fix: address PR review comments

- parseBlockMap duplicate check now uses Object.hasOwn() so prototype-
  chain property names like `toString` and `constructor` aren't falsely
  rejected as duplicates.
- Drop ':' from TAG_KEY_PATTERN. The block-map parser splits on the
  first ':', so a tag key containing ':' (e.g. `foo:bar`) couldn't be
  expressed in YAML form anyway. Aligning the JSON form keeps validation
  consistent across both input styles. Also rewords the validation
  error message to match the trimmed character set.
- Rename the misleading "rejects JSON arrays" test to make clear it
  rejects non-string JSON values; add a separate case for a root-level
  JSON array (which falls through to the YAML parser); add a regression
  test for the prototype-chain dupe-check fix.

Author: lukekim

__tests__/tags.test.ts

@@ -55,6 +55,15 @@ describe("parseTags", () => {
       expect(() => parseTags("env: a\nenv: b")).toThrow(/duplicate tag key/);
     });
 
+    it("does not treat Object.prototype property names as duplicates", () => {
+      // Regression: `if (key in out)` would falsely flag built-in property
+      // names like `toString` or `constructor` as duplicates on first use.
+      expect(parseTags("toString: bar\nconstructor: baz")).toEqual({
+        toString: "bar",
+        constructor: "baz",
+      });
+    });
+
     it("rejects values longer than 256 chars", () => {
       const long = "x".repeat(257);
       expect(() => parseTags(`big: ${long}`)).toThrow(/exceeds 256/);
@@ -73,18 +82,27 @@ describe("parseTags", () => {
       expect(() => parseTags("{ not json")).toThrow(/not valid JSON/);
     });
 
-    it("rejects JSON arrays", () => {
-      // Arrays don't start with `{`, so the parser falls through to YAML parsing.
-      // This test ensures wrapping a literal `{` array-like in JSON fails clearly.
+    it("rejects non-string JSON values (e.g. an array under a key)", () => {
       expect(() => parseTags('{"tags":["a","b"]}')).toThrow(/must be a string/);
     });
 
+    it("treats a root-level JSON array as YAML and rejects it as malformed", () => {
+      // A literal `[…]` at the root doesn't start with `{`, so the parser
+      // falls through to the block-map path, where it's rejected because the
+      // first non-empty line lacks a "key: value" separator.
+      expect(() => parseTags('["a","b"]')).toThrow(/expected "key: value"/);
+    });
+
     it("rejects JSON values that aren't strings", () => {
       expect(() => parseTags('{"replicas":3}')).toThrow(/must be a string/);
     });
 
     it("rejects JSON keys with invalid characters", () => {
       expect(() => parseTags('{"1bad":"x"}')).toThrow(/start with a letter/);
     });
+
+    it("rejects JSON keys containing ':' (would conflict with the YAML separator)", () => {
+      expect(() => parseTags('{"foo:bar":"value"}')).toThrow(/letters, numbers, and "_\.\/-"/);
+    });
   });
 });