@quonfig/cli 0.4.0 → 0.6.0

package/dist/util/encryption.js

@@ -1,5 +1,5 @@
 import { encryption } from '@quonfig/node';
-import forge from 'node-forge';
+import { createDecipheriv } from 'node:crypto';
 import { failure, success } from '../result.js';
 const SEPARATOR = '--';
 const KEY_LENGTH = 32; // 32 bytes for AES-256
@@ -28,27 +28,18 @@ export function decrypt(encryptedString, keyStringHex) {
     if (encryptedDataPart === '') {
         return '';
     }
-    // Convert hex strings to bytes
-    const keyBytes = forge.util.hexToBytes(keyStringHex);
-    const encryptedBytes = forge.util.hexToBytes(encryptedDataPart);
-    const ivBytes = forge.util.hexToBytes(ivPart);
-    const tagBytes = forge.util.hexToBytes(authTagPart);
-    // Create decipher. node-forge AES-GCM with the IV passed to start() below, not
-    // Node's deprecated IV-less crypto.createDecipher that this rule targets.
-    // nosemgrep: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv
-    const decipher = forge.cipher.createDecipher('AES-GCM', keyBytes);
-    decipher.start({
-        iv: ivBytes,
-        tag: forge.util.createBuffer(tagBytes),
-        tagLength: TAG_LENGTH * 8, // tagLength is in bits
-    });
-    // Decrypt the data
-    decipher.update(forge.util.createBuffer(encryptedBytes));
-    const success = decipher.finish();
-    if (!success) {
+    const key = Buffer.from(keyStringHex, 'hex');
+    const encryptedData = Buffer.from(encryptedDataPart, 'hex');
+    const iv = Buffer.from(ivPart, 'hex');
+    const authTag = Buffer.from(authTagPart, 'hex');
+    const decipher = createDecipheriv('aes-256-gcm', key, iv, { authTagLength: TAG_LENGTH });
+    try {
+        decipher.setAuthTag(authTag);
+        return Buffer.concat([decipher.update(encryptedData), decipher.final()]).toString('utf8');
+    }
+    catch {
         throw new Error('Authentication tag verification failed');
     }
-    return decipher.output.toString();
 }
 /**
  * Creates an encrypted ConfigValue using the new v1 API endpoints

package/dist/util/git-ops.d.ts

@@ -11,9 +11,11 @@ export declare const GIT_SAFE_ARGS: readonly string[];
  */
 export declare const GIT_SAFE_ENV: Readonly<NodeJS.ProcessEnv>;
 /**
- * Redact a token from a URL string so it is safe to display to users.
+ * Redact the credential from every http(s) URL in a string (a URL, or git's
+ * stderr) so it is safe to display to users. Handles both `user:token@`
+ * (keeps the user) and a bare `token@` (qfg-9iu0).
  */
-export declare const redactToken: (url: string) => string;
+export declare const redactToken: (text: string) => string;
 export interface RunGitOptions {
     cwd?: string;
     /** Extra env vars merged on top of `process.env` and `GIT_SAFE_ENV`. */

package/dist/util/git-ops.js

@@ -17,9 +17,11 @@ export const GIT_SAFE_ENV = {
     GCM_INTERACTIVE: 'Never',
 };
 /**
- * Redact a token from a URL string so it is safe to display to users.
+ * Redact the credential from every http(s) URL in a string (a URL, or git's
+ * stderr) so it is safe to display to users. Handles both `user:token@`
+ * (keeps the user) and a bare `token@` (qfg-9iu0).
  */
-export const redactToken = (url) => url.replace(/:([^/@]+)@/, ':***@');
+export const redactToken = (text) => text.replaceAll(/(https?:\/\/)(?:([^\s/:@]*):)?[^\s/@]+@/gi, (_match, scheme, user) => user === undefined ? `${scheme}***@` : `${scheme}${user}:***@`);
 /**
  * Canonical entry point for shelling out to git from the CLI. Always prepends
  * `GIT_SAFE_ARGS` and merges `GIT_SAFE_ENV` so credential prompts never leak

