@decimalturn/toml-patch 0.6.0 → 0.7.0

package/dist/toml-patch.es.js

@@ -1,4 +1,4 @@
-//! @decimalturn/toml-patch v0.6.0 - https://github.com/DecimalTurn/toml-patch - @license: MIT
+//! @decimalturn/toml-patch v0.7.0 - https://github.com/DecimalTurn/toml-patch - @license: MIT
 var NodeType;
 (function (NodeType) {
     NodeType["Document"] = "Document";
@@ -82,6 +82,9 @@ function isBlock(node) {
 }
 
 function iterator(value) {
+    if (typeof value === 'string') {
+        return utf16Iterator(value);
+    }
     return value[Symbol.iterator]();
 }
 /**
@@ -139,6 +142,18 @@ class Cursor {
 function done() {
     return { value: undefined, done: true };
 }
+/**
+ * Creates a UTF-16 code unit iterator for a string.
+ * This is necessary because cursor.index is used to access string positions
+ * via input[cursor.index] and input.slice() throughout the tokenizer.
+ * While Symbol.iterator yields code points (better for humans), we need
+ * UTF-16 indices for correct string access in JavaScript.
+ */
+function* utf16Iterator(str) {
+    for (let i = 0; i < str.length; i++) {
+        yield str[i];
+    }
+}
 
 function getSpan(location) {
     return {
@@ -174,19 +189,29 @@ function findPosition(input, index) {
 }
 function getLine$1(input, position) {
     const lines = findLines(input);
-    const start = lines[position.line - 2] || 0;
+    const start = lines[position.line - 2] !== undefined ? lines[position.line - 2] + 1 : 0;
     const end = lines[position.line - 1] || input.length;
     return input.substring(start, end);
 }
 function findLines(input) {
-    // exec is stateful, so create new regexp each time
-    const BY_NEW_LINE = /\r\n|\n/g;
     const indexes = [];
-    let match;
-    while ((match = BY_NEW_LINE.exec(input)) != null) {
-        indexes.push(match.index + match[0].length - 1);
+    for (let i = 0; i < input.length; i++) {
+        const char = input[i];
+        if (char === '\n') {
+            indexes.push(i);
+        }
+        else if (char === '\r') {
+            // Handle \r\n as a single line break
+            if (input[i + 1] === '\n') {
+                indexes.push(i + 1); // Position after \r\n
+                i++; // Skip the \n
+            }
+            else {
+                indexes.push(i);
+            }
+        }
     }
-    indexes.push(input.length + 1);
+    indexes.push(input.length);
     return indexes;
 }
 function clonePosition(position) {
@@ -235,7 +260,6 @@ var TokenType;
     TokenType["Literal"] = "Literal";
 })(TokenType || (TokenType = {}));
 const IS_WHITESPACE = /\s/;
-const IS_NEW_LINE = /(\r\n|\n)/;
 const DOUBLE_QUOTE = `"`;
 const SINGLE_QUOTE = `'`;
 const SPACE = ' ';
@@ -246,6 +270,19 @@ function* tokenize(input) {
     cursor.next();
     const locate = createLocate(input);
     while (!cursor.done) {
+        const code = cursor.value.charCodeAt(0);
+        // TOML does not allow ASCII control characters other than HT (TAB), LF, and CR.
+        // CR is only allowed as part of CRLF and is validated below.
+        if ((code <= 0x1f || code === 0x7f) && code !== 0x09 && code !== 0x0d && code !== 0x0a) {
+            throw new ParseError(input, findPosition(input, cursor.index), `Control character 0x${code.toString(16).toUpperCase().padStart(2, '0')} is not allowed in TOML`);
+        }
+        // CR (0x0D) is only allowed as part of CRLF
+        if (cursor.value === '\r') {
+            const next = cursor.peek();
+            if (next.done || next.value !== '\n') {
+                throw new ParseError(input, findPosition(input, cursor.index), 'Invalid standalone CR (\\r); CR must be part of a CRLF sequence');
+            }
+        }
         if (IS_WHITESPACE.test(cursor.value)) ;
         else if (cursor.value === '[' || cursor.value === ']') {
             // Handle special characters: [, ], {, }, =, comma
@@ -265,7 +302,7 @@ function* tokenize(input) {
         }
         else if (cursor.value === '#') {
             // Handle comments = # -> EOL
-            yield comment$1(cursor, locate);
+            yield comment$1(cursor, locate, input);
         }
         else {
             const multiline_char = checkThree(input, cursor.index, SINGLE_QUOTE) ||
@@ -284,11 +321,19 @@ function* tokenize(input) {
 function specialCharacter(cursor, locate, type) {
     return { type, raw: cursor.value, loc: locate(cursor.index, cursor.index + 1) };
 }
-function comment$1(cursor, locate) {
+function comment$1(cursor, locate, input) {
     const start = cursor.index;
     let raw = cursor.value;
-    while (!cursor.peek().done && !IS_NEW_LINE.test(cursor.peek().value)) {
+    // TOML comment ends at CR or LF.
+    while (!cursor.peek().done &&
+        cursor.peek().value !== '\n' &&
+        cursor.peek().value !== '\r') {
         cursor.next();
+        const code = cursor.value.charCodeAt(0);
+        // Disallow ASCII control characters in comments (except HT / TAB).
+        if ((code <= 0x1f || code === 0x7f) && code !== 0x09) {
+            throw new ParseError(input, findPosition(input, cursor.index), `Control character 0x${code.toString(16).toUpperCase().padStart(2, '0')} is not allowed in TOML`);
+        }
         raw += cursor.value;
     }
     // Early exit is ok for comment, no closing conditions
@@ -300,19 +345,76 @@ function comment$1(cursor, locate) {
 }
 function multiline(cursor, locate, multiline_char, input) {
     const start = cursor.index;
-    let quotes = multiline_char + multiline_char + multiline_char;
+    const quotes = multiline_char + multiline_char + multiline_char;
     let raw = quotes;
-    // Skip over quotes
+    // Skip over opening quotes
     cursor.next();
     cursor.next();
     cursor.next();
-    // The reason why we need to check if there is more than three is because we have to match the last 3 quotes, not the first 3 that appears consecutively
-    // See spec-string-basic-multiline-9.toml
-    while (!cursor.done && (!checkThree(input, cursor.index, multiline_char) || CheckMoreThanThree(input, cursor.index, multiline_char))) {
+    // Multiline strings close on the first unescaped """ / '''.
+    // A run of 4 or 5 quote characters at the end is allowed to include 1 or 2 quotes
+    // immediately before the closing delimiter, but 6+ consecutive quotes is invalid.
+    while (!cursor.done) {
+        const found = checkThree(input, cursor.index, multiline_char);
+        if (found) {
+            let runLength = 3;
+            while (input[cursor.index + runLength] === multiline_char) {
+                runLength++;
+            }
+            if (runLength >= 6) {
+                throw new ParseError(input, findPosition(input, cursor.index), `Invalid multiline string: ${runLength} consecutive ${multiline_char} characters`);
+            }
+            if (runLength === 3) {
+                break;
+            }
+            // runLength is 4 or 5: keep the leading 1 or 2 quote chars as content,
+            // and close on the last 3.
