
+        masked += ch; i += 1; prevWasJsonKey = jsonKeyBefore; continue;
+      }
+
+      // Structural punctuation stays visible, and each of these opens a node
+      // position after it.
+      if (ch === "{" || ch === "[") {
+        masked += ch; i += 1; flowDepth += 1; atNodeStart = true; continue;
+      }
+      if (ch === "}" || ch === "]") {
+        masked += ch; i += 1; if (flowDepth > 0) flowDepth -= 1;
+        atNodeStart = false;
+        // A closing delimiter ends a JSON-LIKE key just as a closing quote
+        // does, and YAML lets that kind of key take its colon with no space
+        // after it. `{{a: b}:!!python/object x}` is valid, and reading the `:`
+        // as ordinary text left the tag masked — the same bypass as the quoted
+        // key, through the other production for the same rule.
+        prevWasJsonKey = true;
+        continue;
+      }
+      if (ch === ",") { masked += ch; i += 1; atNodeStart = true; continue; }
+      if (ch === "-" && (i + 1 >= line.length || _isPlainSpace(line.charAt(i + 1)))) {
+        masked += ch; i += 1; atNodeStart = true;
+        // A sequence entry written inline starts a node PAST the dash, and any
+        // block scalar it opens is measured from there rather than from the
+        // line's leading whitespace. Getting this wrong is not a false refusal
+        // but a false ACCEPT: in
+        //
+        //     - key: |
+        //         body
+        //       evil: !tag x
+        //
+        // `evil` is a sibling of `key`, and measuring the body against the
+        // dash's indent of zero swallows it — masking a real tag and handing
+        // both screens a document they then call clean.
+        var afterDash = i;
+        while (afterDash < line.length && _isPlainSpace(line.charAt(afterDash))) afterDash += 1;
+        if (afterDash < line.length) nodeIndent = afterDash;
+        // ...unless the item's node IS a block scalar, with no mapping in
+        // between: `- |` then `  !hello`. There the body starts at the same
+        // column the `|` sits in, so measuring from that column masks nothing
+        // and the scalar's first line reads as a tag. The owner of the block is
+        // the sequence ITEM, so the dash's column is what bounds it.
+        dashIndent = i - 1;
+        continue;
+      }
+      if (ch === "?" && (i + 1 >= line.length || _isPlainSpace(line.charAt(i + 1)))) {
+        masked += ch; i += 1; atNodeStart = true; continue;
+      }
+      // A colon separates a key from its value when whitespace follows, when a
+      // flow delimiter does — and, inside a flow collection, when the key was
+      // QUOTED. That last form is YAML's JSON compatibility: `{"a":value}` is
+      // valid and needs no space, so requiring one left the colon unread, the
+      // node position closed, and the value masked as though it were more of
+      // the key's scalar. `{"a":!!python/object x}` therefore reached both
+      // screens with its tag hidden — a deserialization tag, which is the
+      // single most dangerous thing this scan exists to surface.
+      if (ch === ":" &&
+          (i + 1 >= line.length || _isPlainSpace(line.charAt(i + 1)) ||
+           (flowDepth > 0 && ",}]".indexOf(line.charAt(i + 1)) !== -1) ||
+           (flowDepth > 0 && jsonKeyBefore))) {
+        masked += ch; i += 1; atNodeStart = true; continue;
+      }
+
+      // A node's properties survive: they are exactly what the callers scan for,
+      // and they are the ONLY place a `!`, `&` or `*` means what it looks like.
+      if (atNodeStart && _isPropertySigil(ch)) {
+        var pEnd = i + 1;
+        if (ch === "!" && line.charAt(pEnd) === "!") pEnd += 1;
+        while (pEnd < line.length && !_isPlainSpace(line.charAt(pEnd)) &&
+               (flowDepth === 0 || ",}]".indexOf(line.charAt(pEnd)) === -1)) pEnd += 1;
+        masked += line.slice(i, pEnd);
+        i = pEnd;
+        continue;                                   // properties chain
+      }
+
+      // A quoted scalar: the quotes stay, the body goes. The body is content by
+      // construction, so nothing in it is ever structure.
