@o3co/ts.hocon 1.11.0 → 1.12.0

package/README.md

@@ -265,12 +265,12 @@ Supported byte units: `B`, `KB`/`KiB`, `MB`/`MiB`, `GB`/`GiB`, `TB`/`TiB` (and l
 
 ## Spec Compliance
 
-Conformance against the [Lightbend HOCON specification](https://github.com/lightbend/config/blob/main/HOCON.md) is tracked at item granularity in [`docs/spec-compliance.md`](docs/spec-compliance.md). The table below is a snapshot as of 2026-05-13; see [`xx.hocon/docs/compliance-matrix.md`](https://github.com/o3co/xx.hocon/blob/main/docs/compliance-matrix.md) for live cross-impl values.
+Conformance against the [Lightbend HOCON specification](https://github.com/lightbend/config/blob/main/HOCON.md) is tracked at item granularity in [`docs/spec-compliance.md`](docs/spec-compliance.md), which is the source these rates are computed from — `tests/docs.test.ts` recomputes them and fails the build if this table drifts. See [`xx.hocon/docs/compliance-matrix.md`](https://github.com/o3co/xx.hocon/blob/main/docs/compliance-matrix.md) for the cross-implementation roll-up.
 
 | Metric                                | Status        |
 | ------------------------------------- | ------------- |
-| Spec total (incl. out-of-scope)       | **74.2%**     |
-| In-scope only                         | **83.3%**     |
+| Spec total (incl. out-of-scope)       | **89.3%**     |
+| In-scope only                         | **99.2%**     |
 | Lightbend `test01`–`test13` suite     | 13/13 passing |
 
 **Extra-spec conventions (E-series) — implementation status:**
@@ -289,10 +289,6 @@ Supported since v0.2.0 (P1):
 
 - `.properties` file parsing
 
-### Stricter than Lightbend
-
-- **S8.6 leading-hyphen rejection** (Unreleased): `a = -foo`, `a = -bar`, `a = -` etc. now raise a lex error per HOCON.md L270–276, where Lightbend silently falls back to unquoted strings. Mitigation: quote the value (`a = "-foo"`). See [CHANGELOG](CHANGELOG.md#unreleased) and [`docs/spec-compliance.md`](docs/spec-compliance.md) §S8.6.
-
 ## Performance
 
 ### ts.hocon Parsing Cost
@@ -325,7 +321,7 @@ For typical application configs (loaded once at startup), the parsing cost is ne
 
 ### Feature Comparison with node-config
 
-ts.hocon provides significantly richer configuration capabilities compared to [node-config](https://github.com/node-config/node-config) (JSON):
+Feature-level comparison with [node-config](https://github.com/node-config/node-config) **v4.4.2** reading JSON config files, as of 2026-07-26:
 
 | Feature | ts.hocon | node-config (JSON) |
 |---|---|---|
@@ -498,6 +494,15 @@ When parsing untrusted HOCON input, be aware of:
 - **Path traversal in includes:** a relative `include` path resolves against `baseDir` and can climb out of it with `..` segments to reach sensitive files such as `/etc/passwd`. Use a custom `readFileSync`/`readFile` that validates paths if parsing untrusted input.
 - **Input size:** The parser has no built-in input size limit. For untrusted input, validate size before calling `parse()`.
 - **Include depth:** Limited to 50 levels to prevent stack overflow from deep include chains.
+- **Mapped path depth:** an environment variable's `__` segments and a
+  `.properties` dotted key are limited to 64 segments. One name produces one
+  arbitrarily deep chain, so without the cap a single long variable name was
+  enough to exhaust the stack. rs.hocon and py.hocon cap the same mapping at 64.
+- **Document nesting depth:** not capped. A document nested past what the
+  engine's stack holds fails as `ParseError` or `ConfigError` — never as a bare
+  `RangeError` — but the depth at which that happens depends on how deep the
+  calling code already is, so validate size before parsing untrusted input (see
+  above) rather than relying on a fixed level.
 - **Prototype pollution:** keys named `__proto__`, `constructor` or `prototype`
   are **kept as ordinary keys** — a `.properties` file or environment variable
   may legitimately use them, and dropping them would be silent data loss.

