fhirpath 0.2.0.pre1

data/docs/first-slice.md

@@ -0,0 +1,57 @@
+# FHIRPath first parity slice
+
+Status: implemented prototype slice
+Target: normative FHIRPath 2.0.0 core expressions
+
+This slice exercises the complete Ruby path from source text through lexer/parser, immutable AST, per-evaluation context, and collection-first evaluator. It is intentionally a small compatibility slice, not a complete FHIRPath implementation.
+
+## Supported behavior
+
+- Boolean, string, integer, decimal, and scientific-notation numeric literals
+- Empty and comma-separated collection literals (`{}` and `{1, 2}`)
+- Parentheses and unary `+`/`-`
+- Numeric `+`, `-`, `*`, `/`, `div`, and `mod`; string `+` and `&` concatenation semantics
+- Numeric and string relational comparisons (`<`, `<=`, `>`, `>=`)
+- Collection-aware equality (`=`, `!=`) and equivalence (`~`, `!~`), including order-independent duplicate matching
+- Union (`|`) and string concatenation (`+` propagates empty operands; `&` treats empty operands as `''`)
+- Membership (`in`, `contains`) and built-in primitive type operators (`is`, `as`)
+- Empty-aware `and`, `or`, `xor`, and `implies`
+- Plain Hash/Array/object member navigation with collection flattening
+- Expression indexers, including empty, out-of-range, and singleton/type checks
+- `where`, `select`, `first`, `exists`, `count`, `empty`, `not`, `all`, and Boolean aggregate functions
+- `$this`, `$index`, and `$total` focus variables inside delayed predicates
+- `%name` external constants through the existing variable/host boundary
+- Complete-input parsing with source spans on syntax and evaluation errors, comments, and strict Unicode escapes
+- Reusable compiled expressions with no retained resource or evaluation context
+
+Every public evaluation returns `FHIRPath::Collection`; `evaluate_first` remains the explicit scalar convenience API.
+
+## Intentional deviations and deferrals
+
+- Union, string concatenation, membership, and primitive type operators are implemented for the supported built-in value subset; complex types and FHIR model metadata remain deferred.
+- Equivalence normalizes case and runs of whitespace for strings and rounds numeric operands to their least precise decimal place. Full equivalence semantics for all FHIRPath types remain deferred with the broader value system.
+- Division always produces an exact `BigDecimal`; temporal, quantity, UCUM, and advanced numeric semantics are deferred.
+- Empty arithmetic and relational operands return the empty collection. Empty equality follows FHIRPath's empty-aware result policy; equivalence of two empty collections returns `true`.
+- dependency-free FHIR R4 JSON choice navigation for `Observation.value[x]`;
+- broader FHIR-specific model metadata, primitive extensions, terminology, `resolve()`, temporal/quantity values, advanced functions, and the official shared-suite importer remain deferred.
+- Trial-use FHIRPath 3.0 features remain disabled by the normative 2.0.0 capability.
+
+## Verification
+
+Focused coverage is in `test/parity_slice_test.rb`; the existing foundation tests were updated where expression indexers now accept the standard expression form. The slice covers successful arithmetic/comparison/logic, empty propagation, nested predicate focus, index validation, type and singleton errors, malformed/trailing input, unsupported operators, compiled-expression reuse, and plain-model end-to-end navigation.
+
+Run:
+
+```sh
+bundle exec rake test
+bundle exec rubocop
+git diff --check
+```
+
+## Compatibility references
+
+- HL7 FHIRPath specification: https://raw.githubusercontent.com/HL7/FHIRPath/master/input/pages/index.md
+- HL7 FHIRPath grammar: https://raw.githubusercontent.com/HL7/FHIRPath/master/input/images/fhirpath.g4
+- HL7 FHIRPath shared tests: https://raw.githubusercontent.com/HL7/FHIRPath/master/input/pages/tests.md
+- fhirpath-py public API: https://raw.githubusercontent.com/beda-software/fhirpath-py/master/fhirpathpy/__init__.py
+- fhirpath-py evaluator and invocation registry: https://raw.githubusercontent.com/beda-software/fhirpath-py/master/fhirpathpy/engine/__init__.py