+            raw += multiline_char.repeat(runLength - 3);
+            for (let i = 0; i < runLength - 3; i++) {
+                cursor.next();
+            }
+            break;
+        }
+        if (cursor.value === '\r') {
+            const next = cursor.peek();
+            if (next.done || next.value !== '\n') {
+                throw new ParseError(input, findPosition(input, cursor.index), 'Invalid standalone CR (\\r) in multiline string (must be part of CRLF sequence)');
+            }
+        }
+        // Validate control characters in multiline strings
+        const code = cursor.value.charCodeAt(0);
+        // In multiline strings, control characters are not allowed except tab (0x09), LF (0x0A), and CR (0x0D as part of CRLF)
+        // DEL (0x7F) is also not allowed
+        if ((code <= 0x1f || code === 0x7f) && code !== 0x09 && code !== 0x0a && code !== 0x0d) {
+            const stringType = multiline_char === DOUBLE_QUOTE ? 'multiline basic strings' : 'multiline literal strings';
+            const hexCode = `0x${code.toString(16).toUpperCase().padStart(2, '0')}`;
+            // Provide friendly names for common control characters
+            let charName = '';
+            if (code === 0x00) {
+                charName = 'Null';
+            }
+            else if (code === 0x7f) {
+                charName = 'DEL';
+            }
+            const message = charName
+                ? `${charName} (control character ${hexCode}) is not allowed in ${stringType}`
+                : `Control character ${hexCode} is not allowed in ${stringType}`;
+            throw new ParseError(input, findPosition(input, cursor.index), message);
+        }
         raw += cursor.value;
         cursor.next();
     }
     if (cursor.done) {
+        // Check if the issue might be caused by escape sequences preventing proper closure
+        // For multiline basic strings ("""), check if there are backslashes near the end that might be escaping quotes
+        if (multiline_char === DOUBLE_QUOTE) {
+            // Check the last few characters before EOF for patterns like \""" or \"
+            const precedingText = input.slice(0, cursor.index);
+            const hasEscapedQuotes = /\\"+$/.test(precedingText);
+            if (hasEscapedQuotes) {
+                throw new ParseError(input, findPosition(input, cursor.index), `Expected close of multiline string with ${quotes}, reached end of file. Check for escape sequences (\\) that may be preventing proper string closure`);
+            }
+        }
         throw new ParseError(input, findPosition(input, cursor.index), `Expected close of multiline string with ${quotes}, reached end of file`);
     }
     raw += quotes;
@@ -367,6 +469,35 @@ function string$1(cursor, locate, input) {
     };
     while (!cursor.done && !isFinished(cursor)) {
         cursor.next();
+        // Validate control characters in quoted strings
+        if (double_quoted || single_quoted) {
+            const code = cursor.value.charCodeAt(0);
+            // In basic strings (double-quoted) and literal strings (single-quoted),
+            // control characters are not allowed except tab (0x09)
+            // DEL (0x7F) is also not allowed
+            if ((code <= 0x1f || code === 0x7f) && code !== 0x09) {
+                const stringType = double_quoted ? 'basic strings' : 'literal strings';
+                const hexCode = `0x${code.toString(16).toUpperCase().padStart(2, '0')}`;
+                // Provide friendly names for common control characters
+                let charName = '';
+                if (code === 0x0a) {
+                    charName = 'Newline';
+                }
+                else if (code === 0x0d) {
+                    charName = 'Carriage return';
+                }
+                else if (code === 0x00) {
+                    charName = 'Null';
+                }
+                else if (code === 0x7f) {
+                    charName = 'DEL';
+                }
+                const message = charName
+                    ? `${charName} (control character ${hexCode}) is not allowed in ${stringType}`
+                    : `Control character ${hexCode} is not allowed in ${stringType}`;
+                throw new ParseError(input, findPosition(input, cursor.index), message);
+            }
+        }
         if (cursor.value === DOUBLE_QUOTE)
             double_quoted = !double_quoted;
         if (cursor.value === SINGLE_QUOTE && !double_quoted)
@@ -430,15 +561,6 @@ function checkThree(input, current, check) {
     const isEscaped = backslashes[0].length % 2 !== 0; // Odd number of backslashes means escaped
     return isEscaped ? false : check; // Return `check` if not escaped, otherwise `false`
 }
-function CheckMoreThanThree(input, current, check) {
-    if (!check) {
-        return false;
-    }
-    return (input[current] === check &&
-        input[current + 1] === check &&
-        input[current + 2] === check &&
-        input[current + 3] === check);
-}
 
 function last(values) {
     return values[values.length - 1];
@@ -577,6 +699,40 @@ function isBackslashEscaped(source, backslashOffset) {
     return precedingBackslashes % 2 !== 0;
 }
 function unescapeLargeUnicode(escaped) {
+    // First, validate all escape sequences are valid TOML escapes
+    // Valid TOML escape sequences: \b \t \n \f \r \" \\ \uXXXX \UXXXXXXXX \xHH (1.1.0) \e (1.1.0)
+    const ESCAPE_VALIDATION = /\\(.)/g;
+    let match;
+    while ((match = ESCAPE_VALIDATION.exec(escaped)) !== null) {
+        const offset = match.index;
+        if (isBackslashEscaped(escaped, offset)) {
+            continue; // This backslash is itself escaped, so skip
+        }
+        const escapeChar = match[1];
+        // Valid single-char escapes: b, t, n, f, r, ", \, e
+        // Valid multi-char escapes: u (followed by 4 hex), U (followed by 8 hex), x (followed by 2 hex)
+        const validEscapes = ['b', 't', 'n', 'f', 'r', '"', '\\', 'e', 'u', 'U', 'x'];
+        if (!validEscapes.includes(escapeChar)) {
+            throw new Error(`Invalid escape sequence: \\${escapeChar}`);
+        }
+    }
+    // Validate \uXXXX sequences don't use surrogate codepoints (0xD800-0xDFFF)
+    const SMALL_UNICODE = /\\u([a-fA-F0-9]{4})/g;
+    const smallUnicodeSource = escaped;
+    while ((match = SMALL_UNICODE.exec(smallUnicodeSource)) !== null) {
+        const offset = match.index;
+        if (isBackslashEscaped(smallUnicodeSource, offset)) {
+            continue;
+        }
+        const hex = match[1];
+        const codePoint = parseInt(hex, 16);
+        // Surrogate pair range: 0xD800-0xDFFF
+        // High surrogates: 0xD800-0xDBFF
+        // Low surrogates: 0xDC00-0xDFFF
+        if (codePoint >= 0xD800 && codePoint <= 0xDFFF) {
+            throw new Error(`Invalid Unicode escape: \\u${hex} (surrogate codepoints are not allowed)`);
+        }
+    }
     // TOML 1.1.0: Handle \xHH hex escapes (for codepoints < 255)
     const HEX_ESCAPE = /\\x([a-fA-F0-9]{2})/g;
     const hexEscapeSource = escaped;
@@ -825,13 +981,14 @@ class DateFormatHelper {
 // Patterns for different date/time formats
 DateFormatHelper.IS_DATE_ONLY = /^\d{4}-\d{2}-\d{2}$/;
 DateFormatHelper.IS_TIME_ONLY = /^\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?$/;
-DateFormatHelper.IS_LOCAL_DATETIME_T = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?$/;
+DateFormatHelper.IS_LOCAL_DATETIME_T = /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?$/;
 DateFormatHelper.IS_LOCAL_DATETIME_SPACE = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}(?::\d{2})?(?:\.\d+)?$/;
-DateFormatHelper.IS_OFFSET_DATETIME_T = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?(?:[Zz]|[+-]\d{2}:\d{2})$/;
+DateFormatHelper.IS_OFFSET_DATETIME_T = /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?(?:[Zz]|[+-]\d{2}:\d{2})$/;
 DateFormatHelper.IS_OFFSET_DATETIME_SPACE = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}(?::\d{2})?(?:\.\d+)?(?:[Zz]|[+-]\d{2}:\d{2})$/;
 // Legacy patterns from parse-toml.ts (for compatibility)
-DateFormatHelper.IS_FULL_DATE = /(\d{4})-(\d{2})-(\d{2})/;
-DateFormatHelper.IS_FULL_TIME = /(\d{2}):(\d{2})(?::(\d{2}))?/;
+// Made more permissive to catch malformed dates (e.g., 1987-7-05) for validation
+DateFormatHelper.IS_FULL_DATE = /(\d{4})-(\d+)-(\d+)/;
+DateFormatHelper.IS_FULL_TIME = /(\d+):(\d+)(?::(\d+))?/;
 /**
  * Custom Date class for local dates (date-only).
  * Format: 1979-05-27
@@ -1004,16 +1161,19 @@ const TRUE = 'true';
 const FALSE = 'false';
 const HAS_E = /e/i;
 const IS_DIVIDER = /\_/g;
-const IS_INF = /inf/;
-const IS_NAN = /nan/;
-const IS_HEX = /^0x/;
-const IS_OCTAL = /^0o/;
-const IS_BINARY = /^0b/;
+const IS_INF = /^[+\-]?inf$/;
+const IS_NAN = /^[+\-]?nan$/;
+const IS_HEX = /^[+\-]?0x/i;
+const IS_OCTAL = /^[+\-]?0o/i;
+const IS_BINARY = /^[+\-]?0b/i;
 function* parseTOML(input) {
-    const tokens = tokenize(input);
-    const cursor = new Cursor(tokens);
+    // Use non-generator parsing to avoid stack overflow on deeply nested structures
+    const cursor = new Cursor(tokenize(input));
     while (!cursor.next().done) {
-        yield* walkBlock(cursor, input);
+        const blocks = walkBlock(cursor, input);
+        for (const block of blocks) {
+            yield block;
+        }
     }
 }
 /**
@@ -1028,59 +1188,14 @@ function* continueParsingTOML(existingAst, remainingString) {
     for (const item of existingAst) {
         yield item;
     }
-    // Parse and yield all items from the remaining string
-    for (const item of parseTOML(remainingString)) {
-        yield item;
-    }
-}
-function* walkBlock(cursor, input) {
-    if (cursor.value.type === TokenType.Comment) {
-        yield comment(cursor);
-    }
-    else if (cursor.value.type === TokenType.Bracket) {
-        yield table(cursor, input);
-    }
-    else if (cursor.value.type === TokenType.Literal) {
-        yield* keyValue(cursor, input);
-    }
-    else {
-        throw new ParseError(input, cursor.value.loc.start, `Unexpected token "${cursor.value.type}". Expected Comment, Bracket, or String`);
-    }
-}
-function* walkValue$1(cursor, input) {
-    if (cursor.value.type === TokenType.Literal) {
-        if (cursor.value.raw[0] === DOUBLE_QUOTE || cursor.value.raw[0] === SINGLE_QUOTE) {
-            yield string(cursor);
-        }
-        else if (cursor.value.raw === TRUE || cursor.value.raw === FALSE) {
-            yield boolean(cursor);
-        }
-        else if (dateFormatHelper.IS_FULL_DATE.test(cursor.value.raw) || dateFormatHelper.IS_FULL_TIME.test(cursor.value.raw)) {
-            yield datetime(cursor, input);
-        }
-        else if ((!cursor.peek().done && cursor.peek().value.type === TokenType.Dot) ||
-            IS_INF.test(cursor.value.raw) ||
-            IS_NAN.test(cursor.value.raw) ||
-            (HAS_E.test(cursor.value.raw) && !IS_HEX.test(cursor.value.raw))) {
-            yield float(cursor, input);
-        }
-        else {
-            yield integer(cursor);
+    // Parse and yield all items from the remaining string using non-generator path
+    const cursor = new Cursor(tokenize(remainingString));
+    while (!cursor.next().done) {
+        const blocks = walkBlock(cursor, remainingString);
+        for (const block of blocks) {
+            yield block;
         }
     }
-    else if (cursor.value.type === TokenType.Curly) {
-        const [inline_table, comments] = inlineTable(cursor, input);
-        yield inline_table;
-        yield* comments;
-    }
-    else if (cursor.value.type === TokenType.Bracket) {