+      if (ch === '"' || ch === "'") {
+        var qr = _maskQuotedBody(line, i + 1, ch);
+        masked += ch + qr.masked;
+        i = qr.end;
+        // Not closed on this line means the scalar CONTINUES, which YAML allows
+        // and which the line-at-a-time reading would otherwise lose. The quote
+        // is remembered so the next line is read as its body rather than as
+        // structure.
+        if (!qr.closed) { openQuote = ch; break; }
+        atNodeStart = false;
+        // Remembered for the colon rule above: a quoted scalar is one of the
+        // two JSON-like key forms that may take its colon with no space between.
+        prevWasJsonKey = true;
+        continue;
+      }
+
+      // A block-scalar header ends the line's structure; the body is masked by
+      // the outer loop.
+      var bHead = _blockHeaderEnd(line, i);
+      if (bHead) {
+        masked += line.slice(i, bHead.end);
+        // The body must beat the DASH when there is one, and the line's node
+        // otherwise. That is only a floor: where the body actually starts is
+        // detected from its first content line, because with extra spacing
+        // after a dash it can sit anywhere past that floor.
+        // The owner is the node the block hangs off: the ITEM when the header
+        // stands where the item's own node goes (`- |`), and the MAPPING ENTRY
+        // when it follows a key (`- key: |`). Using the dash for the second
+        // case made a sibling written straight after an empty block look like
+        // its first body line — `- key: |` / `  evil: !tag x` masked the tag.
+        //
+        // It also settles the padded case the honest way. `-   key: |` puts the
+        // mapping at column 4, so a body at column 4 is not content by YAML's
+        // own indentation rule; that document is malformed, and reading its
+        // next line as structure surfaces whatever it says rather than hiding
+        // it. Where a shape is ambiguous, the reading that keeps a sibling
+        // VISIBLE is the one to take — the other hides real tags.
+        blockOwner = (dashIndent >= 0 && i === nodeIndent) ? dashIndent : nodeIndent;
+        // ...unless the header DECLARED it. `|2` fixes the body's indentation
+        // relative to the parent, so a first line indented further does not
+        // move it, and a later line back at the declared column is still body.
+        // Detecting in that case ends the block early and hands the rest of the
+        // scalar to the structural scan.
+        //
+        // Counted from that same owner: for `- key: |2` the indicator is
+        // relative to the mapping entry, not the dash, and counting from the
+        // dash puts the body two columns too far left and swallows the entry's
+        // siblings.
+        blockBody = bHead.declared ? blockOwner + bHead.declared : -1;
+        i = bHead.end;
+        atNodeStart = false;
+        continue;
+      }
+
+      // Anything else begins a PLAIN scalar, and everything to the end of it is
+      // content. This is the case the previous implementations had no notion of:
+      // in `x: hello !world` the `!world` sits inside a scalar that started at
+      // `hello`, so it names no tag, and only knowing a scalar had already begun
+      // can tell you that.
+      var s = i;
+      while (s < line.length) {
+        var c3 = line.charAt(s);
+        if (c3 === "#" && _isPlainSpace(line.charAt(s - 1))) break;
+        if (c3 === ":" &&
+            (s + 1 >= line.length || _isPlainSpace(line.charAt(s + 1)) ||
+             (flowDepth > 0 && ",}]".indexOf(line.charAt(s + 1)) !== -1))) break;
+        if (flowDepth > 0 && ",}][{".indexOf(c3) !== -1) break;
+        s += 1;
+      }
+      masked += _blanked(line.slice(i, s));
+      // Where this scalar BEGAN. A dash earlier on the line is not enough to
+      // make the scalar the item's own: in `- key: hello` the scalar belongs to
+      // `key`, and treating the next line at the mapping's column as its
+      // continuation masked the tag on a sibling key.
+      plainStartCol = i;
+      i = s;
+      atNodeStart = false;
+      // A plain scalar reaching the end of the line may continue on the next
+      // one. Only the LAST thing read on a line can, so this is recorded here
+      // and cleared by anything that follows it.