data/docs/release-checklist.md

@@ -0,0 +1,57 @@
+# Release checklist
+
+This checklist is the gate for a reusable public release. It is intentionally explicit because a successful gem build is not the same as a legally releasable or conformant package.
+
+## Current assessment (`0.2.0.pre1`)
+
+| Criterion | Status | Evidence / rationale |
+|---|---|---|
+| `require "fhirpath"` from a clean install | Met | `script/verify_gem_install.sh` and API tests |
+| Documented parse/compile/evaluate API | Met | `README.md`, `docs/api.md` |
+| Explicit supported Ruby policy | Met | gemspec and CI matrix target Ruby 3.2/3.3; publication contract is `docs/support-matrix.md` |
+| Exact FHIRPath target and capability set in package metadata | Met | `Capability.current`, gemspec metadata, and `script/verify_release.rb` |
+| Tests, static checks, package build in CI | Met | `.github/workflows/ci.yml` |
+| Reproducible checked-in vector workflow | Met | `docs/conformance.md`, `conformance/core.jsonl` |
+| Coverage summary | Met | `COVERAGE=1` test workflow and `script/check_coverage.rb` |
+| Tagged release workflow and checksummed assets | Met | `.github/workflows/release.yml` and `docs/releasing.md` |
+| RubyGems publication and external readback | Ready | Trusted Publishing environment gate and `gem push`; requires one-time RubyGems publisher setup |
+| Contributor and security guidance | Met | `CONTRIBUTING.md`, `SECURITY.md` |
+| Changelog/release notes | Met | `CHANGELOG.md` and this checklist |
+| Complete official HL7 shared-suite conformance | Partial | importer and full suite remain deferred |
+| FHIR release model adapter | Partial | `PlainModel` only; adapters are host-dependent |
+| License selected and encoded in package metadata | Met | MIT License text is checked in at `LICENSE`; `fhirpath.gemspec` declares `MIT` |
+| RubyGems/public reusable release | Pre-release only | The workflow permits prerelease tags; stable promotion remains blocked by the channel and incomplete conformance/model gates |
+
+## Required before publication
+
+- Audit runtime and development dependency licenses and any future grammar/fixture provenance.
+- Confirm the supported Ruby matrix and run it on the tagged source revision.
+- Build from a clean committed checkout; inspect gem contents and metadata.
+- Run the complete tests, RuboCop, vectors, coverage, and gem-install smoke test.
+- Generate release notes with scope, limitations, conformance counts, known host/model exclusions, and checksum/provenance.
+- Create a reviewed version tag and use `.github/workflows/release.yml` with the approved `release` environment; do not publish from a dirty tree.
+- Verify the RubyGems readback, pushed commit, tag, GitHub release metadata, and uploaded artifacts after each external action.
+
+The license decision is complete. This implementation adds the gated workflow,
+but does not commit, push, create a tag, or publish a release.
+
+## Integration countercheck (2026-09-05)
+
+The post-hardening working tree was independently reviewed against the HL7 FHIRPath operator documentation and exercised locally. This pass corrected two implementation gaps: `&` now treats an empty operand as `''`, and relational/union/type parser precedence now follows the normative ordering. The nonstandard `\\UXXXXXXXX` string escape is rejected; valid UTF-16 `\\uXXXX` surrogate pairs are combined.
+
+Verification on Homebrew Ruby 4.0.4 (the repository's local bundle contains native extensions for this runtime):
+
+- `bundle exec rake test`: 50 runs, 191 assertions, 0 failures, 0 errors, 0 skips;
+- `bundle exec rubocop`: 31 files inspected, no offenses;
+- `bundle exec rake vectors`: 8 total, 8 pass, 0 defect, 0 unsupported, 0 host-dependent, 0 not-run;
+- `bundle exec rake build`: `pkg/fhirpath-0.2.0.pre1.gem` built;
+- `script/verify_gem_install.sh`: clean isolated install and `1 + 2` smoke test passed;
+- `COVERAGE=1 bundle exec rake test` plus `script/check_coverage.rb`: 88.9% (829/932 executable lines); and
+- `git diff --check`: passed.
+
+The project is usable as a clearly scoped MIT-licensed pre-release core slice,
+but it is not yet a complete FHIRPath implementation or production release.
+The official HL7 shared-suite importer, temporal/quantity semantics, FHIR model
+adapters, and broader standard function families remain explicitly deferred.
+No commit, push, tag, publication, or external repository setting change was
+performed.

