From 5059aee6e861fa34491c45ac4c23f32d49834d8d Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Wed, 29 Oct 2025 12:37:46 +0000
Subject: [PATCH 1/2] fix(replace): update delimiters to respect valid js
 identifier chars

---
 packages/replace/README.md                    |  10 ++++----
 packages/replace/src/index.js                 |   6 ++++-
 .../form/dollar-sign-boundary/_config.js      |   9 +++++++
 .../form/dollar-sign-boundary/input.js        |  20 +++++++++++++++
 packages/replace/test/snapshots/form.js.md    |  24 ++++++++++++++++++
 packages/replace/test/snapshots/form.js.snap  | Bin 816 -> 979 bytes
 6 files changed, 63 insertions(+), 6 deletions(-)
 create mode 100644 packages/replace/test/fixtures/form/dollar-sign-boundary/_config.js
 create mode 100644 packages/replace/test/fixtures/form/dollar-sign-boundary/input.js

diff --git a/packages/replace/README.md b/packages/replace/README.md
index 412db4d5d..d787d73e8 100644
--- a/packages/replace/README.md
+++ b/packages/replace/README.md
@@ -61,14 +61,14 @@ In addition to the properties and values specified for replacement, users may al
 ### `delimiters`
 
 Type: `Array[String, String]`<br>
-Default: `['\\b', '\\b(?!\\.)']`
+Default: `['(?<![_$a-zA-Z0-9\\xA0-\\uFFFF])', '(?![_$a-zA-Z0-9\\xA0-\\uFFFF])(?!\\.)']`
 
-Specifies the boundaries around which strings will be replaced. By default, delimiters are [word boundaries](https://www.regular-expressions.info/wordboundaries.html) and also prevent replacements of instances with nested access. See [Word Boundaries](#word-boundaries) below for more information.
+Specifies the boundaries around which strings will be replaced. By default, delimiters match JavaScript identifier boundaries and also prevent replacements of instances with nested access. See [Word Boundaries](#word-boundaries) below for more information.
 For example, if you pass `typeof window` in `values` to-be-replaced, then you could expect the following scenarios:
 
 - `typeof window` **will** be replaced
-- `typeof window.document` **will not** be replaced due to `(?!\.)` boundary
-- `typeof windowSmth` **will not** be replaced due to a `\b` boundary
+- `typeof window.document` **will not** be replaced due to the `(?!\.)` boundary
+- `typeof windowSmth` **will not** be replaced due to identifier boundaries
 
 Delimiters will be used to build a `Regexp`. To match special characters (any of `.*+?^${}()|[]\`), be sure to [escape](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#escaping) them.
 
@@ -194,7 +194,7 @@ replace({
 
 ## Word Boundaries
 
-By default, values will only match if they are surrounded by _word boundaries_.
+By default, values will only match if they are surrounded by _word boundaries_ that respect JavaScript's rules for valid identifiers (including `$` and `_` as valid identifier characters).
 
 Consider the following options and build file:
 
diff --git a/packages/replace/src/index.js b/packages/replace/src/index.js
index 5d0427769..1b17e8129 100755
--- a/packages/replace/src/index.js
+++ b/packages/replace/src/index.js
@@ -54,7 +54,11 @@ function expandTypeofReplacements(replacements) {
 