-        const [inline_array, comments] = inlineArray(cursor, input);
-        yield inline_array;
-        yield* comments;
-    }
-    else {
-        throw new ParseError(input, cursor.value.loc.start, `Unrecognized token type "${cursor.value.type}". Expected String, Curly, or Bracket`);
-    }
 }
 function comment(cursor) {
     // # line comment
@@ -1114,8 +1229,22 @@ function table(cursor, input) {
     if (is_table && cursor.value.raw !== '[') {
         throw new ParseError(input, cursor.value.loc.start, `Expected table opening "[", found ${cursor.value.raw}`);
     }
-    if (!is_table && (cursor.value.raw !== '[' || cursor.peek().value.raw !== '[')) {
-        throw new ParseError(input, cursor.value.loc.start, `Expected array of tables opening "[[", found ${cursor.value.raw + cursor.peek().value.raw}`);
+    if (!is_table) {
+        const next = cursor.peek();
+        if (next.done) {
+            throw new ParseError(input, cursor.value.loc.start, 'Expected second "[" for array of tables opening, found end of input');
+        }
+        if (cursor.value.raw !== '[' || next.value.raw !== '[') {
+            throw new ParseError(input, cursor.value.loc.start, `Expected array of tables opening "[[", found ${cursor.value.raw + next.value.raw}`);
+        }
+        // Validate that table array brackets are immediately adjacent (no whitespace)
+        const firstBracket = cursor.value;
+        const secondBracket = next.value;
+        // Check if brackets are on the same line and adjacent columns
+        if (firstBracket.loc.end.line !== secondBracket.loc.start.line ||
+            firstBracket.loc.end.column !== secondBracket.loc.start.column) {
+            throw new ParseError(input, firstBracket.loc.start, 'Array of tables opening brackets must be immediately adjacent with no whitespace: [[table]]');
+        }
     }
     // Set start location from opening tag
     const key = is_table
@@ -1134,23 +1263,84 @@ function table(cursor, input) {
     if (cursor.done) {
         throw new ParseError(input, key.loc.start, `Expected table key, reached end of file`);
     }
+    // Check if the table/array name is empty (e.g., [[]] or [])
+    if (cursor.value.type === TokenType.Bracket && cursor.value.raw === ']') {
+        throw new ParseError(input, cursor.value.loc.start, type === NodeType.TableArray
+            ? 'Array of tables header [[]] requires a table name'
+            : 'Table header [] requires a table name');
+    }
+    // Validate that multiline strings are not used as table keys
+    const raw = cursor.value.raw;
+    {
+        if (raw.startsWith('"""') || raw.startsWith("'''")) {
+            throw new ParseError(input, cursor.value.loc.start, 'Multiline strings (""" or \'\'\') cannot be used as keys');
+        }
+        // Validate bare key characters (TOML 1.1.0: A-Za-z0-9_- only)
+        const isQuoted = raw.startsWith('"') || raw.startsWith("'");
+        if (!isQuoted) {
+            for (let i = 0; i < raw.length; i++) {
+                const char = raw[i];
+                if (!/[A-Za-z0-9_-]/.test(char)) {
+                    throw new ParseError(input, { line: cursor.value.loc.start.line, column: cursor.value.loc.start.column + i }, `Invalid character '${char}' in bare key. Bare keys can only contain A-Z, a-z, 0-9, _, and -`);
+                }
+            }
+        }
+    }
+    let keyValue;
+    try {
+        keyValue = [parseString(cursor.value.raw)];
+    }
+    catch (err) {
+        const e = err;
+        throw new ParseError(input, cursor.value.loc.start, e.message);
+    }
     key.item = {
         type: NodeType.Key,
         loc: cloneLocation(cursor.value.loc),
         raw: cursor.value.raw,
-        value: [parseString(cursor.value.raw)]
+        value: keyValue
     };
     while (!cursor.peek().done && cursor.peek().value.type === TokenType.Dot) {
         cursor.next();
         const dot = cursor.value;
         cursor.next();
+        // Validate each part of a dotted table key
+        const partRaw = cursor.value.raw;
+        const partIsQuoted = partRaw.startsWith('"') || partRaw.startsWith("'");
+        if (!partIsQuoted) {
+            for (let i = 0; i < partRaw.length; i++) {
+                const char = partRaw[i];
+                if (!/[A-Za-z0-9_-]/.test(char)) {
+                    throw new ParseError(input, { line: cursor.value.loc.start.line, column: cursor.value.loc.start.column + i }, `Invalid character '${char}' in bare key. Bare keys can only contain A-Z, a-z, 0-9, _, and -`);
+                }
+            }
+        }
         const before = ' '.repeat(dot.loc.start.column - key.item.loc.end.column);
         const after = ' '.repeat(cursor.value.loc.start.column - dot.loc.end.column);
         key.item.loc.end = cursor.value.loc.end;
         key.item.raw += `${before}.${after}${cursor.value.raw}`;
-        key.item.value.push(parseString(cursor.value.raw));
+        try {
+            key.item.value.push(parseString(cursor.value.raw));
+        }
+        catch (err) {
+            const e = err;
+            throw new ParseError(input, cursor.value.loc.start, e.message);
+        }
     }
     cursor.next();
+    // Table headers must not contain newlines - all parts must be on the same line
+    // Example invalid TOML (table/newline-01): [tbl\n]
+    // Example invalid TOML (table/newline-03): ["tbl"\n]
+    if (!cursor.done) {
+        const headerStartLine = is_table
+            ? key.loc.start.line
+            : key.loc.start.line; // Both use the opening bracket line
+        if (cursor.value.loc.start.line !== headerStartLine) {
+            throw new ParseError(input, cursor.value.loc.start, is_table
+                ? `Table header must not contain newlines. Expected closing ']' on line ${headerStartLine}, found on line ${cursor.value.loc.start.line}`
+                : `Unclosed array of tables header: expected closing ']]' on line ${headerStartLine}, found newline`);
+        }
+    }
     if (is_table && (cursor.done || cursor.value.raw !== ']')) {
         throw new ParseError(input, cursor.done ? key.item.loc.end : cursor.value.loc.start, `Expected table closing "]", found ${cursor.done ? 'end of file' : cursor.value.raw}`);
     }
@@ -1163,15 +1353,37 @@ function table(cursor, input) {
             ? 'end of file'
             : cursor.value.raw + cursor.peek().value.raw}`);
     }
+    // Validate that table array closing brackets are immediately adjacent (no whitespace)
+    if (!is_table) {
+        const firstBracket = cursor.value;
+        const secondBracket = cursor.peek().value;
+        // Check if brackets are on the same line and adjacent columns
+        if (firstBracket.loc.end.line !== secondBracket.loc.start.line ||
+            firstBracket.loc.end.column !== secondBracket.loc.start.column) {
+            throw new ParseError(input, firstBracket.loc.start, 'Array of tables closing brackets must be immediately adjacent with no whitespace: ]]');
+        }
+    }
     // Set end location from closing tag
     if (!is_table)
         cursor.next();
     key.loc.end = cursor.value.loc.end;
+    // Table/array headers must be alone on their line - nothing can follow the closing bracket(s)
+    // Example invalid TOML (key/after-table): [error] this = "should not be here"
+    // Example invalid TOML (key/after-array): [[agencies]] owner = "S Cjelli"
+    if (!cursor.peek().done) {
+        const nextToken = cursor.peek().value;
+        // Check if there's content on the same line after the closing bracket
+        // Comments are the only thing allowed on the same line
+        if (nextToken.loc.start.line === key.loc.end.line &&
+            nextToken.type !== TokenType.Comment) {
+            throw new ParseError(input, nextToken.loc.start, `Unexpected content after ${is_table ? 'table' : 'array of tables'} header`);
+        }
+    }
     // Add child items
     let items = [];
     while (!cursor.peek().done && cursor.peek().value.type !== TokenType.Bracket) {
         cursor.next();
-        merge(items, [...walkBlock(cursor, input)]);
+        merge(items, walkBlock(cursor, input));
     }
     return {
         type: is_table ? NodeType.Table : NodeType.TableArray,
@@ -1185,56 +1397,20 @@ function table(cursor, input) {
         items
     };
 }
-function keyValue(cursor, input) {
-    // 3. KeyValue
-    //
-    // key = value
-    // ^-^          key
-    //     ^        equals
-    //       ^---^  value
-    const key = {
-        type: NodeType.Key,
-        loc: cloneLocation(cursor.value.loc),
-        raw: cursor.value.raw,
-        value: [parseString(cursor.value.raw)]
-    };
-    while (!cursor.peek().done && cursor.peek().value.type === TokenType.Dot) {
-        cursor.next();
-        cursor.next();
-        key.loc.end = cursor.value.loc.end;
-        key.raw += `.${cursor.value.raw}`;
-        key.value.push(parseString(cursor.value.raw));
-    }
-    cursor.next();
-    if (cursor.done || cursor.value.type !== TokenType.Equal) {
-        throw new ParseError(input, cursor.done ? key.loc.end : cursor.value.loc.start, `Expected "=" for key-value, found ${cursor.done ? 'end of file' : cursor.value.raw}`);
+function string(cursor, input) {
+    let value;
+    try {
+        value = parseString(cursor.value.raw);
     }
-    const equals = cursor.value.loc.start.column;
-    cursor.next();
-    if (cursor.done) {
-        throw new ParseError(input, key.loc.start, `Expected value for key-value, reached end of file`);
+    catch (err) {
+        const e = err;
+        throw new ParseError(input, cursor.value.loc.start, e.message);
     }
-    const [value, ...comments] = walkValue$1(cursor, input);
-    return [
-        {
-            type: NodeType.KeyValue,
-            key,
-            value: value,
-            loc: {
-                start: clonePosition(key.loc.start),
-                end: clonePosition(value.loc.end)
-            },
-            equals
-        },
-        ...comments
-    ];
-}
-function string(cursor) {
     return {
         type: NodeType.String,
         loc: cursor.value.loc,
         raw: cursor.value.raw,
-        value: parseString(cursor.value.raw)
+        value
     };
 }
 function boolean(cursor) {
@@ -1287,6 +1463,10 @@ function datetime(cursor, input) {
         loc = { start, end: cursor.value.loc.end };
         raw += `.${cursor.value.raw}`;
     }
+    // Validate datetime format
+    {
+        validateDateTimeFormat(raw, input, loc.start);
+    }
     if (!dateFormatHelper.IS_FULL_DATE.test(raw)) {
         // Local time only (e.g., "07:32:00" or "07:32:00.999")
         if (dateFormatHelper.IS_TIME_ONLY.test(raw)) {
@@ -1329,18 +1509,227 @@ function datetime(cursor, input) {
         value
     };
 }
+// Helper function to calculate days in a month for any year (including 0-99)
+// JavaScript's Date constructor treats years 0-99 as 1900-1999, so we need manual calculation
+function getDaysInMonth(year, month) {
+    // Month is 1-12
+    const daysPerMonth = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    if (month === 2) {
+        // Check if it's a leap year
+        // Leap year rules: divisible by 4, except century years (divisible by 100) unless also divisible by 400
+        const isLeapYear = (year % 4 === 0 && year % 100 !== 0) || (year % 400 === 0);
+        return isLeapYear ? 29 : 28;
+    }
+    return daysPerMonth[month - 1];
+}
+// Helper function to validate datetime format
+function validateDateTimeFormat(raw, input, loc) {
+    // Group 9: fractional seconds and timezone offset validation.