package/dist/adapters/env.cjs

@@ -557,6 +557,31 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/internal/properties/properties.ts
 function nestPairs(pairs) {
   const root = /* @__PURE__ */ Object.create(null);
@@ -1570,7 +1595,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }
@@ -1670,13 +1698,14 @@ function parseDotEnv(input, opts = {}) {
   for (let i = 0; i < lines.length; i++) {
     const raw = (lines[i] ?? "").trim();
     if (raw === "" || raw.startsWith("#")) continue;
-    const line = raw.startsWith("export ") ? raw.slice("export ".length) : raw;
+    const line = stripExport(raw);
     const eq = line.indexOf("=");
     if (eq === -1) throw new ConfigError(`${origin}:${i + 1}: expected NAME=value`, "");
     const name = line.slice(0, eq).trim();
     if (name === "") throw new ConfigError(`${origin}:${i + 1}: empty variable name`, "");
-    const value = dotEnvValue(line.slice(eq + 1).replace(/^[ \t]+/, ""), origin, i + 1, name);
     if (!name.startsWith(prefix)) continue;
+    checkName(name, origin, i + 1);
+    const value = dotEnvValue(line.slice(eq + 1).replace(/^[ \t]+/, ""), origin, i + 1, name);
     pairs.push([toPath(name.slice(prefix.length)), value]);
   }
   return fromMap(nestPairs(pairs), origin);
@@ -1686,6 +1715,12 @@ function toPath(name) {
   if (segs.some((s) => s === "")) {
     throw new ConfigError(`env: "${name}" produces an empty path segment`, name);
   }
+  if (tooDeep(segs.length)) {
+    throw new ConfigError(
+      `env: "${name}" maps to a path ${segs.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+      name
+    );
+  }
   return segs;
 }
 function asciiLower(s) {
@@ -1731,6 +1766,20 @@ function dotEnvValue(v, origin, line, name) {
   }
   return trimmed;
 }
+function stripExport(line) {
+  const m = /^export[ \t]+/.exec(line);
+  return m ? line.slice(m[0].length) : line;
+}
+function checkName(name, origin, line) {
+  const bad = /\p{White_Space}|#/u.exec(name);
+  if (bad) {
+    const what = bad[0] === "#" ? "'#'" : "whitespace";
+    throw new ConfigError(
+      `${origin}:${line}: variable name "${name}" contains ${what}; the line is not NAME=value (spec F1.7)`,
+      name
+    );
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   loadEnv,

package/dist/adapters/env.js

@@ -520,6 +520,31 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/internal/properties/properties.ts
 function nestPairs(pairs) {
   const root = /* @__PURE__ */ Object.create(null);
@@ -1533,7 +1558,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }
@@ -1633,13 +1661,14 @@ function parseDotEnv(input, opts = {}) {
   for (let i = 0; i < lines.length; i++) {
     const raw = (lines[i] ?? "").trim();
     if (raw === "" || raw.startsWith("#")) continue;
-    const line = raw.startsWith("export ") ? raw.slice("export ".length) : raw;
+    const line = stripExport(raw);
     const eq = line.indexOf("=");
     if (eq === -1) throw new ConfigError(`${origin}:${i + 1}: expected NAME=value`, "");
     const name = line.slice(0, eq).trim();
     if (name === "") throw new ConfigError(`${origin}:${i + 1}: empty variable name`, "");
-    const value = dotEnvValue(line.slice(eq + 1).replace(/^[ \t]+/, ""), origin, i + 1, name);
     if (!name.startsWith(prefix)) continue;
+    checkName(name, origin, i + 1);
+    const value = dotEnvValue(line.slice(eq + 1).replace(/^[ \t]+/, ""), origin, i + 1, name);
     pairs.push([toPath(name.slice(prefix.length)), value]);
   }
   return fromMap(nestPairs(pairs), origin);
@@ -1649,6 +1678,12 @@ function toPath(name) {
   if (segs.some((s) => s === "")) {
     throw new ConfigError(`env: "${name}" produces an empty path segment`, name);
   }
+  if (tooDeep(segs.length)) {
+    throw new ConfigError(
+      `env: "${name}" maps to a path ${segs.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+      name
+    );
+  }
   return segs;
 }
 function asciiLower(s) {
@@ -1694,6 +1729,20 @@ function dotEnvValue(v, origin, line, name) {
   }
   return trimmed;
 }
+function stripExport(line) {
+  const m = /^export[ \t]+/.exec(line);
+  return m ? line.slice(m[0].length) : line;
+}
+function checkName(name, origin, line) {
+  const bad = /\p{White_Space}|#/u.exec(name);
+  if (bad) {
+    const what = bad[0] === "#" ? "'#'" : "whitespace";
+    throw new ConfigError(
+      `${origin}:${line}: variable name "${name}" contains ${what}; the line is not NAME=value (spec F1.7)`,
+      name
+    );
+  }
+}
 export {
   loadEnv,
   parseDotEnv

