@o3co/ts.hocon 1.11.0 → 1.13.0

package/dist/adapters/env.js

@@ -34,13 +34,22 @@ function coerceNumber(value) {
   return Number(value);
 }
 var DURATION_UNITS = {
+  // S19.1–S19.3: the bare nano/micro/milli (+plural) aliases are part of the
+  // spec's unit lists (HOCON.md L1307–L1309) and accepted by Lightbend
+  // (typesafe-config 1.4.6 probe, 2026-08-18); they were missing here.
   ns: 1e-6,
+  nano: 1e-6,
+  nanos: 1e-6,
   nanosecond: 1e-6,
   nanoseconds: 1e-6,
   us: 1e-3,
+  micro: 1e-3,
+  micros: 1e-3,
   microsecond: 1e-3,
   microseconds: 1e-3,
   ms: 1,
+  milli: 1,
+  millis: 1,
   millisecond: 1,
   milliseconds: 1,
   s: 1e3,
@@ -92,37 +101,76 @@ function parseDuration(value, outputUnit = "ms") {
   return ms / divisor;
 }
 var BYTE_UNITS = {
+  // S21.1–S21.4 — the EXACT Lightbend/typesafe-config unit set (1.4.6 probe,
+  // 2026-08-18). Multi-letter units are case-sensitive: the SI decimal short
+  // form is `kB` (NOT `KB`/`kb` — Lightbend rejects both), higher decimals
+  // are `MB`…`YB`, binary prefixes are `Ki`/`KiB`…`Yi`/`YiB` with capital
+  // first letter, and long forms are lowercase only (`kilobyte`, never
+  // `Kilobyte`). Only the bare byte unit (`B`/`b`) and the single-letter
+  // -Xmx forms accept both cases. The old case-insensitive fallback and the
+  // lowercase alias rows accepted spellings Lightbend rejects — removed.
   B: 1,
+  b: 1,
   byte: 1,
   bytes: 1,
-  KB: 1e3,
+  kB: 1e3,
   kilobyte: 1e3,
   kilobytes: 1e3,
-  KiB: 1024,
-  kibibyte: 1024,
-  kibibytes: 1024,
   MB: 1e6,
   megabyte: 1e6,
   megabytes: 1e6,
-  MiB: 1048576,
-  mebibyte: 1048576,
-  mebibytes: 1048576,
   GB: 1e9,
   gigabyte: 1e9,
   gigabytes: 1e9,
-  GiB: 1073741824,
-  gibibyte: 1073741824,
-  gibibytes: 1073741824,
   TB: 1e12,
   terabyte: 1e12,
   terabytes: 1e12,
+  PB: 1e15,
+  petabyte: 1e15,
+  petabytes: 1e15,
+  EB: 1e18,
+  exabyte: 1e18,
+  exabytes: 1e18,
+  ZB: 1e21,
+  zettabyte: 1e21,
+  zettabytes: 1e21,
+  YB: 1e24,
+  yottabyte: 1e24,
+  yottabytes: 1e24,
+  Ki: 1024,
+  KiB: 1024,
+  kibibyte: 1024,
+  kibibytes: 1024,
+  Mi: 1048576,
+  MiB: 1048576,
+  mebibyte: 1048576,
+  mebibytes: 1048576,
+  Gi: 1073741824,
+  GiB: 1073741824,
+  gibibyte: 1073741824,
+  gibibytes: 1073741824,
+  Ti: 1099511627776,
   TiB: 1099511627776,
   tebibyte: 1099511627776,
   tebibytes: 1099511627776,
-  // S21.4 — HOCON.md L1385: single-letter abbreviations → powers of two (java -Xmx convention).
-  // Lightbend typesafe-config 1.4.3 verified: 1K=1024, 1M=1048576, etc.
-  // Both upper- and lowercase accepted per Lightbend behaviour.
-  // Z/Y (2^70/2^80) are deferred — they overflow MAX_SAFE_INTEGER and require BigInt accessor.