package/dist/util/redact.d.ts

@@ -0,0 +1,56 @@
+/** Plaintext shorter than this never has its tail shown. */
+export declare const LAST4_MIN_LENGTH = 12;
+export type RedactedSummary = {
+    /** true for `decryptWith` values, false for confidential-only values */
+    encrypted: boolean;
+    /** `*****<first 5 hex of md5>` — absent only before the value is encrypted */
+    fingerprint?: string;
+    /** last 4 chars of the plaintext, only when the plaintext is >= 12 chars */
+    last4?: string;
+    /** plaintext length — absent only when the plaintext is not known */
+    length?: number;
+    redacted: true;
+};
+/**
+ * The SDK telemetry fingerprint: `*****` + the first 5 hex chars of the md5.
+ * Identical to sdk-node resolver.ts makeConfidential (and sdk-ruby), so the
+ * value the CLI shows matches what telemetry and the UI report.
+ */
+export declare const fingerprint: (value: string) => string;
+/**
+ * Build the redacted summary for a value.
+ *
+ * - `ciphertext` given: an encrypted value. Like the SDK resolver, the
+ *   fingerprint hashes the CIPHERTEXT (that is what telemetry sees).
+ * - `encrypted: true` without ciphertext: about to be encrypted (e.g. a confirm
+ *   prompt before the write) — no fingerprint yet.
+ * - neither: a confidential-but-unencrypted value; the fingerprint hashes the
+ *   plaintext, again matching the SDK.
+ *
+ * `plaintext` may be omitted when it is not known (e.g. ciphertext that could
+ * not be decrypted); length and last4 are then left out.
+ */
+export declare const redactedSummary: ({ ciphertext, encrypted, plaintext, }: {
+    ciphertext?: string;
+    encrypted?: boolean;
+    plaintext?: string;
+}) => RedactedSummary;
+/**
+ * One-line human display, e.g.
+ *   [encrypted *****3fa9c, 51 chars, ends …a1b2]
+ *   [encrypted, 10 chars]                 (before encryption, no fingerprint)
+ *   [confidential *****1c2d3, 10 chars]
+ */
+export declare const redactedDisplay: (summary: RedactedSummary) => string;
+/**
+ * Deep-copy a stored config document, replacing the plaintext of every
+ * confidential-but-UNencrypted rule value with its redacted display. Encrypted
+ * values (`decryptWith`) are ciphertext and are left as they are.
+ */
+export declare const scrubConfidentialValues: <T>(doc: T) => T;
+/**
+ * Scrub anything headed for a --verbose / debug log line (qfg-38lp): objects
+ * are deep-scrubbed, and a string that is itself JSON (e.g. a pre-stringified
+ * request body) is parsed, scrubbed and re-serialised.
+ */
+export declare const scrubForLog: (message: unknown) => unknown;