package/dist/adapters/jsonc.cjs

@@ -557,6 +557,27 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/value/numeric-array.ts
 function numericObjectToArray(value) {
   if (value.kind !== "object") return null;
@@ -1535,7 +1556,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }
@@ -1600,7 +1624,10 @@ function coerceValue(v, atPath) {
 
 // src/adapters/jsonc.ts
 function parseJsonc(input, originDescription) {
-  const doc = JSON.parse(stripTrailingCommas(stripComments(stripBom(input))), bigIntReviver);
+  const doc = guardStackDepth(
+    () => JSON.parse(stripTrailingCommas(stripComments(stripBom(input))), bigIntReviver),
+    (msg) => depthError(`jsonc: ${msg}`)
+  );
   if (doc === null || typeof doc !== "object" || Array.isArray(doc)) {
     throw new ConfigError(
       `jsonc: document root is ${Array.isArray(doc) ? "an array" : typeof doc}, but a config root must be an object (spec F0.3)`,

package/dist/adapters/jsonc.d.cts

@@ -20,7 +20,18 @@ import { C as Config } from '../config-Dlq6rF3w.cjs';
  * the JS number model, as they do for HOCON's own literals, so read large
  * identifiers with `getString`.
  *
- * See docs/specs/format-ingestion-mapping.md items F3.x in the hocon scope.
+ * **An unpaired `\uXXXX` surrogate is accepted here and refused by go.hocon,
+ * py.hocon and rs.hocon** (F3.5). That is deliberate, and the same divergence
+ * the properties adapter already carries under F2.8: a JavaScript string is
+ * UTF-16, like Java's, so it holds a lone surrogate natively and round-trips it.
+ * A Go or Rust string cannot hold one at all — Go silently substituted U+FFFD
+ * until F3.5 — and a Python `str` can hold one but cannot encode it as UTF-8,
+ * so all three refuse rather than defer the failure. Refusing here would mean
+ * this spec overriding the host language rather than protecting the user; see
+ * S1.2.6 for the class.
+ *
+ * See the F3.x items in the format-ingestion mapping spec:
+ * https://github.com/o3co/xx.hocon/blob/main/docs/format-ingestion-mapping.md
  */
 declare function parseJsonc(input: string, originDescription?: string): Config;
 /**

package/dist/adapters/jsonc.d.ts

@@ -20,7 +20,18 @@ import { C as Config } from '../config-Dlq6rF3w.js';
  * the JS number model, as they do for HOCON's own literals, so read large
  * identifiers with `getString`.
  *
- * See docs/specs/format-ingestion-mapping.md items F3.x in the hocon scope.
+ * **An unpaired `\uXXXX` surrogate is accepted here and refused by go.hocon,
+ * py.hocon and rs.hocon** (F3.5). That is deliberate, and the same divergence
+ * the properties adapter already carries under F2.8: a JavaScript string is
+ * UTF-16, like Java's, so it holds a lone surrogate natively and round-trips it.
+ * A Go or Rust string cannot hold one at all — Go silently substituted U+FFFD
+ * until F3.5 — and a Python `str` can hold one but cannot encode it as UTF-8,
+ * so all three refuse rather than defer the failure. Refusing here would mean
+ * this spec overriding the host language rather than protecting the user; see
+ * S1.2.6 for the class.
+ *
+ * See the F3.x items in the format-ingestion mapping spec:
+ * https://github.com/o3co/xx.hocon/blob/main/docs/format-ingestion-mapping.md
  */
 declare function parseJsonc(input: string, originDescription?: string): Config;
 /**

package/dist/adapters/jsonc.js

@@ -520,6 +520,27 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/value/numeric-array.ts
 function numericObjectToArray(value) {
   if (value.kind !== "object") return null;
@@ -1498,7 +1519,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }
@@ -1563,7 +1587,10 @@ function coerceValue(v, atPath) {
 