+  Pi: 1024 ** 5,
+  PiB: 1024 ** 5,
+  pebibyte: 1024 ** 5,
+  pebibytes: 1024 ** 5,
+  Ei: 1024 ** 6,
+  EiB: 1024 ** 6,
+  exbibyte: 1024 ** 6,
+  exbibytes: 1024 ** 6,
+  Zi: 1024 ** 7,
+  ZiB: 1024 ** 7,
+  zebibyte: 1024 ** 7,
+  zebibytes: 1024 ** 7,
+  Yi: 1024 ** 8,
+  YiB: 1024 ** 8,
+  yobibyte: 1024 ** 8,
+  yobibytes: 1024 ** 8,
+  // S21.4 — single-letter abbreviations → powers of two (java -Xmx
+  // convention); Lightbend accepts BOTH cases here, through the full ladder.
   K: 1024,
   k: 1024,
   M: 1024 ** 2,
@@ -135,16 +183,10 @@ var BYTE_UNITS = {
   p: 1024 ** 5,
   E: 1024 ** 6,
   e: 1024 ** 6,
-  // lowercase short-form aliases
-  b: 1,
-  kb: 1e3,
-  kib: 1024,
-  mb: 1e6,
-  mib: 1048576,
-  gb: 1e9,
-  gib: 1073741824,
-  tb: 1e12,
-  tib: 1099511627776
+  Z: 1024 ** 7,
+  z: 1024 ** 7,
+  Y: 1024 ** 8,
+  y: 1024 ** 8
 };
 var OUTPUT_BYTE_UNITS = {
   B: 1,
@@ -182,10 +224,7 @@ function parseBytes(value, outputUnit = "B") {
     }
     return bytes2 / divisor;
   }
-  let mult = BYTE_UNITS[unit];
-  if (mult === void 0) {
-    mult = BYTE_UNITS[unit.toLowerCase()];
-  }
+  const mult = BYTE_UNITS[unit];
   if (mult === void 0) return NaN;
   const bytes = num * mult;
   if (Math.abs(bytes) > Number.MAX_SAFE_INTEGER) {
@@ -232,35 +271,114 @@ function stringSegmentsToKey(segments) {
     return t;
   }).join(".");
 }
+function prefixSelfRefRemainder(s, fullKey) {
+  const texts = s.segments.map((seg) => seg.text);
+  if (!stringSegmentsToKey(texts).startsWith(fullKey + ".")) return null;
+  for (let n = 1; n < texts.length; n++) {
+    if (stringSegmentsToKey(texts.slice(0, n)) === fullKey) return texts.slice(n);
+  }
+  return null;
+}
+function navigateResolverValue(v, remainder) {
+  let cur = v;
+  for (const seg of remainder) {
+    if (isSubst(cur) || isConcat(cur)) return null;
+    if (isResObj(cur)) {
+      const next = cur.fields.get(seg);
+      if (next === void 0) return void 0;
+      cur = next;
+      continue;
+    }
+    const hv = cur;
+    if (hv.kind === "object") {
+      const next = hv.fields.get(seg);
+      if (next === void 0) return void 0;
+      cur = next;
+      continue;
+    }
+    return void 0;
+  }
+  return cur;
+}
+function foldPrefixSelfRef(s, replacement, remainder) {
+  const navigated = navigateResolverValue(replacement, remainder);
+  if (navigated === null) return s;
+  if (navigated === void 0) {
+    return {
+      _kind: "subst-placeholder",
+      segments: s.segments.map((seg) => ({ text: seg.text, line: seg.line, col: seg.col })),
+      optional: s.optional,
+      knownAbsent: true,
+      listSuffix: s.listSuffix,
+      line: s.line,
+      col: s.col,
+      prefixLen: s.prefixLen
+    };
+  }
+  return cloneResolverValue(navigated);
+}
+function mergeResObjLayers(base, top) {
+  const fields = new Map(base.fields);
+  for (const [k, tv] of top.fields) {
+    const bv = fields.get(k);
+    if (bv !== void 0 && isResObj(bv) && isResObj(tv)) {
+      fields.set(k, mergeResObjLayers(bv, tv));
+    } else {
+      fields.set(k, tv);
+    }
+  }
+  const priorValues = new Map(base.priorValues);
+  for (const [k, pv] of top.priorValues) priorValues.set(k, pv);
+  const resetKeys = new Set(base.resetKeys);
+  for (const k of top.resetKeys) resetKeys.add(k);
+  return {
+    _kind: "res-obj",
+    fields,
+    priorValues,
+    resetKeys
+  };
+}
 function containsSelfRef(v, fullKey) {