package/dist/util/redact.js

@@ -0,0 +1,98 @@
+import { createHash } from 'node:crypto';
+/**
+ * Shared secret-redaction helper (qfg-38lp). Every CLI path that would show a
+ * secret (or `confidential`) value goes through here instead of printing the
+ * plaintext. Plaintext is only ever printed by `qfg get --reveal`.
+ */
+const FINGERPRINT_PREFIX = '*****';
+/** Plaintext shorter than this never has its tail shown. */
+export const LAST4_MIN_LENGTH = 12;
+/**
+ * The SDK telemetry fingerprint: `*****` + the first 5 hex chars of the md5.
+ * Identical to sdk-node resolver.ts makeConfidential (and sdk-ruby), so the
+ * value the CLI shows matches what telemetry and the UI report.
+ */
+export const fingerprint = (value) => `${FINGERPRINT_PREFIX}${createHash('md5').update(value).digest('hex').slice(0, 5)}`;
+/**
+ * Build the redacted summary for a value.
+ *
+ * - `ciphertext` given: an encrypted value. Like the SDK resolver, the
+ *   fingerprint hashes the CIPHERTEXT (that is what telemetry sees).
+ * - `encrypted: true` without ciphertext: about to be encrypted (e.g. a confirm
+ *   prompt before the write) — no fingerprint yet.
+ * - neither: a confidential-but-unencrypted value; the fingerprint hashes the
+ *   plaintext, again matching the SDK.
+ *
+ * `plaintext` may be omitted when it is not known (e.g. ciphertext that could
+ * not be decrypted); length and last4 are then left out.
+ */
+export const redactedSummary = ({ ciphertext, encrypted, plaintext, }) => {
+    const isEncrypted = ciphertext !== undefined || encrypted === true;
+    const hashed = ciphertext ?? (isEncrypted ? undefined : plaintext);
+    const summary = { encrypted: isEncrypted, redacted: true };
+    if (hashed !== undefined)
+        summary.fingerprint = fingerprint(hashed);
+    if (plaintext !== undefined)
+        summary.length = plaintext.length;
+    if (plaintext !== undefined && plaintext.length >= LAST4_MIN_LENGTH)
+        summary.last4 = plaintext.slice(-4);
+    return summary;
+};
+/**
+ * One-line human display, e.g.
+ *   [encrypted *****3fa9c, 51 chars, ends …a1b2]
+ *   [encrypted, 10 chars]                 (before encryption, no fingerprint)
+ *   [confidential *****1c2d3, 10 chars]
+ */
+export const redactedDisplay = (summary) => {
+    const label = summary.encrypted ? 'encrypted' : 'confidential';
+    const head = summary.fingerprint ? `${label} ${summary.fingerprint}` : label;
+    const parts = [head];
+    if (typeof summary.length === 'number')
+        parts.push(`${summary.length} chars`);
+    if (summary.last4)
+        parts.push(`ends …${summary.last4}`);
+    return `[${parts.join(', ')}]`;
+};
+/**
+ * Deep-copy a stored config document, replacing the plaintext of every
+ * confidential-but-UNencrypted rule value with its redacted display. Encrypted
+ * values (`decryptWith`) are ciphertext and are left as they are.
+ */
+export const scrubConfidentialValues = (doc) => {
+    const walk = (node) => {
+        if (Array.isArray(node))
+            return node.map((item) => walk(item));
+        if (node === null || typeof node !== 'object')
+            return node;
+        const record = node;
+        const out = {};
+        for (const [k, v] of Object.entries(record))
+            out[k] = walk(v);
+        if (record.confidential === true && !record.decryptWith && record.value !== undefined && record.value !== null) {
+            const plaintext = typeof record.value === 'string' ? record.value : JSON.stringify(record.value);
+            out.value = redactedDisplay(redactedSummary({ plaintext }));
+        }
+        return out;
+    };
+    return walk(doc);
+};
+/**
+ * Scrub anything headed for a --verbose / debug log line (qfg-38lp): objects
+ * are deep-scrubbed, and a string that is itself JSON (e.g. a pre-stringified
+ * request body) is parsed, scrubbed and re-serialised.
+ */
+export const scrubForLog = (message) => {
+    if (typeof message === 'string') {
+        const trimmed = message.trim();
+        if (!trimmed.startsWith('{') && !trimmed.startsWith('['))
+            return message;
+        try {
+            return JSON.stringify(scrubConfidentialValues(JSON.parse(trimmed)), null, 2);
+        }
+        catch {
+            return message;
+        }
+    }
+    return scrubConfidentialValues(message);
+};