 // src/adapters/jsonc.ts
 function parseJsonc(input, originDescription) {
-  const doc = JSON.parse(stripTrailingCommas(stripComments(stripBom(input))), bigIntReviver);
+  const doc = guardStackDepth(
+    () => JSON.parse(stripTrailingCommas(stripComments(stripBom(input))), bigIntReviver),
+    (msg) => depthError(`jsonc: ${msg}`)
+  );
   if (doc === null || typeof doc !== "object" || Array.isArray(doc)) {
     throw new ConfigError(
       `jsonc: document root is ${Array.isArray(doc) ? "an array" : typeof doc}, but a config root must be an object (spec F0.3)`,

package/dist/adapters/properties.cjs

@@ -565,6 +565,31 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/internal/properties/properties.ts
 function parseProperties(input) {
   const pairs = [];
@@ -572,7 +597,15 @@ function parseProperties(input) {
     const [rawKey, rawValue] = splitKeyValue(text);
     const key = unescapeProps(rawKey, line);
     if (key === "") continue;
-    pairs.push([key.split("."), unescapeProps(rawValue, line)]);
+    const segments = key.split(".");
+    if (tooDeep(segments.length)) {
+      throw new ParseError(
+        `key maps to a path ${segments.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+        line,
+        1
+      );
+    }
+    pairs.push([segments, unescapeProps(rawValue, line)]);
   }
   return nestPairs(pairs);
 }
@@ -1671,7 +1704,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }

package/dist/adapters/properties.js

@@ -529,6 +529,31 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/internal/properties/properties.ts
 function parseProperties(input) {
   const pairs = [];
@@ -536,7 +561,15 @@ function parseProperties(input) {
     const [rawKey, rawValue] = splitKeyValue(text);
     const key = unescapeProps(rawKey, line);
     if (key === "") continue;
-    pairs.push([key.split("."), unescapeProps(rawValue, line)]);
+    const segments = key.split(".");
+    if (tooDeep(segments.length)) {
+      throw new ParseError(
+        `key maps to a path ${segments.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+        line,
+        1
+      );
+    }
+    pairs.push([segments, unescapeProps(rawValue, line)]);
   }
   return nestPairs(pairs);
 }
@@ -1635,7 +1668,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }

package/dist/adapters/toml.cjs

@@ -557,6 +557,27 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/value/numeric-array.ts
 function numericObjectToArray(value) {
   if (value.kind !== "object") return null;
@@ -1535,7 +1556,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }
@@ -1601,7 +1625,13 @@ function coerceValue(v, atPath) {
 // src/adapters/toml.ts
 function parseTomlConfig(input, originDescription) {
   const doc = (0, import_smol_toml.parse)(stripBom(input));
-  return fromMap(convert(doc, ""), originDescription);
+  return fromMap(
+    guardStackDepth(
+      () => convert(doc, ""),
+      (msg) => depthError(`toml: ${msg}`)
+    ),
+    originDescription
+  );
 }
 function convert(v, atPath) {
   if (Array.isArray(v)) return v.map((e, i) => convert(e, `${atPath}[${i}]`));

package/dist/adapters/toml.d.cts

@@ -11,7 +11,8 @@ import { C as Config } from '../config-Dlq6rF3w.cjs';
  * the safe-integer range is an error here rather than silently rounded — go's
  * adapter accepts those, its int64 being wide enough (spec F0.5).
  *
- * See docs/specs/format-ingestion-mapping.md items F4.x in the hocon scope.
+ * See the F4.x items in the format-ingestion mapping spec:
+ * https://github.com/o3co/xx.hocon/blob/main/docs/format-ingestion-mapping.md
  */
 declare function parseTomlConfig(input: string, originDescription?: string): Config;
 

package/dist/adapters/toml.d.ts

@@ -11,7 +11,8 @@ import { C as Config } from '../config-Dlq6rF3w.js';
  * the safe-integer range is an error here rather than silently rounded — go's
  * adapter accepts those, its int64 being wide enough (spec F0.5).
  *
- * See docs/specs/format-ingestion-mapping.md items F4.x in the hocon scope.
+ * See the F4.x items in the format-ingestion mapping spec:
+ * https://github.com/o3co/xx.hocon/blob/main/docs/format-ingestion-mapping.md
  */
 declare function parseTomlConfig(input: string, originDescription?: string): Config;
 