+    // Reject fractional seconds with no digits after the dot (e.g. "...:09.Z" or "...:09.+01:00").
+    if (/\.([Zz]|[+-])/.test(raw)) {
+        throw new ParseError(input, loc, `Invalid datetime "${raw}": fractional seconds must have at least one digit after decimal point`);
+    }
+    // Reject trailing +/- without hour/minute (e.g., "...+" or "...-")
+    if (/[+-]$/.test(raw)) {
+        throw new ParseError(input, loc, `Invalid datetime "${raw}": timezone offset requires hour and minute components`);
+    }
+    // If an offset is present, it must be [+-]HH:MM and only after a time component.
+    // (Avoid accidentally matching date hyphens by requiring a time first.)
+    const hasTime = /\d{2}:\d{2}/.test(raw);
+    const offsetMatch = hasTime ? raw.match(/([+-])(\d+)(:?)(\d*)$/) : null;
+    if (offsetMatch) {
+        const fullOffset = offsetMatch[0];
+        const hours = offsetMatch[2];
+        const colon = offsetMatch[3];
+        const minutes = offsetMatch[4];
+        if (colon !== ':') {
+            throw new ParseError(input, loc, `Invalid timezone offset "${fullOffset}": must use colon separator (e.g., +09:09)`);
+        }
+        if (hours.length !== 2) {
+            throw new ParseError(input, loc, `Invalid timezone offset "${fullOffset}": hour must be exactly 2 digits`);
+        }
+        if (!minutes || minutes.length === 0) {
+            throw new ParseError(input, loc, `Invalid timezone offset "${fullOffset}": minute component is required`);
+        }
+        if (minutes.length !== 2) {
+            throw new ParseError(input, loc, `Invalid timezone offset "${fullOffset}": minute must be exactly 2 digits`);
+        }
+        const hourNum = parseInt(hours, 10);
+        if (hourNum < 0 || hourNum > 23) {
+            throw new ParseError(input, loc, `Invalid timezone offset "${fullOffset}": hour must be between 00 and 23, found ${hours}`);
+        }
+        const minuteNum = parseInt(minutes, 10);
+        if (minuteNum < 0 || minuteNum > 59) {
+            throw new ParseError(input, loc, `Invalid timezone offset "${fullOffset}": minute must be between 00 and 59, found ${minutes}`);
+        }
+    }
+    // First, ensure the overall shape is valid (anchors matter).
+    // This catches cases where regexes below might partially match a prefix and ignore trailing junk.
+    const validDateTimePattern = /^\d{4}-\d{2}-\d{2}(?:[Tt ]\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?(?:[Zz]|[+-]\d{2}:\d{2})?)?$/;
+    const validTimePattern = /^\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?$/;
+    if (!validDateTimePattern.test(raw) && !validTimePattern.test(raw)) {
+        // Date cannot end with trailing T without a time component
+        if (/^\d{4}-\d{2}-\d{2}T$/.test(raw)) {
+            throw new ParseError(input, loc, `Invalid date "${raw}": date cannot end with 'T' without a time component`);
+        }
+        // Any unexpected character immediately after a date-only value.
+        // Exclude T/t (date-time separators) from this check.
+        if (/^\d{4}-\d{2}-\d{2}[a-su-zA-SU-Z]/.test(raw)) {
+            throw new ParseError(input, loc, `Invalid date "${raw}": unexpected character after date`);
+        }
+        // Missing separator between date and time
+        if (/^\d{4}-\d{2}-\d{2}\d{2}:\d{2}/.test(raw)) {
+            throw new ParseError(input, loc, `Invalid datetime "${raw}": missing separator 'T' or space between date and time`);
+        }
+        throw new ParseError(input, loc, `Invalid datetime "${raw}"`);
+    }
+    // Check for year with wrong number of digits (must be exactly 4)
+    const yearMatch = raw.match(/^(\d+)-/);
+    if (yearMatch && yearMatch[1].length !== 4) {
+        throw new ParseError(input, loc, `Invalid date "${raw}": year must be exactly 4 digits, found ${yearMatch[1].length}`);
+    }
+    // Check for date with wrong number of digits for month/day BEFORE extracting components
+    // Pattern should be YYYY-MM-DD (exactly 4, 2, 2 digits)
+    const datePattern = /^(\d+)-(\d+)-(\d+)/;
+    const dateMatch = raw.match(datePattern);
+    if (dateMatch) {
+        const [, , month, day] = dateMatch;
+        if (month.length !== 2) {
+            throw new ParseError(input, loc, `Invalid date "${raw}": month must be exactly 2 digits, found ${month.length}`);
+        }
+        if (day.length !== 2) {
+            throw new ParseError(input, loc, `Invalid date "${raw}": day must be exactly 2 digits, found ${day.length}`);
+        }
+    }
+    // Check for time with wrong number of digits for hour/minute/second
+    const timePattern = /[T ](\d+):(\d+)(?::(\d+))?/;
+    const timeMatch = raw.match(timePattern);
+    if (timeMatch) {
+        const [, hour, minute, second] = timeMatch;
+        if (hour.length !== 2) {
+            throw new ParseError(input, loc, `Invalid time "${raw}": hour must be exactly 2 digits, found ${hour.length}`);
+        }
+        if (minute.length !== 2) {
+            throw new ParseError(input, loc, `Invalid time "${raw}": minute must be exactly 2 digits, found ${minute.length}`);
+        }
+        if (second && second.length !== 2) {
+            throw new ParseError(input, loc, `Invalid time "${raw}": second must be exactly 2 digits, found ${second.length}`);
+        }
+    }
+    // Check for standalone time (no date prefix)
+    const timeOnlyPattern = /^(\d+):(\d+)(?::(\d+))?/;
+    const timeOnlyMatch = raw.match(timeOnlyPattern);
+    if (timeOnlyMatch && !dateMatch) {
+        const [, hour, minute, second] = timeOnlyMatch;
+        if (hour.length !== 2) {
+            throw new ParseError(input, loc, `Invalid time "${raw}": hour must be exactly 2 digits, found ${hour.length}`);
+        }
+        if (minute.length !== 2) {
+            throw new ParseError(input, loc, `Invalid time "${raw}": minute must be exactly 2 digits, found ${minute.length}`);
+        }
+        if (second && second.length !== 2) {
+            throw new ParseError(input, loc, `Invalid time "${raw}": second must be exactly 2 digits, found ${second.length}`);
+        }
+    }
+    // Extract components for range validation (now we know they have the right length)
+    const dateTimeMatch = raw.match(/^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2}))?)?/);
+    const timeOnlyMatchExact = raw.match(/^(\d{2}):(\d{2})(?::(\d{2}))?/);
+    if (dateTimeMatch) {
+        const [, year, month, day, hour, minute, second] = dateTimeMatch;
+        // Validate month range (01-12)
+        const monthNum = parseInt(month, 10);
+        if (monthNum < 1 || monthNum > 12) {
+            throw new ParseError(input, loc, `Invalid date "${raw}": month must be between 01 and 12`);
+        }
+        // Validate day range (01-31 depending on month)
+        const dayNum = parseInt(day, 10);
+        if (dayNum < 1 || dayNum > 31) {
+            throw new ParseError(input, loc, `Invalid date "${raw}": day must be between 01 and 31`);
+        }
+        // Check if day is valid for the specific month
+        const yearNum = parseInt(year, 10);
+        const daysInMonth = getDaysInMonth(yearNum, monthNum);
+        if (dayNum > daysInMonth) {
+            throw new ParseError(input, loc, `Invalid date "${raw}": day ${day} is invalid for month ${month} in year ${year}`);
+        }
+        // Validate time component ranges if present
+        if (hour !== undefined) {
+            const hourNum = parseInt(hour, 10);
+            if (hourNum < 0 || hourNum > 23) {
+                throw new ParseError(input, loc, `Invalid time "${raw}": hour must be between 00 and 23`);
+            }
+        }
+        if (minute !== undefined) {
+            const minuteNum = parseInt(minute, 10);
+            if (minuteNum < 0 || minuteNum > 59) {
+                throw new ParseError(input, loc, `Invalid time "${raw}": minute must be between 00 and 59`);
+            }
+        }
+        if (second !== undefined) {
+            const secondNum = parseInt(second, 10);
+            if (secondNum < 0 || secondNum > 60) {
+                throw new ParseError(input, loc, `Invalid time "${raw}": second must be between 00 and 60`);
+            }
+        }
+    }
+    else if (timeOnlyMatchExact) {
+        const [, hour, minute, second] = timeOnlyMatchExact;
+        const hourNum = parseInt(hour, 10);
+        if (hourNum < 0 || hourNum > 23) {
+            throw new ParseError(input, loc, `Invalid time "${raw}": hour must be between 00 and 23`);
+        }
+        const minuteNum = parseInt(minute, 10);
+        if (minuteNum < 0 || minuteNum > 59) {
+            throw new ParseError(input, loc, `Invalid time "${raw}": minute must be between 00 and 59`);
+        }
+        if (second !== undefined) {
+            const secondNum = parseInt(second, 10);
+            if (secondNum < 0 || secondNum > 60) {
+                throw new ParseError(input, loc, `Invalid time "${raw}": second must be between 00 and 60`);
+            }
+        }
+    }
+}
 function float(cursor, input) {
     let loc = cursor.value.loc;
     let raw = cursor.value.raw;
     let value;
     if (IS_INF.test(raw)) {
-        value = raw === '-inf' ? -Infinity : Infinity;
+        value = raw.startsWith('-') ? -Infinity : Infinity;
     }
     else if (IS_NAN.test(raw)) {
-        value = raw === '-nan' ? -NaN : NaN;
+        value = NaN;
     }
     else if (!cursor.peek().done && cursor.peek().value.type === TokenType.Dot) {
         const start = loc.start;
+        {
+            // Validate that we don't already have an exponent (e.g., 1e2 cannot have a fractional part after it)
+            if (HAS_E.test(raw) && !IS_HEX.test(raw)) {
+                throw new ParseError(input, loc.start, `Invalid float "${raw}": cannot have decimal point after exponent`);
+            }
+            // Validate integer part before decimal point
+            const intPart = raw;
+            // Validate no leading zeros in integer part (after optional sign)
+            // e.g. 00.1, +00.1, 0_0.1 are invalid
+            const withoutUnderscores = intPart.replace(IS_DIVIDER, '');
+            if (/^[+\-]?0\d/.test(withoutUnderscores) && !IS_HEX.test(intPart) && !IS_OCTAL.test(intPart) && !IS_BINARY.test(intPart)) {
+                throw new ParseError(input, loc.start, 'Leading zeros are not allowed in the integer part of a float');
+            }
+            // Validate no leading dot (must have at least one digit before the dot)
+            const withoutSign = intPart.replace(/^[+\-]/, '');
+            if (withoutSign === '' || withoutSign === '_') {
+                throw new ParseError(input, loc.start, `Invalid float: decimal point must be preceded by at least one digit`);
+            }
+            if (/_$/.test(intPart)) {
+                throw new ParseError(input, loc.start, 'Underscore before decimal point is not allowed');
+            }
+            if (/^[+\-]?_/.test(intPart)) {
+                throw new ParseError(input, loc.start, 'Leading underscore is not allowed');
+            }
+            if (/__/.test(intPart)) {
+                throw new ParseError(input, loc.start, 'Consecutive underscores are not allowed');
+            }
+        }
         // From spec:
         // | A fractional part is a decimal point followed by one or more digits.