package/dist/util/value-source.d.ts

@@ -0,0 +1,30 @@
+import { Result } from '../result.js';
+/**
+ * qfg-38lp: ways to hand the CLI a value WITHOUT putting it in argv (where it
+ * lands in shell history, `ps`, CI logs and agent transcripts).
+ *
+ *   --value-stdin              read the value from stdin
+ *   --value-from-env <VAR>     read the value from a LOCAL env var, right now
+ *
+ * Not to be confused with --env-var, which stores no value at all: it records
+ * that the SDK reads the value from that env var at RUNTIME.
+ */
+export declare const valueSourceFlags: {
+    'value-from-env': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+    'value-stdin': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+};
+type ValueSourceInput = {
+    'env-var'?: string;
+    value?: string;
+    'value-from-env'?: string;
+    'value-stdin'?: boolean;
+};
+/** Strip exactly one trailing newline (`\n` or `\r\n`), as `echo`/heredocs add one. */
+export declare const stripOneTrailingNewline: (s: string) => string;
+/**
+ * Resolve the value from --value / --value-stdin / --value-from-env, enforcing
+ * that at most one of those (or --env-var) is given. Returns `undefined` when
+ * none was given (the caller may then prompt or use --env-var).
+ */
+export declare const resolveValueSource: (flags: ValueSourceInput) => Promise<Result<string | undefined>>;
+export {};

package/dist/util/value-source.js

@@ -0,0 +1,81 @@
+import { Flags } from '@oclif/core';
+import { failure, success } from '../result.js';
+import getString from '../ui/get-string.js';
+/**
+ * qfg-38lp: ways to hand the CLI a value WITHOUT putting it in argv (where it
+ * lands in shell history, `ps`, CI logs and agent transcripts).
+ *
+ *   --value-stdin              read the value from stdin
+ *   --value-from-env <VAR>     read the value from a LOCAL env var, right now
+ *
+ * Not to be confused with --env-var, which stores no value at all: it records
+ * that the SDK reads the value from that env var at RUNTIME.
+ */
+export const valueSourceFlags = {
+    'value-from-env': Flags.string({
+        description: 'read the value to store from this LOCAL env var now (keeps it out of argv/shell history). Not the same as --env-var',
+        helpValue: 'VAR',
+    }),
+    'value-stdin': Flags.boolean({
+        default: false,
+        description: 'read the value to store from stdin (one trailing newline is stripped). Keeps it out of argv',
+    }),
+};
+/** Read all of stdin (tests swap `process.stdin` for a Readable). */
+const readStdin = async () => {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+};
+/** Strip exactly one trailing newline (`\n` or `\r\n`), as `echo`/heredocs add one. */
+export const stripOneTrailingNewline = (s) => {
+    if (s.endsWith('\r\n'))
+        return s.slice(0, -2);
+    if (s.endsWith('\n'))
+        return s.slice(0, -1);
+    return s;
+};
+/**
+ * Resolve the value from --value / --value-stdin / --value-from-env, enforcing
+ * that at most one of those (or --env-var) is given. Returns `undefined` when
+ * none was given (the caller may then prompt or use --env-var).
+ */
+export const resolveValueSource = async (flags) => {
+    const given = [
+        flags.value === undefined ? undefined : '--value',
+        flags['value-stdin'] ? '--value-stdin' : undefined,
+        flags['value-from-env'] === undefined ? undefined : '--value-from-env',
+        flags['env-var'] === undefined ? undefined : '--env-var',
+    ].filter(Boolean);
+    if (given.length > 1) {
+        return failure(`Pass only one of --value, --value-stdin, --value-from-env or --env-var (got ${given.join(' and ')}). ` +
+            '--env-var stores no value: it tells the SDK to read the value from that env var at runtime.');
+    }
+    if (flags['value-stdin']) {
+        // On a terminal, a hand-typed value would be echoed; read it through the
+        // hidden prompt instead (one line, nothing echoed).
+        const value = process.stdin.isTTY
+            ? ((await getString({ allowBlank: true, mask: true, message: 'Value (input is hidden)' })) ?? '')
+            : stripOneTrailingNewline(await readStdin());
+        if (value === '') {
+            return failure('--value-stdin read an empty value from stdin. Pipe the value in, e.g. `pbpaste | qfg ... --value-stdin`.');
+        }
+        return success(value);
+    }
+    const envName = flags['value-from-env'];
+    if (envName !== undefined) {
+        const value = process.env[envName];
+        if (value === undefined) {
+            return failure(`--value-from-env: environment variable ${envName} is not set in this shell. ` +
+                `If you set it without \`export\`, run \`export ${envName}\` (or load a .env file with ` +
+                '`set -a; source ./file.env; set +a`).');
+        }
+        if (value === '') {
+            return failure(`--value-from-env: environment variable ${envName} is empty.`);
+        }
+        return success(value);
+    }
+    return success(flags.value);
+};