-  if (isSubst(v)) return !v.knownAbsent && substFullKey(v) === fullKey;
-  if (isConcat(v)) return v.nodes.some((n) => containsSelfRef(n, fullKey));
+  return containsSelfRefInner(v, fullKey, true);
+}
+function containsSelfRefInner(v, fullKey, allowPrefix) {
+  if (isSubst(v))
+    return !v.knownAbsent && (substFullKey(v) === fullKey || allowPrefix && prefixSelfRefRemainder(v, fullKey) !== null);
+  if (isConcat(v)) return v.nodes.some((n) => containsSelfRefInner(n, fullKey, allowPrefix));
   if (isResObj(v)) {
     for (const f of v.fields.values()) {
-      if (containsSelfRef(f, fullKey)) return true;
+      if (containsSelfRefInner(f, fullKey, false)) return true;
     }
     return false;
   }
   const hv = v;
   if (hv.kind === "array") {
-    return hv.items.some((item) => containsSelfRef(item, fullKey));
+    return hv.items.some((item) => containsSelfRefInner(item, fullKey, allowPrefix));
   }
   if (hv.kind === "object") {
     for (const f of hv.fields.values()) {
-      if (containsSelfRef(f, fullKey)) return true;
+      if (containsSelfRefInner(f, fullKey, false)) return true;
     }
     return false;
   }
   return false;
 }
 function foldSelfRef(v, fullKey, replacement) {
+  return foldSelfRefInner(v, fullKey, replacement, true);
+}
+function foldSelfRefInner(v, fullKey, replacement, allowPrefix) {
   if (isSubst(v)) {
-    return substFullKey(v) === fullKey ? replacement : v;
+    if (substFullKey(v) === fullKey) return replacement;
+    if (allowPrefix) {
+      const remainder = prefixSelfRefRemainder(v, fullKey);
+      if (remainder !== null) return foldPrefixSelfRef(v, replacement, remainder);
+    }
+    return v;
   }
   if (isConcat(v)) {
     return {
       _kind: "concat-placeholder",
-      nodes: v.nodes.map((n) => foldSelfRef(n, fullKey, replacement)),
+      nodes: v.nodes.map((n) => foldSelfRefInner(n, fullKey, replacement, allowPrefix)),
       line: v.line,
       col: v.col
     };
@@ -268,7 +386,7 @@ function foldSelfRef(v, fullKey, replacement) {
   if (isResObj(v)) {
     const newFields = /* @__PURE__ */ new Map();
     for (const [k, val] of v.fields) {
-      newFields.set(k, foldSelfRef(val, fullKey, replacement));
+      newFields.set(k, foldSelfRefInner(val, fullKey, replacement, false));
     }
     return { _kind: "res-obj", fields: newFields, priorValues: new Map(v.priorValues), resetKeys: new Set(v.resetKeys) };
   }
@@ -276,13 +394,15 @@ function foldSelfRef(v, fullKey, replacement) {
   if (hv.kind === "array") {
     return {
       kind: "array",
-      items: hv.items.map((item) => foldSelfRef(item, fullKey, replacement))
+      items: hv.items.map(
+        (item) => foldSelfRefInner(item, fullKey, replacement, allowPrefix)
+      )
     };
   }
   if (hv.kind === "object") {
     const newFields = /* @__PURE__ */ new Map();
     for (const [k, val] of hv.fields) {
-      newFields.set(k, foldSelfRef(val, fullKey, replacement));
+      newFields.set(k, foldSelfRefInner(val, fullKey, replacement, false));
     }
     return { kind: "object", fields: newFields };
   }
@@ -291,10 +411,26 @@ function foldSelfRef(v, fullKey, replacement) {
 function foldOrSkipPrior(prior, fullKey, old) {
   if (!containsSelfRef(prior, fullKey)) return cloneResolverValue(prior);
   if (old === void 0) return foldOptionalSelfRefAbsent(prior, fullKey);
+  if (isSubst(prior)) {
+    const remainder = prefixSelfRefRemainder(prior, fullKey);
+    if (remainder !== null) {