         //
@@ -1352,47 +1741,425 @@ function float(cursor, input) {
         cursor.next();
         raw += `.${cursor.value.raw}`;
         loc = { start, end: cursor.value.loc.end };
+        {
+            // Validate underscore placement in fractional part
+            const fracPart = cursor.value.raw;
+            // Validate that fractional part starts with a digit (not 'e')
+            if (!/^\d/.test(fracPart)) {
+                throw new ParseError(input, cursor.value.loc.start, `Invalid float: fractional part must start with a digit, found "${fracPart}"`);
+            }
+            if (/^_/.test(fracPart)) {
+                throw new ParseError(input, cursor.value.loc.start, 'Underscore after decimal point is not allowed');
+            }
+            if (/_$/.test(fracPart)) {
+                throw new ParseError(input, cursor.value.loc.start, 'Trailing underscore in fractional part is not allowed');
+            }
+            // Validate underscore before exponent in fractional part
+            if (/_[eE]/.test(fracPart)) {
+                throw new ParseError(input, cursor.value.loc.start, 'Underscore before exponent is not allowed');
+            }
+            // Validate underscore at start of exponent in fractional part
+            if (/[eE][+\-]?_/.test(fracPart)) {
+                throw new ParseError(input, cursor.value.loc.start, 'Underscore at start of exponent is not allowed');
+            }
+            // Validate incomplete exponent in fractional part (just E with nothing or just sign after)
+            if (/[eE][+\-]?$/.test(fracPart)) {
+                throw new ParseError(input, cursor.value.loc.start, `Invalid float "${raw}": incomplete exponent`);
+            }
+            // Validate no decimal point in exponent in fractional part
+            if (/[eE][+\-]?.*\./.test(fracPart)) {
+                throw new ParseError(input, cursor.value.loc.start, `Invalid float "${raw}": decimal point not allowed in exponent`);
+            }
+        }
         value = Number(raw.replace(IS_DIVIDER, ''));
     }
     else {
+        // Validate underscore placement in integer part (exponent-only floats like 1e5)
+        if (/_$/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Underscore before decimal point is not allowed');
+        }
+        if (/^[+\-]?_/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Leading underscore is not allowed');
+        }
+        if (/__/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Consecutive underscores are not allowed');
+        }
+        // Validate incomplete exponent (just E with nothing or just sign after)
+        if (/[eE][+\-]?$/.test(raw)) {
+            throw new ParseError(input, loc.start, `Invalid float "${raw}": incomplete exponent`);
+        }
+        // Validate no decimal point in exponent
+        if (/[eE][+\-]?.*\./.test(raw)) {
+            throw new ParseError(input, loc.start, `Invalid float "${raw}": decimal point not allowed in exponent`);
+        }
+        // Validate underscore before exponent
+        if (/_[eE]/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Underscore before exponent is not allowed');
+        }
+        // Validate underscore at start of exponent
+        if (/[eE][+\-]?_/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Underscore at start of exponent is not allowed');
+        }
+        // Validate no dot after exponent (e.g., 1e2.3 is invalid)
+        if (!cursor.peek().done && cursor.peek().value.type === TokenType.Dot) {
+            throw new ParseError(input, cursor.peek().value.loc.start, `Invalid float "${raw}.": cannot have decimal point after exponent`);
+        }
+        // Validate no leading zeros in integer part (after optional sign)
+        // e.g. 00e1, +00e1, 0_0e1 are invalid
+        const withoutUnderscores = raw.replace(IS_DIVIDER, '');
+        if (/^[+\-]?0\d/.test(withoutUnderscores) && !IS_HEX.test(raw) && !IS_OCTAL.test(raw) && !IS_BINARY.test(raw)) {
+            throw new ParseError(input, loc.start, 'Leading zeros are not allowed in the integer part of a float');
+        }
         value = Number(raw.replace(IS_DIVIDER, ''));
     }
+    // Reject non-special floats that parse to NaN (e.g. "Inf", "NaN", "1ee2")
+    if (Number.isNaN(value) && !IS_NAN.test(raw)) {
+        throw new ParseError(input, loc.start, `Invalid float "${raw}"`);
+    }
     return { type: NodeType.Float, loc, raw, value };
 }
-function integer(cursor) {
-    // > Integer values -0 and +0 are valid and identical to an unprefixed zero
-    if (cursor.value.raw === '-0' || cursor.value.raw === '+0') {
-        return {
-            type: NodeType.Integer,
-            loc: cursor.value.loc,
-            raw: cursor.value.raw,
-            value: 0
-        };
+function integer(cursor, input) {
+    const raw = cursor.value.raw;
+    const loc = cursor.value.loc;
+    // Guard: values that look like dates/times must never be parsed as integers.
+    // (Prevents parseInt() from accepting prefixes like "199-09-09" -> 199.)