package/dist/verify/regex-dialect.d.ts

@@ -0,0 +1,39 @@
+/**
+ * "Quonfig regex v1": the regex dialect of PROP_MATCHES and PROP_DOES_NOT_MATCH
+ * (qfg-ktkr.2). Spec: project/plans/2026-10-12-regex-write-time-check.md
+ * section 2, approved 2026-10-16 (qfg-goi1.10.10). Fixture of record:
+ * integration-test-data tests/regex/dialect.yaml (tag v2026.10.22.1; \_, \v
+ * and \x80-\xFF rejected per qfg-ktkr.7), which
+ * test/verify/regex-dialect.test.ts holds this file to, row by row.
+ *
+ * The dialect is the intersection of what every SDK's engine (go RE2, node
+ * RegExp, python re, ruby Onigmo, java.util.regex, .NET Regex) accepts and
+ * reads the same way, plus a ReDoS safety rule. SDKs do not validate; the
+ * writers (this check, app-quonfig's copy, and the Git hook built from this
+ * repo) are the only gate.
+ *
+ * No imports: src/verify/ is bundled into the standalone qfg-verify hook.
+ */
+export declare const REGEX_V1_LIMITS: {
+    readonly maxLength: 256;
+    readonly maxRepeat: 1000;
+    readonly maxUnboundedQuantifiers: 2;
+};
+/** The canonical docs section the error links to (qfg-ktkr.5 owns the page). */
+export declare const REGEX_V1_DOCS_URL = "https://docs.quonfig.com/docs/explanations/features/rules-and-segmentation#quonfig-regex-v1";
+export type RegexV1Reason = 'backref' | 'bad-repeat' | 'class-syntax' | 'group-extension' | 'inline-flag' | 'lookaround' | 'named-group' | 'nested-quantifier' | 'octal' | 'possessive' | 'syntax' | 'too-long' | 'too-many-unbounded' | 'unicode-shorthand' | 'unsupported-escape';
+/** Fix-it hints, verbatim from the fixture's `hints` map. */
+export declare const REGEX_V1_HINTS: Record<RegexV1Reason, string>;
+export interface RegexV1Violation {
+    hint: string;
+    reason: RegexV1Reason;
+}
+/**
+ * Check one pattern against Quonfig regex v1. Returns null when the pattern is
+ * in the dialect, or the reason and fix-it hint for the first violation.
+ *
+ * Precedence (fixture header): too-long first; then one left-to-right scan
+ * reports the first offending construct (an unclosed ( or [ is found at the
+ * end); then too-many-unbounded, which needs the whole pattern.
+ */
+export declare function checkRegexV1(pattern: string): null | RegexV1Violation;