+      const navigated = navigateResolverValue(old, remainder);
+      if (navigated === void 0 && prior.optional) return cloneResolverValue(old);
+      if (navigated !== null && navigated !== void 0 && isResObj(navigated) && isResObj(old)) {
+        return mergeResObjLayers(
+          cloneResolverValue(old),
+          cloneResolverValue(navigated)
+        );
+      }
+    }
+  }
   return foldSelfRef(prior, fullKey, old);
 }
 function foldOptionalSelfRefAbsent(v, fullKey) {
-  if (isSubst(v) && substFullKey(v) === fullKey) {
+  return foldOptionalSelfRefAbsentInner(v, fullKey, true);
+}
+function foldOptionalSelfRefAbsentInner(v, fullKey, allowPrefix) {
+  if (isSubst(v) && (substFullKey(v) === fullKey || allowPrefix && prefixSelfRefRemainder(v, fullKey) !== null)) {
     if (!v.optional) return void 0;
     return {
       _kind: "subst-placeholder",
@@ -310,7 +446,7 @@ function foldOptionalSelfRefAbsent(v, fullKey) {
   if (isConcat(v)) {
     const nodes = [];
     for (const node of v.nodes) {
-      const folded = foldOptionalSelfRefAbsent(node, fullKey);
+      const folded = foldOptionalSelfRefAbsentInner(node, fullKey, allowPrefix);
       if (folded === void 0) return void 0;
       nodes.push(folded);
     }
@@ -319,7 +455,7 @@ function foldOptionalSelfRefAbsent(v, fullKey) {
   if (isResObj(v)) {
     const fields = /* @__PURE__ */ new Map();
     for (const [key, value] of v.fields) {
-      const folded = foldOptionalSelfRefAbsent(value, fullKey);
+      const folded = foldOptionalSelfRefAbsentInner(value, fullKey, false);
       if (folded === void 0) return void 0;
       fields.set(key, folded);
     }
@@ -329,7 +465,7 @@ function foldOptionalSelfRefAbsent(v, fullKey) {
   if (hv.kind === "array") {
     const items = [];
     for (const item of hv.items) {
-      const folded = foldOptionalSelfRefAbsent(item, fullKey);
+      const folded = foldOptionalSelfRefAbsentInner(item, fullKey, allowPrefix);
       if (folded === void 0) return void 0;
       items.push(folded);
     }
@@ -338,7 +474,7 @@ function foldOptionalSelfRefAbsent(v, fullKey) {
   if (hv.kind === "object") {
     const fields = /* @__PURE__ */ new Map();
     for (const [key, value] of hv.fields) {
-      const folded = foldOptionalSelfRefAbsent(value, fullKey);
+      const folded = foldOptionalSelfRefAbsentInner(value, fullKey, false);
       if (folded === void 0) return void 0;
       fields.set(key, folded);
     }
@@ -520,6 +656,31 @@ function stripBom(input) {
   return input.charCodeAt(0) === 65279 ? input.slice(1) : input;
 }
 
+// src/internal/depth.ts
+var MAX_PATH_SEGMENTS = 64;
+function tooDeep(segments) {
+  return segments > MAX_PATH_SEGMENTS;
+}
+function guardStackDepth(fn, wrap) {
+  try {
+    return fn();
+  } catch (e) {
+    if (!isStackOverflow(e)) throw e;
+    throw wrap(STACK_MESSAGE);
+  }
+}
+var STACK_MESSAGE = "input is nested too deeply for this engine's stack, or contains a cycle (flatten the document, or break the cycle)";
+function isStackOverflow(e) {
+  if (!(e instanceof RangeError)) return false;
+  const m = e.message.toLowerCase();
+  return m.includes("call stack") || // V8: "Maximum call stack size exceeded"
+  m.includes("recursion") || // SpiderMonkey: "too much recursion"
+  m.includes("stack overflow");
+}
+function depthError(message) {
+  return new ConfigError(message, "");
+}
+
 // src/internal/properties/properties.ts