+      sawPlainToEol = s >= line.length;
+    }
+    // Armed only when the line ended inside a plain scalar, and measured
+    // against the node that opened it rather than the line's own indent. `x:`
+    // with nothing after it never arms this, so the mapping written underneath
+    // it is still read as structure rather than swallowed as text.
+    // Armed inside a flow collection too: a plain scalar spans lines there just
+    // as it does outside one, and requiring depth zero left `x: [hello` /
+    // `  !world]` reading its second line at a fresh node start.
+    if (sawPlainToEol && openQuote === null && blockOwner < 0) {
+      if (!continuesPlain) {
+        plainOpen = nodeIndent;
+        // Whether the scalar hangs directly off a sequence dash decides how its
+        // continuation is measured, so it is remembered with the column.
+        // Only when the scalar IS the item's node: a dash on the line, and the
+        // scalar starting exactly where that item's node begins.
+        plainFromDash = dashIndent >= 0 && plainStartCol === nodeIndent;
+      }
+    } else {
+      plainOpen = -1;
+      plainFromDash = false;
+    }
+    out.push(masked + (cr ? "\r" : ""));
+  }
+  return out.join("\n");
+}
+
+// A line kept for its structure, with any comment on it masked. Used for the
+// directive and document-marker lines, which are passed through whole because
+// what makes them structural is their shape rather than a scan of their parts.
+// The comment is still content and still has to go.
+function _maskTrailingComment(line) {
+  for (var i = 0; i < line.length; i += 1) {
+    if (line.charAt(i) !== "#") continue;
+    if (i !== 0 && !_isPlainSpace(line.charAt(i - 1))) continue;
+    return line.slice(0, i) + _blanked(line.slice(i));
+  }
+  return line;
+}
+
+// The body of a quoted scalar from `at`, masked, stopping at the closing quote.
+// Returns where the scan ended (past the quote when it closed) and whether it
+// did close, which is what tells the caller the scalar runs onto the next line.
+//
+// Both the escape forms are honoured because both hide a quote that would
+// otherwise look like the end: `\"` inside a double-quoted scalar and `''`
+// inside a single-quoted one. Reading either as a terminator ends the mask
+// early and hands the rest of the scalar back to the structural scan as though
+// it were YAML.
+function _maskQuotedBody(line, at, quote) {
+  var body = "";
+  var k = at;
+  while (k < line.length) {
+    var c = line.charAt(k);
+    if (quote === '"' && c === "\\" && k + 1 < line.length) { body += "  "; k += 2; continue; }
+    if (c === quote) {
+      if (quote === "'" && line.charAt(k + 1) === "'") { body += "  "; k += 2; continue; }
+      return { masked: body + quote, end: k + 1, closed: true };
+    }
+    body += c === "\t" ? "\t" : " ";
+    k += 1;
+  }
+  return { masked: body, end: k, closed: false };
+}
+
+// Same length, spaces throughout. Newlines cannot appear here — the caller
+// splits on them first — but a tab is preserved so column arithmetic that
+// counts it as one character still agrees with the source.
+function _blanked(s) {
+  var o = "";
+  for (var i = 0; i < s.length; i += 1) o += s.charAt(i) === "\t" ? "\t" : " ";
+  return o;
+}
+
+module.exports = {
+  maskNonStructural: maskNonStructural,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.51",
+  "version": "0.18.53",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:7276e0db-b00d-4f53-8f63-c7572db5520b",
+  "serialNumber": "urn:uuid:f52f2ee6-253b-4bf4-9915-22d453a4407a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-23T08:40:11.763Z",
+    "timestamp": "2026-08-24T12:08:00.505Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.51",
+      "bom-ref": "@blamejs/core@0.18.53",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.51",
+      "version": "0.18.53",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.51",
+      "purl": "pkg:npm/%40blamejs/core@0.18.53",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.51",
+      "ref": "@blamejs/core@0.18.53",
       "dependsOn": []
     }
   ]