+    if (/^\d{1,}-\d{1,}/.test(raw) ||
+        /^\d{1,}:\d{1,}/.test(raw) ||
+        /^\d{6}-\d{2}$/.test(raw)) {
+        throw new ParseError(input, loc.start, `Invalid integer "${raw}"`);
+    }
+    {
+        // > Integer values -0 and +0 are valid and identical to an unprefixed zero
+        if (raw === '-0' || raw === '+0') {
+            return {
+                type: NodeType.Integer,
+                loc: loc,
+                raw: raw,
+                value: 0
+            };
+        }
+        // Validation: No double signs (++99, --99)
+        if (/^[+\-]{2,}/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Double sign is not allowed in integers');
+        }
+        // Validation: No leading zeros (except for hex/octal/binary with prefixes)
+        // Check after removing underscores to catch cases like 0_0 which is equivalent to 00
+        const withoutUnderscores = raw.replace(/_/g, '');
+        if (/^[+\-]?0\d/.test(withoutUnderscores) && !IS_HEX.test(raw) && !IS_OCTAL.test(raw) && !IS_BINARY.test(raw)) {
+            throw new ParseError(input, loc.start, 'Leading zeros are not allowed in decimal integers');
+        }
+        // Validation: No trailing underscores
+        if (/_$/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Underscores in numbers must be surrounded by digits');
+        }
+        // Validation: No leading underscores (after optional sign)
+        if (/^[+\-]?_/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Underscores in numbers must be surrounded by digits');
+        }
+        // Validation: No consecutive underscores
+        if (/__/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Consecutive underscores in numbers are not allowed');
+        }
     }
     let radix = 10;
-    if (IS_HEX.test(cursor.value.raw)) {
+    let numericPart;
+    // Hexadecimal validation
+    if (IS_HEX.test(raw)) {
         radix = 16;
+        // Validation: Capital prefix not allowed
+        if (/^[+\-]?0X/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Hexadecimal prefix must be lowercase "0x"');
+        }
+        // Validation: Underscore after prefix
+        if (/^[+\-]?0x_/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Underscores in numbers must be surrounded by digits');
+        }
+        numericPart = raw.replace(/^[+\-]?0x/i, '');
+        // Validation: Incomplete hexadecimal
+        if (!numericPart || numericPart === '_' || /^_/.test(numericPart)) {
+            throw new ParseError(input, loc.start, 'Incomplete hexadecimal number');
+        }
+        // Validation: Invalid hexadecimal digits
+        const hexDigits = numericPart.replace(/_/g, '');
+        if (!/^[0-9a-fA-F]+$/.test(hexDigits)) {
+            throw new ParseError(input, loc.start, 'Invalid hexadecimal digits');
+        }
+        // Validation: Signed non-decimal numbers not allowed
+        if (/^[+\-]/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Hexadecimal numbers cannot have a sign prefix');
+        }
     }
-    else if (IS_OCTAL.test(cursor.value.raw)) {
+    // Octal validation
+    else if (IS_OCTAL.test(raw)) {
         radix = 8;
+        // Validation: Capital prefix not allowed
+        if (/^[+\-]?0O/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Octal prefix must be lowercase "0o"');
+        }
+        // Validation: Underscore after prefix
+        if (/^[+\-]?0o_/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Underscores in numbers must be surrounded by digits');
+        }
+        numericPart = raw.replace(/^[+\-]?0o/i, '');
+        // Validation: Incomplete octal
+        if (!numericPart || numericPart === '_' || /^_/.test(numericPart)) {
+            throw new ParseError(input, loc.start, 'Incomplete octal number');
+        }
+        // Validation: Invalid octal digits
+        const octalDigits = numericPart.replace(/_/g, '');
+        if (!/^[0-7]+$/.test(octalDigits)) {
+            throw new ParseError(input, loc.start, 'Invalid octal digits (must be 0-7)');
+        }
+        // Validation: Signed non-decimal numbers not allowed
+        if (/^[+\-]/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Octal numbers cannot have a sign prefix');
+        }
     }
-    else if (IS_BINARY.test(cursor.value.raw)) {
+    // Binary validation
+    else if (IS_BINARY.test(raw)) {
         radix = 2;
+        // Validation: Capital prefix not allowed
+        if (/^[+\-]?0B/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Binary prefix must be lowercase "0b"');
+        }
+        // Validation: Underscore after prefix
+        if (/^[+\-]?0b_/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Underscores in numbers must be surrounded by digits');
+        }
+        numericPart = raw.replace(/^[+\-]?0b/i, '');
+        // Validation: Incomplete binary
+        if (!numericPart || numericPart === '_' || /^_/.test(numericPart)) {
+            throw new ParseError(input, loc.start, 'Incomplete binary number');
+        }
+        // Validation: Invalid binary digits
+        const binaryDigits = numericPart.replace(/_/g, '');
+        if (!/^[01]+$/.test(binaryDigits)) {
+            throw new ParseError(input, loc.start, 'Invalid binary digits (must be 0 or 1)');
+        }
+        // Validation: Signed non-decimal numbers not allowed
+        if (/^[+\-]/.test(raw)) {
+            throw new ParseError(input, loc.start, 'Binary numbers cannot have a sign prefix');
+        }
     }
-    const value = parseInt(cursor
-        .value.raw.replace(IS_DIVIDER, '')
+    const value = parseInt(raw
+        .replace(IS_DIVIDER, '')
         .replace(IS_OCTAL, '')
         .replace(IS_BINARY, ''), radix);
+    if (Number.isNaN(value)) {
+        throw new ParseError(input, loc.start, `Invalid integer "${raw}"`);
+    }
     return {
         type: NodeType.Integer,
-        loc: cursor.value.loc,
-        raw: cursor.value.raw,
+        loc: loc,
+        raw: raw,
         value
     };
 }
+/**
+ * Walk a Block (Comment, Table, or KeyValue)
+ * This new version avoids recursion for key-value pairs to improve performance on large files.
+ * @param cursor Cursor<Token>
+ * @param input string
+ * @returns Block[]
+ */
+function walkBlock(cursor, input) {
+    if (cursor.value.type === TokenType.Comment) {
+        return [comment(cursor)];
+    }
+    else if (cursor.value.type === TokenType.Bracket) {
+        // For tables, we can't easily avoid recursion, so just use the existing function
+        // In practice, top-level tables aren't deeply nested
+        return [table(cursor, input)];
+    }
+    else if (cursor.value.type === TokenType.Literal) {
+        return keyValue(cursor, input);
+    }
+    else if (cursor.value.type === TokenType.Equal) {
+        throw new ParseError(input, cursor.value.loc.start, `Missing key before '='`);
+    }
+    else {
+        throw new ParseError(input, cursor.value.loc.start, `Unexpected token "${cursor.value.type}". Expected Comment, Bracket, or String`);
+    }
+}
+/**
+ * Walk a KeyValue pair or Comment
+ * This new version avoids recursion for key-value pairs to improve performance on large files.
+ * @param cursor Cursor<Token>
+ * @param input string
+ * @returns Array<KeyValue | Comment>
+ */
+function keyValue(cursor, input) {
+    // 3. KeyValue
+    //
+    // key = value
+    // ^-^          key
+    //     ^        equals
+    //       ^---^  value
+    // Match the more helpful diagnostic when users write `key: value`.
+    // Depending on tokenization, the ':' may be attached to the key token (e.g. 'name:').
+    const rawKeyToken = cursor.value.raw;
+    if (rawKeyToken.endsWith(':')) {
+        throw new ParseError(input, { line: cursor.value.loc.start.line, column: cursor.value.loc.start.column + [...rawKeyToken].length - 1 }, `Use '=' to separate keys and values, not ':'`);
+    }
+    // Validate that multiline strings are not used as keys
+    if (rawKeyToken.startsWith('"""') || rawKeyToken.startsWith("'''")) {
+        throw new ParseError(input, cursor.value.loc.start, 'Multiline strings (""" or \'\'\') cannot be used as keys');
+    }
+    // Validate bare key characters (TOML 1.1.0: A-Za-z0-9_- only)
+    const isQuotedKey = rawKeyToken.startsWith('"') || rawKeyToken.startsWith("'");
+    if (!isQuotedKey) {
+        for (let i = 0; i < rawKeyToken.length; i++) {
+            const char = rawKeyToken[i];
+            if (!/[A-Za-z0-9_-]/.test(char)) {
+                throw new ParseError(input, { line: cursor.value.loc.start.line, column: cursor.value.loc.start.column + i }, `Invalid character '${char}' in bare key. Bare keys can only contain A-Z, a-z, 0-9, _, and -`);
+            }
+        }
+    }
+    let keyValue2;
+    try {
+        keyValue2 = [parseString(cursor.value.raw)];
+    }
+    catch (err) {
+        const e = err;
+        throw new ParseError(input, cursor.value.loc.start, e.message);
+    }
+    const key = {
+        type: NodeType.Key,
+        loc: cloneLocation(cursor.value.loc),
+        raw: cursor.value.raw,
+        value: keyValue2
+    };
+    while (!cursor.peek().done && cursor.peek().value.type === TokenType.Dot) {
+        cursor.next();
+        cursor.next();
+        // Validate each part of a dotted key
+        const partRaw = cursor.value.raw;
+        if (partRaw.startsWith('"""') || partRaw.startsWith("'''")) {
+            throw new ParseError(input, cursor.value.loc.start, 'Multiline strings (""" or \'\'\') cannot be used as keys');
+        }
+        const partIsQuoted = partRaw.startsWith('"') || partRaw.startsWith("'");
+        if (!partIsQuoted) {
+            for (let i = 0; i < partRaw.length; i++) {
+                const char = partRaw[i];
+                if (!/[A-Za-z0-9_-]/.test(char)) {
+                    throw new ParseError(input, { line: cursor.value.loc.start.line, column: cursor.value.loc.start.column + i }, `Invalid character '${char}' in bare key. Bare keys can only contain A-Z, a-z, 0-9, _, and -`);
+                }
+            }
+        }
+        key.loc.end = cursor.value.loc.end;
+        key.raw += `.${cursor.value.raw}`;
+        try {
+            key.value.push(parseString(cursor.value.raw));
+        }
+        catch (err) {
+            const e = err;
+            throw new ParseError(input, cursor.value.loc.start, e.message);
+        }
+    }
+    cursor.next();
+    // TOML key/value pairs must include '=' on the same line as the key.
+    // Example invalid TOML (spec: bare-key-2):
+    //   barekey\n   = 123
+    if (!cursor.done && cursor.value.loc.start.line !== key.loc.end.line) {
+        throw new ParseError(input, cursor.value.loc.start, `Expected "=" for key-value on the same line as the key`);
+    }
+    if (cursor.done || cursor.value.type !== TokenType.Equal) {
+        if (!cursor.done && cursor.value.raw === ':') {
+            throw new ParseError(input, cursor.value.loc.start, `Use '=' to separate keys and values, not ':'`);
+        }
+        throw new ParseError(input, cursor.done ? key.loc.end : cursor.value.loc.start, `Expected "=" for key-value`);
+    }
+    const equals = cursor.value.loc.start.column;
+    const equalsLine = cursor.value.loc.start.line;
+    cursor.next();
+    if (cursor.done) {
+        throw new ParseError(input, key.loc.start, `Expected value for key-value, reached end of file`);
+    }
+    // TOML values must be on the same line as the '=' sign.
+    // Example invalid TOML (key/newline-06):
+    //   key =\n1
+    if (cursor.value.loc.start.line !== equalsLine) {
+        throw new ParseError(input, cursor.value.loc.start, `Expected value on the same line as the '=' sign`);
+    }
+    if (cursor.done) {
+        throw new ParseError(input, key.loc.start, `Expected value for key-value`);
+    }
+    const results = walkValue$1(cursor, input);
+    const value = results[0];
+    const comments = results.slice(1);
+    // Key/value pairs must be separated by a newline (or EOF). Whitespace alone isn't enough.
+    // Example invalid TOML: first = "Tom" last = "Preston-Werner"
+    //
+    // Note: don't reject valid inline-tables like { a = 1, b = 2 } where tokens like ',' or '}'
+    // legitimately follow a value on the same line.