data/docs/releasing.md

@@ -0,0 +1,87 @@
+# Releasing FHIRPath for Ruby
+
+This document defines the versioning, release-gate, RubyGems, and GitHub
+publication workflow. Publication is performed only from a reviewed, pushed
+tag; the release workflow never packages a dirty local checkout.
+
+## Versioning policy
+
+- The gem name is `fhirpath` and tags use the form `vVERSION`.
+- Versions follow RubyGems-compatible Semantic Versioning. While the API and
+  conformance surface are pre-1.0, use `0.MINOR.PATCH` and a prerelease suffix
+  such as `0.1.0.pre1` for published previews.
+- `lib/fhirpath/version.rb`, `CHANGELOG.md`, and the release tag must agree.
+- `FHIRPath::RELEASE_CHANNEL` remains `pre-release` until the complete
+  promotion decision is made. The release verifier rejects a stable-looking
+  version while that channel is still pre-release.
+- Every release updates the `Unreleased` section into a dated version section,
+  adds the comparison link, and preserves explicit supported, unsupported, and
+  host-dependent behavior.
+
+## Required gates
+
+A release tag advances only when all of these checks pass on the tagged source:
+
+1. Ruby 3.2 and Ruby 3.3 CI matrix;
+2. full Minitest suite and RuboCop;
+3. checked-in compatibility vectors, with no `defect` or `not-run` cases;
+4. coverage generation and summary validation;
+5. `gem build` from the tag;
+6. isolated local installation and `1 + 2` API smoke test;
+7. package metadata verification, including version, MIT license, exact
+   FHIRPath target, capability set, release status, and support-matrix URI;
+8. release notes generated from the feature/support matrix and current vector
+   evidence; and
+9. a SHA-256 manifest covering the published gem and conformance report.
+
+Unsupported and host-dependent behavior may remain in a pre-release, but it
+must be listed in the support matrix and release notes. A defect or silently
+skipped case is a hard failure.
+
+## RubyGems publication
+
+The `publish` job supports two authentication modes:
+
+1. **Repository API key (default when configured):** store the owner's RubyGems
+   API key as the `RUBYGEMS_API_KEY` repository secret (`gh secret set
+   RUBYGEMS_API_KEY --repo niccoreyes/fhirpath-ruby`). The workflow passes it as
+   `GEM_HOST_API_KEY` and runs `gem push` directly.
+2. **RubyGems Trusted Publishing (fallback):** when the secret is absent, the
+   workflow configures short-lived OIDC credentials and pushes with them.
+   Configure a pending trusted publisher (for a new gem) or a trusted publisher
+   (for an existing gem) with:
+
+- owner: `niccoreyes`;
+- repository: `fhirpath-ruby`;
+- workflow name: `Release`;
+- environment: `release`.
+
+The workflow's `publish` job has only `id-token: write` and read access to
+repository contents. It downloads the exact artifact produced by the gated
+package job, pushes the exact gem, and reads the RubyGems API back until the
+exact version is visible.
+
+## GitHub release publication
+
+After RubyGems confirms the exact version, the workflow creates a GitHub release
+for the existing tag and attaches:
+
+- the `.gem` artifact;
+- `SHA256SUMS.txt`; and
+- the JSON compatibility/conformance report.
+
+The generated notes include the FHIRPath target, capability set, supported
+behavior, explicit unsupported/deferred behavior, host-dependent behavior,
+verification evidence, and artifact provenance. The GitHub release is marked
+as a prerelease while the gem version is prerelease.
+
+## Manual operator procedure
+
+1. Update `lib/fhirpath/version.rb` and the `Unreleased` changelog section.
+2. Run every command in `CONTRIBUTING.md`, inspect the gem contents, and review
+   `docs/support-matrix.md` and `docs/release-checklist.md`.
+3. Open and merge the review PR; do not tag an unreviewed or dirty checkout.
+4. Create and push the matching `vVERSION` tag from the reviewed commit.
+5. Approve the `release` environment if required by repository settings.
+6. Verify the workflow, RubyGems version, GitHub release, assets, checksums, and
+   notes. If any external readback disagrees, stop and investigate before retrying.