 function nestPairs(pairs) {
   const root = /* @__PURE__ */ Object.create(null);
@@ -609,6 +770,12 @@ var SubstitutionResolver = class {
     // Cross-impl with rs.hocon v1.5.1's resolving_field_path (same purpose,
     // same prefix-match semantics).
     this.resolvingFieldPath = [];
+    // S13a.12 recursion guard: field keys whose prior is currently being
+    // resolved through the prefix-self-ref branch. Saved priors are
+    // prefix-self-ref-free by the fold invariant, so re-entry only happens on
+    // a shape the fold could not see through (a live subst mid-navigation) —
+    // report it as a cycle instead of recursing forever.
+    this.resolvingPrefixPriors = /* @__PURE__ */ new Set();
   }
   /** Returns a prefix for error messages, including origin info when set. */
   originPrefix() {
@@ -623,46 +790,57 @@ var SubstitutionResolver = class {
       this.resolvingFieldPath.push(key);
       const fullCacheKey = stringSegmentsToKey(this.resolvingFieldPath);
       this.cache.delete(fullCacheKey);
-      let resolved;
       try {
-        resolved = this.resolveVal(val, obj);
-      } finally {
-        this.resolvingFieldPath.pop();
-      }
-      if (resolved !== void 0) {
-        if (resolved.kind === "object") {
+        const resolved = this.resolveVal(val, obj);
+        if (resolved !== void 0) {
+          if (resolved.kind === "object") {
+            const prior = obj.priorValues.get(key);
+            if (prior !== void 0) {
+              const priorResolved = this.resolveVal(prior, obj);
+              if (priorResolved !== void 0 && priorResolved.kind === "object") {
+                const finalValue = deepMergeHoconValues(
+                  priorResolved,
+                  resolved
+                );
+                result.set(key, finalValue);
+                this.cache.set(fullCacheKey, finalValue);
+                this.cacheDescendants(fullCacheKey, finalValue);
+                continue;
+              }
+            }
+          }
+          result.set(key, resolved);
+          this.cache.set(fullCacheKey, resolved);
+          this.cacheDescendants(fullCacheKey, resolved);
+        } else {
           const prior = obj.priorValues.get(key);
           if (prior !== void 0) {
             const priorResolved = this.resolveVal(prior, obj);
-            if (priorResolved !== void 0 && priorResolved.kind === "object") {
-              const finalValue = deepMergeHoconValues(
-                priorResolved,
-                resolved
-              );
-              result.set(key, finalValue);
-              this.cache.set(fullCacheKey, finalValue);
-              this.cacheDescendants(fullCacheKey, finalValue);
-              continue;
+            if (priorResolved !== void 0) {
+              result.set(key, priorResolved);
+              this.cache.set(fullCacheKey, priorResolved);
+              this.cacheDescendants(fullCacheKey, priorResolved);
             }
           }
         }
-        result.set(key, resolved);
-        this.cache.set(fullCacheKey, resolved);
-        this.cacheDescendants(fullCacheKey, resolved);
-      } else {
-        const prior = obj.priorValues.get(key);
-        if (prior !== void 0) {
-          const priorResolved = this.resolveVal(prior, obj);
-          if (priorResolved !== void 0) {
-            result.set(key, priorResolved);
-            this.cache.set(fullCacheKey, priorResolved);