+    if (!cursor.peek().done) {
+        const nextToken = cursor.peek().value;
+        // Check for Dot token after a numeric value (likely multiple decimal points)
+        if (nextToken.type === TokenType.Dot &&
+            nextToken.loc.start.line === value.loc.end.line &&
+            (value.type === NodeType.Float || value.type === NodeType.Integer)) {
+            throw new ParseError(input, nextToken.loc.start, 'Invalid number: multiple decimal points not allowed');
+        }
+        const startsNewStatement = nextToken.type === TokenType.Literal ||
+            nextToken.type === TokenType.Bracket;
+        if (startsNewStatement && nextToken.loc.start.line === value.loc.end.line) {
+            throw new ParseError(input, nextToken.loc.start, 'Key/value pairs must be separated by a newline');
+        }
+    }
+    return [
+        {
+            type: NodeType.KeyValue,
+            key,
+            value: value,
+            loc: { start: clonePosition(key.loc.start), end: clonePosition(value.loc.end) },
+            equals
+        },
+        ...comments
+    ];
+}
+function walkValue$1(cursor, input) {
+    if (cursor.value.type === TokenType.Literal) {
+        const raw = cursor.value.raw;
+        if (raw[0] === DOUBLE_QUOTE || raw[0] === SINGLE_QUOTE) {
+            return [string(cursor, input)];
+        }
+        else if (raw === TRUE || raw === FALSE) {
+            return [boolean(cursor)];
+            // Route anything that looks like a date or time through datetime() so invalid formats throw,
+            // instead of being mis-parsed as integers (e.g., "199-09-09" -> 199).
+        }
+        else if (/^\d/.test(raw) &&
+            (/^\d{1,}-\d{1,}/.test(raw) || /^\d{1,}:\d{1,}/.test(raw))) {
+            return [datetime(cursor, input)];
+        }
+        else if ((!cursor.peek().done && cursor.peek().value.type === TokenType.Dot) ||
+            IS_INF.test(raw) ||
+            IS_NAN.test(raw) ||
+            (HAS_E.test(raw) && !IS_HEX.test(raw))) {
+            return [float(cursor, input)];
+        }
+        else {
+            return [integer(cursor, input)];
+        }
+    }
+    else if (cursor.value.type === TokenType.Curly) {
+        const [inline_table, comments] = inlineTable(cursor, input);
+        return [inline_table, ...comments];
+    }
+    else if (cursor.value.type === TokenType.Bracket) {
+        const [inline_array, comments] = inlineArray(cursor, input);
+        return [inline_array, ...comments];
+    }
+    else if (cursor.value.type === TokenType.Dot) {
+        throw new ParseError(input, cursor.value.loc.start, `Invalid number: cannot start with a dot. Numbers must start with a digit`);
+    }
+    else {
+        throw new ParseError(input, cursor.value.loc.start, `Unrecognized token type`);
+    }
+}
 function inlineTable(cursor, input) {
     if (cursor.value.raw !== '{') {
-        throw new ParseError(input, cursor.value.loc.start, `Expected "{" for inline table, found ${cursor.value.raw}`);
+        throw new ParseError(input, cursor.value.loc.start, `Expected "{" for inline table`);
     }
     // 6. InlineTable
     const value = {
@@ -1404,7 +2171,6 @@ function inlineTable(cursor, input) {
     cursor.next();
     while (!cursor.done &&
         !(cursor.value.type === TokenType.Curly && cursor.value.raw === '}')) {
-        // TOML 1.1.0: Handle comments in inline tables
         if (cursor.value.type === TokenType.Comment) {
             comments.push(comment(cursor));
             cursor.next();
@@ -1415,29 +2181,37 @@ function inlineTable(cursor, input) {
             if (!previous) {
                 throw new ParseError(input, cursor.value.loc.start, 'Found "," without previous value in inline table');
             }
+            if (previous.comma) {
+                throw new ParseError(input, cursor.value.loc.start, 'Found consecutive commas in inline table (double comma is not allowed)');
+            }
             previous.comma = true;
             previous.loc.end = cursor.value.loc.start;
             cursor.next();
             continue;
         }
-        const [item, ...additional_comments] = walkBlock(cursor, input);
-        if (item.type !== NodeType.KeyValue) {
-            throw new ParseError(input, cursor.value.loc.start, `Only key-values are supported in inline tables, found ${item.type}`);
+        const previous = value.items[value.items.length - 1];
+        if (previous && !previous.comma) {
+            throw new ParseError(input, cursor.value.loc.start, 'Missing comma between inline table items');
+        }
+        // Recursively parse the key-value, but without generators
+        const blocks = walkBlock(cursor, input);
+        const item = blocks[0];
+        const additional_comments = blocks.slice(1);
+        if (item.type === NodeType.KeyValue) {
+            value.items.push({
+                type: NodeType.InlineItem,
+                loc: cloneLocation(item.loc),
+                item: item,
+                comma: false
+            });
+            merge(comments, additional_comments);
         }
-        const inline_item = {
-            type: NodeType.InlineItem,
-            loc: cloneLocation(item.loc),
-            item,
-            comma: false
-        };
-        value.items.push(inline_item);
-        merge(comments, additional_comments);
         cursor.next();
     }
     if (cursor.done ||
         cursor.value.type !== TokenType.Curly ||
         cursor.value.raw !== '}') {
-        throw new ParseError(input, cursor.done ? value.loc.start : cursor.value.loc.start, `Expected "}", found ${cursor.done ? 'end of file' : cursor.value.raw}`);
+        throw new ParseError(input, cursor.done ? value.loc.start : cursor.value.loc.start, `Expected "}"`);
     }
     value.loc.end = cursor.value.loc.end;
     return [value, comments];
@@ -1445,14 +2219,14 @@ function inlineTable(cursor, input) {
 function inlineArray(cursor, input) {
     // 7. InlineArray
     if (cursor.value.raw !== '[') {
-        throw new ParseError(input, cursor.value.loc.start, `Expected "[" for inline array, found ${cursor.value.raw}`);
+        throw new ParseError(input, cursor.value.loc.start, `Expected "[" for inline array`);
     }
     const value = {
         type: NodeType.InlineArray,
         loc: cloneLocation(cursor.value.loc),
         items: []
     };
-    let comments = [];
+    const comments = [];
     cursor.next();
     while (!cursor.done &&
         !(cursor.value.type === TokenType.Bracket && cursor.value.raw === ']')) {
@@ -1461,6 +2235,9 @@ function inlineArray(cursor, input) {
             if (!previous) {
                 throw new ParseError(input, cursor.value.loc.start, 'Found "," without previous value for inline array');
             }
+            if (previous.comma) {
+                throw new ParseError(input, cursor.value.loc.start, 'Found consecutive commas in array (double comma is not allowed)');
+            }
             previous.comma = true;
             previous.loc.end = cursor.value.loc.start;
         }
@@ -1468,14 +2245,19 @@ function inlineArray(cursor, input) {
             comments.push(comment(cursor));
         }
         else {
-            const [item, ...additional_comments] = walkValue$1(cursor, input);
-            const inline_item = {
+            const previous = value.items[value.items.length - 1];
+            if (previous && !previous.comma) {
+                throw new ParseError(input, cursor.value.loc.start, 'Missing comma between array elements');
+            }
+            const results = walkValue$1(cursor, input);
+            const item = results[0];
+            const additional_comments = results.slice(1);
+            value.items.push({
                 type: NodeType.InlineItem,
                 loc: cloneLocation(item.loc),
                 item,
                 comma: false
-            };
-            value.items.push(inline_item);
+            });
             merge(comments, additional_comments);
         }
         cursor.next();
@@ -1483,7 +2265,7 @@ function inlineArray(cursor, input) {
     if (cursor.done ||
         cursor.value.type !== TokenType.Bracket ||
         cursor.value.raw !== ']') {
-        throw new ParseError(input, cursor.done ? value.loc.start : cursor.value.loc.start, `Expected "]", found ${cursor.done ? 'end of file' : cursor.value.raw}`);
+        throw new ParseError(input, cursor.done ? value.loc.start : cursor.value.loc.start, `Expected "]"`);
     }
     value.loc.end = cursor.value.loc.end;
     return [value, comments];
@@ -3218,6 +4000,21 @@ function getLine(lines, index) {
     return lines[index - 1];
 }
 
+/**
+ * Recursively tracks all nested inline tables within an inline table.
+ * This ensures that nested inline tables like { nest = {} } are also tracked as immutable.
+ */
+function trackNestedInlineTables(inlineTable, basePath, inlineTables) {
+    for (const item of inlineTable.items) {
+        const keyValue = item.item;
+        const fullPath = basePath.concat(keyValue.key.value);
+        if (keyValue.value.type === NodeType.InlineTable) {
+            inlineTables.add(joinKey(fullPath));
+            // Recursively track nested inline tables
+            trackNestedInlineTables(keyValue.value, fullPath, inlineTables);
+        }
+    }
+}
 /**
  * Converts the given AST to a JavaScript object.