 export default function replace(options = {}) {
   const filter = createFilter(options.include, options.exclude);
-  const { delimiters = ['\\b', '\\b(?!\\.)'], preventAssignment, objectGuards } = options;
+  const {
+    delimiters = ['(?<![_$a-zA-Z0-9\\xA0-\\uFFFF])', '(?![_$a-zA-Z0-9\\xA0-\\uFFFF])(?!\\.)'],
+    preventAssignment,
+    objectGuards
+  } = options;
   const replacements = getReplacements(options);
   if (objectGuards) expandTypeofReplacements(replacements);
   const functionValues = mapToFunctions(replacements);
diff --git a/packages/replace/test/fixtures/form/dollar-sign-boundary/_config.js b/packages/replace/test/fixtures/form/dollar-sign-boundary/_config.js
new file mode 100644
index 000000000..a2a35ea15
--- /dev/null
+++ b/packages/replace/test/fixtures/form/dollar-sign-boundary/_config.js
@@ -0,0 +1,9 @@
+module.exports = {
+  description: 'should not replace when followed by valid identifier characters',
+  options: {
+    values: {
+      'typeof window': '"undefined"'
+    },
+    preventAssignment: true
+  }
+};
diff --git a/packages/replace/test/fixtures/form/dollar-sign-boundary/input.js b/packages/replace/test/fixtures/form/dollar-sign-boundary/input.js
new file mode 100644
index 000000000..12cebbe5d
--- /dev/null
+++ b/packages/replace/test/fixtures/form/dollar-sign-boundary/input.js
@@ -0,0 +1,20 @@
+/* eslint-disable no-undef */
+// Should NOT be replaced - window$1 is a different identifier
+if (typeof window$1 === 'undefined') {
+  console.log('no window$1');
+}
+
+// Should be replaced - standalone typeof window
+if (typeof window === 'undefined') {
+  console.log('no window');
+}
+
+// Should NOT be replaced - window_ is a different identifier  
+if (typeof window_ !== 'undefined') {
+  console.log('has window_');
+}
+
+// Should be replaced - typeof window followed by dot
+if (typeof window.document !== 'undefined') {
+  console.log('has document');
+}
diff --git a/packages/replace/test/snapshots/form.js.md b/packages/replace/test/snapshots/form.js.md
index e8b50f05c..895062192 100644
--- a/packages/replace/test/snapshots/form.js.md
+++ b/packages/replace/test/snapshots/form.js.md
@@ -20,6 +20,30 @@ Generated by [AVA](https://avajs.dev).
       <%original %>␊
     \`);`
 
+## dollar-sign-boundary: should not replace when followed by valid identifier characters
+
+> Snapshot 1
+
+    `// Should NOT be replaced - window$1 is a different identifier␊
+    if (typeof window$1 === 'undefined') {␊
+      console.log('no window$1');␊
+    }␊
+    ␊
+    // Should be replaced - standalone "undefined"␊
+    if ("undefined" === 'undefined') {␊
+      console.log('no window');␊
+    }␊
+    ␊
+    // Should NOT be replaced - window_ is a different identifier  ␊
+    if (typeof window_ !== 'undefined') {␊
+      console.log('has window_');␊
+    }␊
+    ␊
+    // Should be replaced - "undefined" followed by dot␊
+    if (typeof window.document !== 'undefined') {␊
+      console.log('has document');␊
+    }`
+
 ## match-variables: matches most specific variables
 