package/dist/adapters/toml.js

@@ -523,6 +523,27 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/value/numeric-array.ts
 function numericObjectToArray(value) {
   if (value.kind !== "object") return null;
@@ -1501,7 +1522,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }
@@ -1567,7 +1591,13 @@ function coerceValue(v, atPath) {
 // src/adapters/toml.ts
 function parseTomlConfig(input, originDescription) {
   const doc = parseToml(stripBom(input));
-  return fromMap(convert(doc, ""), originDescription);
+  return fromMap(
+    guardStackDepth(
+      () => convert(doc, ""),
+      (msg) => depthError(`toml: ${msg}`)
+    ),
+    originDescription
+  );
 }
 function convert(v, atPath) {
   if (Array.isArray(v)) return v.map((e, i) => convert(e, `${atPath}[${i}]`));

package/dist/adapters/yaml.cjs

@@ -558,6 +558,27 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/value/numeric-array.ts
 function numericObjectToArray(value) {
   if (value.kind !== "object") return null;
@@ -1536,7 +1557,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }
@@ -1613,11 +1637,14 @@ function parseYaml(input, originDescription) {
   if (doc.errors.length > 0) {
     throw new ConfigError(`yaml: ${doc.errors[0]?.message ?? "parse error"}`, "");
   }
-  return fromYamlValue(doc.toJS({ mapAsMap: false }), originDescription);
+  return fromYamlValue(doc.toJS({ mapAsMap: true }), originDescription);
 }
 function fromYamlValue(value, originDescription) {
   if (value === null || value === void 0) return fromMap({}, originDescription);
-  const normalized = convert(value, "");
+  const normalized = guardStackDepth(
+    () => convert(value, ""),
+    (msg) => depthError(`yaml: ${msg}`)
+  );
   if (typeof normalized !== "object" || normalized === null || Array.isArray(normalized)) {
     throw new ConfigError(
       `yaml: document root is ${Array.isArray(normalized) ? "an array" : typeof normalized}, but a config root must be an object (spec F0.3)`,
@@ -1633,6 +1660,7 @@ function convert(v, atPath) {
   }
   if (v instanceof Map) {
     const entries = [];
+    const seen = /* @__PURE__ */ new Map();
     for (const [k, e] of v) {
       if (k !== null && typeof k === "object") {
         throw new ConfigError(
@@ -1641,6 +1669,13 @@ function convert(v, atPath) {
         );
       }
       const key = String(k);
+      if (seen.has(key)) {
+        throw new ConfigError(
+          `yaml: sibling mapping keys ${keyForm(seen.get(key))} and ${keyForm(k)} both give the key "${key}"${atPath === "" ? "" : ` at "${atPath}"`}; rename one of them, because one of the two values would otherwise be lost. Quoting a non-string key helps only where that changes the key text, as 0x10 does and 1 does not (spec F5.3)`,
+          atPath
+        );
+      }
+      seen.set(key, k);
       entries.push([key, convert(e, atPath === "" ? key : `${atPath}.${key}`)]);
     }
     return Object.fromEntries(entries);
@@ -1674,6 +1709,10 @@ function bytesToBase64(bytes) {
   }
   return btoa(binary);
 }
+function keyForm(k) {
+  if (typeof k === "string") return JSON.stringify(k);
+  return `${String(k)} (${k === null ? "null" : typeof k})`;
+}
 var MAX_SAFE = BigInt(Number.MAX_SAFE_INTEGER);
 var MIN_SAFE = BigInt(Number.MIN_SAFE_INTEGER);
 function isSafeIntegerBigInt(v) {

package/dist/adapters/yaml.d.cts

@@ -29,7 +29,8 @@ import { C as Config } from '../config-Dlq6rF3w.cjs';
  * than rounded. `getNumber` and `toObject` still apply the JS number model, so
  * read large identifiers with `getString`.
  *
- * See docs/specs/format-ingestion-mapping.md items F5.x in the hocon scope.
+ * See the F5.x items in the format-ingestion mapping spec:
+ * https://github.com/o3co/xx.hocon/blob/main/docs/format-ingestion-mapping.md
  */
 declare function parseYaml(input: string, originDescription?: string): Config;
 /**

package/dist/adapters/yaml.d.ts

@@ -29,7 +29,8 @@ import { C as Config } from '../config-Dlq6rF3w.js';
  * than rounded. `getNumber` and `toObject` still apply the JS number model, so
  * read large identifiers with `getString`.
  *
- * See docs/specs/format-ingestion-mapping.md items F5.x in the hocon scope.
+ * See the F5.x items in the format-ingestion mapping spec:
+ * https://github.com/o3co/xx.hocon/blob/main/docs/format-ingestion-mapping.md
  */
 declare function parseYaml(input: string, originDescription?: string): Config;
 /**