  *
@@ -3230,13 +4027,16 @@ function toJS(ast, input = '') {
     const tables = new Set();
     const table_arrays = new Set();
     const defined = new Set();
+    const implicit_tables = new Set();
+    const inline_tables = new Set();
     let active = result;
     let skip_depth = 0;
+    let active_path = [];
     traverse(ast, {
         [NodeType.Table](node) {
             const key = node.key.item.value;
             try {
-                validateKey(result, key, node.type, { tables, table_arrays, defined });
+                validateKey(result, [], key, node.type, { tables, table_arrays, defined, implicit_tables, inline_tables });
             }
             catch (err) {
                 const e = err;
@@ -3246,11 +4046,12 @@ function toJS(ast, input = '') {
             tables.add(joined_key);
             defined.add(joined_key);
             active = ensureTable(result, key);
+            active_path = key;
         },
         [NodeType.TableArray](node) {
             const key = node.key.item.value;
             try {
-                validateKey(result, key, node.type, { tables, table_arrays, defined });
+                validateKey(result, [], key, node.type, { tables, table_arrays, defined, implicit_tables, inline_tables });
             }
             catch (err) {
                 const e = err;
@@ -3260,6 +4061,7 @@ function toJS(ast, input = '') {
             table_arrays.add(joined_key);
             defined.add(joined_key);
             active = ensureTableArray(result, key);
+            active_path = key;
         },
         [NodeType.KeyValue]: {
             enter(node) {
@@ -3267,16 +4069,48 @@ function toJS(ast, input = '') {
                     return;
                 const key = node.key.value;
                 try {
-                    validateKey(active, key, node.type, { tables, table_arrays, defined });
+                    validateKey(active, active_path, key, node.type, {
+                        tables,
+                        table_arrays,
+                        defined,
+                        implicit_tables,
+                        inline_tables
+                    });
                 }
                 catch (err) {
                     const e = err;
                     throw new ParseError(input, node.key.loc.start, e.message);
                 }
-                const value = toValue(node.value);
+                // Track implicit tables created by dotted keys.
+                // Example: within [fruit], `apple.color = ...` implicitly defines tables `fruit.apple`.
+                // Example: `type.name = ...` implicitly defines table `product.type`.
+                if (key.length > 1) {
+                    for (let i = 1; i < key.length; i++) {
+                        const implicit = joinKey(active_path.concat(key.slice(0, i)));
+                        implicit_tables.add(implicit);
+                        defined.add(implicit);
+                    }
+                }
+                let value;
+                try {
+                    value = toValue(node.value);
+                }
+                catch (err) {
+                    // Convert plain Errors from toValue() to ParseErrors with location info
+                    const e = err;
+                    throw new ParseError(input, node.value.loc.start, e.message);
+                }
+                // Inline tables are immutable in TOML: once defined, they cannot be extended.
+                // Track their key path so later dotted keys can be rejected.
+                if (node.value.type === NodeType.InlineTable) {
+                    const base_path = active_path.concat(key);
+                    inline_tables.add(joinKey(base_path));
+                    // Also track nested inline tables within this inline table
+                    trackNestedInlineTables(node.value, base_path, inline_tables);
+                }
                 const target = key.length > 1 ? ensureTable(active, key.slice(0, -1)) : active;
                 target[last(key)] = value;
-                defined.add(joinKey(key));
+                defined.add(joinKey(active_path.concat(key)));
             }
         },
         [NodeType.InlineTable]: {
@@ -3295,9 +4129,39 @@ function toValue(node) {
     switch (node.type) {
         case NodeType.InlineTable:
             const result = blank();
+            const defined_keys = new Set();
+            const defined_prefixes = new Map(); // prefix -> one of the full keys that uses it
             node.items.forEach(({ item }) => {
                 const key = item.key.value;
                 const value = toValue(item.value);
+                // Check for duplicate keys and conflicting key paths
+                const full_key = joinKey(key);
+                // Check if this exact key was already defined
+                if (defined_keys.has(full_key)) {
+                    throw new Error(`Duplicate key "${full_key}" in inline table`);
+                }
+                // Check if any prefix of this key conflicts with an existing key
+                // e.g., if "a.b" is defined, we can't later define "a.b.c" (would overwrite the value)
+                for (let i = 1; i < key.length; i++) {
+                    const prefix = joinKey(key.slice(0, i));
+                    if (defined_keys.has(prefix)) {
+                        throw new Error(`Key "${full_key}" conflicts with already defined key "${prefix}" in inline table`);
+                    }
+                }
+                // Check if this key is a prefix of an already defined key
+                // e.g., if "a.b.c" is defined, we can't later define "a.b" (would overwrite the table)
+                if (defined_prefixes.has(full_key)) {
+                    const existing = defined_prefixes.get(full_key);
+                    throw new Error(`Key "${full_key}" conflicts with already defined key "${existing}" in inline table`);
+                }
+                defined_keys.add(full_key);
+                // Track all prefixes of this key
+                for (let i = 1; i < key.length; i++) {
+                    const prefix = joinKey(key.slice(0, i));
+                    if (!defined_prefixes.has(prefix)) {
+                        defined_prefixes.set(prefix, full_key);
+                    }
+                }
                 const target = key.length > 1 ? ensureTable(result, key.slice(0, -1)) : result;
                 target[last(key)] = value;
             });
@@ -3318,7 +4182,67 @@ function toValue(node) {
             throw new Error(`Unrecognized value type "${node.type}"`);
     }
 }
-function validateKey(object, key, type, state) {
+function validateKey(object, prefix, key, type, state) {
+    const full_key = prefix.concat(key);
+    const joined_full_key = joinKey(full_key);
+    // 0. Inline tables are immutable.
+    // Once a key is assigned an inline table, it cannot be extended by dotted keys or table headers.
+    // (toml-test invalid: spec-1.1.0/common-49-0, inline-table/overwrite-02, inline-table/overwrite-05)
+    if (type === NodeType.KeyValue && key.length > 1) {
+        for (let i = 1; i < key.length; i++) {
+            const candidate = joinKey(prefix.concat(key.slice(0, i)));
+            if (state.inline_tables.has(candidate)) {
+                throw new Error(`Invalid key, cannot extend an inline table at ${candidate}`);
+            }
+        }
+    }
+    // Also check if a table header tries to extend an inline table
+    if ((type === NodeType.Table || type === NodeType.TableArray) && state.inline_tables.has(joined_full_key)) {
+        throw new Error(`Invalid key, cannot extend an inline table at ${joined_full_key}`);
+    }
+    // Check if table header path contains an inline table
+    if (type === NodeType.Table || type === NodeType.TableArray) {
+        for (let i = 1; i < key.length; i++) {
+            const candidate = joinKey(prefix.concat(key.slice(0, i)));
+            if (state.inline_tables.has(candidate)) {
+                throw new Error(`Invalid key, cannot extend an inline table at ${candidate}`);
+            }
+        }
+    }
+    // 0a. Dotted key-value assignments cannot traverse into an array-of-tables.
+    // This would be ambiguous (which element?) and is rejected by toml-test's
+    // append-with-dotted-keys fixtures.
+    if (type === NodeType.KeyValue && key.length > 1) {
+        for (let i = 1; i < key.length; i++) {
+            const candidate = joinKey(prefix.concat(key.slice(0, i)));
+            if (state.table_arrays.has(candidate)) {
+                throw new Error(`Invalid key, cannot traverse into an array of tables at ${candidate}`);
+            }
+        }
+    }
+    // 0b. Tables created implicitly by dotted keys cannot be re-opened via table headers.
+    // (toml-test invalid: spec-1.1.0/common-46-0 and common-46-1)
+    if ((type === NodeType.Table || type === NodeType.TableArray) && state.implicit_tables.has(joined_full_key)) {
+        throw new Error(`Invalid key, a table has already been defined implicitly named ${joined_full_key}`);
+    }
+    // 0c. A table path cannot later be re-assigned as a value.
+    // Example: `type.name = "Nail"` then `type = { edible = false }` is invalid.
+    // Example: `a.b.c = 1` then `a.b = 2` is invalid (a.b was implicitly created as a table).
+    // (toml-test invalid: spec-1.1.0/common-50-0, table/append-with-dotted-keys-05)
+    if (type === NodeType.KeyValue && state.implicit_tables.has(joined_full_key)) {
+        throw new Error(`Invalid key, a table has already been defined named ${joined_full_key}`);
+    }
+    // 0d. Dotted keys cannot extend tables that were explicitly defined earlier.
+    // Example: `[a.b.c]` followed by `[a]` then `b.c.t = "value"` is invalid.
+    // (toml-test invalid: table/append-with-dotted-keys-01, table/append-with-dotted-keys-02)
+    if (type === NodeType.KeyValue && key.length > 1) {
+        for (let i = 1; i <= key.length; i++) {
+            const candidate = joinKey(prefix.concat(key.slice(0, i)));
+            if (state.tables.has(candidate)) {
+                throw new Error(`Invalid key, cannot add to an explicitly defined table ${candidate} using dotted keys`);
+            }
+        }
+    }
     // 1. Cannot override primitive value
     let parts = [];
     let index = 0;
@@ -3327,20 +4251,28 @@ function validateKey(object, key, type, state) {
         if (!has(object, part))
             return;
         if (isPrimitive(object[part])) {
-            throw new Error(`Invalid key, a value has already been defined for ${parts.join('.')}`);
+            const fullKey = joinKey(prefix.concat(parts));
+            throw new Error(`Invalid key, a value has already been defined for ${fullKey}`);
         }
-        const joined_parts = joinKey(parts);
+        const joined_parts = joinKey(prefix.concat(parts));
         if (Array.isArray(object[part]) && !state.table_arrays.has(joined_parts)) {
             throw new Error(`Invalid key, cannot add to a static array at ${joined_parts}`);
         }
         const next_is_last = index++ < key.length - 1;
         object = Array.isArray(object[part]) && next_is_last ? last(object[part]) : object[part];
     }
-    const joined_key = joinKey(key);
+    const joined_key = joined_full_key;
     // 2. Cannot override table
     if (object && type === NodeType.Table && state.defined.has(joined_key)) {
         throw new Error(`Invalid key, a table has already been defined named ${joined_key}`);
     }
+    // 2b. Cannot assign a value to a path that is already a table (explicit or implicit).
+    if (object && type === NodeType.KeyValue && key.length === 1 && state.defined.has(joined_key)) {
+        // If the path exists as a structured value, overriding it is invalid.
+        if (!isPrimitive(object)) {
+            throw new Error(`Invalid key, a table has already been defined named ${joined_key}`);
+        }
+    }
     // 3. Cannot add table array to static array or table
     if (object && type === NodeType.TableArray && !state.table_arrays.has(joined_key)) {
         throw new Error(`Invalid key, cannot add an array of tables to a table at ${joined_key}`);