 > Snapshot 1
diff --git a/packages/replace/test/snapshots/form.js.snap b/packages/replace/test/snapshots/form.js.snap
index 310c56eb38c632cf1ac77b555dd5599f00682428..9f9e1760d85f66081dc00418b91cb7ab9fd72947 100644
GIT binary patch
literal 979
zcmV;^11$VORzV<BZeeh9Xm4~Nb~6eC0BhbX(=sYyfNt-dZ)BK?ugMc@QE_`oRpb7J
zhnVGq*B^@r00000000A(mQ9ZvMG%H}7a^oM!4(cvEH++88QY7HAhYp85CMcpatM)<
z14`Q6HJ(n|U8AlZdsm197jFEB@JmsT=QHEoEI#$e>#3)z>+PAh>C%vV!~gt?UVDQV
zbHS`vc8%62pa|KHJvhvbkO*cYOo5;+v?|S3<eZV`zuqb(ym&tO;NYW!@H_nQ;FH78
zaz_%Gr)W3RA0B@H>?c^j*dzP#SsnCqg+{NnN5=`!lF@CDp<Nut_@x))z9h?JaB66E
z@+yKFSVaK$kAa+CX)Da}c{#7AaC{!Unlup46d5C291@F{R9Ge4WdfX0VH8+u%dpMR
zLQ2Na78NWnVIz!Ipj9YGs?mYWgcEWv`irBFyX;4YN3$6`-3594<TqGiLk}@*wN<qJ
z;uJK40HxCu9a`Us73maC{AG@mw(7-V0pr3dOtnQdp1>awK(|O^OO1LwIg9>`q86i%
zz+PA-3|WLx^T<&dwln`fAqN4k%KPQjX#)%se+jqV3y}$~)$hr>n_Ty>75QQ4sUlef
zJKPYVmX{2T_twJ8EZzvG#nK=rP%a?Dn%D#9D0QkOG=iZo<~?7GdU2QN1#Ci3l7-Xh
zd^#Vu-T!rEyEr$+O52!nugUW64(N6NP5_l)h_LM;=xeOm8ax7EDxAc%$eZz_a;&X1
zg~A8`FX~b5aD&!AXfC0ykCW=ciDicJO#(j)s|+$!%Mi{DR)uhi!%bH4gs1FD=I>rI
z7iH7a@-<37diSK^_HAhPf*YDi*vK8JLWYu6R%sXZ^+<QO(;>Gi+SroMv|S}NetAS;
zWthUImqOMHBRJNf2Vph?WTUN*mFCb}vC$Tzu6TdHU-{nwGJB`(iaW^F$`JY29`bpY
z;;S!jMq3xZ?TdSzlaABEmeox_1ZQ)%4Zu^l3Ix=mA>c_5@Ke0V$$3ziio$ppX`2^*
z`kF^g@L6eIVdD19kN_8X_#Z>HdEIN{`H#Jj--KK}giCn=r&m^_R}!+=R%1~Ebzi+z
zE!rj6YM<Q*Z`H$lagFOw>hUBvefMZ{8T?&MI`XNar?kehvri^nm*4Z~tZ<hx<>-Vb
z*XgVJD}}W}sB}>4_OSonV}CNc^G+?{&MZo`V-Mc~qa>>!0iS87&UytdHFqn?-JPN(
z{w^4ZrPH~O6-px<UiXF7s-aR3!Owf(^GXN1-gx}r(Zi(jSP!$Q|9=$Ng(m$8002bA
B<@f*q

literal 816
zcmV-01JC?HRzV<BZeeh9Xm4~Nb~6eC02-0V-iBhT%Cnfd;dR$q+gVA7`Mfl-a{T5`
zukbIv{~wD800000000AxmBDV)KoEvoA%x@`S2!?@RGd_`lOiOjQwNGDAVlGSkl=vS
z&F(nacC%~ktdmxV0~b!bM0rx=#Exy;R?TU5_K)YAe`oB=WULH7qd$MqNvH69z=-5T
z&rrJvghA521B<C*96`;Q$`GW6N+n6Nl%~efuS+4AV_$oBHtucYzs<WF_ctG=)^H>W
zQP0EIN3XuTg&2H?<osco^pQX%XVRgi2+Ww!&XJ%BwsX91<T&6)lTjEdGwGgqPy!1N
z;9wh!l@qC%+8!<U<rcO_-brr_F_<yOr@@?A$;JvPf@J^+W`-P4id-g=!&=a$8Z@Xn
zbt-?1j=?-H#%S0J2jRf4az87I4pNm(qz+8#q|vmx0nnzpf|URYK^tMwK#(^WQ`zeQ
zkjX5^8B5pe<K<dvt}=lh0G^kt)Z!eqJ6yLw-NmT5?to8`pGEMFX`zsy2!p#w5hfY4
zg7Q8pc=D%QQOxf~G3PRYZpVyIk-H9T#WDDq7MMtl!iUF?VSN_Iaka@0QfoxUbIVqT
zeiiV0@WTUW+*SQ_=>05f+bU=SZQNAqNmSx5uPBeSOPDuGm^RWd3Z(OUL+JMbNlEPj
zAt~>zKuL{WU7Y)75?Dwr%pw$qXSrwB{<nop&PqL@8gdb7BY$WhkLnappWKeNG{5SL
z{n||jNv4<XM!=LZ3#zvPI0It@2BoMC*lhql!1L5t2Lcn8DF+>?)69jZ)LAF*FNc?@
zfKQoaeD$88EY1H%P#i*a*iQMTk@9(7s{^AEV%WRZk%lEkW93F%0@Yu9g%?!_7Sc^`
zg*R#7eY;`myXCr<Px|W7>LQ=-VpEfc!hAL}Ty}Q1SD*5IhgLIt5ttM$bH>*Cs{BTf
z6bOY5O5GLg-y7_o`aA!52|Il+k(M01077oGfC$`FS}|-GywvO#lHHY}B7T_<5OFJ0
u7YO8vS-k1{R;i&-x4}mZ@Ij%2Rd0MeJU)tw8Eas!{r?9!_sxEL2LJ%RnuzuQ