package/dist/verify/regex-dialect.js

@@ -0,0 +1,278 @@
+/**
+ * "Quonfig regex v1": the regex dialect of PROP_MATCHES and PROP_DOES_NOT_MATCH
+ * (qfg-ktkr.2). Spec: project/plans/2026-10-12-regex-write-time-check.md
+ * section 2, approved 2026-10-16 (qfg-goi1.10.10). Fixture of record:
+ * integration-test-data tests/regex/dialect.yaml (tag v2026.10.22.1; \_, \v
+ * and \x80-\xFF rejected per qfg-ktkr.7), which
+ * test/verify/regex-dialect.test.ts holds this file to, row by row.
+ *
+ * The dialect is the intersection of what every SDK's engine (go RE2, node
+ * RegExp, python re, ruby Onigmo, java.util.regex, .NET Regex) accepts and
+ * reads the same way, plus a ReDoS safety rule. SDKs do not validate; the
+ * writers (this check, app-quonfig's copy, and the Git hook built from this
+ * repo) are the only gate.
+ *
+ * No imports: src/verify/ is bundled into the standalone qfg-verify hook.
+ */
+export const REGEX_V1_LIMITS = { maxLength: 256, maxRepeat: 1000, maxUnboundedQuantifiers: 2 };
+/** The canonical docs section the error links to (qfg-ktkr.5 owns the page). */
+export const REGEX_V1_DOCS_URL = 'https://docs.quonfig.com/docs/explanations/features/rules-and-segmentation#quonfig-regex-v1';
+/** Fix-it hints, verbatim from the fixture's `hints` map. */
+export const REGEX_V1_HINTS = {
+    'too-long': 'Regex patterns are limited to 256 characters.',
+    syntax: 'This is not a valid regular expression. Check for an unbalanced ( ) or [ ], a trailing \\, a reversed range such as [z-a], or a quantifier with nothing before it (a quantifier cannot follow ^, $, |, ( or another quantifier).',
+    lookaround: 'Lookahead and lookbehind ((?=, (?!, (?<=, (?<!) are not supported. Rewrite the pattern without them, or split the rule into two criteria.',
+    'named-group': "Named groups ((?<name>...), (?P<name>...), (?'name'...)) are not supported. Use a plain group ( ) or (?: ).",
+    'inline-flag': 'Inline flags such as (?i) are not supported. Spell out both cases with a class, for example [Hh]ello.',
+    'group-extension': 'Only ( ) and (?: ) groups are supported. Atomic groups (?>...), comments (?#...), conditionals and other (? forms are not.',
+    backref: 'Backreferences (\\1 to \\9, \\k<name>) are not supported. Repeat the text explicitly instead.',
+    octal: 'Octal escapes and \\0 are not supported. Write the character as \\xHH, for example \\x00.',
+    possessive: 'Possessive quantifiers (*+, ++, ?+, {n}+) are not supported. Use the plain form (a+) or the lazy form (a+?).',
+    'bad-repeat': 'Write repeat counts as {n}, {n,} or {n,m} with n <= m <= 1000. {,m} is not portable: write {0,m}. Escape a literal brace as \\{.',
+    'class-syntax': 'Inside [...] use only literals, ranges and escapes. POSIX classes such as [:digit:], a nested [, &&, --, ~~ and || are not supported. Escape a literal [ or ] as \\[ or \\], and do not start a class with ].',
+    'unicode-shorthand': '\\d, \\w, \\s, \\b and their negations match different characters in different SDKs. Use [0-9], [A-Za-z0-9_] or [ \\t\\r\\n\\f\\x0B].',
+    'unsupported-escape': 'This escape is not supported. The supported escapes are \\ followed by ASCII punctuation other than _, \\t \\n \\r \\f, and \\xHH with exactly two hex digits from \\x00 to \\x7F. Write _ unescaped instead of \\_, \\x0B instead of \\v, and a character above \\x7F as the character itself.',
+    'nested-quantifier': 'A quantifier cannot apply to a group that contains a quantifier or a |, as in (a+)+ or (a|b)*. Such patterns can take exponential time. Quantify the inner part only, or use a class: [ab]* instead of (a|b)*.',
+    'too-many-unbounded': 'A pattern can have at most 2 unbounded quantifiers (*, +, {n,}). Bound the extra ones with {n,m}, or split the rule into two criteria.',
+};
+// qfg-ktkr.7: no \_ (.NET throws), no \v (java reads a vertical-whitespace
+// class), and \xHH only up to \x7F (ruby rejects \x80-\xFF).
+const ASCII_PUNCT = '!"#$%&\'()*+,-./:;<=>?@[\\]^`{|}~';
+const SIMPLE_ESCAPES = { f: 0x0c, n: 0x0a, r: 0x0d, t: 0x09 };