data/docs/support-matrix.md

@@ -0,0 +1,102 @@
+# Release support matrix
+
+Status: `pre-release` (`0.2.0.pre1`)
+
+This is the release-facing support matrix. It is deliberately narrower than
+"FHIRPath-compatible": every supported claim must have executable evidence, and
+every deferred or host-dependent behavior remains a limitation in release notes.
+The detailed behavior table is maintained in [`feature-matrix.md`](feature-matrix.md).
+
+## Language and package declaration
+
+| Field | Declared value |
+|---|---|
+| Gem | `fhirpath` |
+| Normative FHIRPath target | `2.0.0` |
+| Release channel | `pre-release` |
+| License | MIT |
+| Supported Ruby CI matrix | Ruby `3.2`, Ruby `3.3` |
+| Model support | Model-independent plain Ruby Hash/Array/object navigation plus dependency-free FHIR R4 JSON adapter |
+| FHIR model releases | R4 (`4.0.1`), selectable with `model: :r4` |
+| Trial-use features | One declared exception only: the FHIRPath 3.0 STU3 aggregate functions `sum`/`avg`/`max`/`min`, shipped by default in the standard registry (see [Declared STU3-subset exception](#declared-stu3-subset-exception)) |
+
+The packaged gem repeats the target and capability declaration in gem metadata:
+`fhirpath_target`, `capability_set`, `release_status`, and
+`support_matrix_uri`. `FHIRPath::Capability.current` is the runtime source for
+the same target and capability-set values.
+
+## Published capability set
+
+These stable identifiers describe the behavior included in the current package:
+
+- `parser` — complete-input parsing, immutable AST nodes, and source spans;
+- `immutable-ast` — immutable parse/compile boundaries;
+- `collection-evaluation` — explicit empty, singleton, and multi-item results;
+- `plain-model-navigation` — Hash, Array, and safe simple-object navigation;
+- `primitive-values` — strings, Booleans, integers, decimals, and scientific notation;
+- `arithmetic` — unary/numeric arithmetic and string `+`;
+- `comparison-and-equivalence` — relational comparison, equality, and equivalence;
+- `boolean-logic` — empty-aware Boolean operators;
+- `union-membership-and-type-operators` — union, `in`, `contains`, `is`, and `as`;
+- `collection-functions` — `where`, `select`, `first`, `exists`, `count`, `empty`, `not`, `all`, and Boolean aggregates;
+- `focus-variables` — `$this`, `$index`, and `$total`;
+- `external-constants` — explicitly supplied `%name` values;
+- `custom-functions` — explicitly registered functions;
+- `compiled-expression-reuse` — immutable reusable compiled expressions; and
+- `structured-errors` — typed errors with machine-readable codes and source spans.
+
+### Declared STU3-subset exception
+
+The normative target stays FHIRPath `2.0.0` and the published capability set
+above stays unchanged, but the standard registry ships one STU3 subset by
+default as a deliberate, documented exception:
+
+- the FHIRPath 3.0.0 STU3 aggregate functions `sum()`, `avg()`, `max()`, and
+  `min()` (published 2026-07-28; absent from normative 2.0.0, which contains
+  only `count()`, and absent from the 3.0.0 ballot);
+- `FHIRPath::Capability.current` keeps `fhirpath: '2.0.0'` and reports this
+  subset in `trial_use` under the marker `stu3-aggregate-functions`, so the
+  capability report (`Capability#to_h`) always names the STU3 behavior it
+  ships and never folds it silently into the normative claims;
+- `trial_use` is a surface declaration, not a registry gate: the marker does
+  not disable or enable functions in `FHIRPath::FunctionRegistry.standard`.
+  A caller that needs a hard 2.0.0-only function set must supply its own
+  registry built without the aggregate functions; that enforcement is not
+  implemented in the current capability surface.
+
+The functions are supported; see [`feature-matrix.md`](feature-matrix.md) for
+behavioral evidence and [`docs/api.md`](api.md) for the runtime declaration.
+
+## Explicitly unsupported or deferred
+
+The release must continue to state these limitations:
+
+- complete official HL7 shared-suite conformance and its importer;
+- date/time literals and values;
+- quantity and UCUM semantics;
+- advanced conversion, math, string, regular-expression, and navigation functions, and the general-purpose `aggregate()` function;
+- complex literals and additional standard value types;
+- standard environment variables beyond explicitly supplied external constants;
+- FHIRPath `3.0` STU3 features beyond the declared `stu3-aggregate-functions` subset; and
+- network I/O and global evaluator state in the pure evaluation boundary.
+
+## Host-dependent behavior
+
+The gem bundles the dependency-free R4 JSON adapter described above. Callers
+must supply and validate these remaining adapters or services at the host
+boundary before claiming support:
+
+- FHIR R5 and broader release-specific model adapters;
+- broader choice-element metadata and primitive extensions; and
+- `resolve()` and terminology services.
+
+## Evidence and promotion policy
+
+Each tagged release runs the Ruby 3.2/3.3 matrix, tests, RuboCop, checked-in
+compatibility vectors, package build, isolated installed-gem smoke test, and
+coverage validation. Defect or silently skipped vector cases fail the release;
+unsupported and host-dependent cases are retained as classified evidence.
+
+The project remains pre-release until the release channel is deliberately
+promoted after the official conformance and remaining model/host gates are
+resolved. A successful build alone never changes the support claims.