From 4b69e438fe96e7ba079740763603fc67092a0c65 Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Wed, 29 Oct 2025 13:10:23 +0000
Subject: [PATCH 2/2] test: update snapshots

---
 packages/replace/test/snapshots/form.js.md   |   3 ++-
 packages/replace/test/snapshots/form.js.snap | Bin 979 -> 989 bytes
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/replace/test/snapshots/form.js.md b/packages/replace/test/snapshots/form.js.md
index 895062192..28d0fe39c 100644
--- a/packages/replace/test/snapshots/form.js.md
+++ b/packages/replace/test/snapshots/form.js.md
@@ -24,7 +24,8 @@ Generated by [AVA](https://avajs.dev).
 
 > Snapshot 1
 
-    `// Should NOT be replaced - window$1 is a different identifier␊
+    `/* eslint-disable no-undef */␊
+    // Should NOT be replaced - window$1 is a different identifier␊
     if (typeof window$1 === 'undefined') {␊
       console.log('no window$1');␊
     }␊
diff --git a/packages/replace/test/snapshots/form.js.snap b/packages/replace/test/snapshots/form.js.snap
index 9f9e1760d85f66081dc00418b91cb7ab9fd72947..727ba7b9fd47d860e4cf347462b788bb0911d173 100644
GIT binary patch
literal 989
zcmV<310wuERzV<BZeeh9Xm4~Nb~6eC0I!)sI41@Ty9yyX#(Y$qvEh$qkfXX4xuTS+
z@wG&wM<0s_00000000A(md}sdL=?xjix84;T;b5yh;5Qp?PL)W)Y~i+Q9y{chf=9M
zpms9z98Wu$vF44FjSvSe-1sBPUy8=@k8z#dE;-GQZ~Q**`F&^nE?X+Y-_k$-qLWVH
z<(v`8m0qKEDF}n4#||tOig5(BVX8!s8akCE%?iqmqrct>!5n)r{pjeEBmcYg@zJNZ
zJ}<1{NR*)7BtJa*{`pU^fU!ez<MSryZGlRzr9(?8m?fdzAVIe{jPXk^#sh9N8HI^5
ztI6vK8ekCtJU9Vk<w|O%PA;l>Gli3j==HRPcrJ`m%*H;kcxg&4nBAp7xha(ZZMrgS
zbJUO-rOXxuEO)SBN(zv|mm`yCf#=LJeh~fTaT2m0-#(t50+N#2#X=HWDg<rfQVY!B
zbQaBK@NAFp<mqp)#5OmGVJo#T+b_;Q5-<=l%g~~B0ZAk?n7CbmChOFT#RA4v0I5-o
zr|?Gv5SDPPO{*SH&!a!10HcpUj%mS^(FmjVk)tYXF#kUx2LZ3j`_<KH0}K;?1$RCO
zkuz%4AILjQE^Gy1+%R+^3@^P|ZivvxD~8sYYvy<!Z<v+7NhpPC0SVTI98iH=W|BiI
z7`kTObIqt1cZrU{#&@jIaF)!I`MC4O*R?6*LX|72V^cV3H0@7_o;UUas0BlWZ4W_S
zW8BXE5dfLea$K{b9Y3zdQgc-bi~#Vm85I^csNKW%hzebv*2huIbL4MR_?c;;kf2@$
z|K4C#GAqcRb2X2D%7JA5?j>_sHN9EBLGDKHziGI87ur4VhIZmN3Ts5keaUL8bPI=i
zB-{-;<W5Z+YvXdMS80P^y&}IdOkvYYA@7A@6ieTOFq^%1Ld8mIj6(6@e!ud+17vbm
z>J<gZ^~w<W*B<gkNb%K|H=}Ke-}S});7!L_sjKRyz`V05Yy)t{9|a5=(GYOb1N;mx
z3u7G!%vh-$jHE6~m%O1-8+=xom#MhBH&URo@c$#IH?O-?Ui{b#`Hj!jfj^WNaCT)y
zdL=O$yJ{>Npzva@Ytb#iR=WH~c&i@X%WGUeX~t9U^!=mN&ilKb1oA|fXJ(C6XHTY~
z%kMk1n%P}!3bf1_8}wE44MS2O)H-N%2iSk_u|FN&)~B;5la?HO3xwQg0V%j#T5;Yh
zaHY9dOYZFz9r1VGK*X&qTr7|)X7Rf3uTBlMdI)~e1E1GA*!RYhhmRknwa0pxZT<fP
LgD})<8wvmbOkmyb