+const MAX_HEX_ESCAPE = 0x7f;
+const SHORTHANDS = 'dDwWsSbB';
+const HEX = /^[\dA-Fa-f]{2}$/;
+class Violation {
+    reason;
+    constructor(reason) {
+        this.reason = reason;
+    }
+}
+const fail = (reason) => {
+    throw new Violation(reason);
+};
+/**
+ * Check one pattern against Quonfig regex v1. Returns null when the pattern is
+ * in the dialect, or the reason and fix-it hint for the first violation.
+ *
+ * Precedence (fixture header): too-long first; then one left-to-right scan
+ * reports the first offending construct (an unclosed ( or [ is found at the
+ * end); then too-many-unbounded, which needs the whole pattern.
+ */
+export function checkRegexV1(pattern) {
+    const cps = [...pattern];
+    try {
+        if (cps.length > REGEX_V1_LIMITS.maxLength)
+            fail('too-long');
+        const unbounded = scan(cps);
+        if (unbounded > REGEX_V1_LIMITS.maxUnboundedQuantifiers)
+            fail('too-many-unbounded');
+        return null;
+    }
+    catch (error) {
+        if (error instanceof Violation)
+            return { hint: REGEX_V1_HINTS[error.reason], reason: error.reason };
+        throw error;
+    }
+}
+/** Scan the pattern; returns the unbounded-quantifier count or throws a Violation. */
+function scan(p) {
+    // One frame per open group: does it (transitively) contain a quantifier or |?
+    const groups = [];
+    let last = 'none';
+    let lastGroupRisky = false;
+    let unbounded = 0;
+    let i = 0;
+    const markRisky = () => {
+        if (groups.length > 0)
+            groups[groups.length - 1] = true;
+    };
+    /** At p[i] === '{': parse a repeat. Returns [end index, unbounded] or throws. */
+    const parseRepeat = () => {
+        let j = i + 1;
+        let n = '';
+        while (j < p.length && p[j] >= '0' && p[j] <= '9')
+            n += p[j++];
+        let m;
+        let comma = false;
+        if (p[j] === ',') {
+            comma = true;
+            j++;
+            m = '';
+            while (j < p.length && p[j] >= '0' && p[j] <= '9')
+                m += p[j++];
+        }
+        if (p[j] !== '}' || n === '')
+            fail('bad-repeat'); // {,m}, a bare {, x{foo}
+        const lo = Number(n);
+        const hi = comma && m !== '' ? Number(m) : undefined;
+        if (lo > REGEX_V1_LIMITS.maxRepeat || (hi !== undefined && (hi > REGEX_V1_LIMITS.maxRepeat || hi < lo)))
+            fail('bad-repeat');
+        return [j, comma && m === ''];
+    };
+    /** At p[i] === '\\': validate one escape, return its code point (or -1 for a non-literal). */
+    const parseEscape = () => {
+        const c = p[i + 1];
+        if (c === undefined)
+            fail('syntax');
+        if (c >= '1' && c <= '9')
+            fail('backref');
+        if (c === 'k')
+            fail('backref');
+        if (c === '0')
+            fail('octal');
+        if (SHORTHANDS.includes(c))
+            fail('unicode-shorthand');
+        if (c in SIMPLE_ESCAPES) {
+            i += 2;
+            return SIMPLE_ESCAPES[c];
+        }
+        if (c === 'x') {
+            const hex = (p[i + 2] ?? '') + (p[i + 3] ?? '');
+            if (!HEX.test(hex))
+                fail('unsupported-escape');
+            const cp = Number.parseInt(hex, 16);
+            if (cp > MAX_HEX_ESCAPE)
+                fail('unsupported-escape');
+            i += 4;
+            return cp;
+        }
+        if (c.length === 1 && ASCII_PUNCT.includes(c)) {
+            i += 2;
+            return c.codePointAt(0);
+        }
+        return fail('unsupported-escape');
+    };
+    const parseClass = () => {
+        // p[i] === '['
+        i++;
+        if (p[i] === '^')
+            i++;
+        if (p[i] === ']')
+            fail('class-syntax'); // []a] / [^]a] read differently in node
+        const start = i;
+        let prev; // code point of the previous single literal, for ranges
+        for (;;) {
+            const c = p[i];
+            if (c === undefined)
+                fail('syntax'); // unclosed [