data/lib/fhirpath/ast.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+module FHIRPath
+  module AST
+    class Node
+      attr_reader :span
+
+      def initialize(span:)
+        @span = span
+        freeze
+      end
+    end
+
+    class Literal < Node
+      attr_reader :value
+
+      def initialize(value:, span:)
+        @value = freeze_value(value)
+        super(span: span)
+      end
+
+      private
+
+      def freeze_value(value)
+        case value
+        when Array
+          value.map { |item| freeze_value(item) }.freeze
+        when Hash
+          value.each_with_object({}) do |(key, item), copy|
+            copy[freeze_value(key)] = freeze_value(item)
+          end.freeze
+        when String
+          value.dup.freeze
+        else
+          value
+        end
+      end
+    end
+
+    class CollectionLiteral < Node
+      attr_reader :elements
+
+      def initialize(elements:, span:)
+        @elements = Array(elements).dup.freeze
+        super(span: span)
+      end
+    end
+
+    class Identifier < Node
+      attr_reader :name
+
+      def initialize(name:, span:)
+        @name = name.freeze
+        super(span: span)
+      end
+    end
+
+    class Variable < Node
+      attr_reader :name
+
+      def initialize(name:, span:)
+        @name = name.freeze
+        super(span: span)
+      end
+    end
+
+    class ExternalConstant < Node
+      attr_reader :name
+
+      def initialize(name:, span:)
+        @name = name.freeze
+        super(span: span)
+      end
+    end
+
+    class MemberInvocation < Node
+      attr_reader :receiver, :name
+
+      def initialize(receiver:, name:, span:)
+        @receiver = receiver
+        @name = name.freeze
+        super(span: span)
+      end
+    end
+
+    class Indexer < Node
+      attr_reader :receiver, :index
+
+      def initialize(receiver:, index:, span:)
+        @receiver = receiver
+        @index = index
+        super(span: span)
+      end
+    end
+
+    class FunctionInvocation < Node
+      attr_reader :receiver, :name, :arguments
+
+      def initialize(receiver:, name:, arguments:, span:)
+        @receiver = receiver
+        @name = name.freeze
+        @arguments = Array(arguments).dup.freeze
+        super(span: span)
+      end
+    end
+
+    class UnaryExpression < Node
+      attr_reader :operator, :operand
+
+      def initialize(operator:, operand:, span:)
+        @operator = operator.to_sym
+        @operand = operand
+        super(span: span)
+      end
+    end
+
+    class BinaryExpression < Node
+      attr_reader :left, :operator, :right
+
+      def initialize(left:, operator:, right:, span:)
+        @left = left
+        @operator = operator.to_sym
+        @right = right
+        super(span: span)
+      end
+    end
+  end
+end