package/dist/adapters/yaml.js

@@ -523,6 +523,27 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/value/numeric-array.ts
 function numericObjectToArray(value) {
   if (value.kind !== "object") return null;
@@ -1501,7 +1522,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }
@@ -1578,11 +1602,14 @@ function parseYaml(input, originDescription) {
   if (doc.errors.length > 0) {
     throw new ConfigError(`yaml: ${doc.errors[0]?.message ?? "parse error"}`, "");
   }
-  return fromYamlValue(doc.toJS({ mapAsMap: false }), originDescription);
+  return fromYamlValue(doc.toJS({ mapAsMap: true }), originDescription);
 }
 function fromYamlValue(value, originDescription) {
   if (value === null || value === void 0) return fromMap({}, originDescription);
-  const normalized = convert(value, "");
+  const normalized = guardStackDepth(
+    () => convert(value, ""),
+    (msg) => depthError(`yaml: ${msg}`)
+  );
   if (typeof normalized !== "object" || normalized === null || Array.isArray(normalized)) {
     throw new ConfigError(
       `yaml: document root is ${Array.isArray(normalized) ? "an array" : typeof normalized}, but a config root must be an object (spec F0.3)`,
@@ -1598,6 +1625,7 @@ function convert(v, atPath) {
   }
   if (v instanceof Map) {
     const entries = [];
+    const seen = /* @__PURE__ */ new Map();
     for (const [k, e] of v) {
       if (k !== null && typeof k === "object") {
         throw new ConfigError(
@@ -1606,6 +1634,13 @@ function convert(v, atPath) {
         );
       }
       const key = String(k);
+      if (seen.has(key)) {
+        throw new ConfigError(
+          `yaml: sibling mapping keys ${keyForm(seen.get(key))} and ${keyForm(k)} both give the key "${key}"${atPath === "" ? "" : ` at "${atPath}"`}; rename one of them, because one of the two values would otherwise be lost. Quoting a non-string key helps only where that changes the key text, as 0x10 does and 1 does not (spec F5.3)`,
+          atPath
+        );
+      }
+      seen.set(key, k);
       entries.push([key, convert(e, atPath === "" ? key : `${atPath}.${key}`)]);
     }
     return Object.fromEntries(entries);
@@ -1639,6 +1674,10 @@ function bytesToBase64(bytes) {
   }
   return btoa(binary);
 }
+function keyForm(k) {
+  if (typeof k === "string") return JSON.stringify(k);
+  return `${String(k)} (${k === null ? "null" : typeof k})`;
+}
 var MAX_SAFE = BigInt(Number.MAX_SAFE_INTEGER);
 var MIN_SAFE = BigInt(Number.MIN_SAFE_INTEGER);
 function isSafeIntegerBigInt(v) {

package/dist/index.cjs

@@ -1548,6 +1548,39 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+async function guardStackDepthAsync(fn, wrap) {
+  try {
+    return await fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+
 // src/internal/properties/properties.ts
 function parseProperties(input) {
   const pairs = [];
@@ -1555,7 +1588,15 @@ function parseProperties(input) {
     const [rawKey, rawValue] = splitKeyValue(text);
     const key = unescapeProps(rawKey, line);
     if (key === "") continue;
-    pairs.push([key.split("."), unescapeProps(rawValue, line)]);
+    const segments = key.split(".");
+    if (tooDeep(segments.length)) {
+      throw new ParseError(
+        `key maps to a path ${segments.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+        line,
+        1
+      );
+    }
+    pairs.push([segments, unescapeProps(rawValue, line)]);
   }
   return nestPairs(pairs);
 }
@@ -3249,13 +3290,16 @@ function buildResolveContext(input, opts) {
   return { ast, resolveOpts };
 }
 function parse(input, opts = {}) {
-  const { ast, resolveOpts } = buildResolveContext(input, opts);
-  const value = resolve2(ast, resolveOpts);
-  if (value.kind !== "object") throw new Error("resolved value is not an object");
-  return new Config(value, { resolved: true, originDescription: opts.originDescription });
+  return parseStringWithOptions(input, opts);
 }
 var parseString = parse;
 function parseStringWithOptions(input, opts = {}) {
+  return guardStackDepth(
+    () => parseStringInner(input, opts),
+    (msg) => new ParseError(msg, 1, 1, opts.originDescription)
+  );
+}
+function parseStringInner(input, opts) {
   const resolveSubstitutions = opts.resolveSubstitutions ?? true;
   const { ast, resolveOpts } = buildResolveContext(input, opts);
   if (resolveSubstitutions) {
@@ -3286,10 +3330,12 @@ function parseFileWithOptions(filePath, opts = {}) {
   });
 }
 async function parseAsync(input, opts = {}) {
-  const { ast, resolveOpts } = buildResolveContext(input, opts);
-  const value = await resolveAsync(ast, resolveOpts);
-  if (value.kind !== "object") throw new Error("resolved value is not an object");
-  return new Config(value);
+  return guardStackDepthAsync(async () => {
+    const { ast, resolveOpts } = buildResolveContext(input, opts);
+    const value = await resolveAsync(ast, resolveOpts);
+    if (value.kind !== "object") throw new Error("resolved value is not an object");
+    return new Config(value);
+  }, (msg) => new ParseError(msg, 1, 1, opts.originDescription));
 }
 function parseFile(filePath, opts = {}) {
   if (typeof process === "undefined" && !opts.readFileSync) {
@@ -3350,7 +3396,10 @@ function isNull(v) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }

package/dist/index.js

@@ -1494,6 +1494,39 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+async function guardStackDepthAsync(fn, wrap) {
+  try {
+    return await fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+
 // src/internal/properties/properties.ts
 function parseProperties(input) {
   const pairs = [];
@@ -1501,7 +1534,15 @@ function parseProperties(input) {
     const [rawKey, rawValue] = splitKeyValue(text);
     const key = unescapeProps(rawKey, line);
     if (key === "") continue;
-    pairs.push([key.split("."), unescapeProps(rawValue, line)]);
+    const segments = key.split(".");
+    if (tooDeep(segments.length)) {
+      throw new ParseError(
+        `key maps to a path ${segments.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+        line,
+        1
+      );
+    }
+    pairs.push([segments, unescapeProps(rawValue, line)]);
   }
   return nestPairs(pairs);
 }
@@ -3194,13 +3235,16 @@ function buildResolveContext(input, opts) {
   return { ast, resolveOpts };
 }
 function parse(input, opts = {}) {
-  const { ast, resolveOpts } = buildResolveContext(input, opts);
-  const value = resolve2(ast, resolveOpts);
-  if (value.kind !== "object") throw new Error("resolved value is not an object");
-  return new Config(value, { resolved: true, originDescription: opts.originDescription });
+  return parseStringWithOptions(input, opts);
 }
 var parseString = parse;
 function parseStringWithOptions(input, opts = {}) {
+  return guardStackDepth(
+    () => parseStringInner(input, opts),
+    (msg) => new ParseError(msg, 1, 1, opts.originDescription)
+  );
+}
+function parseStringInner(input, opts) {
   const resolveSubstitutions = opts.resolveSubstitutions ?? true;
   const { ast, resolveOpts } = buildResolveContext(input, opts);
   if (resolveSubstitutions) {
@@ -3231,10 +3275,12 @@ function parseFileWithOptions(filePath, opts = {}) {
   });
 }
 async function parseAsync(input, opts = {}) {
-  const { ast, resolveOpts } = buildResolveContext(input, opts);
-  const value = await resolveAsync(ast, resolveOpts);
-  if (value.kind !== "object") throw new Error("resolved value is not an object");
-  return new Config(value);
+  return guardStackDepthAsync(async () => {
+    const { ast, resolveOpts } = buildResolveContext(input, opts);
+    const value = await resolveAsync(ast, resolveOpts);
+    if (value.kind !== "object") throw new Error("resolved value is not an object");
+    return new Config(value);
+  }, (msg) => new ParseError(msg, 1, 1, opts.originDescription));
 }
 function parseFile(filePath, opts = {}) {
   if (typeof process === "undefined" && !opts.readFileSync) {
@@ -3295,7 +3341,10 @@ function isNull(v) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }

package/dist/zod.cjs

@@ -1530,6 +1530,28 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+
 // src/internal/properties/properties.ts
 function parseProperties(input) {
   const pairs = [];
@@ -1537,7 +1559,15 @@ function parseProperties(input) {
     const [rawKey, rawValue] = splitKeyValue(text);
     const key = unescapeProps(rawKey, line);
     if (key === "") continue;
-    pairs.push([key.split("."), unescapeProps(rawValue, line)]);
+    const segments = key.split(".");
+    if (tooDeep(segments.length)) {
+      throw new ParseError(
+        `key maps to a path ${segments.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+        line,
+        1
+      );
+    }
+    pairs.push([segments, unescapeProps(rawValue, line)]);
   }
   return nestPairs(pairs);
 }
@@ -3216,10 +3246,30 @@ function buildResolveContext(input, opts) {
   return { ast, resolveOpts };
 }
 function parse(input, opts = {}) {
+  return parseStringWithOptions(input, opts);
+}
+function parseStringWithOptions(input, opts = {}) {
+  return guardStackDepth(
+    () => parseStringInner(input, opts),
+    (msg) => new ParseError(msg, 1, 1, opts.originDescription)
+  );
+}
+function parseStringInner(input, opts) {
+  const resolveSubstitutions = opts.resolveSubstitutions ?? true;
   const { ast, resolveOpts } = buildResolveContext(input, opts);
-  const value = resolve2(ast, resolveOpts);
-  if (value.kind !== "object") throw new Error("resolved value is not an object");
-  return new Config(value, { resolved: true, originDescription: opts.originDescription });
+  if (resolveSubstitutions) {
+    const value = resolve2(ast, resolveOpts);
+    if (value.kind !== "object") throw new Error("resolved value is not an object");
+    return new Config(value, { resolved: true, originDescription: opts.originDescription });
+  }
+  const tree = buildTree(ast, resolveOpts);
+  const hasPlaceholders = containsPlaceholders(tree);
+  return Config._fromUnresolvedResObj(tree, {
+    parseBaseDir: opts.baseDir,
+    originDescription: opts.originDescription,
+    resolved: !hasPlaceholders,
+    resolveOpts
+  });
 }
 function parseFile(filePath, opts = {}) {
   if (typeof process === "undefined" && !opts.readFileSync) {

package/dist/zod.js

@@ -1498,6 +1498,28 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+
 // src/internal/properties/properties.ts
 function parseProperties(input) {
   const pairs = [];
@@ -1505,7 +1527,15 @@ function parseProperties(input) {
     const [rawKey, rawValue] = splitKeyValue(text);
     const key = unescapeProps(rawKey, line);
     if (key === "") continue;
-    pairs.push([key.split("."), unescapeProps(rawValue, line)]);
+    const segments = key.split(".");
+    if (tooDeep(segments.length)) {
+      throw new ParseError(
+        `key maps to a path ${segments.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+        line,
+        1
+      );
+    }
+    pairs.push([segments, unescapeProps(rawValue, line)]);
   }
   return nestPairs(pairs);
 }
@@ -3183,10 +3213,30 @@ function buildResolveContext(input, opts) {
   return { ast, resolveOpts };
 }
 function parse(input, opts = {}) {
+  return parseStringWithOptions(input, opts);
+}
+function parseStringWithOptions(input, opts = {}) {
+  return guardStackDepth(
+    () => parseStringInner(input, opts),
+    (msg) => new ParseError(msg, 1, 1, opts.originDescription)
+  );
+}
+function parseStringInner(input, opts) {
+  const resolveSubstitutions = opts.resolveSubstitutions ?? true;
   const { ast, resolveOpts } = buildResolveContext(input, opts);
-  const value = resolve2(ast, resolveOpts);
-  if (value.kind !== "object") throw new Error("resolved value is not an object");
-  return new Config(value, { resolved: true, originDescription: opts.originDescription });
+  if (resolveSubstitutions) {
+    const value = resolve2(ast, resolveOpts);
+    if (value.kind !== "object") throw new Error("resolved value is not an object");
+    return new Config(value, { resolved: true, originDescription: opts.originDescription });
+  }
+  const tree = buildTree(ast, resolveOpts);
+  const hasPlaceholders = containsPlaceholders(tree);
+  return Config._fromUnresolvedResObj(tree, {
+    parseBaseDir: opts.baseDir,
+    originDescription: opts.originDescription,
+    resolved: !hasPlaceholders,
+    resolveOpts
+  });
 }
 function parseFile(filePath, opts = {}) {
   if (typeof process === "undefined" && !opts.readFileSync) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/ts.hocon",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "Full Lightbend HOCON spec-compliant parser and config library for TypeScript",
   "keywords": [
     "hocon",