+            if (c === ']') {
+                const body = p.slice(start, i);
+                if (body.length >= 2 && body[0] === ':' && body.at(-1) === ':')
+                    fail('class-syntax'); // [:alpha:]
+                i++;
+                return;
+            }
+            if (c === '[')
+                fail('class-syntax'); // nested [ and [[:x:]]
+            if ('&-~|'.includes(c) && p[i + 1] === c)
+                fail('class-syntax'); // && -- ~~ ||
+            if (c === '-' && prev !== undefined && p[i + 1] !== ']' && p[i + 1] !== undefined) {
+                i++;
+                if (p[i] === '[')
+                    fail('class-syntax');
+                const hi = p[i] === '\\' ? parseEscape() : p[i++].codePointAt(0);
+                if (hi < prev)
+                    fail('syntax'); // [z-a]
+                prev = undefined;
+                continue;
+            }
+            prev = c === '\\' ? parseEscape() : p[i++].codePointAt(0);
+        }
+    };
+    while (i < p.length) {
+        const c = p[i];
+        switch (c) {
+            case '\\': {
+                parseEscape();
+                last = 'atom';
+                continue;
+            }
+            case '[': {
+                parseClass();
+                last = 'atom';
+                continue;
+            }
+            case '(': {
+                if (p[i + 1] === '?') {
+                    const a = p[i + 2];
+                    const b = p[i + 3];
+                    if (a === ':') {
+                        i += 3;
+                    }
+                    else if (a === '=' || a === '!' || (a === '<' && (b === '=' || b === '!'))) {
+                        fail('lookaround');
+                    }
+                    else if (a === '<' || a === 'P' || a === "'") {
+                        fail('named-group');
+                    }
+                    else if (a !== undefined && /[A-Za-z-]/.test(a)) {
+                        fail('inline-flag');
+                    }
+                    else if (a === undefined) {
+                        fail('syntax');
+                    }
+                    else {
+                        fail('group-extension');
+                    }
+                }
+                else {
+                    i++;
+                }
+                groups.push(false);
+                last = 'none';
+                continue;
+            }
+            case ')': {
+                if (groups.length === 0)
+                    fail('syntax');
+                lastGroupRisky = groups.pop();
+                if (lastGroupRisky)
+                    markRisky(); // "contains" is transitive
+                last = 'group';
+                i++;
+                continue;
+            }
+            case '|': {
+                markRisky();
+                last = 'none';
+                break;
+            }
+            case '^':
+            case '$': {
+                last = 'none';
+                break;
+            }
+            case '*':
+            case '+':
+            case '?':
+            case '{': {
+                let end = i;
+                let isUnbounded = c === '*' || c === '+';
+                if (c === '{')
+                    [end, isUnbounded] = parseRepeat();
+                if (last === 'none' || last === 'quantifier')
+                    fail('syntax');
+                if (last === 'group' && lastGroupRisky)
+                    fail('nested-quantifier');
+                markRisky();
+                if (isUnbounded)
+                    unbounded++;
+                i = end + 1;
+                if (p[i] === '?')
+                    i++; // lazy
+                else if (p[i] === '+')
+                    fail('possessive');
+                last = 'quantifier';
+                continue;
+            }
+            default: {
+                last = 'atom';
+            }
+        }
+        i++;
+    }
+    if (groups.length > 0)
+        fail('syntax'); // unclosed (
+    return unbounded;
+}