-            this.cacheDescendants(fullCacheKey, priorResolved);
-          }
-        }
+      } finally {
+        this.resolvingFieldPath.pop();
       }
     }
     return { kind: "object", fields: result };
   }
+  /** S13a.12: walk resolved-object fields by segment text. A missing segment
+   * or a walk into a scalar/array is path-absent → undefined. */
+  navigateResolved(v, remainder) {
+    let cur = v;
+    for (const seg of remainder) {
+      if (cur.kind !== "object") return void 0;
+      const next = cur.fields.get(seg);
+      if (next === void 0) return void 0;
+      cur = next;
+    }
+    return cur;
+  }
   cacheDescendants(prefix, value) {
     if (value.kind !== "object") return;
     for (const [key, child] of value.fields) {
@@ -685,17 +863,59 @@ var SubstitutionResolver = class {
     if (isResObj(v)) return this.resolveResObj(v);
     const hv = v;
     if (hv.kind === "array") {
-      return {
-        kind: "array",
-        items: hv.items.map(
-          (item) => this.resolveVal(item, scope) ?? { kind: "scalar", raw: "null", valueType: "null" }
-        )
-      };
+      const items = [];
+      for (const item of hv.items) {
+        const resolved = this.resolveVal(item, scope);
+        if (resolved === void 0) continue;
+        items.push(resolved);
+      }
+      return { kind: "array", items };
     }
     return hv;
   }
   resolveSubst(s, scope) {
-    if (s.knownAbsent) return void 0;
+    if (s.knownAbsent) {
+      if (!s.optional) {
+        if (this.opts.allowUnresolved) return s;
+        const k = s.listSuffix ? `${segmentsToKey(s.segments)}[]` : segmentsToKey(s.segments);
+        throw new ResolveError(
+          `${this.originPrefix()}could not resolve substitution: \${${k}}`,
+          k,
+          s.line,
+          s.col
+        );
+      }
+      return void 0;
+    }
+    {
+      const rfp = this.resolvingFieldPath;
+      const sTexts = s.segments.map((seg) => seg.text);
+      if (rfp.length > 0 && rfp.length < sTexts.length && stringSegmentsToKey(sTexts.slice(0, rfp.length)) === stringSegmentsToKey(rfp)) {
+        const guardKey = stringSegmentsToKey(rfp);
+        const prior = scope.priorValues.get(rfp[rfp.length - 1]);
+        if (prior !== void 0 && !this.resolvingPrefixPriors.has(guardKey)) {
+          this.resolvingPrefixPriors.add(guardKey);
+          try {
+            const priorResolved = this.resolveVal(prior, scope);
+            if (priorResolved !== void 0) {
+              const navigated = this.navigateResolved(priorResolved, sTexts.slice(rfp.length));
+              if (navigated !== void 0) return navigated;
+            }
+          } finally {
+            this.resolvingPrefixPriors.delete(guardKey);
+          }
+        }
+        if (s.optional) return void 0;
+        if (this.opts.allowUnresolved) return s;
+        const k = s.listSuffix ? `${segmentsToKey(s.segments)}[]` : segmentsToKey(s.segments);
+        throw new ResolveError(
+          `${this.originPrefix()}could not resolve substitution: \${${k}}`,
+          k,
+          s.line,
+          s.col
+        );
+      }
+    }
     const key = s.listSuffix ? `${segmentsToKey(s.segments)}[]` : segmentsToKey(s.segments);
     if (this.cache.has(key)) return this.cache.get(key);
     if (this.resolving.has(key)) {
@@ -1015,6 +1235,121 @@ function hoconValueToResObj2(value) {
   return obj;
 }
 
+// src/render-hocon.ts