literal 979
zcmV;^11$VORzV<BZeeh9Xm4~Nb~6eC0BhbX(=sYyfNt-dZ)BK?ugMc@QE_`oRpb7J
zhnVGq*B^@r00000000A(mQ9ZvMG%H}7a^oM!4(cvEH++88QY7HAhYp85CMcpatM)<
z14`Q6HJ(n|U8AlZdsm197jFEB@JmsT=QHEoEI#$e>#3)z>+PAh>C%vV!~gt?UVDQV
zbHS`vc8%62pa|KHJvhvbkO*cYOo5;+v?|S3<eZV`zuqb(ym&tO;NYW!@H_nQ;FH78
zaz_%Gr)W3RA0B@H>?c^j*dzP#SsnCqg+{NnN5=`!lF@CDp<Nut_@x))z9h?JaB66E
z@+yKFSVaK$kAa+CX)Da}c{#7AaC{!Unlup46d5C291@F{R9Ge4WdfX0VH8+u%dpMR
zLQ2Na78NWnVIz!Ipj9YGs?mYWgcEWv`irBFyX;4YN3$6`-3594<TqGiLk}@*wN<qJ
z;uJK40HxCu9a`Us73maC{AG@mw(7-V0pr3dOtnQdp1>awK(|O^OO1LwIg9>`q86i%
zz+PA-3|WLx^T<&dwln`fAqN4k%KPQjX#)%se+jqV3y}$~)$hr>n_Ty>75QQ4sUlef
zJKPYVmX{2T_twJ8EZzvG#nK=rP%a?Dn%D#9D0QkOG=iZo<~?7GdU2QN1#Ci3l7-Xh
zd^#Vu-T!rEyEr$+O52!nugUW64(N6NP5_l)h_LM;=xeOm8ax7EDxAc%$eZz_a;&X1
zg~A8`FX~b5aD&!AXfC0ykCW=ciDicJO#(j)s|+$!%Mi{DR)uhi!%bH4gs1FD=I>rI
z7iH7a@-<37diSK^_HAhPf*YDi*vK8JLWYu6R%sXZ^+<QO(;>Gi+SroMv|S}NetAS;
zWthUImqOMHBRJNf2Vph?WTUN*mFCb}vC$Tzu6TdHU-{nwGJB`(iaW^F$`JY29`bpY
z;;S!jMq3xZ?TdSzlaABEmeox_1ZQ)%4Zu^l3Ix=mA>c_5@Ke0V$$3ziio$ppX`2^*
z`kF^g@L6eIVdD19kN_8X_#Z>HdEIN{`H#Jj--KK}giCn=r&m^_R}!+=R%1~Ebzi+z
zE!rj6YM<Q*Z`H$lagFOw>hUBvefMZ{8T?&MI`XNar?kehvri^nm*4Z~tZ<hx<>-Vb
z*XgVJD}}W}sB}>4_OSonV}CNc^G+?{&MZo`V-Mc~qa>>!0iS87&UytdHFqn?-JPN(
z{w^4ZrPH~O6-px<UiXF7s-aR3!Owf(^GXN1-gx}r(Zi(jSP!$Q|9=$Ng(m$8002bA
B<@f*q