data/lib/fhirpath/capability.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module FHIRPath
+  # Immutable declaration of the language and host features in use.
+  class Capability
+    CAPABILITY_SET = %w[
+      parser immutable-ast collection-evaluation plain-model-navigation
+      primitive-values arithmetic comparison-and-equivalence boolean-logic
+      union-membership-and-type-operators collection-functions focus-variables
+      external-constants custom-functions compiled-expression-reuse fhir-r4-model
+      structured-errors
+    ].freeze
+
+    # Named FHIRPath 3.0.0 STU3 subset the standard registry ships by default.
+    # `Capability.current` reports it in `trial_use` (not in `capability_set`),
+    # so the capability report never mixes STU3 behavior silently into the
+    # normative 2.0.0 claims: `fhirpath` stays `2.0.0` and the capability set
+    # above stays unchanged. The marker declares the shipped surface; it does
+    # not gate `FunctionRegistry.standard` (see docs/api.md Capability).
+    STU3_AGGREGATE_FUNCTIONS = 'stu3-aggregate-functions'
+
+    attr_reader :fhirpath, :trial_use, :model_releases, :host_features, :capability_set
+
+    def self.current
+      @current ||= new
+    end
+
+    def initialize(fhirpath: '2.0.0', trial_use: [STU3_AGGREGATE_FUNCTIONS], model_releases: ['R4'], host_features: [],
+                   capability_set: CAPABILITY_SET)
+      @fhirpath = fhirpath.to_s.freeze
+      @trial_use = Array(trial_use).map(&:to_s).freeze
+      @model_releases = Array(model_releases).map(&:to_s).freeze
+      @host_features = Array(host_features).map(&:to_s).freeze
+      @capability_set = Array(capability_set).map(&:to_s).freeze
+      freeze
+    end
+
+    def supports?(feature)
+      trial_use.include?(feature.to_s) || host_features.include?(feature.to_s) ||
+        supports_model?(feature)
+    end
+
+    def supports_model?(release)
+      model_releases.any? { |configured_release| configured_release.casecmp?(release.to_s) }
+    end
+
+    def to_h
+      {
+        fhirpath: fhirpath,
+        capability_set: capability_set,
+        trial_use: trial_use,
+        model_releases: model_releases,
+        host_features: host_features
+      }
+    end
+  end
+end

data/lib/fhirpath/collection.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module FHIRPath
+  # Ordered FHIRPath collection. Empty is represented by an object, not nil.
+  class Collection
+    include Enumerable
+
+    def self.empty
+      new
+    end
+
+    def self.from(value)
+      return value if value.is_a?(self)
+      return empty if value.nil?
+
+      new(value.is_a?(Array) ? value : [value])
+    end
+
+    attr_reader :items, :types
+
+    def initialize(items = [], types: nil)
+      @items = flatten_items(Array(items)).freeze
+      @types = validate_types(types, @items.length)
+      freeze
+    end
+
+    def each(&block)
+      return enum_for(:each) unless block
+
+      items.each(&block)
+    end
+
+    def empty?
+      items.empty?
+    end
+
+    def singleton?
+      items.length == 1
+    end
+
+    def singleton!
+      return items.first if singleton?
+
+      raise SingletonError
+    end
+
+    def first_item
+      items.first
+    end
+
+    def count
+      items.length
+    end
+
+    def to_a
+      items.dup
+    end
+
+    def +(other)
+      Collection.new(items + Collection.from(other).items)
+    end
+
+    def map_items(&block)
+      Collection.new(map(&block).flat_map { |value| Collection.from(value).items })
+    end
+
+    def inspect
+      "#<#{self.class} #{items.inspect}>"
+    end
+
+    private
+
+    # Optional positional model-type metadata parallel to +items+ (entries are
+    # logical type names or nil). Without metadata the collection behaves
+    # exactly as before; item values are never wrapped or altered.
+    def validate_types(types, length)
+      return nil if types.nil?
+
+      raise ArgumentError, 'types must match the number of items' unless types.length == length
+
+      types.freeze
+    end
+
+    def flatten_items(values)
+      values.each_with_object([]) do |value, flattened|
+        if value.is_a?(Array)
+          flattened.concat(flatten_items(value))
+        else
+          flattened << value
+        end
+      end
+    end
+  end
+end

data/lib/fhirpath/compiled_expression.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module FHIRPath
+  # Reusable immutable parse/evaluation boundary.
+  class CompiledExpression
+    attr_reader :source, :parsed, :ast, :model, :functions, :capability
+
+    def initialize(parsed:, model:, functions:, capability:)
+      @parsed = parsed
+      @source = parsed.source
+      @ast = parsed.ast
+      @model = model
+      @functions = functions
+      @capability = capability
+      freeze
+    end
+
+    def evaluate(resource, variables: {}, host: nil, options: {})
+      context = EvaluationContext.new(
+        root: resource,
+        variables: variables,
+        model: model,
+        host: host,
+        functions: functions,
+        capability: capability,
+        options: options.merge(expression: source)
+      )
+      Evaluator.new.evaluate(ast, context)
+    end
+
+    def call(resource, **kwargs)
+      evaluate(resource, **kwargs)
+    end
+  end
+end