+function renderHoconFromRoot(root) {
+  const out = [];
+  renderObjectBody(out, root, 0);
+  return out.join("");
+}
+function renderObjectBody(out, o, depth) {
+  const indent = "  ".repeat(depth);
+  for (const [k, v] of o.fields) {
+    out.push(indent, renderKey(k));
+    if (v.kind === "object") {
+      out.push(" {");
+      if (v.fields.size === 0) {
+        out.push("}\n");
+        continue;
+      }
+      out.push("\n");
+      renderObjectBody(out, v, depth + 1);
+      out.push(indent, "}\n");
+    } else {
+      out.push(" = ");
+      renderValue(out, v, depth);
+      out.push("\n");
+    }
+  }
+}
+function renderValue(out, v, depth) {
+  switch (v.kind) {
+    case "object": {
+      if (v.fields.size === 0) {
+        out.push("{}");
+        return;
+      }
+      out.push("{\n");
+      renderObjectBody(out, v, depth + 1);
+      out.push("  ".repeat(depth), "}");
+      return;
+    }
+    case "array":
+      renderArray(out, v, depth);
+      return;
+    case "scalar":
+      out.push(renderScalar(v));
+      return;
+    default:
+      throw new ConfigError(
+        "renderHocon: unrenderable value (config must be resolved data)",
+        ""
+      );
+  }
+}
+function renderArray(out, a, depth) {
+  if (a.items.length === 0) {
+    out.push("[]");
+    return;
+  }
+  const inner = "  ".repeat(depth + 1);
+  out.push("[\n");
+  for (const e of a.items) {
+    out.push(inner);
+    renderValue(out, e, depth + 1);
+    out.push("\n");
+  }
+  out.push("  ".repeat(depth), "]");
+}
+function renderScalar(s) {
+  switch (s.valueType) {
+    case "null":
+      return "null";
+    case "boolean":
+    case "number":
+      return s.raw;
+    case "string":
+      return renderString(s.raw);
+  }
+}
+var SAFE_UNQUOTED_KEY = /^[A-Za-z0-9_-]+$/;
+function renderKey(k) {
+  if (k === "include") return quoteString(k);
+  return SAFE_UNQUOTED_KEY.test(k) ? k : quoteString(k);
+}
+var SAFE_BARE_STRING = /^[A-Za-z][A-Za-z0-9_-]*$/;
+var STRING_KEYWORDS = /* @__PURE__ */ new Set(["true", "false", "null", "yes", "no", "on", "off"]);
+function renderString(s) {
+  return SAFE_BARE_STRING.test(s) && !STRING_KEYWORDS.has(s.toLowerCase()) ? s : quoteString(s);
+}
+function quoteString(s) {
+  if (s.includes("\n") && !s.includes("\r") && !s.includes('"""') && !s.endsWith('"')) {
+    return `"""${s}"""`;
+  }
+  let b = '"';
+  for (const ch of s) {
+    switch (ch) {
+      case '"':
+        b += '\\"';
+        break;
+      case "\\":
+        b += "\\\\";
+        break;
+      case "\n":
+        b += "\\n";
+        break;
+      case "\r":
+        b += "\\r";
+        break;
+      case "	":
+        b += "\\t";
+        break;
+      default:
+        b += ch;
+    }
+  }
+  return b + '"';
+}
+
 // src/config.ts
 var Config = class _Config {
   constructor(root, opts) {
@@ -1320,6 +1655,36 @@ var Config = class _Config {
   toObject(opts) {
     return hoconToJs(this.root, opts?.nullPrototype === true);
   }
+  /**
+   * Renders this resolved Config as HOCON text (E18; lockstep with go.hocon's
+   * `Config.RenderHOCON`, v1.11.0).
+   *
+   * The output round-trips: parsing it back yields the same value tree. That
+   * is the correctness contract, not byte-for-byte formatting — a scalar is
+   * quoted whenever leaving it bare would re-parse as a different type (a
+   * string `"8080"` becomes `"8080"`, not `8080`), and left bare only when it
+   * provably cannot.
+   *
+   * The Config must be resolved and hold only data (objects, arrays, string /
+   * number / boolean / null scalars) — exactly what {@link fromMap} and the
+   * format adapters produce. An unresolved placeholder throws
+   * {@link ConfigError}; substitutions have no textual round trip through a
+   * value tree.
+   *
+   * The root object's fields are emitted without enclosing braces, nested
+   * objects as `key { … }`, arrays as newline-separated `[ … ]`, indented two
+   * spaces. Source comments are not represented — a value tree does not carry
+   * them.
+   */
+  renderHocon() {
+    if (!this._resolved) {
+      throw new ConfigError(
+        "renderHocon: unrenderable unresolved substitution (config must be resolved data)",
+        ""
+      );
+    }
+    return renderHoconFromRoot(this.root);
+  }
   /**
    * @internal Test-only: renders this resolved Config's value tree as canonical
    * JSON (sorted keys, no whitespace). Used by Layer-2 fixture tests to compare
@@ -1533,7 +1898,10 @@ function normalizeLeadingZeroNumber(raw) {
 
 // src/value-factory.ts
 function fromMap(values, originDescription) {
-  const fields = coerceObject(values, "");
+  const fields = guardStackDepth(
+    () => coerceObject(values, ""),
+    (msg) => depthError(`fromMap: ${msg}`)
+  );
   const root = { kind: "object", fields };
   return Config._fromResolvedValue(root, { originDescription });
 }
@@ -1633,13 +2001,14 @@ function parseDotEnv(input, opts = {}) {
   for (let i = 0; i < lines.length; i++) {
     const raw = (lines[i] ?? "").trim();
     if (raw === "" || raw.startsWith("#")) continue;
-    const line = raw.startsWith("export ") ? raw.slice("export ".length) : raw;
+    const line = stripExport(raw);
     const eq = line.indexOf("=");
     if (eq === -1) throw new ConfigError(`${origin}:${i + 1}: expected NAME=value`, "");
     const name = line.slice(0, eq).trim();
     if (name === "") throw new ConfigError(`${origin}:${i + 1}: empty variable name`, "");
-    const value = dotEnvValue(line.slice(eq + 1).replace(/^[ \t]+/, ""), origin, i + 1, name);
     if (!name.startsWith(prefix)) continue;
+    checkName(name, origin, i + 1);
+    const value = dotEnvValue(line.slice(eq + 1).replace(/^[ \t]+/, ""), origin, i + 1, name);
     pairs.push([toPath(name.slice(prefix.length)), value]);
   }
   return fromMap(nestPairs(pairs), origin);
@@ -1649,6 +2018,12 @@ function toPath(name) {
   if (segs.some((s) => s === "")) {
     throw new ConfigError(`env: "${name}" produces an empty path segment`, name);
   }
+  if (tooDeep(segs.length)) {
+    throw new ConfigError(
+      `env: "${name}" maps to a path ${segs.length} segments deep, over the limit of ${MAX_PATH_SEGMENTS}`,
+      name
+    );
+  }
   return segs;
 }
 function asciiLower(s) {
@@ -1694,6 +2069,20 @@ function dotEnvValue(v, origin, line, name) {
   }
   return trimmed;
 }
+function stripExport(line) {
+  const m = /^export[ \t]+/.exec(line);
+  return m ? line.slice(m[0].length) : line;
+}
+function checkName(name, origin, line) {
+  const bad = /\p{White_Space}|#/u.exec(name);
+  if (bad) {
+    const what = bad[0] === "#" ? "'#'" : "whitespace";
+    throw new ConfigError(
+      `${origin}:${line}: variable name "${name}" contains ${what}; the line is not NAME=value (spec F1.7)`,
+      name
+    );
+  }
+}
 export {
   loadEnv,
   parseDotEnv